Analysis
-
max time kernel
2679s -
max time network
2661s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
04-02-2023 18:08
Behavioral task
behavioral1
Sample
pyinstaller-win32.zip
Resource
win10v2004-20221111-en
General
-
Target
pyinstaller-win32.zip
-
Size
32.4MB
-
MD5
9f91073cd545613e9fa3593780bbb591
-
SHA1
72fa93d9ff6db3d7531ce867bcb56678899c7517
-
SHA256
ef50776ce3a231937d2933ec928629c663f1a39f00cc1d1648a100b144ba614c
-
SHA512
37faf419e4786d544d2c65f2dff93d4cc5f869687891101219077ef5b7d8e2e723ab698aa42f399cdb4a52e3e2f9d7691bad3daa51f97d95a00d7dae294e497a
-
SSDEEP
786432:F2eLVjOPCE8RmA8tWp3uTRS452QU/ogbNjJnR/fn+yx6:TVywl8UhKS45UNxRnn+w6
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Programs\Python\Python311\NEWS.txt
http.server``
http
http.server
http.HTTPMethod
https://gitlab.com/warsaw/pynche
https://www.blake2.net/
https://github.com/python/peps/pull/689
https://invisible-island.net/ncurses/NEWS.html#index-t20170401
https://bugs.python.org/issue26903
https://mail.python.org/archives/list/[email protected]/thread/CLVXXPQ2T2LQ5MP2Y53VVQFCXYWQJHKZ/
https://www.openssl.org/docs/man1.1.1/man7/proxy-certificates.html
https://bugzilla.redhat.com/show_bug.cgi?id=1866884
http.client.putrequest
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=242274
http.client
https://www.w3.org/TR/xml/#sec-prolog-dtd
https://fishshell.com/docs/current/commands.html#source
httplib
http.client.InvalidURL
http://www.example.com
http.HTTPStatus(200
https://www.openssl.org/docs/man1.1.0/ssl/SSL_CTX_set_min_proto_version.html
https://docs.python.org/3/
https://python.visualstudio.com/cpython
https://sourceforge.net/p/expat/bugs/537/
https://github.com/libexpat/libexpat/issues/115
http.cookies
https://github.com/python/performance
http.client.HTTPConnection
https://github.com/python/typing
http.cookie.time2netscape
http.server.BaseHTTPRequestHandler.send_error
https://github.com/python/pythondotorg/issues/945
http.server._quote_html
http.client.RemoteDisconnected
http.server.test
http.client.HTTPConnection.request
http.cookies.Morsel
http.HTTPStatus
http.client.HTTPSConnection
http.cookies.SimpleCookie
http.client.HTTPConnection.set_tunnel
http://www.python.org/
https://www.python.org
Signatures
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
python-3.11.1-amd64.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation python-3.11.1-amd64.exe -
Executes dropped EXE 19 IoCs
Processes:
Satire Injector-decrypted.justify_fix_fix.exeSatire Injector-decrypted.exeSatire Injector-decrypted.justify.exeMegaDumper.exeSatire Injector.exepython-3.11.1-amd64.exepython-3.11.1-amd64.exepython-3.11.1-amd64.exepython.exepython.exepythonw.exepy.exepython.exepy.exepython.exepy.exepython.exepy.exepython.exepid process 3976 Satire Injector-decrypted.justify_fix_fix.exe 5656 Satire Injector-decrypted.exe 3952 Satire Injector-decrypted.justify.exe 2244 MegaDumper.exe 5876 Satire Injector.exe 1216 python-3.11.1-amd64.exe 1664 python-3.11.1-amd64.exe 1648 python-3.11.1-amd64.exe 4584 python.exe 4916 python.exe 5400 pythonw.exe 3304 py.exe 4144 python.exe 4364 py.exe 2216 python.exe 5220 py.exe 5312 python.exe 4608 py.exe 3480 python.exe -
Loads dropped DLL 54 IoCs
Processes:
Simple_MSIL_Decryptor.exeSimple_MSIL_Decryptor.exeSimple_MSIL_Decryptor.exepython-3.11.1-amd64.exeMsiExec.exepython.exepython.exepythonw.exepython.exepython.exepython.exepython.exepid process 4780 Simple_MSIL_Decryptor.exe 4780 Simple_MSIL_Decryptor.exe 5820 Simple_MSIL_Decryptor.exe 5820 Simple_MSIL_Decryptor.exe 5820 Simple_MSIL_Decryptor.exe 5820 Simple_MSIL_Decryptor.exe 4920 Simple_MSIL_Decryptor.exe 4920 Simple_MSIL_Decryptor.exe 4920 Simple_MSIL_Decryptor.exe 4920 Simple_MSIL_Decryptor.exe 4920 Simple_MSIL_Decryptor.exe 4920 Simple_MSIL_Decryptor.exe 4920 Simple_MSIL_Decryptor.exe 4920 Simple_MSIL_Decryptor.exe 1664 python-3.11.1-amd64.exe 4700 MsiExec.exe 4584 python.exe 4584 python.exe 4584 python.exe 4584 python.exe 4584 python.exe 4584 python.exe 4916 python.exe 4916 python.exe 4916 python.exe 4916 python.exe 4916 python.exe 4916 python.exe 4916 python.exe 4916 python.exe 4916 python.exe 4916 python.exe 4916 python.exe 4916 python.exe 4916 python.exe 4916 python.exe 4916 python.exe 4916 python.exe 4916 python.exe 4916 python.exe 4916 python.exe 4916 python.exe 4916 python.exe 5400 pythonw.exe 5400 pythonw.exe 4144 python.exe 4144 python.exe 2216 python.exe 2216 python.exe 1204 5312 python.exe 5312 python.exe 3480 python.exe 3480 python.exe -
Registers COM server for autorun 1 TTPs 4 IoCs
Processes:
msiexec.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32\ = "C:\\Windows\\pyshellext.amd64.dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32 msiexec.exe -
Adds Run key to start application 2 TTPs 7 IoCs
Processes:
msedge.exemsedge.exemsedge.exepython-3.11.1-amd64.exemsedge.exemsedge.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce python-3.11.1-amd64.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\{fca95908-8c70-405d-9e72-cd746e2f7786} = "\"C:\\Users\\Admin\\AppData\\Local\\Package Cache\\{fca95908-8c70-405d-9e72-cd746e2f7786}\\python-3.11.1-amd64.exe\" /burn.runonce" python-3.11.1-amd64.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops desktop.ini file(s) 2 IoCs
Processes:
Simple_MSIL_Decryptor (2).exedescription ioc process File created C:\Windows\assembly\Desktop.ini Simple_MSIL_Decryptor (2).exe File opened for modification C:\Windows\assembly\Desktop.ini Simple_MSIL_Decryptor (2).exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exedescription ioc process File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\K: msiexec.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
Processes:
VMUnprotect.Dumper.exeSatire Injector-decrypted.justify_fix_fix.exeSatire Injector-decrypted.exeSatire Injector-decrypted.justify.exeSatire Injector.exepid process 5668 VMUnprotect.Dumper.exe 5668 VMUnprotect.Dumper.exe 3976 Satire Injector-decrypted.justify_fix_fix.exe 5656 Satire Injector-decrypted.exe 3952 Satire Injector-decrypted.justify.exe 760 Satire Injector.exe 760 Satire Injector.exe -
Drops file in Program Files directory 2 IoCs
Processes:
description ioc process File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\57217822-3167-4388-bf9d-54717cb0873e.tmp File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230204190933.pma -
Drops file in Windows directory 64 IoCs
Processes:
Simple_MSIL_Decryptor.exeSimple_MSIL_Decryptor.exemsiexec.exeSimple_MSIL_Decryptor.exeSimple_MSIL_Decryptor (2).exeSimple_MSIL_Decryptor.exedescription ioc process File created C:\Windows\assembly\GACLock.dat Simple_MSIL_Decryptor.exe File created C:\Windows\assembly\tmp\705SDZUQ\Simple_MSIL_Decryptor.exe Simple_MSIL_Decryptor.exe File opened for modification C:\Windows\Installer\MSI9C2C.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC5EC.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log Simple_MSIL_Decryptor.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\e7d648d.msi msiexec.exe File created C:\Windows\assembly\tmp\7ZUDNL25\Simple_MSIL_Decryptor (2).exe Simple_MSIL_Decryptor (2).exe File created C:\Windows\Installer\SourceHash{E63D4F21-1B1F-43DC-9347-4FB51A71704C} msiexec.exe File created C:\Windows\Installer\SourceHash{5EB7FFE8-5B05-4DD3-9DE0-D0F20D93FA6C} msiexec.exe File opened for modification C:\Windows\Installer\{8A19B72D-62A8-4198-BEBD-CAEF117194C8}\ARPIcon msiexec.exe File opened for modification C:\Windows\Installer\MSI244C.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log Simple_MSIL_Decryptor.exe File created C:\Windows\Installer\SourceHash{5D1EFF51-4740-4E62-8E49-11C13DEC34C3} msiexec.exe File opened for modification C:\Windows\Installer\MSI8150.tmp msiexec.exe File opened for modification C:\Windows\Installer\e7d6486.msi msiexec.exe File created C:\Windows\Installer\e7d6489.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIE7BE.tmp msiexec.exe File opened for modification C:\Windows\assembly\tmp\VXZT0U4P\Simple_MSIL_Decryptor.exe Simple_MSIL_Decryptor.exe File opened for modification C:\Windows\assembly Simple_MSIL_Decryptor (2).exe File opened for modification C:\Windows\assembly\tmp\7ZUDNL25\Simple_MSIL_Decryptor (2).exe Simple_MSIL_Decryptor (2).exe File created C:\Windows\Installer\e7d647d.msi msiexec.exe File created C:\Windows\Installer\SourceHash{C5FAF3D9-A03D-4F6A-AAC9-87735DDA5DCF} msiexec.exe File opened for modification C:\Windows\Installer\e7d648a.msi msiexec.exe File created C:\Windows\py.exe msiexec.exe File opened for modification C:\Windows\Installer\e7d6492.msi msiexec.exe File created C:\Windows\assembly\GACLock.dat Simple_MSIL_Decryptor.exe File opened for modification C:\Windows\assembly\tmp\PBT4PRHZ\Simple_MSIL_Decryptor.exe Simple_MSIL_Decryptor.exe File created C:\Windows\assembly\Desktop.ini Simple_MSIL_Decryptor (2).exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log Simple_MSIL_Decryptor.exe File opened for modification C:\Windows\Installer\e7d647e.msi msiexec.exe File created C:\Windows\Installer\e7d648e.msi msiexec.exe File created C:\Windows\Installer\SourceHash{8A19B72D-62A8-4198-BEBD-CAEF117194C8} msiexec.exe File created C:\Windows\assembly\tmp\PBT4PRHZ\Simple_MSIL_Decryptor.exe Simple_MSIL_Decryptor.exe File opened for modification C:\Windows\Installer\e7d646e.msi msiexec.exe File created C:\Windows\Installer\e7d6471.msi msiexec.exe File created C:\Windows\Installer\e7d6472.msi msiexec.exe File created C:\Windows\Installer\e7d6486.msi msiexec.exe File created C:\Windows\Installer\e7d647e.msi msiexec.exe File created C:\Windows\Installer\SourceHash{EFFC2C23-AEE2-4867-998C-5F5A902496C0} msiexec.exe File created C:\Windows\Installer\e7d6491.msi msiexec.exe File created C:\Windows\assembly\tmp\VXZT0U4P\Simple_MSIL_Decryptor.exe Simple_MSIL_Decryptor.exe File created C:\Windows\assembly\GACLock.dat Simple_MSIL_Decryptor.exe File opened for modification C:\Windows\Installer\MSI66B0.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI6B74.tmp msiexec.exe File created C:\Windows\Installer\e7d6476.msi msiexec.exe File created C:\Windows\Installer\e7d6495.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIDBA8.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{66CA643F-68B2-4063-8F87-34D48A2C49ED} msiexec.exe File opened for modification C:\Windows\Installer\e7d648e.msi msiexec.exe File opened for modification C:\Windows\assembly\tmp\705SDZUQ\Simple_MSIL_Decryptor.exe Simple_MSIL_Decryptor.exe File created C:\Windows\Installer\e7d646e.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\e7d6476.msi msiexec.exe File created C:\Windows\Installer\e7d6481.msi msiexec.exe File created C:\Windows\pyw.exe msiexec.exe File created C:\Windows\Installer\e7d6492.msi msiexec.exe File created C:\Windows\Installer\SourceHash{592A8BDA-2DD1-4C98-86D1-72B14B0464FD} msiexec.exe File created C:\Windows\Installer\e7d648a.msi msiexec.exe File created C:\Windows\Installer\{8A19B72D-62A8-4198-BEBD-CAEF117194C8}\ARPIcon msiexec.exe File opened for modification C:\Windows\assembly\Desktop.ini Simple_MSIL_Decryptor (2).exe File created C:\Windows\Installer\SourceHash{A7DE96A8-2F75-44B2-B46E-5D50DE5B1B80} msiexec.exe File created C:\Windows\Installer\SourceHash{988799D6-A7CE-4F51-89AF-1E4A64FA7ECA} msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 28 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 1036 4780 WerFault.exe Simple_MSIL_Decryptor.exe 3492 4780 WerFault.exe Simple_MSIL_Decryptor.exe 5584 5820 WerFault.exe Simple_MSIL_Decryptor.exe 4060 5820 WerFault.exe Simple_MSIL_Decryptor.exe 4356 6008 WerFault.exe VMP_DeMutation.exe 6052 5092 WerFault.exe VMP_DeMutation.exe 3920 4920 WerFault.exe Simple_MSIL_Decryptor.exe 4604 4920 WerFault.exe Simple_MSIL_Decryptor.exe 5924 6048 WerFault.exe VMP_DeMutation.exe 5004 756 WerFault.exe VMP_DeMutation.exe 4936 4592 WerFault.exe VMP_DeMutation.exe 4528 4896 WerFault.exe VMP_DeMutation.exe 996 5888 WerFault.exe VMP_DeMutation.exe 1692 5688 WerFault.exe VMP_DeMutation.exe 4504 3020 WerFault.exe VMP_DeMutation.exe 6076 4440 WerFault.exe VMP_DeMutation.exe 2668 5160 WerFault.exe VMP_DeMutation.exe 2124 4264 WerFault.exe VMP_DeMutation.exe 3692 4280 WerFault.exe VMP_DeMutation.exe 5104 4292 WerFault.exe VMP_DeMutation.exe 4752 1536 WerFault.exe VMP_DeMutation.exe 444 600 WerFault.exe VMP_DeMutation.exe 3728 3852 WerFault.exe VMP_DeMutation.exe 2572 4368 WerFault.exe VMPKiller.exe 2472 2304 WerFault.exe VMP_DeMutation.exe 4356 3740 WerFault.exe VMP_DeMutation.exe 4804 1396 WerFault.exe VMP_DeMutation.exe 5984 3620 WerFault.exe VMP_DeMutation.exe -
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
vssvc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000106161d2e731958f0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000106161d20000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3f000000ffffffff000000000700010000680900106161d2000000000000d0120000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000106161d200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000106161d200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe -
Enumerates system info in registry 2 TTPs 15 IoCs
Processes:
msedge.exemsedge.exemsedge.exemsedge.exemsedge.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Modifies data under HKEY_USERS 3 IoCs
Processes:
msiexec.exedescription ioc process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f msiexec.exe -
Modifies registry class 64 IoCs
Processes:
python-3.11.1-amd64.exemsiexec.exeOpenWith.exemsedge.exeOpenWith.exemsedge.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Installer\Dependencies\{5D1EFF51-4740-4E62-8E49-11C13DEC34C3}\DisplayName = "Python 3.11.1 Core Interpreter (64-bit)" python-3.11.1-amd64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Python.ArchiveFile msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Installer\Dependencies\{5D1EFF51-4740-4E62-8E49-11C13DEC34C3}\Version = "3.11.1150.0" python-3.11.1-amd64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D27B91A88A268914EBDBACFE1117498C\AssociateFiles msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D27B91A88A268914EBDBACFE1117498C\Version = "51060553" msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Installer\Dependencies\{A7DE96A8-2F75-44B2-B46E-5D50DE5B1B80}\Version = "3.11.1150.0" python-3.11.1-amd64.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Installer\Dependencies\{A7DE96A8-2F75-44B2-B46E-5D50DE5B1B80}\Dependents python-3.11.1-amd64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.pyc\ = "Python.CompiledFile" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Python.NoConFile\Shell\editwithidle\shell\edit311\command msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConArchiveFile\shell\open\command\ = "\"C:\\Windows\\pyw.exe\" \"%L\" %*" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE} msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D27B91A88A268914EBDBACFE1117498C msiexec.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings msedge.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Python.NoConFile\Shell\editwithidle\shell\edit311 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Python.ArchiveFile\shell\open msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConArchiveFile\shell msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConArchiveFile\DefaultIcon\ = "\"C:\\Windows\\py.exe\",5" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Python.CompiledFile\DefaultIcon\ = "\"C:\\Windows\\py.exe\",2" msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Installer\Dependencies\{21EEFB31-6A96-4CAE-9A3B-B7FD6374C155}\Version = "3.11.1150.0" python-3.11.1-amd64.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Installer\Dependencies\{66CA643F-68B2-4063-8F87-34D48A2C49ED}\Dependents python-3.11.1-amd64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConArchiveFile\shell\open\command msiexec.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Installer\Dependencies\{5D1EFF51-4740-4E62-8E49-11C13DEC34C3}\Dependents python-3.11.1-amd64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConArchiveFile\shell\open msiexec.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings OpenWith.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D27B91A88A268914EBDBACFE1117498C\Language = "1033" msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Installer\Dependencies\{EFFC2C23-AEE2-4867-998C-5F5A902496C0}\ = "{EFFC2C23-AEE2-4867-998C-5F5A902496C0}" python-3.11.1-amd64.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Python.File msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Python.File\shell\open msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConArchiveFile msiexec.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Python.File\Shell\editwithidle\shell msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Python.CompiledFile\shellex\DropHandler msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Python.ArchiveFile\shellex\DropHandler msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.pyo\ = "Python.CompiledFile" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D27B91A88A268914EBDBACFE1117498C\SourceList\Net msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Installer\Dependencies\{C5FAF3D9-A03D-4F6A-AAC9-87735DDA5DCF}\DisplayName = "Python 3.11.1 pip Bootstrap (64-bit)" python-3.11.1-amd64.exe Key created \REGISTRY\MACHINE\Software\Classes\Python.Extension\DefaultIcon msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\.pyz msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Installer\Dependencies\{E63D4F21-1B1F-43DC-9347-4FB51A71704C}\DisplayName = "Python 3.11.1 Utility Scripts (64-bit)" python-3.11.1-amd64.exe Key created \REGISTRY\MACHINE\Software\Classes\Python.NoConFile msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.pyz\Content Type = "application/x-zip-compressed" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe Key created \REGISTRY\MACHINE\Software\Classes\Python.File\shell\open\command msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConFile\shell\open msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Python.CompiledFile\DefaultIcon msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Python.CompiledFile\shellex msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Python.Extension\DefaultIcon\ = "\"C:\\Windows\\py.exe\",3" msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Python.File\Shell\editwithidle\Subcommands msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Python.File\DefaultIcon\ = "\"C:\\Windows\\py.exe\",1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConFile\ = "Python File (no console)" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Python.CompiledFile\shell\open\command msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Installer\Dependencies\{592A8BDA-2DD1-4C98-86D1-72B14B0464FD}\DisplayName = "Python 3.11.1 Add to Path (64-bit)" python-3.11.1-amd64.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Installer\Dependencies\{EFFC2C23-AEE2-4867-998C-5F5A902496C0}\Dependents\{fca95908-8c70-405d-9e72-cd746e2f7786} python-3.11.1-amd64.exe Key created \REGISTRY\MACHINE\Software\Classes\Python.Extension msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Python.ArchiveFile msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Installer\Dependencies\CPython-3.11\DisplayName = "Python 3.11.1 (64-bit)" python-3.11.1-amd64.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Python.NoConFile\Shell msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Python.File\shell\open\command msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConFile\shellex\DropHandler msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D27B91A88A268914EBDBACFE1117498C\DeploymentFlags = "2" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Installer\Dependencies\{C5FAF3D9-A03D-4F6A-AAC9-87735DDA5DCF}\Dependents\{fca95908-8c70-405d-9e72-cd746e2f7786} python-3.11.1-amd64.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Installer\Dependencies\{21EEFB31-6A96-4CAE-9A3B-B7FD6374C155}\Dependents python-3.11.1-amd64.exe Key created \REGISTRY\MACHINE\Software\Classes\Python.NoConFile\shellex\DropHandler msiexec.exe -
NTFS ADS 2 IoCs
Processes:
msedge.exemsedge.exedescription ioc process File opened for modification C:\Users\Admin\Downloads\Unconfirmed 651771.crdownload:SmartScreen msedge.exe File opened for modification C:\Users\Admin\Downloads\Unconfirmed 816533.crdownload:SmartScreen msedge.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exemsedge.exeidentity_helper.exemsedge.exeMegaDumper.exepid process 1372 msedge.exe 1372 msedge.exe 4208 msedge.exe 4208 msedge.exe 4332 identity_helper.exe 4332 identity_helper.exe 6100 msedge.exe 6100 msedge.exe 1028 msedge.exe 1028 msedge.exe 2704 msedge.exe 2704 msedge.exe 3292 identity_helper.exe 3292 identity_helper.exe 2228 msedge.exe 2228 msedge.exe 3060 msedge.exe 3060 msedge.exe 4256 msedge.exe 4256 msedge.exe 4832 identity_helper.exe 4832 identity_helper.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 992 msedge.exe 992 msedge.exe 3608 msedge.exe 3608 msedge.exe 112 identity_helper.exe 112 identity_helper.exe 5200 msedge.exe 5200 msedge.exe 2244 MegaDumper.exe 2244 MegaDumper.exe 2244 MegaDumper.exe 2244 MegaDumper.exe 2244 MegaDumper.exe 2244 MegaDumper.exe 2244 MegaDumper.exe 2244 MegaDumper.exe 2244 MegaDumper.exe 2244 MegaDumper.exe 2244 MegaDumper.exe 2244 MegaDumper.exe 2244 MegaDumper.exe 2244 MegaDumper.exe 2244 MegaDumper.exe 2244 MegaDumper.exe 2244 MegaDumper.exe 2244 MegaDumper.exe 2244 MegaDumper.exe 2244 MegaDumper.exe 2244 MegaDumper.exe 2244 MegaDumper.exe 2244 MegaDumper.exe 2244 MegaDumper.exe 2244 MegaDumper.exe 2244 MegaDumper.exe 2244 MegaDumper.exe 2244 MegaDumper.exe 2244 MegaDumper.exe 2244 MegaDumper.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
MegaDumper.exeOpenWith.exepid process 2244 MegaDumper.exe 3252 OpenWith.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 61 IoCs
Processes:
msedge.exemsedge.exemsedge.exemsedge.exemsedge.exepid process 4208 msedge.exe 4208 msedge.exe 4208 msedge.exe 4208 msedge.exe 4208 msedge.exe 4208 msedge.exe 4208 msedge.exe 4208 msedge.exe 4208 msedge.exe 4208 msedge.exe 4208 msedge.exe 4208 msedge.exe 4208 msedge.exe 4208 msedge.exe 4208 msedge.exe 2704 msedge.exe 2704 msedge.exe 2704 msedge.exe 2704 msedge.exe 2704 msedge.exe 2704 msedge.exe 2704 msedge.exe 2704 msedge.exe 2704 msedge.exe 2704 msedge.exe 2704 msedge.exe 4256 msedge.exe 4256 msedge.exe 4256 msedge.exe 4256 msedge.exe 4256 msedge.exe 4256 msedge.exe 4256 msedge.exe 4256 msedge.exe 4256 msedge.exe 4256 msedge.exe 4256 msedge.exe 4256 msedge.exe 3608 msedge.exe 3608 msedge.exe 3608 msedge.exe 3608 msedge.exe 3608 msedge.exe 3608 msedge.exe 3608 msedge.exe 3608 msedge.exe 3608 msedge.exe 3608 msedge.exe 3608 msedge.exe 3608 msedge.exe 3608 msedge.exe 3608 msedge.exe 3608 msedge.exe 3608 msedge.exe 3608 msedge.exe 1780 msedge.exe 1780 msedge.exe 1780 msedge.exe 1780 msedge.exe 1780 msedge.exe 1780 msedge.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
AUDIODG.EXEAUDIODG.EXEMegaDumper.exeAUDIODG.EXEvssvc.exepython-3.11.1-amd64.exemsiexec.exedescription pid process Token: 33 1712 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1712 AUDIODG.EXE Token: 33 5640 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 5640 AUDIODG.EXE Token: SeDebugPrivilege 2244 MegaDumper.exe Token: SeDebugPrivilege 2244 MegaDumper.exe Token: 33 1600 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1600 AUDIODG.EXE Token: SeBackupPrivilege 1280 vssvc.exe Token: SeRestorePrivilege 1280 vssvc.exe Token: SeAuditPrivilege 1280 vssvc.exe Token: SeShutdownPrivilege 1664 python-3.11.1-amd64.exe Token: SeIncreaseQuotaPrivilege 1664 python-3.11.1-amd64.exe Token: SeSecurityPrivilege 1112 msiexec.exe Token: SeCreateTokenPrivilege 1664 python-3.11.1-amd64.exe Token: SeAssignPrimaryTokenPrivilege 1664 python-3.11.1-amd64.exe Token: SeLockMemoryPrivilege 1664 python-3.11.1-amd64.exe Token: SeIncreaseQuotaPrivilege 1664 python-3.11.1-amd64.exe Token: SeMachineAccountPrivilege 1664 python-3.11.1-amd64.exe Token: SeTcbPrivilege 1664 python-3.11.1-amd64.exe Token: SeSecurityPrivilege 1664 python-3.11.1-amd64.exe Token: SeTakeOwnershipPrivilege 1664 python-3.11.1-amd64.exe Token: SeLoadDriverPrivilege 1664 python-3.11.1-amd64.exe Token: SeSystemProfilePrivilege 1664 python-3.11.1-amd64.exe Token: SeSystemtimePrivilege 1664 python-3.11.1-amd64.exe Token: SeProfSingleProcessPrivilege 1664 python-3.11.1-amd64.exe Token: SeIncBasePriorityPrivilege 1664 python-3.11.1-amd64.exe Token: SeCreatePagefilePrivilege 1664 python-3.11.1-amd64.exe Token: SeCreatePermanentPrivilege 1664 python-3.11.1-amd64.exe Token: SeBackupPrivilege 1664 python-3.11.1-amd64.exe Token: SeRestorePrivilege 1664 python-3.11.1-amd64.exe Token: SeShutdownPrivilege 1664 python-3.11.1-amd64.exe Token: SeDebugPrivilege 1664 python-3.11.1-amd64.exe Token: SeAuditPrivilege 1664 python-3.11.1-amd64.exe Token: SeSystemEnvironmentPrivilege 1664 python-3.11.1-amd64.exe Token: SeChangeNotifyPrivilege 1664 python-3.11.1-amd64.exe Token: SeRemoteShutdownPrivilege 1664 python-3.11.1-amd64.exe Token: SeUndockPrivilege 1664 python-3.11.1-amd64.exe Token: SeSyncAgentPrivilege 1664 python-3.11.1-amd64.exe Token: SeEnableDelegationPrivilege 1664 python-3.11.1-amd64.exe Token: SeManageVolumePrivilege 1664 python-3.11.1-amd64.exe Token: SeImpersonatePrivilege 1664 python-3.11.1-amd64.exe Token: SeCreateGlobalPrivilege 1664 python-3.11.1-amd64.exe Token: SeRestorePrivilege 1112 msiexec.exe Token: SeTakeOwnershipPrivilege 1112 msiexec.exe Token: SeRestorePrivilege 1112 msiexec.exe Token: SeTakeOwnershipPrivilege 1112 msiexec.exe Token: SeRestorePrivilege 1112 msiexec.exe Token: SeTakeOwnershipPrivilege 1112 msiexec.exe Token: SeRestorePrivilege 1112 msiexec.exe Token: SeTakeOwnershipPrivilege 1112 msiexec.exe Token: SeRestorePrivilege 1112 msiexec.exe Token: SeTakeOwnershipPrivilege 1112 msiexec.exe Token: SeRestorePrivilege 1112 msiexec.exe Token: SeTakeOwnershipPrivilege 1112 msiexec.exe Token: SeRestorePrivilege 1112 msiexec.exe Token: SeTakeOwnershipPrivilege 1112 msiexec.exe Token: SeRestorePrivilege 1112 msiexec.exe Token: SeTakeOwnershipPrivilege 1112 msiexec.exe Token: SeRestorePrivilege 1112 msiexec.exe Token: SeTakeOwnershipPrivilege 1112 msiexec.exe Token: SeRestorePrivilege 1112 msiexec.exe Token: SeTakeOwnershipPrivilege 1112 msiexec.exe Token: SeRestorePrivilege 1112 msiexec.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
msedge.exeNOTEPAD.EXEmsedge.exepid process 4208 msedge.exe 4208 msedge.exe 4208 msedge.exe 4208 msedge.exe 4208 msedge.exe 4208 msedge.exe 4208 msedge.exe 4208 msedge.exe 4208 msedge.exe 4208 msedge.exe 4208 msedge.exe 4208 msedge.exe 4208 msedge.exe 4208 msedge.exe 4208 msedge.exe 4208 msedge.exe 4208 msedge.exe 4208 msedge.exe 4208 msedge.exe 4208 msedge.exe 4208 msedge.exe 4208 msedge.exe 4208 msedge.exe 4208 msedge.exe 4208 msedge.exe 4208 msedge.exe 4208 msedge.exe 4208 msedge.exe 4208 msedge.exe 4208 msedge.exe 4208 msedge.exe 4208 msedge.exe 4208 msedge.exe 4208 msedge.exe 4208 msedge.exe 4208 msedge.exe 4208 msedge.exe 4484 NOTEPAD.EXE 2704 msedge.exe 2704 msedge.exe 2704 msedge.exe 2704 msedge.exe 2704 msedge.exe 2704 msedge.exe 2704 msedge.exe 2704 msedge.exe 2704 msedge.exe 2704 msedge.exe 2704 msedge.exe 2704 msedge.exe 2704 msedge.exe 2704 msedge.exe 2704 msedge.exe 2704 msedge.exe 2704 msedge.exe 2704 msedge.exe 2704 msedge.exe 2704 msedge.exe 2704 msedge.exe 2704 msedge.exe 2704 msedge.exe 2704 msedge.exe 2704 msedge.exe 2704 msedge.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
msedge.exemsedge.exemsedge.exepid process 4208 msedge.exe 4208 msedge.exe 4208 msedge.exe 4208 msedge.exe 4208 msedge.exe 4208 msedge.exe 4208 msedge.exe 4208 msedge.exe 4208 msedge.exe 4208 msedge.exe 4208 msedge.exe 4208 msedge.exe 4208 msedge.exe 4208 msedge.exe 4208 msedge.exe 4208 msedge.exe 4208 msedge.exe 4208 msedge.exe 4208 msedge.exe 4208 msedge.exe 4208 msedge.exe 4208 msedge.exe 4208 msedge.exe 4208 msedge.exe 2704 msedge.exe 2704 msedge.exe 2704 msedge.exe 2704 msedge.exe 2704 msedge.exe 2704 msedge.exe 2704 msedge.exe 2704 msedge.exe 2704 msedge.exe 2704 msedge.exe 2704 msedge.exe 2704 msedge.exe 2704 msedge.exe 2704 msedge.exe 2704 msedge.exe 2704 msedge.exe 2704 msedge.exe 2704 msedge.exe 2704 msedge.exe 2704 msedge.exe 2704 msedge.exe 2704 msedge.exe 2704 msedge.exe 2704 msedge.exe 4256 msedge.exe 4256 msedge.exe 4256 msedge.exe 4256 msedge.exe 4256 msedge.exe 4256 msedge.exe 4256 msedge.exe 4256 msedge.exe 4256 msedge.exe 4256 msedge.exe 4256 msedge.exe 4256 msedge.exe 4256 msedge.exe 4256 msedge.exe 4256 msedge.exe 4256 msedge.exe -
Suspicious use of SetWindowsHookEx 19 IoCs
Processes:
OpenWith.exeOpenWith.exeOpenWith.exepid process 4448 OpenWith.exe 3116 OpenWith.exe 3252 OpenWith.exe 3252 OpenWith.exe 3252 OpenWith.exe 3252 OpenWith.exe 3252 OpenWith.exe 3252 OpenWith.exe 3252 OpenWith.exe 3252 OpenWith.exe 3252 OpenWith.exe 3252 OpenWith.exe 3252 OpenWith.exe 3252 OpenWith.exe 3252 OpenWith.exe 3252 OpenWith.exe 3252 OpenWith.exe 3252 OpenWith.exe 3252 OpenWith.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 4208 wrote to memory of 4480 4208 msedge.exe msedge.exe PID 4208 wrote to memory of 4480 4208 msedge.exe msedge.exe PID 4208 wrote to memory of 4440 4208 msedge.exe msedge.exe PID 4208 wrote to memory of 4440 4208 msedge.exe msedge.exe PID 4208 wrote to memory of 4440 4208 msedge.exe msedge.exe PID 4208 wrote to memory of 4440 4208 msedge.exe msedge.exe PID 4208 wrote to memory of 4440 4208 msedge.exe msedge.exe PID 4208 wrote to memory of 4440 4208 msedge.exe msedge.exe PID 4208 wrote to memory of 4440 4208 msedge.exe msedge.exe PID 4208 wrote to memory of 4440 4208 msedge.exe msedge.exe PID 4208 wrote to memory of 4440 4208 msedge.exe msedge.exe PID 4208 wrote to memory of 4440 4208 msedge.exe msedge.exe PID 4208 wrote to memory of 4440 4208 msedge.exe msedge.exe PID 4208 wrote to memory of 4440 4208 msedge.exe msedge.exe PID 4208 wrote to memory of 4440 4208 msedge.exe msedge.exe PID 4208 wrote to memory of 4440 4208 msedge.exe msedge.exe PID 4208 wrote to memory of 4440 4208 msedge.exe msedge.exe PID 4208 wrote to memory of 4440 4208 msedge.exe msedge.exe PID 4208 wrote to memory of 4440 4208 msedge.exe msedge.exe PID 4208 wrote to memory of 4440 4208 msedge.exe msedge.exe PID 4208 wrote to memory of 4440 4208 msedge.exe msedge.exe PID 4208 wrote to memory of 4440 4208 msedge.exe msedge.exe PID 4208 wrote to memory of 4440 4208 msedge.exe msedge.exe PID 4208 wrote to memory of 4440 4208 msedge.exe msedge.exe PID 4208 wrote to memory of 4440 4208 msedge.exe msedge.exe PID 4208 wrote to memory of 4440 4208 msedge.exe msedge.exe PID 4208 wrote to memory of 4440 4208 msedge.exe msedge.exe PID 4208 wrote to memory of 4440 4208 msedge.exe msedge.exe PID 4208 wrote to memory of 4440 4208 msedge.exe msedge.exe PID 4208 wrote to memory of 4440 4208 msedge.exe msedge.exe PID 4208 wrote to memory of 4440 4208 msedge.exe msedge.exe PID 4208 wrote to memory of 4440 4208 msedge.exe msedge.exe PID 4208 wrote to memory of 4440 4208 msedge.exe msedge.exe PID 4208 wrote to memory of 4440 4208 msedge.exe msedge.exe PID 4208 wrote to memory of 4440 4208 msedge.exe msedge.exe PID 4208 wrote to memory of 4440 4208 msedge.exe msedge.exe PID 4208 wrote to memory of 4440 4208 msedge.exe msedge.exe PID 4208 wrote to memory of 4440 4208 msedge.exe msedge.exe PID 4208 wrote to memory of 4440 4208 msedge.exe msedge.exe PID 4208 wrote to memory of 4440 4208 msedge.exe msedge.exe PID 4208 wrote to memory of 4440 4208 msedge.exe msedge.exe PID 4208 wrote to memory of 4440 4208 msedge.exe msedge.exe PID 4208 wrote to memory of 1372 4208 msedge.exe msedge.exe PID 4208 wrote to memory of 1372 4208 msedge.exe msedge.exe PID 4208 wrote to memory of 4696 4208 msedge.exe msedge.exe PID 4208 wrote to memory of 4696 4208 msedge.exe msedge.exe PID 4208 wrote to memory of 4696 4208 msedge.exe msedge.exe PID 4208 wrote to memory of 4696 4208 msedge.exe msedge.exe PID 4208 wrote to memory of 4696 4208 msedge.exe msedge.exe PID 4208 wrote to memory of 4696 4208 msedge.exe msedge.exe PID 4208 wrote to memory of 4696 4208 msedge.exe msedge.exe PID 4208 wrote to memory of 4696 4208 msedge.exe msedge.exe PID 4208 wrote to memory of 4696 4208 msedge.exe msedge.exe PID 4208 wrote to memory of 4696 4208 msedge.exe msedge.exe PID 4208 wrote to memory of 4696 4208 msedge.exe msedge.exe PID 4208 wrote to memory of 4696 4208 msedge.exe msedge.exe PID 4208 wrote to memory of 4696 4208 msedge.exe msedge.exe PID 4208 wrote to memory of 4696 4208 msedge.exe msedge.exe PID 4208 wrote to memory of 4696 4208 msedge.exe msedge.exe PID 4208 wrote to memory of 4696 4208 msedge.exe msedge.exe PID 4208 wrote to memory of 4696 4208 msedge.exe msedge.exe PID 4208 wrote to memory of 4696 4208 msedge.exe msedge.exe PID 4208 wrote to memory of 4696 4208 msedge.exe msedge.exe PID 4208 wrote to memory of 4696 4208 msedge.exe msedge.exe
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\pyinstaller-win32.zip1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"1⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff8b38846f8,0x7ff8b3884708,0x7ff8b38847182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,6548950165985388297,5852883688445960887,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,6548950165985388297,5852883688445960887,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,6548950165985388297,5852883688445960887,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6548950165985388297,5852883688445960887,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6548950165985388297,5852883688445960887,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3708 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6548950165985388297,5852883688445960887,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3716 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2132,6548950165985388297,5852883688445960887,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5132 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2132,6548950165985388297,5852883688445960887,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5772 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6548950165985388297,5852883688445960887,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6284 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,6548950165985388297,5852883688445960887,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6664 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings2⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1c4,0x22c,0x7ff6041a5460,0x7ff6041a5470,0x7ff6041a54803⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,6548950165985388297,5852883688445960887,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6664 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6548950165985388297,5852883688445960887,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6740 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6548950165985388297,5852883688445960887,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5908 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6548950165985388297,5852883688445960887,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6548950165985388297,5852883688445960887,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6324 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6548950165985388297,5852883688445960887,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3820 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6548950165985388297,5852883688445960887,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6548950165985388297,5852883688445960887,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6548950165985388297,5852883688445960887,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6548950165985388297,5852883688445960887,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1884 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6548950165985388297,5852883688445960887,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2132,6548950165985388297,5852883688445960887,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5464 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6548950165985388297,5852883688445960887,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5944 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2132,6548950165985388297,5852883688445960887,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5216 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2132,6548950165985388297,5852883688445960887,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7368 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2132,6548950165985388297,5852883688445960887,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6684 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2132,6548950165985388297,5852883688445960887,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6940 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2132,6548950165985388297,5852883688445960887,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6476 /prefetch:82⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Downloads\Cracking Tools\SMD_unpacking_tools\New folder\Simple_MSIL_Decryptor.exe"C:\Users\Admin\Downloads\Cracking Tools\SMD_unpacking_tools\New folder\Simple_MSIL_Decryptor.exe"1⤵
- Drops file in Windows directory
-
C:\Users\Admin\Downloads\Cracking Tools\SMD_unpacking_tools\New folder\Simple_MSIL_Decryptor.exe"C:\Users\Admin\Downloads\Cracking Tools\SMD_unpacking_tools\New folder\Simple_MSIL_Decryptor.exe"1⤵
- Drops file in Windows directory
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Cracking Tools\SMD_unpacking_tools\New folder\README.txt1⤵
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\Cracking Tools\SMD_unpacking_tools\New folder\Simple_MSIL_Decryptor (2).exe"C:\Users\Admin\Downloads\Cracking Tools\SMD_unpacking_tools\New folder\Simple_MSIL_Decryptor (2).exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Windows directory
-
C:\Users\Admin\Downloads\Cracking Tools\SMD_unpacking_tools\New folder\Simple_MSIL_Decryptor.exe"C:\Users\Admin\Downloads\Cracking Tools\SMD_unpacking_tools\New folder\Simple_MSIL_Decryptor.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4780 -s 16682⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4780 -s 16842⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4780 -ip 47801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4780 -ip 47801⤵
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Cracking Tools\SMD_unpacking_tools\New folder\README.txt1⤵
-
C:\Users\Admin\Downloads\Cracking Tools\SMD_unpacking_tools\New folder\Simple_MSIL_Decryptor.exe"C:\Users\Admin\Downloads\Cracking Tools\SMD_unpacking_tools\New folder\Simple_MSIL_Decryptor.exe"1⤵
- Drops file in Windows directory
-
C:\Users\Admin\Downloads\Cracking Tools\SMD_unpacking_tools\New folder\Simple_MSIL_Decryptor.exe"C:\Users\Admin\Downloads\Cracking Tools\SMD_unpacking_tools\New folder\Simple_MSIL_Decryptor.exe"1⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5820 -s 16922⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5820 -s 17242⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 5820 -ip 58201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 5820 -ip 58201⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default1⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8b38846f8,0x7ff8b3884708,0x7ff8b38847182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,2326057305857360373,6276853967856998490,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2612 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2326057305857360373,6276853967856998490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3128 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,2326057305857360373,6276853967856998490,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2326057305857360373,6276853967856998490,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3140 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,2326057305857360373,6276853967856998490,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2124,2326057305857360373,6276853967856998490,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5376 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,2326057305857360373,6276853967856998490,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5584 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,2326057305857360373,6276853967856998490,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5584 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2326057305857360373,6276853967856998490,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2326057305857360373,6276853967856998490,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2940 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2326057305857360373,6276853967856998490,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2326057305857360373,6276853967856998490,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2326057305857360373,6276853967856998490,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2326057305857360373,6276853967856998490,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2828 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2326057305857360373,6276853967856998490,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2326057305857360373,6276853967856998490,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2124,2326057305857360373,6276853967856998490,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5788 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2326057305857360373,6276853967856998490,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2124,2326057305857360373,6276853967856998490,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6032 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Users\Admin\Downloads\VMUnprotect.Dumper-net472 (1)\net472\VMUnprotect.Dumper.exe"C:\Users\Admin\Downloads\VMUnprotect.Dumper-net472 (1)\net472\VMUnprotect.Dumper.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x414 0x4181⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Downloads\Cracking Tools\VMP_DeMutation.exe"C:\Users\Admin\Downloads\Cracking Tools\VMP_DeMutation.exe"1⤵
-
C:\Users\Admin\Downloads\Cracking Tools\VMP_DeMutation.exe"C:\Users\Admin\Downloads\Cracking Tools\VMP_DeMutation.exe" "C:\Users\Admin\Downloads\Cracking Tools\Satire Injector-decrypted.exe"1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 6008 -s 8242⤵
- Program crash
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 404 -p 6008 -ip 60081⤵
-
C:\Users\Admin\Downloads\Cracking Tools\VMP Killer\VMPKiller.exe"C:\Users\Admin\Downloads\Cracking Tools\VMP Killer\VMPKiller.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default1⤵
- Adds Run key to start application
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SendNotifyMessage
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8b38846f8,0x7ff8b3884708,0x7ff8b38847182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,4892059993630250967,10914814764957837409,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,4892059993630250967,10914814764957837409,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,4892059993630250967,10914814764957837409,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2636 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4892059993630250967,10914814764957837409,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4892059993630250967,10914814764957837409,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4892059993630250967,10914814764957837409,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4892059993630250967,10914814764957837409,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4336 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4892059993630250967,10914814764957837409,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4892059993630250967,10914814764957837409,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4028 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4892059993630250967,10914814764957837409,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4008 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4892059993630250967,10914814764957837409,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6076 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2136,4892059993630250967,10914814764957837409,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6304 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,4892059993630250967,10914814764957837409,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6464 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,4892059993630250967,10914814764957837409,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6464 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4892059993630250967,10914814764957837409,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2052 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2136,4892059993630250967,10914814764957837409,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=1296 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2136,4892059993630250967,10914814764957837409,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5820 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2136,4892059993630250967,10914814764957837409,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4092 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2136,4892059993630250967,10914814764957837409,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4380 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2136,4892059993630250967,10914814764957837409,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1804 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,4892059993630250967,10914814764957837409,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4384 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4892059993630250967,10914814764957837409,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2744 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4892059993630250967,10914814764957837409,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4892059993630250967,10914814764957837409,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:12⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Users\Admin\Downloads\Cracking Tools\VMP Killer\VMPKiller.exe"C:\Users\Admin\Downloads\Cracking Tools\VMP Killer\VMPKiller.exe"1⤵
-
C:\Users\Admin\Downloads\Cracking Tools\Universal_Fixer NET 4\Universal_Fixer.exe"C:\Users\Admin\Downloads\Cracking Tools\Universal_Fixer NET 4\Universal_Fixer.exe"1⤵
-
C:\Users\Admin\Downloads\Cracking Tools\Satire Injector-decrypted.justify_fix_fix.exe"C:\Users\Admin\Downloads\Cracking Tools\Satire Injector-decrypted.justify_fix_fix.exe"1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Downloads\Cracking Tools\Satire Injector-decrypted.exe"C:\Users\Admin\Downloads\Cracking Tools\Satire Injector-decrypted.exe"1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Downloads\Cracking Tools\Satire Injector-decrypted.justify.exe"C:\Users\Admin\Downloads\Cracking Tools\Satire Injector-decrypted.justify.exe"1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Downloads\Cracking Tools\VMP_DeMutation.exe"C:\Users\Admin\Downloads\Cracking Tools\VMP_DeMutation.exe"1⤵
-
C:\Users\Admin\Downloads\Cracking Tools\VMP_DeMutation.exe"C:\Users\Admin\Downloads\Cracking Tools\VMP_DeMutation.exe" "C:\Users\Admin\Downloads\Cracking Tools\Satire Injector-decrypted.justify_fix_fix.exe"1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 5092 -s 8242⤵
- Program crash
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 404 -p 5092 -ip 50921⤵
-
C:\Users\Admin\Downloads\Cracking Tools\SMD_unpacking_tools\New folder\Simple_MSIL_Decryptor.exe"C:\Users\Admin\Downloads\Cracking Tools\SMD_unpacking_tools\New folder\Simple_MSIL_Decryptor.exe"1⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4920 -s 16522⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4920 -s 15722⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4920 -ip 49201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4920 -ip 49201⤵
-
C:\Users\Admin\Downloads\Cracking Tools\VMP_DeMutation.exe"C:\Users\Admin\Downloads\Cracking Tools\VMP_DeMutation.exe" "C:\Users\Admin\Downloads\Cracking Tools\Satire Injector.exe"1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 6048 -s 8242⤵
- Program crash
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 432 -p 6048 -ip 60481⤵
-
C:\Users\Admin\Downloads\Cracking Tools\VMP_DeMutation.exe"C:\Users\Admin\Downloads\Cracking Tools\VMP_DeMutation.exe" "C:\Users\Admin\Downloads\Cracking Tools\Satire Injector.exe"1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 756 -s 8242⤵
- Program crash
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 444 -p 756 -ip 7561⤵
-
C:\Users\Admin\Downloads\Cracking Tools\VMP_DeMutation.exe"C:\Users\Admin\Downloads\Cracking Tools\VMP_DeMutation.exe" "C:\Users\Admin\Downloads\Cracking Tools\Satire Injector.exe"1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4592 -s 8242⤵
- Program crash
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 524 -p 4592 -ip 45921⤵
-
C:\Users\Admin\Downloads\Cracking Tools\VMP_DeMutation.exe"C:\Users\Admin\Downloads\Cracking Tools\VMP_DeMutation.exe" "C:\Users\Admin\Downloads\Cracking Tools\Satire Injector.exe"1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4896 -s 8242⤵
- Program crash
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 540 -p 4896 -ip 48961⤵
-
C:\Users\Admin\Downloads\Cracking Tools\VMP_DeMutation.exe"C:\Users\Admin\Downloads\Cracking Tools\VMP_DeMutation.exe" "C:\Users\Admin\Downloads\Cracking Tools\Satire Injector.exe"1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 5888 -s 8242⤵
- Program crash
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 404 -p 5888 -ip 58881⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default1⤵
- Adds Run key to start application
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8b38846f8,0x7ff8b3884708,0x7ff8b38847182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,8439946082766728661,9185184037441921243,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,8439946082766728661,9185184037441921243,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2424 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,8439946082766728661,9185184037441921243,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8439946082766728661,9185184037441921243,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8439946082766728661,9185184037441921243,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8439946082766728661,9185184037441921243,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8439946082766728661,9185184037441921243,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2112,8439946082766728661,9185184037441921243,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5172 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8439946082766728661,9185184037441921243,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8439946082766728661,9185184037441921243,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8439946082766728661,9185184037441921243,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2112,8439946082766728661,9185184037441921243,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3520 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,8439946082766728661,9185184037441921243,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6328 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,8439946082766728661,9185184037441921243,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6328 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2112,8439946082766728661,9185184037441921243,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3624 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8439946082766728661,9185184037441921243,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8439946082766728661,9185184037441921243,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=180 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2112,8439946082766728661,9185184037441921243,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5720 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2112,8439946082766728661,9185184037441921243,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6168 /prefetch:82⤵
-
C:\Users\Admin\Downloads\MegaDumper.exe"C:\Users\Admin\Downloads\MegaDumper.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,8439946082766728661,9185184037441921243,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1952 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8439946082766728661,9185184037441921243,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1764 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8439946082766728661,9185184037441921243,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4288 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8439946082766728661,9185184037441921243,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8439946082766728661,9185184037441921243,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5860 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8439946082766728661,9185184037441921243,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8439946082766728661,9185184037441921243,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8439946082766728661,9185184037441921243,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8439946082766728661,9185184037441921243,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3608 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2112,8439946082766728661,9185184037441921243,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6756 /prefetch:82⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x414 0x4181⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Downloads\Cracking Tools\Satire Injector.exe"C:\Users\Admin\Downloads\Cracking Tools\Satire Injector.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Downloads\Cracking Tools\VMP_DeMutation.exe"C:\Users\Admin\Downloads\Cracking Tools\VMP_DeMutation.exe" "C:\Users\Admin\Downloads\Cracking Tools\Satire Injector.exe"1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 5688 -s 8242⤵
- Program crash
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 536 -p 5688 -ip 56881⤵
-
C:\Users\Admin\Downloads\Cracking Tools\VMP_DeMutation.exe"C:\Users\Admin\Downloads\Cracking Tools\VMP_DeMutation.exe" "C:\Users\Admin\Downloads\Cracking Tools\Satire Injector.exe"1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3020 -s 8242⤵
- Program crash
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 580 -p 3020 -ip 30201⤵
-
C:\Users\Admin\Downloads\Cracking Tools\VMP_DeMutation.exe"C:\Users\Admin\Downloads\Cracking Tools\VMP_DeMutation.exe" "C:\Users\Admin\Downloads\Cracking Tools\Satire Injector.exe"1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4440 -s 8282⤵
- Program crash
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 604 -p 4440 -ip 44401⤵
-
C:\Users\Admin\Downloads\Cracking Tools\Satire Injector.exe"C:\Users\Admin\Downloads\Cracking Tools\Satire Injector.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\Cracking Tools\Universal_Fixer NET 4\Universal_Fixer.exe"C:\Users\Admin\Downloads\Cracking Tools\Universal_Fixer NET 4\Universal_Fixer.exe"1⤵
-
C:\Users\Admin\Downloads\Cracking Tools\VMP_DeMutation.exe"C:\Users\Admin\Downloads\Cracking Tools\VMP_DeMutation.exe" "C:\Users\Admin\Downloads\Cracking Tools\Satire Injector_fix.exe"1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 5160 -s 8242⤵
- Program crash
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 384 -p 5160 -ip 51601⤵
-
C:\Users\Admin\Downloads\Cracking Tools\VMP_DeMutation.exe"C:\Users\Admin\Downloads\Cracking Tools\VMP_DeMutation.exe" "C:\Users\Admin\Downloads\Cracking Tools\Satire Injector_fix.exe"1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4264 -s 8282⤵
- Program crash
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 488 -p 4264 -ip 42641⤵
-
C:\Users\Admin\Downloads\Cracking Tools\VMP_DeMutation.exe"C:\Users\Admin\Downloads\Cracking Tools\VMP_DeMutation.exe" "C:\Users\Admin\Downloads\Cracking Tools\Satire Injector.exe"1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4280 -s 8242⤵
- Program crash
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 600 -p 4280 -ip 42801⤵
-
C:\Users\Admin\Downloads\Cracking Tools\VMP_DeMutation.exe"C:\Users\Admin\Downloads\Cracking Tools\VMP_DeMutation.exe" "C:\Users\Admin\Downloads\Cracking Tools\Satire Injector_fix.exe"1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4292 -s 8242⤵
- Program crash
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 596 -p 4292 -ip 42921⤵
-
C:\Users\Admin\Downloads\Cracking Tools\VMP_DeMutation.exe"C:\Users\Admin\Downloads\Cracking Tools\VMP_DeMutation.exe" "C:\Users\Admin\Downloads\Cracking Tools\Satire Injector_fix.exe"1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1536 -s 6922⤵
- Program crash
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 544 -p 1536 -ip 15361⤵
-
C:\Users\Admin\Downloads\Cracking Tools\VMP Killer\VMPKiller.exe"C:\Users\Admin\Downloads\Cracking Tools\VMP Killer\VMPKiller.exe"1⤵
-
C:\Users\Admin\Downloads\Cracking Tools\VMP_DeMutation.exe"C:\Users\Admin\Downloads\Cracking Tools\VMP_DeMutation.exe" "C:\Users\Admin\Downloads\Cracking Tools\Satire Injector_fix.justify.exe"1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 600 -s 8162⤵
- Program crash
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 576 -p 600 -ip 6001⤵
-
C:\Users\Admin\Downloads\Cracking Tools\VMP_DeMutation.exe"C:\Users\Admin\Downloads\Cracking Tools\VMP_DeMutation.exe" "C:\Users\Admin\Downloads\Cracking Tools\Satire Injector_fix.justify.exe"1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3852 -s 8242⤵
- Program crash
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 600 -p 3852 -ip 38521⤵
-
C:\Users\Admin\Downloads\Cracking Tools\Universal_Fixer NET 4\Universal_Fixer.exe"C:\Users\Admin\Downloads\Cracking Tools\Universal_Fixer NET 4\Universal_Fixer.exe"1⤵
-
C:\Users\Admin\Downloads\Cracking Tools\VMP Killer\VMPKiller.exe"C:\Users\Admin\Downloads\Cracking Tools\VMP Killer\VMPKiller.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4368 -s 8682⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 4368 -ip 43681⤵
-
C:\Users\Admin\Downloads\Cracking Tools\VMP Killer\VMPKiller.exe"C:\Users\Admin\Downloads\Cracking Tools\VMP Killer\VMPKiller.exe"1⤵
-
C:\Users\Admin\Downloads\Cracking Tools\VMP_DeMutation.exe"C:\Users\Admin\Downloads\Cracking Tools\VMP_DeMutation.exe" "C:\Users\Admin\Downloads\Cracking Tools\Satire Injector.justify.exe"1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2304 -s 8242⤵
- Program crash
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 544 -p 2304 -ip 23041⤵
-
C:\Users\Admin\Downloads\Cracking Tools\Universal_Fixer NET 4\Universal_Fixer.exe"C:\Users\Admin\Downloads\Cracking Tools\Universal_Fixer NET 4\Universal_Fixer.exe"1⤵
-
C:\Users\Admin\Downloads\Cracking Tools\VMP_DeMutation.exe"C:\Users\Admin\Downloads\Cracking Tools\VMP_DeMutation.exe" "C:\Users\Admin\Downloads\Cracking Tools\Satire Injector.justify_fix.exe"1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3740 -s 8322⤵
- Program crash
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 616 -p 3740 -ip 37401⤵
-
C:\Users\Admin\Downloads\Cracking Tools\VMP_DeMutation.exe"C:\Users\Admin\Downloads\Cracking Tools\VMP_DeMutation.exe" "C:\Users\Admin\Downloads\Cracking Tools\Satire Injector.justify_fix.exe"1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1396 -s 8282⤵
- Program crash
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 608 -p 1396 -ip 13961⤵
-
C:\Users\Admin\Downloads\Cracking Tools\VMP_DeMutation.exe"C:\Users\Admin\Downloads\Cracking Tools\VMP_DeMutation.exe" "C:\Users\Admin\Downloads\Cracking Tools\Satire Injector.justify_fix.exe"1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3620 -s 8242⤵
- Program crash
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 604 -p 3620 -ip 36201⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x414 0x4181⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default1⤵
- Adds Run key to start application
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8b38846f8,0x7ff8b3884708,0x7ff8b38847182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,17276090257273959961,7065451926044402537,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,17276090257273959961,7065451926044402537,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2424 /prefetch:32⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,17276090257273959961,7065451926044402537,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,17276090257273959961,7065451926044402537,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,17276090257273959961,7065451926044402537,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,17276090257273959961,7065451926044402537,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,17276090257273959961,7065451926044402537,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4108 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2076,17276090257273959961,7065451926044402537,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3540 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,17276090257273959961,7065451926044402537,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5908 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,17276090257273959961,7065451926044402537,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5908 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,17276090257273959961,7065451926044402537,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3556 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2076,17276090257273959961,7065451926044402537,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5680 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2076,17276090257273959961,7065451926044402537,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6152 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2076,17276090257273959961,7065451926044402537,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6240 /prefetch:82⤵
-
C:\Users\Admin\Downloads\python-3.11.1-amd64.exe"C:\Users\Admin\Downloads\python-3.11.1-amd64.exe"2⤵
- Executes dropped EXE
-
C:\Windows\Temp\{9C045613-4FB2-4598-A16B-52A95F017F0C}\.cr\python-3.11.1-amd64.exe"C:\Windows\Temp\{9C045613-4FB2-4598-A16B-52A95F017F0C}\.cr\python-3.11.1-amd64.exe" -burn.clean.room="C:\Users\Admin\Downloads\python-3.11.1-amd64.exe" -burn.filehandle.attached=528 -burn.filehandle.self=5363⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Temp\{1B35EB65-03FE-4350-8F41-91908613B49D}\.be\python-3.11.1-amd64.exe"C:\Windows\Temp\{1B35EB65-03FE-4350-8F41-91908613B49D}\.be\python-3.11.1-amd64.exe" -q -burn.elevated BurnPipe.{AA3EA04A-5F17-4882-AC1D-D483AB781FEE} {9315A6B0-C657-40AA-8999-3E0A584E11E9} 16644⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Programs\Python\Python311\pythonw.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python311\pythonw.exe" -c "import winreg; winreg.SetValueEx(winreg.CreateKey(winreg.HKEY_LOCAL_MACHINE, r'SYSTEM\CurrentControlSet\Control\FileSystem'), 'LongPathsEnabled', None, winreg.REG_DWORD, 1)"4⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,17276090257273959961,7065451926044402537,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,17276090257273959961,7065451926044402537,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5232 /prefetch:22⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Registers COM server for autorun
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 4810FB02F7200BD545B23B5A28E158652⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe"C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe" -E -s -m ensurepip -U --default-pip3⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe -W ignore::DeprecationWarning -c " import runpy import sys sys.path = ['C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp6ojfydbj\\setuptools-65.5.0-py3-none-any.whl', 'C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp6ojfydbj\\pip-22.3.1-py3-none-any.whl'] + sys.path sys.argv[1:] = ['install', '--no-cache-dir', '--no-index', '--find-links', 'C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp6ojfydbj', '--upgrade', 'setuptools', 'pip'] runpy.run_module(\"pip\", run_name=\"__main__\", alter_sys=True) "4⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"5⤵
-
C:\Windows\py.exe"C:\Windows\py.exe" "C:\Users\Admin\Downloads\VMProtect-devirtualization-main\VMProtect-devirtualization-main\looking_jmp.py"1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe "C:\Users\Admin\Downloads\VMProtect-devirtualization-main\VMProtect-devirtualization-main\looking_jmp.py"2⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\py.exe"C:\Windows\py.exe" "C:\Users\Admin\Downloads\VMProtect-devirtualization-main\VMProtect-devirtualization-main\attack_vmp.py"1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe "C:\Users\Admin\Downloads\VMProtect-devirtualization-main\VMProtect-devirtualization-main\attack_vmp.py"2⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\VMProtect-devirtualization-main\VMProtect-devirtualization-main\README.md2⤵
-
C:\Windows\py.exe"C:\Windows\py.exe" "C:\Users\Admin\Downloads\VMProtect-devirtualization-main\VMProtect-devirtualization-main\attack_vmp.py" "C:\Users\Admin\Downloads\Cracking Tools\Satire Injector.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe "C:\Users\Admin\Downloads\VMProtect-devirtualization-main\VMProtect-devirtualization-main\attack_vmp.py" "C:\Users\Admin\Downloads\Cracking Tools\Satire Injector.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\py.exe"C:\Windows\py.exe" "C:\Users\Admin\Downloads\VMProtect-devirtualization-main\VMProtect-devirtualization-main\looking_jmp.py" "C:\Users\Admin\Downloads\Cracking Tools\Satire Injector.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exeC:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe "C:\Users\Admin\Downloads\VMProtect-devirtualization-main\VMProtect-devirtualization-main\looking_jmp.py" "C:\Users\Admin\Downloads\Cracking Tools\Satire Injector.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Simple_MSIL_Decryptor.exe.logFilesize
1KB
MD57ebe314bf617dc3e48b995a6c352740c
SHA1538f643b7b30f9231a3035c448607f767527a870
SHA25648178f884b8a4dd96e330b210b0530667d9473a7629fc6b4ad12b614bf438ee8
SHA5120ba9d8f4244c15285e254d27b4bff7c49344ff845c48bc0bf0d8563072fab4d6f7a6abe6b6742e8375a08e9a3b3e5d5dc4937ab428dbe2dd8e62892fda04507e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation\6498.2022.12.1\manifest.jsonFilesize
114B
MD5da31362706c7b2660d7341ea74acd822
SHA1da6f475dfd70e6e811162a887989214bfecfcfea
SHA256702289682a16d11b41d431d0bc4ff31efc930cd900902d14d2d67375d108aec7
SHA512eb681ce7c884735b953a668342d7143f67bd4dfee997358fc0f0fc8ab76ce15220b78d6fb2da98154c413b9232c733f171d3b06021c7d1753d5f56e41b34b75d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD577c5176b80498efa00b6017129739c95
SHA1b687aceede3bb326320a8ac6f652d3cbc5482635
SHA256f0a2332f3aead2f03825b552d03d66574b3877ef4a0b9f0d61c99e71b721a413
SHA512db6984d885a42f1fcc9a6598540d8c94744a74f09822eccddb8d9e81cd7cf2a54689720af729dd99bf97a482963e5939e71ae62e24251c1bd2f6ce8c30fd5301
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\FaviconsFilesize
24KB
MD55628d7abdd12cabfdf8e173f4bb06adf
SHA13cb63fc80dbc6fa4e074797811c38eab27f2f57c
SHA25635498fce486df2dfc97513a1a12f7e56bca1ee717bbe0be6718c2c97cfb5aeb3
SHA512295a2a1f49048965ea816b8f370cd6c07e5f63c3d0697ea5b02e75f6478a280fab257fbddac166ad0867b8037e7472c597ba9b84c45280b135fa8b0de7976a52
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HistoryFilesize
124KB
MD53163e3d14f4db6514a8b78b0c6206910
SHA1c9640fd4c290a074a65d101dd33399bd664ca8dd
SHA2563a07b81919dab77fcaea1e4a1eaabf3e32da2bfe95ed714270d7245b102b3492
SHA5124a53620341aac075d058e1f1cad0d713250c92618bda335cce90a4bf9e1f206ac29c6e8a0c8b81e5446dd10f0317a15b83a328bc23b24bff3ae33ab81945a2a8
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
10KB
MD5519bda33ad7eb27ecfad34ee47101d3d
SHA14946f4a0ae5a2021fa15ba462bf9ad9197514c97
SHA256094d8bf55efa2ecee30a8abdf14aeb34f40e864ec5ef21ca6f31c5b94acbdefc
SHA512d5ac94a82432abad1d6c0a5a97abca2e66314769050081110a3564899ac764079dab034e9a97e2e9087e4574e44872c0d9e6cad246a15ec4c63005ef6a2d02c5
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure PreferencesFilesize
24KB
MD5eabc81a570ad1cc52ae18a0a641d1ba4
SHA1a0730ec772df53f6f3e29dec149886ca74f41a20
SHA2561a2fe6978a03be1b5304732bd84a0fe742c51d6ffddde9d4c3d6ea73e3eb13c2
SHA51294eebc210ec71491ed3d7ff71b35dd25f486bfec0123d69c9c95285ac51d26a928cc961ca28513b973bf64331e38c9eda1125216c97dc6f242f85aa1736ce216
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.logFilesize
184B
MD5ac4b2866377133a10f0edfad59c84606
SHA10a16c693c2eb4186c5c8d0f230e366e3cb98ec62
SHA2567bb8f7e683df7d2f6ce89c9b6cd5f8e78fba697b668394d1e57bc591d4659c1f
SHA5129a361bf139cba35930e4653a83374457b20c7756dfe7a4e80cf433f49cdb688ee265a0048de170a2d7e29f42dc95553dbfca1cd99bbb6f7871e7edc910627ebc
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOGFilesize
350B
MD55692fa77223a850e854783f2084ba608
SHA12b04e1a46e518aa68b17e32180f3baa42a67d274
SHA2567d2bc137424778c11ddbf85e8180c8e5e46fafe7bc3aeb5e9172d676638542ae
SHA512b2830acad6d0a4cf84470287b7e3f22323f5e2a24991581c10e12c7dfb8f62150b487b81a38e2518ea1253c2401ca85245ab17454ffbe0a652f65c2dff5fd5d2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOGFilesize
326B
MD5ab13a804afb2483dd900af02643d7e1f
SHA1474accec579b2eddef5b82b0df3665a25766152f
SHA256b7536f1497a07cb2e9e968b0ce07019196ccdd242d10adcc67cd10d8b8fd7b0e
SHA5124e2100c0cd2f9266672f94cb5d545712079dc54a36ef7d2258a60d522427fee3540fd5393b249f71cc4b1f6e4a2cd068be3a73783ba304c0018d1ab6c2654bb8
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited LinksFilesize
128KB
MD56906e02d5052da5f4d67f83cfba11ff2
SHA182945f4422464c69adc759b4ff1c64be608b0a82
SHA25611625c0f91ef8c7fbf011503adc140e2cbfa859e20d84d1f8986fca137571714
SHA512a1755915ac9f9a52573a29105e0cb9fa6b72648a8569f71ed198ee734619b675886f3ed3321d02b45c4b5e7a2f656dcbffa176c8dd6d6884b9dbaefd7bde07c3
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web DataFilesize
116KB
MD5f70aa3fa04f0536280f872ad17973c3d
SHA150a7b889329a92de1b272d0ecf5fce87395d3123
SHA2568d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8
SHA51230675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last VersionFilesize
11B
MD5838a7b32aefb618130392bc7d006aa2e
SHA15159e0f18c9e68f0e75e2239875aa994847b8290
SHA256ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa
SHA5129e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
14KB
MD53266408d4646b76f7e2d45c284ce8103
SHA188e20bc9f9da207db586175c67a9fabb5376faef
SHA2565eb973588cf27a6ec688763cb727e516737917ad1cb5227eadb1de7e9abd58b2
SHA512bd83cccf4666784f22b76457778a1c1979d93a4897e7754846015071efce1efa17648f6ecf713855e7102c1afa2e88a18ebcbc16f29e3ccd24d81eb43f3759cc
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Safe Browsing\ChromeExtMalware.storeFilesize
1.8MB
MD5457c2a94c606ad0124de970954d7e34c
SHA1b83de32b9ac607e4027deea8062cc3a9e4aac5a2
SHA256b8df182684818587ddffb5b92cbec843022ddd604633f0c1f589c41a54977352
SHA512ecb9bb92626d59b3dd73b96cb7d0914cdbc15fc396d7ad3f99d7d83e7e0a6f27c5e728bbd215d16fb598370e435d65268da84e1b2e05656a2af53b3c2695177b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1Filesize
264KB
MD5ea7841971ccb7fa9f3b0853a736d93d2
SHA1f334872661e607afc8012be0337400df0a7eed73
SHA2560c70afc9d8776b2feb2ed36557bbbbf99a41060cfe73cdc30b08de559573e46c
SHA512ad5c0c5908fe3d25c9cf80040f7321e86f4d90a65ebcb97f676e24feb9e22529e5bb779f56b263d3352311b0afdb02a11680213771097142a7d81372bb69af3f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\edgeSettingsFilesize
81B
MD5f222079e71469c4d129b335b7c91355e
SHA10056c3003874efef229a5875742559c8c59887dc
SHA256e713c1b13a849d759ebaa6256773f4f1d6dfc0c6a4247edaa726e0206ecacb00
SHA512e5a49275e056b6628709cf6509a5f33f8d1d1e93125eaa6ec1c7f51be589fd3d8ea7a59b9639db586d76a994ad3dc452c7826e4ac0c8c689dd67ff90e33f0b75
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\edgeSettings_2.0-2f9188b68640dbf72295f9083a21d674a314721ef06f82db281cbcb052ff8ec1Filesize
126KB
MD56698422bea0359f6d385a4d059c47301
SHA1b1107d1f8cc1ef600531ed87cea1c41b7be474f6
SHA2562f9188b68640dbf72295f9083a21d674a314721ef06f82db281cbcb052ff8ec1
SHA512d0cdb3fa21e03f950dbe732832e0939a4c57edc3b82adb7a556ebd3a81d219431a440357654dfea94d415ba00fd7dcbd76f49287d85978d12c224cbfa8c1ad8d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\synchronousLookupUrisFilesize
40B
MD5500a5860655dc9e6f9f81e3b3ad42b3f
SHA14df80ec9de551a41ff3e1fdc55dd8d9f9dbb5ecb
SHA256a678ecbcb2a2df9801a241a1d5640e5a2d87d35993b19e768d11bb1e1148a1e5
SHA51282d6cd8a8f9d1c4344a900dd85bab47df1bb8cbfa88e2178b09e23515ea87da865a1727b63daf187f2fe55ce8302e4d325ca151185447bc407e14947cafff299
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\synchronousLookupUris_638111309020341229Filesize
165B
MD54a0ca68406dee4d6fb5ca50051364427
SHA1291ab9bba58e8ac4018928f82ce58cda48480740
SHA2560353e73c017ddaae1a847d427f1172b3aa907ba5d751f4ff57f7cef39fad5bd5
SHA512db97937eff07ed7c7f4ab8cf48f0788c7abe3a3a5475faad3b484be853ef12fdcfc9f6a3f33ba94c19cb4e7e56d0d80aa4cf9958156d7a00ce62a754de31b855
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\topTrafficFilesize
29B
MD552e2839549e67ce774547c9f07740500
SHA1b172e16d7756483df0ca0a8d4f7640dd5d557201
SHA256f81b7b9ce24f5a2b94182e817037b5f1089dc764bc7e55a9b0a6227a7e121f32
SHA512d80e7351e4d83463255c002d3fdce7e5274177c24c4c728d7b7932d0be3ebcfeb68e1e65697ed5e162e1b423bb8cdfa0864981c4b466d6ad8b5e724d84b4203b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\topTraffic_638004170464094982Filesize
450KB
MD5e9c502db957cdb977e7f5745b34c32e6
SHA1dbd72b0d3f46fa35a9fe2527c25271aec08e3933
SHA2565a6b49358772db0b5c682575f02e8630083568542b984d6d00727740506569d4
SHA512b846e682427cf144a440619258f5aa5c94caee7612127a60e4bd3c712f8ff614da232d9a488e27fc2b0d53fd6acf05409958aea3b21ea2c1127821bd8e87a5ca
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Indexed Rules\30\9.33.0\Ruleset DataFilesize
139KB
MD572ccec08c60a7f3a383147f7a9f2951d
SHA143f34bde1863649ffaa91bfa656f7bc682c8428f
SHA256e3d195c993651718d270f40378d6bd5ffd60b871f27c18284c818dd27de36b59
SHA51258a598eb552ca86724a21a0c71d4f7bf127394b9de3ab6c9e74347b7689bc1c5a53a96b244a77e516f55d97274f8381a28515254821c505081792f08bdee38f6
-
C:\Users\Admin\Downloads\Cracking Tools\SMD_unpacking_tools\New folder\Simple_MSIL_Decryptor.exeFilesize
84KB
MD5faad7efed30037defa10f6944d8fd62c
SHA1f57dee1375b47f9568ed44cd4c20732c5fbe26b9
SHA256e6543ba496d58a7380fe72541d45b4d85dde29fb8b1a13e151f6365ca194ab45
SHA5127163adb190c03eca439f31fced7dc7e8c74f30de7b0b87f168032f80ae953d64fdf49a317258736ece3bdc1f60594b5582e0f443b43db56d1fb63c26c7eec6c4
-
C:\Users\Admin\Downloads\Cracking Tools\SMD_unpacking_tools\New folder\Simple_MSIL_Decryptor.exeFilesize
68KB
MD5f31d39e0a340a22d2e664ae92c5d3c89
SHA105cd45f108804a0d328ab7f204d05c3d06141f7a
SHA256611b694d9b73606d5b1bf197794c2b61fd4fe013fca7ae7010b824f86df2e847
SHA51228a69296d14a7ad71827c74eba4dcc412a1b3ed63aab5f31d6af4b1a447dd228cd8ac7421a8c83b4c6510076c5a7a21c50898cd0d5bfe52df16c4a736cdf13ac
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.logFilesize
148KB
MD54eb2eb3ae636705c6e72ddb76acb6135
SHA1268240f93a02f40b7a3097ca7b8db4f0ddef4cfd
SHA256bbb223700f03a4090255ec2a0dc529ae0ec46528fc813e5c03153f557ed04d82
SHA512f3292e994abeaff870b221f779c4b32c16a8a386417972831cb8ea21f51b681c5407174446f7d848bc02f0e63b8cfedf2e0bbb0688f874440e47de9a46d18b52
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.logFilesize
148KB
MD57ce5c048b3a79edd9cfdaa11e67014e1
SHA100b6903529996a8cee0815644192c1f1f0c6ec6d
SHA256adcfe68d702b73e609edf2700fbded7a8dbb13a73da1bfeccb17c09e88049db0
SHA512250b6c71d42493b388f9d1865f0d702bc82f43386db567402c1dedfc952f5dbabb3d26a99f435a19294ea7338152fae867afe4f29ad9a503c1996eba921615f5
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.logFilesize
149KB
MD53d346c2c3352c096915abeb82857ce49
SHA18f94892d56b257e5d2cd19cf9cfcc756d9e29ffd
SHA25646203e50a5336e03c634317c2101394039d39f2d84f5ae1b6aa5ab709dac9af3
SHA512eca9d3a26a5208502d060c2153588897f092c89911d5b6129d8b176f858286e10bb9c58a80d0f63d675d722f6ed6e9a6610b378d785d5b646383a1b423828f9b
-
C:\Windows\assembly\GAC_32\Simple_MSIL_Decryptor\1.0.0.0__57f08409feeb2038\Simple_MSIL_Decryptor.exeFilesize
68KB
MD5f31d39e0a340a22d2e664ae92c5d3c89
SHA105cd45f108804a0d328ab7f204d05c3d06141f7a
SHA256611b694d9b73606d5b1bf197794c2b61fd4fe013fca7ae7010b824f86df2e847
SHA51228a69296d14a7ad71827c74eba4dcc412a1b3ed63aab5f31d6af4b1a447dd228cd8ac7421a8c83b4c6510076c5a7a21c50898cd0d5bfe52df16c4a736cdf13ac
-
C:\Windows\assembly\GAC_32\Simple_MSIL_Decryptor\1.0.0.0__57f08409feeb2038\Simple_MSIL_Decryptor.exeFilesize
68KB
MD5f31d39e0a340a22d2e664ae92c5d3c89
SHA105cd45f108804a0d328ab7f204d05c3d06141f7a
SHA256611b694d9b73606d5b1bf197794c2b61fd4fe013fca7ae7010b824f86df2e847
SHA51228a69296d14a7ad71827c74eba4dcc412a1b3ed63aab5f31d6af4b1a447dd228cd8ac7421a8c83b4c6510076c5a7a21c50898cd0d5bfe52df16c4a736cdf13ac
-
C:\Windows\assembly\GAC_32\Simple_MSIL_Decryptor\1.0.0.0__57f08409feeb2038\Simple_MSIL_Decryptor.exeFilesize
68KB
MD5f31d39e0a340a22d2e664ae92c5d3c89
SHA105cd45f108804a0d328ab7f204d05c3d06141f7a
SHA256611b694d9b73606d5b1bf197794c2b61fd4fe013fca7ae7010b824f86df2e847
SHA51228a69296d14a7ad71827c74eba4dcc412a1b3ed63aab5f31d6af4b1a447dd228cd8ac7421a8c83b4c6510076c5a7a21c50898cd0d5bfe52df16c4a736cdf13ac
-
C:\Windows\assembly\GAC_32\Simple_MSIL_Decryptor\1.0.0.0__57f08409feeb2038\Simple_MSIL_Decryptor.exeFilesize
68KB
MD5f31d39e0a340a22d2e664ae92c5d3c89
SHA105cd45f108804a0d328ab7f204d05c3d06141f7a
SHA256611b694d9b73606d5b1bf197794c2b61fd4fe013fca7ae7010b824f86df2e847
SHA51228a69296d14a7ad71827c74eba4dcc412a1b3ed63aab5f31d6af4b1a447dd228cd8ac7421a8c83b4c6510076c5a7a21c50898cd0d5bfe52df16c4a736cdf13ac
-
C:\Windows\assembly\GAC_32\Simple_MSIL_Decryptor\1.0.0.0__57f08409feeb2038\Simple_MSIL_Decryptor.exeFilesize
68KB
MD5f31d39e0a340a22d2e664ae92c5d3c89
SHA105cd45f108804a0d328ab7f204d05c3d06141f7a
SHA256611b694d9b73606d5b1bf197794c2b61fd4fe013fca7ae7010b824f86df2e847
SHA51228a69296d14a7ad71827c74eba4dcc412a1b3ed63aab5f31d6af4b1a447dd228cd8ac7421a8c83b4c6510076c5a7a21c50898cd0d5bfe52df16c4a736cdf13ac
-
C:\Windows\assembly\GAC_32\Simple_MSIL_Decryptor\1.0.0.0__57f08409feeb2038\Simple_MSIL_Decryptor.exeFilesize
68KB
MD5f31d39e0a340a22d2e664ae92c5d3c89
SHA105cd45f108804a0d328ab7f204d05c3d06141f7a
SHA256611b694d9b73606d5b1bf197794c2b61fd4fe013fca7ae7010b824f86df2e847
SHA51228a69296d14a7ad71827c74eba4dcc412a1b3ed63aab5f31d6af4b1a447dd228cd8ac7421a8c83b4c6510076c5a7a21c50898cd0d5bfe52df16c4a736cdf13ac
-
C:\Windows\assembly\GAC_32\Simple_MSIL_Decryptor\1.0.0.0__57f08409feeb2038\Simple_MSIL_Decryptor.exeFilesize
68KB
MD5f31d39e0a340a22d2e664ae92c5d3c89
SHA105cd45f108804a0d328ab7f204d05c3d06141f7a
SHA256611b694d9b73606d5b1bf197794c2b61fd4fe013fca7ae7010b824f86df2e847
SHA51228a69296d14a7ad71827c74eba4dcc412a1b3ed63aab5f31d6af4b1a447dd228cd8ac7421a8c83b4c6510076c5a7a21c50898cd0d5bfe52df16c4a736cdf13ac
-
\??\pipe\LOCAL\crashpad_4208_TPRKNRJAXLRQDABPMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/544-289-0x0000000000000000-mapping.dmp
-
memory/756-337-0x00007FF8B2070000-0x00007FF8B2B31000-memory.dmpFilesize
10.8MB
-
memory/756-338-0x00007FF8B2070000-0x00007FF8B2B31000-memory.dmpFilesize
10.8MB
-
memory/756-249-0x0000000000000000-mapping.dmp
-
memory/840-310-0x0000000000000000-mapping.dmp
-
memory/1028-234-0x0000000000000000-mapping.dmp
-
memory/1036-261-0x0000000000000000-mapping.dmp
-
memory/1164-151-0x0000000000000000-mapping.dmp
-
memory/1168-308-0x0000000000000000-mapping.dmp
-
memory/1180-238-0x0000000000000000-mapping.dmp
-
memory/1220-150-0x0000000000000000-mapping.dmp
-
memory/1256-155-0x0000000000000000-mapping.dmp
-
memory/1368-140-0x0000000000000000-mapping.dmp
-
memory/1372-135-0x0000000000000000-mapping.dmp
-
memory/1488-287-0x0000000000000000-mapping.dmp
-
memory/1500-292-0x0000000000000000-mapping.dmp
-
memory/1668-263-0x0000000000000000-mapping.dmp
-
memory/1784-319-0x00000000002B0000-0x00000000002CC000-memory.dmpFilesize
112KB
-
memory/1796-148-0x0000000000000000-mapping.dmp
-
memory/1796-157-0x0000000000000000-mapping.dmp
-
memory/2228-264-0x0000000000000000-mapping.dmp
-
memory/2244-358-0x00000000006B0000-0x00000000006E0000-memory.dmpFilesize
192KB
-
memory/2400-247-0x0000000000000000-mapping.dmp
-
memory/2576-187-0x0000000004FC0000-0x0000000005052000-memory.dmpFilesize
584KB
-
memory/2576-185-0x00000000005A0000-0x00000000005B8000-memory.dmpFilesize
96KB
-
memory/2576-188-0x0000000005EA0000-0x0000000005EAA000-memory.dmpFilesize
40KB
-
memory/2576-186-0x0000000005570000-0x0000000005B14000-memory.dmpFilesize
5.6MB
-
memory/2752-284-0x0000000000470000-0x0000000000480000-memory.dmpFilesize
64KB
-
memory/2752-285-0x0000000004DD0000-0x0000000004EEE000-memory.dmpFilesize
1.1MB
-
memory/2752-286-0x0000000004D30000-0x0000000004DA6000-memory.dmpFilesize
472KB
-
memory/2844-202-0x0000000000FD0000-0x0000000000FE8000-memory.dmpFilesize
96KB
-
memory/3020-362-0x00007FF8B0060000-0x00007FF8B0B21000-memory.dmpFilesize
10.8MB
-
memory/3020-365-0x00007FF8B0060000-0x00007FF8B0B21000-memory.dmpFilesize
10.8MB
-
memory/3060-290-0x0000000000000000-mapping.dmp
-
memory/3096-242-0x0000000000000000-mapping.dmp
-
memory/3116-253-0x0000000000000000-mapping.dmp
-
memory/3168-296-0x0000000000000000-mapping.dmp
-
memory/3292-243-0x0000000000000000-mapping.dmp
-
memory/3460-146-0x0000000000000000-mapping.dmp
-
memory/3476-240-0x0000000000000000-mapping.dmp
-
memory/3652-223-0x0000000000000000-mapping.dmp
-
memory/3652-144-0x0000000000000000-mapping.dmp
-
memory/3720-180-0x0000000000000000-mapping.dmp
-
memory/3816-300-0x0000000000000000-mapping.dmp
-
memory/3952-324-0x00000224E1810000-0x00000224E19B6000-memory.dmpFilesize
1.6MB
-
memory/3952-326-0x00007FF8B0060000-0x00007FF8B0B21000-memory.dmpFilesize
10.8MB
-
memory/3952-325-0x00007FF8B0060000-0x00007FF8B0B21000-memory.dmpFilesize
10.8MB
-
memory/3976-321-0x00007FF8B0060000-0x00007FF8B0B21000-memory.dmpFilesize
10.8MB
-
memory/3976-322-0x00007FF8B0060000-0x00007FF8B0B21000-memory.dmpFilesize
10.8MB
-
memory/3976-320-0x00000199E68F0000-0x00000199E6A96000-memory.dmpFilesize
1.6MB
-
memory/4112-327-0x00007FF8B0060000-0x00007FF8B0B21000-memory.dmpFilesize
10.8MB
-
memory/4120-255-0x0000000000000000-mapping.dmp
-
memory/4264-369-0x00007FF8B0060000-0x00007FF8B0B21000-memory.dmpFilesize
10.8MB
-
memory/4264-368-0x00007FF8B0060000-0x00007FF8B0B21000-memory.dmpFilesize
10.8MB
-
memory/4280-371-0x00007FF8B0060000-0x00007FF8B0B21000-memory.dmpFilesize
10.8MB
-
memory/4280-370-0x00007FF8B0060000-0x00007FF8B0B21000-memory.dmpFilesize
10.8MB
-
memory/4296-294-0x0000000000000000-mapping.dmp
-
memory/4332-153-0x0000000000000000-mapping.dmp
-
memory/4420-142-0x0000000000000000-mapping.dmp
-
memory/4440-363-0x00007FF8B0060000-0x00007FF8B0B21000-memory.dmpFilesize
10.8MB
-
memory/4440-134-0x0000000000000000-mapping.dmp
-
memory/4440-364-0x00007FF8B0060000-0x00007FF8B0B21000-memory.dmpFilesize
10.8MB
-
memory/4480-132-0x0000000000000000-mapping.dmp
-
memory/4512-306-0x0000000000000000-mapping.dmp
-
memory/4592-339-0x00007FF8B2070000-0x00007FF8B2B31000-memory.dmpFilesize
10.8MB
-
memory/4644-152-0x0000000000000000-mapping.dmp
-
memory/4696-138-0x0000000000000000-mapping.dmp
-
memory/4780-196-0x0000000000E30000-0x0000000000E48000-memory.dmpFilesize
96KB
-
memory/4780-200-0x00000000084D0000-0x000000000860E000-memory.dmpFilesize
1.2MB
-
memory/4832-311-0x0000000000000000-mapping.dmp
-
memory/4896-341-0x00007FF8B2070000-0x00007FF8B2B31000-memory.dmpFilesize
10.8MB
-
memory/4896-340-0x00007FF8B2070000-0x00007FF8B2B31000-memory.dmpFilesize
10.8MB
-
memory/4920-331-0x0000000007320000-0x00000000074C6000-memory.dmpFilesize
1.6MB
-
memory/4928-257-0x0000000000000000-mapping.dmp
-
memory/5020-182-0x0000000000000000-mapping.dmp
-
memory/5092-329-0x00007FF8B0060000-0x00007FF8B0B21000-memory.dmpFilesize
10.8MB
-
memory/5092-330-0x00007FF8B0060000-0x00007FF8B0B21000-memory.dmpFilesize
10.8MB
-
memory/5092-328-0x00007FF8B0060000-0x00007FF8B0B21000-memory.dmpFilesize
10.8MB
-
memory/5148-236-0x0000000000000000-mapping.dmp
-
memory/5160-366-0x00007FF8B0060000-0x00007FF8B0B21000-memory.dmpFilesize
10.8MB
-
memory/5160-367-0x00007FF8B0060000-0x00007FF8B0B21000-memory.dmpFilesize
10.8MB
-
memory/5276-193-0x00000000749A0000-0x0000000074F51000-memory.dmpFilesize
5.7MB
-
memory/5276-194-0x00000000749A0000-0x0000000074F51000-memory.dmpFilesize
5.7MB
-
memory/5280-259-0x0000000000000000-mapping.dmp
-
memory/5284-304-0x0000000000000000-mapping.dmp
-
memory/5304-298-0x0000000000000000-mapping.dmp
-
memory/5308-302-0x0000000000000000-mapping.dmp
-
memory/5348-159-0x0000000000000000-mapping.dmp
-
memory/5404-209-0x0000000000000000-mapping.dmp
-
memory/5424-184-0x0000000000000000-mapping.dmp
-
memory/5448-161-0x0000000000000000-mapping.dmp
-
memory/5484-281-0x00007FF8B2070000-0x00007FF8B2B31000-memory.dmpFilesize
10.8MB
-
memory/5484-280-0x0000000000190000-0x000000000022E000-memory.dmpFilesize
632KB
-
memory/5520-163-0x0000000000000000-mapping.dmp
-
memory/5524-190-0x0000000000000000-mapping.dmp
-
memory/5620-165-0x0000000000000000-mapping.dmp
-
memory/5636-167-0x0000000000000000-mapping.dmp
-
memory/5656-323-0x0000000000C70000-0x0000000000DAE000-memory.dmpFilesize
1.2MB
-
memory/5668-268-0x000001F8D14D0000-0x000001F8D151C000-memory.dmpFilesize
304KB
-
memory/5668-277-0x000001F8D1680000-0x000001F8D17BE000-memory.dmpFilesize
1.2MB
-
memory/5668-273-0x000001F8D13B0000-0x000001F8D13BC000-memory.dmpFilesize
48KB
-
memory/5668-274-0x000001F8D14C0000-0x000001F8D14C8000-memory.dmpFilesize
32KB
-
memory/5668-265-0x000001F8B70B0000-0x000001F8B70D4000-memory.dmpFilesize
144KB
-
memory/5668-266-0x000001F8D1410000-0x000001F8D147A000-memory.dmpFilesize
424KB
-
memory/5668-267-0x000001F8D13C0000-0x000001F8D13DA000-memory.dmpFilesize
104KB
-
memory/5668-279-0x00007FF8B2070000-0x00007FF8B2B31000-memory.dmpFilesize
10.8MB
-
memory/5668-278-0x000001F8D1650000-0x000001F8D1658000-memory.dmpFilesize
32KB
-
memory/5668-271-0x000001F8D14A0000-0x000001F8D14B6000-memory.dmpFilesize
88KB
-
memory/5668-269-0x000001F8D13E0000-0x000001F8D13F2000-memory.dmpFilesize
72KB
-
memory/5668-270-0x000001F8D13A0000-0x000001F8D13B0000-memory.dmpFilesize
64KB
-
memory/5668-276-0x00007FF8B2070000-0x00007FF8B2B31000-memory.dmpFilesize
10.8MB
-
memory/5668-275-0x00007FF8B2070000-0x00007FF8B2B31000-memory.dmpFilesize
10.8MB
-
memory/5668-272-0x000001F8D1520000-0x000001F8D1540000-memory.dmpFilesize
128KB
-
memory/5688-361-0x00007FF8B0060000-0x00007FF8B0B21000-memory.dmpFilesize
10.8MB
-
memory/5760-169-0x0000000000000000-mapping.dmp
-
memory/5776-171-0x0000000000000000-mapping.dmp
-
memory/5848-173-0x0000000000000000-mapping.dmp
-
memory/5860-251-0x0000000000000000-mapping.dmp
-
memory/5888-342-0x00007FF8B1CA0000-0x00007FF8B2761000-memory.dmpFilesize
10.8MB
-
memory/5900-245-0x0000000000000000-mapping.dmp
-
memory/5964-313-0x0000000000000000-mapping.dmp
-
memory/6008-282-0x00007FF8B2070000-0x00007FF8B2B31000-memory.dmpFilesize
10.8MB
-
memory/6008-283-0x00007FF8B2070000-0x00007FF8B2B31000-memory.dmpFilesize
10.8MB
-
memory/6040-175-0x0000000000000000-mapping.dmp
-
memory/6048-336-0x00007FF8B2070000-0x00007FF8B2B31000-memory.dmpFilesize
10.8MB
-
memory/6048-335-0x00007FF8B2070000-0x00007FF8B2B31000-memory.dmpFilesize
10.8MB
-
memory/6056-177-0x0000000000000000-mapping.dmp
-
memory/6100-178-0x0000000000000000-mapping.dmp