Analysis
- max time kernel
186s - max time network
270s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
03/03/2024, 11:07
General
- Target MEmu-setup-abroad-sdk-mv.exe
- Size 23.0MB
- Sample240303-m79gvsaa45
- SHA256 89174acde0ea21562e6186847ba7d12aacd9b2b2132f456dd8335680daadd9a9
Malware Config
Signatures
- Cobalt Strike reflective loader 1 IoCs
Detects the reflective loader used by Cobalt Strike.
- Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
- Detect ZGRat V1 3 IoCs
- ZGRat
ZGRat is remote access trojan written in C#.
- Drops file in Drivers directory 7 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks for any installed AV software in registry 1 TTPs 2 IoCs
- Downloads MZ/PE file
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
- Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory 64 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
- Executes dropped EXE 31 IoCs
- Launches sc.exe 24 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Loads dropped DLL 64 IoCs
- Registers COM server for autorun 1 TTPs 15 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- Checks processor information in registry 2 TTPs 9 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
- Modifies data under HKEY_USERS 64 IoCs
- Modifies registry class 64 IoCs
- Modifies system certificate store 2 TTPs 22 IoCs
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: LoadsDriver 4 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 41 IoCs
- Suspicious use of SendNotifyMessage 38 IoCs
- Suspicious use of SetWindowsHookEx 40 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\MEmu-setup-abroad-sdk-mv.exe"C:\Users\Admin\AppData\Local\Temp\MEmu-setup-abroad-sdk-mv.exe"1⤵
- Checks for any installed AV software in registry
- Drops file in Program Files directory
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.microvirt.com/new_market/service.php?action=directed&channel=cd5e1e00&hver=9.0.0.0&id=49&lang=22⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9c91346f8,0x7ff9c9134708,0x7ff9c91347183⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=fallback-handler --database="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --exception-pointers=102778570522624 --process=176 /prefetch:7 --thread=78284⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1496,2023050628376450720,444927200103507100,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1496,2023050628376450720,444927200103507100,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1496,2023050628376450720,444927200103507100,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1496,2023050628376450720,444927200103507100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3584 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1496,2023050628376450720,444927200103507100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3592 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1496,2023050628376450720,444927200103507100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4532 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1496,2023050628376450720,444927200103507100,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4880 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1496,2023050628376450720,444927200103507100,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4880 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1496,2023050628376450720,444927200103507100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1496,2023050628376450720,444927200103507100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4048 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1496,2023050628376450720,444927200103507100,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4024 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1496,2023050628376450720,444927200103507100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1496,2023050628376450720,444927200103507100,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5944 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1496,2023050628376450720,444927200103507100,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4552 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1496,2023050628376450720,444927200103507100,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4188 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1496,2023050628376450720,444927200103507100,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2288 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1496,2023050628376450720,444927200103507100,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5532 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1496,2023050628376450720,444927200103507100,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1864 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1496,2023050628376450720,444927200103507100,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2364 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1496,2023050628376450720,444927200103507100,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1260 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1496,2023050628376450720,444927200103507100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4428 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1496,2023050628376450720,444927200103507100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2604 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1496,2023050628376450720,444927200103507100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3164 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1496,2023050628376450720,444927200103507100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6448 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1496,2023050628376450720,444927200103507100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6556 /prefetch:13⤵
-
-
-
C:\Program Files\Microvirt\tempDir\Setup.exe"C:\Program Files\Microvirt\tempDir\Setup.exe" --insPath "C:\Program Files\Microvirt" --channel cd5e1e15 --noCheckMd5 --callbackProcessInfo --callbackExitCode /S2⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\sc.exeC:\Windows\System32\sc query MEmuSVC3⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\System32\sc query MEmuSVC3⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\System32\sc query MEmuUSB3⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\System32\sc query MEmuNetFlt3⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\System32\sc query MEmuNetLwf3⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\System32\sc query MEmuNetAdp3⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\System32\sc query MEmuNetFlt3⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\System32\sc query MEmuNetLwf3⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\System32\sc query MEmuNetAdp3⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\System32\sc query MEmuUSBMon3⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\System32\sc query MEmuDrv3⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32" /s /u "C:\Program Files\Microvirt\MEmuHyperv\MEmuC.dll"3⤵
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32" /s /u "C:\Program Files\Microvirt\MEmuHyperv\MEmuProxyStub.dll"3⤵
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32" /s /u "C:\Program Files\Microvirt\MEmuHyperv\x86\MEmuC.dll"3⤵
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32" /s /u "C:\Program Files\Microvirt\MEmuHyperv\x86\MEmuProxyStub.dll"3⤵
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc" query MEmuDrv3⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc" query MEmuUSBMon3⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc" query MEmuNetFlt3⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc" query MEmuNetLwf3⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\system32\sc" query MEmuNetAdp3⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\System32\sc query MEmuSVC3⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\System32\sc query MEmuSVC3⤵
- Launches sc.exe
-
-
C:\Program Files\Microvirt\tempDir\7za.exe"C:\Program Files\Microvirt\tempDir\7za.exe" x -y -aoa "C:\Program Files\Microvirt\tempDir\Setup.7z" "-oC:\Program Files\Microvirt"3⤵
- Drops file in Program Files directory
- Executes dropped EXE
-
-
C:\Program Files\Microvirt\tempDir\7za.exe"C:\Program Files\Microvirt\tempDir\7za.exe" x -y -aoa "C:\Program Files\Microvirt\MEmuHyperv64.7z" "-oC:\Program Files\Microvirt\MEmuHyperv"3⤵
- Drops file in Program Files directory
- Executes dropped EXE
-
-
C:\Program Files\Microvirt\tempDir\7za.exe"C:\Program Files\Microvirt\tempDir\7za.exe" x -y -aoa "C:\Program Files\Microvirt\MEmuHyperv32.7z" "-oC:\Program Files\Microvirt\MEmuHyperv\x86" libcurl.dll libcrypto-1_1.dll libssl-1_1.dll msvcp100.dll msvcr100.dll msvcr120.dll MEmuC.dll MEmuHPV.dll MEmuProxyStub.dll MEmuREM.dll MEmuRT.dll3⤵
- Drops file in Program Files directory
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\System32\sc query MEmuDrv3⤵
- Launches sc.exe
-
-
C:\Program Files\Microvirt\MEmuHyperv\MEmuDrvInst.exe"C:\Program Files\Microvirt\MEmuHyperv\MEmuDrvInst.exe" driver install "C:\Program Files\Microvirt\MEmuHyperv\MEmuDrv.inf"3⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Microvirt\MEmuHyperv\MEmuManage.exe"C:\Program Files\Microvirt\MEmuHyperv\MEmuManage.exe" list runningvms3⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
-
-
C:\Program Files\Microvirt\MEmuHyperv\MEmuSVC.exe"C:\Program Files\Microvirt\MEmuHyperv\MEmuSVC.exe" /UnregServer3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32" /s /u "C:\Program Files\Microvirt\MEmuHyperv\MEmuC.dll"3⤵
- Loads dropped DLL
-
C:\Windows\system32\regsvr32.exe/s /u "C:\Program Files\Microvirt\MEmuHyperv\MEmuC.dll"4⤵
- Loads dropped DLL
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32" /s /u "C:\Program Files\Microvirt\MEmuHyperv\MEmuProxyStub.dll"3⤵
- Loads dropped DLL
-
C:\Windows\system32\regsvr32.exe/s /u "C:\Program Files\Microvirt\MEmuHyperv\MEmuProxyStub.dll"4⤵
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32" /s /u "C:\Program Files\Microvirt\MEmuHyperv\x86\MEmuC.dll"3⤵
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32" /s /u "C:\Program Files\Microvirt\MEmuHyperv\x86\MEmuProxyStub.dll"3⤵
-
-
C:\Program Files\Microvirt\MEmuHyperv\MEmuSVC.exe"C:\Program Files\Microvirt\MEmuHyperv\MEmuSVC.exe" /RegServer3⤵
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32" /s "C:\Program Files\Microvirt\MEmuHyperv\MEmuC.dll"3⤵
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files\Microvirt\MEmuHyperv\MEmuC.dll"4⤵
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32" /s "C:\Program Files\Microvirt\MEmuHyperv\MEmuProxyStub.dll"3⤵
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files\Microvirt\MEmuHyperv\MEmuProxyStub.dll"4⤵
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32" /s "C:\Program Files\Microvirt\MEmuHyperv\x86\MEmuC.dll"3⤵
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32" /s "C:\Program Files\Microvirt\MEmuHyperv\x86\MEmuProxyStub.dll"3⤵
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\System32\sc query MEmuSVC3⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\System32\sc query MEmuSVC3⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\System32\sc query MEmuSVC3⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\system32\sc start MEmuSVC3⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\System32\sc query MEmuSVC3⤵
- Launches sc.exe
-
-
C:\Program Files\Microvirt\MEmuHyperv\MEmuManage.exe"C:\Program Files\Microvirt\MEmuHyperv\MEmuManage.exe" setproperty machinefolder "C:\Program Files\Microvirt\MEmu\MemuHyperv VMs"3⤵
-
-
C:\Program Files\Microvirt\MEmu\MEmuRepair.exe"C:\Program Files\Microvirt\MEmu\MEmuRepair.exe" --getVtStatus3⤵
-
-
C:\Program Files\Microvirt\MEmuHyperv\MEmuManage.exe"C:\Program Files\Microvirt\MEmuHyperv\MEmuManage.exe" setproperty machinefolder "C:\Program Files\Microvirt\MEmu\MemuHyperv VMs"3⤵
-
-
C:\Program Files\Microvirt\MEmuHyperv\MEmuManage.exe"C:\Program Files\Microvirt\MEmuHyperv\MEmuManage.exe" showmediuminfo "C:\Program Files\Microvirt\MEmu\image\96\MEmu96-2024021900027FFF-disk1.vmdk"3⤵
-
-
C:\Program Files\Microvirt\MEmu\MEmuc.exe"C:\Program Files\Microvirt\MEmu\MEmuc.exe" create 963⤵
-
C:\Program Files\Microvirt\MEmu\MEmuConsole.exe"C:\Program Files\Microvirt\MEmu\MEmuConsole.exe" -b4⤵
-
-
-
C:\Program Files\Microvirt\MEmu\MEmu.exe"C:\Program Files\Microvirt\MEmu\MEmu.exe" adjustconfig MEmu3⤵
-
-
C:\Program Files\Microvirt\MEmu\screenrecord.exe"C:\Program Files\Microvirt\MEmu\screenrecord.exe"3⤵
-
-
C:\Program Files\Microvirt\MEmu\MEmu.exe"C:\Program Files\Microvirt\MEmu\MEmu.exe" install3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.memuplay.com/thanks/3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9c91346f8,0x7ff9c9134708,0x7ff9c91347184⤵
-
-
-
-
C:\Program Files\Microvirt\MEmu\MEmuRepair.exe"C:\Program Files\Microvirt\MEmu\MEmuRepair.exe" --getVtStatus2⤵
-
-
C:\Program Files\Microvirt\MEmu\MEmu.exe"C:\Program Files\Microvirt\MEmu\MEmu.exe" MEmu2⤵
-
C:\Windows\SysWOW64\cmd.execmd /c chcp 65001 && ping www.baidu.com -n 53⤵
-
C:\Windows\SysWOW64\chcp.comchcp 650014⤵
-
-
C:\Windows\SysWOW64\PING.EXEping www.baidu.com -n 54⤵
- Runs ping.exe
-
-
-
C:\Program Files\Microvirt\MEmu\adb.exeadb disconnect 127.0.0.1:215033⤵
-
-
C:\Windows\SysWOW64\cmd.execmd /c ipconfig /flushdns3⤵
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /flushdns4⤵
- Gathers network information
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 31522⤵
- Program crash
-
-
C:\Users\Admin\AppData\Local\Temp\Product_files\rsStubActivator.exe"C:\Users\Admin\AppData\Local\Temp\Product_files\rsStubActivator.exe" -ip:"dui=c070db30910b3644d518fbc7a55deb33bcdf70e9&dit=20240303110885790&is_silent=true&oc=DOT_RAV_Cross_Tri_NCB&p=c52b&a=100&b=&se=true" -vp:"dui=c070db30910b3644d518fbc7a55deb33bcdf70e9&dit=20240303110885790&oc=DOT_RAV_Cross_Tri_NCB&p=c52b&a=100&oip=26&ptl=7&dta=true" -dp:"dui=c070db30910b3644d518fbc7a55deb33bcdf70e9&dit=20240303110885790&oc=DOT_RAV_Cross_Tri_NCB&p=c52b&a=100" -i -v -d1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\bjwia3d0.exe"C:\Users\Admin\AppData\Local\Temp\bjwia3d0.exe" /silent2⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\nskAD1A.tmp\RAVEndPointProtection-installer.exe"C:\Users\Admin\AppData\Local\Temp\nskAD1A.tmp\RAVEndPointProtection-installer.exe" "C:\Users\Admin\AppData\Local\Temp\bjwia3d0.exe" /silent3⤵
- Drops file in Drivers directory
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe"C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe" -i -bn:ReasonLabs -pn:EPP -lpn:rav_antivirus -url:https://update.reasonsecurity.com/v2/live -dt:104⤵
- Executes dropped EXE
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" setupapi.dll,InstallHinfSection DefaultInstall 128 C:\Program Files\ReasonLabs\EPP\x64\rsKernelEngine.inf4⤵
- Adds Run key to start application
-
C:\Windows\system32\runonce.exe"C:\Windows\system32\runonce.exe" -r5⤵
- Checks processor information in registry
-
C:\Windows\System32\grpconv.exe"C:\Windows\System32\grpconv.exe" -o6⤵
-
-
-
-
C:\Windows\system32\wevtutil.exe"C:\Windows\system32\wevtutil.exe" im C:\Program Files\ReasonLabs\EPP\x64\rsKernelEngineEvents.xml4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\fltmc.exe"fltmc.exe" load rsKernelEngine4⤵
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\wevtutil.exe"C:\Windows\system32\wevtutil.exe" im C:\Program Files\ReasonLabs\EPP\elam\evntdrv.xml4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files\ReasonLabs\EPP\rsWSC.exe"C:\Program Files\ReasonLabs\EPP\rsWSC.exe" -i -i4⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files\ReasonLabs\EPP\rsClientSvc.exe"C:\Program Files\ReasonLabs\EPP\rsClientSvc.exe" -i -i4⤵
- Executes dropped EXE
-
-
C:\Program Files\ReasonLabs\EPP\rsEngineSvc.exe"C:\Program Files\ReasonLabs\EPP\rsEngineSvc.exe" -i -i4⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\umws2sz3.exe"C:\Users\Admin\AppData\Local\Temp\umws2sz3.exe" /silent2⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\nso98FC.tmp\RAVVPN-installer.exe"C:\Users\Admin\AppData\Local\Temp\nso98FC.tmp\RAVVPN-installer.exe" "C:\Users\Admin\AppData\Local\Temp\umws2sz3.exe" /silent3⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\ReasonLabs\VPN\rsVPNClientSvc.exe"C:\Program Files\ReasonLabs\VPN\rsVPNClientSvc.exe" -i -i4⤵
- Executes dropped EXE
-
-
C:\Program Files\ReasonLabs\VPN\rsVPNSvc.exe"C:\Program Files\ReasonLabs\VPN\rsVPNSvc.exe" -i -i4⤵
- Executes dropped EXE
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\3gd2qnss.exe"C:\Users\Admin\AppData\Local\Temp\3gd2qnss.exe" /silent2⤵
-
C:\Users\Admin\AppData\Local\Temp\nsoC8C2.tmp\SaferWeb-installer.exe"C:\Users\Admin\AppData\Local\Temp\nsoC8C2.tmp\SaferWeb-installer.exe" "C:\Users\Admin\AppData\Local\Temp\3gd2qnss.exe" /silent3⤵
-
\??\c:\windows\system32\rundll32.exe"c:\windows\system32\rundll32.exe" setupapi.dll,InstallHinfSection DefaultInstall 128 C:\Program Files\ReasonLabs\DNS\rsDwf.inf4⤵
-
C:\Windows\system32\runonce.exe"C:\Windows\system32\runonce.exe" -r5⤵
-
C:\Windows\System32\grpconv.exe"C:\Windows\System32\grpconv.exe" -o6⤵
-
-
-
-
C:\Program Files\ReasonLabs\DNS\rsDNSClientSvc.exe"C:\Program Files\ReasonLabs\DNS\rsDNSClientSvc.exe" -i -i4⤵
-
-
C:\Program Files\ReasonLabs\DNS\rsDNSResolver.exe"C:\Program Files\ReasonLabs\DNS\rsDNSResolver.exe" -i -service install4⤵
-
-
C:\Program Files\ReasonLabs\DNS\rsDNSResolver.exe"C:\Program Files\ReasonLabs\DNS\rsDNSResolver.exe" -service install4⤵
-
-
C:\Program Files\ReasonLabs\DNS\rsDNSSvc.exe"C:\Program Files\ReasonLabs\DNS\rsDNSSvc.exe" -i -i4⤵
-
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe"C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe" -pn:EPP -lpn:rav_antivirus -url:https://update.reasonsecurity.com/v2/live -bn:ReasonLabs -dt:101⤵
- Executes dropped EXE
-
C:\Program Files\ReasonLabs\EPP\rsWSC.exe"C:\Program Files\ReasonLabs\EPP\rsWSC.exe"1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\ReasonLabs\EPP\rsClientSvc.exe"C:\Program Files\ReasonLabs\EPP\rsClientSvc.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\ReasonLabs\EPP\rsEngineSvc.exe"C:\Program Files\ReasonLabs\EPP\rsEngineSvc.exe"1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
\??\c:\program files\reasonlabs\epp\rsHelper.exe"c:\program files\reasonlabs\epp\rsHelper.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
\??\c:\program files\reasonlabs\EPP\ui\EPP.exe"c:\program files\reasonlabs\EPP\ui\EPP.exe" --minimized --first-run2⤵
- Executes dropped EXE
-
C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe"C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe" "c:\program files\reasonlabs\EPP\ui\app.asar" --engine-path="c:\program files\reasonlabs\EPP" --minimized --first-run3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe"C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\ReasonLabs\EPP" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2260 --field-trial-handle=2264,i,17883452948713436447,9637315873024068080,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:24⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe"C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\ReasonLabs\EPP" --standard-schemes=mc --secure-schemes=mc --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --mojo-platform-channel-handle=2296 --field-trial-handle=2264,i,17883452948713436447,9637315873024068080,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:84⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe"C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ReasonLabs\EPP" --standard-schemes=mc --secure-schemes=mc --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --app-user-model-id=com.reasonlabs.epp --app-path="C:\Program Files\ReasonLabs\Common\Client\v1.4.2\resources\app.asar" --enable-sandbox --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2852 --field-trial-handle=2264,i,17883452948713436447,9637315873024068080,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:14⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe"C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ReasonLabs\EPP" --standard-schemes=mc --secure-schemes=mc --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --app-user-model-id=com.reasonlabs.epp --app-path="C:\Program Files\ReasonLabs\Common\Client\v1.4.2\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3936 --field-trial-handle=2264,i,17883452948713436447,9637315873024068080,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:14⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe"C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\ReasonLabs\EPP" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2284 --field-trial-handle=2264,i,17883452948713436447,9637315873024068080,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:24⤵
-
-
C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe"C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\ReasonLabs\EPP" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=disabled --mojo-platform-channel-handle=2756 --field-trial-handle=2264,i,17883452948713436447,9637315873024068080,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:24⤵
-
-
-
-
C:\program files\reasonlabs\epp\rsLitmus.A.exe"C:\program files\reasonlabs\epp\rsLitmus.A.exe"2⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4476.0.316182617\876834722" -parentBuildID 20221007134813 -prefsHandle 1880 -prefMapHandle 1872 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a3347a1d-8080-4e18-814b-773d459eb482} 4476 "\\.\pipe\gecko-crash-server-pipe.4476" 1972 276653d2e58 gpu3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4476.1.353104552\794086307" -parentBuildID 20221007134813 -prefsHandle 2400 -prefMapHandle 2396 -prefsLen 20785 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bb34d02a-1d20-4afe-96ec-c1522739caa4} 4476 "\\.\pipe\gecko-crash-server-pipe.4476" 2412 27658871f58 socket3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4476.2.1678417703\1616195475" -childID 1 -isForBrowser -prefsHandle 3332 -prefMapHandle 3328 -prefsLen 20888 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {432a9384-07d3-4d1f-a9bb-55aeb62e75f2} 4476 "\\.\pipe\gecko-crash-server-pipe.4476" 3344 276692a4458 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4476.3.66312690\1922925661" -childID 2 -isForBrowser -prefsHandle 2964 -prefMapHandle 2916 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8b9d0138-fcbf-469f-bce6-405a82c54285} 4476 "\\.\pipe\gecko-crash-server-pipe.4476" 3668 27658862b58 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4476.4.2080297161\920830055" -childID 3 -isForBrowser -prefsHandle 4444 -prefMapHandle 4228 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bd2d1fc7-d294-41b5-9f47-6d55312dde6f} 4476 "\\.\pipe\gecko-crash-server-pipe.4476" 4460 2766a4fc558 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4476.5.1471105171\1908256214" -childID 4 -isForBrowser -prefsHandle 5136 -prefMapHandle 5132 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f2a20d43-f582-43bd-9f54-eedae1c42d0f} 4476 "\\.\pipe\gecko-crash-server-pipe.4476" 5148 2766b3af258 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4476.6.497389623\137248210" -childID 5 -isForBrowser -prefsHandle 5284 -prefMapHandle 5288 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f70e38c1-159a-492e-9f55-91f325c3860d} 4476 "\\.\pipe\gecko-crash-server-pipe.4476" 5168 2766b86e858 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4476.7.394679601\584163720" -childID 6 -isForBrowser -prefsHandle 5476 -prefMapHandle 5480 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {171c7937-ea47-4088-9e48-8ba87e480cfc} 4476 "\\.\pipe\gecko-crash-server-pipe.4476" 5560 2766b86dc58 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4476.8.1458057937\1250224864" -childID 7 -isForBrowser -prefsHandle 5944 -prefMapHandle 5940 -prefsLen 26285 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ceb52e65-9e4b-44f9-9d57-a2ca282b26eb} 4476 "\\.\pipe\gecko-crash-server-pipe.4476" 5952 2766c990858 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4476.9.1200053252\1061041106" -childID 8 -isForBrowser -prefsHandle 5940 -prefMapHandle 3080 -prefsLen 26725 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b589d5a2-0448-4781-9425-7ffad9304594} 4476 "\\.\pipe\gecko-crash-server-pipe.4476" 6080 2766cd5fc58 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4476.10.222756638\133837120" -childID 9 -isForBrowser -prefsHandle 5940 -prefMapHandle 6212 -prefsLen 26725 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {24a728fd-8521-4a38-9d6b-d80db6054c6a} 4476 "\\.\pipe\gecko-crash-server-pipe.4476" 6216 2766d345a58 tab3⤵
-
-
-
C:\Program Files\Microvirt\MEmuHyperv\MEmuSVC.exe"C:\Program Files\Microvirt\MEmuHyperv\MEmuSVC.exe" -Embedding1⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files\ReasonLabs\VPN\rsVPNClientSvc.exe"C:\Program Files\ReasonLabs\VPN\rsVPNClientSvc.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\ReasonLabs\VPN\rsVPNSvc.exe"C:\Program Files\ReasonLabs\VPN\rsVPNSvc.exe"1⤵
-
\??\c:\program files\reasonlabs\VPN\ui\VPN.exe"c:\program files\reasonlabs\VPN\ui\VPN.exe" --minimized --focused --first-run2⤵
-
C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe"C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe" "c:\program files\reasonlabs\VPN\ui\app.asar" --engine-path="c:\program files\reasonlabs\VPN" --minimized --focused --first-run3⤵
-
C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe"C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\ReasonLabs\VPN" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2232 --field-trial-handle=2236,i,8818949333630964216,261168085319388797,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:24⤵
-
-
C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe"C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\ReasonLabs\VPN" --mojo-platform-channel-handle=2168 --field-trial-handle=2236,i,8818949333630964216,261168085319388797,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:84⤵
-
-
C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe"C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ReasonLabs\VPN" --app-user-model-id=com.reasonlabs.vpn --app-path="C:\Program Files\ReasonLabs\Common\Client\v1.4.2\resources\app.asar" --enable-sandbox --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2800 --field-trial-handle=2236,i,8818949333630964216,261168085319388797,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:14⤵
-
-
C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe"C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ReasonLabs\VPN" --app-user-model-id=com.reasonlabs.vpn --app-path="C:\Program Files\ReasonLabs\Common\Client\v1.4.2\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3864 --field-trial-handle=2236,i,8818949333630964216,261168085319388797,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:14⤵
-
-
-
-
C:\Program Files\Microvirt\MEmuHyperv\MEmuSVC.exe"C:\Program Files\Microvirt\MEmuHyperv\MEmuSVC.exe" -Embedding1⤵
-
C:\Program Files\Microvirt\MEmu\MemuService.exe"C:\Program Files\Microvirt\MEmu\MemuService.exe"1⤵
-
C:\Program Files\Microvirt\MEmuHyperv\MEmuSVC.exe"C:\Program Files\Microvirt\MEmuHyperv\MEmuSVC.exe" -Embedding1⤵
-
C:\Program Files\Microvirt\MEmuHyperv\MEmuSVC.exe"C:\Program Files\Microvirt\MEmuHyperv\MEmuSVC.exe" -Embedding1⤵
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Program Files\Microvirt\MEmuHyperv\MEmuSVC.exe"C:\Program Files\Microvirt\MEmuHyperv\MEmuSVC.exe" -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Program Files\Microvirt\MEmuHyperv\MEmuSVC.exe"C:\Program Files\Microvirt\MEmuHyperv\MEmuSVC.exe" -Embedding1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3036 -ip 30361⤵
-
C:\Program Files\ReasonLabs\DNS\rsDNSClientSvc.exe"C:\Program Files\ReasonLabs\DNS\rsDNSClientSvc.exe"1⤵
-
C:\Program Files\ReasonLabs\DNS\rsDNSResolver.exe"C:\Program Files\ReasonLabs\DNS\rsDNSResolver.exe"1⤵
-
C:\Program Files\ReasonLabs\DNS\rsDNSSvc.exe"C:\Program Files\ReasonLabs\DNS\rsDNSSvc.exe"1⤵
-
\??\c:\program files\reasonlabs\DNS\ui\DNS.exe"c:\program files\reasonlabs\DNS\ui\DNS.exe" --minimized --focused --first-run2⤵
-
C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe"C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe" "c:\program files\reasonlabs\DNS\ui\app.asar" --engine-path="c:\program files\reasonlabs\DNS" --minimized --focused --first-run3⤵
-
C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe"C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\ReasonLabs\DNS" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2164 --field-trial-handle=2388,i,11159473659086398897,10842796788076265416,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:24⤵
-
-
C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe"C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\ReasonLabs\DNS" --mojo-platform-channel-handle=2448 --field-trial-handle=2388,i,11159473659086398897,10842796788076265416,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:84⤵
-
-
C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe"C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ReasonLabs\DNS" --app-user-model-id=com.reasonlabs.dns --app-path="C:\Program Files\ReasonLabs\Common\Client\v1.4.2\resources\app.asar" --enable-sandbox --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2816 --field-trial-handle=2388,i,11159473659086398897,10842796788076265416,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:14⤵
-
-
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Program Files\Microvirt\MEmu\MEmuConsole.exe"C:\Program Files\Microvirt\MEmu\MEmuConsole.exe"1⤵
-
C:\Program Files\Microvirt\MEmu\adb.exeadb start-server2⤵
-
-
C:\Program Files\Microvirt\MEmuHyperv\MEmuSVC.exe"C:\Program Files\Microvirt\MEmuHyperv\MEmuSVC.exe" -Embedding1⤵
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
MEmu.memu
MEmu.memu
config.ini
config.ini
config.ini
config.ini.MKwEbv
config.ini.lock
config.ini.lock
config.ini.lock
config.ini.oBVJfG
7za.exe
Setup.7z
Setup.exe
Setup.exe
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting
Setup.exe.setting.Uh3036
Setup.exe.setting.lock
rsSyncSvc.exe
rsSyncSvc.exe
rsDNSSvc.InstallLog
rsDNSSvc.InstallLog
uninstall.ico
InstallUtil.InstallLog
InstallerLib.dll
System.Net.Http.dll
rsElam.sys
mc.dll
rsClientSvc.exe
rsEngine.Client.dll
rsEngine.Core.dll
rsEngine.Data.dll
rsEngine.Extension.dll
rsEngine.Features.dll
rsEngine.Loggers.Application.dll
rsEngine.Scan.dll
rsEngine.UDI.dll
rsEngine.Utilities.Browsers.dll
rsEngine.Utilities.dll
rsEngine.config
rsEngineSvc.InstallLog
rsEngineSvc.InstallLog
rsEngineSvc.exe
rsEngineSvc.exe.config
rsWSC.InstallLog
rsWSC.exe
EPP.exe
rsKernelEngine.inf
Uninstall.exe
rsVPNSvc.InstallLog
rsVPNSvc.InstallLog
rsVPNSvc.InstallState
VPN.exe
SignaturesYF.dat.tmp
SignaturesYFS.dat.tmp
SignaturesYS.dat.tmp
settings.dat
settings.dat
69b863b3-cd00-49fd-8dcb-f59bb1f3aae1.tmp
the-real-index
the-real-index
MANIFEST-000001
_ruleset1
verified_contents.json
background.bundle.js
contentScript.bundle.js
icon-128.png
icon-34.png
icon-threat.png
icon-upgrade.png
arrow.svg
attention-icon.svg
breach-notify-icon.svg
close-icon.svg
crown.svg
info.svg
logo-blue.svg
logo_with_name.svg
no-scan-notify-icon.svg
index.bundle.js
index.html
manifest.json
noto-sans-bold.woff
noto-sans.woff
rules.json
segoe-ui-bold.woff
segoe-ui.woff
Network Persistent State
Network Persistent State
Network Persistent State
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity~RFe5803d3.TMP
CURRENT
Local State
Local State
Local State
Local State
MEmuSetup.log
MEmuSetup.log
MEmuSetup.log
rsStubActivator.exe
bjwia3d0.exe
bjwia3d0.exe
bjwia3d0.exe
mds.dll
System.dll
ArchiveUtilityx64.dll
Microsoft.Win32.TaskScheduler.dll
RAVEndPointProtection-installer.exe
rsAtom.dll
rsJSON.dll
rsLogger.dll
rsStubLib.dll
rsSyncSvc.exe
rsJSON.DLL
rsServiceController.DLL
rsAtom.DLL
rsLogger.DLL
uninstall.ico
rsAtom.DLL
rsJSON.DLL
rsLogger.DLL
rsJSON.DLL
rsAtom.DLL
00eb76de-6ece-4630-8314-44b17a7b515b.tmp
default.dic
data.safe.bin
2e14caab-1869-4142-ac9b-fdebd869cd79
df742727-8c91-42dd-9239-9acf30d552c1
prefs-1.js
prefs-1.js
prefs.js
sessionCheckpoints.json.tmp
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
sessionstore.jsonlz4
data_0
CURRENT
index
data_0
data_1
data_2
data_3
10005995-6d82-4ba2-bffb-ec99a755632b.tmp
f8d8a523-17c3-4870-b06d-1dd4051c1e92.tmp
MinecraftInstaller.ePPDq1Sv.exe.part
MEmuDrv.sys
7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6
18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB
memory/2356-13848-0x000001C9F66B0000-0x000001C9F66DE000-memory.dmp
memory/2356-13895-0x00007FF9B9050000-0x00007FF9B9B11000-memory.dmp
memory/2356-13849-0x00007FF9B9050000-0x00007FF9B9B11000-memory.dmp
memory/2356-13850-0x000001C9F8470000-0x000001C9F8480000-memory.dmp
memory/2356-13851-0x000001C9F6A70000-0x000001C9F6A71000-memory.dmp
memory/2356-13852-0x000001C9F66B0000-0x000001C9F66DE000-memory.dmp
memory/2356-13865-0x000001C9F6BF0000-0x000001C9F6C02000-memory.dmp
memory/2356-13866-0x000001C9F8410000-0x000001C9F844C000-memory.dmp
memory/3036-27-0x000000000A320000-0x000000000A84C000-memory.dmp
memory/3036-23-0x0000000006580000-0x0000000006612000-memory.dmp
memory/3036-26-0x0000000009D80000-0x0000000009DE6000-memory.dmp
memory/3036-20-0x0000000073D80000-0x0000000073DBE000-memory.dmp
memory/3036-30-0x0000000003C60000-0x0000000003C70000-memory.dmp
memory/3036-25-0x0000000009CE0000-0x0000000009D7C000-memory.dmp
memory/3036-24-0x0000000009C00000-0x0000000009C46000-memory.dmp
memory/3036-19-0x0000000006120000-0x000000000615E000-memory.dmp
memory/3036-15-0x0000000003C60000-0x0000000003C70000-memory.dmp
memory/3036-32-0x00000000734E0000-0x0000000073C90000-memory.dmp
memory/3036-22-0x0000000008CD0000-0x0000000009274000-memory.dmp
memory/3036-609-0x0000000003C60000-0x0000000003C70000-memory.dmp
memory/3036-21-0x00000000734E0000-0x0000000073C90000-memory.dmp
memory/3036-29-0x0000000003C60000-0x0000000003C70000-memory.dmp
memory/3036-28-0x0000000004450000-0x000000000445A000-memory.dmp
memory/4128-13903-0x000001CEB86B0000-0x000001CEB86D2000-memory.dmp
memory/4128-13902-0x000001CEB80D0000-0x000001CEB80EA000-memory.dmp
memory/4128-13901-0x000001CED14A0000-0x000001CED161C000-memory.dmp
memory/4128-13899-0x000001CED0E50000-0x000001CED0E60000-memory.dmp
memory/4128-13898-0x000001CED1130000-0x000001CED1496000-memory.dmp
memory/4128-13897-0x00007FF9B9050000-0x00007FF9B9B11000-memory.dmp
memory/4128-13900-0x000001CEB8060000-0x000001CEB8061000-memory.dmp
memory/4160-13718-0x000001BA77590000-0x000001BA775A0000-memory.dmp
memory/4160-597-0x00007FF9B9050000-0x00007FF9B9B11000-memory.dmp
memory/4160-634-0x000001BA77590000-0x000001BA775A0000-memory.dmp
memory/4160-535-0x000001BA779E0000-0x000001BA77F08000-memory.dmp
memory/4160-325-0x000001BA75150000-0x000001BA75158000-memory.dmp
memory/4160-12791-0x00007FF9B9050000-0x00007FF9B9B11000-memory.dmp
memory/4252-13076-0x00000263719B0000-0x00000263719FE000-memory.dmp
memory/4252-13057-0x00000263719B0000-0x00000263719FE000-memory.dmp
memory/4252-13811-0x0000026371950000-0x0000026371951000-memory.dmp
memory/4252-13803-0x0000026371AF0000-0x0000026371B1A000-memory.dmp
memory/4252-13798-0x0000026371940000-0x0000026371941000-memory.dmp
memory/4252-13790-0x0000026371A30000-0x0000026371A60000-memory.dmp
memory/4252-13786-0x0000026371960000-0x0000026371961000-memory.dmp
memory/4252-13776-0x0000026371A40000-0x0000026371A7A000-memory.dmp
memory/4252-13783-0x0000026371910000-0x0000026371911000-memory.dmp
memory/4252-13777-0x00007FF9B9050000-0x00007FF9B9B11000-memory.dmp
memory/4252-13825-0x0000026371A40000-0x0000026371A41000-memory.dmp
memory/4252-13731-0x00000263713A0000-0x00000263713B0000-memory.dmp
memory/4252-13108-0x00000263719B0000-0x00000263719FE000-memory.dmp
memory/4252-13106-0x00000263719B0000-0x00000263719FE000-memory.dmp
memory/4252-13104-0x00000263719B0000-0x00000263719FE000-memory.dmp
memory/4252-13102-0x00000263719B0000-0x00000263719FE000-memory.dmp
memory/4252-13100-0x00000263719B0000-0x00000263719FE000-memory.dmp
memory/4252-13098-0x00000263719B0000-0x00000263719FE000-memory.dmp
memory/4252-13096-0x00000263719B0000-0x00000263719FE000-memory.dmp
memory/4252-13094-0x00000263719B0000-0x00000263719FE000-memory.dmp
memory/4252-13089-0x00000263719B0000-0x00000263719FE000-memory.dmp
memory/4252-13083-0x00000263719B0000-0x00000263719FE000-memory.dmp
memory/4252-13081-0x00000263719B0000-0x00000263719FE000-memory.dmp
memory/4252-13079-0x00000263719B0000-0x00000263719FE000-memory.dmp
memory/4252-13827-0x00000263713A0000-0x00000263713B0000-memory.dmp
memory/4252-13074-0x00000263719B0000-0x00000263719FE000-memory.dmp
memory/4252-13072-0x00000263719B0000-0x00000263719FE000-memory.dmp
memory/4252-13070-0x00000263719B0000-0x00000263719FE000-memory.dmp
memory/4252-13067-0x00000263719B0000-0x00000263719FE000-memory.dmp
memory/4252-13063-0x00000263719B0000-0x00000263719FE000-memory.dmp
memory/4252-13061-0x00000263719B0000-0x00000263719FE000-memory.dmp
memory/4252-13817-0x0000026371BD0000-0x0000026371BFE000-memory.dmp
memory/4252-13054-0x00000263719B0000-0x00000263719FE000-memory.dmp
memory/4252-13052-0x00000263719B0000-0x00000263719FE000-memory.dmp
memory/4252-13050-0x00000263719B0000-0x00000263719FE000-memory.dmp
memory/4252-13048-0x00000263719B0000-0x00000263719FE000-memory.dmp
memory/4252-13037-0x00000263719B0000-0x00000263719FE000-memory.dmp
memory/4252-13035-0x00000263719B0000-0x00000263719FE000-memory.dmp
memory/4252-13033-0x00000263719B0000-0x00000263719FE000-memory.dmp
memory/4252-13031-0x00000263719B0000-0x00000263719FE000-memory.dmp
memory/4252-13029-0x00000263719B0000-0x00000263719FE000-memory.dmp
memory/4252-13027-0x00000263719B0000-0x00000263719FE000-memory.dmp
memory/4252-13024-0x00000263719B0000-0x00000263719FE000-memory.dmp
memory/4252-2531-0x0000026358A10000-0x0000026358A11000-memory.dmp
memory/4252-13021-0x00000263719B0000-0x00000263719FE000-memory.dmp
memory/4252-13022-0x00000263719B0000-0x00000263719FE000-memory.dmp
memory/4252-13020-0x00000263719B0000-0x0000026371A00000-memory.dmp
memory/4252-2081-0x00000263714B0000-0x00000263714EA000-memory.dmp
memory/4252-2873-0x0000026371550000-0x00000263715A8000-memory.dmp
memory/4252-2042-0x0000026358A50000-0x0000026358A90000-memory.dmp
memory/4252-2044-0x0000026358BD0000-0x0000026358C00000-memory.dmp
memory/4252-2040-0x0000026356E00000-0x0000026356E88000-memory.dmp
memory/4252-2468-0x00000263713A0000-0x00000263713B0000-memory.dmp
memory/4252-2348-0x00007FF9B9050000-0x00007FF9B9B11000-memory.dmp
memory/4252-2095-0x0000026371370000-0x000002637139A000-memory.dmp
memory/4252-2592-0x0000026357230000-0x0000026357231000-memory.dmp
memory/4252-2591-0x0000026357220000-0x0000026357221000-memory.dmp
memory/5516-13916-0x000002D733DE0000-0x000002D733DE1000-memory.dmp
memory/5516-13915-0x000002D74DF00000-0x000002D74DF10000-memory.dmp
memory/5516-13914-0x00007FF9B9050000-0x00007FF9B9B11000-memory.dmp
memory/5516-13913-0x000002D7339F0000-0x000002D733A44000-memory.dmp