Analysis
- max time kernel
2382s - max time network
2337s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
11/05/2024, 23:17
General
- Target https://mega.nz/file/MIxgWZ4Z#XaGDJS5gxybHhVkLcfhL-_ngHNWv7m4iwD2VgWPvrpA
- Sample240511-29sdpadf21
Malware Config
Signatures
- Downloads MZ/PE file
- Checks computer location settings 2 TTPs 7 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 30 IoCs
- Loads dropped DLL 64 IoCs
- Registers COM server for autorun 1 TTPs 64 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR) 1 TTPs 8 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Drops file in System32 directory 52 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 64 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- Checks processor information in registry 2 TTPs 16 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 22 IoCs
- Modifies Control Panel 11 IoCs
- Modifies Internet Explorer settings 1 TTPs 2 IoCs
- Modifies data under HKEY_USERS 7 IoCs
- Modifies registry class 64 IoCs
- Modifies system certificate store 2 TTPs 3 IoCs
- NTFS ADS 2 IoCs
- Suspicious behavior: AddClipboardFormatListener 5 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 4 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 61 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 36 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://mega.nz/file/MIxgWZ4Z#XaGDJS5gxybHhVkLcfhL-_ngHNWv7m4iwD2VgWPvrpA1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffa7cf46f8,0x7fffa7cf4708,0x7fffa7cf47182⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,11014157609492476707,9927956885550439145,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,11014157609492476707,9927956885550439145,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,11014157609492476707,9927956885550439145,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11014157609492476707,9927956885550439145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11014157609492476707,9927956885550439145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,11014157609492476707,9927956885550439145,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5268 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,11014157609492476707,9927956885550439145,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5268 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11014157609492476707,9927956885550439145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11014157609492476707,9927956885550439145,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11014157609492476707,9927956885550439145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11014157609492476707,9927956885550439145,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11014157609492476707,9927956885550439145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11014157609492476707,9927956885550439145,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11014157609492476707,9927956885550439145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3504 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11014157609492476707,9927956885550439145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6004 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11014157609492476707,9927956885550439145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2132,11014157609492476707,9927956885550439145,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6032 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2132,11014157609492476707,9927956885550439145,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3616 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11014157609492476707,9927956885550439145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3584 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2132,11014157609492476707,9927956885550439145,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6288 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11014157609492476707,9927956885550439145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11014157609492476707,9927956885550439145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2132,11014157609492476707,9927956885550439145,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5344 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11014157609492476707,9927956885550439145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6508 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11014157609492476707,9927956885550439145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11014157609492476707,9927956885550439145,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11014157609492476707,9927956885550439145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11014157609492476707,9927956885550439145,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11014157609492476707,9927956885550439145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11014157609492476707,9927956885550439145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6564 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11014157609492476707,9927956885550439145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6884 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,11014157609492476707,9927956885550439145,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5900 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11014157609492476707,9927956885550439145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6928 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11014157609492476707,9927956885550439145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3668 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2132,11014157609492476707,9927956885550439145,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6700 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11014157609492476707,9927956885550439145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2132,11014157609492476707,9927956885550439145,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7280 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\Downloads\VEGAS_Pro_19.0.0.651_DE-EN-FR-ES-BR_865A072F.exe"C:\Users\Admin\Downloads\VEGAS_Pro_19.0.0.651_DE-EN-FR-ES-BR_865A072F.exe"2⤵
- Executes dropped EXE
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SYSTEM32\msiexec.exe"msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\SonyInstall_1\redist.msi" /quiet /norestart /Liwear "C:\Users\Admin\AppData\Roaming\Sony\msvcrt_redist_11052024-112219.log"3⤵
-
-
-
C:\Users\Admin\Downloads\VEGAS_Pro_19.0.0.651_DE-EN-FR-ES-BR_865A072F.exe"C:\Users\Admin\Downloads\VEGAS_Pro_19.0.0.651_DE-EN-FR-ES-BR_865A072F.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x494 0x2e81⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fff9735ab58,0x7fff9735ab68,0x7fff9735ab782⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1720 --field-trial-handle=1872,i,16560731093712052632,7804194945405082134,131072 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=1872,i,16560731093712052632,7804194945405082134,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2308 --field-trial-handle=1872,i,16560731093712052632,7804194945405082134,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3024 --field-trial-handle=1872,i,16560731093712052632,7804194945405082134,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3032 --field-trial-handle=1872,i,16560731093712052632,7804194945405082134,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4408 --field-trial-handle=1872,i,16560731093712052632,7804194945405082134,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4148 --field-trial-handle=1872,i,16560731093712052632,7804194945405082134,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4680 --field-trial-handle=1872,i,16560731093712052632,7804194945405082134,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4828 --field-trial-handle=1872,i,16560731093712052632,7804194945405082134,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4940 --field-trial-handle=1872,i,16560731093712052632,7804194945405082134,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5092 --field-trial-handle=1872,i,16560731093712052632,7804194945405082134,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4956 --field-trial-handle=1872,i,16560731093712052632,7804194945405082134,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4336 --field-trial-handle=1872,i,16560731093712052632,7804194945405082134,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=244 --field-trial-handle=1872,i,16560731093712052632,7804194945405082134,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=2372 --field-trial-handle=1872,i,16560731093712052632,7804194945405082134,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=4516 --field-trial-handle=1872,i,16560731093712052632,7804194945405082134,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=4660 --field-trial-handle=1872,i,16560731093712052632,7804194945405082134,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=2628 --field-trial-handle=1872,i,16560731093712052632,7804194945405082134,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=5212 --field-trial-handle=1872,i,16560731093712052632,7804194945405082134,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5456 --field-trial-handle=1872,i,16560731093712052632,7804194945405082134,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=5560 --field-trial-handle=1872,i,16560731093712052632,7804194945405082134,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=5584 --field-trial-handle=1872,i,16560731093712052632,7804194945405082134,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=5164 --field-trial-handle=1872,i,16560731093712052632,7804194945405082134,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=5448 --field-trial-handle=1872,i,16560731093712052632,7804194945405082134,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=5656 --field-trial-handle=1872,i,16560731093712052632,7804194945405082134,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=4428 --field-trial-handle=1872,i,16560731093712052632,7804194945405082134,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --mojo-platform-channel-handle=3372 --field-trial-handle=1872,i,16560731093712052632,7804194945405082134,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --mojo-platform-channel-handle=5848 --field-trial-handle=1872,i,16560731093712052632,7804194945405082134,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5616 --field-trial-handle=1872,i,16560731093712052632,7804194945405082134,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2628 --field-trial-handle=1872,i,16560731093712052632,7804194945405082134,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --mojo-platform-channel-handle=4072 --field-trial-handle=1872,i,16560731093712052632,7804194945405082134,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --mojo-platform-channel-handle=3028 --field-trial-handle=1872,i,16560731093712052632,7804194945405082134,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --mojo-platform-channel-handle=3972 --field-trial-handle=1872,i,16560731093712052632,7804194945405082134,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5240 --field-trial-handle=1872,i,16560731093712052632,7804194945405082134,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3432 --field-trial-handle=1872,i,16560731093712052632,7804194945405082134,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --mojo-platform-channel-handle=2300 --field-trial-handle=1872,i,16560731093712052632,7804194945405082134,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4356 --field-trial-handle=1872,i,16560731093712052632,7804194945405082134,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --mojo-platform-channel-handle=4884 --field-trial-handle=1872,i,16560731093712052632,7804194945405082134,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --mojo-platform-channel-handle=6288 --field-trial-handle=1872,i,16560731093712052632,7804194945405082134,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --mojo-platform-channel-handle=6660 --field-trial-handle=1872,i,16560731093712052632,7804194945405082134,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --mojo-platform-channel-handle=5524 --field-trial-handle=1872,i,16560731093712052632,7804194945405082134,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --mojo-platform-channel-handle=6980 --field-trial-handle=1872,i,16560731093712052632,7804194945405082134,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --mojo-platform-channel-handle=6776 --field-trial-handle=1872,i,16560731093712052632,7804194945405082134,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --mojo-platform-channel-handle=7096 --field-trial-handle=1872,i,16560731093712052632,7804194945405082134,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --mojo-platform-channel-handle=6364 --field-trial-handle=1872,i,16560731093712052632,7804194945405082134,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --mojo-platform-channel-handle=7112 --field-trial-handle=1872,i,16560731093712052632,7804194945405082134,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5172 --field-trial-handle=1872,i,16560731093712052632,7804194945405082134,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --mojo-platform-channel-handle=6848 --field-trial-handle=1872,i,16560731093712052632,7804194945405082134,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --mojo-platform-channel-handle=6656 --field-trial-handle=1872,i,16560731093712052632,7804194945405082134,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6388 --field-trial-handle=1872,i,16560731093712052632,7804194945405082134,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --mojo-platform-channel-handle=7044 --field-trial-handle=1872,i,16560731093712052632,7804194945405082134,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6944 --field-trial-handle=1872,i,16560731093712052632,7804194945405082134,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=7016 --field-trial-handle=1872,i,16560731093712052632,7804194945405082134,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --mojo-platform-channel-handle=4156 --field-trial-handle=1872,i,16560731093712052632,7804194945405082134,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4676 --field-trial-handle=1872,i,16560731093712052632,7804194945405082134,131072 /prefetch:82⤵
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7084 --field-trial-handle=1872,i,16560731093712052632,7804194945405082134,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6288 --field-trial-handle=1872,i,16560731093712052632,7804194945405082134,131072 /prefetch:82⤵
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6268 --field-trial-handle=1872,i,16560731093712052632,7804194945405082134,131072 /prefetch:82⤵
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6668 --field-trial-handle=1872,i,16560731093712052632,7804194945405082134,131072 /prefetch:82⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6668 --field-trial-handle=1872,i,16560731093712052632,7804194945405082134,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 9936429EFB115EF703A9BEA59A59B5262⤵
- Loads dropped DLL
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 02ACAFBCF3948175403A5B3CB84260992⤵
- Loads dropped DLL
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen.exe" Install "C:\Program Files\VEGAS\VEGAS Pro 19.0\bdmux\BdMuxServer.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 224 -InterruptEvent 0 -NGENProcess 228 -Pipe 220 -Comment "NGen Worker Process"4⤵
- Loads dropped DLL
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d4 -InterruptEvent 0 -NGENProcess 2d0 -Pipe 228 -Comment "NGen Worker Process"4⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 0 -NGENProcess 2d8 -Pipe 2e0 -Comment "NGen Worker Process"4⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 304 -InterruptEvent 0 -NGENProcess 2f4 -Pipe 2e4 -Comment "NGen Worker Process"4⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2dc -InterruptEvent 0 -NGENProcess 31c -Pipe 2fc -Comment "NGen Worker Process"4⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 318 -InterruptEvent 0 -NGENProcess 2ec -Pipe 32c -Comment "NGen Worker Process"4⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 340 -InterruptEvent 0 -NGENProcess 314 -Pipe 2f4 -Comment "NGen Worker Process"4⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d8 -InterruptEvent 0 -NGENProcess 300 -Pipe 318 -Comment "NGen Worker Process"4⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 300 -InterruptEvent 0 -NGENProcess 2ec -Pipe 304 -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 31c -InterruptEvent 0 -NGENProcess 338 -Pipe 340 -Comment "NGen Worker Process"4⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d8 -InterruptEvent 0 -NGENProcess 334 -Pipe 33c -Comment "NGen Worker Process"4⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 334 -InterruptEvent 0 -NGENProcess 2ec -Pipe 2d8 -Comment "NGen Worker Process"4⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 324 -InterruptEvent 0 -NGENProcess 344 -Pipe 34c -Comment "NGen Worker Process"4⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 344 -InterruptEvent 0 -NGENProcess 330 -Pipe 324 -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 21c -InterruptEvent 0 -NGENProcess 34c -Pipe 300 -Comment "NGen Worker Process"4⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 308 -InterruptEvent 0 -NGENProcess 320 -Pipe 328 -Comment "NGen Worker Process"4⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 344 -InterruptEvent 0 -NGENProcess 364 -Pipe 308 -Comment "NGen Worker Process"4⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 34c -InterruptEvent 0 -NGENProcess 338 -Pipe 334 -Comment "NGen Worker Process"4⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 330 -InterruptEvent 0 -NGENProcess 348 -Pipe 354 -Comment "NGen Worker Process"4⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 330 -InterruptEvent 0 -NGENProcess 2ec -Pipe 34c -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 344 -InterruptEvent 0 -NGENProcess 35c -Pipe 2f4 -Comment "NGen Worker Process"4⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 21c -InterruptEvent 0 -NGENProcess 368 -Pipe 338 -Comment "NGen Worker Process"4⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 334 -InterruptEvent 0 -NGENProcess 368 -Pipe 31c -Comment "NGen Worker Process"4⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 35c -InterruptEvent 0 -NGENProcess 344 -Pipe 21c -Comment "NGen Worker Process"4⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 360 -InterruptEvent 0 -NGENProcess 334 -Pipe 368 -Comment "NGen Worker Process"4⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 370 -InterruptEvent 0 -NGENProcess 320 -Pipe 378 -Comment "NGen Worker Process"4⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 35c -InterruptEvent 0 -NGENProcess 38c -Pipe 330 -Comment "NGen Worker Process"4⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 38c -InterruptEvent 0 -NGENProcess 390 -Pipe 37c -Comment "NGen Worker Process"4⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 39c -InterruptEvent 0 -NGENProcess 38c -Pipe 384 -Comment "NGen Worker Process"4⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 370 -InterruptEvent 0 -NGENProcess 360 -Pipe 388 -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3a4 -InterruptEvent 0 -NGENProcess 388 -Pipe 38c -Comment "NGen Worker Process"4⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 380 -InterruptEvent 0 -NGENProcess 394 -Pipe 398 -Comment "NGen Worker Process"4⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3a8 -InterruptEvent 0 -NGENProcess 3bc -Pipe 3ac -Comment "NGen Worker Process"4⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3cc -InterruptEvent 0 -NGENProcess 3a8 -Pipe 334 -Comment "NGen Worker Process"4⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 394 -InterruptEvent 0 -NGENProcess 3a0 -Pipe 380 -Comment "NGen Worker Process"4⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3b4 -InterruptEvent 0 -NGENProcess 3a4 -Pipe 3a8 -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3d4 -InterruptEvent 0 -NGENProcess 3a4 -Pipe 3d8 -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3d4 -InterruptEvent 0 -NGENProcess 3c0 -Pipe 388 -Comment "NGen Worker Process"4⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3dc -InterruptEvent 0 -NGENProcess 3c0 -Pipe 3a4 -Comment "NGen Worker Process"4⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3e4 -InterruptEvent 0 -NGENProcess 3b4 -Pipe 3cc -Comment "NGen Worker Process"4⤵
- Drops file in Windows directory
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2ec -InterruptEvent 0 -NGENProcess 3b4 -Pipe 3b8 -Comment "NGen Worker Process"4⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3c8 -InterruptEvent 0 -NGENProcess 3a0 -Pipe 360 -Comment "NGen Worker Process"4⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 39c -InterruptEvent 0 -NGENProcess 394 -Pipe 3b0 -Comment "NGen Worker Process"4⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3e8 -InterruptEvent 0 -NGENProcess 350 -Pipe 3a0 -Comment "NGen Worker Process"4⤵
-
-
-
-
C:\Windows\System32\MsiExec.exe"C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files (x86)\VEGAS\Shared Plug-Ins\Audio_x64\mchammer_x64.dll"2⤵
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
-
-
C:\Windows\System32\MsiExec.exe"C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files (x86)\VEGAS\Shared Plug-Ins\Audio_x64\sffrgpnv_x64.dll"2⤵
- Loads dropped DLL
- Modifies registry class
-
-
C:\Windows\System32\MsiExec.exe"C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files (x86)\VEGAS\Shared Plug-Ins\Audio_x64\sfppack1_x64.dll"2⤵
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
-
-
C:\Windows\System32\MsiExec.exe"C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files (x86)\VEGAS\Shared Plug-Ins\Audio_x64\sfppack2_x64.dll"2⤵
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
-
-
C:\Windows\System32\MsiExec.exe"C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files (x86)\VEGAS\Shared Plug-Ins\Audio_x64\sfppack3_x64.dll"2⤵
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
-
-
C:\Windows\System32\MsiExec.exe"C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files (x86)\VEGAS\Shared Plug-Ins\Audio_x64\sfresfilter_x64.dll"2⤵
- Loads dropped DLL
- Registers COM server for autorun
-
-
C:\Windows\System32\MsiExec.exe"C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files (x86)\VEGAS\Shared Plug-Ins\Audio_x64\sftrkfx1_x64.dll"2⤵
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
-
-
C:\Windows\System32\MsiExec.exe"C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files (x86)\VEGAS\Shared Plug-Ins\Audio_x64\sfxpfx1_x64.dll"2⤵
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
-
-
C:\Windows\System32\MsiExec.exe"C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files (x86)\VEGAS\Shared Plug-Ins\Audio_x64\sfxpfx2_x64.dll"2⤵
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
-
-
C:\Windows\System32\MsiExec.exe"C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files (x86)\VEGAS\Shared Plug-Ins\Audio_x64\sfxpfx3_x64.dll"2⤵
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
-
-
C:\Windows\System32\MsiExec.exe"C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files (x86)\VEGAS\Shared Plug-Ins\Audio_x64\xpvinyl_x64.dll"2⤵
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
-
-
C:\Windows\syswow64\MsiExec.exe"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\CDDBControl.dll"2⤵
- Loads dropped DLL
- Modifies registry class
-
-
C:\Windows\syswow64\MsiExec.exe"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\CDDBUI.dll"2⤵
- Loads dropped DLL
- Modifies registry class
-
-
C:\Windows\syswow64\MsiExec.exe"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files\VEGAS\VEGAS Pro 19.0\x86\sfvstproxystubx86.dll"2⤵
- Loads dropped DLL
- Modifies registry class
-
-
C:\Windows\System32\MsiExec.exe"C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files\VEGAS\VEGAS Pro 19.0\sfvstwrap.dll"2⤵
- Loads dropped DLL
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding E852B1D1440DB830224FD9B32DD68BEB E Global\MSI00002⤵
- Loads dropped DLL
-
-
C:\Program Files\VEGAS\VEGAS Pro 19.0\vegas190.exe"C:\Program Files\VEGAS\VEGAS Pro 19.0\vegas190.exe" /register /user 10852⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\VEGAS\VEGAS Pro 19.0\ErrorReportLauncher.exe"C:\Program Files\VEGAS\VEGAS Pro 19.0\ErrorReportLauncher.exe"3⤵
- Executes dropped EXE
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\patch\" -ad -an -ai#7zMap26094:72:7zEvent68231⤵
-
C:\Windows\System32\DataExchangeHost.exeC:\Windows\System32\DataExchangeHost.exe -Embedding1⤵
-
C:\Program Files\VEGAS\VEGAS Pro 19.0\vegas190.exe"C:\Program Files\VEGAS\VEGAS Pro 19.0\vegas190.exe"1⤵
- Executes dropped EXE
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\VEGAS\VEGAS Pro 19.0\ErrorReportLauncher.exe"C:\Program Files\VEGAS\VEGAS Pro 19.0\ErrorReportLauncher.exe"2⤵
- Executes dropped EXE
-
-
C:\Program Files\VEGAS\VEGAS Pro 19.0\x86\FileIOSurrogate.exe"C:\Program Files\VEGAS\VEGAS Pro 19.0\x86\FileIOSurrogate.exe" 10342⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\VEGAS\VEGAS Pro 19.0\x86\sfvstserver.exe"C:\Program Files\VEGAS\VEGAS Pro 19.0\x86\sfvstserver.exe" -Event MxVstServerEvent_848 -Vendor "MAGIX" -Product "VEGAS Pro 19.0"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6764 -s 9043⤵
- Program crash
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x494 0x2e81⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 6764 -ip 67641⤵
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Boris FX Sapphire Plug-ins for OFX 2024.5 [FileCR]\" -ad -an -ai#7zMap12853:162:7zEvent300871⤵
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Boris FX Sapphire Plug-ins for OFX 2024.5 [FileCR]\Boris FX Sapphire Plug-ins for OFX 2024.5\Instructions.txt1⤵
-
C:\Users\Admin\Downloads\Boris FX Sapphire Plug-ins for OFX 2024.5 [FileCR]\Boris FX Sapphire Plug-ins for OFX 2024.5\sapphire-ofx-install-2024.5.exe"C:\Users\Admin\Downloads\Boris FX Sapphire Plug-ins for OFX 2024.5 [FileCR]\Boris FX Sapphire Plug-ins for OFX 2024.5\sapphire-ofx-install-2024.5.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-482IH.tmp\sapphire-ofx-install-2024.5.tmp"C:\Users\Admin\AppData\Local\Temp\is-482IH.tmp\sapphire-ofx-install-2024.5.tmp" /SL5="$16026E,621794662,931840,C:\Users\Admin\Downloads\Boris FX Sapphire Plug-ins for OFX 2024.5 [FileCR]\Boris FX Sapphire Plug-ins for OFX 2024.5\sapphire-ofx-install-2024.5.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SYSTEM32\cmd.execmd /c mkdir C:\ProgramData\BorisFX\Sapphire3⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /c move C:\ProgramData\GenArts\Sapphire C:\ProgramData\BorisFX\Sapphire\Sapphire3⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /c mklink /D C:\ProgramData\GenArts\Sapphire C:\ProgramData\BorisFX\Sapphire\Sapphire3⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /c move C:\ProgramData\GenArts\lensflares C:\ProgramData\BorisFX\Sapphire\lensflares3⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /c mklink /D C:\ProgramData\GenArts\lensflares C:\ProgramData\BorisFX\Sapphire\lensflares3⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /c move C:\ProgramData\GenArts\glares C:\ProgramData\BorisFX\Sapphire\glares3⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /c mklink /D C:\ProgramData\GenArts\glares C:\ProgramData\BorisFX\Sapphire\glares3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\is-MO993.tmp\vcredist_x64.exe"C:\Users\Admin\AppData\Local\Temp\is-MO993.tmp\vcredist_x64" /q3⤵
- Executes dropped EXE
-
C:\Windows\Temp\{BC6CD0BF-3401-4CDB-88F2-9F576CE9B321}\.cr\vcredist_x64.exe"C:\Windows\Temp\{BC6CD0BF-3401-4CDB-88F2-9F576CE9B321}\.cr\vcredist_x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-MO993.tmp\vcredist_x64.exe" -burn.filehandle.attached=568 -burn.filehandle.self=676 /q4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-MO993.tmp\_isetup\_setup64.tmphelper 105 0x4903⤵
- Executes dropped EXE
-
-
C:\Program Files\BorisFX\Sapphire 2024.5 OFX\license-tool\license-tool.exe"C:\Program Files\BorisFX\Sapphire 2024.5 OFX\license-tool\license-tool.exe" --installer --api ofx --productline Sapphire --feature sapphire --license-file "C:\ProgramData\GenArts\rlm\SapphireOFX.lic"3⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Boris FX Sapphire Plug-ins for OFX 2024.5 [FileCR]\Boris FX Sapphire Plug-ins for OFX 2024.5\Instructions.txt1⤵
-
C:\Program Files\VEGAS\VEGAS Pro 19.0\vegas190.exe"C:\Program Files\VEGAS\VEGAS Pro 19.0\vegas190.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\VEGAS\VEGAS Pro 19.0\ErrorReportLauncher.exe"C:\Program Files\VEGAS\VEGAS Pro 19.0\ErrorReportLauncher.exe"2⤵
- Executes dropped EXE
-
-
C:\Program Files\BorisFX\Sapphire 2024.5 OFX\preset-browser\preset-browser.exeC:\Program Files\BorisFX\Sapphire 2024.5 OFX\preset-browser\preset-browser.exe2⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\VEGAS\VEGAS Pro 19.0\x86\sfvstserver.exe"C:\Program Files\VEGAS\VEGAS Pro 19.0\x86\sfvstserver.exe" -Event MxVstServerEvent_116 -Vendor "MAGIX" -Product "VEGAS Pro 19.0"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" "C:\Program Files\BorisFX\Sapphire 2024.5 OFX\run-python.vbs" notused "C:\Program Files\BorisFX\Sapphire 2024.5 OFX\update-check\update-check.exe" --silent --user-data "C:\Users\Admin\AppData\Local/BorisFX/SapphireOFX/usage_data-OFX.bak"2⤵
- Checks computer location settings
-
C:\Program Files\BorisFX\Sapphire 2024.5 OFX\update-check\update-check.exe"C:\Program Files\BorisFX\Sapphire 2024.5 OFX\update-check\update-check.exe" --silent --user-data C:\Users\Admin\AppData\Local/BorisFX/SapphireOFX/usage_data-OFX.bak3⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" "C:\Program Files\BorisFX\Sapphire 2024.5 OFX\run-python.vbs" notused "C:\Program Files\BorisFX\Sapphire 2024.5 OFX\license-tool\license-tool.exe" --check-subscriptions --subscription-dialogs2⤵
- Checks computer location settings
-
C:\Program Files\BorisFX\Sapphire 2024.5 OFX\license-tool\license-tool.exe"C:\Program Files\BorisFX\Sapphire 2024.5 OFX\license-tool\license-tool.exe" --check-subscriptions --subscription-dialogs3⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Enumerates system info in registry
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x494 0x2e81⤵
-
C:\Program Files\VEGAS\VEGAS Pro 19.0\vegas190.exe"C:\Program Files\VEGAS\VEGAS Pro 19.0\vegas190.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\VEGAS\VEGAS Pro 19.0\ErrorReportLauncher.exe"C:\Program Files\VEGAS\VEGAS Pro 19.0\ErrorReportLauncher.exe"2⤵
- Executes dropped EXE
-
-
C:\Program Files\VEGAS\VEGAS Pro 19.0\x86\sfvstserver.exe"C:\Program Files\VEGAS\VEGAS Pro 19.0\x86\sfvstserver.exe" -Event MxVstServerEvent_5904 -Vendor "MAGIX" -Product "VEGAS Pro 19.0"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\BorisFX\Sapphire 2024.5 OFX\preset-browser\preset-browser.exeC:\Program Files\BorisFX\Sapphire 2024.5 OFX\preset-browser\preset-browser.exe2⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" "C:\Program Files\BorisFX\Sapphire 2024.5 OFX\run-python.vbs" notused "C:\Program Files\BorisFX\Sapphire 2024.5 OFX\license-tool\license-tool.exe" --check-subscriptions --subscription-dialogs2⤵
- Checks computer location settings
-
C:\Program Files\BorisFX\Sapphire 2024.5 OFX\license-tool\license-tool.exe"C:\Program Files\BorisFX\Sapphire 2024.5 OFX\license-tool\license-tool.exe" --check-subscriptions --subscription-dialogs3⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Enumerates system info in registry
-
-
-
C:\Program Files\VEGAS\VEGAS Pro 19.0\vegas190.exe"C:\Program Files\VEGAS\VEGAS Pro 19.0\vegas190.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\VEGAS\VEGAS Pro 19.0\ErrorReportLauncher.exe"C:\Program Files\VEGAS\VEGAS Pro 19.0\ErrorReportLauncher.exe"2⤵
- Executes dropped EXE
-
-
C:\Program Files\VEGAS\VEGAS Pro 19.0\x86\sfvstserver.exe"C:\Program Files\VEGAS\VEGAS Pro 19.0\x86\sfvstserver.exe" -Event MxVstServerEvent_6380 -Vendor "MAGIX" -Product "VEGAS Pro 19.0"2⤵
- Executes dropped EXE
-
-
C:\Program Files\BorisFX\Sapphire 2024.5 OFX\preset-browser\preset-browser.exeC:\Program Files\BorisFX\Sapphire 2024.5 OFX\preset-browser\preset-browser.exe2⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" "C:\Program Files\BorisFX\Sapphire 2024.5 OFX\run-python.vbs" notused "C:\Program Files\BorisFX\Sapphire 2024.5 OFX\license-tool\license-tool.exe" --check-subscriptions --subscription-dialogs2⤵
- Checks computer location settings
-
C:\Program Files\BorisFX\Sapphire 2024.5 OFX\license-tool\license-tool.exe"C:\Program Files\BorisFX\Sapphire 2024.5 OFX\license-tool\license-tool.exe" --check-subscriptions --subscription-dialogs3⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Enumerates system info in registry
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService1⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
2Pre-OS Boot
1Bootkit
1Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
e5bd6dc.rbs
is-NN961.tmp
is-0TC2D.tmp
is-1FLP2.tmp
is-2UJ4D.tmp
is-3J0A6.tmp
is-3P7MP.tmp
is-4LCEN.tmp
is-5P2CN.tmp
is-5RA6K.tmp
is-5TF3J.tmp
is-6PSHJ.tmp
is-6UA2G.tmp
is-71CFT.tmp
is-75DOO.tmp
is-7DN5K.tmp
is-8203N.tmp
is-892UG.tmp
is-90F03.tmp
is-9L55O.tmp
is-A1B60.tmp
is-AKMTO.tmp
is-AMP7S.tmp
is-AT151.tmp
is-B6DSE.tmp
is-BPBNE.tmp
is-CI9QD.tmp
is-DI05V.tmp
is-GHIK7.tmp
is-HK4SS.tmp
is-HSCET.tmp
is-I54R7.tmp
is-IA3S3.tmp
is-J6BHV.tmp
is-JE6J8.tmp
is-JV9GR.tmp
is-K2GT1.tmp
is-KQGND.tmp
is-LHOB1.tmp
is-M4GQ1.tmp
is-O5P94.tmp
is-OCUVQ.tmp
is-Q88FK.tmp
is-RIFP4.tmp
is-RN68H.tmp
is-RQ7JA.tmp
is-V9D3A.tmp
is-VST1P.tmp
is-52O01.tmp
Canon_20Sumire_2024mm.flare
Photonic.flare
is-08LHT.tmp
is-0J9O3.tmp
is-0OJHA.tmp
is-0RG78.tmp
is-0SRMG.tmp
is-0V0LM.tmp
is-12ETI.tmp
is-13RK3.tmp
is-1444A.tmp
is-14K4L.tmp
is-1CFEQ.tmp
is-1IKPR.tmp
is-1MFHJ.tmp
is-1QDJ6.tmp
is-1RC14.tmp
is-1SBGP.tmp
is-23SIR.tmp
is-26MMG.tmp
is-2AI7J.tmp
is-2B05S.tmp
is-2FQ6S.tmp
is-2GTNP.tmp
is-2H9RR.tmp
is-2HMFS.tmp
is-2JGNS.tmp
is-2PBIB.tmp
is-2RL1Q.tmp
is-2SEU7.tmp
is-305TE.tmp
is-33NTL.tmp
is-3D6PI.tmp
is-3I84M.tmp
is-3KRCT.tmp
is-3LJC2.tmp
is-3MBO7.tmp
is-41BGN.tmp
is-42QNT.tmp
is-47UQ1.tmp
is-486O5.tmp
is-491FF.tmp
is-4AQ0A.tmp
is-4G29I.tmp
is-4HM2H.tmp
is-4PV0I.tmp
is-4V59V.tmp
is-59BJM.tmp
is-59E2P.tmp
is-5B2Q7.tmp
is-5C9Q2.tmp
is-5GQEE.tmp
is-5HKKE.tmp
is-5KCGJ.tmp
is-5NR81.tmp
is-5SNL9.tmp
is-5TATR.tmp
is-5TKI4.tmp
is-62TKK.tmp
is-64388.tmp
is-6B971.tmp
is-6DJ22.tmp
is-6JEB3.tmp
is-6OGAK.tmp
is-6TQ04.tmp
is-6UNO7.tmp
is-722FS.tmp
is-73H9D.tmp
is-79D4L.tmp
is-7BEOJ.tmp
is-7GOT7.tmp
is-7L90K.tmp
is-7R09I.tmp
is-7TC7G.tmp
is-7TKLL.tmp
is-7TL3B.tmp
is-80FU7.tmp
is-840OC.tmp
is-865MQ.tmp
is-86POL.tmp
is-87J06.tmp
is-8BRRQ.tmp
is-8K8SO.tmp
is-8NFAO.tmp
is-8NRAG.tmp
is-8PDCK.tmp
is-8UOUI.tmp
is-9266N.tmp
is-99U4R.tmp
is-9A5MB.tmp
is-9BA6J.tmp
is-9GEFC.tmp
is-9IEFS.tmp
is-9LBCU.tmp
is-9QE4B.tmp
is-9UTOP.tmp
is-A85CO.tmp
is-A86EP.tmp
is-A8U3C.tmp
is-AC2OU.tmp
is-AED11.tmp
is-AIG61.tmp
is-ARA5D.tmp
is-B3687.tmp
is-B4HTA.tmp
is-B5189.tmp
is-B7V5T.tmp
is-BB1OD.tmp
is-BBDTD.tmp
is-BCLTA.tmp
is-BDMGR.tmp
is-BFGHA.tmp
is-BJ63P.tmp
is-BJIIU.tmp
is-BLIMB.tmp
is-BMT20.tmp
is-BPBB1.tmp
is-BQ4CT.tmp
is-BSRRD.tmp
is-C2L69.tmp
is-C59E2.tmp
is-C94FT.tmp
is-CA4TD.tmp
is-CBDEP.tmp
is-CKN31.tmp
is-CT5IS.tmp
is-CUGAO.tmp
is-CUHK9.tmp
is-D31AK.tmp
is-D40FJ.tmp
is-D64U6.tmp
is-D6GOO.tmp
is-D98P2.tmp
is-DCC4H.tmp
is-DK4G0.tmp
is-DTI6U.tmp
is-DU0UH.tmp
is-DUAKK.tmp
is-E1C8N.tmp
is-E2KKS.tmp
is-E92UD.tmp
is-EA64I.tmp
is-EAV4T.tmp
is-ECSIV.tmp
is-EEQUS.tmp
is-EL1TL.tmp
is-EO3V9.tmp
is-EUOCP.tmp
is-F04C5.tmp
is-F40QO.tmp
is-F437F.tmp
is-F7NPI.tmp
is-FH1S1.tmp
is-FPOJM.tmp
is-FT31M.tmp
is-G768B.tmp
is-G99PA.tmp
is-GF0IS.tmp
is-GGIPE.tmp
is-GIHOR.tmp
is-GQLJI.tmp
is-GSL0R.tmp
is-GVSP6.tmp
is-H03HH.tmp
is-H11FM.tmp
is-H36NE.tmp
is-HB897.tmp
is-HBG7F.tmp
is-HBVAG.tmp
is-HC3N8.tmp
is-HD2O1.tmp
is-HH5TQ.tmp
is-HKDB4.tmp
is-HP734.tmp
is-HRPIQ.tmp
is-HTK8N.tmp
is-HTNRC.tmp
is-I2JI0.tmp
is-I31U9.tmp
is-I5S5H.tmp
is-I6JB2.tmp
is-IA88T.tmp
is-IAKMR.tmp
is-IEHBA.tmp
is-IGKJP.tmp
is-IQM5U.tmp
is-IVFRF.tmp
is-J18T4.tmp
is-J1OHC.tmp
is-J1P4P.tmp
is-J6E3O.tmp
is-J84AH.tmp
is-JB30D.tmp
is-JBJ23.tmp
is-JCKOB.tmp
is-JE9DB.tmp
is-JGAM0.tmp
is-JH7HT.tmp
is-JIKP9.tmp
is-JK16O.tmp
is-JL5VM.tmp
is-JMA5N.tmp
is-JPDVO.tmp
is-K0QVB.tmp
is-K5U3I.tmp
is-K72OI.tmp
is-K9I5U.tmp
is-KDME1.tmp
is-KOCT6.tmp
is-KPBM9.tmp
is-KR4V5.tmp
is-KU532.tmp
is-L4H8Q.tmp
is-LAFDA.tmp
is-LCQCT.tmp
is-LE1QE.tmp
is-LFQLA.tmp
is-LHNA1.tmp
is-LML7A.tmp
is-LNLF8.tmp
is-LT78S.tmp
is-M10OV.tmp
is-M9C4B.tmp
is-M9TK2.tmp
is-MATAJ.tmp
is-MDC02.tmp
is-MEO5T.tmp
is-MHHCS.tmp
is-MKRAC.tmp
is-MNRM6.tmp
is-N0FM7.tmp
is-N1A08.tmp
is-N34MB.tmp
is-N9N5E.tmp
is-ND7RV.tmp
is-NDC6M.tmp
is-NRUJ9.tmp
is-O0F38.tmp
is-O1659.tmp
is-O7UV7.tmp
is-OA1R4.tmp
is-OEBI6.tmp
is-OIAO2.tmp
is-OIMEA.tmp
is-ONRUR.tmp
is-OTMJ9.tmp
is-OTQA6.tmp
is-P0IL8.tmp
is-P6VFM.tmp
is-P76AF.tmp
is-PBNV9.tmp
is-PP10M.tmp
is-PPK7I.tmp
is-PQ00F.tmp
is-PTFPS.tmp
is-PVKMF.tmp
is-Q2U20.tmp
is-Q4BT9.tmp
is-Q92TV.tmp
is-QAB6H.tmp
is-QRCPU.tmp
is-R106O.tmp
is-R3F5M.tmp
is-RC9AE.tmp
is-RCL0P.tmp
is-REU6Q.tmp
is-RHIGL.tmp
is-RN8HH.tmp
is-RSMS2.tmp
is-S175U.tmp
is-S6SIQ.tmp
is-S9BT7.tmp
is-SGN5Q.tmp
is-SH6VP.tmp
is-SIKJO.tmp
is-STJ3T.tmp
is-T1AGS.tmp
is-TBFQ0.tmp
is-TFBJI.tmp
is-TI5HM.tmp
is-TKMMV.tmp
is-TN8NT.tmp
is-TO8JQ.tmp
is-UCT31.tmp
is-UDS48.tmp
is-UF1TG.tmp
is-UFRG9.tmp
is-UI9JF.tmp
is-UVDBA.tmp
is-V43CG.tmp
is-V5L5L.tmp
is-VG104.tmp
is-VHC87.tmp
is-VKPR5.tmp
is-VN1U5.tmp
is-VSCI1.tmp
is-VUKDN.tmp
is-VVDJ7.tmp
white_sun.flare
license-tool.bat
BorisFX_B_Win.png
license-tool.exe
license-tool.exe.manifest
is-5I1GS.tmp
is-TNDE0.tmp
vcruntime140.dll
BorisFX.Sapphire.CUDA.em64t.manifest
cudart64_12.dll
BorisFX.Sapphire.MMD.em64t.manifest
libmmd.dll
BorisFX.Sapphire.OpenColorIO.em64t.manifest
Half-2_5.dll
OpenColorIO_2_1.dll
libexpat.dll
BorisFX.Sapphire.OpenImageIO.em64t.manifest
Iex-2_5.dll
IlmImf-2_5.dll
IlmThread-2_5.dll
Imath-2_5.dll
OpenImageIO.dll
boost_chrono-vc141-mt-x64-1_70.dll
boost_filesystem-vc141-mt-x64-1_70.dll
boost_regex-vc141-mt-x64-1_70.dll
boost_system-vc141-mt-x64-1_70.dll
boost_thread-vc141-mt-x64-1_70.dll
dbgeng.dll
dbghelp.dll
jpeg62.dll
libpng16.dll
openjp2.dll
tiff.dll
zlib.dll
BorisFX.Sapphire.Svml_dispmd.em64t.manifest
svml_dispmd.dll
BorisFX.Sapphire.mocha.em64t.manifest
BorisFX.Sapphire.nvrtc.em64t.manifest
nvrtc-builtins64_123.dll
nvrtc64_120_0.dll
mc_dec_mp4v.dll
local_de_DE.cfg
local_de_DE.cfg
local_de_DE.cfg
local_en_US.cfg
local_en_US.cfg
local_en_US.cfg
local_es_ES.cfg
local_es_ES.cfg
local_es_ES.cfg
local_es_ES.cfg
local_es_ES.cfg
local_es_ES.cfg
local_es_ES.cfg
local_fr_FR.cfg
local_fr_FR.cfg
local_fr_FR.cfg
local_ja_JP.cfg
local_ja_JP.cfg
local_ko_KR.cfg
local_ko_KR.cfg
local_ko_KR.cfg
local_pt_BR.cfg
local_pt_BR.cfg
local_zh_CN.cfg
local_zh_CN.cfg
PresetPackage.ko-KR.xml
install.cfg
install.cfg
install.cfg
UnlockFormServiceCenter_nb_NO.rtf
Interlock_20Reveal.jpg
S_ColorFuse_BW_20Agfa_20APX_20400.jpg
S_ColorFuse_BW_20Fuji_20Acros_20100.jpg
S_ColorFuse_BW_20Fuji_20Neopan_20400.jpg
S_ColorFuse_BW_20High_20Key.jpg
S_ColorFuse_BW_20Ilford_20Delta_203200.jpg
S_ColorFuse_BW_20Ilford_20XP_20Super_20400.jpg
S_ColorFuse_BW_20Red_20Filter.jpg
S_ColorFuse_BW_20Soft_20Contrast.jpg
S_ColorFuse_C_20Eastman_20Color_20Neg_20100T_205247.jpg
S_ColorFuse_C_20Fuji_20Astia_20100F_20Expired.jpg
S_ColorFuse_C_20Fuji_20Pro_20800_20Expired.jpg
S_ColorFuse_C_20Fuji_20Provia_20100F.jpg
S_ColorFuse_C_20Fuji_20Provia_20100F_20Expired.jpg
S_ColorFuse_C_20Fuji_20Superia_20400_20Expired.jpg
S_ColorFuse_C_20Fuji_20Velvia_20100.jpg
S_ColorFuse_C_20Kodachrome_2025_20Heavy.jpg
S_ColorFuse_C_20Kodak_20Portra_20160Vc.jpg
S_ColorFuse_C_20Kodak_20Portra_20400Uc.jpg
S_ColorFuse_C_20Kodak_20Royal_20Gold_20400.jpg
S_ColorFuse_Default.jpg
S_ColorFuse_M_2070s_20Vintage_20Summer.jpg
S_ColorFuse_M_20Airy_20X-Pro.jpg
S_ColorFuse_M_20Color_20Pop.jpg
S_ColorFuse_M_20Combat_20Action.jpg
S_ColorFuse_M_20Commercial_20Success.jpg
S_ColorFuse_M_20Cool_20Defoliate.jpg
S_ColorFuse_M_20Cool_20Gritty_20Cops.jpg
S_ColorFuse_M_20Cool_20Morning.jpg
S_ColorFuse_M_20Enchanted_20Garden_20Party.jpg
S_ColorFuse_M_20Faded_20Memories.jpg
S_ColorFuse_M_20Falling_20to_20Autumn.jpg
S_ColorFuse_M_20Flexible_20B_26W_20Conversion.jpg
S_ColorFuse_M_20Get_20Mean.jpg
S_ColorFuse_M_20Heavy_20Film_20Color.jpg
S_ColorFuse_M_20Hot_20War.jpg
S_ColorFuse_M_20In_20the_20Morning.jpg
S_ColorFuse_M_20Independent_20Hit.jpg
S_ColorFuse_M_20It_27s_20Vintage_2c_20Dahlin_27.jpg
S_ColorFuse_M_20Late_20in_20the_20Day.jpg
S_ColorFuse_M_20Light_20is_20Fading.jpg
S_ColorFuse_M_20Mean_20Green_20Lover.jpg
S_ColorFuse_M_20Modern_20Sportswear.jpg
S_ColorFuse_M_20Punch_20It_2c_20Chewy.jpg
S_ColorFuse_M_20Punchier_20B_26W.jpg
S_ColorFuse_M_20Push_20It.jpg
S_ColorFuse_M_20Rich_20Cocoa.jpg
S_ColorFuse_M_20Rich_20Gold.jpg
S_ColorFuse_M_20Saturated_20Candy.jpg
S_ColorFuse_M_20Super_20Knock_20Out.jpg
S_ColorFuse_M_20Vintage_20Crunchy.jpg
S_ColorFuse_M_20Warm_20Sunshine.jpg
S_ColorFuse_M_20Welcome_20to_20Miami.jpg
S_ColorFuse_M_20_70s_20Landscape_20Postcard.jpg
S_ColorFuse_S_20Ardiente.jpg
S_ColorFuse_S_20Brief_20Encounter_20Chocolate.jpg
S_ColorFuse_S_20Color_20Contrast_20Smack.jpg
S_ColorFuse_S_20Dark_20and_20Sleepy_20Hollow.jpg
S_ColorFuse_S_20Deep_20Blue.jpg
S_ColorFuse_S_20Detroit_201991_20Green_20Heavy.jpg
S_ColorFuse_S_20Dry_20County.jpg
S_ColorFuse_S_20Dystopian_20Values.jpg
S_ColorFuse_S_20Faded_20Early_2080s.jpg
S_ColorFuse_S_20False_20Color.jpg
S_ColorFuse_S_20Hot_20Cocoa.jpg
S_ColorFuse_S_20Morning_20Mist.jpg
S_ColorFuse_S_20Orange_20n_20Teal_20Blockbuster.jpg
S_ColorFuse_S_20Orange_20n_20Teal_20Punchy.jpg
S_ColorFuse_S_20Orange_20n_20Teal_20Stark.jpg
S_ColorFuse_S_20Punchy_20Slightly_20Warm.jpg
S_ColorFuse_S_20Saturated_20Pop_20Film.jpg
S_ColorFuse_S_20Soft_20B_26W.jpg
S_ColorFuse_S_20Technicolor_20Big_20Bump.jpg
S_ColorFuse_S_20Vintage_20Colorblind.jpg
S_ColorFuse_S_20Vintage_20Cool_20Twist.jpg
S_ColorFuse_S_20Vintage_20Hot_20Horror.jpg
S_ColorFuse_S_20Vintage_20Low_20Con.jpg
S_ColorFuse_S_20Vintage_20Psyonic.jpg
S_ColorFuse_S_20Vintage_20Soft_20Fall.jpg
S_ColorFuse_S_20Vintage_20Summer_20Camp.jpg
S_ColorFuse_S_20X-Pro_20Crunch.jpg
S_LensFlare_Default.jpg
S_PixelMosh_Bold_20Pulse_20Streak.jpg
S_TextureNoiseEmboss_The_20Hulk_27s_20Been_20Foiled.gp
S_TimeAverage_Time_20Trails_20-_2025.jpg
Angenieux_20EZ-2_2015-40mm.flare
Canon_20Macro_20100L.flare
Kowa_20Evolution_2040mm.flare
MxNewsfeed.xml
MxNewsfeed.xml
.gfh6chl6
.544f4b4e
installation.ini
F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
f_00000b
f_000030
f_000034
f_00003c
f_00003e
f_00003f
f_000040
f_000048
f_000049
f_00005d
f_000060
f_000061
f_000068
f_00008e
f_00008f
f_000090
f_000091
f_000092
f_000093
f_000094
f_000095
f_000096
f_000097
f_000098
f_000099
f_00009a
f_00009b
f_00009c
f_00009d
f_00009e
f_00009f
f_0000a0
f_0000a1
f_0000a2
f_0000a3
f_0000a4
f_0000a5
f_0000a6
f_0000a7
f_0000a8
f_0000a9
f_0000aa
f_0000ab
f_0000ac
f_0000ad
f_0000ae
f_0000c4
f_0000c7
f_0000c9
f_0000cb
1b6be7269342e93a_0
360847bc44a9dbd6_0
8eaa5fa8a480443e_0
96c87ccc79fcc6c1_0
a19e12eb660e4818_0
a19e12eb660e4818_0
d0bccffba97e2fac_0
d5a86b9f3319ea2e_0
faa72e6bf8f87573_0
temp-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
index.txt
index.txt
index.txt~RFe61a325.TMP
the-real-index
the-real-index~RFe646d80.TMP
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Module Info Cache
Module Info Cache
Module Info Cache
Module Info Cache
Module Info Cache~RFe5ab41f.TMP
settings.dat
settings.dat
f_000037
f_00003b
f_00003d
f_00003f
f_000040
the-real-index
the-real-index
the-real-index
the-real-index
CURRENT
MANIFEST-000001
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
MANIFEST-000001
the-real-index
the-real-index~RFe57bd64.TMP
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity~RFe57f201.TMP
CURRENT
Local State
Local State
Local State
Local State
MxNewsFeed[1].htm
Setup Log 2024-05-11 #001.txt
EULA_esp.rtf
inst_banner.bmp
request.ini
sonyinstall_x64.dll
vegas190.msi
setupcfg.xml
FFCache_x64_1033.ini
00000002.jpg
persist.prefs
result.html
result.xml
5d696d521de238c3.customDestinations-ms
5d696d521de238c3.customDestinations-ms
VegasDMAM
MSI5D61.tmp
MSIDF7.tmp
vegas.ico (new loc)
ngen.log
DLLDEV32i.dll
license.rtf
logo.png
memory/848-7642-0x0000000014240000-0x0000000014282000-memory.dmp
memory/848-6695-0x0000000003EE0000-0x0000000003F08000-memory.dmp
memory/848-8515-0x000000001AB30000-0x000000001AB76000-memory.dmp
memory/848-7658-0x0000000014670000-0x00000000146AA000-memory.dmp
memory/848-7657-0x0000000014190000-0x0000000014198000-memory.dmp
memory/848-7656-0x0000000014140000-0x0000000014148000-memory.dmp
memory/848-7655-0x0000000014560000-0x00000000145A4000-memory.dmp
memory/848-7653-0x0000000014130000-0x0000000014138000-memory.dmp
memory/848-7654-0x0000000015350000-0x00000000153B2000-memory.dmp
memory/848-7652-0x00000000140A0000-0x00000000140AA000-memory.dmp
memory/848-7651-0x0000000014170000-0x0000000014182000-memory.dmp
memory/848-7649-0x0000000015D70000-0x0000000015F0A000-memory.dmp
memory/848-7648-0x0000000014150000-0x0000000014162000-memory.dmp
memory/848-8516-0x000000001ABA0000-0x000000001ABBA000-memory.dmp
memory/848-9348-0x000000001AD30000-0x000000001ADA0000-memory.dmp
memory/848-9349-0x000000001AF30000-0x000000001B032000-memory.dmp
memory/848-8514-0x000000001A9E0000-0x000000001AA30000-memory.dmp
memory/848-7647-0x00000000142D0000-0x0000000014330000-memory.dmp
memory/848-7669-0x0000000015D00000-0x0000000015D32000-memory.dmp
memory/848-7660-0x0000000015510000-0x0000000015554000-memory.dmp
memory/848-7661-0x0000000015BD0000-0x0000000015C36000-memory.dmp
memory/848-7663-0x0000000014520000-0x000000001452A000-memory.dmp
memory/848-7631-0x0000000011020000-0x0000000011070000-memory.dmp
memory/848-7636-0x00000000118A0000-0x0000000011902000-memory.dmp
memory/848-7632-0x00000000129C0000-0x0000000012A72000-memory.dmp
memory/848-7634-0x0000000010FF0000-0x000000001100E000-memory.dmp
memory/848-7635-0x00000000110A0000-0x00000000110B8000-memory.dmp
memory/848-7667-0x0000000014530000-0x0000000014538000-memory.dmp
memory/848-7630-0x0000000011800000-0x0000000011892000-memory.dmp
memory/848-7638-0x0000000011100000-0x0000000011122000-memory.dmp
memory/848-7659-0x00000000153C0000-0x00000000153F0000-memory.dmp
memory/848-7639-0x00000000140B0000-0x00000000140D8000-memory.dmp
memory/848-7637-0x0000000012C10000-0x0000000012D96000-memory.dmp
memory/848-7640-0x00000000140E0000-0x00000000140FE000-memory.dmp
memory/848-7641-0x0000000014100000-0x000000001412A000-memory.dmp
memory/848-7668-0x0000000017E70000-0x0000000017F2A000-memory.dmp
memory/848-7643-0x0000000014090000-0x000000001409E000-memory.dmp
memory/848-7666-0x00000000153F0000-0x000000001540C000-memory.dmp
memory/848-7644-0x0000000014290000-0x00000000142C8000-memory.dmp
memory/848-7662-0x0000000014510000-0x000000001451A000-memory.dmp
memory/848-7645-0x00000000145C0000-0x0000000014668000-memory.dmp
memory/848-7664-0x0000000015560000-0x0000000015594000-memory.dmp
memory/848-7646-0x0000000015430000-0x0000000015504000-memory.dmp
memory/848-7665-0x00000000174A0000-0x00000000177C4000-memory.dmp
memory/848-7633-0x0000000011070000-0x0000000011092000-memory.dmp
memory/848-6696-0x0000000003EE0000-0x0000000003F08000-memory.dmp
memory/1140-5987-0x0000000010000000-0x0000000010005000-memory.dmp
memory/2140-5892-0x0000015A3A4E0000-0x0000015A3A4E1000-memory.dmp
memory/2536-6001-0x0000000030000000-0x0000000030006000-memory.dmp
memory/2596-6051-0x00000000628D0000-0x0000000062B5E000-memory.dmp
memory/2944-5864-0x00000168DE070000-0x00000168DE086000-memory.dmp
memory/3496-5876-0x0000014EB28A0000-0x0000014EB28B6000-memory.dmp
memory/3548-5898-0x00007FF6126E0000-0x00007FF6155D3000-memory.dmp
memory/3704-5878-0x0000028607150000-0x0000028607166000-memory.dmp
memory/3752-6095-0x0000000006AE0000-0x0000000006B01000-memory.dmp
memory/3752-6048-0x0000000004EC0000-0x0000000005214000-memory.dmp
memory/3752-6049-0x0000000006430000-0x000000000647C000-memory.dmp
memory/3948-5868-0x000002A3B5910000-0x000002A3B5926000-memory.dmp
memory/3948-6285-0x0000000005CC0000-0x0000000005D3D000-memory.dmp
memory/4720-5862-0x000002048DC50000-0x000002048DC66000-memory.dmp
memory/4744-5866-0x000002472BA00000-0x000002472BA16000-memory.dmp
memory/4936-5860-0x0000020C21190000-0x0000020C211A6000-memory.dmp
memory/5024-6205-0x0000000007B20000-0x0000000007B41000-memory.dmp
memory/5044-5950-0x0000000005490000-0x00000000054AC000-memory.dmp
memory/5044-5953-0x00000000056B0000-0x000000000572A000-memory.dmp
memory/5044-5941-0x0000000005100000-0x0000000005108000-memory.dmp
memory/5044-5942-0x0000000005110000-0x0000000005118000-memory.dmp
memory/5044-5943-0x0000000005120000-0x0000000005145000-memory.dmp
memory/5044-5944-0x00000000051B0000-0x0000000005206000-memory.dmp
memory/5044-5945-0x0000000005160000-0x0000000005170000-memory.dmp
memory/5044-5946-0x00000000057C0000-0x0000000005D64000-memory.dmp
memory/5044-5960-0x00000000057A0000-0x00000000057BE000-memory.dmp
memory/5044-5959-0x0000000006290000-0x00000000062B2000-memory.dmp
memory/5044-5962-0x0000000006390000-0x00000000063E0000-memory.dmp
memory/5044-5947-0x0000000005400000-0x0000000005448000-memory.dmp
memory/5044-5949-0x0000000005470000-0x0000000005482000-memory.dmp
memory/5044-5964-0x0000000006560000-0x00000000065C6000-memory.dmp
memory/5044-5963-0x00000000064A0000-0x0000000006552000-memory.dmp
memory/5044-5958-0x0000000006210000-0x000000000625C000-memory.dmp
memory/5044-5961-0x0000000006300000-0x000000000633C000-memory.dmp
memory/5044-5978-0x00000000068E0000-0x000000000695D000-memory.dmp
memory/5044-5948-0x0000000005190000-0x0000000005198000-memory.dmp
memory/5044-5951-0x0000000005500000-0x000000000554F000-memory.dmp
memory/5044-5952-0x00000000055C0000-0x000000000562C000-memory.dmp
memory/5044-5979-0x0000000006760000-0x000000000676A000-memory.dmp
memory/5044-5981-0x0000000007160000-0x00000000072E6000-memory.dmp
memory/5044-5984-0x0000000006AE0000-0x0000000006AF2000-memory.dmp
memory/5044-5983-0x0000000007330000-0x000000000736C000-memory.dmp
memory/5044-5972-0x0000000006630000-0x0000000006662000-memory.dmp
memory/5044-5982-0x0000000006AC0000-0x0000000006ADA000-memory.dmp
memory/5044-5954-0x0000000005460000-0x000000000546A000-memory.dmp
memory/5044-5980-0x00000000067E0000-0x0000000006800000-memory.dmp
memory/5044-5977-0x0000000007030000-0x0000000007152000-memory.dmp
memory/5044-5955-0x0000000005D70000-0x00000000060C4000-memory.dmp
memory/5044-5975-0x0000000006790000-0x00000000067D4000-memory.dmp
memory/5044-5976-0x0000000006740000-0x000000000675A000-memory.dmp
memory/5044-5974-0x0000000006810000-0x00000000068DE000-memory.dmp
memory/5044-5973-0x0000000006710000-0x0000000006732000-memory.dmp
memory/5044-5957-0x0000000005590000-0x0000000005598000-memory.dmp
memory/5044-5971-0x00000000065D0000-0x00000000065F0000-memory.dmp
memory/5044-5969-0x0000000007500000-0x00000000079CC000-memory.dmp
memory/5044-5970-0x0000000006480000-0x0000000006492000-memory.dmp
memory/5044-5966-0x00000000063E0000-0x0000000006402000-memory.dmp
memory/5044-5967-0x0000000006670000-0x0000000006702000-memory.dmp
memory/5044-5968-0x0000000006410000-0x000000000642C000-memory.dmp
memory/5044-5965-0x0000000006B00000-0x000000000702C000-memory.dmp
memory/5124-5858-0x0000020299690000-0x00000202996A6000-memory.dmp
memory/5380-5874-0x000001B8251E0000-0x000001B8251F6000-memory.dmp
memory/5444-5872-0x0000013EF1370000-0x0000013EF1386000-memory.dmp
memory/5680-6204-0x0000000006EB0000-0x0000000006F2D000-memory.dmp
memory/5684-6022-0x0000000010030000-0x0000000010083000-memory.dmp
memory/6072-6066-0x0000000064D10000-0x0000000064DE8000-memory.dmp
memory/6116-6017-0x0000000006C40000-0x0000000006F94000-memory.dmp
memory/6116-6018-0x0000000011000000-0x0000000011025000-memory.dmp
memory/6140-5870-0x000001E90DA90000-0x000001E90DAA6000-memory.dmp