Analysis
- max time kernel
924s - max time network
923s - platform
windows10-1703_x64 - resource
win10-20240404-en - resource tags
- submitted
09/08/2024, 12:48
General
- Target MSEdgeRedirect.exe
- Size 1.1MB
- Sample240809-p18m4avbph
- SHA256 5c52dbabaa238202ddc0326d33edf8e48ae90f7f29490fde236f334769ab86d2
Score
9/10
Malware Config
Signatures
- Modifies boot configuration data using bcdedit 1 TTPs 1 IoCs
- Blocklisted process makes network request 4 IoCs
- Downloads MZ/PE file
- Drops file in Drivers directory 16 IoCs
- Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 38 IoCs
- Loads dropped DLL 64 IoCs
- Modifies file permissions 1 TTPs 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 26 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Power Settings 1 TTPs 4 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
- Detected potential entity reuse from brand microsoft.
- Drops file in System32 directory 9 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 21 IoCs
- Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- System Location Discovery: System Language Discovery 1 TTPs 35 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 12 IoCs
Processor information is often read in order to detect sandboxing environments.
- Disables Windows logging functionality 2 TTPs
Changes registry settings to disable Windows Event logging.
- Enumerates system info in registry 2 TTPs 6 IoCs
- Kills process with taskkill 2 IoCs
- Modifies Internet Explorer settings 1 TTPs 9 IoCs
- Modifies data under HKEY_USERS 4 IoCs
- Modifies registry class 64 IoCs
- Modifies registry key 1 TTPs 5 IoCs
- NTFS ADS 3 IoCs
- Runs net.exe
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious behavior: LoadsDriver 64 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- System policy modification 1 TTPs 1 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\MSEdgeRedirect.exe"C:\Users\Admin\AppData\Local\Temp\MSEdgeRedirect.exe"1⤵
- Checks computer location settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- Checks processor information in registry
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4308.0.1201492740\1454402235" -parentBuildID 20221007134813 -prefsHandle 1748 -prefMapHandle 1728 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a40fafa3-7cb0-41ef-b4d6-8c69d1949cc5} 4308 "\\.\pipe\gecko-crash-server-pipe.4308" 1828 237910dd158 gpu3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4308.1.1721383723\1713267232" -parentBuildID 20221007134813 -prefsHandle 2172 -prefMapHandle 2168 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e0ba6ecd-a365-480f-9583-8a5f81f8da94} 4308 "\\.\pipe\gecko-crash-server-pipe.4308" 2184 23791005c58 socket3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4308.2.1069414541\1003911890" -childID 1 -isForBrowser -prefsHandle 2860 -prefMapHandle 2856 -prefsLen 20866 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {79b01071-aaf1-4443-b744-8bfaa7c6236a} 4308 "\\.\pipe\gecko-crash-server-pipe.4308" 2872 2379529ee58 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4308.3.1265275040\1632939944" -childID 2 -isForBrowser -prefsHandle 3492 -prefMapHandle 3500 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {eadc79a7-5fa3-4dcb-807e-0004512f65af} 4308 "\\.\pipe\gecko-crash-server-pipe.4308" 3512 23795713258 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4308.4.1895193468\27151796" -childID 3 -isForBrowser -prefsHandle 4212 -prefMapHandle 4208 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {82e39367-5123-49a5-93c2-485287e3e873} 4308 "\\.\pipe\gecko-crash-server-pipe.4308" 4224 237970dd558 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4308.5.170738878\501245271" -childID 4 -isForBrowser -prefsHandle 4808 -prefMapHandle 4776 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f43dbaf4-d7b6-41e2-924a-c33aacd58a6a} 4308 "\\.\pipe\gecko-crash-server-pipe.4308" 4740 23797677558 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4308.6.204233113\2056770278" -childID 5 -isForBrowser -prefsHandle 4940 -prefMapHandle 4944 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {350b214a-4f23-4df3-bbb4-24756f18bf67} 4308 "\\.\pipe\gecko-crash-server-pipe.4308" 4760 23797819558 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4308.7.43128784\190277380" -childID 6 -isForBrowser -prefsHandle 5072 -prefMapHandle 5076 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9a2c1c28-9df5-42ff-a394-b35ca0d1fb2b} 4308 "\\.\pipe\gecko-crash-server-pipe.4308" 4728 23797ec6858 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4308.8.1060028347\2056734530" -childID 7 -isForBrowser -prefsHandle 5752 -prefMapHandle 5748 -prefsLen 26641 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ac06f09b-1f29-4669-894e-86683f315d12} 4308 "\\.\pipe\gecko-crash-server-pipe.4308" 5768 23799690a58 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4308.9.1320663790\1265489120" -childID 8 -isForBrowser -prefsHandle 6168 -prefMapHandle 5880 -prefsLen 26816 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a5512e82-4a0b-4a4b-9447-d830f20d54ea} 4308 "\\.\pipe\gecko-crash-server-pipe.4308" 6176 2379e227e58 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4308.10.381743476\28162783" -childID 9 -isForBrowser -prefsHandle 6248 -prefMapHandle 6252 -prefsLen 26816 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cf9b30ab-7e1a-4c84-a589-a6fe1a442bb3} 4308 "\\.\pipe\gecko-crash-server-pipe.4308" 6240 2379e228758 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4308.11.847584250\321769648" -parentBuildID 20221007134813 -prefsHandle 6432 -prefMapHandle 6436 -prefsLen 26816 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d0625e16-111f-4dbb-bba2-ab355f506248} 4308 "\\.\pipe\gecko-crash-server-pipe.4308" 6424 2379e2d5c58 rdd3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4308.12.828920952\402073851" -childID 10 -isForBrowser -prefsHandle 10784 -prefMapHandle 10772 -prefsLen 26816 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0929fe91-1f6c-47c9-82a7-449997c98dc1} 4308 "\\.\pipe\gecko-crash-server-pipe.4308" 10740 2379c19bf58 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4308.13.1584270698\686728209" -childID 11 -isForBrowser -prefsHandle 10568 -prefMapHandle 10560 -prefsLen 27081 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {595cf80d-80b9-4d05-a877-0f43944457ed} 4308 "\\.\pipe\gecko-crash-server-pipe.4308" 10556 2379e218d58 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4308.14.962103585\1739794854" -childID 12 -isForBrowser -prefsHandle 6276 -prefMapHandle 6272 -prefsLen 27081 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b0e16d22-e75b-4382-a264-3589806da67d} 4308 "\\.\pipe\gecko-crash-server-pipe.4308" 6284 2379e218758 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4308.15.1166690226\1669690598" -childID 13 -isForBrowser -prefsHandle 10264 -prefMapHandle 10260 -prefsLen 27081 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a2860129-b6ae-4b5e-aa04-36895c1e8eb0} 4308 "\\.\pipe\gecko-crash-server-pipe.4308" 10272 2379e219058 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4308.16.682745160\798379572" -childID 14 -isForBrowser -prefsHandle 4728 -prefMapHandle 5292 -prefsLen 27138 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bbc5744b-6a36-4e7c-a02b-e8d1a44ab706} 4308 "\\.\pipe\gecko-crash-server-pipe.4308" 4952 23797a48658 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4308.17.1550408149\1506372676" -childID 15 -isForBrowser -prefsHandle 10712 -prefMapHandle 10744 -prefsLen 27138 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8dbf8417-4083-40fd-bee0-d0ae71881e88} 4308 "\\.\pipe\gecko-crash-server-pipe.4308" 10688 2379bc85758 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4308.18.2090400572\1359923999" -childID 16 -isForBrowser -prefsHandle 5820 -prefMapHandle 4808 -prefsLen 27138 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c3900b5c-0103-4947-a4ec-bba0c82e3d56} 4308 "\\.\pipe\gecko-crash-server-pipe.4308" 5808 237fc65e558 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4308.19.1448375654\2114722956" -childID 17 -isForBrowser -prefsHandle 4008 -prefMapHandle 6668 -prefsLen 27138 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0adeebcc-9a80-4af4-8366-6bcc3c0f3a7d} 4308 "\\.\pipe\gecko-crash-server-pipe.4308" 4044 237fc660a58 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4308.20.1382434524\1354629737" -childID 18 -isForBrowser -prefsHandle 5432 -prefMapHandle 5428 -prefsLen 27138 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d4ba7c81-7dd8-438b-a535-e9d59b24d444} 4308 "\\.\pipe\gecko-crash-server-pipe.4308" 5460 237fc65fb58 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4308.21.2012626042\491178452" -childID 19 -isForBrowser -prefsHandle 4888 -prefMapHandle 5760 -prefsLen 27138 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8a807a7a-c560-49a2-b573-5c3183e59bfc} 4308 "\\.\pipe\gecko-crash-server-pipe.4308" 4860 23797a62558 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4308.22.1395271044\1248382817" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 6292 -prefMapHandle 6160 -prefsLen 27138 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b63eccbc-9e1a-4fa2-8e02-f9ecbeba889b} 4308 "\\.\pipe\gecko-crash-server-pipe.4308" 10556 23798c2fb58 utility3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4308.23.1271212577\2039390364" -childID 20 -isForBrowser -prefsHandle 5760 -prefMapHandle 5520 -prefsLen 27138 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {79d2b7b0-1849-4cca-aeb7-a79b3436e851} 4308 "\\.\pipe\gecko-crash-server-pipe.4308" 4924 237997e3b58 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4308.24.94274129\577709804" -childID 21 -isForBrowser -prefsHandle 4848 -prefMapHandle 4248 -prefsLen 27138 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3c013797-df2e-4842-b120-845cc213c19d} 4308 "\\.\pipe\gecko-crash-server-pipe.4308" 6048 23798b7d058 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4308.25.1326345152\32343249" -childID 22 -isForBrowser -prefsHandle 10044 -prefMapHandle 4872 -prefsLen 27138 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b174c307-af28-483b-8609-7737060e6b8e} 4308 "\\.\pipe\gecko-crash-server-pipe.4308" 5544 2379a15fc58 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4308.26.526821536\1044779155" -childID 23 -isForBrowser -prefsHandle 4924 -prefMapHandle 10716 -prefsLen 27195 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {07afc33c-a105-40aa-bacf-1d02dd0f37ee} 4308 "\\.\pipe\gecko-crash-server-pipe.4308" 6052 23799690158 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4308.27.1323368989\1427620260" -childID 24 -isForBrowser -prefsHandle 6664 -prefMapHandle 4776 -prefsLen 27195 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {81af05d4-5dcf-473c-b200-1a25708974e7} 4308 "\\.\pipe\gecko-crash-server-pipe.4308" 4904 23799692b58 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4308.28.824813603\1496995564" -childID 25 -isForBrowser -prefsHandle 5204 -prefMapHandle 10048 -prefsLen 27195 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1d4b59c7-fa6f-445b-b520-42da072bbaa0} 4308 "\\.\pipe\gecko-crash-server-pipe.4308" 5036 23799690d58 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4308.29.256917539\813699770" -childID 26 -isForBrowser -prefsHandle 6772 -prefMapHandle 10708 -prefsLen 27195 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {48b62df9-f6b0-49aa-a671-13fede6be24b} 4308 "\\.\pipe\gecko-crash-server-pipe.4308" 10272 2379811a558 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4308.30.1162582250\1280528067" -childID 27 -isForBrowser -prefsHandle 5764 -prefMapHandle 10776 -prefsLen 27195 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {81d6a163-2dd6-42b8-a3e1-6bb3ad058708} 4308 "\\.\pipe\gecko-crash-server-pipe.4308" 4544 2379cec1158 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4308.31.1002336881\732280788" -childID 28 -isForBrowser -prefsHandle 6356 -prefMapHandle 5936 -prefsLen 27195 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0e79fa44-a18f-4859-b11c-b987a28b0502} 4308 "\\.\pipe\gecko-crash-server-pipe.4308" 9816 2379cec0558 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4308.32.484732287\523398222" -childID 29 -isForBrowser -prefsHandle 9632 -prefMapHandle 9628 -prefsLen 27195 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7dde8f3e-8f94-443b-82c0-475cb284ddfb} 4308 "\\.\pipe\gecko-crash-server-pipe.4308" 9640 2379cec2358 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4308.33.1437043808\1584377421" -childID 30 -isForBrowser -prefsHandle 4812 -prefMapHandle 10108 -prefsLen 27195 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {25381162-bb5e-4d81-908b-990c245ca065} 4308 "\\.\pipe\gecko-crash-server-pipe.4308" 9540 2379d3c6758 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4308.34.1501156565\626561918" -childID 31 -isForBrowser -prefsHandle 4880 -prefMapHandle 5016 -prefsLen 27195 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {001f20d4-adfe-42e2-b483-fe8d99eaa44f} 4308 "\\.\pipe\gecko-crash-server-pipe.4308" 4488 2379d578f58 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4308.35.924474292\616856918" -childID 32 -isForBrowser -prefsHandle 9400 -prefMapHandle 9396 -prefsLen 27195 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {57a25e8f-035b-4053-a9be-c25befba1aa9} 4308 "\\.\pipe\gecko-crash-server-pipe.4308" 9408 2379d579e58 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4308.36.604338666\267320116" -childID 33 -isForBrowser -prefsHandle 10080 -prefMapHandle 5876 -prefsLen 27195 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ed2e43e8-9711-417b-8d27-1f122702d5f5} 4308 "\\.\pipe\gecko-crash-server-pipe.4308" 4876 2379df6bf58 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4308.37.1253102903\1017174593" -childID 34 -isForBrowser -prefsHandle 9904 -prefMapHandle 3872 -prefsLen 27195 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1c23ee26-4914-4e57-af4a-7d5a0bb777c7} 4308 "\\.\pipe\gecko-crash-server-pipe.4308" 4612 2379e554558 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4308.38.2138976801\1946992076" -childID 35 -isForBrowser -prefsHandle 9756 -prefMapHandle 5804 -prefsLen 27195 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {208b218f-d20a-4616-82c4-0472ae12f967} 4308 "\\.\pipe\gecko-crash-server-pipe.4308" 4608 237970dd258 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4308.39.1840435263\1514051278" -childID 36 -isForBrowser -prefsHandle 5252 -prefMapHandle 10092 -prefsLen 27195 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {88022dfe-de7a-4440-9a5a-76e02c24513c} 4308 "\\.\pipe\gecko-crash-server-pipe.4308" 9888 2379eb4c658 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4308.40.1840628437\1177777024" -childID 37 -isForBrowser -prefsHandle 9324 -prefMapHandle 9328 -prefsLen 27195 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2a8873e0-1d33-469c-8d1c-2f3f2a2e07e8} 4308 "\\.\pipe\gecko-crash-server-pipe.4308" 4536 2379eb4cf58 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4308.41.1127739156\23408048" -childID 38 -isForBrowser -prefsHandle 8988 -prefMapHandle 8984 -prefsLen 27195 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b2227573-9b10-4b3b-bf6d-28761f446c03} 4308 "\\.\pipe\gecko-crash-server-pipe.4308" 8896 2379e3e4d58 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4308.42.294598104\323435514" -childID 39 -isForBrowser -prefsHandle 8788 -prefMapHandle 10400 -prefsLen 27195 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2599b96d-b129-4808-a3e4-8824e283e2a2} 4308 "\\.\pipe\gecko-crash-server-pipe.4308" 9088 2379edc8058 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4308.43.29472623\1988738269" -childID 40 -isForBrowser -prefsHandle 10728 -prefMapHandle 5820 -prefsLen 27195 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {78690942-6152-4d43-b6c0-d924d060709e} 4308 "\\.\pipe\gecko-crash-server-pipe.4308" 6500 2379e9e2358 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4308.44.1806814373\365273095" -childID 41 -isForBrowser -prefsHandle 8716 -prefMapHandle 8712 -prefsLen 27195 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a3f71c11-fd50-4500-8db4-6e833123f19b} 4308 "\\.\pipe\gecko-crash-server-pipe.4308" 8520 2379ef7e758 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4308.45.933136564\1099947894" -childID 42 -isForBrowser -prefsHandle 8076 -prefMapHandle 8080 -prefsLen 27195 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {90d1c5d9-732a-4038-b18c-a61a0dbab74c} 4308 "\\.\pipe\gecko-crash-server-pipe.4308" 8068 2379f3e5058 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4308.46.977914389\756973290" -childID 43 -isForBrowser -prefsHandle 7928 -prefMapHandle 7924 -prefsLen 27195 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {171c0261-afd7-4ab7-ba89-cb44f52652d4} 4308 "\\.\pipe\gecko-crash-server-pipe.4308" 7936 2379f3e5c58 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4308.47.724398265\1324649160" -childID 44 -isForBrowser -prefsHandle 7736 -prefMapHandle 7732 -prefsLen 27195 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f64cb734-0f97-4710-a025-7a933f4e13e7} 4308 "\\.\pipe\gecko-crash-server-pipe.4308" 7744 2379f3e6b58 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4308.48.1080584914\866422255" -childID 45 -isForBrowser -prefsHandle 9612 -prefMapHandle 10704 -prefsLen 27739 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5f88abd7-021c-4c16-b3fa-f761f96bf070} 4308 "\\.\pipe\gecko-crash-server-pipe.4308" 8960 2379984cb58 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4308.49.1054881871\399102205" -childID 46 -isForBrowser -prefsHandle 8684 -prefMapHandle 8676 -prefsLen 27739 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {883ce49f-52d5-4960-97be-2d0089177858} 4308 "\\.\pipe\gecko-crash-server-pipe.4308" 8968 2379ece5358 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4308.50.2051084174\1146655943" -childID 47 -isForBrowser -prefsHandle 9364 -prefMapHandle 8968 -prefsLen 27739 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4f5d36dd-bf1c-4465-9f3f-be7b442635f0} 4308 "\\.\pipe\gecko-crash-server-pipe.4308" 7956 2379f867958 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4308.51.659990149\3326945" -childID 48 -isForBrowser -prefsHandle 8860 -prefMapHandle 8856 -prefsLen 27739 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4dae7507-986b-4119-bc83-0b8fe5414150} 4308 "\\.\pipe\gecko-crash-server-pipe.4308" 8848 2379f868558 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4308.52.662997135\113017552" -childID 49 -isForBrowser -prefsHandle 10612 -prefMapHandle 5816 -prefsLen 27835 -prefMapSize 233444 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2a5a2061-275d-4757-98ed-7434e4e63ea9} 4308 "\\.\pipe\gecko-crash-server-pipe.4308" 9388 2379ce06158 tab3⤵
-
-
C:\Users\Admin\Downloads\dc_portable_ad_bing_20240809.17232083912853b1006409a12039364.exe"C:\Users\Admin\Downloads\dc_portable_ad_bing_20240809.17232083912853b1006409a12039364.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\EaseUSDiskCopy6.0.2\DCLoading.exe"C:\Users\Admin\AppData\Roaming\EaseUSDiskCopy6.0.2\DCLoading.exe" 6.0.2 04⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Roaming\EaseUSDiskCopy6.0.2\Trial\bin\x64\DrvSetup.exe"C:\Users\Admin\AppData\Roaming\EaseUSDiskCopy6.0.2\Trial\bin\x64\DrvSetup.exe" "C:\Users\Admin\AppData\Roaming\EaseUSDiskCopy6.0.2\Trial\drv\win10x64" -install4⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Roaming\EaseUSDiskCopy6.0.2\Trial\bin\InfoForSetup.exe"C:\Users\Admin\AppData\Roaming\EaseUSDiskCopy6.0.2\Trial\bin\InfoForSetup.exe" /AutoUid4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Roaming\EaseUSDiskCopy6.0.2\Trial\bin\SetupUE.exe"C:\Users\Admin\AppData\Roaming\EaseUSDiskCopy6.0.2\Trial\bin\SetupUE.exe" /Disable "{\"Language\":\"English\",\"Version\":\"DiskCopy_Portable_ad_bing\",\"Version_Num\":\"6.0.2\",\"Pageid\":\"17232083912853b1006409a12039364\",\"UE\":\"Off\"}"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\EaseUSDiskCopy6.0.2\Trial\bin\InfoForSetup.exe"C:\Users\Admin\AppData\Roaming\EaseUSDiskCopy6.0.2\Trial\bin\InfoForSetup.exe" /Disable5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get caption5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Roaming\EaseUSDiskCopy6.0.2\Trial\bin\InfoForSetup.exe"C:\Users\Admin\AppData\Roaming\EaseUSDiskCopy6.0.2\Trial\bin\InfoForSetup.exe" /SendInfo "Window" "Install" "Activity" "Info_Userinfo" "Attribute" "{\"Language\":\"English\",\"Version\":\"DiskCopy_Portable_ad_bing\",\"Version_Num\":\"6.0.2\",\"Pageid\":\"17232083912853b1006409a12039364\",\"UE\":\"Off\",\"Country\":\"United States\",\"Timezone\":\"GMT-00:00\",\"OS\":\"Microsoft Windows 10 Pro 64-bit (10.0.15063.1.256)\"}"5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\EaseUSDiskCopy6.0.2\Trial\bin\AliyunWrapExe.ExeC:\Users\Admin\AppData\Roaming\EaseUSDiskCopy6.0.2\Trial\bin\AliyunWrapExe.Exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Users\Admin\AppData\Roaming\EaseUSDiskCopy6.0.2\Trial\bin\EaseUS Disk Copy.exe"C:\Users\Admin\AppData\Roaming\EaseUSDiskCopy6.0.2\Trial\bin\EaseUS Disk Copy.exe" "NoNeedSplashWnd" "DCLoading.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\EaseUSDiskCopy6.0.2\Trial\bin\firebasefetch.exeC:\Users\Admin\AppData\Roaming\EaseUSDiskCopy6.0.2\Trial\bin\firebasefetch.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Roaming\EaseUSDiskCopy6.0.2\Trial\bin\EuDownload.exe"C:\Users\Admin\AppData\Roaming\EaseUSDiskCopy6.0.2\Trial\bin\EuDownload.exe" https://update.easeus.com/update/tb/config.zip "C:\Users\Admin\AppData\Roaming\EaseUSDiskCopy6.0.2\Trial\bin\..\Config.zip" 0 "" 1 55445⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Roaming\EaseUSDiskCopy6.0.2\Trial\bin\EuDownload.exe"C:\Users\Admin\AppData\Roaming\EaseUSDiskCopy6.0.2\Trial\bin\EuDownload.exe" https://update.easeus.com/popup/product/dc/exit/en.png "C:\Users\Admin\AppData\Roaming\EaseUSDiskCopy6.0.2\Trial\bin\..\res\picture_dc_tmp.png" 0 "" 1 42525⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im DCLoading.exe5⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
-
-
C:\Users\Admin\AppData\Roaming\EaseUSDiskCopy6.0.2\Trial\bin\EuDownload.exe"C:\Users\Admin\AppData\Roaming\EaseUSDiskCopy6.0.2\Trial\bin\EuDownload.exe" https://update.easeus.com/update/dc/dc.ini "C:\Users\Admin\AppData\Roaming\EaseUSDiskCopy6.0.2\Trial\bin\dc_update.ini" 0 "" 1 56005⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Roaming\EaseUSDiskCopy6.0.2\Trial\bin\EuDownload.exe"C:\Users\Admin\AppData\Roaming\EaseUSDiskCopy6.0.2\Trial\bin\EuDownload.exe" https://update.easeus.com/update/dc/dc.ini "C:\Users\Admin\AppData\Roaming\EaseUSDiskCopy6.0.2\Trial\bin\dc_update.ini" 0 "" 1 61085⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"1⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pbix0quq\pbix0quq.cmdline"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1280.tmp" "c:\Users\Admin\AppData\Local\Temp\pbix0quq\CSCD95A85E0C8AF49928146DC79233B8748.TMP"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\OOSU10.exe"C:\Users\Admin\AppData\Local\Temp\OOSU10.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" -list2⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" -duplicatescheme e9a42b02-d5df-448d-aa00-03f14749eb612⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" -list2⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" /hibernate off2⤵
- Power Settings
-
-
C:\Windows\system32\bcdedit.exe"C:\Windows\system32\bcdedit.exe" /set {current} bootmenupolicy Legacy2⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\Taskmgr.exe"C:\Windows\system32\Taskmgr.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" C:\ProgramData\Microsoft\Diagnosis\ETLLogs\AutoLogger /deny SYSTEM:(OI)(CI)F2⤵
- Modifies file permissions
-
-
C:\Windows\system32\cleanmgr.exe"C:\Windows\system32\cleanmgr.exe" /d C: /VERYLOWDISK2⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
-
C:\Users\Admin\AppData\Local\Temp\216CFA31-E900-4F5C-828E-54528C366587\dismhost.exeC:\Users\Admin\AppData\Local\Temp\216CFA31-E900-4F5C-828E-54528C366587\dismhost.exe {0D10348C-B75A-4113-8657-41D629E01B25}3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
-
-
-
C:\Windows\system32\Dism.exe"C:\Windows\system32\Dism.exe" /online /Cleanup-Image /StartComponentCleanup /ResetBase2⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\0401028D-4158-4A49-A454-7785DD914D3E\dismhost.exeC:\Users\Admin\AppData\Local\Temp\0401028D-4158-4A49-A454-7785DD914D3E\dismhost.exe {44A77A7C-4344-4FB9-BEC7-9FFC80EAD08B}3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
-
-
-
C:\Windows\system32\netsh.exe"C:\Windows\system32\netsh.exe" interface teredo set state disabled2⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc1⤵
- Checks SCSI registry key(s)
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- NTFS ADS
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\TodoBackup_16.3_Trial.exe"C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\TodoBackup_16.3_Trial.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-5CEPR.tmp\TodoBackup_16.3_Trial.tmp"C:\Users\Admin\AppData\Local\Temp\is-5CEPR.tmp\TodoBackup_16.3_Trial.tmp" /SL5="$160462,171656957,539648,C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\TodoBackup_16.3_Trial.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /C ""C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\install-EaseUSprovider.cmd""4⤵
-
C:\Windows\system32\net.exenet stop vds /Y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop vds /Y6⤵
-
-
-
C:\Windows\system32\net.exenet stop vss /Y5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop vss /Y6⤵
-
-
-
C:\Windows\system32\net.exenet stop swprv5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop swprv6⤵
-
-
-
C:\Windows\system32\reg.exereg.exe delete HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\VssEaseusProvider /f5⤵
- Modifies registry key
-
-
C:\Windows\system32\cscript.execscript "C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\\register_app.vbs" -unregister "VssEaseusProvider"5⤵
-
-
C:\Windows\system32\regsvr32.exeregsvr32 /s /u "C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\\VssEaseusProvider.dll"5⤵
-
-
C:\Windows\system32\cscript.execscript "C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\register_app.vbs" -register "VssEaseusProvider" "C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\VssEaseusProvider.dll" "VSS Easeus Provider"5⤵
-
-
C:\Windows\system32\reg.exereg.exe add HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\VssEaseusProvider /f5⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg.exe add HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\VssEaseusProvider /f /v CustomSource /t REG_DWORD /d 15⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg.exe add HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\VssEaseusProvider /f /v EventMessageFile /t REG_EXPAND_SZ /d "C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\VssEaseusProvider.dll"5⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg.exe add HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\VssEaseusProvider /f /v TypesSupported /t REG_DWORD /d 75⤵
- Modifies registry key
-
-
-
C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\drvsetup.exe"C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\drvsetup.exe" "C:\Program Files (x86)\EaseUS\Todo Backup\drv" -install4⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
-
C:\Windows\System32\InfDefaultInstall.exeC:\Windows\System32\InfDefaultInstall.exe "C:\Program Files (x86)\EaseUS\Todo Backup\drv\\euimgprt.inf"5⤵
- Drops file in Drivers directory
- Adds Run key to start application
-
C:\Windows\system32\runonce.exe"C:\Windows\system32\runonce.exe" -r6⤵
- Checks processor information in registry
-
C:\Windows\System32\grpconv.exe"C:\Windows\System32\grpconv.exe" -o7⤵
-
-
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /T /PID 58325⤵
- Kills process with taskkill
-
-
-
C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\AppSetup.exe"C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\AppSetup.exe" Install4⤵
- Executes dropped EXE
- Modifies registry class
-
-
C:\Program Files (x86)\EaseUS\Todo Backup\bin\Agent.exe"C:\Program Files (x86)\EaseUS\Todo Backup\bin\Agent.exe" install4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\EaseUS\Todo Backup\bin\EUinApp.exe"C:\Program Files (x86)\EaseUS\Todo Backup\bin\EUinApp.exe" TBConsoleUI.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
-
-
C:\Program Files (x86)\EaseUS\Todo Backup\bin\TrayProcess.exe"C:\Program Files (x86)\EaseUS\Todo Backup\bin\TrayProcess.exe" install4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
-
C:\Program Files (x86)\EaseUS\Todo Backup\bin\AliyunWrapExe.Exe"C:\Program Files (x86)\EaseUS\Todo Backup\bin\AliyunWrapExe.Exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files (x86)\EaseUS\Todo Backup\bin\InfoForSetup.exe"C:\Program Files (x86)\EaseUS\Todo Backup\bin\InfoForSetup.exe" /AutoUid4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\EaseUS\Todo Backup\bin\SetupUE.exe"C:\Program Files (x86)\EaseUS\Todo Backup\bin\SetupUE.exe" /Enable "{\"Language\":\"English\",\"Version\":\"TodoBackup_Home_Trial_2406\",\"Version_Num\":\"16.3\",\"Pageid\":\"\",\"UE\":\"On\"}"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\EaseUS\Todo Backup\bin\InfoForSetup.exe"C:\Program Files (x86)\EaseUS\Todo Backup\bin\InfoForSetup.exe" /Enable5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get caption5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\EaseUS\Todo Backup\bin\InfoForSetup.exe"C:\Program Files (x86)\EaseUS\Todo Backup\bin\InfoForSetup.exe" /SendInfo "Window" "Install" "Activity" "Info_Userinfo" "Attribute" "{\"Language\":\"English\",\"Version\":\"TodoBackup_Home_Trial_2406\",\"Version_Num\":\"16.3\",\"Pageid\":\"\",\"UE\":\"On\",\"Country\":\"United States\",\"Timezone\":\"GMT-00:00\",\"OS\":\"Microsoft Windows 10 Pro 64-bit (10.0.15063.1.256)\"}"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\TodoBackup_16.3_Free.exe"C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\TodoBackup_16.3_Free.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-JJVHQ.tmp\TodoBackup_16.3_Free.tmp"C:\Users\Admin\AppData\Local\Temp\is-JJVHQ.tmp\TodoBackup_16.3_Free.tmp" /SL5="$304C8,171757556,539648,C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\TodoBackup_16.3_Free.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-II6P8.tmp\InfoForSetup.exe"C:\Users\Admin\AppData\Local\Temp\is-II6P8.tmp\InfoForSetup.exe" /UninstallStart "C:\Users\Admin\AppData\Local\Temp\is-II6P8.tmp"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-II6P8.tmp\AliyunWrapExe.ExeC:\Users\Admin\AppData\Local\Temp\is-II6P8.tmp\AliyunWrapExe.Exe /RunInTemp5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-II6P8.tmp\InfoForSetup.exe"C:\Users\Admin\AppData\Local\Temp\is-II6P8.tmp\InfoForSetup.exe" /UninstallEnd4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\System32\DataExchangeHost.exeC:\Windows\System32\DataExchangeHost.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}1⤵
- Drops file in Windows directory
-
C:\Windows\system32\RunDll32.exeRunDll32 catsrvut.dll,QueryUserDll "C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\VssEaseusProvider.dll" Global\{41BC3D5A-1102-40B4-BAB6-8BED3294C732}2⤵
-
-
C:\Windows\system32\RunDll32.exeRunDll32 catsrvut.dll,QueryUserDll "C:\Program Files (x86)\EaseUS\Todo Backup\bin\x64\VssEaseusProvider.dll" Global\{AF2DAFE5-BEC2-474B-8DCE-A049C61119B8}2⤵
- Modifies registry class
-
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Program Files (x86)\EaseUS\Todo Backup\bin\Agent.exe"C:\Program Files (x86)\EaseUS\Todo Backup\bin\Agent.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\EaseUS\Todo Backup\bin\FuncRun.exe"C:\Program Files (x86)\EaseUS\Todo Backup\bin\FuncRun.exe" PIPE:TodoFlSyncProxy66B61367 PARENT:13742⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Program Files (x86)\EaseUS\Todo Backup\bin\TodoBackupService.exe"C:\Program Files (x86)\EaseUS\Todo Backup\bin\TodoBackupService.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
-
-
C:\Program Files (x86)\EaseUS\Todo Backup\bin\TodoBackupEnumNetByFD_0.exe"C:\Program Files (x86)\EaseUS\Todo Backup\bin\TodoBackupEnumNetByFD_0.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservice -s fdPHost1⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies Internet Explorer settings
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
- Checks SCSI registry key(s)
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
- Checks SCSI registry key(s)
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
- Checks SCSI registry key(s)
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Component Object Model Hijacking
1Netsh Helper DLL
1Power Settings
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Component Object Model Hijacking
1Netsh Helper DLL
1Defense Evasion
File and Directory Permissions Modification
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
5Subvert Trust Controls
1SIP and Trust Provider Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
7za.exe
AuConv.dll
AuConvEx.dll
DataMana.dll
DevCtrl.dll
MSVCP60.DLL
Microsoft.VC90.CRT.cat
Microsoft.VC90.MFC.manifest
PEtools.xml
RecLib.dll
UserRes.dll
atl90.dll
dlconfig.xml
is-6G253.tmp
is-F5FV7.tmp
is-THS62.tmp
is-UF8U7.tmp
libGuiTheme.dll
mfc90u.dll
msvcp90.dll
msvcr90.dll
AliyunConfig.ini
DataFile.ini
DataFile.ini
DataFile.ini
is-4S6RJ.tmp
is-DJD3N.tmp
is-P8MKR.tmp
is-R42JL.tmp
lsi_scsi.inf
lsi_scsi.inf
is-EFJJ2.tmp
is-8GVIB.tmp
is-MB2DR.tmp
is-AO2LJ.tmp
is-1QJ24.tmp
is-Q9PJ3.tmp
is-KH3C6.tmp
is-OQU4R.tmp
lsi_sas.inf
lsi_sas.inf
is-6VBUV.tmp
is-F2GG8.tmp
is-OLFO3.tmp
is-R1V85.tmp
is-90H32.tmp
is-VIE5C.tmp
is-GU6Q2.tmp
is-E2OGO.tmp
lsi_sas.inf
is-I3HI9.tmp
is-FO5N6.tmp
is-C66P9.tmp
is-RI058.tmp
is-RP5RO.tmp
EUinApp.exe
FileExtend_default.xml
InfoForSetup.exe
Loader.exe
TbLogsysClient.tblog
euimgprt.ini
euimgprt.ini
default.ini
default.ini.lock
is-L79EE.tmp
is-OMSGP.tmp
is-SU7PS.tmp
wimgapi.dll
easeusdrv.log
easeusdrv.log
easeusdrv.log
euimgprt.inf
DsBackupConfig.ini
SqlBackup.ini
cloudlang.ini
is-8IK3S.tmp
is-Q049T.tmp
UIConfig.ini
OGG.png
is-0610H.tmp
is-0TGHH.tmp
is-1HN2H.tmp
is-1ROGN.tmp
is-25GRG.tmp
is-4RJFJ.tmp
is-5MPLG.tmp
is-65UBE.tmp
is-6GQFB.tmp
is-7FUCH.tmp
is-8OTUN.tmp
is-9HEK1.tmp
is-9L2DD.tmp
is-ASQLU.tmp
is-BOPHR.tmp
is-CSJLH.tmp
is-E9QOA.tmp
is-EQ91C.tmp
is-FLPUO.tmp
is-GCIN8.tmp
is-GKFC1.tmp
is-GQKQH.tmp
is-HEF9E.tmp
is-J4I5I.tmp
is-JUK0Q.tmp
is-KCS28.tmp
is-LEF6Q.tmp
is-LIK8P.tmp
is-LTR7G.tmp
is-MIANR.tmp
is-MPF67.tmp
is-O44HP.tmp
is-O46L0.tmp
is-OHBQK.tmp
is-OVS75.tmp
is-PQQN6.tmp
is-QF1CC.tmp
is-QM4RD.tmp
is-R5D8P.tmp
is-RLFA9.tmp
is-RQ7QU.tmp
is-S80T2.tmp
is-T020Q.tmp
is-TFACB.tmp
is-U78U6.tmp
is-V0ROC.tmp
is-4S1O2.tmp
is-5H12D.tmp
is-ACSBB.tmp
is-FAD2A.tmp
is-GNIR5.tmp
is-H0SON.tmp
is-NQNS6.tmp
is-V7I6K.tmp
is-JU91U.tmp
is-FSQ85.tmp
is-84LE9.tmp
is-ESFKD.tmp
trayConfig.ini
2058908056867f6eac.bin
iconcache_idx.db
edgecompatviewlist[1].xml
1128
13596
17724
24958
25039
8464
3B6010BD9DB5450F15E0E1E21F7FC3CF09395079
46363B5291B13C1C6CEF012861BF1D47DDE5359F
47407BACF02492D9B14305D434F53D138608BDB5
646829319C67DD4727104CB4F8B6606414E30D3D
8927C1EFE8F1AC9B69A60F172D098CCAEE2E5723
8D88ED7A6AE6A02E71FD2DD47EA93A07FE680FB6
BA30A8866A8313A16394DA2599448520494928BB
BB02C91B94BECA3714B2715BC1EA011A59503C62
C7F27F1B728D8DB7CFCCA0B5822E7997A8F337CE
E3CE568CF43027EF1C0D22D482E4AAD5D66A470A
F2BDD219B9409DE3AC3D6C73B4EA04F9CA54DFFF
aUBwqp2ovtfm4kbhINtjyw==.ico
auc_easeus[1].js
firebase[1].js
cdn.consentmanager[1].xml
update.easeus[1].xml
update.easeus[1].xml
update.easeus[1].xml
www.easeus[1].xml
www.easeus[1].xml
www.easeus[1].xml
www.easeus[1].xml
www.easeus[1].xml
www.easeus[1].xml
www.easeus[1].xml
www.easeus[1].xml
www.easeus[1].xml
www.easeus[1].xml
www.easeus[1].xml
suggestions[1].en-US
fav[1].ico
~DFB7FCB2E0B758DC47.TMP
microsoft.windows[1].xml
API-MS-Win-Core-Heap-Obsolete-L1-1-0.dll
API-MS-Win-Core-Kernel32-Private-L1-1-0.dll
API-MS-Win-Core-Kernel32-Private-L1-1-1.dll
API-MS-Win-core-file-l2-1-0.dll
API-MS-Win-core-file-l2-1-1.dll
CbsProvider.dll
DismCorePS.dll
DismHost.exe
OSProvider.dll
api-ms-win-base-util-l1-1-0.dll
api-ms-win-core-com-l1-1-0.dll
api-ms-win-core-comm-l1-1-0.dll
api-ms-win-core-console-l1-1-0.dll
api-ms-win-core-datetime-l1-1-0.dll
api-ms-win-core-datetime-l1-1-1.dll
api-ms-win-core-debug-l1-1-0.dll
api-ms-win-core-debug-l1-1-1.dll
api-ms-win-core-delayload-l1-1-0.dll
api-ms-win-core-errorhandling-l1-1-0.dll
api-ms-win-core-errorhandling-l1-1-1.dll
api-ms-win-core-fibers-l1-1-0.dll
api-ms-win-core-fibers-l1-1-1.dll
api-ms-win-core-file-l1-1-0.dll
api-ms-win-core-file-l1-2-0.dll
api-ms-win-core-file-l1-2-1.dll
api-ms-win-core-handle-l1-1-0.dll
api-ms-win-core-heap-l1-1-0.dll
api-ms-win-core-interlocked-l1-1-0.dll
api-ms-win-core-io-l1-1-0.dll
api-ms-win-core-io-l1-1-1.dll
api-ms-win-core-kernel32-legacy-l1-1-0.dll
api-ms-win-core-kernel32-legacy-l1-1-1.dll
api-ms-win-core-libraryloader-l1-1-0.dll
api-ms-win-core-libraryloader-l1-1-1.dll
OOSU10.exe
RES1280.tmp
__PSScriptPolicyTest_mz0gll4n.o22.ps1
TBFirewall.dll
_shfoldr.dll
TodoBackup_16.3_Free.tmp
System.dll
pbix0quq.dll
tmpaddon
tmpaddon-1
cttlogo.png
DataFile.ini
DataFile.ini
DataFile.ini
DataFile.ini
DataFile.ini
DataFile.ini
DataFile.ini
DataFile.ini
DataFile.ini
DataFile.ini
DataFile.ini
DataFile.ini
DataFile.ini
DataFile.ini
DataFile.ini
DataFile.ini
DataFile.ini
symmpi.tag
EuNetAuth.ini
TBGetRemoteNetInfo.dll.manifest
dc_update.ini.eud
tempInfo.web
tmp_log.log
tmp_log.log
tmp_log.log
tmp_log.log
tmp_log.log
easeusdrv.log
TBEMLib.ini
TBEMLib.ini
UIConfig.ini
language.ini
6824f4a902c78fbd.customDestinations-ms
data.safe.bin
data.safe.bin
693c93be-4630-43fe-9049-d2c83f7cd4a1
8f3b3bcc-02a1-42ab-995a-066c17199578
c06ebda6-6a65-4c06-a063-a392a7fb202b
eb45b6fa-a4f9-4fd4-ba46-9b7047c6718c
gmpopenh264.dll
gmpopenh264.info
LICENSE.txt
manifest.json
widevinecdm.dll
widevinecdm.dll.lib
widevinecdm.dll.sig
prefs-1.js
prefs-1.js
prefs-1.js
prefs-1.js
prefs-1.js
prefs.js
prefs.js
prefs.js
sessionCheckpoints.json.tmp
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
sessionstore.jsonlz4
301792106ttes.sqlite
1305289650LCo7g%sCD7a%t0a3b3a3s.sqlite
3870112724rsegmnoittet-es.sqlite
tabs.json.tmp
dism.log
dism.log
dism.log
SET8EF7.tmp
CSCD95A85E0C8AF49928146DC79233B8748.TMP
pbix0quq.0.cs
pbix0quq.cmdline
DismProv.dll
LogProvider.dll
memory/204-8742-0x000001B50FE20000-0x000001B50FE30000-memory.dmp
memory/204-8777-0x000001B50D330000-0x000001B50D332000-memory.dmp
memory/204-8759-0x000001B50FF30000-0x000001B50FF40000-memory.dmp
memory/1776-8541-0x0000000004890000-0x000000000499F000-memory.dmp
memory/1776-8561-0x00000000049E0000-0x00000000049FB000-memory.dmp
memory/1776-8530-0x0000000004290000-0x00000000042A2000-memory.dmp
memory/3148-8854-0x000001E920CD0000-0x000001E920CD2000-memory.dmp
memory/3148-8866-0x000001E920DB0000-0x000001E920DB2000-memory.dmp
memory/3148-8806-0x000001E90C6C0000-0x000001E90C6C2000-memory.dmp
memory/3148-8811-0x000001E91CF00000-0x000001E91CF02000-memory.dmp
memory/3148-8809-0x000001E90C6F0000-0x000001E90C6F2000-memory.dmp
memory/3148-8805-0x000001E90CD00000-0x000001E90CE00000-memory.dmp
memory/3148-8868-0x000001E920DD0000-0x000001E920DD2000-memory.dmp
memory/3148-8864-0x000001E920D90000-0x000001E920D92000-memory.dmp
memory/3148-8862-0x000001E920D70000-0x000001E920D72000-memory.dmp
memory/3148-8860-0x000001E920D60000-0x000001E920D62000-memory.dmp
memory/3148-8858-0x000001E920D50000-0x000001E920D52000-memory.dmp
memory/3148-8856-0x000001E920D30000-0x000001E920D32000-memory.dmp
memory/3148-8852-0x000001E91F4F0000-0x000001E91F4F2000-memory.dmp
memory/3148-9203-0x000001E91F440000-0x000001E91F442000-memory.dmp
memory/3148-9201-0x000001E91F410000-0x000001E91F412000-memory.dmp
memory/3148-9073-0x000001E91D5E0000-0x000001E91D600000-memory.dmp
memory/3148-9030-0x000001E90CD00000-0x000001E90CE00000-memory.dmp
memory/3148-8985-0x000001E90CAD0000-0x000001E90CAD2000-memory.dmp
memory/3148-8912-0x000001E91DDC0000-0x000001E91DDC2000-memory.dmp
memory/3148-8910-0x000001E91ED60000-0x000001E91ED80000-memory.dmp
memory/3148-8908-0x000001E91EC60000-0x000001E91EC80000-memory.dmp
memory/3148-8889-0x000001E90CA90000-0x000001E90CA92000-memory.dmp
memory/3324-1159-0x0000024E88360000-0x0000024E8837A000-memory.dmp
memory/3324-1157-0x0000024E88330000-0x0000024E8835C000-memory.dmp
memory/3324-1156-0x0000024E86580000-0x0000024E86770000-memory.dmp
memory/3324-1158-0x0000024E884A0000-0x0000024E88546000-memory.dmp
memory/3324-1160-0x0000024EA0E60000-0x0000024EA0F18000-memory.dmp
memory/6056-1128-0x000001F46D790000-0x000001F46D798000-memory.dmp
memory/6056-853-0x000001F46D160000-0x000001F46D168000-memory.dmp
memory/6056-516-0x000001F4696A0000-0x000001F469716000-memory.dmp
memory/6056-901-0x000001F46D620000-0x000001F46D62E000-memory.dmp
memory/6056-735-0x000001F469A90000-0x000001F469AC8000-memory.dmp
memory/6056-564-0x000001F469B20000-0x000001F469CE2000-memory.dmp
memory/6056-565-0x000001F46A220000-0x000001F46A746000-memory.dmp
memory/6056-505-0x000001F4695E0000-0x000001F46961C000-memory.dmp
memory/6056-731-0x000001F469CF0000-0x000001F469DC6000-memory.dmp
memory/6056-734-0x000001F469A40000-0x000001F469A48000-memory.dmp
memory/6056-478-0x000001F469120000-0x000001F469142000-memory.dmp
memory/6056-1263-0x000001F46D7D0000-0x000001F46D7E0000-memory.dmp
memory/6056-2509-0x000001F46D9F0000-0x000001F46DA12000-memory.dmp
memory/6056-2490-0x000001F46D9F0000-0x000001F46DA1A000-memory.dmp