Analysis
- user interaction
yes - max time kernel
300s - max time network
301s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
- submitted
30/07/2026, 18:33
General
- Target https://3dripper.com/
- Sample260730-w7behavfjf
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 64 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in System32 directory 1 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 15 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Inno Setup is an open-source installation builder for Windows applications. 4 IoCs
Inno Setup installer
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies Internet Explorer settings 1 TTPs 4 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 64 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 47 IoCs
- Suspicious use of SendNotifyMessage 36 IoCs
- Suspicious use of SetWindowsHookEx 5 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://3dripper.com/1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x28c,0x7ff961d4c188,0x7ff961d4c194,0x7ff961d4c1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1856,i,2374629655387993884,856142946059068520,262144 --field-trial-handle=2244,i,221660218793194036,12020835650089680445,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1988,i,644631002402882166,7369252277082496809,524288 --field-trial-handle=2244,i,221660218793194036,12020835650089680445,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:32⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2552,i,14363756274698926137,4509073302308141874,524288 --field-trial-handle=2244,i,221660218793194036,12020835650089680445,262144 --variations-seed-version --mojo-platform-channel-handle=1780 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3400,i,182941775302032188,9224719897581638379,2097152 --field-trial-handle=2244,i,221660218793194036,12020835650089680445,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3404,i,3188198167287037783,10350406529399058766,2097152 --field-trial-handle=2244,i,221660218793194036,12020835650089680445,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4092,i,5132283845479314946,14933166396587543301,2097152 --field-trial-handle=2244,i,221660218793194036,12020835650089680445,262144 --variations-seed-version --mojo-platform-channel-handle=4100 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4108,i,3325618912080197040,18322649626580253237,2097152 --field-trial-handle=2244,i,221660218793194036,12020835650089680445,262144 --variations-seed-version --mojo-platform-channel-handle=4136 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5056,i,4565937925611028942,17350170660485206829,524288 --field-trial-handle=2244,i,221660218793194036,12020835650089680445,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,6184854049887407845,5097542059461420907,524288 --field-trial-handle=2244,i,221660218793194036,12020835650089680445,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,12633027423605400437,4528264733556726846,524288 --field-trial-handle=2244,i,221660218793194036,12020835650089680445,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,2214564079056974722,11507244081212396424,524288 --field-trial-handle=2244,i,221660218793194036,12020835650089680445,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,2214564079056974722,11507244081212396424,524288 --field-trial-handle=2244,i,221660218793194036,12020835650089680445,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,4935089756177177443,1562289208242163605,524288 --field-trial-handle=2244,i,221660218793194036,12020835650089680445,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,6358387248630786529,6617486408178768264,524288 --field-trial-handle=2244,i,221660218793194036,12020835650089680445,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,214043472494870316,17806305285552818391,524288 --field-trial-handle=2244,i,221660218793194036,12020835650089680445,262144 --variations-seed-version --mojo-platform-channel-handle=4128 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,4449088117162091303,7829703843285883221,524288 --field-trial-handle=2244,i,221660218793194036,12020835650089680445,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6316,i,4763825406177550079,11162630703704512656,2097152 --field-trial-handle=2244,i,221660218793194036,12020835650089680445,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6484,i,2252129241785136085,17521856604668496924,2097152 --field-trial-handle=2244,i,221660218793194036,12020835650089680445,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6328,i,18112261191643777607,6712753513307712145,2097152 --field-trial-handle=2244,i,221660218793194036,12020835650089680445,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6720,i,2960008530314509157,2175949737777176045,2097152 --field-trial-handle=2244,i,221660218793194036,12020835650089680445,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6844,i,8126610593957515029,14630988554925001670,2097152 --field-trial-handle=2244,i,221660218793194036,12020835650089680445,262144 --variations-seed-version --mojo-platform-channel-handle=6868 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=772,i,13703580230848866368,5222263950712133078,2097152 --field-trial-handle=2244,i,221660218793194036,12020835650089680445,262144 --variations-seed-version --mojo-platform-channel-handle=7052 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6756,i,13417327107091692736,13572251059588587579,2097152 --field-trial-handle=2244,i,221660218793194036,12020835650089680445,262144 --variations-seed-version --mojo-platform-channel-handle=6740 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6296,i,15304213703688229602,5769469589272303393,2097152 --field-trial-handle=2244,i,221660218793194036,12020835650089680445,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7256,i,17906848865576406032,9770123774343486670,2097152 --field-trial-handle=2244,i,221660218793194036,12020835650089680445,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6744,i,12242543764315122038,8144766109487608429,524288 --field-trial-handle=2244,i,221660218793194036,12020835650089680445,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7404,i,4788910756861484175,9212900457241469240,2097152 --field-trial-handle=2244,i,221660218793194036,12020835650089680445,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7024,i,9038794878866661030,14712657306596220208,262144 --field-trial-handle=2244,i,221660218793194036,12020835650089680445,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7660,i,17502114224994622769,12152530962986052572,524288 --field-trial-handle=2244,i,221660218793194036,12020835650089680445,262144 --variations-seed-version --mojo-platform-channel-handle=7668 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7676,i,13715325366684318872,11575783243465349971,2097152 --field-trial-handle=2244,i,221660218793194036,12020835650089680445,262144 --variations-seed-version --mojo-platform-channel-handle=7700 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7888,i,75533382070272355,4950253807158442953,524288 --field-trial-handle=2244,i,221660218793194036,12020835650089680445,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6172,i,12892422807642570007,7707662097026187434,524288 --field-trial-handle=2244,i,221660218793194036,12020835650089680445,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,10711124706983298292,5419714574337352452,524288 --field-trial-handle=2244,i,221660218793194036,12020835650089680445,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7876,i,17867549869932945263,18339329133644523116,524288 --field-trial-handle=2244,i,221660218793194036,12020835650089680445,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7392,i,5202745321773411073,3914354307836841701,524288 --field-trial-handle=2244,i,221660218793194036,12020835650089680445,262144 --variations-seed-version --mojo-platform-channel-handle=7864 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=6656,i,1448214769329723789,4972731322278821040,2097152 --field-trial-handle=2244,i,221660218793194036,12020835650089680445,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=7012,i,10251797087961201510,17785275609905068627,2097152 --field-trial-handle=2244,i,221660218793194036,12020835650089680445,262144 --variations-seed-version --mojo-platform-channel-handle=7164 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=7152,i,4283077026056444583,13429069260454650442,2097152 --field-trial-handle=2244,i,221660218793194036,12020835650089680445,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=7136,i,12997733725888158280,4521440781128615468,2097152 --field-trial-handle=2244,i,221660218793194036,12020835650089680445,262144 --variations-seed-version --mojo-platform-channel-handle=6816 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8228,i,17797802914934105854,7575676869310914604,524288 --field-trial-handle=2244,i,221660218793194036,12020835650089680445,262144 --variations-seed-version --mojo-platform-channel-handle=6980 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\3dRipperPro.exe"C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\3dRipperPro.exe"1⤵
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\nvm-setup.exeC:\Users\Admin\Downloads\3d_Ripper_Pro_v108\nvm-setup.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-HSILR.tmp\nvm-setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-HSILR.tmp\nvm-setup.tmp" /SL5="$8026C,4785755,796160,C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\nvm-setup.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /C node "C:\Users\Admin\AppData\Local\Temp\is-4JB67.tmp\nvm_check.js" > "C:\Users\Admin\AppData\Local\Temp\is-4JB67.tmp\nvm_node_check.txt"4⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /C node "C:\Users\Admin\AppData\Local\Temp\is-4JB67.tmp\nvm_check.js" > "C:\Users\Admin\AppData\Local\Temp\is-4JB67.tmp\nvm_node_check.txt"4⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /C node "C:\Users\Admin\AppData\Local\Temp\is-4JB67.tmp\nvm_check.js" > "C:\Users\Admin\AppData\Local\Temp\is-4JB67.tmp\nvm_node_check.txt"4⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /C node "C:\Users\Admin\AppData\Local\Temp\is-4JB67.tmp\nvm_check.js" > "C:\Users\Admin\AppData\Local\Temp\is-4JB67.tmp\nvm_node_check.txt"4⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /C node "C:\Users\Admin\AppData\Local\Temp\is-4JB67.tmp\nvm_check.js" > "C:\Users\Admin\AppData\Local\Temp\is-4JB67.tmp\nvm_node_check.txt"4⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /C node "C:\Users\Admin\AppData\Local\Temp\is-4JB67.tmp\nvm_check.js" > "C:\Users\Admin\AppData\Local\Temp\is-4JB67.tmp\nvm_node_check.txt"4⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /C node "C:\Users\Admin\AppData\Local\Temp\is-4JB67.tmp\nvm_check.js" > "C:\Users\Admin\AppData\Local\Temp\is-4JB67.tmp\nvm_node_check.txt"4⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /C node "C:\Users\Admin\AppData\Local\Temp\is-4JB67.tmp\nvm_check.js" > "C:\Users\Admin\AppData\Local\Temp\is-4JB67.tmp\nvm_node_check.txt"4⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /C node "C:\Users\Admin\AppData\Local\Temp\is-4JB67.tmp\nvm_check.js" > "C:\Users\Admin\AppData\Local\Temp\is-4JB67.tmp\nvm_node_check.txt"4⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /C node "C:\Users\Admin\AppData\Local\Temp\is-4JB67.tmp\nvm_check.js" > "C:\Users\Admin\AppData\Local\Temp\is-4JB67.tmp\nvm_node_check.txt"4⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /C node "C:\Users\Admin\AppData\Local\Temp\is-4JB67.tmp\nvm_check.js" > "C:\Users\Admin\AppData\Local\Temp\is-4JB67.tmp\nvm_node_check.txt"4⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /C node "C:\Users\Admin\AppData\Local\Temp\is-4JB67.tmp\nvm_check.js" > "C:\Users\Admin\AppData\Local\Temp\is-4JB67.tmp\nvm_node_check.txt"4⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /C node "C:\Users\Admin\AppData\Local\Temp\is-4JB67.tmp\nvm_check.js" > "C:\Users\Admin\AppData\Local\Temp\is-4JB67.tmp\nvm_node_check.txt"4⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /C node "C:\Users\Admin\AppData\Local\Temp\is-4JB67.tmp\nvm_check.js" > "C:\Users\Admin\AppData\Local\Temp\is-4JB67.tmp\nvm_node_check.txt"4⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /C node "C:\Users\Admin\AppData\Local\Temp\is-4JB67.tmp\nvm_check.js" > "C:\Users\Admin\AppData\Local\Temp\is-4JB67.tmp\nvm_node_check.txt"4⤵
- Executes a command shell one-liner
-
-
C:\Users\Admin\AppData\Local\nvm\nvm.exe"C:\Users\Admin\AppData\Local\nvm\nvm.exe" subscribe --lts --current --nvm4w --author4⤵
- Executes dropped EXE
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoExit -Command refreshenv; cls; Write-Host 'Welcome to NVM for Windows v1.2.2'4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Data\3dripper.batC:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Data\3dripper.bat key.txt file.binz2⤵
-
-
C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Data\3dripper.batC:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Data\3dripper.bat key.txt model_file.binz2⤵
-
-
C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Data\3dripper.batC:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Data\3dripper.bat key.txt model_file_wireframe.binz2⤵
-
-
C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Data\3dripper.exeC:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Data\3dripper.exe file.osgjs model.gltf2⤵
-
-
C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Data\DecryptTex.batC:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Data\DecryptTex.bat "C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Downloads\santuncustom\01- rieju.mrt.50cc\317ece66729d4b3e8e9a8df169c31a69_RGB_Tire.png" "C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Downloads\santuncustom\01- rieju.mrt.50cc\317ece66729d4b3e8e9a8df169c31a69_RGB_Tire.png" 208652 02⤵
-
C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Data\DecryptTex.batC:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Data\DecryptTex.bat "C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Downloads\santuncustom\01- rieju.mrt.50cc\317ece66729d4b3e8e9a8df169c31a69_RGB_Tire.png" "C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Downloads\santuncustom\01- rieju.mrt.50cc\317ece66729d4b3e8e9a8df169c31a69_RGB_Tire.png" 208652 03⤵
- Loads dropped DLL
-
-
-
C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Data\DecryptTex.batC:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Data\DecryptTex.bat "C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Downloads\santuncustom\01- rieju.mrt.50cc\45d9ea62fe2c4cc091570968996fb824_RGB_sigmamc10.jpeg" "C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Downloads\santuncustom\01- rieju.mrt.50cc\45d9ea62fe2c4cc091570968996fb824_RGB_sigmamc10.jpeg" 39532 02⤵
-
C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Data\DecryptTex.batC:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Data\DecryptTex.bat "C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Downloads\santuncustom\01- rieju.mrt.50cc\45d9ea62fe2c4cc091570968996fb824_RGB_sigmamc10.jpeg" "C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Downloads\santuncustom\01- rieju.mrt.50cc\45d9ea62fe2c4cc091570968996fb824_RGB_sigmamc10.jpeg" 39532 03⤵
- Loads dropped DLL
-
-
-
C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Data\DecryptTex.batC:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Data\DecryptTex.bat "C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Downloads\santuncustom\01- rieju.mrt.50cc\52539d95493b49ed82850e633e607021_RGB_Katteet_Base_Color.png" "C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Downloads\santuncustom\01- rieju.mrt.50cc\52539d95493b49ed82850e633e607021_RGB_Katteet_Base_Color.png" 153353 02⤵
-
C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Data\DecryptTex.batC:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Data\DecryptTex.bat "C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Downloads\santuncustom\01- rieju.mrt.50cc\52539d95493b49ed82850e633e607021_RGB_Katteet_Base_Color.png" "C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Downloads\santuncustom\01- rieju.mrt.50cc\52539d95493b49ed82850e633e607021_RGB_Katteet_Base_Color.png" 153353 03⤵
- Loads dropped DLL
-
-
-
C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Data\DecryptTex.batC:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Data\DecryptTex.bat "C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Downloads\santuncustom\01- rieju.mrt.50cc\7c4cfa020972462b94b37a7a01bb06bc_RGB_Gripdonuts.jpeg" "C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Downloads\santuncustom\01- rieju.mrt.50cc\7c4cfa020972462b94b37a7a01bb06bc_RGB_Gripdonuts.jpeg" 242216 02⤵
-
C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Data\DecryptTex.batC:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Data\DecryptTex.bat "C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Downloads\santuncustom\01- rieju.mrt.50cc\7c4cfa020972462b94b37a7a01bb06bc_RGB_Gripdonuts.jpeg" "C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Downloads\santuncustom\01- rieju.mrt.50cc\7c4cfa020972462b94b37a7a01bb06bc_RGB_Gripdonuts.jpeg" 242216 03⤵
- Loads dropped DLL
-
-
-
C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Data\DecryptTex.batC:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Data\DecryptTex.bat "C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Downloads\santuncustom\01- rieju.mrt.50cc\87404ba723584e96a7578c9bf12940ae_RGB_\u00c4nkk\u00e4.png" "C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Downloads\santuncustom\01- rieju.mrt.50cc\87404ba723584e96a7578c9bf12940ae_RGB_\u00c4nkk\u00e4.png" 80375 02⤵
-
C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Data\DecryptTex.batC:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Data\DecryptTex.bat "C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Downloads\santuncustom\01- rieju.mrt.50cc\87404ba723584e96a7578c9bf12940ae_RGB_\u00c4nkk\u00e4.png" "C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Downloads\santuncustom\01- rieju.mrt.50cc\87404ba723584e96a7578c9bf12940ae_RGB_\u00c4nkk\u00e4.png" 80375 03⤵
-
-
-
C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Data\DecryptTex.batC:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Data\DecryptTex.bat "C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Downloads\santuncustom\01- rieju.mrt.50cc\8bf03c10f12e4aca84f716080107e831_R_NGK_0.jpeg" "C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Downloads\santuncustom\01- rieju.mrt.50cc\8bf03c10f12e4aca84f716080107e831_R_NGK_0.jpeg" 236855 02⤵
-
C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Data\DecryptTex.batC:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Data\DecryptTex.bat "C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Downloads\santuncustom\01- rieju.mrt.50cc\8bf03c10f12e4aca84f716080107e831_R_NGK_0.jpeg" "C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Downloads\santuncustom\01- rieju.mrt.50cc\8bf03c10f12e4aca84f716080107e831_R_NGK_0.jpeg" 236855 03⤵
-
-
-
C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Data\DecryptTex.batC:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Data\DecryptTex.bat "C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Downloads\santuncustom\01- rieju.mrt.50cc\9095ea470ea64c4bbbe9344bfdda49d5_RGB_Stage6.png" "C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Downloads\santuncustom\01- rieju.mrt.50cc\9095ea470ea64c4bbbe9344bfdda49d5_RGB_Stage6.png" 112050 02⤵
-
C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Data\DecryptTex.batC:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Data\DecryptTex.bat "C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Downloads\santuncustom\01- rieju.mrt.50cc\9095ea470ea64c4bbbe9344bfdda49d5_RGB_Stage6.png" "C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Downloads\santuncustom\01- rieju.mrt.50cc\9095ea470ea64c4bbbe9344bfdda49d5_RGB_Stage6.png" 112050 03⤵
-
-
-
C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Data\DecryptTex.batC:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Data\DecryptTex.bat "C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Downloads\santuncustom\01- rieju.mrt.50cc\a4ad5bfdff5c4c829499a8f534d8c1a9_R_4014259.jpeg" "C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Downloads\santuncustom\01- rieju.mrt.50cc\a4ad5bfdff5c4c829499a8f534d8c1a9_R_4014259.jpeg" 130242 02⤵
-
C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Data\DecryptTex.batC:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Data\DecryptTex.bat "C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Downloads\santuncustom\01- rieju.mrt.50cc\a4ad5bfdff5c4c829499a8f534d8c1a9_R_4014259.jpeg" "C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Downloads\santuncustom\01- rieju.mrt.50cc\a4ad5bfdff5c4c829499a8f534d8c1a9_R_4014259.jpeg" 130242 03⤵
-
-
-
C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Data\DecryptTex.batC:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Data\DecryptTex.bat "C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Downloads\santuncustom\01- rieju.mrt.50cc\b560b686a27b416bb284b5a13dbbfe64_RGB_Fatbar_kiinnikkeet.png" "C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Downloads\santuncustom\01- rieju.mrt.50cc\b560b686a27b416bb284b5a13dbbfe64_RGB_Fatbar_kiinnikkeet.png" 199259 02⤵
-
C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Data\DecryptTex.batC:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Data\DecryptTex.bat "C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Downloads\santuncustom\01- rieju.mrt.50cc\b560b686a27b416bb284b5a13dbbfe64_RGB_Fatbar_kiinnikkeet.png" "C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Downloads\santuncustom\01- rieju.mrt.50cc\b560b686a27b416bb284b5a13dbbfe64_RGB_Fatbar_kiinnikkeet.png" 199259 03⤵
-
-
-
C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Data\DecryptTex.batC:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Data\DecryptTex.bat "C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Downloads\santuncustom\01- rieju.mrt.50cc\f0cd1c4b471a48d88f6f488b45619b2a_RGB_FrontFender.png" "C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Downloads\santuncustom\01- rieju.mrt.50cc\f0cd1c4b471a48d88f6f488b45619b2a_RGB_FrontFender.png" 187450 02⤵
-
C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Data\DecryptTex.batC:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Data\DecryptTex.bat "C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Downloads\santuncustom\01- rieju.mrt.50cc\f0cd1c4b471a48d88f6f488b45619b2a_RGB_FrontFender.png" "C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Downloads\santuncustom\01- rieju.mrt.50cc\f0cd1c4b471a48d88f6f488b45619b2a_RGB_FrontFender.png" 187450 03⤵
-
-
-
C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Data\DecryptTex.batC:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Data\DecryptTex.bat "C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Downloads\santuncustom\01- rieju.mrt.50cc\f43d62fd88194bae8d733d7d001c3670_RGB_Valokytkin1.png" "C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Downloads\santuncustom\01- rieju.mrt.50cc\f43d62fd88194bae8d733d7d001c3670_RGB_Valokytkin1.png" 119619 02⤵
-
C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Data\DecryptTex.batC:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Data\DecryptTex.bat "C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Downloads\santuncustom\01- rieju.mrt.50cc\f43d62fd88194bae8d733d7d001c3670_RGB_Valokytkin1.png" "C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Downloads\santuncustom\01- rieju.mrt.50cc\f43d62fd88194bae8d733d7d001c3670_RGB_Valokytkin1.png" 119619 03⤵
-
-
-
C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Data\DecryptTex.batC:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Data\DecryptTex.bat "C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Downloads\santuncustom\01- rieju.mrt.50cc\f67f3ebf2b8f445194b23b1b71161c21_RGB_Alakauttanen.png" "C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Downloads\santuncustom\01- rieju.mrt.50cc\f67f3ebf2b8f445194b23b1b71161c21_RGB_Alakauttanen.png" 34520 02⤵
-
C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Data\DecryptTex.batC:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Data\DecryptTex.bat "C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Downloads\santuncustom\01- rieju.mrt.50cc\f67f3ebf2b8f445194b23b1b71161c21_RGB_Alakauttanen.png" "C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Downloads\santuncustom\01- rieju.mrt.50cc\f67f3ebf2b8f445194b23b1b71161c21_RGB_Alakauttanen.png" 34520 03⤵
-
-
-
C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Data\DecryptTex.batC:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Data\DecryptTex.bat "C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Downloads\santuncustom\01- rieju.mrt.50cc\fdd7f622e9a5422dbf5bddff3cc9287c_RGB_Takahaarukka.png" "C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Downloads\santuncustom\01- rieju.mrt.50cc\fdd7f622e9a5422dbf5bddff3cc9287c_RGB_Takahaarukka.png" 111447 02⤵
-
C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Data\DecryptTex.batC:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Data\DecryptTex.bat "C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Downloads\santuncustom\01- rieju.mrt.50cc\fdd7f622e9a5422dbf5bddff3cc9287c_RGB_Takahaarukka.png" "C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Downloads\santuncustom\01- rieju.mrt.50cc\fdd7f622e9a5422dbf5bddff3cc9287c_RGB_Takahaarukka.png" 111447 03⤵
-
-
-
C:\Windows\SysWOW64\Explorer.exeExplorer.exe C:\Users\Admin\Downloads\3d_Ripper_Pro_v108\Downloads\santuncustom\01- rieju.mrt.50cc\2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Replay Monitor
Loading Replay Monitor...
Downloads
blocklist
settings.dat
settings.dat
BookmarkMergedSurfaceOrdering
f_000091
f_00009a
f_00009c
f_00009d
f_00009e
f_00009f
f_0000a0
f_0000a1
f_0000a2
f_0000a3
f_0000a4
f_0000b7
f_0000b8
f_0000b9
f_0000ba
f_0000bc
f_0000be
f_0000bf
f_0000c0
f_0000c1
f_0000c3
f_000118
f_00011a
the-real-index
the-real-index
the-real-index
the-real-index~RFe58a052.TMP
SiteList-Enterprise.json
Edge Profile.ico
CURRENT
MANIFEST-000001
MANIFEST-000001
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Sdch Dictionaries
Sdch Dictionaries~RFe59a965.TMP
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index~RFe5bfe13.TMP
the-real-index
the-real-index
the-real-index~RFe5b7ba5.TMP
the-real-index
the-real-index~RFe5a64b6.TMP
index.txt
index.txt
index.txt
index.txt
the-real-index
the-real-index~RFe5a2fdb.TMP
sync_diagnostic.log
OperationConfig
OperationConfig~RFe5906ec.TMP
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter~RFe598478.TMP
8a0dc33c-125b-4487-9424-82931c1091de.tmp
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
9443666f428d44e1af8c5e6d4ec922ec[1].jpg
MSVCP140.dll
_imaging.cp310-win_amd64.pyd
_imagingtk.cp310-win_amd64.pyd
_webp.cp310-win_amd64.pyd
VCRUNTIME140_1.dll
_asyncio.pyd
_bz2.pyd
_cffi_backend.cp310-win_amd64.pyd
_decimal.pyd
_elementtree.pyd
_hashlib.pyd
_lzma.pyd
_multiprocessing.pyd
_overlapped.pyd
_queue.pyd
_socket.pyd
_ssl.pyd
_uuid.pyd
LICENSE
METADATA
RECORD
WHEEL
top_level.txt
zip-safe
api-ms-win-core-console-l1-1-0.dll
api-ms-win-core-datetime-l1-1-0.dll
api-ms-win-core-debug-l1-1-0.dll
api-ms-win-core-errorhandling-l1-1-0.dll
api-ms-win-core-file-l1-1-0.dll
api-ms-win-core-file-l1-2-0.dll
api-ms-win-core-file-l2-1-0.dll
api-ms-win-core-handle-l1-1-0.dll
api-ms-win-core-heap-l1-1-0.dll
api-ms-win-core-interlocked-l1-1-0.dll
api-ms-win-core-libraryloader-l1-1-0.dll
api-ms-win-core-localization-l1-2-0.dll
api-ms-win-core-memory-l1-1-0.dll
api-ms-win-core-namedpipe-l1-1-0.dll
api-ms-win-core-processenvironment-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-1.dll
api-ms-win-core-profile-l1-1-0.dll
api-ms-win-core-rtlsupport-l1-1-0.dll
api-ms-win-core-string-l1-1-0.dll
api-ms-win-core-synch-l1-1-0.dll
api-ms-win-core-synch-l1-2-0.dll
api-ms-win-core-sysinfo-l1-1-0.dll
api-ms-win-core-timezone-l1-1-0.dll
api-ms-win-core-util-l1-1-0.dll
api-ms-win-crt-conio-l1-1-0.dll
api-ms-win-crt-convert-l1-1-0.dll
api-ms-win-crt-environment-l1-1-0.dll
api-ms-win-crt-filesystem-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-process-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-time-l1-1-0.dll
api-ms-win-crt-utility-l1-1-0.dll
libcrypto-1_1.dll
libopenblas.XWYDX2IKJW2NMTWSFYNGFUWKQU3LYTCZ.gfortran-win_amd64.dll
libssl-1_1.dll
_multiarray_tests.cp310-win_amd64.pyd
_multiarray_umath.cp310-win_amd64.pyd
_pocketfft_internal.cp310-win_amd64.pyd
_umath_linalg.cp310-win_amd64.pyd
lapack_lite.cp310-win_amd64.pyd
_bounded_integers.cp310-win_amd64.pyd
_common.cp310-win_amd64.pyd
_generator.cp310-win_amd64.pyd
_mt19937.cp310-win_amd64.pyd
_pcg64.cp310-win_amd64.pyd
_philox.cp310-win_amd64.pyd
_sfc64.cp310-win_amd64.pyd
bit_generator.cp310-win_amd64.pyd
mtrand.cp310-win_amd64.pyd
pyexpat.pyd
COPYING.txt
METADATA
RECORD
WHEEL
entry_points.txt
top_level.txt
select.pyd
LICENSE
METADATA
RECORD
WHEEL
entry_points.txt
top_level.txt
shader.pyd
unicodedata.pyd
VCRUNTIME140.dll
_ctypes.pyd
base_library.zip
libffi-7.dll
python310.dll
ucrtbase.dll
INSTALLER
__PSScriptPolicyTest_sdij2ujh.k0f.ps1
nvm_check.js
nvm-setup.tmp
nvm.exe
default.dic
ccba5a5986c77e43.customDestinations-ms
ccba5a5986c77e43.customDestinations-ms
ccba5a5986c77e43.customDestinations-ms
ccba5a5986c77e43.customDestinations-ms
file.binz
file.osgjs
file.osgjs
key.txt
key2.txt
model_file.bin
model_file.bin
model_file.binz
model_file_wireframe.bin
model_file_wireframe.bin
model_file_wireframe.binz
nvm-setup.exe
temp.dat
temp.dat
temp.dat
temp.dat
memory/716-1540-0x0000000000400000-0x00000000006F2000-memory.dmp
memory/716-1596-0x0000000000400000-0x00000000006F2000-memory.dmp
memory/716-1637-0x0000000000400000-0x00000000006F2000-memory.dmp
memory/1236-3272-0x00007FF6152D0000-0x00007FF618B50000-memory.dmp
memory/1236-2534-0x0000013C78180000-0x0000013C78190000-memory.dmp
memory/1236-2533-0x0000013C78140000-0x0000013C78180000-memory.dmp
memory/2760-2306-0x00007FF6152D0000-0x00007FF618B50000-memory.dmp
memory/2760-2410-0x00007FF6152D0000-0x00007FF618B50000-memory.dmp
memory/2760-2309-0x00000188BD680000-0x00000188BD690000-memory.dmp
memory/2760-2308-0x00000188BD640000-0x00000188BD680000-memory.dmp
memory/2772-1532-0x0000000000400000-0x00000000004D0000-memory.dmp
memory/2772-1638-0x0000000000400000-0x00000000004D0000-memory.dmp
memory/2772-1539-0x0000000000400000-0x00000000004D0000-memory.dmp
memory/3508-1625-0x0000018E7F190000-0x0000018E7F1D4000-memory.dmp
memory/3508-1622-0x0000018E7E900000-0x0000018E7E922000-memory.dmp
memory/3508-1633-0x0000018E7F140000-0x0000018E7F14A000-memory.dmp
memory/3508-1634-0x0000018E7F260000-0x0000018E7F2D6000-memory.dmp
memory/5084-3309-0x000003F250CC0000-0x000003F250D00000-memory.dmp
memory/5084-3598-0x00007FF6152D0000-0x00007FF618B50000-memory.dmp
memory/5084-3310-0x000003F250D00000-0x000003F250D10000-memory.dmp