Windows Analysis Report
KeePassXC-2.7.10-Win64.msi

Overview

General Information

Sample name: KeePassXC-2.7.10-Win64.msi
Analysis ID: 1669048
MD5: a8ed4c0ffda5146b1fd0e7a3c33777b6
SHA1: 6b58858f997e43da3a5f5184c3de7f875c6ed635
SHA256: 57781a64392d55c950fe734d084b500b836ef5a8029995ae4dfd8d911aba4b44
Infos:

Detection

Score: 4
Range: 0 - 100
Confidence: 40%

Signatures

Adds / modifies Windows certificates
Checks for available system drives (often done to infect USB drives)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Deletes files inside the Windows folder
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Enables debug privileges
Found dropped PE file which has not been started or loaded
May sleep (evasive loops) to hinder dynamic analysis
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Sigma detected: CurrentVersion Autorun Keys Modification
Stores files to the Windows start menu directory
Stores large binary data to the registry
Uses taskkill to terminate processes

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
Source: KeePassXC.exe, 00000013.00000002.4095576691.00007FF93DD4E000.00000004.00000001.01000000.00000007.sdmp Binary or memory string: -----BEGIN PUBLIC KEY----- memstr_2b3a2fa0-3
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\argon2.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\botan-3.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\brotlicommon.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\brotlidec.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\bz2.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\double-conversion.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\freetype.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\harfbuzz.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\jpeg62.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\KeePassXC.exe Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\keepassxc-autotype-windows.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\keepassxc-cli.exe Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\keepassxc-proxy.exe Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\libcrypto-3-x64.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\liblzma.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\libpng16.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\libsharpyuv.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\libssl-3-x64.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\libwebp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\libwebpdemux.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\libwebpmux.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\minizip.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\pcre2-16.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\plugins Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\plugins\bearer Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\plugins\bearer\qgenericbearer.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\plugins\iconengines Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\plugins\iconengines\qsvgicon.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\plugins\imageformats Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\plugins\imageformats\qgif.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\plugins\imageformats\qicns.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\plugins\imageformats\qico.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\plugins\imageformats\qjpeg.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\plugins\imageformats\qsvg.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\plugins\imageformats\qtga.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\plugins\imageformats\qtiff.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\plugins\imageformats\qwbmp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\plugins\imageformats\qwebp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\plugins\platforms Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\plugins\platforms\qwindows.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\plugins\styles Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\plugins\styles\qwindowsvistastyle.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\qrencode.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\qt.conf Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\Qt5Concurrent.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\Qt5Core.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\Qt5Gui.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\Qt5Network.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\Qt5Svg.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\Qt5Widgets.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\readline.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\docs Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\docs\KeePassXC_GettingStarted.html Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\docs\KeePassXC_KeyboardShortcuts.html Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\docs\KeePassXC_UserGuide.html Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\icons Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\icons\application Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\icons\application\256x256 Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\icons\application\256x256\apps Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\icons\application\256x256\apps\keepassxc.png Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_ar.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_bg.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_ca.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_cs.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_da.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_de.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_el.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_en.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_en_GB.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_en_US.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_es.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_et.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_fi.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_fil.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_fr.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_fr_CA.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_he.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_hr.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_hu.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_id.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_it.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_ja.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_km.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_ko.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_lt.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_my.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_nb.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_nl.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_pl.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_pt_BR.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_pt_PT.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_ro.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_ru.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_si.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_sk.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_sl.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_sq.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_sr.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_sv.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_th.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_tr.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_uk.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_zh_CN.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_zh_TW.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\qtbase_ar.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\qtbase_bg.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\qtbase_ca.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\qtbase_cs.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\qtbase_da.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\qtbase_de.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\qtbase_en.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\qtbase_es.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\qtbase_fa.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\qtbase_fi.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\qtbase_fr.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\qtbase_gd.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\qtbase_he.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\qtbase_hr.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\qtbase_hu.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\qtbase_it.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\qtbase_ja.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\qtbase_ko.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\qtbase_lv.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\qtbase_nl.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\qtbase_nn.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\qtbase_pl.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\qtbase_pt_BR.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\qtbase_ru.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\qtbase_sk.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\qtbase_tr.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\qtbase_uk.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\qtbase_zh_CN.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\qtbase_zh_TW.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\wordlists Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\wordlists\eff_large.wordlist Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\ssl Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\ssl\certs Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\ssl\certs\ca-bundle.crt Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\tiff.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\zlib1.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\zstd.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E86A6926-F1BD-42B8-BE36-12E8A3A052AC} Jump to behavior
Source: Binary string: C:\Tools\vcpkg\buildtrees\zlib\x64-windows-rel\zlib.pdb## source: KeePassXC.exe, 00000013.00000002.4098576060.00007FF95D9CF000.00000002.00000001.01000000.0000000D.sdmp, KeePassXC.exe, 00000016.00000002.3177344391.00007FF95D9CF000.00000002.00000001.01000000.0000000D.sdmp
Source: Binary string: C:\Tools\vcpkg\buildtrees\double-conversion\x64-windows-rel\double-conversion.pdb source: KeePassXC.exe, 00000013.00000002.4097420375.00007FF957ABD000.00000002.00000001.01000000.00000011.sdmp, KeePassXC.exe, 00000016.00000002.3176869456.00007FF957ABD000.00000002.00000001.01000000.00000011.sdmp
Source: Binary string: C:\Tools\vcpkg\buildtrees\freetype\x64-windows-rel\freetype.pdb source: KeePassXC.exe, 00000013.00000002.4088123746.00007FF93BEFA000.00000002.00000001.01000000.00000017.sdmp, KeePassXC.exe, 00000016.00000002.3170869722.00007FF93BEFA000.00000002.00000001.01000000.00000017.sdmp
Source: Binary string: C:\Tools\vcpkg\buildtrees\qt5-base\x64-windows-rel\plugins\styles\qwindowsvistastyle.pdb''! source: KeePassXC.exe, 00000013.00000002.4087602282.00007FF93BD8B000.00000002.00000001.01000000.0000001C.sdmp, KeePassXC.exe, 00000016.00000002.3170310906.00007FF93BD8B000.00000002.00000001.01000000.0000001C.sdmp
Source: Binary string: C:\Tools\vcpkg\buildtrees\double-conversion\x64-windows-rel\double-conversion.pdb## source: KeePassXC.exe, 00000013.00000002.4097420375.00007FF957ABD000.00000002.00000001.01000000.00000011.sdmp, KeePassXC.exe, 00000016.00000002.3176869456.00007FF957ABD000.00000002.00000001.01000000.00000011.sdmp
Source: Binary string: C:\Tools\vcpkg\buildtrees\brotli\x64-windows-rel\brotlidec.pdb source: KeePassXC.exe, 00000013.00000002.4096319904.00007FF950BDA000.00000002.00000001.01000000.00000019.sdmp, KeePassXC.exe, 00000016.00000002.3176445737.00007FF950BDA000.00000002.00000001.01000000.00000019.sdmp
Source: Binary string: C:\Tools\vcpkg\buildtrees\qt5-svg\x64-windows-rel\plugins\iconengines\qsvgicon.pdb source: KeePassXC.exe, 00000013.00000002.4096644792.00007FF957A65000.00000002.00000001.01000000.0000001E.sdmp
Source: Binary string: C:\Tools\vcpkg\buildtrees\openssl\x64-windows-rel\libssl-3-x64.pdbDD source: KeePassXC.exe, 00000013.00000002.4089548597.00007FF93C5AC000.00000002.00000001.01000000.00000010.sdmp, KeePassXC.exe, 00000016.00000002.3171911099.00007FF93C5AC000.00000002.00000001.01000000.00000010.sdmp
Source: Binary string: C:\Tools\vcpkg\buildtrees\argon2\x64-windows-rel\argon2.pdb source: KeePassXC.exe, 00000013.00000002.4098807577.00007FF95DD57000.00000002.00000001.01000000.00000009.sdmp, KeePassXC.exe, 00000016.00000002.3177427548.00007FF95DD57000.00000002.00000001.01000000.00000009.sdmp
Source: Binary string: C:\Tools\vcpkg\buildtrees\libpng\x64-windows-rel\libpng16.pdb source: KeePassXC.exe, 00000013.00000002.4096783705.00007FF957A95000.00000002.00000001.01000000.00000015.sdmp, KeePassXC.exe, 00000016.00000002.3176748418.00007FF957A95000.00000002.00000001.01000000.00000015.sdmp
Source: Binary string: C:\Tools\vcpkg\buildtrees\brotli\x64-windows-rel\brotlicommon.pdb source: KeePassXC.exe, 00000013.00000002.4096019479.00007FF93F123000.00000002.00000001.01000000.0000001A.sdmp, KeePassXC.exe, 00000016.00000002.3176094001.00007FF93F123000.00000002.00000001.01000000.0000001A.sdmp
Source: Binary string: C:\Tools\vcpkg\buildtrees\qt5-base\x64-windows-rel\lib\Qt5Concurrent.pdb!! source: KeePassXC.exe, 00000013.00000002.4099027666.00007FF9610C4000.00000002.00000001.01000000.00000008.sdmp, KeePassXC.exe, 00000016.00000002.3177508058.00007FF9610C4000.00000002.00000001.01000000.00000008.sdmp
Source: Binary string: r.PDB source: KeePassXC.exe, 00000013.00000002.4091832948.00007FF93D19A000.00000002.00000001.01000000.0000000C.sdmp, KeePassXC.exe, 00000016.00000002.3173924410.00007FF93D19A000.00000002.00000001.01000000.0000000C.sdmp
Source: Binary string: C:\Tools\vcpkg\buildtrees\qt5-base\x64-windows-rel\lib\Qt5Core.pdb source: KeePassXC.exe, 00000013.00000002.4092224554.00007FF93D46B000.00000002.00000001.01000000.0000000B.sdmp, KeePassXC.exe, 00000016.00000002.3174571972.00007FF93D46B000.00000002.00000001.01000000.0000000B.sdmp
Source: Binary string: C:\Tools\vcpkg\buildtrees\qt5-svg\x64-windows-rel\lib\Qt5Svg.pdb source: KeePassXC.exe, 00000013.00000002.4095832762.00007FF93DD9F000.00000002.00000001.01000000.00000005.sdmp, KeePassXC.exe, 00000016.00000002.3175928902.00007FF93DD9F000.00000002.00000001.01000000.00000005.sdmp
Source: Binary string: C:\Tools\vcpkg\buildtrees\openssl\x64-windows-rel\libcrypto-3-x64.pdb source: KeePassXC.exe, 00000013.00000002.4089209402.00007FF93C41E000.00000002.00000001.01000000.00000013.sdmp, KeePassXC.exe, 00000016.00000002.3171650373.00007FF93C41E000.00000002.00000001.01000000.00000013.sdmp
Source: Binary string: C:\Tools\vcpkg\buildtrees\libpng\x64-windows-rel\libpng16.pdb$$ source: KeePassXC.exe, 00000013.00000002.4096783705.00007FF957A95000.00000002.00000001.01000000.00000015.sdmp, KeePassXC.exe, 00000016.00000002.3176748418.00007FF957A95000.00000002.00000001.01000000.00000015.sdmp
Source: Binary string: C:\Tools\vcpkg\buildtrees\openssl\x64-windows-rel\libssl-3-x64.pdb source: KeePassXC.exe, 00000013.00000002.4089548597.00007FF93C5AC000.00000002.00000001.01000000.00000010.sdmp, KeePassXC.exe, 00000016.00000002.3171911099.00007FF93C5AC000.00000002.00000001.01000000.00000010.sdmp
Source: Binary string: C:\Tools\vcpkg\buildtrees\qt5-base\x64-windows-rel\lib\Qt5Concurrent.pdb source: KeePassXC.exe, 00000013.00000002.4099027666.00007FF9610C4000.00000002.00000001.01000000.00000008.sdmp, KeePassXC.exe, 00000016.00000002.3177508058.00007FF9610C4000.00000002.00000001.01000000.00000008.sdmp
Source: Binary string: C:\Tools\vcpkg\buildtrees\botan\x64-windows-rel\botan-3.pdb source: KeePassXC.exe, 00000013.00000002.4095222872.00007FF93DA60000.00000002.00000001.01000000.0000000A.sdmp, KeePassXC.exe, 00000016.00000002.3175318715.00007FF93DA60000.00000002.00000001.01000000.0000000A.sdmp
Source: Binary string: C:\Tools\vcpkg\buildtrees\qt5-base\x64-windows-rel\lib\Qt5Network.pdb source: KeePassXC.exe, 00000013.00000002.4095535046.00007FF93DCEE000.00000002.00000001.01000000.00000007.sdmp, KeePassXC.exe, 00000016.00000002.3175629660.00007FF93DCEE000.00000002.00000001.01000000.00000007.sdmp
Source: Binary string: C:\Tools\vcpkg\buildtrees\qt5-svg\x64-windows-rel\lib\Qt5Svg.pdb++ source: KeePassXC.exe, 00000013.00000002.4095832762.00007FF93DD9F000.00000002.00000001.01000000.00000005.sdmp, KeePassXC.exe, 00000016.00000002.3175928902.00007FF93DD9F000.00000002.00000001.01000000.00000005.sdmp
Source: Binary string: C:\Tools\vcpkg\buildtrees\pcre2\x64-windows-rel\pcre2-16.pdb source: KeePassXC.exe, 00000013.00000002.4096160060.00007FF944043000.00000002.00000001.01000000.00000012.sdmp, KeePassXC.exe, 00000016.00000002.3176282328.00007FF944043000.00000002.00000001.01000000.00000012.sdmp
Source: Binary string: C:\Tools\vcpkg\buildtrees\harfbuzz\x64-windows-rel\src\harfbuzz.pdb source: KeePassXC.exe, 00000013.00000002.4088325018.00007FF93BFF2000.00000002.00000001.01000000.00000016.sdmp, KeePassXC.exe, 00000016.00000002.3171096150.00007FF93BFF2000.00000002.00000001.01000000.00000016.sdmp
Source: Binary string: C:\Tools\vcpkg\buildtrees\qt5-base\x64-windows-rel\lib\Qt5Gui.pdb< source: KeePassXC.exe, 00000013.00000002.4091209691.00007FF93CF19000.00000002.00000001.01000000.0000000C.sdmp, KeePassXC.exe, 00000016.00000002.3173443311.00007FF93CF19000.00000002.00000001.01000000.0000000C.sdmp, KeePassXC.exe, 00000018.00000002.3256335958.00007FF93CF19000.00000002.00000001.01000000.0000000C.sdmp
Source: Binary string: C:\Tools\vcpkg\buildtrees\qt5-base\x64-windows-rel\lib\Qt5Core.pdb( source: KeePassXC.exe, 00000013.00000002.4092224554.00007FF93D46B000.00000002.00000001.01000000.0000000B.sdmp, KeePassXC.exe, 00000016.00000002.3174571972.00007FF93D46B000.00000002.00000001.01000000.0000000B.sdmp
Source: Binary string: C:\Tools\vcpkg\buildtrees\qt5-base\x64-windows-rel\lib\Qt5Widgets.pdb source: KeePassXC.exe, 00000013.00000002.4090045675.00007FF93C93E000.00000002.00000001.01000000.0000000F.sdmp, KeePassXC.exe, 00000016.00000002.3172356309.00007FF93C93E000.00000002.00000001.01000000.0000000F.sdmp
Source: Binary string: C:\Tools\vcpkg\buildtrees\libqrencode\x64-windows-rel\qrencode.pdb source: KeePassXC.exe, 00000013.00000002.4098279468.00007FF9586B9000.00000002.00000001.01000000.00000006.sdmp, KeePassXC.exe, 00000016.00000002.3177224774.00007FF9586B9000.00000002.00000001.01000000.00000006.sdmp
Source: Binary string: C:\Tools\vcpkg\buildtrees\freetype\x64-windows-rel\freetype.pdb>> source: KeePassXC.exe, 00000013.00000002.4088123746.00007FF93BEFA000.00000002.00000001.01000000.00000017.sdmp, KeePassXC.exe, 00000016.00000002.3170869722.00007FF93BEFA000.00000002.00000001.01000000.00000017.sdmp
Source: Binary string: C:\Tools\vcpkg\buildtrees\qt5-base\x64-windows-rel\plugins\platforms\qwindows.pdb source: KeePassXC.exe, 00000013.00000002.4087820584.00007FF93BE27000.00000002.00000001.01000000.0000001B.sdmp, KeePassXC.exe, 00000016.00000002.3170489266.00007FF93BE27000.00000002.00000001.01000000.0000001B.sdmp
Source: Binary string: C:\Tools\vcpkg\buildtrees\zstd\x64-windows-rel\lib\zstd.pdb99 source: KeePassXC.exe, 00000013.00000002.4088582697.00007FF93C0CA000.00000002.00000001.01000000.00000014.sdmp, KeePassXC.exe, 00000016.00000002.3171285759.00007FF93C0CA000.00000002.00000001.01000000.00000014.sdmp
Source: Binary string: C:\Tools\vcpkg\buildtrees\pcre2\x64-windows-rel\pcre2-16.pdb// source: KeePassXC.exe, 00000013.00000002.4096160060.00007FF944043000.00000002.00000001.01000000.00000012.sdmp, KeePassXC.exe, 00000016.00000002.3176282328.00007FF944043000.00000002.00000001.01000000.00000012.sdmp
Source: Binary string: C:\Tools\vcpkg\buildtrees\bzip2\x64-windows-rel\bz2.pdb source: KeePassXC.exe, 00000013.00000002.4096458026.00007FF956DC0000.00000002.00000001.01000000.00000018.sdmp, KeePassXC.exe, 00000016.00000002.3176587539.00007FF956DC0000.00000002.00000001.01000000.00000018.sdmp
Source: Binary string: r.PDB!`r. source: KeePassXC.exe, 00000013.00000002.4091209691.00007FF93CF19000.00000002.00000001.01000000.0000000C.sdmp, KeePassXC.exe, 00000016.00000002.3173443311.00007FF93CF19000.00000002.00000001.01000000.0000000C.sdmp, KeePassXC.exe, 00000018.00000002.3256335958.00007FF93CF19000.00000002.00000001.01000000.0000000C.sdmp
Source: Binary string: C:\Tools\vcpkg\buildtrees\qt5-base\x64-windows-rel\plugins\styles\qwindowsvistastyle.pdb source: KeePassXC.exe, 00000013.00000002.4087602282.00007FF93BD8B000.00000002.00000001.01000000.0000001C.sdmp, KeePassXC.exe, 00000016.00000002.3170310906.00007FF93BD8B000.00000002.00000001.01000000.0000001C.sdmp
Source: Binary string: C:\Tools\vcpkg\buildtrees\minizip\x64-windows-rel\minizip.pdb source: KeePassXC.exe, 00000013.00000002.4097904725.00007FF957E0A000.00000002.00000001.01000000.0000000E.sdmp, KeePassXC.exe, 00000016.00000002.3177092336.00007FF957E0A000.00000002.00000001.01000000.0000000E.sdmp
Source: Binary string: C:\Tools\vcpkg\buildtrees\harfbuzz\x64-windows-rel\src\harfbuzz.pdbPP source: KeePassXC.exe, 00000013.00000002.4088325018.00007FF93BFF2000.00000002.00000001.01000000.00000016.sdmp, KeePassXC.exe, 00000016.00000002.3171096150.00007FF93BFF2000.00000002.00000001.01000000.00000016.sdmp
Source: Binary string: C:\Tools\vcpkg\buildtrees\qt5-base\x64-windows-rel\plugins\platforms\qwindows.pdbll% source: KeePassXC.exe, 00000013.00000002.4087820584.00007FF93BE27000.00000002.00000001.01000000.0000001B.sdmp, KeePassXC.exe, 00000016.00000002.3170489266.00007FF93BE27000.00000002.00000001.01000000.0000001B.sdmp
Source: Binary string: r.PDB! source: KeePassXC.exe, 00000013.00000002.4091209691.00007FF93CF19000.00000002.00000001.01000000.0000000C.sdmp, KeePassXC.exe, 00000016.00000002.3173443311.00007FF93CF19000.00000002.00000001.01000000.0000000C.sdmp, KeePassXC.exe, 00000018.00000002.3256335958.00007FF93CF19000.00000002.00000001.01000000.0000000C.sdmp
Source: Binary string: C:\Tools\vcpkg\buildtrees\zstd\x64-windows-rel\lib\zstd.pdb source: KeePassXC.exe, 00000013.00000002.4088582697.00007FF93C0CA000.00000002.00000001.01000000.00000014.sdmp, KeePassXC.exe, 00000016.00000002.3171285759.00007FF93C0CA000.00000002.00000001.01000000.00000014.sdmp
Source: Binary string: C:\Tools\vcpkg\buildtrees\qt5-base\x64-windows-rel\lib\Qt5Gui.pdb source: KeePassXC.exe, 00000013.00000002.4091209691.00007FF93CF19000.00000002.00000001.01000000.0000000C.sdmp, KeePassXC.exe, 00000016.00000002.3173443311.00007FF93CF19000.00000002.00000001.01000000.0000000C.sdmp, KeePassXC.exe, 00000018.00000002.3256335958.00007FF93CF19000.00000002.00000001.01000000.0000000C.sdmp
Source: Binary string: C:\Tools\vcpkg\buildtrees\zlib\x64-windows-rel\zlib.pdb source: KeePassXC.exe, 00000013.00000002.4098576060.00007FF95D9CF000.00000002.00000001.01000000.0000000D.sdmp, KeePassXC.exe, 00000016.00000002.3177344391.00007FF95D9CF000.00000002.00000001.01000000.0000000D.sdmp
Checks for available system drives (often done to infect USB drives)
Source: C:\Windows\System32\msiexec.exe File opened: z: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: x: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: v: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: t: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: r: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: p: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: n: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: l: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: j: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: h: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: f: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: b: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: y: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: w: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: u: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: s: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: q: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: o: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: m: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: k: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: i: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: g: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: e: Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe File opened: c: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: a: Jump to behavior
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: KeePassXC.exe, 00000013.00000002.4095535046.00007FF93DCEE000.00000002.00000001.01000000.00000007.sdmp, KeePassXC.exe, 00000016.00000002.3175629660.00007FF93DCEE000.00000002.00000001.01000000.00000007.sdmp String found in binary or memory: 04:7e:cb:e9:fc:a5:5f:7b:d0:9e:ae:36:e1:0c:ae:1email.google.comf5:c8:6a:f3:61:62:f1:3a:64:f5:4f:6d:c9:58:7c:06www.google.comd7:55:8f:da:f5:f1:10:5b:b2:13:28:2b:70:77:29:a3login.yahoo.com39:2a:43:4f:0e:07:df:1f:8a:a3:05:de:34:e0:c2:293e:75:ce:d4:6b:69:30:21:21:88:30:ae:86:a8:2a:71e9:02:8b:95:78:e4:15:dc:1a:71:0a:2b:88:15:44:47login.skype.com92:39:d5:34:8f:40:d1:69:5a:74:54:70:e1:f2:3f:43addons.mozilla.orgb0:b7:13:3e:d0:96:f9:b5:6f:ae:91:c8:74:bd:3a:c0login.live.comd8:f3:5f:4e:b7:87:2b:2d:ab:06:92:e3:15:38:2f:b0global trustee05:e2:e6:a4:cd:09:ea:54:d6:65:b0:75:fe:22:a2:56*.google.com0c:76:da:9c:91:0c:4e:2c:9e:fe:15:d0:58:93:3c:4cDigiNotar Root CAf1:4a:13:f4:87:2b:56:dc:39:df:84:ca:7a:a1:06:49DigiNotar Services CA36:16:71:55:43:42:1b:9d:e6:cb:a3:64:41:df:24:38DigiNotar Services 1024 CA0a:82:bd:1e:14:4e:88:14:d7:5b:1a:55:27:be:bf:3eDigiNotar Root CA G2a4:b6:ce:e3:2e:d3:35:46:26:3c:b3:55:3a:a8:92:21CertiID Enterprise Certificate Authority5b:d5:60:9c:64:17:68:cf:21:0e:35:fd:fb:05:ad:41DigiNotar Qualified CA46:9c:2c:b007:27:10:0dDigiNotar Cyber CA07:27:0f:f907:27:10:0301:31:69:b0DigiNotar PKIoverheid CA Overheid en Bedrijven01:31:34:bfDigiNotar PKIoverheid CA Organisatie - G2d6:d0:29:77:f1:49:fd:1a:83:f2:b9:ea:94:8c:5c:b4DigiNotar Extended Validation CA1e:7d:7a:53:3d:45:30:41:96:40:0f:71:48:1f:45:04DigiNotar Public CA 202546:9c:2c:af46:9c:3c:c907:27:14:a9Digisign Server ID (Enrich)4c:0e:63:6aDigisign Server ID - (Enrich)72:03:21:05:c5:0c:08:57:3d:8e:a5:30:4e:fe:e8:b0UTN-USERFirst-Hardware41MD5 Collisions Inc. (http://www.phreedom.org/md5)08:27*.EGO.GOV.TR08:64e-islem.kktcmerkezbankasi.org03:1d:a7AC DG Tr equals www.yahoo.com (Yahoo)
Source: global traffic DNS traffic detected: DNS query: assets.msn.com
Source: global traffic DNS traffic detected: DNS query: windows.msn.com
Source: global traffic DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic DNS traffic detected: DNS query: api.msn.com
Source: global traffic DNS traffic detected: DNS query: c.msn.com
Source: KeePassXC.exe, 00000013.00000002.4096019479.00007FF93F123000.00000002.00000001.01000000.0000001A.sdmp, KeePassXC.exe, 00000016.00000002.3176094001.00007FF93F123000.00000002.00000001.01000000.0000001A.sdmp String found in binary or memory: http://.css
Source: KeePassXC.exe, 00000013.00000002.4096019479.00007FF93F123000.00000002.00000001.01000000.0000001A.sdmp, KeePassXC.exe, 00000016.00000002.3176094001.00007FF93F123000.00000002.00000001.01000000.0000001A.sdmp String found in binary or memory: http://.jpg
Source: KeePassXC.exe, 00000013.00000002.4095535046.00007FF93DCEE000.00000002.00000001.01000000.00000007.sdmp, KeePassXC.exe, 00000016.00000002.3175629660.00007FF93DCEE000.00000002.00000001.01000000.00000007.sdmp String found in binary or memory: http://bugreports.qt.io/
Source: KeePassXC.exe, 00000013.00000002.4095535046.00007FF93DCEE000.00000002.00000001.01000000.00000007.sdmp, KeePassXC.exe, 00000016.00000002.3175629660.00007FF93DCEE000.00000002.00000001.01000000.00000007.sdmp String found in binary or memory: http://bugreports.qt.io/_q_receiveReplyensureClientPrefaceSentMicrosoft-IIS/4.Microsoft-IIS/5.Netsca
Source: KeePassXC.exe, 00000013.00000002.4083476237.000001DDB4EA2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://fontfabrik.com
Source: KeePassXC.exe, 00000013.00000002.4096019479.00007FF93F123000.00000002.00000001.01000000.0000001A.sdmp, KeePassXC.exe, 00000016.00000002.3176094001.00007FF93F123000.00000002.00000001.01000000.0000001A.sdmp String found in binary or memory: http://html4/loose.dtd
Source: KeePassXC.exe, 00000013.00000002.4091209691.00007FF93CF19000.00000002.00000001.01000000.0000000C.sdmp, KeePassXC.exe, 00000016.00000002.3173443311.00007FF93CF19000.00000002.00000001.01000000.0000000C.sdmp, KeePassXC.exe, 00000018.00000002.3256335958.00007FF93CF19000.00000002.00000001.01000000.0000000C.sdmp String found in binary or memory: http://www.aiim.org/pdfa/ns/id/
Source: KeePassXC.exe, 00000013.00000002.4091209691.00007FF93CF19000.00000002.00000001.01000000.0000000C.sdmp, KeePassXC.exe, 00000016.00000002.3173443311.00007FF93CF19000.00000002.00000001.01000000.0000000C.sdmp, KeePassXC.exe, 00000018.00000002.3256335958.00007FF93CF19000.00000002.00000001.01000000.0000000C.sdmp String found in binary or memory: http://www.color.org)
Source: KeePassXC.exe, 00000013.00000002.4095535046.00007FF93DCEE000.00000002.00000001.01000000.00000007.sdmp, KeePassXC.exe, 00000016.00000002.3175629660.00007FF93DCEE000.00000002.00000001.01000000.00000007.sdmp String found in binary or memory: http://www.phreedom.org/md5)
Source: KeePassXC.exe, 00000013.00000002.4095535046.00007FF93DCEE000.00000002.00000001.01000000.00000007.sdmp, KeePassXC.exe, 00000016.00000002.3175629660.00007FF93DCEE000.00000002.00000001.01000000.00000007.sdmp String found in binary or memory: http://www.phreedom.org/md5)08:27
Source: KeePassXC.exe, 00000016.00000002.3177092336.00007FF957E0A000.00000002.00000001.01000000.0000000E.sdmp String found in binary or memory: http://www.winimage.com/zLibDll
Source: KeePassXC.exe, 00000013.00000002.4097904725.00007FF957E0A000.00000002.00000001.01000000.0000000E.sdmp, KeePassXC.exe, 00000016.00000002.3177092336.00007FF957E0A000.00000002.00000001.01000000.0000000E.sdmp String found in binary or memory: http://www.winimage.com/zLibDll-
Source: KeePassXC.exe, 00000013.00000002.4097904725.00007FF957E0A000.00000002.00000001.01000000.0000000E.sdmp, KeePassXC.exe, 00000016.00000002.3177092336.00007FF957E0A000.00000002.00000001.01000000.0000000E.sdmp String found in binary or memory: http://www.winimage.com/zLibDll1.3.0
Source: KeePassXC.exe, 00000013.00000002.4098605466.00007FF95D9D7000.00000002.00000001.01000000.0000000D.sdmp, KeePassXC.exe, 00000016.00000002.3177366542.00007FF95D9D7000.00000002.00000001.01000000.0000000D.sdmp String found in binary or memory: http://www.zlib.net/D
Source: KeePassXC.exe, 00000013.00000002.4085937700.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp, KeePassXC.exe, 00000013.00000000.3118368978.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp, KeePassXC.exe, 00000013.00000002.4082400095.000001DDB46C0000.00000004.00000020.00020000.00000000.sdmp, KeePassXC.exe, 00000013.00000002.4082675025.000001DDB4893000.00000004.00000020.00020000.00000000.sdmp, KeePassXC.exe, 00000016.00000002.3169651614.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp, KeePassXC.exe, 00000016.00000000.3165382566.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://addons.mozilla.org/firefox/addon/keepassxc-browser/
Source: KeePassXC.exe, 00000013.00000002.4085937700.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp, KeePassXC.exe, 00000013.00000002.4086915398.00007FF93BA86000.00000002.00000001.01000000.0000001F.sdmp, KeePassXC.exe, 00000013.00000000.3118368978.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp, KeePassXC.exe, 00000016.00000002.3169651614.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp, KeePassXC.exe, 00000016.00000000.3165382566.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://api.github.com/repos/keepassxreboot/keepassxc/releases
Source: KeePassXC.exe, 00000013.00000002.4085937700.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp, KeePassXC.exe, 00000013.00000002.4086915398.00007FF93BA86000.00000002.00000001.01000000.0000001F.sdmp, KeePassXC.exe, 00000013.00000000.3118368978.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp, KeePassXC.exe, 00000016.00000002.3169651614.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp, KeePassXC.exe, 00000016.00000000.3165382566.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://api.github.com/repos/keepassxreboot/keepassxc/releases/latestAccepttag_name
Source: KeePassXC.exe, 00000013.00000002.4085937700.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp, KeePassXC.exe, 00000013.00000002.4086915398.00007FF93BA86000.00000002.00000001.01000000.0000001F.sdmp, KeePassXC.exe, 00000013.00000000.3118368978.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp, KeePassXC.exe, 00000016.00000002.3169651614.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp, KeePassXC.exe, 00000016.00000000.3165382566.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://api.pwnedpasswords.com/range/
Source: KeePassXC.exe, 00000013.00000002.4086915398.00007FF93BA86000.00000002.00000001.01000000.0000001F.sdmp String found in binary or memory: https://api.pwnedpasswords.com/range/KeePassXCUser-Agent:
Source: KeePassXC.exe, 00000013.00000002.4085937700.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp, KeePassXC.exe, 00000013.00000000.3118368978.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp, KeePassXC.exe, 00000016.00000002.3169651614.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp, KeePassXC.exe, 00000016.00000000.3165382566.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://api.pwnedpasswords.com/range/User-Agent:
Source: KeePassXC.exe, 00000013.00000002.4085937700.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp, KeePassXC.exe, 00000013.00000000.3118368978.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp, KeePassXC.exe, 00000013.00000002.4082400095.000001DDB46C0000.00000004.00000020.00020000.00000000.sdmp, KeePassXC.exe, 00000013.00000002.4082675025.000001DDB4893000.00000004.00000020.00020000.00000000.sdmp, KeePassXC.exe, 00000016.00000002.3169651614.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp, KeePassXC.exe, 00000016.00000000.3165382566.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://chromewebstore.google.com/detail/keepassxc-browser/oboonakemofpalcgghocfoadofidjkkk
Source: KeePassXC.exe, 00000016.00000000.3165382566.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://github.com
Source: KeePassXC.exe, 00000013.00000003.3122082159.000001DDB19F1000.00000004.00000020.00020000.00000000.sdmp, KeePassXC.exe, 00000013.00000002.4085937700.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp, KeePassXC.exe, 00000013.00000002.4086915398.00007FF93BA86000.00000002.00000001.01000000.0000001F.sdmp, KeePassXC.exe, 00000013.00000002.4081482497.000001DDB19D4000.00000004.00000020.00020000.00000000.sdmp, KeePassXC.exe, 00000013.00000000.3118368978.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp, KeePassXC.exe, 00000013.00000002.4082400095.000001DDB4670000.00000004.00000020.00020000.00000000.sdmp, KeePassXC.exe, 00000016.00000003.3168656346.000001927844D000.00000004.00000020.00020000.00000000.sdmp, KeePassXC.exe, 00000016.00000002.3169651614.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp, KeePassXC.exe, 00000016.00000000.3165382566.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp, KeePassXC.exe, 00000016.00000002.3169068793.000001927844E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/TheZ3ro
Source: KeePassXC.exe, 00000013.00000003.3122082159.000001DDB19F1000.00000004.00000020.00020000.00000000.sdmp, KeePassXC.exe, 00000013.00000002.4085937700.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp, KeePassXC.exe, 00000013.00000002.4086915398.00007FF93BA86000.00000002.00000001.01000000.0000001F.sdmp, KeePassXC.exe, 00000013.00000002.4081482497.000001DDB19D4000.00000004.00000020.00020000.00000000.sdmp, KeePassXC.exe, 00000013.00000000.3118368978.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp, KeePassXC.exe, 00000013.00000002.4082400095.000001DDB4670000.00000004.00000020.00020000.00000000.sdmp, KeePassXC.exe, 00000016.00000003.3168656346.000001927844D000.00000004.00000020.00020000.00000000.sdmp, KeePassXC.exe, 00000016.00000002.3169651614.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp, KeePassXC.exe, 00000016.00000000.3165382566.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp, KeePassXC.exe, 00000016.00000002.3169068793.000001927844E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/droidmonkey
Source: KeePassXC.exe, 00000013.00000003.3122082159.000001DDB19F1000.00000004.00000020.00020000.00000000.sdmp, KeePassXC.exe, 00000013.00000002.4085937700.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp, KeePassXC.exe, 00000013.00000002.4086915398.00007FF93BA86000.00000002.00000001.01000000.0000001F.sdmp, KeePassXC.exe, 00000013.00000002.4081482497.000001DDB19D4000.00000004.00000020.00020000.00000000.sdmp, KeePassXC.exe, 00000013.00000000.3118368978.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp, KeePassXC.exe, 00000013.00000002.4082400095.000001DDB4670000.00000004.00000020.00020000.00000000.sdmp, KeePassXC.exe, 00000016.00000003.3168656346.000001927844D000.00000004.00000020.00020000.00000000.sdmp, KeePassXC.exe, 00000016.00000002.3169651614.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp, KeePassXC.exe, 00000016.00000000.3165382566.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp, KeePassXC.exe, 00000016.00000002.3169068793.000001927844E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/hifi
Source: KeePassXC.exe, 00000016.00000000.3165382566.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://github.com/keepassxreboot/keepassxc/graphs/contributors
Source: KeePassXC.exe, 00000016.00000000.3165382566.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://github.com/keepassxreboot/keepassxc/issues
Source: KeePassXC.exe, 00000013.00000003.3122082159.000001DDB19F1000.00000004.00000020.00020000.00000000.sdmp, KeePassXC.exe, 00000013.00000002.4085937700.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp, KeePassXC.exe, 00000013.00000002.4086915398.00007FF93BA86000.00000002.00000001.01000000.0000001F.sdmp, KeePassXC.exe, 00000013.00000002.4081482497.000001DDB19D4000.00000004.00000020.00020000.00000000.sdmp, KeePassXC.exe, 00000013.00000000.3118368978.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp, KeePassXC.exe, 00000013.00000002.4082400095.000001DDB4670000.00000004.00000020.00020000.00000000.sdmp, KeePassXC.exe, 00000016.00000003.3168656346.000001927844D000.00000004.00000020.00020000.00000000.sdmp, KeePassXC.exe, 00000016.00000002.3169651614.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp, KeePassXC.exe, 00000016.00000000.3165382566.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp, KeePassXC.exe, 00000016.00000002.3169068793.000001927844E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/louib
Source: KeePassXC.exe, 00000013.00000003.3122082159.000001DDB19F1000.00000004.00000020.00020000.00000000.sdmp, KeePassXC.exe, 00000013.00000002.4085937700.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp, KeePassXC.exe, 00000013.00000002.4086915398.00007FF93BA86000.00000002.00000001.01000000.0000001F.sdmp, KeePassXC.exe, 00000013.00000002.4081482497.000001DDB19D4000.00000004.00000020.00020000.00000000.sdmp, KeePassXC.exe, 00000013.00000000.3118368978.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp, KeePassXC.exe, 00000013.00000002.4082400095.000001DDB4670000.00000004.00000020.00020000.00000000.sdmp, KeePassXC.exe, 00000016.00000003.3168656346.000001927844D000.00000004.00000020.00020000.00000000.sdmp, KeePassXC.exe, 00000016.00000002.3169651614.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp, KeePassXC.exe, 00000016.00000000.3165382566.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp, KeePassXC.exe, 00000016.00000002.3169068793.000001927844E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/phoerious
Source: KeePassXC.exe, 00000013.00000003.3122082159.000001DDB19F1000.00000004.00000020.00020000.00000000.sdmp, KeePassXC.exe, 00000013.00000002.4085937700.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp, KeePassXC.exe, 00000013.00000002.4086915398.00007FF93BA86000.00000002.00000001.01000000.0000001F.sdmp, KeePassXC.exe, 00000013.00000002.4081482497.000001DDB19D4000.00000004.00000020.00020000.00000000.sdmp, KeePassXC.exe, 00000013.00000000.3118368978.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp, KeePassXC.exe, 00000013.00000002.4082400095.000001DDB4670000.00000004.00000020.00020000.00000000.sdmp, KeePassXC.exe, 00000016.00000003.3168656346.000001927844D000.00000004.00000020.00020000.00000000.sdmp, KeePassXC.exe, 00000016.00000002.3169651614.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp, KeePassXC.exe, 00000016.00000000.3165382566.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp, KeePassXC.exe, 00000016.00000002.3169068793.000001927844E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/varjolintu
Source: KeePassXC.exe, 00000016.00000000.3165382566.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://haveibeenpwned.com).
Source: KeePassXC.exe, 00000013.00000002.4081482497.000001DDB1A27000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://haveibeenpwned.com/Passwords.
Source: KeePassXC.exe, 00000013.00000002.4085937700.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp, KeePassXC.exe, 00000013.00000002.4086915398.00007FF93BA86000.00000002.00000001.01000000.0000001F.sdmp, KeePassXC.exe, 00000013.00000000.3118368978.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp, KeePassXC.exe, 00000016.00000002.3169651614.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp, KeePassXC.exe, 00000016.00000000.3165382566.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://icons.duckduckgo.com
Source: KeePassXC.exe, 00000013.00000002.4085937700.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp, KeePassXC.exe, 00000013.00000000.3118368978.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp, KeePassXC.exe, 00000016.00000002.3169651614.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp, KeePassXC.exe, 00000016.00000000.3165382566.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://icons.duckduckgo.com.ico/ip3/./favicon.ico/favicon.ico
Source: KeePassXC.exe, 00000013.00000002.4086915398.00007FF93BA86000.00000002.00000001.01000000.0000001F.sdmp String found in binary or memory: https://icons.duckduckgo.com.ico/ip3/./favicon.ico/favicon.ico0r
Source: KeePassXC.exe, 00000016.00000000.3165382566.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://keepassxc.org
Source: KeePassXC.exe, 00000016.00000000.3165382566.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://keepassxc.org/
Source: KeePassXC.exe, 00000013.00000002.4085937700.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp, KeePassXC.exe, 00000013.00000002.4086915398.00007FF93BA86000.00000002.00000001.01000000.0000001F.sdmp, KeePassXC.exe, 00000013.00000000.3118368978.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp, KeePassXC.exe, 00000016.00000002.3169651614.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp, KeePassXC.exe, 00000016.00000000.3165382566.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://keepassxc.org/docs/
Source: KeePassXC.exe, 00000016.00000000.3165382566.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://keepassxc.org/docs/#faq-yubikey-howto
Source: KeePassXC.exe, 00000013.00000002.4085937700.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp, KeePassXC.exe, 00000013.00000002.4086915398.00007FF93BA86000.00000002.00000001.01000000.0000001F.sdmp, KeePassXC.exe, 00000013.00000000.3118368978.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp, KeePassXC.exe, 00000016.00000002.3169651614.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp, KeePassXC.exe, 00000016.00000000.3165382566.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://keepassxc.org/docs/KeePassXC_UserGuide.html#_configure_auto_type_sequences
Source: KeePassXC.exe, 00000013.00000002.4085937700.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp, KeePassXC.exe, 00000013.00000002.4086915398.00007FF93BA86000.00000002.00000001.01000000.0000001F.sdmp, KeePassXC.exe, 00000013.00000000.3118368978.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp, KeePassXC.exe, 00000016.00000002.3169651614.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp, KeePassXC.exe, 00000016.00000000.3165382566.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://keepassxc.org/docs/KeePassXC_UserGuide.html#_configure_auto_type_sequences1updateAutoTypeEna
Source: KeePassXC.exe, 00000013.00000002.4085937700.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp, KeePassXC.exe, 00000013.00000002.4086915398.00007FF93BA86000.00000002.00000001.01000000.0000001F.sdmp, KeePassXC.exe, 00000013.00000000.3118368978.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp, KeePassXC.exe, 00000016.00000002.3169651614.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp, KeePassXC.exe, 00000016.00000000.3165382566.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://keepassxc.org/donate
Source: KeePassXC.exe, 00000013.00000002.4085937700.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp, KeePassXC.exe, 00000013.00000002.4086915398.00007FF93BA86000.00000002.00000001.01000000.0000001F.sdmp, KeePassXC.exe, 00000013.00000000.3118368978.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp, KeePassXC.exe, 00000016.00000002.3169651614.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp, KeePassXC.exe, 00000016.00000000.3165382566.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://keepassxc.org/donatehttps://github.com/keepassxreboot/keepassxc/issuesfile:///%1docs/KeePass
Source: KeePassXC.exe, 00000016.00000000.3165382566.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://keepassxc.org/download/
Source: KeePassXC.exe, 00000016.00000000.3165382566.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://onlykey.io
Source: KeePassXC.exe, 00000013.00000002.4089396385.00007FF93C519000.00000002.00000001.01000000.00000013.sdmp, KeePassXC.exe, 00000013.00000002.4089639795.00007FF93C5D4000.00000002.00000001.01000000.00000010.sdmp, KeePassXC.exe, 00000016.00000002.3171996231.00007FF93C5D4000.00000002.00000001.01000000.00000010.sdmp, KeePassXC.exe, 00000016.00000002.3171797523.00007FF93C519000.00000002.00000001.01000000.00000013.sdmp String found in binary or memory: https://www.openssl.org/H
Source: KeePassXC.exe, 00000016.00000000.3165382566.00007FF6ACA86000.00000002.00000001.01000000.00000004.sdmp String found in binary or memory: https://www.yubico.com/
Creates files inside the system directory
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\607c22.msi Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSI8430.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSI8625.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\inprogressinstallinfo.ipi Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\SourceHash{E86A6926-F1BD-42B8-BE36-12E8A3A052AC} Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSI881A.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\{E86A6926-F1BD-42B8-BE36-12E8A3A052AC} Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\{E86A6926-F1BD-42B8-BE36-12E8A3A052AC}\ProductIcon.ico Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\607c24.msi Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\607c24.msi Jump to behavior
Deletes files inside the Windows folder
Source: C:\Windows\System32\msiexec.exe File deleted: C:\Windows\Installer\MSI8430.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File deleted: C:\Windows\Installer\607c24.msi Jump to behavior
Source: C:\Windows\System32\msiexec.exe File deleted: C:\Windows\Installer\MSI881A.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File deleted: C:\Windows\Installer\607c22.msi Jump to behavior
Source: C:\Windows\System32\msiexec.exe File deleted: C:\Windows\Installer\inprogressinstallinfo.ipi Jump to behavior
Source: Qt5Core.dll.2.dr Static PE information: Section: .qtmimed ZLIB complexity 0.997458770800317
Source: classification engine Classification label: clean4.winMSI@16/160@6/0
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\KeePassXC Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe File created: C:\Users\user\AppData\Roaming\KeePassXC Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8064:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8136:120:WilError_03
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Temp\MSI6E86.tmp Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = &quot;KeePassXC.exe&quot;)
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = &quot;keepassxc-proxy.exe&quot;)
Source: C:\Windows\System32\msiexec.exe File read: C:\Windows\win.ini Jump to behavior
Source: C:\Windows\System32\msiexec.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA Jump to behavior
Source: KeePassXC-2.7.10-Win64.msi Static file information: TRID: Microsoft Windows Installer (60509/1) 57.88%
Source: unknown Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\KeePassXC-2.7.10-Win64.msi"
Source: unknown Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 3C7DB1E64F61A48906110C16B119F45C C
Source: C:\Windows\System32\msiexec.exe Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding ADA735D44122B6D1906D2FBADB36DA04
Source: C:\Windows\SysWOW64\msiexec.exe Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\SysWOW64\taskkill.exe" /IM KeePassXC.exe
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\msiexec.exe Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\SysWOW64\taskkill.exe" /IM keepassxc-proxy.exe /F
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\msiexec.exe Process created: C:\Program Files\KeePassXC\KeePassXC.exe "C:\Program Files\KeePassXC\KeePassXC.exe"
Source: unknown Process created: C:\Program Files\KeePassXC\KeePassXC.exe "C:\Program Files\KeePassXC\KeePassXC.exe"
Source: unknown Process created: C:\Program Files\KeePassXC\KeePassXC.exe "C:\Program Files\KeePassXC\KeePassXC.exe"
Source: C:\Windows\System32\msiexec.exe Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 3C7DB1E64F61A48906110C16B119F45C C Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding ADA735D44122B6D1906D2FBADB36DA04 Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process created: C:\Program Files\KeePassXC\KeePassXC.exe "C:\Program Files\KeePassXC\KeePassXC.exe" Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\SysWOW64\taskkill.exe" /IM KeePassXC.exe Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\SysWOW64\taskkill.exe" /IM keepassxc-proxy.exe /F Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: aclayers.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: srpapi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: tsappcmp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: cryptnet.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: appidapi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: msihnd.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: pcacli.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: oleacc.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: riched20.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: usp10.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: msls31.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: aclayers.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: tsappcmp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: srclient.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: spp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: vssapi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: vsstrace.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: cryptnet.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: appidapi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: srpapi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: vcruntime140_1_clr0400.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: pcacli.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: servicingcommon.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: cabinet.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: cfgmgr32.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: linkinfo.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: ntshrui.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: cscapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: aclayers.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: cfgmgr32.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: virtdisk.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: smartscreenps.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: shdocvw.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: aclayers.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: qt5svg.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: qrencode.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: qt5concurrent.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: winscard.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: argon2.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: hid.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: qt5network.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: qt5widgets.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: qt5gui.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: qt5core.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: botan-3.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: zlib1.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: minizip.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: msvcp140.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: vcruntime140_1.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: qt5widgets.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: qt5gui.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: qt5core.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: zlib1.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: qt5core.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: zlib1.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: libssl-3-x64.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: libcrypto-3-x64.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: qt5core.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: vcruntime140_1.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: msvcp140.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: vcruntime140_1.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: msvcp140.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: vcruntime140_1.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: version.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: zlib1.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: double-conversion.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: pcre2-16.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: zstd.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: msvcp140.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: msvcp140_1.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: vcruntime140_1.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: d3d11.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: dxgi.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: libpng16.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: zlib1.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: harfbuzz.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: msvcp140.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: vcruntime140_1.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: msvcp140_1.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: libcrypto-3-x64.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: dxgi.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: freetype.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: bz2.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: brotlidec.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: brotlicommon.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: d3d9.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: dxcore.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: d3d10warp.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: directxdatabasehelper.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: resourcepolicyclient.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: dataexchange.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: twinapi.appcore.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: thumbcache.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: qt5svg.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: qrencode.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: qt5concurrent.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: winscard.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: argon2.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: hid.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: qt5network.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: qt5widgets.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: qt5gui.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: qt5core.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: botan-3.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: zlib1.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: minizip.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: msvcp140.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: vcruntime140_1.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: qt5widgets.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: qt5gui.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: qt5core.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: zlib1.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: qt5core.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: vcruntime140_1.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: qt5gui.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: qt5core.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: msvcp140.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: msvcp140_1.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: vcruntime140_1.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: qt5core.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: zlib1.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: libssl-3-x64.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: libcrypto-3-x64.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: d3d11.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: dxgi.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: qt5core.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: libpng16.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: zlib1.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: harfbuzz.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: msvcp140.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: vcruntime140_1.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: msvcp140.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: vcruntime140_1.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: version.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: zlib1.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: double-conversion.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: pcre2-16.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: zstd.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: msvcp140.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: msvcp140_1.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: vcruntime140_1.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: msvcp140.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: vcruntime140_1.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: vcruntime140_1.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: libcrypto-3-x64.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: dxgi.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: freetype.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: bz2.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: brotlidec.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: brotlicommon.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: qt5svg.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: qrencode.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: qt5concurrent.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: winscard.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: argon2.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: hid.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: qt5network.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: qt5widgets.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: qt5gui.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: qt5core.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: botan-3.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: zlib1.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: minizip.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: msvcp140.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: vcruntime140_1.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: qt5core.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: vcruntime140_1.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: qt5gui.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: qt5core.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: qt5core.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: zlib1.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: libssl-3-x64.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: libcrypto-3-x64.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: msvcp140.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: msvcp140_1.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: vcruntime140_1.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: d3d11.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: dxgi.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: qt5core.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: libpng16.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: zlib1.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: harfbuzz.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: msvcp140.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: vcruntime140_1.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: msvcp140.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: vcruntime140_1.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: msvcp140.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: vcruntime140_1.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: version.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: zlib1.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: double-conversion.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: pcre2-16.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: zstd.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: msvcp140.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: msvcp140_1.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: vcruntime140_1.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: vcruntime140_1.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: libcrypto-3-x64.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: dxgi.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: freetype.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: bz2.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: brotlidec.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: brotlicommon.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9FC8E510-A27C-4B3B-B9A3-BF65F00256A8}\InProcServer32 Jump to behavior
Source: KeePassXC.lnk.2.dr LNK file: ..\..\..\..\..\..\Program Files\KeePassXC\KeePassXC.exe
Source: KeePassXC - Getting Started.lnk.2.dr LNK file: ..\..\..\..\..\..\Program Files\KeePassXC\share\docs\KeePassXC_GettingStarted.html
Source: KeePassXC - User Guide.lnk.2.dr LNK file: ..\..\..\..\..\..\Program Files\KeePassXC\share\docs\KeePassXC_UserGuide.html
Source: C:\Windows\System32\msiexec.exe Automated click: Next
Source: C:\Windows\System32\msiexec.exe Automated click: I accept the terms in the License Agreement
Source: C:\Windows\System32\msiexec.exe Automated click: Next
Source: C:\Windows\System32\msiexec.exe Automated click: Next
Source: C:\Windows\System32\msiexec.exe Automated click: Install
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\argon2.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\botan-3.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\brotlicommon.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\brotlidec.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\bz2.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\double-conversion.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\freetype.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\harfbuzz.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\jpeg62.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\KeePassXC.exe Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\keepassxc-autotype-windows.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\keepassxc-cli.exe Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\keepassxc-proxy.exe Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\libcrypto-3-x64.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\liblzma.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\libpng16.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\libsharpyuv.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\libssl-3-x64.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\libwebp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\libwebpdemux.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\libwebpmux.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\minizip.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\pcre2-16.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\plugins Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\plugins\bearer Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\plugins\bearer\qgenericbearer.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\plugins\iconengines Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\plugins\iconengines\qsvgicon.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\plugins\imageformats Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\plugins\imageformats\qgif.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\plugins\imageformats\qicns.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\plugins\imageformats\qico.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\plugins\imageformats\qjpeg.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\plugins\imageformats\qsvg.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\plugins\imageformats\qtga.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\plugins\imageformats\qtiff.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\plugins\imageformats\qwbmp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\plugins\imageformats\qwebp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\plugins\platforms Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\plugins\platforms\qwindows.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\plugins\styles Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\plugins\styles\qwindowsvistastyle.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\qrencode.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\qt.conf Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\Qt5Concurrent.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\Qt5Core.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\Qt5Gui.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\Qt5Network.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\Qt5Svg.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\Qt5Widgets.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\readline.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\docs Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\docs\KeePassXC_GettingStarted.html Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\docs\KeePassXC_KeyboardShortcuts.html Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\docs\KeePassXC_UserGuide.html Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\icons Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\icons\application Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\icons\application\256x256 Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\icons\application\256x256\apps Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\icons\application\256x256\apps\keepassxc.png Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_ar.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_bg.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_ca.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_cs.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_da.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_de.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_el.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_en.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_en_GB.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_en_US.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_es.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_et.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_fi.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_fil.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_fr.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_fr_CA.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_he.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_hr.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_hu.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_id.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_it.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_ja.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_km.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_ko.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_lt.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_my.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_nb.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_nl.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_pl.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_pt_BR.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_pt_PT.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_ro.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_ru.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_si.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_sk.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_sl.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_sq.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_sr.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_sv.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_th.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_tr.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_uk.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_zh_CN.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\keepassxc_zh_TW.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\qtbase_ar.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\qtbase_bg.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\qtbase_ca.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\qtbase_cs.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\qtbase_da.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\qtbase_de.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\qtbase_en.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\qtbase_es.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\qtbase_fa.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\qtbase_fi.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\qtbase_fr.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\qtbase_gd.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\qtbase_he.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\qtbase_hr.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\qtbase_hu.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\qtbase_it.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\qtbase_ja.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\qtbase_ko.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\qtbase_lv.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\qtbase_nl.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\qtbase_nn.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\qtbase_pl.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\qtbase_pt_BR.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\qtbase_ru.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\qtbase_sk.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\qtbase_tr.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\qtbase_uk.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\qtbase_zh_CN.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\translations\qtbase_zh_TW.qm Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\wordlists Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\share\wordlists\eff_large.wordlist Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\ssl Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\ssl\certs Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\ssl\certs\ca-bundle.crt Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\tiff.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\zlib1.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Directory created: C:\Program Files\KeePassXC\zstd.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E86A6926-F1BD-42B8-BE36-12E8A3A052AC} Jump to behavior
Source: KeePassXC-2.7.10-Win64.msi Static file information: File size 34897920 > 1048576
Source: Binary string: C:\Tools\vcpkg\buildtrees\zlib\x64-windows-rel\zlib.pdb## source: KeePassXC.exe, 00000013.00000002.4098576060.00007FF95D9CF000.00000002.00000001.01000000.0000000D.sdmp, KeePassXC.exe, 00000016.00000002.3177344391.00007FF95D9CF000.00000002.00000001.01000000.0000000D.sdmp
Source: Binary string: C:\Tools\vcpkg\buildtrees\double-conversion\x64-windows-rel\double-conversion.pdb source: KeePassXC.exe, 00000013.00000002.4097420375.00007FF957ABD000.00000002.00000001.01000000.00000011.sdmp, KeePassXC.exe, 00000016.00000002.3176869456.00007FF957ABD000.00000002.00000001.01000000.00000011.sdmp
Source: Binary string: C:\Tools\vcpkg\buildtrees\freetype\x64-windows-rel\freetype.pdb source: KeePassXC.exe, 00000013.00000002.4088123746.00007FF93BEFA000.00000002.00000001.01000000.00000017.sdmp, KeePassXC.exe, 00000016.00000002.3170869722.00007FF93BEFA000.00000002.00000001.01000000.00000017.sdmp
Source: Binary string: C:\Tools\vcpkg\buildtrees\qt5-base\x64-windows-rel\plugins\styles\qwindowsvistastyle.pdb''! source: KeePassXC.exe, 00000013.00000002.4087602282.00007FF93BD8B000.00000002.00000001.01000000.0000001C.sdmp, KeePassXC.exe, 00000016.00000002.3170310906.00007FF93BD8B000.00000002.00000001.01000000.0000001C.sdmp
Source: Binary string: C:\Tools\vcpkg\buildtrees\double-conversion\x64-windows-rel\double-conversion.pdb## source: KeePassXC.exe, 00000013.00000002.4097420375.00007FF957ABD000.00000002.00000001.01000000.00000011.sdmp, KeePassXC.exe, 00000016.00000002.3176869456.00007FF957ABD000.00000002.00000001.01000000.00000011.sdmp
Source: Binary string: C:\Tools\vcpkg\buildtrees\brotli\x64-windows-rel\brotlidec.pdb source: KeePassXC.exe, 00000013.00000002.4096319904.00007FF950BDA000.00000002.00000001.01000000.00000019.sdmp, KeePassXC.exe, 00000016.00000002.3176445737.00007FF950BDA000.00000002.00000001.01000000.00000019.sdmp
Source: Binary string: C:\Tools\vcpkg\buildtrees\qt5-svg\x64-windows-rel\plugins\iconengines\qsvgicon.pdb source: KeePassXC.exe, 00000013.00000002.4096644792.00007FF957A65000.00000002.00000001.01000000.0000001E.sdmp
Source: Binary string: C:\Tools\vcpkg\buildtrees\openssl\x64-windows-rel\libssl-3-x64.pdbDD source: KeePassXC.exe, 00000013.00000002.4089548597.00007FF93C5AC000.00000002.00000001.01000000.00000010.sdmp, KeePassXC.exe, 00000016.00000002.3171911099.00007FF93C5AC000.00000002.00000001.01000000.00000010.sdmp
Source: Binary string: C:\Tools\vcpkg\buildtrees\argon2\x64-windows-rel\argon2.pdb source: KeePassXC.exe, 00000013.00000002.4098807577.00007FF95DD57000.00000002.00000001.01000000.00000009.sdmp, KeePassXC.exe, 00000016.00000002.3177427548.00007FF95DD57000.00000002.00000001.01000000.00000009.sdmp
Source: Binary string: C:\Tools\vcpkg\buildtrees\libpng\x64-windows-rel\libpng16.pdb source: KeePassXC.exe, 00000013.00000002.4096783705.00007FF957A95000.00000002.00000001.01000000.00000015.sdmp, KeePassXC.exe, 00000016.00000002.3176748418.00007FF957A95000.00000002.00000001.01000000.00000015.sdmp
Source: Binary string: C:\Tools\vcpkg\buildtrees\brotli\x64-windows-rel\brotlicommon.pdb source: KeePassXC.exe, 00000013.00000002.4096019479.00007FF93F123000.00000002.00000001.01000000.0000001A.sdmp, KeePassXC.exe, 00000016.00000002.3176094001.00007FF93F123000.00000002.00000001.01000000.0000001A.sdmp
Source: Binary string: C:\Tools\vcpkg\buildtrees\qt5-base\x64-windows-rel\lib\Qt5Concurrent.pdb!! source: KeePassXC.exe, 00000013.00000002.4099027666.00007FF9610C4000.00000002.00000001.01000000.00000008.sdmp, KeePassXC.exe, 00000016.00000002.3177508058.00007FF9610C4000.00000002.00000001.01000000.00000008.sdmp
Source: Binary string: r.PDB source: KeePassXC.exe, 00000013.00000002.4091832948.00007FF93D19A000.00000002.00000001.01000000.0000000C.sdmp, KeePassXC.exe, 00000016.00000002.3173924410.00007FF93D19A000.00000002.00000001.01000000.0000000C.sdmp
Source: Binary string: C:\Tools\vcpkg\buildtrees\qt5-base\x64-windows-rel\lib\Qt5Core.pdb source: KeePassXC.exe, 00000013.00000002.4092224554.00007FF93D46B000.00000002.00000001.01000000.0000000B.sdmp, KeePassXC.exe, 00000016.00000002.3174571972.00007FF93D46B000.00000002.00000001.01000000.0000000B.sdmp
Source: Binary string: C:\Tools\vcpkg\buildtrees\qt5-svg\x64-windows-rel\lib\Qt5Svg.pdb source: KeePassXC.exe, 00000013.00000002.4095832762.00007FF93DD9F000.00000002.00000001.01000000.00000005.sdmp, KeePassXC.exe, 00000016.00000002.3175928902.00007FF93DD9F000.00000002.00000001.01000000.00000005.sdmp
Source: Binary string: C:\Tools\vcpkg\buildtrees\openssl\x64-windows-rel\libcrypto-3-x64.pdb source: KeePassXC.exe, 00000013.00000002.4089209402.00007FF93C41E000.00000002.00000001.01000000.00000013.sdmp, KeePassXC.exe, 00000016.00000002.3171650373.00007FF93C41E000.00000002.00000001.01000000.00000013.sdmp
Source: Binary string: C:\Tools\vcpkg\buildtrees\libpng\x64-windows-rel\libpng16.pdb$$ source: KeePassXC.exe, 00000013.00000002.4096783705.00007FF957A95000.00000002.00000001.01000000.00000015.sdmp, KeePassXC.exe, 00000016.00000002.3176748418.00007FF957A95000.00000002.00000001.01000000.00000015.sdmp
Source: Binary string: C:\Tools\vcpkg\buildtrees\openssl\x64-windows-rel\libssl-3-x64.pdb source: KeePassXC.exe, 00000013.00000002.4089548597.00007FF93C5AC000.00000002.00000001.01000000.00000010.sdmp, KeePassXC.exe, 00000016.00000002.3171911099.00007FF93C5AC000.00000002.00000001.01000000.00000010.sdmp
Source: Binary string: C:\Tools\vcpkg\buildtrees\qt5-base\x64-windows-rel\lib\Qt5Concurrent.pdb source: KeePassXC.exe, 00000013.00000002.4099027666.00007FF9610C4000.00000002.00000001.01000000.00000008.sdmp, KeePassXC.exe, 00000016.00000002.3177508058.00007FF9610C4000.00000002.00000001.01000000.00000008.sdmp
Source: Binary string: C:\Tools\vcpkg\buildtrees\botan\x64-windows-rel\botan-3.pdb source: KeePassXC.exe, 00000013.00000002.4095222872.00007FF93DA60000.00000002.00000001.01000000.0000000A.sdmp, KeePassXC.exe, 00000016.00000002.3175318715.00007FF93DA60000.00000002.00000001.01000000.0000000A.sdmp
Source: Binary string: C:\Tools\vcpkg\buildtrees\qt5-base\x64-windows-rel\lib\Qt5Network.pdb source: KeePassXC.exe, 00000013.00000002.4095535046.00007FF93DCEE000.00000002.00000001.01000000.00000007.sdmp, KeePassXC.exe, 00000016.00000002.3175629660.00007FF93DCEE000.00000002.00000001.01000000.00000007.sdmp
Source: Binary string: C:\Tools\vcpkg\buildtrees\qt5-svg\x64-windows-rel\lib\Qt5Svg.pdb++ source: KeePassXC.exe, 00000013.00000002.4095832762.00007FF93DD9F000.00000002.00000001.01000000.00000005.sdmp, KeePassXC.exe, 00000016.00000002.3175928902.00007FF93DD9F000.00000002.00000001.01000000.00000005.sdmp
Source: Binary string: C:\Tools\vcpkg\buildtrees\pcre2\x64-windows-rel\pcre2-16.pdb source: KeePassXC.exe, 00000013.00000002.4096160060.00007FF944043000.00000002.00000001.01000000.00000012.sdmp, KeePassXC.exe, 00000016.00000002.3176282328.00007FF944043000.00000002.00000001.01000000.00000012.sdmp
Source: Binary string: C:\Tools\vcpkg\buildtrees\harfbuzz\x64-windows-rel\src\harfbuzz.pdb source: KeePassXC.exe, 00000013.00000002.4088325018.00007FF93BFF2000.00000002.00000001.01000000.00000016.sdmp, KeePassXC.exe, 00000016.00000002.3171096150.00007FF93BFF2000.00000002.00000001.01000000.00000016.sdmp
Source: Binary string: C:\Tools\vcpkg\buildtrees\qt5-base\x64-windows-rel\lib\Qt5Gui.pdb< source: KeePassXC.exe, 00000013.00000002.4091209691.00007FF93CF19000.00000002.00000001.01000000.0000000C.sdmp, KeePassXC.exe, 00000016.00000002.3173443311.00007FF93CF19000.00000002.00000001.01000000.0000000C.sdmp, KeePassXC.exe, 00000018.00000002.3256335958.00007FF93CF19000.00000002.00000001.01000000.0000000C.sdmp
Source: Binary string: C:\Tools\vcpkg\buildtrees\qt5-base\x64-windows-rel\lib\Qt5Core.pdb( source: KeePassXC.exe, 00000013.00000002.4092224554.00007FF93D46B000.00000002.00000001.01000000.0000000B.sdmp, KeePassXC.exe, 00000016.00000002.3174571972.00007FF93D46B000.00000002.00000001.01000000.0000000B.sdmp
Source: Binary string: C:\Tools\vcpkg\buildtrees\qt5-base\x64-windows-rel\lib\Qt5Widgets.pdb source: KeePassXC.exe, 00000013.00000002.4090045675.00007FF93C93E000.00000002.00000001.01000000.0000000F.sdmp, KeePassXC.exe, 00000016.00000002.3172356309.00007FF93C93E000.00000002.00000001.01000000.0000000F.sdmp
Source: Binary string: C:\Tools\vcpkg\buildtrees\libqrencode\x64-windows-rel\qrencode.pdb source: KeePassXC.exe, 00000013.00000002.4098279468.00007FF9586B9000.00000002.00000001.01000000.00000006.sdmp, KeePassXC.exe, 00000016.00000002.3177224774.00007FF9586B9000.00000002.00000001.01000000.00000006.sdmp
Source: Binary string: C:\Tools\vcpkg\buildtrees\freetype\x64-windows-rel\freetype.pdb>> source: KeePassXC.exe, 00000013.00000002.4088123746.00007FF93BEFA000.00000002.00000001.01000000.00000017.sdmp, KeePassXC.exe, 00000016.00000002.3170869722.00007FF93BEFA000.00000002.00000001.01000000.00000017.sdmp
Source: Binary string: C:\Tools\vcpkg\buildtrees\qt5-base\x64-windows-rel\plugins\platforms\qwindows.pdb source: KeePassXC.exe, 00000013.00000002.4087820584.00007FF93BE27000.00000002.00000001.01000000.0000001B.sdmp, KeePassXC.exe, 00000016.00000002.3170489266.00007FF93BE27000.00000002.00000001.01000000.0000001B.sdmp
Source: Binary string: C:\Tools\vcpkg\buildtrees\zstd\x64-windows-rel\lib\zstd.pdb99 source: KeePassXC.exe, 00000013.00000002.4088582697.00007FF93C0CA000.00000002.00000001.01000000.00000014.sdmp, KeePassXC.exe, 00000016.00000002.3171285759.00007FF93C0CA000.00000002.00000001.01000000.00000014.sdmp
Source: Binary string: C:\Tools\vcpkg\buildtrees\pcre2\x64-windows-rel\pcre2-16.pdb// source: KeePassXC.exe, 00000013.00000002.4096160060.00007FF944043000.00000002.00000001.01000000.00000012.sdmp, KeePassXC.exe, 00000016.00000002.3176282328.00007FF944043000.00000002.00000001.01000000.00000012.sdmp
Source: Binary string: C:\Tools\vcpkg\buildtrees\bzip2\x64-windows-rel\bz2.pdb source: KeePassXC.exe, 00000013.00000002.4096458026.00007FF956DC0000.00000002.00000001.01000000.00000018.sdmp, KeePassXC.exe, 00000016.00000002.3176587539.00007FF956DC0000.00000002.00000001.01000000.00000018.sdmp
Source: Binary string: r.PDB!`r. source: KeePassXC.exe, 00000013.00000002.4091209691.00007FF93CF19000.00000002.00000001.01000000.0000000C.sdmp, KeePassXC.exe, 00000016.00000002.3173443311.00007FF93CF19000.00000002.00000001.01000000.0000000C.sdmp, KeePassXC.exe, 00000018.00000002.3256335958.00007FF93CF19000.00000002.00000001.01000000.0000000C.sdmp
Source: Binary string: C:\Tools\vcpkg\buildtrees\qt5-base\x64-windows-rel\plugins\styles\qwindowsvistastyle.pdb source: KeePassXC.exe, 00000013.00000002.4087602282.00007FF93BD8B000.00000002.00000001.01000000.0000001C.sdmp, KeePassXC.exe, 00000016.00000002.3170310906.00007FF93BD8B000.00000002.00000001.01000000.0000001C.sdmp
Source: Binary string: C:\Tools\vcpkg\buildtrees\minizip\x64-windows-rel\minizip.pdb source: KeePassXC.exe, 00000013.00000002.4097904725.00007FF957E0A000.00000002.00000001.01000000.0000000E.sdmp, KeePassXC.exe, 00000016.00000002.3177092336.00007FF957E0A000.00000002.00000001.01000000.0000000E.sdmp
Source: Binary string: C:\Tools\vcpkg\buildtrees\harfbuzz\x64-windows-rel\src\harfbuzz.pdbPP source: KeePassXC.exe, 00000013.00000002.4088325018.00007FF93BFF2000.00000002.00000001.01000000.00000016.sdmp, KeePassXC.exe, 00000016.00000002.3171096150.00007FF93BFF2000.00000002.00000001.01000000.00000016.sdmp
Source: Binary string: C:\Tools\vcpkg\buildtrees\qt5-base\x64-windows-rel\plugins\platforms\qwindows.pdbll% source: KeePassXC.exe, 00000013.00000002.4087820584.00007FF93BE27000.00000002.00000001.01000000.0000001B.sdmp, KeePassXC.exe, 00000016.00000002.3170489266.00007FF93BE27000.00000002.00000001.01000000.0000001B.sdmp
Source: Binary string: r.PDB! source: KeePassXC.exe, 00000013.00000002.4091209691.00007FF93CF19000.00000002.00000001.01000000.0000000C.sdmp, KeePassXC.exe, 00000016.00000002.3173443311.00007FF93CF19000.00000002.00000001.01000000.0000000C.sdmp, KeePassXC.exe, 00000018.00000002.3256335958.00007FF93CF19000.00000002.00000001.01000000.0000000C.sdmp
Source: Binary string: C:\Tools\vcpkg\buildtrees\zstd\x64-windows-rel\lib\zstd.pdb source: KeePassXC.exe, 00000013.00000002.4088582697.00007FF93C0CA000.00000002.00000001.01000000.00000014.sdmp, KeePassXC.exe, 00000016.00000002.3171285759.00007FF93C0CA000.00000002.00000001.01000000.00000014.sdmp
Source: Binary string: C:\Tools\vcpkg\buildtrees\qt5-base\x64-windows-rel\lib\Qt5Gui.pdb source: KeePassXC.exe, 00000013.00000002.4091209691.00007FF93CF19000.00000002.00000001.01000000.0000000C.sdmp, KeePassXC.exe, 00000016.00000002.3173443311.00007FF93CF19000.00000002.00000001.01000000.0000000C.sdmp, KeePassXC.exe, 00000018.00000002.3256335958.00007FF93CF19000.00000002.00000001.01000000.0000000C.sdmp
Source: Binary string: C:\Tools\vcpkg\buildtrees\zlib\x64-windows-rel\zlib.pdb source: KeePassXC.exe, 00000013.00000002.4098576060.00007FF95D9CF000.00000002.00000001.01000000.0000000D.sdmp, KeePassXC.exe, 00000016.00000002.3177344391.00007FF95D9CF000.00000002.00000001.01000000.0000000D.sdmp
PE file contains sections with non-standard names
Source: harfbuzz.dll.2.dr Static PE information: section name: _RDATA
Source: keepassxc-autotype-windows.dll.2.dr Static PE information: section name: .qtmetad
Source: qgenericbearer.dll.2.dr Static PE information: section name: .qtmetad
Source: qsvgicon.dll.2.dr Static PE information: section name: .qtmetad
Source: qgif.dll.2.dr Static PE information: section name: .qtmetad
Source: qicns.dll.2.dr Static PE information: section name: .qtmetad
Source: qico.dll.2.dr Static PE information: section name: .qtmetad
Source: qjpeg.dll.2.dr Static PE information: section name: .qtmetad
Source: qsvg.dll.2.dr Static PE information: section name: .qtmetad
Source: qtga.dll.2.dr Static PE information: section name: .qtmetad
Source: qtiff.dll.2.dr Static PE information: section name: .qtmetad
Source: qwbmp.dll.2.dr Static PE information: section name: .qtmetad
Source: qwebp.dll.2.dr Static PE information: section name: .qtmetad
Source: qwindows.dll.2.dr Static PE information: section name: .qtmetad
Source: qwindowsvistastyle.dll.2.dr Static PE information: section name: .qtmetad
Source: Qt5Core.dll.2.dr Static PE information: section name: .qtmimed
Drops PE files
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Temp\MSIB0CF.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\KeePassXC\minizip.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\KeePassXC\libwebpdemux.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\KeePassXC\botan-3.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\KeePassXC\plugins\imageformats\qtiff.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\KeePassXC\harfbuzz.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSI8430.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\KeePassXC\keepassxc-cli.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\KeePassXC\Qt5Widgets.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\KeePassXC\plugins\imageformats\qsvg.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSI8625.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\KeePassXC\libsharpyuv.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\KeePassXC\plugins\imageformats\qico.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\KeePassXC\brotlicommon.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\KeePassXC\Qt5Network.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\KeePassXC\plugins\imageformats\qwbmp.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\KeePassXC\keepassxc-proxy.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\KeePassXC\zlib1.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\KeePassXC\plugins\bearer\qgenericbearer.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\KeePassXC\libcrypto-3-x64.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\KeePassXC\qrencode.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\KeePassXC\Qt5Svg.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\KeePassXC\plugins\iconengines\qsvgicon.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\KeePassXC\zstd.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\KeePassXC\liblzma.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\KeePassXC\Qt5Gui.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\KeePassXC\readline.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\KeePassXC\bz2.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\KeePassXC\argon2.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Temp\MSI6E86.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\KeePassXC\freetype.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\KeePassXC\libwebp.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\KeePassXC\plugins\imageformats\qwebp.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\KeePassXC\jpeg62.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\KeePassXC\libssl-3-x64.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\KeePassXC\plugins\imageformats\qtga.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\KeePassXC\plugins\styles\qwindowsvistastyle.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\KeePassXC\tiff.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\KeePassXC\plugins\imageformats\qicns.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\KeePassXC\Qt5Concurrent.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\KeePassXC\Qt5Core.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\KeePassXC\pcre2-16.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\KeePassXC\plugins\imageformats\qjpeg.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\KeePassXC\plugins\platforms\qwindows.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\KeePassXC\double-conversion.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\KeePassXC\libwebpmux.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\KeePassXC\brotlidec.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\KeePassXC\KeePassXC.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\KeePassXC\keepassxc-autotype-windows.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\KeePassXC\libpng16.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Program Files\KeePassXC\plugins\imageformats\qgif.dll Jump to dropped file
Drops PE files to the windows directory (C:\Windows)
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSI8430.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSI8625.tmp Jump to dropped file
Stores files to the Windows start menu directory
Source: C:\Windows\System32\msiexec.exe File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KeePassXC Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KeePassXC\KeePassXC.lnk Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KeePassXC\KeePassXC - Getting Started.lnk Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KeePassXC\KeePassXC - User Guide.lnk Jump to behavior
Source: C:\Windows\System32\msiexec.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run KeePassXC Jump to behavior
Source: C:\Windows\System32\msiexec.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run KeePassXC Jump to behavior
Stores large binary data to the registry
Source: C:\Windows\System32\msiexec.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CCBBF9E1485AF63CE47ABF8E9E648C2504FC319D Blob Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Program Files\KeePassXC\KeePassXC.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIB0CF.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\KeePassXC\libwebpdemux.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\KeePassXC\plugins\iconengines\qsvgicon.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\KeePassXC\plugins\imageformats\qtiff.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\KeePassXC\readline.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\KeePassXC\liblzma.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\Installer\MSI8430.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\KeePassXC\keepassxc-cli.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI6E86.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\KeePassXC\plugins\imageformats\qsvg.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\Installer\MSI8625.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\KeePassXC\libwebp.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\KeePassXC\plugins\imageformats\qwebp.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\KeePassXC\jpeg62.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\KeePassXC\libsharpyuv.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\KeePassXC\plugins\imageformats\qico.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\KeePassXC\plugins\imageformats\qtga.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\KeePassXC\tiff.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\KeePassXC\plugins\styles\qwindowsvistastyle.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\KeePassXC\plugins\imageformats\qwbmp.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\KeePassXC\plugins\imageformats\qicns.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\KeePassXC\keepassxc-proxy.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\KeePassXC\plugins\bearer\qgenericbearer.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\KeePassXC\plugins\imageformats\qjpeg.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\KeePassXC\plugins\platforms\qwindows.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\KeePassXC\libwebpmux.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\KeePassXC\keepassxc-autotype-windows.dll Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Program Files\KeePassXC\plugins\imageformats\qgif.dll Jump to dropped file
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Program Files\KeePassXC\KeePassXC.exe TID: 3864 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe TID: 1792 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: KeePassXC.exe, 00000013.00000002.4091728053.00007FF93D189000.00000008.00000001.01000000.0000000C.sdmp, KeePassXC.exe, 00000016.00000002.3173862835.00007FF93D189000.00000008.00000001.01000000.0000000C.sdmp Binary or memory string: .?AVQEmulationPaintEngine@@
Source: C:\Windows\System32\msiexec.exe Process information queried: ProcessInformation Jump to behavior
Enables debug privileges
Source: C:\Windows\SysWOW64\taskkill.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Process token adjusted: Debug Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\SysWOW64\msiexec.exe Process created: C:\Program Files\KeePassXC\KeePassXC.exe "C:\Program Files\KeePassXC\KeePassXC.exe" Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\SysWOW64\taskkill.exe" /IM KeePassXC.exe Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\SysWOW64\taskkill.exe" /IM keepassxc-proxy.exe /F Jump to behavior
Uses taskkill to terminate processes
Source: C:\Windows\SysWOW64\msiexec.exe Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\SysWOW64\taskkill.exe" /IM KeePassXC.exe Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\SysWOW64\taskkill.exe" /IM keepassxc-proxy.exe /F Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\System32\msiexec.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Queries volume information: C:\Program Files\KeePassXC\qt.conf VolumeInformation Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Queries volume information: C:\Program Files\KeePassXC\qt.conf VolumeInformation Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Queries volume information: C:\Program Files\KeePassXC\plugins\platforms\qwindows.dll VolumeInformation Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Queries volume information: C:\Program Files\KeePassXC\plugins\styles\qwindowsvistastyle.dll VolumeInformation Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Queries volume information: C:\Program Files\KeePassXC\share\translations\qtbase_en.qm VolumeInformation Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Queries volume information: C:\Program Files\KeePassXC\share\translations\keepassxc_en.qm VolumeInformation Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Queries volume information: C:\Program Files\KeePassXC\plugins\iconengines\qsvgicon.dll VolumeInformation Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Queries volume information: C:\Windows\Fonts\segoeuib.ttf VolumeInformation Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Queries volume information: C:\Program Files\KeePassXC\keepassxc-autotype-windows.dll VolumeInformation Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Queries volume information: C:\Program Files\KeePassXC\qt.conf VolumeInformation Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Queries volume information: C:\Program Files\KeePassXC\qt.conf VolumeInformation Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Queries volume information: C:\Program Files\KeePassXC\plugins\platforms\qwindows.dll VolumeInformation Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Queries volume information: C:\Program Files\KeePassXC\plugins\styles\qwindowsvistastyle.dll VolumeInformation Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Queries volume information: C:\Users\user\AppData\Roaming\KeePassXC\keepassxc.ini VolumeInformation Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Queries volume information: C:\Users\user\AppData\Roaming\KeePassXC\keepassxc.ini VolumeInformation Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Queries volume information: C:\Program Files\KeePassXC\qt.conf VolumeInformation Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Queries volume information: C:\Program Files\KeePassXC\qt.conf VolumeInformation Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Queries volume information: C:\Program Files\KeePassXC\plugins\platforms\qwindows.dll VolumeInformation Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Queries volume information: C:\Program Files\KeePassXC\plugins\styles\qwindowsvistastyle.dll VolumeInformation Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Queries volume information: C:\Users\user\AppData\Roaming\KeePassXC\keepassxc.ini VolumeInformation Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Queries volume information: C:\Users\user\AppData\Roaming\KeePassXC\keepassxc.ini VolumeInformation Jump to behavior
Source: C:\Program Files\KeePassXC\KeePassXC.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
Adds / modifies Windows certificates
Source: C:\Windows\System32\msiexec.exe Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CCBBF9E1485AF63CE47ABF8E9E648C2504FC319D Blob Jump to behavior
windows-stand
Behavior
Click here to start
Slideshow Behavior Animation
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1669048 Sample: KeePassXC-2.7.10-Win64.msi Startdate: 19/04/2025 Architecture: WINDOWS Score: 4 43 windows.msn.com.edgesuite.net 2->43 45 windows.msn.com 2->45 47 16 other IPs or domains 2->47 8 msiexec.exe 232 184 2->8         started        11 msiexec.exe 7 2->11         started        13 KeePassXC.exe 2 2->13         started        15 KeePassXC.exe 2 2->15         started        process3 file4 31 C:\Windows\Installer\MSI8625.tmp, PE32 8->31 dropped 33 C:\Windows\Installer\MSI8430.tmp, PE32 8->33 dropped 35 C:\Program Files\KeePassXC\zstd.dll, PE32+ 8->35 dropped 41 46 other files (none is malicious) 8->41 dropped 17 msiexec.exe 8->17         started        19 msiexec.exe 1 8->19         started        37 C:\Users\user\AppData\Local\...\MSIB0CF.tmp, PE32 11->37 dropped 39 C:\Users\user\AppData\Local\...\MSI6E86.tmp, PE32 11->39 dropped process5 process6 21 taskkill.exe 1 17->21         started        23 taskkill.exe 1 17->23         started        25 KeePassXC.exe 12 19->25         started        process7 27 conhost.exe 21->27         started        29 conhost.exe 23->29         started       
⊘No contacted IP infos

Contacted Domains

Name IP Active
ax-0002.ax-msedge.net 150.171.27.11 true
a-0003.a-msedge.net 204.79.197.203 true
c-msn-pme.trafficmanager.net 20.110.205.119 true
sb.scorecardresearch.com 3.163.80.85 true
a1062.dscd.akamai.net 23.0.162.246 true
ax-0001.ax-msedge.net 150.171.28.10 true
a233.dscd.akamai.net 23.0.162.246 true
assets.msn.com unknown unknown
windows.msn.com unknown unknown
c.msn.com unknown unknown
api.msn.com unknown unknown