Analysis
- user interaction
yes - max time kernel
1799s - max time network
1784s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260130-en - resource tags
- submitted
16/04/2026, 09:14
General
- Target zenith/gradle/wrapper/gradle-wrapper.jar
- Size 60KB
- Sample260416-k7prcaby2n
- SHA256 ed2c26eba7cfb93cc2b7785d05e534f07b5b48b5e7fc941921cd098628abca58
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 6 IoCs
- Loads dropped DLL 1 IoCs
- Modifies system executable filetype association 2 TTPs 16 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 1 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 64 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 41 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 48 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\zenith\gradle\wrapper\gradle-wrapper.jar1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ffa9655c728,0x7ffa9655c734,0x7ffa9655c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=2020,i,911243341481555033,10762812255398420696,524288 --field-trial-handle=1768,i,5211905776799202702,8123844498879802760,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=636 /prefetch:32⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1728,i,2333218395367201996,4360052635304596050,262144 --field-trial-handle=1768,i,5211905776799202702,8123844498879802760,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1840 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2424,i,15210830900958999707,14179469932789778540,524288 --field-trial-handle=1768,i,5211905776799202702,8123844498879802760,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2592 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3192,i,13047421446046604453,13798046506668735581,2097152 --field-trial-handle=1768,i,5211905776799202702,8123844498879802760,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3252 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3196,i,13687759244604938143,12919849462992617304,2097152 --field-trial-handle=1768,i,5211905776799202702,8123844498879802760,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3284 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4260,i,8549506778852759606,3013541524454507025,2097152 --field-trial-handle=1768,i,5211905776799202702,8123844498879802760,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4288 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4772,i,13898967934806169392,2694066204781553739,2097152 --field-trial-handle=1768,i,5211905776799202702,8123844498879802760,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4776 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5448,i,4283929173226484719,2024229861888014631,524288 --field-trial-handle=1768,i,5211905776799202702,8123844498879802760,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5452 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5744,i,8857951267770586854,15913051507100458007,2097152 --field-trial-handle=1768,i,5211905776799202702,8123844498879802760,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5716 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3264,i,6747263117563605783,14430564982305770675,2097152 --field-trial-handle=1768,i,5211905776799202702,8123844498879802760,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5944 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3320,i,13845910682211754898,4444205812064544267,524288 --field-trial-handle=1768,i,5211905776799202702,8123844498879802760,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5976 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\winrar-x64-720.exe"C:\Users\Admin\Downloads\winrar-x64-720.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\WinRAR\uninstall.exe"C:\Program Files\WinRAR\uninstall.exe" /setup3⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6204,i,10521559596424089631,5324763510517446625,524288 --field-trial-handle=1768,i,5211905776799202702,8123844498879802760,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6216 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\winrar-x64-720 (1).exe"C:\Users\Admin\Downloads\winrar-x64-720 (1).exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6292,i,13191428152760553432,4758479237213627518,524288 --field-trial-handle=1768,i,5211905776799202702,8123844498879802760,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6296 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6288,i,11149327841353251751,374314375655479190,524288 --field-trial-handle=1768,i,5211905776799202702,8123844498879802760,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6316 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6312,i,14751063420438478168,14423052251787245632,524288 --field-trial-handle=1768,i,5211905776799202702,8123844498879802760,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6256 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\winrar-x64-720.exe"C:\Users\Admin\Downloads\winrar-x64-720.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\uninstall.exe"C:\Program Files\uninstall.exe" /setup3⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Drops file in Program Files directory
- Modifies registry class
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5600,i,3551426473923053395,13959178465355695568,262144 --field-trial-handle=1768,i,5211905776799202702,8123844498879802760,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5596 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=4348,i,12999986979550613841,5818955788962274671,2097152 --field-trial-handle=1768,i,5211905776799202702,8123844498879802760,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4372 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3816,i,15488721352795871999,2441991238186749510,524288 --field-trial-handle=1768,i,5211905776799202702,8123844498879802760,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5444 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6420,i,17803359542946232631,14816843466409082116,2097152 --field-trial-handle=1768,i,5211905776799202702,8123844498879802760,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6396 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6524,i,887222715184149066,3510334745745316175,2097152 --field-trial-handle=1768,i,5211905776799202702,8123844498879802760,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6536 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6888,i,6306306736559010020,5692960839861985730,2097152 --field-trial-handle=1768,i,5211905776799202702,8123844498879802760,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6912 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6544,i,14412208452779350847,801781093097463878,2097152 --field-trial-handle=1768,i,5211905776799202702,8123844498879802760,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6976 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6432,i,14974859653081368211,1923214205612087138,2097152 --field-trial-handle=1768,i,5211905776799202702,8123844498879802760,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1184 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6660,i,4914232262237442083,445840402271355824,2097152 --field-trial-handle=1768,i,5211905776799202702,8123844498879802760,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6884 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6508,i,11189916840865797482,17904082409905906508,2097152 --field-trial-handle=1768,i,5211905776799202702,8123844498879802760,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6228 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4336,i,5086041679153185822,1582319291544882785,524288 --field-trial-handle=1768,i,5211905776799202702,8123844498879802760,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=7096 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6676,i,2610919246545610692,12076071471799361973,524288 --field-trial-handle=1768,i,5211905776799202702,8123844498879802760,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=7100 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=7208,i,2797627241343489796,13625227807110058394,2097152 --field-trial-handle=1768,i,5211905776799202702,8123844498879802760,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=7200 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=6552,i,2881010965422374076,14421069986698962218,2097152 --field-trial-handle=1768,i,5211905776799202702,8123844498879802760,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6512 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=6720,i,8012244664400245427,10866679208286008323,2097152 --field-trial-handle=1768,i,5211905776799202702,8123844498879802760,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=7296 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=6504,i,15690970013465191787,7431472604394127121,2097152 --field-trial-handle=1768,i,5211905776799202702,8123844498879802760,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=7396 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=6824,i,13983154980133169868,10789103254813703191,2097152 --field-trial-handle=1768,i,5211905776799202702,8123844498879802760,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6240 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=7528,i,9512492325639388610,13661776072363063162,2097152 --field-trial-handle=1768,i,5211905776799202702,8123844498879802760,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=7380 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=5616,i,14703170408252122883,15526708315078873225,2097152 --field-trial-handle=1768,i,5211905776799202702,8123844498879802760,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=7552 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=5764,i,2346936814801754111,10354577307189727438,2097152 --field-trial-handle=1768,i,5211905776799202702,8123844498879802760,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5696 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=5792,i,8220403292105246577,3657617014971571736,2097152 --field-trial-handle=1768,i,5211905776799202702,8123844498879802760,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6928 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=908,i,6056233242461428266,14437796756238110255,2097152 --field-trial-handle=1768,i,5211905776799202702,8123844498879802760,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6404 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=7476,i,11895802596663652289,11138783286344763068,2097152 --field-trial-handle=1768,i,5211905776799202702,8123844498879802760,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=7428 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --metrics-shmem-handle=6924,i,7624113107383649876,4935877612871873655,2097152 --field-trial-handle=1768,i,5211905776799202702,8123844498879802760,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=7416 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=6864,i,10035882432642783423,12960628497273682720,2097152 --field-trial-handle=1768,i,5211905776799202702,8123844498879802760,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6380 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --metrics-shmem-handle=4640,i,3577587227967079445,14694647506694694647,2097152 --field-trial-handle=1768,i,5211905776799202702,8123844498879802760,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6352 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --metrics-shmem-handle=4304,i,7326401293318767030,9529834200439344918,2097152 --field-trial-handle=1768,i,5211905776799202702,8123844498879802760,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4372 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --metrics-shmem-handle=5768,i,6529900362246923224,16480560245397640629,2097152 --field-trial-handle=1768,i,5211905776799202702,8123844498879802760,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5828 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --metrics-shmem-handle=6444,i,9098878485155151745,12936619773814716220,2097152 --field-trial-handle=1768,i,5211905776799202702,8123844498879802760,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3408 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --metrics-shmem-handle=5864,i,13654490060999576225,977013996207474135,2097152 --field-trial-handle=1768,i,5211905776799202702,8123844498879802760,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5792 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --metrics-shmem-handle=1296,i,18196976962881852428,1547323787036630154,2097152 --field-trial-handle=1768,i,5211905776799202702,8123844498879802760,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=7564 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --metrics-shmem-handle=5808,i,12107113062025743094,8281643895887337007,2097152 --field-trial-handle=1768,i,5211905776799202702,8123844498879802760,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6796 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --metrics-shmem-handle=7028,i,933944925404526202,11119426553166106687,2097152 --field-trial-handle=1768,i,5211905776799202702,8123844498879802760,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=7720 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --metrics-shmem-handle=1548,i,10717837177126799408,15102074455266163219,2097152 --field-trial-handle=1768,i,5211905776799202702,8123844498879802760,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6184 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --metrics-shmem-handle=7884,i,2078062002941599960,9414026693464282284,2097152 --field-trial-handle=1768,i,5211905776799202702,8123844498879802760,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=7920 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --metrics-shmem-handle=7848,i,17302380656648284107,2217752176705251752,2097152 --field-trial-handle=1768,i,5211905776799202702,8123844498879802760,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5752 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --metrics-shmem-handle=6404,i,1227174641185622802,14708159645396050938,2097152 --field-trial-handle=1768,i,5211905776799202702,8123844498879802760,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=8136 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --metrics-shmem-handle=7176,i,7556688946204934868,562884377866707784,2097152 --field-trial-handle=1768,i,5211905776799202702,8123844498879802760,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=7196 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --metrics-shmem-handle=4788,i,10856109888687943566,1035047897727913878,2097152 --field-trial-handle=1768,i,5211905776799202702,8123844498879802760,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6828 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5812,i,16372166261345123419,15385865269401625488,524288 --field-trial-handle=1768,i,5211905776799202702,8123844498879802760,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6452 /prefetch:82⤵
-
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\zenith.rar"2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Privilege Escalation
Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
7zxa.dll
Default.SFX
Default32.SFX
Descript.ion
Rar.exe
RarExtInstaller.exe
RarExtPackage.msix
Resources.pri
UnRAR.exe
WhatsNew.txt
WinCon.SFX
WinCon32.SFX
WinRAR.chm
WinRAR.exe
Default.SFX
License.txt
Order.htm
Rar.txt
RarExt.dll
RarExt32.dll
RarExtLogo.altform-unplated_targetsize-32.png
RarExtLogo.altform-unplated_targetsize-48.png
RarExtLogo.altform-unplated_targetsize-64.png
RarFiles.lst
ReadMe.txt
Uninstall.exe
Uninstall.lst
WinRAR.exe
Zip32.SFX
Zip.SFX
Console RAR manual.lnk
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
f_000006
f_000008
f_00000a
f_00000b
f_00001d
f_00001e
f_00001f
f_000020
f_000021
f_000022
f_000023
f_000024
f_000027
f_00003a
f_00003b
f_00003c
f_00003d
f_00003e
f_00003f
f_000041
f_000042
f_000043
f_000044
f_000045
f_000047
f_000048
f_000049
f_00004a
f_00004b
f_00004c
f_00004d
f_00004e
f_00004f
f_000050
f_000051
f_000052
f_000053
f_000054
f_000055
f_000058
f_00005b
f_000062
f_000067
f_00006a
f_000092
f_000093
f_000098
17cb2a3083b94fd0_0
358ec8d5383b2c8e_0
b6b37e79c2c8e175_0
temp-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
CURRENT
MANIFEST-000001
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
TransportSecurity
TransportSecurity
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index~RFe5d44cc.TMP
index.txt
index.txt~RFe5d44fb.TMP
fa813c9ad67834ac_0
fa813c9ad67834ac_1
the-real-index
the-real-index
the-real-index~RFe5859d3.TMP
the-real-index
index
c22d588f4a2f75a0_0
the-real-index
the-real-index~RFe5d44eb.TMP
index.txt
index.txt
index.txt
index.txt
index.txt
index.txt
index.txt
index.txt~RFe5cf4f6.TMP
000003.log
LOG
LOG
LOG.old
MANIFEST-000001
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
default.dic
5d696d521de238c3.customDestinations-ms
5d696d521de238c3.customDestinations-ms
5d696d521de238c3.customDestinations-ms
5d696d521de238c3.customDestinations-ms
5d696d521de238c3.customDestinations-ms
5d696d521de238c3.customDestinations-ms
Console RAR manual.lnk
What is new in the latest version.lnk
WinRAR help.lnk
WinRAR.lnk
winrar-x64-720.exe
zenith.rar
memory/3088-405-0x000002829F600000-0x000002829F72B000-memory.dmp
memory/4452-390-0x000001B4F5530000-0x000001B4F565B000-memory.dmp
memory/4452-553-0x000001B4F5530000-0x000001B4F565B000-memory.dmp
memory/4540-515-0x000002414C9E0000-0x000002414CB0B000-memory.dmp
memory/4744-12-0x0000020EA0990000-0x0000020EA0C00000-memory.dmp
memory/4744-11-0x0000020EA0970000-0x0000020EA0971000-memory.dmp
memory/4744-2-0x0000020EA0990000-0x0000020EA0C00000-memory.dmp
memory/5428-500-0x00000286B2420000-0x00000286B254B000-memory.dmp
memory/5428-429-0x00000286B2420000-0x00000286B254B000-memory.dmp
memory/5716-262-0x000001E8BD100000-0x000001E8BD22B000-memory.dmp
memory/5720-26-0x000001FA89700000-0x000001FA8982B000-memory.dmp
memory/5960-3364-0x0000027C32540000-0x0000027C3266B000-memory.dmp
memory/5960-3365-0x0000027C38100000-0x0000027C3810C000-memory.dmp
memory/5960-3418-0x0000027C32540000-0x0000027C3266B000-memory.dmp