Analysis
- user interaction
yes - max time kernel
281s - max time network
400s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
23/04/2026, 01:52
General
- Target https://pixeldrain.com/api/file/udvJyVk2?download
- Sample260423-can5jsfz3x
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 31 IoCs
- Loads dropped DLL 64 IoCs
- Modifies system executable filetype association 2 TTPs 16 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 2 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 12 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops desktop.ini file(s) 3 IoCs
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Network Share Discovery 1 TTPs
Attempt to gather information on host network.
- Drops file in System32 directory 6 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 64 IoCs
- Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 2 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 9 IoCs
- Modifies Internet Explorer settings 1 TTPs 46 IoCs
- Modifies data under HKEY_USERS 64 IoCs
- Modifies registry class 64 IoCs
- NTFS ADS 64 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 28 IoCs
- Suspicious use of SetWindowsHookAW 2 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://pixeldrain.com/api/file/udvJyVk2?download2⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x258,0x7ffbe11ac188,0x7ffbe11ac194,0x7ffbe11ac1a03⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1784,i,3073880600045082185,10654595077604379477,524288 --field-trial-handle=2100,i,8744980915594307421,9091580376942528932,262144 --variations-seed-version --mojo-platform-channel-handle=2736 /prefetch:113⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1552,i,18334400098953097091,852544315814380338,262144 --field-trial-handle=2100,i,8744980915594307421,9091580376942528932,262144 --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2356,i,18371250832824707929,2066031222996327381,524288 --field-trial-handle=2100,i,8744980915594307421,9091580376942528932,262144 --variations-seed-version --mojo-platform-channel-handle=2744 /prefetch:133⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,5819982714793258882,5320631243421641599,2097152 --field-trial-handle=2100,i,8744980915594307421,9091580376942528932,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,3316239253730568337,7332093789749706972,2097152 --field-trial-handle=2100,i,8744980915594307421,9091580376942528932,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4832,i,688660336214298567,7993509838759531849,524288 --field-trial-handle=2100,i,8744980915594307421,9091580376942528932,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4836,i,17600847520061446958,11494484721201543576,524288 --field-trial-handle=2100,i,8744980915594307421,9091580376942528932,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5488,i,16279781711711909729,6421969784605087678,2097152 --field-trial-handle=2100,i,8744980915594307421,9091580376942528932,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3320,i,4266046735316992220,3430783766900517278,524288 --field-trial-handle=2100,i,8744980915594307421,9091580376942528932,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5336,i,13498730749773902986,1140612177731466357,524288 --field-trial-handle=2100,i,8744980915594307421,9091580376942528932,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5336,i,13498730749773902986,1140612177731466357,524288 --field-trial-handle=2100,i,8744980915594307421,9091580376942528932,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,3268969731049693409,16002739399220380855,524288 --field-trial-handle=2100,i,8744980915594307421,9091580376942528932,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:143⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.execookie_exporter.exe --cookie-json=11404⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5532,i,16306901348416408614,6193348229008089669,2097152 --field-trial-handle=2100,i,8744980915594307421,9091580376942528932,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,15793137503600746915,4130317891345848680,524288 --field-trial-handle=2100,i,8744980915594307421,9091580376942528932,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6816,i,5210388561907137224,14173693923607960684,524288 --field-trial-handle=2100,i,8744980915594307421,9091580376942528932,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6812,i,13292678979197938559,2274429854275409483,524288 --field-trial-handle=2100,i,8744980915594307421,9091580376942528932,262144 --variations-seed-version --mojo-platform-channel-handle=3040 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4944,i,10699287941825229675,7804300498342474930,524288 --field-trial-handle=2100,i,8744980915594307421,9091580376942528932,262144 --variations-seed-version --mojo-platform-channel-handle=2812 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4828,i,12621998239688199442,3188583125381350131,524288 --field-trial-handle=2100,i,8744980915594307421,9091580376942528932,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6468,i,5864214068855939892,17662394754554865884,524288 --field-trial-handle=2100,i,8744980915594307421,9091580376942528932,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5524,i,699324743457264698,10410680265710251051,2097152 --field-trial-handle=2100,i,8744980915594307421,9091580376942528932,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=3540,i,945023111883713442,9981437894595855327,2097152 --field-trial-handle=2100,i,8744980915594307421,9091580376942528932,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3724,i,4322438071951886315,12518461254716113507,262144 --field-trial-handle=2100,i,8744980915594307421,9091580376942528932,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:103⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6468,i,16522052998092992791,8755816093493731808,2097152 --field-trial-handle=2100,i,8744980915594307421,9091580376942528932,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=3652,i,8261103783697095972,10924653996228804273,2097152 --field-trial-handle=2100,i,8744980915594307421,9091580376942528932,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7024,i,14597126855405885527,10850146428382574484,2097152 --field-trial-handle=2100,i,8744980915594307421,9091580376942528932,262144 --variations-seed-version --mojo-platform-channel-handle=7032 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=5552,i,8703918971803046039,10362618036633481383,2097152 --field-trial-handle=2100,i,8744980915594307421,9091580376942528932,262144 --variations-seed-version --mojo-platform-channel-handle=6996 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7288,i,9263433434963454795,6101754159752918701,2097152 --field-trial-handle=2100,i,8744980915594307421,9091580376942528932,262144 --variations-seed-version --mojo-platform-channel-handle=6944 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7368,i,2994629126796528913,8834809005440351060,524288 --field-trial-handle=2100,i,8744980915594307421,9091580376942528932,262144 --variations-seed-version --mojo-platform-channel-handle=7328 /prefetch:143⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6576,i,9471124857824393542,2173255612491799164,524288 --field-trial-handle=2100,i,8744980915594307421,9091580376942528932,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=6372,i,14968538158496769339,15879434680925384132,2097152 --field-trial-handle=2100,i,8744980915594307421,9091580376942528932,262144 --variations-seed-version --mojo-platform-channel-handle=7800 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7940,i,7029710470552214167,17147801731526793806,2097152 --field-trial-handle=2100,i,8744980915594307421,9091580376942528932,262144 --variations-seed-version --mojo-platform-channel-handle=7304 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8128,i,1034594240368513810,3482747174255846957,524288 --field-trial-handle=2100,i,8744980915594307421,9091580376942528932,262144 --variations-seed-version --mojo-platform-channel-handle=7204 /prefetch:143⤵
-
-
C:\Users\Admin\Downloads\winzip77-bing.exe"C:\Users\Admin\Downloads\winzip77-bing.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\e5a88c9\winzip77-bing.exerun=1 shortcut="C:\Users\Admin\Downloads\winzip77-bing.exe"4⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8184,i,12004258608382457466,12565864231571478917,524288 --field-trial-handle=2100,i,8744980915594307421,9091580376942528932,262144 --variations-seed-version --mojo-platform-channel-handle=7172 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2400,i,2849578959253091791,222039684866126215,524288 --field-trial-handle=2100,i,8744980915594307421,9091580376942528932,262144 --variations-seed-version --mojo-platform-channel-handle=8076 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=7108,i,2587881043668641951,4169535047905484089,2097152 --field-trial-handle=2100,i,8744980915594307421,9091580376942528932,262144 --variations-seed-version --mojo-platform-channel-handle=7088 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7912,i,127123794682949471,5015796168698313901,524288 --field-trial-handle=2100,i,8744980915594307421,9091580376942528932,262144 --variations-seed-version --mojo-platform-channel-handle=8260 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window3⤵
- Enumerates system info in registry
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2ac,0x7ffbe11ac188,0x7ffbe11ac194,0x7ffbe11ac1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1832,i,9338076421336787230,10807515934819010454,524288 --field-trial-handle=2164,i,11462292710656406897,16999410845155760736,262144 --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1688,i,363889212922963266,12096828246899627990,262144 --field-trial-handle=2164,i,11462292710656406897,16999410845155760736,262144 --variations-seed-version --mojo-platform-channel-handle=2160 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2516,i,13447538497191114727,9922418731722059584,524288 --field-trial-handle=2164,i,11462292710656406897,16999410845155760736,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4436,i,15428237152515540517,7663779728251938666,524288 --field-trial-handle=2164,i,11462292710656406897,16999410845155760736,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4436,i,15428237152515540517,7663779728251938666,524288 --field-trial-handle=2164,i,11462292710656406897,16999410845155760736,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4556,i,3140289643852190348,14882737392496718126,524288 --field-trial-handle=2164,i,11462292710656406897,16999410845155760736,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4808,i,8022534343634909109,7169941155797840272,524288 --field-trial-handle=2164,i,11462292710656406897,16999410845155760736,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4812,i,2145609259875203556,12548513749623877792,524288 --field-trial-handle=2164,i,11462292710656406897,16999410845155760736,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4936,i,16499895372321268457,8010437090554933730,524288 --field-trial-handle=2164,i,11462292710656406897,16999410845155760736,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,17702842187968770489,11329300450289098764,524288 --field-trial-handle=2164,i,11462292710656406897,16999410845155760736,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4920,i,2181288276322658602,13043338209203029323,524288 --field-trial-handle=2164,i,11462292710656406897,16999410845155760736,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5256,i,4910771298458351905,14993754420784298603,524288 --field-trial-handle=2164,i,11462292710656406897,16999410845155760736,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5348,i,597567397847841955,2610940147400429140,262144 --field-trial-handle=2164,i,11462292710656406897,16999410845155760736,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:104⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5328,i,15119606442112993866,6094113902222689830,524288 --field-trial-handle=2164,i,11462292710656406897,16999410845155760736,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4584,i,12994930265607264479,2525242968161733045,524288 --field-trial-handle=2164,i,11462292710656406897,16999410845155760736,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:144⤵
-
-
-
-
C:\Program Files\WinZip\winzip64.exe"C:\Program Files\WinZip\winzip64.exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Checks processor information in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookAW
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\WinZip\WzCABCacheSyncHelper64.exe"C:\Program Files\WinZip\WzCABCacheSyncHelper64.exe"3⤵
- Executes dropped EXE
-
-
C:\Program Files\WinZip\SPkgRegister64.exe"C:\Program Files\WinZip\SPkgRegister64.exe" /reg /cu3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=winzip64.exe --webview-exe-version="77.0 (206)" --user-data-dir="C:\Users\Admin\AppData\Local\WinZip\WebView2UDF\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --mojo-named-platform-channel-pipe=4476.492.45145618645540217253⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\WinZip\WebView2UDF\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\WinZip\WebView2UDF\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x170,0x7ffba7deb078,0x7ffba7deb084,0x7ffba7deb0904⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\WinZip\WebView2UDF\EBWebView" --webview-exe-name=winzip64.exe --webview-exe-version="77.0 (206)" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1580,i,4584826353893934262,7703344360391235744,262144 --variations-seed-version --mojo-platform-channel-handle=1688 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\WinZip\WebView2UDF\EBWebView" --webview-exe-name=winzip64.exe --webview-exe-version="77.0 (206)" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=1996,i,4584826353893934262,7703344360391235744,262144 --variations-seed-version --mojo-platform-channel-handle=2004 /prefetch:114⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\WinZip\WebView2UDF\EBWebView" --webview-exe-name=winzip64.exe --webview-exe-version="77.0 (206)" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=1988,i,4584826353893934262,7703344360391235744,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\WinZip\WebView2UDF\EBWebView" --webview-exe-name=winzip64.exe --webview-exe-version="77.0 (206)" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3464,i,4584826353893934262,7703344360391235744,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:14⤵
-
-
-
C:\Program Files\WinZip\winzip64.exe"C:\Program Files\WinZip\winzip64.exe" /admincfg3⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
-
-
C:\Program Files\WinZip\WzScan.exe"C:\Program Files\WinZip\WzScan.exe" -pinstall3⤵
- Executes dropped EXE
- Checks processor information in registry
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.winzip.com/instcmplt.cgi?pid=WNZP&ver=77.0.16478.0&lang=en&osbits=64&vid=oemg&x-at=bing2⤵
-
-
C:\Program Files\WinZip\winzip64.exe"C:\Program Files\WinZip\winzip64.exe" "C:\Users\Admin\Downloads\RobinMorningwoodAdventurev2.0.11Build14335285.7z"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Downloads\Robin Morningwood Adventure\Robin Morningwood Adventure.exe"C:\Users\Admin\Downloads\Robin Morningwood Adventure\Robin Morningwood Adventure.exe"2⤵
-
C:\Users\Admin\Downloads\Robin Morningwood Adventure\UnityCrashHandler64.exe"C:\Users\Admin\Downloads\Robin Morningwood Adventure\UnityCrashHandler64.exe" --attach 6516 27182647910403⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Modifies system executable filetype association
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 950CCC9D0FD2C7AB47E49D20D6856D2A2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 6A8D080585F7FD61C49E845F1F74834C2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks /Create /SC DAILY /TN "WinZip Update Notifier 1" /TR "\"C:\Program Files\WinZip\WZUpdateNotifier.exe\" -checkType=\"scheduled_9AM\" -show" /ST 09:05 /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks /Create /SC DAILY /TN "WinZip Update Notifier 2" /TR "\"C:\Program Files\WinZip\WZUpdateNotifier.exe\" -checkType=\"scheduled_12PM\" -show" /ST 12:05 /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks /Create /SC DAILY /TN "WinZip Update Notifier 3" /TR "\"C:\Program Files\WinZip\WZUpdateNotifier.exe\" -checkType=\"scheduled_3PM\" -show" /ST 15:05 /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 1703C47673ECA92D9B8A7ECEC6283874 E Global\MSI00002⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\WinZip\FAHConsole.exe"C:\Program Files\WinZip\FAHConsole.exe"3⤵
- Executes dropped EXE
-
C:\Program Files\WinZip\FAHWindow64.exe"C:\Program Files\WinZip\FAHWindow64.exe" register4⤵
- Executes dropped EXE
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe /s "C:\Program Files\WinZip\WXFCMBPDF.dll" /codebase /tlb3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe /s "C:\Program Files\WinZip\WXFRMPD.dll" /codebase /tlb3⤵
- Modifies data under HKEY_USERS
- Modifies registry class
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe /s "C:\Program Files\WinZip\WXFSGNPDFWINCERTSTORE.dll" /codebase /tlb3⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe /s "C:\Program Files\WinZip\WXFP2D.dll" /codebase /tlb3⤵
- Modifies registry class
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe /s "C:\Program Files\WinZip\WXFSGNPDF.dll" /codebase /tlb3⤵
- Drops file in Program Files directory
- Modifies registry class
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe /s "C:\Program Files\WinZip\WXFD2P.dll" /codebase /tlb3⤵
- Modifies registry class
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe /s "C:\Program Files\WinZip\WXFWMRK.dll" /codebase /tlb3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe /s "C:\Program Files\WinZip\WXFCNVP.dll" /codebase /tlb3⤵
- Modifies data under HKEY_USERS
- Modifies registry class
-
-
-
C:\Program Files\WinZip\WzPreviewer64.exe"C:\Program Files\WinZip\WzPreviewer64.exe" -regserver winzip642⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
-
C:\Program Files\WinZip\WzPreloader.exe"C:\Program Files\WinZip\WzPreloader.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\WinZip\winzip64.exe"C:\Program Files\WinZip\winzip64.exe" /noqp /nodesktop /nostartmenu /nomenugroup /autoinstall /lang 10332⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
- Checks whether UAC is enabled
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookAW
-
C:\Program Files\WinZip\WzCABCacheSyncHelper64.exe"C:\Program Files\WinZip\WzCABCacheSyncHelper64.exe"3⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
-
-
-
C:\Program Files\WinZip\winzip64.exe"C:\Program Files\WinZip\winzip64.exe" /precreatehkcu2⤵
- Executes dropped EXE
-
-
C:\Program Files\WinZip\WzUpdater.exe"C:\Program Files\WinZip\WzUpdater.exe" /schedule2⤵
- Executes dropped EXE
-
-
C:\Program Files\WinZip\SPkgRegister64.exe"C:\Program Files\WinZip\SPkgRegister64.exe" /reg /cu2⤵
- Executes dropped EXE
-
-
C:\Program Files\WinZip\SPkgRegister64.exe"C:\Program Files\WinZip\SPkgRegister64.exe" /reg2⤵
- Executes dropped EXE
-
-
C:\Program Files\WinZip\WZUpdateNotifier.exe"C:\Program Files\WinZip\WZUpdateNotifier.exe"2⤵
- Executes dropped EXE
-
-
C:\Program Files\WinZip\WzBGTComServer64.exe"C:\Program Files\WinZip\WzBGTComServer64.exe" /REGSERVER2⤵
- Executes dropped EXE
-
-
C:\Program Files\WinZip\WzBGTools64.exe"C:\Program Files\WinZip\WzBGTools64.exe" /s2⤵
- Executes dropped EXE
-
-
C:\Program Files\WinZip\ZipSendService.exe"C:\Program Files\WinZip\ZipSendService.exe" /REGAPP Outlook2⤵
- Executes dropped EXE
-
C:\Program Files\WinZip\ZipSendService.exe"C:\Program Files\WinZip\ZipSendService.exe" /REGSERVER3⤵
- Executes dropped EXE
- Modifies registry class
-
-
-
C:\Program Files\WinZip\adxregistrator.exe"C:\Program Files\WinZip\adxregistrator.exe" /install="WZOffice.dll" /privileges=admin /generateLogFile=false /CLRVersion="4.0"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\WinZip\FAHConsole.exe"C:\Program Files\WinZip\FAHConsole.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\WinZip\FAHWindow64.exe"C:\Program Files\WinZip\FAHWindow64.exe" register2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\WinZip\WZUpdateNotifier.exe"C:\Program Files\WinZip\WZUpdateNotifier.exe" -show1⤵
- Executes dropped EXE
-
C:\Program Files\WinZip\WZUpdateNotifier.exe"C:\Program Files\WinZip\WZUpdateNotifier.exe" -showOnly -allowParallelExecution2⤵
- Executes dropped EXE
-
-
C:\Program Files\WinZip\WzUpdater.exe"C:\Program Files\WinZip\WzUpdater.exe"1⤵
- Executes dropped EXE
-
C:\PROGRA~1\WinZip\WzPreloader.exeC:\PROGRA~1\WinZip\WZPREL~1.EXE1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\WinZip\WzBGTToolsManager64.exe"C:\Program Files\WinZip\WzBGTToolsManager64.exe"1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004C8 0x00000000000004E01⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Modify Registry
3Subvert Trust Controls
1SIP and Trust Provider Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
e5aee8b.rbs
SbkupStub.exe.config
WinZipCourierConfig.exe
WinZip Duplicate File Finder.lnk
WinZip Duplicate File Finder.lnk~RFe5b1a7a.TMP
WinZip Image Manager.lnk
WinZip Image Manager.lnk~RFe5b1a99.TMP
WinZip PDF Express.lnk
WinZip PDF Express.lnk~RFe5b1ab8.TMP
WinZip SafeShare.lnk
WinZip SafeShare.lnk
WinZip Secure Backup.lnk
WinZip Secure Backup.lnk~RFe5b1ae7.TMP
WinZip Tool Settings.lnk
WinZip Tool Settings.lnk
WinZip Tool Settings.lnk~RFe5b1a4b.TMP
WinZip.lnk
WinZip.lnk~RFe5b1a3b.TMP
WinZip.lnk
WinZip.lnk~RFe5b1a3b.TMP
winzip.77.xml
WinZip.addon
WinZip.addon
WinZip.addon
WinZip.addon
config.rma
3C42BC945025A34066DAB76EF3F80A05
FE17BEC2A573BC9AE36869D0274FFA19_6DA81F04C5F9EAD2CD0268808FCE61E1
3C42BC945025A34066DAB76EF3F80A05
FE17BEC2A573BC9AE36869D0274FFA19_6DA81F04C5F9EAD2CD0268808FCE61E1
autofill_bypass_cache_forms.json
edge_autofill_global_block_list.json
v1FieldTypes.json
settings.dat
settings.dat
settings.dat
settings.dat
settings.dat
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
f_000083
f_000086
the-real-index
the-real-index
the-real-index~RFe5a94cf.TMP
SiteList-Enterprise.json
HubApps
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Sdch Dictionaries
Preferences
Preferences
Preferences
Secure Preferences
sync_diagnostic.log
CURRENT
MANIFEST-000001
domain_actions.dll
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
crs.pb
ct_config.pb
kp_pinslist.pb
RevisitationBloomfilter
RevisitationBloomfilter~RFe5a7716.TMP
Filtering Rules
LICENSE
typosquatting_list.pb
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
ipm.corel[1].xml
ipm.corel[1].xml
ipm.corel[1].xml
ipm.corel[1].xml
thumbcache_idx.db
thumbcache_idx.db
thumbcache_idx.db
thumbcache_idx.db
thumbcache_idx.db
thumbcache_idx.db
thumbcache_idx.db
thumbcache_idx.db
thumbcache_idx.db
thumbcache_idx.db
thumbcache_idx.db
thumbcache_idx.db
thumbcache_idx.db
thumbcache_idx.db
thumbcache_idx.db
thumbcache_idx.db
thumbcache_idx.db
thumbcache_idx.db
thumbcache_idx.db
thumbcache_idx.db
thumbcache_idx.db
thumbcache_idx.db
thumbcache_idx.db
thumbcache_idx.db
thumbcache_idx.db
thumbcache_idx.db
thumbcache_idx.db
gtm[1].js
IPP_GMT_1776909348.html
log_20260423015528.txt
installer_log_20260423015514.txt
Load.html
common.css
jquery-ui.css
button-normal.png
centerImg.png
close-normal.png
footerImg.png
headerImg.png
header_logo.png
common.js
external.js
jquery-1.11.2.min.js
jquery-ui.min.js
config.js
installerlist.js
installparams.js
stubparams.js
features.js
page.html
page.js
features.js
page.html
page.js
features.js
page.html
page.js
features.js
page.html
page.js
features.js
page.html
page.js
page.js
features.js
page.html
page.js
settings.dat
the-real-index
the-real-index
data_0
data_1
data_2
data_3
Local State
Local State
Local State
Local State
Local State~RFe5b7982.TMP
WzRecipientsCache.db
f01b4d95cf55d32a.automaticDestinations-ms
db53b23fd1edbd46.customDestinations-ms
appmanifest_1457220.acf:Zone.Identifier
clienticon.ico
page_bg_raw.jpg
RobinMorningwoodAdventurev2.0.11Build14335285.7z:Zone.Identifier
winzip77-bing.exe.crdownload
winzip77-bing.exe:Zone.Identifier
WinZip Duplicate File Finder.lnk
WinZip Duplicate File Finder.lnk~RFe5b1a6a.TMP
WinZip Image Manager.lnk
WinZip Image Manager.lnk
WinZip PDF Express.lnk
WinZip PDF Express.lnk~RFe5b1aa9.TMP
WinZip SafeShare.lnk
WinZip SafeShare.lnk~RFe5b1ac8.TMP
WinZip Secure Backup.lnk
WinZip Secure Backup.lnk~RFe5b1ae7.TMP
WinZip.lnk
WinZip.lnk~RFe5b1a2c.TMP
MSIF0CA.tmp
MSIF119.tmp
MSIF15B.tmp
DupFFStub64_Shortcut_Desktop.ico
ImgUtilStub64_Shortcut_Desktop.ico
PdfUtilStub64_Shortcut_Desktop.ico
SafeShareStub64_Shortcut_Desktop.ico
SbkupStub64_ShortCut_StartMenu.ico
WinZip64_Shortcut_MenuGroup.ico
manifest.json
keys.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
edge_checkout_page_validator.js
manifest.json
data.txt
manifest.json
metadata-2
{180c3c1e-a144-4890-87be-f6411f03aa4b}_OnDiskSnapshotProp
memory/1056-2185-0x0000021522170000-0x000002152217E000-memory.dmp
memory/1056-2187-0x0000021522120000-0x000002152212C000-memory.dmp
memory/1192-1765-0x00007FFBCAD00000-0x00007FFBCAD1E000-memory.dmp
memory/1192-1789-0x000001E1E5260000-0x000001E1E5268000-memory.dmp
memory/1192-1779-0x000001E1E5240000-0x000001E1E524E000-memory.dmp
memory/1192-1780-0x000001E1E7980000-0x000001E1E79B8000-memory.dmp
memory/1192-1768-0x000001E1E5290000-0x000001E1E547E000-memory.dmp
memory/1192-1764-0x000001E1E4F80000-0x000001E1E4F9E000-memory.dmp
memory/1192-1751-0x000001D9E2A30000-0x000001D9E2AC2000-memory.dmp
memory/1192-1748-0x000001D9CA2D0000-0x000001D9CA2DC000-memory.dmp
memory/1192-1749-0x000001D9CA300000-0x000001D9CA314000-memory.dmp
memory/1192-1747-0x00007FFBCB660000-0x00007FFBCB6A7000-memory.dmp
memory/1192-1746-0x000001D9E2840000-0x000001D9E2887000-memory.dmp
memory/1192-1841-0x000001D9C9F70000-0x000001D9C9F7C000-memory.dmp
memory/1192-1842-0x000001E1E51F0000-0x000001E1E5202000-memory.dmp
memory/1568-2160-0x0000026F5CBF0000-0x0000026F5CC86000-memory.dmp
memory/1568-2162-0x0000026F42A20000-0x0000026F42A2C000-memory.dmp
memory/1568-2159-0x0000026F424E0000-0x0000026F424F0000-memory.dmp
memory/1604-2197-0x000001FCA91F0000-0x000001FCA91FC000-memory.dmp
memory/1604-2195-0x000001FCA9240000-0x000001FCA924C000-memory.dmp
memory/1668-2497-0x00007FFBEFCD0000-0x00007FFBEFCD1000-memory.dmp
memory/1744-2242-0x0000000005DA0000-0x0000000005DBE000-memory.dmp
memory/1744-2234-0x0000000005EC0000-0x0000000006466000-memory.dmp
memory/1744-2233-0x00000000054E0000-0x000000000590A000-memory.dmp
memory/1744-2235-0x00000000059F0000-0x0000000005A82000-memory.dmp
memory/1744-2240-0x00000000059A0000-0x00000000059AA000-memory.dmp
memory/1744-2241-0x0000000005D60000-0x0000000005D96000-memory.dmp
memory/1916-2190-0x000001E51FFF0000-0x000001E520002000-memory.dmp
memory/1916-2192-0x000001E51FF90000-0x000001E51FF9C000-memory.dmp
memory/2536-2172-0x000002C52E3E0000-0x000002C52E3EC000-memory.dmp
memory/2536-2170-0x000002C5485C0000-0x000002C5485D6000-memory.dmp
memory/2600-2212-0x0000029B49F50000-0x0000029B4A188000-memory.dmp
memory/2600-2214-0x0000029B2FE50000-0x0000029B2FE5C000-memory.dmp
memory/2600-2211-0x0000029B2F880000-0x0000029B2F8BC000-memory.dmp
memory/3124-2116-0x0000000004670000-0x0000000004671000-memory.dmp
memory/3124-2117-0x00000000047B0000-0x00000000047B1000-memory.dmp
memory/3124-1788-0x00007FFBEFCD0000-0x00007FFBEFCD2000-memory.dmp
memory/3124-2426-0x0000000005230000-0x0000000005231000-memory.dmp
memory/3184-1177-0x0000000009A60000-0x0000000009AC0000-memory.dmp
memory/3184-1142-0x0000000009A60000-0x0000000009AC0000-memory.dmp
memory/3184-3025-0x0000000009C50000-0x0000000009CF0000-memory.dmp
memory/3184-3024-0x0000000009A60000-0x0000000009AC0000-memory.dmp
memory/3184-1178-0x0000000009C50000-0x0000000009CF0000-memory.dmp
memory/3228-1823-0x0000018975220000-0x000001897528F000-memory.dmp
memory/3228-1769-0x0000018974460000-0x00000189744BA000-memory.dmp
memory/3228-1821-0x00000189751D0000-0x000001897521D000-memory.dmp
memory/3228-1819-0x0000018975160000-0x00000189751CF000-memory.dmp
memory/3228-1818-0x0000018974D00000-0x0000018974D12000-memory.dmp
memory/3228-1817-0x00000189750A0000-0x00000189750F0000-memory.dmp
memory/3228-1816-0x0000018974F60000-0x0000018974FCE000-memory.dmp
memory/3228-1811-0x0000018974F10000-0x0000018974F5D000-memory.dmp
memory/3228-1815-0x0000018975470000-0x0000018975838000-memory.dmp
memory/3228-1814-0x00007FFBB3940000-0x00007FFBB39D3000-memory.dmp
memory/3228-1812-0x00007FFBB6870000-0x00007FFBB68BD000-memory.dmp
memory/3228-1813-0x0000018975000000-0x0000018975093000-memory.dmp
memory/3228-1810-0x0000018974EA0000-0x0000018974F0F000-memory.dmp
memory/3228-1809-0x0000018974E30000-0x0000018974E93000-memory.dmp
memory/3228-1808-0x0000018974DC0000-0x0000018974E23000-memory.dmp
memory/3228-1807-0x0000018974D50000-0x0000018974DB3000-memory.dmp
memory/3228-1806-0x0000018974C70000-0x0000018974CD3000-memory.dmp
memory/3228-1869-0x000001895B6F0000-0x000001895B6FC000-memory.dmp
memory/3228-1870-0x0000018974FE0000-0x0000018974FF2000-memory.dmp
memory/3228-1843-0x00000189752D0000-0x000001897530A000-memory.dmp
memory/3228-1844-0x0000018975290000-0x00000189752B6000-memory.dmp
memory/3228-1829-0x00000189750F0000-0x000001897510C000-memory.dmp
memory/3228-1805-0x0000018974C00000-0x0000018974C63000-memory.dmp
memory/3228-1825-0x00007FFBB38C0000-0x00007FFBB3931000-memory.dmp
memory/3228-1824-0x0000018975310000-0x0000018975381000-memory.dmp
memory/3228-1804-0x0000018974B90000-0x0000018974BF6000-memory.dmp
memory/3228-1803-0x0000018974B20000-0x0000018974B8F000-memory.dmp
memory/3228-1796-0x0000018974AB0000-0x0000018974B1F000-memory.dmp
memory/3228-1792-0x00000189746F0000-0x000001897475F000-memory.dmp
memory/3228-1787-0x0000018974680000-0x00000189746EF000-memory.dmp
memory/3228-1830-0x00007FFBCB090000-0x00007FFBCB0AC000-memory.dmp
memory/3228-1831-0x00000189758F0000-0x000001897595A000-memory.dmp
memory/3228-1828-0x0000018975390000-0x0000018975404000-memory.dmp
memory/3228-1786-0x0000018976090000-0x00000189777DA000-memory.dmp
memory/3228-1826-0x0000018975840000-0x00000189758F0000-memory.dmp
memory/3228-1827-0x00007FFBB3810000-0x00007FFBB38C0000-memory.dmp
memory/3228-1778-0x0000018974610000-0x000001897467F000-memory.dmp
memory/3228-1757-0x000001895B820000-0x000001895B844000-memory.dmp
memory/3228-1776-0x0000018974770000-0x0000018974932000-memory.dmp
memory/3228-1774-0x0000018974520000-0x0000018974544000-memory.dmp
memory/3228-1775-0x00007FFBB9600000-0x00007FFBB9624000-memory.dmp
memory/3228-1773-0x00007FFBB9690000-0x00007FFBB96CA000-memory.dmp
memory/3228-1772-0x0000018974560000-0x000001897459A000-memory.dmp
memory/3228-1771-0x00007FFBCAC90000-0x00007FFBCACB4000-memory.dmp
memory/3228-1770-0x00000189744F0000-0x0000018974514000-memory.dmp
memory/3228-1822-0x00007FFBCB320000-0x00007FFBCB36D000-memory.dmp
memory/3228-1758-0x00007FFBCB040000-0x00007FFBCB064000-memory.dmp
memory/3228-1759-0x00000189742F0000-0x00000189743F8000-memory.dmp
memory/3592-2177-0x000002223A900000-0x000002223A90C000-memory.dmp
memory/3592-2175-0x00000222533D0000-0x000002225341E000-memory.dmp
memory/4072-2021-0x000001C401810000-0x000001C40181C000-memory.dmp
memory/4072-1859-0x000001C47FB30000-0x000001C47FB84000-memory.dmp
memory/4072-1857-0x000001C47FAA0000-0x000001C47FACE000-memory.dmp
memory/4072-1854-0x000001C47F650000-0x000001C47F6C0000-memory.dmp
memory/4460-2122-0x000001E587980000-0x000001E58798C000-memory.dmp
memory/4476-2371-0x00000178B2530000-0x00000178B2588000-memory.dmp
memory/4476-2368-0x00007FFBB8E70000-0x00007FFBB8EAA000-memory.dmp
memory/4476-2365-0x00000178B1E60000-0x00000178B1E84000-memory.dmp
memory/4476-2366-0x00007FFBB8EB0000-0x00007FFBB8ED4000-memory.dmp
memory/4476-2370-0x00007FFBB8DC0000-0x00007FFBB8DE4000-memory.dmp
memory/4476-2344-0x00007FFBCB920000-0x00007FFBCBA6B000-memory.dmp
memory/4476-2343-0x00000178B0FF0000-0x00000178B113B000-memory.dmp
memory/4476-2338-0x0000017897E00000-0x0000017897E47000-memory.dmp
memory/4476-2358-0x00007FFBB8F10000-0x00007FFBB8F34000-memory.dmp
memory/4476-2339-0x00007FFBCBD30000-0x00007FFBCBD77000-memory.dmp
memory/4476-2357-0x00000178B19D0000-0x00000178B19F4000-memory.dmp
memory/4476-2356-0x00000178B1960000-0x00000178B19CF000-memory.dmp
memory/4476-2725-0x00000178B2BD0000-0x00000178B2BE2000-memory.dmp
memory/4476-2367-0x00000178B2460000-0x00000178B249A000-memory.dmp
memory/4476-2375-0x00000178B2900000-0x00000178B2964000-memory.dmp
memory/4476-2724-0x0000017897950000-0x000001789795C000-memory.dmp
memory/4476-2377-0x00000178B29E0000-0x00000178B2A4F000-memory.dmp
memory/4476-2369-0x00000178B24A0000-0x00000178B24C4000-memory.dmp
memory/4476-2372-0x00000178B2600000-0x00000178B266F000-memory.dmp
memory/4800-1777-0x00000222406B0000-0x00000222406BC000-memory.dmp
memory/5028-2180-0x0000014B76110000-0x0000014B7615E000-memory.dmp
memory/5028-2182-0x0000014B5D830000-0x0000014B5D83C000-memory.dmp
memory/5232-2578-0x00007FFBEFCD0000-0x00007FFBEFCD1000-memory.dmp
memory/5588-2167-0x00000134436F0000-0x00000134436FC000-memory.dmp
memory/5588-2165-0x000001345BE00000-0x000001345BE0E000-memory.dmp
memory/5608-2473-0x0000026661A00000-0x0000026661A0C000-memory.dmp
memory/5608-2376-0x00007FFBB8F10000-0x00007FFBB8F34000-memory.dmp
memory/5608-2474-0x000002667B0C0000-0x000002667B0D2000-memory.dmp
memory/5628-1743-0x000001F0D9E40000-0x000001F0D9E62000-memory.dmp
memory/6072-3231-0x00000280DC7F0000-0x00000280DC7FC000-memory.dmp
memory/6072-27926-0x00000280DC7F0000-0x00000280DC7FC000-memory.dmp
memory/6516-27928-0x00000279890F0000-0x0000027989102000-memory.dmp
memory/6516-27927-0x00000279886E0000-0x00000279886EC000-memory.dmp
memory/6616-3741-0x000002046FAF0000-0x000002046FAFC000-memory.dmp
memory/7152-2988-0x0000011018560000-0x000001101856C000-memory.dmp