Analysis
- user interaction
yes - max time kernel
476s - max time network
460s - platform
windows10-2004_x64 - resource
win10v2004-20250619-en - resource tags
- submitted
08/05/2026, 17:17
General
- Target Rise_v6_New_(1).rar.html
- Size 38KB
- Sample260508-vt1a2abt2v
- SHA256 86d36b94bf351741aa4853b1634a558f72feb40b00b13d2147e792def5ab6285
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file 2 IoCs
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 26 IoCs
- Loads dropped DLL 64 IoCs
- Modifies system executable filetype association 2 TTPs 8 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Installs/modifies Browser Helper Object 2 TTPs 6 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
- Drops file in System32 directory 64 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Checks processor information in registry 2 TTPs 21 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 6 IoCs
- Modifies Internet Explorer Phishing Filter 1 TTPs 1 IoCs
- Modifies Internet Explorer settings 1 TTPs 38 IoCs
- Modifies data under HKEY_USERS 64 IoCs
- Modifies registry class 64 IoCs
- Suspicious behavior: EnumeratesProcesses 22 IoCs
- Suspicious behavior: GetForegroundWindowSpam 3 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 24 IoCs
- Suspicious use of SetWindowsHookEx 42 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Rise_v6_New_(1).rar.html1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7fff8efcf208,0x7fff8efcf214,0x7fff8efcf2202⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1936,i,6629038592023517549,16830905904812014938,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:32⤵
- Downloads MZ/PE file
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2280,i,6629038592023517549,16830905904812014938,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2640,i,6629038592023517549,16830905904812014938,262144 --variations-seed-version --mojo-platform-channel-handle=2632 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3448,i,6629038592023517549,16830905904812014938,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3440,i,6629038592023517549,16830905904812014938,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=5124,i,6629038592023517549,16830905904812014938,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=5128,i,6629038592023517549,16830905904812014938,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=564,i,6629038592023517549,16830905904812014938,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=6064,i,6629038592023517549,16830905904812014938,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=6016,i,6629038592023517549,16830905904812014938,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=5712,i,6629038592023517549,16830905904812014938,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=5248,i,6629038592023517549,16830905904812014938,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=5372,i,6629038592023517549,16830905904812014938,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=6032,i,6629038592023517549,16830905904812014938,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=5752,i,6629038592023517549,16830905904812014938,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=5944,i,6629038592023517549,16830905904812014938,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations --always-read-main-dll --field-trial-handle=6280,i,6629038592023517549,16830905904812014938,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --string-annotations --always-read-main-dll --field-trial-handle=5700,i,6629038592023517549,16830905904812014938,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=7084,i,6629038592023517549,16830905904812014938,262144 --variations-seed-version --mojo-platform-channel-handle=7104 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=7140,i,6629038592023517549,16830905904812014938,262144 --variations-seed-version --mojo-platform-channel-handle=7156 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=7084,i,6629038592023517549,16830905904812014938,262144 --variations-seed-version --mojo-platform-channel-handle=7104 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=7152,i,6629038592023517549,16830905904812014938,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=7244,i,6629038592023517549,16830905904812014938,262144 --variations-seed-version --mojo-platform-channel-handle=7192 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --field-trial-handle=7488,i,6629038592023517549,16830905904812014938,262144 --variations-seed-version --mojo-platform-channel-handle=7164 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --string-annotations --always-read-main-dll --field-trial-handle=5044,i,6629038592023517549,16830905904812014938,262144 --variations-seed-version --mojo-platform-channel-handle=7608 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --field-trial-handle=5060,i,6629038592023517549,16830905904812014938,262144 --variations-seed-version --mojo-platform-channel-handle=7644 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=8156,i,6629038592023517549,16830905904812014938,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\jre-8u491-windows-x64.exe"C:\Users\Admin\Downloads\jre-8u491-windows-x64.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\jds240658437.tmp\jre-8u491-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\jds240658437.tmp\jre-8u491-windows-x64.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Java\jre1.8.0_491\bin\javaw.exe-Djdk.disableLastUsageTracking -cp "C:\Program Files\Java\jre1.8.0_491\bin\..\lib\deploy.jar" com.sun.deploy.panel.ControlPanel -getUserWebJavaStatus4⤵
- Executes dropped EXE
-
-
C:\Program Files\Java\jre1.8.0_491\bin\javaw.exe-Djdk.disableLastUsageTracking -cp "C:\Program Files\Java\jre1.8.0_491\bin\..\lib\deploy.jar" com.sun.deploy.panel.ControlPanel -getUserPreviousDecisionsExist 304⤵
- Executes dropped EXE
-
-
C:\Program Files\Java\jre1.8.0_491\bin\javaw.exe-Djdk.disableLastUsageTracking -cp "C:\Program Files\Java\jre1.8.0_491\bin\..\lib\deploy.jar" com.sun.deploy.panel.ControlPanel -systemConfig deployment.expiration.check.enabled false4⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Users\Admin\Downloads\jre-8u491-windows-x64.exe"C:\Users\Admin\Downloads\jre-8u491-windows-x64.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\jds240658453.tmp\jre-8u491-windows-x64.exe"C:\Users\Admin\AppData\Local\Temp\jds240658453.tmp\jre-8u491-windows-x64.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=6004,i,6629038592023517549,16830905904812014938,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=6368,i,6629038592023517549,16830905904812014938,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --string-annotations --always-read-main-dll --field-trial-handle=6408,i,6629038592023517549,16830905904812014938,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=6932,i,6629038592023517549,16830905904812014938,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=5176,i,6629038592023517549,16830905904812014938,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=5096,i,6629038592023517549,16830905904812014938,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --field-trial-handle=6616,i,6629038592023517549,16830905904812014938,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --field-trial-handle=6008,i,6629038592023517549,16830905904812014938,262144 --variations-seed-version --mojo-platform-channel-handle=7888 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --string-annotations --always-read-main-dll --field-trial-handle=4648,i,6629038592023517549,16830905904812014938,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=7020,i,6629038592023517549,16830905904812014938,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=7688,i,6629038592023517549,16830905904812014938,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations --always-read-main-dll --field-trial-handle=4828,i,6629038592023517549,16830905904812014938,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --field-trial-handle=3780,i,6629038592023517549,16830905904812014938,262144 --variations-seed-version --mojo-platform-channel-handle=3984 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --field-trial-handle=3772,i,6629038592023517549,16830905904812014938,262144 --variations-seed-version --mojo-platform-channel-handle=7616 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --field-trial-handle=8188,i,6629038592023517549,16830905904812014938,262144 --variations-seed-version --mojo-platform-channel-handle=3408 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --field-trial-handle=7940,i,6629038592023517549,16830905904812014938,262144 --variations-seed-version --mojo-platform-channel-handle=1660 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=3816,i,6629038592023517549,16830905904812014938,262144 --variations-seed-version --mojo-platform-channel-handle=7700 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=6196,i,6629038592023517549,16830905904812014938,262144 --variations-seed-version --mojo-platform-channel-handle=3956 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=3952,i,6629038592023517549,16830905904812014938,262144 --variations-seed-version --mojo-platform-channel-handle=3928 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --field-trial-handle=3968,i,6629038592023517549,16830905904812014938,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --field-trial-handle=3924,i,6629038592023517549,16830905904812014938,262144 --variations-seed-version --mojo-platform-channel-handle=3956 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --field-trial-handle=3560,i,6629038592023517549,16830905904812014938,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --field-trial-handle=6704,i,6629038592023517549,16830905904812014938,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --string-annotations --always-read-main-dll --field-trial-handle=6712,i,6629038592023517549,16830905904812014938,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --field-trial-handle=7280,i,6629038592023517549,16830905904812014938,262144 --variations-seed-version --mojo-platform-channel-handle=7560 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=7176,i,6629038592023517549,16830905904812014938,262144 --variations-seed-version --mojo-platform-channel-handle=8424 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\winrar-x64-722.exe"C:\Users\Admin\Downloads\winrar-x64-722.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\WinRAR\uninstall.exe"C:\Program Files\WinRAR\uninstall.exe" /setup3⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=7828,i,6629038592023517549,16830905904812014938,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window2⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x214,0x7fff8efcf208,0x7fff8efcf214,0x7fff8efcf2203⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1820,i,12222359548304100858,10600382303431591578,262144 --variations-seed-version --mojo-platform-channel-handle=2160 /prefetch:33⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2132,i,12222359548304100858,10600382303431591578,262144 --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2612,i,12222359548304100858,10600382303431591578,262144 --variations-seed-version --mojo-platform-channel-handle=2748 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=4304,i,12222359548304100858,10600382303431591578,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=4320,i,12222359548304100858,10600382303431591578,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=4320,i,12222359548304100858,10600382303431591578,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=2692,i,12222359548304100858,10600382303431591578,262144 --variations-seed-version --mojo-platform-channel-handle=4676 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=4672,i,12222359548304100858,10600382303431591578,262144 --variations-seed-version --mojo-platform-channel-handle=4696 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=4688,i,12222359548304100858,10600382303431591578,262144 --variations-seed-version --mojo-platform-channel-handle=4752 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=4976,i,12222359548304100858,10600382303431591578,262144 --variations-seed-version --mojo-platform-channel-handle=4696 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=4992,i,12222359548304100858,10600382303431591578,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=4996,i,12222359548304100858,10600382303431591578,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=764,i,12222359548304100858,10600382303431591578,262144 --variations-seed-version --mojo-platform-channel-handle=1560 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=5116,i,12222359548304100858,10600382303431591578,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=5040,i,12222359548304100858,10600382303431591578,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=4732,i,12222359548304100858,10600382303431591578,262144 --variations-seed-version --mojo-platform-channel-handle=4044 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=3792,i,12222359548304100858,10600382303431591578,262144 --variations-seed-version --mojo-platform-channel-handle=4704 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations --always-read-main-dll --field-trial-handle=4708,i,12222359548304100858,10600382303431591578,262144 --variations-seed-version --mojo-platform-channel-handle=4024 /prefetch:83⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"1⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding D529005C1E6A6591E093FE24717ADA682⤵
- Loads dropped DLL
- Drops file in Program Files directory
-
-
C:\Windows\Installer\MSIB82F.tmp"C:\Windows\Installer\MSIB82F.tmp" INSTALLDIR="C:\Program Files\Java\jre-1.8\\" ProductCode={77924AE4-039E-4CA4-87B4-2F64180381F0} /s2⤵
- Executes dropped EXE
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe"C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe" -u auto-update3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding D9CD3F92A8262D06A7C4E41710DA9C19 E Global\MSI00002⤵
-
-
C:\Program Files\Java\jre1.8.0_491\installer.exe"C:\Program Files\Java\jre1.8.0_491\installer.exe" /s INSTALLDIR="C:\Program Files\Java\jre1.8.0_491\\" WEB_ANALYTICS=Disable EULA=Disable INSTALL_SILENT=1 AUTO_UPDATE=Disable SPONSORS=Disable REPAIRMODE=0 ProductCode={71024AE4-039E-4CA4-87B4-2F64180491F0} TMPPINGFILE=C:\Users\Admin\AppData\Local\Temp\jdsping240659328.tmp2⤵
- Executes dropped EXE
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- System Network Configuration Discovery: Internet Connection Discovery
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
-
C:\Program Files\Java\jre1.8.0_491\bin\javaw.exe"C:\Program Files\Java\jre1.8.0_491\bin\javaw.exe" -Xshare:dump -Djdk.disableLastUsageTracking3⤵
- Executes dropped EXE
-
-
C:\Program Files\Java\jre1.8.0_491\bin\ssvagent.exe"C:\Program Files\Java\jre1.8.0_491\bin\ssvagent.exe" -doHKCUSSVSetup3⤵
- Executes dropped EXE
- Modifies registry class
-
-
C:\Program Files\Java\jre1.8.0_491\bin\javaws.exe"C:\Program Files\Java\jre1.8.0_491\bin\javaws.exe" -wait -fix -permissions -silent3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Java\jre1.8.0_491\bin\jp2launcher.exe"C:\Program Files\Java\jre1.8.0_491\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files\Java\jre1.8.0_491" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfNDkxXGxpYlxkZXBsb3kuamFyAC1EamF2YS5zZWN1cml0eS5wb2xpY3k9ZmlsZTpDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfNDkxXGxpYlxzZWN1cml0eVxqYXZhd3MucG9saWN5AC1EdHJ1c3RQcm94eT10cnVlAC1YdmVyaWZ5OnJlbW90ZQAtRGpubHB4LmhvbWU9QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZTEuOC4wXzQ5MVxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUxLjguMF80OTFcbGliXGphdmF3cy5qYXI7QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZTEuOC4wXzQ5MVxsaWJcZGVwbG95LmphcjtDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfNDkxXGxpYlxwbHVnaW4uamFyAC1EamF2YS5hd3QuaGVhZGxlc3M9dHJ1ZQAtRGpubHB4Lmp2bT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfNDkxXGJpblxqYXZhdy5leGU= -ma LXdhaXQALWZpeAAtcGVybWlzc2lvbnMALXNpbGVudAAtbm90V2ViSmF2YQ==4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files\Java\jre1.8.0_491\bin\javaws.exe"C:\Program Files\Java\jre1.8.0_491\bin\javaws.exe" -wait -fix -shortcut -silent3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Java\jre1.8.0_491\bin\jp2launcher.exe"C:\Program Files\Java\jre1.8.0_491\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files\Java\jre1.8.0_491" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfNDkxXGxpYlxkZXBsb3kuamFyAC1EamF2YS5zZWN1cml0eS5wb2xpY3k9ZmlsZTpDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfNDkxXGxpYlxzZWN1cml0eVxqYXZhd3MucG9saWN5AC1EdHJ1c3RQcm94eT10cnVlAC1YdmVyaWZ5OnJlbW90ZQAtRGpubHB4LmhvbWU9QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZTEuOC4wXzQ5MVxiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmUxLjguMF80OTFcbGliXGphdmF3cy5qYXI7QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZTEuOC4wXzQ5MVxsaWJcZGVwbG95LmphcjtDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfNDkxXGxpYlxwbHVnaW4uamFyAC1EamF2YS5hd3QuaGVhZGxlc3M9dHJ1ZQAtRGpubHB4Lmp2bT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlMS44LjBfNDkxXGJpblxqYXZhdy5leGU= -ma LXdhaXQALWZpeAAtc2hvcnRjdXQALXNpbGVudAAtbm90V2ViSmF2YQ==4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A31F53E2031555D17DE1BABCCE550C8D2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding AF5B42E49F9633B8769B5979D19CE144 E Global\MSI00002⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 3BFDE8E6DCEC8AA0AEB9E9ADF69D63692⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 089131E95F9711114F4AB4EDD59301FA E Global\MSI00002⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,Control_RunDLL C:\Windows\System32\inetcpl.cpl ,1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
-
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\Rise v6 New (1).rar"1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Rar$DIa3716.12635.rartemp\Start For Window.cmd" "2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Rar$DIa3716.13457.rartemp\Start For Window.cmd" "2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Rar$DIa3716.13721.rartemp\Start For Window.cmd" "2⤵
-
-
C:\Program Files\WinRAR\WinRAR.exe"C:\Program Files\WinRAR\WinRAR.exe" x -iext -ver -imon1 -- "C:\Users\Admin\Desktop\Rise v6 New (1).rar" "C:\Users\Admin\Desktop\Rise v6 New (1)\"1⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\Rise v6 New (1)\Start For Window.cmd" "1⤵
-
C:\Users\Admin\Desktop\Rise v6 New (1)\files\dependants\windows\jdk-22\bin\java.exedependants\windows\jdk-22\bin\java.exe -jar Launcher.jar2⤵
- Executes dropped EXE
- Checks processor information in registry
-
-
C:\Users\Admin\Desktop\Rise v6 New (1)\files\dependants\windows\jdk-22\bin\java.exe..\files\dependants\windows\jdk-22\bin\java.exe -noverify -Xms4096m -XX:+DisableAttachMechanism -Xmx4g -Djava.library.path=..\files\dependants\windows\1.8.9-natives -cp "..\files\Standalone.jar;..\files\Libraries.jar;lwjgl.jar;lwjgl_util.jar" Start2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Checks processor information in registry
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\Rise v6 New (1)\Start For Window.cmd" "1⤵
-
C:\Users\Admin\Desktop\Rise v6 New (1)\files\dependants\windows\jdk-22\bin\java.exedependants\windows\jdk-22\bin\java.exe -jar Launcher.jar2⤵
- Executes dropped EXE
- Checks processor information in registry
-
-
C:\Users\Admin\Desktop\Rise v6 New (1)\files\dependants\windows\jdk-22\bin\java.exe..\files\dependants\windows\jdk-22\bin\java.exe -noverify -Xms4096m -XX:+DisableAttachMechanism -Xmx4g -Djava.library.path=..\files\dependants\windows\1.8.9-natives -cp "..\files\Standalone.jar;..\files\Libraries.jar;lwjgl.jar;lwjgl_util.jar" Start2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Checks processor information in registry
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\Rise v6 New (1)\Start For Window.cmd" "1⤵
-
C:\Users\Admin\Desktop\Rise v6 New (1)\files\dependants\windows\jdk-22\bin\java.exedependants\windows\jdk-22\bin\java.exe -jar Launcher.jar2⤵
- Executes dropped EXE
- Checks processor information in registry
-
-
C:\Users\Admin\Desktop\Rise v6 New (1)\files\dependants\windows\jdk-22\bin\java.exe..\files\dependants\windows\jdk-22\bin\java.exe -noverify -Xms4096m -XX:+DisableAttachMechanism -Xmx4g -Djava.library.path=..\files\dependants\windows\1.8.9-natives -cp "..\files\Standalone.jar;..\files\Libraries.jar;lwjgl.jar;lwjgl_util.jar" Start2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Checks processor information in registry
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Browser Extensions
1Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
e5bab45.rbs
e5bac64.rbs
e5bac68.rbs
e5bac6d.rbs
Uninstall.exe
manifest.json
manifest.json
LICENSE
manifest.json
manifest.fingerprint
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
edge_checkout_page_validator.js
manifest.json
manifest.json
hyph-as.hyb
hyph-hi.hyb
hyph-nb.hyb
manifest.json
crs.pb
manifest.json
manifest.json
Reference Documentation.url
Get Help.url
Visit Java.com.url
protocols.json
autofill_bypass_cache_forms.json
edge_autofill_global_block_list.json
v1FieldTypes.json
settings.dat
settings.dat
settings.dat
f_000056
f_000057
f_000058
f_000059
f_00005a
f_00005b
f_00005c
f_00005e
f_00005f
f_000060
f_000061
f_000062
f_000063
f_000064
f_000065
f_000067
f_000068
f_000069
f_00006b
f_00006c
f_000074
f_000078
f_00007c
f_00007d
f_000081
f_000082
f_000083
f_000085
f_000086
f_000087
f_00009b
f_0000aa
f_0000ad
f_0000ae
f_0000af
f_0000b0
f_0000b1
f_0000ca
f_0000cb
f_0000d0
f_0000d4
f_0000db
f_0000dc
f_0000e3
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe589517.TMP
SiteList-Enterprise.json
HubApps
000003.log
CURRENT
LOG
MANIFEST-000001
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Sdch Dictionaries
Sdch Dictionaries
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
Secure Preferences
089e66376f63bbec_0
089e66376f63bbec_1
13e83bd1c1ab1541_0
153bba9a429a2c40_0
15986f5b4987b6a6_0
15986f5b4987b6a6_1
1ddc67ccdb6501b5_0
1ddc67ccdb6501b5_1
217bbc87393d2e57_0
264b46d61d915def_0
29e59e735013892c_0
29e59e735013892c_1
2a99e21c738e2a0b_0
2bb582fd7577f97e_0
2e08a9c6ec333021_0
321e64ecacb66619_0
348aae4f13c8f553_0
39c763e560200cda_0
4b23cbf46778b9bc_0
4b23cbf46778b9bc_1
50f14f6390dd155a_0
50f14f6390dd155a_1
57cdff68f0382690_0
57cdff68f0382690_1
5e44a7f4adb70c29_0
6aa48089ea1abea9_0
6aa48089ea1abea9_1
6dcb70bdb8fe40a3_0
74ddcb575e5c21a6_0
74ddcb575e5c21a6_1
7ed93a10144ac834_0
81aefee3f09b918b_0
81aefee3f09b918b_1
85f220494be669b7_0
8bfc77f05f6a3cc5_0
8cce886514f2b2ec_0
8fdcb7992c9e741c_0
95fcbb4ef0998598_0
9f97c8dd99a7773d_0
ac0fca45321fd75c_0
ac0fca45321fd75c_1
b6a609a2a4d72ee3_0
b7cd751a99c70c48_0
b87cf2f2b0511c4c_0
b9dcc9f4c807eeaa_0
c95d30c9d70f69cd_0
d6af3918ca46ca94_0
dd1d9f7425e5aefb_0
e1d0714cd92bc9db_0
e1d0714cd92bc9db_1
ed344a77138c223d_0
ff5222d57552b6c1_0
the-real-index
the-real-index
the-real-index
todelete_04a139df562abfb6_0_1
todelete_04a139df562abfb6_1_1
todelete_095b46367ab49088_0_1
todelete_095b46367ab49088_1_1
todelete_12fd58f3a6ed44f7_0_1
todelete_12fd58f3a6ed44f7_1_1
todelete_205fcfbdb983cd3a_0_1
todelete_205fcfbdb983cd3a_1_1
todelete_27f27acfb30af1fd_0_1
todelete_27f27acfb30af1fd_1_1
todelete_34e03f230b3650e2_0_1
todelete_34e03f230b3650e2_1_1
todelete_3ef081b6e8f31128_0_1
todelete_3ef081b6e8f31128_1_1
todelete_46d7aea8bb4be4a1_0_1
todelete_46d7aea8bb4be4a1_1_1
todelete_478ae91ed41b145c_0_1
todelete_478ae91ed41b145c_1_1
todelete_5532370e78aaf6ac_0_1
todelete_5532370e78aaf6ac_1_1
todelete_5bbb35ca6a42157b_0_1
todelete_5bbb35ca6a42157b_1_1
todelete_5f3dac5e958a9b96_0_1
todelete_5f3dac5e958a9b96_1_1
todelete_66f80f89991ce3c0_0_1
todelete_66f80f89991ce3c0_1_1
todelete_73ef7f5da4fe40ea_0_1
todelete_73ef7f5da4fe40ea_1_1
todelete_7f89e53121a5de82_0_1
todelete_7f89e53121a5de82_1_1
todelete_80ff1193dfe38aea_0_1
todelete_80ff1193dfe38aea_1_1
todelete_8202dead2a74343e_0_1
todelete_8202dead2a74343e_1_1
todelete_8565974ec15a8760_0_1
todelete_8565974ec15a8760_1_1
todelete_89dc05cdaa5fbdf4_0_1
todelete_89dc05cdaa5fbdf4_1_1
todelete_8c353b6491c63b35_0_1
todelete_8c353b6491c63b35_1_1
todelete_93d093dcb79c851f_0_1
todelete_93d093dcb79c851f_1_1
todelete_9b80876d68396a75_0_1
todelete_9b80876d68396a75_1_1
todelete_9c4423d981d35afd_0_1
todelete_9c4423d981d35afd_1_1
todelete_a563e5cdadbea12c_0_1
todelete_a563e5cdadbea12c_1_1
todelete_b048e88379d5fd1b_0_1
todelete_b048e88379d5fd1b_1_1
todelete_b0a991099fcb57a2_0_1
todelete_b0a991099fcb57a2_1_1
todelete_b21b35002a8fca9c_0_1
todelete_b21b35002a8fca9c_1_1
todelete_b4ad4dd0f86d45e4_0_1
todelete_b4ad4dd0f86d45e4_1_1
todelete_b6bc4e4483928f1e_0_1
todelete_b6bc4e4483928f1e_1_1
todelete_c14ba9386034e03c_0_1
todelete_c14ba9386034e03c_1_1
todelete_c48a91fe735aa12a_0_1
todelete_c48a91fe735aa12a_1_1
todelete_c4bbff8cdb4dc327_0_1
todelete_c4bbff8cdb4dc327_1_1
todelete_d4e736ea71d79649_0_1
todelete_d4e736ea71d79649_1_1
todelete_d679fff785e18b55_0_1
todelete_d679fff785e18b55_1_1
todelete_d70a3c03007f008e_0_1
todelete_d70a3c03007f008e_1_1
todelete_de034fd73d1ff2b5_0_1
todelete_de034fd73d1ff2b5_1_1
todelete_df738f1c5797e201_0_1
todelete_df738f1c5797e201_1_1
todelete_e0e6825be37cc859_0_1
todelete_e0e6825be37cc859_1_1
todelete_e49f1fd345623b31_0_1
todelete_e49f1fd345623b31_1_1
todelete_e776776a94d96167_0_1
todelete_e776776a94d96167_1_1
todelete_f05d16d9d97086ee_0_1
todelete_f05d16d9d97086ee_1_1
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe58747f.TMP
the-real-index
the-real-index
the-real-index
the-real-index~RFe5828c1.TMP
todelete_ee91b116cc2005be_0_1
index.txt
index.txt
index.txt
the-real-index
the-real-index
the-real-index
the-real-index~RFe57e733.TMP
MANIFEST-000001
sync_diagnostic.log
beb230d7-cd7a-466b-9523-5faac5c47289.tmp
data.txt
CloudConfigLog
CloudConfigLog
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
ct_config.pb
kp_pinslist.pb
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter~RFe5844e4.TMP
data_1
Staging
keys.json
typosquatting_list.pb
well_known_domains.dll
ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Start For Window.cmd
jusched.log
jusched.log
jusched.log
jusched.log
jusched.log
jusched.log
jusched.log
jusched.log
jusched.log
jusched.log
ccba5a5986c77e43.customDestinations-ms
ADDITIONAL_LICENSE_INFO
ASSEMBLY_EXCEPTION
LICENSE
java.exe
default_US_export.policy
sound.properties
COPYRIGHT
LICENSE
mesa3d.md
winrar-x64-722.exe
MSI2679.tmp
MSI27A6.tmp
MSIAE40.tmp
MSIC7F0.tmp
e5bac6a.msi
memory/740-4530-0x0000021E75280000-0x0000021E7531B000-memory.dmp
memory/1140-6505-0x000001D0D29F0000-0x000001D0D2A0D000-memory.dmp
memory/1140-6501-0x000001D0B6DB0000-0x000001D0B6DB1000-memory.dmp
memory/1140-6504-0x000001D0B6DB0000-0x000001D0B6DB1000-memory.dmp
memory/1440-5835-0x0000022867EE0000-0x0000022867EE1000-memory.dmp
memory/1616-6133-0x000001F88FF40000-0x000001F88FF41000-memory.dmp
memory/1616-6094-0x000001F88FF40000-0x000001F88FF41000-memory.dmp
memory/1616-6107-0x000001F88FF40000-0x000001F88FF41000-memory.dmp
memory/1616-6134-0x000001F88FE80000-0x000001F88FF1B000-memory.dmp
memory/1856-6010-0x0000014500120000-0x00000145001BB000-memory.dmp
memory/1856-6175-0x0000014500120000-0x00000145001BB000-memory.dmp
memory/2204-4544-0x000001BFA40B0000-0x000001BFA414B000-memory.dmp
memory/2608-6047-0x000002786BB20000-0x000002786BB21000-memory.dmp
memory/2608-6034-0x000002786BB20000-0x000002786BB21000-memory.dmp
memory/2608-6077-0x000002786BB20000-0x000002786BB21000-memory.dmp
memory/2608-6078-0x000002786BA10000-0x000002786BAAB000-memory.dmp
memory/2652-5462-0x0000025ADE190000-0x0000025ADE19C000-memory.dmp
memory/2652-5461-0x0000025ADE050000-0x0000025ADE0EB000-memory.dmp
memory/2920-6541-0x000001E2D0B30000-0x000001E2D0BCB000-memory.dmp
memory/3172-6020-0x0000021616E00000-0x0000021616E9B000-memory.dmp
memory/3716-6353-0x000001D52CFA0000-0x000001D52D03B000-memory.dmp
memory/3716-6603-0x00000204723C0000-0x000002047245B000-memory.dmp
memory/3716-6552-0x0000020475970000-0x000002047597C000-memory.dmp
memory/3716-6604-0x0000020475970000-0x000002047597C000-memory.dmp
memory/3716-6551-0x00000204723C0000-0x000002047245B000-memory.dmp
memory/3812-6322-0x000001D5FFE10000-0x000001D5FFE2D000-memory.dmp
memory/3812-6321-0x000001D5F30C0000-0x000001D5F30C1000-memory.dmp
memory/3812-6319-0x000001D5F30C0000-0x000001D5F30C1000-memory.dmp
memory/3868-8440-0x000002A3BE3E0000-0x000002A3BE3EC000-memory.dmp
memory/3868-8439-0x000002A3BE3F0000-0x000002A3BE48B000-memory.dmp
memory/3956-5382-0x00000235E7860000-0x00000235E78FB000-memory.dmp
memory/4240-3286-0x0000027E738B0000-0x0000027E7394B000-memory.dmp
memory/4372-6522-0x0000028E683D0000-0x0000028E683DC000-memory.dmp
memory/4372-2306-0x0000028E66400000-0x0000028E6649B000-memory.dmp
memory/4372-2307-0x0000028E683D0000-0x0000028E683DC000-memory.dmp
memory/4372-6521-0x0000028E66400000-0x0000028E6649B000-memory.dmp
memory/4548-5603-0x0000026F40EA0000-0x0000026F40F3B000-memory.dmp
memory/4548-6174-0x0000026F40EA0000-0x0000026F40F3B000-memory.dmp
memory/4560-6135-0x00000188856F0000-0x000001888578B000-memory.dmp
memory/5052-1950-0x000001C6E6880000-0x000001C6E691B000-memory.dmp
memory/5056-8645-0x000001BBC2050000-0x000001BBC205C000-memory.dmp
memory/5164-8493-0x000001F244240000-0x000001F24424C000-memory.dmp
memory/5696-6140-0x000002D01EDC0000-0x000002D01EE5B000-memory.dmp
memory/5832-6079-0x000002DC44A30000-0x000002DC44ACB000-memory.dmp
memory/5840-8613-0x0000024646050000-0x000002464605C000-memory.dmp
memory/6108-6307-0x0000021F2B4F0000-0x0000021F2B4F1000-memory.dmp
memory/6108-6308-0x0000021F47150000-0x0000021F4716D000-memory.dmp
memory/6108-6302-0x0000021F2B4F0000-0x0000021F2B4F1000-memory.dmp