Analysis
- user interaction
yes - max time kernel
1029s - max time network
1012s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
12/07/2026, 16:28
General
- Target https://kimochi.info/%E5%AF%BE%E6%B1%BA%EF%BC%81%E8%87%AA%E7%A7%B0%E9%96%A2%E8%A5%BF%E3%82%A4%E3%83%81%E3%81%AE%E7%BE%8E%E5%B0%91%E5%A5%B3%E9%99%A4%E9%9C%8A%E5%B8%ABvs%E6%9C%80%E5%BC%B7%E3%83%89%E5%A4%89%E6%85%8B#downloads
- Sample260712-tyslbae171
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
- Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 33 IoCs
- Loads dropped DLL 64 IoCs
- Modifies system executable filetype association 2 TTPs 16 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 3 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops desktop.ini file(s) 3 IoCs
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Network Share Discovery 1 TTPs
Attempt to gather information on host network.
- Drops file in System32 directory 6 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 15 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 9 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 10 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 9 IoCs
- Modifies Internet Explorer settings 1 TTPs 64 IoCs
- Modifies data under HKEY_USERS 64 IoCs
- Modifies registry class 64 IoCs
- Modifies system certificate store 2 TTPs 3 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 5 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 29 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookAW 3 IoCs
- Suspicious use of SetWindowsHookEx 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://kimochi.info/%E5%AF%BE%E6%B1%BA%EF%BC%81%E8%87%AA%E7%A7%B0%E9%96%A2%E8%A5%BF%E3%82%A4%E3%83%81%E3%81%AE%E7%BE%8E%E5%B0%91%E5%A5%B3%E9%99%A4%E9%9C%8A%E5%B8%ABvs%E6%9C%80%E5%BC%B7%E3%83%89%E5%A4%89%E6%85%8B#downloads2⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffe0009c188,0x7ffe0009c194,0x7ffe0009c1a03⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1828,i,8674888380285599447,3108235297737002424,524288 --field-trial-handle=2320,i,12998918865880452389,390693146218570151,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:33⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1692,i,2224189515844623093,3981086012063780385,262144 --field-trial-handle=2320,i,12998918865880452389,390693146218570151,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2480,i,2106903777012720255,18159279690275370070,524288 --field-trial-handle=2320,i,12998918865880452389,390693146218570151,262144 --variations-seed-version --mojo-platform-channel-handle=2628 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,13892040897358858352,14677379348328532716,2097152 --field-trial-handle=2320,i,12998918865880452389,390693146218570151,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,16967440128472139835,6421688296485955658,2097152 --field-trial-handle=2320,i,12998918865880452389,390693146218570151,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4296,i,9375779719338172870,9945108505088848163,2097152 --field-trial-handle=2320,i,12998918865880452389,390693146218570151,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4320,i,17293015900082857940,2271515747292589167,2097152 --field-trial-handle=2320,i,12998918865880452389,390693146218570151,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3652,i,12129889961349520461,11476942055869281975,524288 --field-trial-handle=2320,i,12998918865880452389,390693146218570151,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3656,i,15217586664216123693,5570979393713614813,524288 --field-trial-handle=2320,i,12998918865880452389,390693146218570151,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5808,i,39048040619140093,16731697019279586468,524288 --field-trial-handle=2320,i,12998918865880452389,390693146218570151,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5808,i,39048040619140093,16731697019279586468,524288 --field-trial-handle=2320,i,12998918865880452389,390693146218570151,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4396,i,590467913460752284,1869361782967117861,524288 --field-trial-handle=2320,i,12998918865880452389,390693146218570151,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4368,i,6070914953081398162,9337242213250897708,524288 --field-trial-handle=2320,i,12998918865880452389,390693146218570151,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4516,i,9621268513867413573,2918012683804031663,524288 --field-trial-handle=2320,i,12998918865880452389,390693146218570151,262144 --variations-seed-version --mojo-platform-channel-handle=4632 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4640,i,9435790053202172526,3361382846960018830,2097152 --field-trial-handle=2320,i,12998918865880452389,390693146218570151,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5408,i,13533435298117602911,151011267638634884,2097152 --field-trial-handle=2320,i,12998918865880452389,390693146218570151,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4016,i,17860834317675738017,1817666507039969292,2097152 --field-trial-handle=2320,i,12998918865880452389,390693146218570151,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6828,i,4479819783597474627,787034935541118606,2097152 --field-trial-handle=2320,i,12998918865880452389,390693146218570151,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4020,i,16360469983596494924,2478003989977011071,524288 --field-trial-handle=2320,i,12998918865880452389,390693146218570151,262144 --variations-seed-version --mojo-platform-channel-handle=6956 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6748,i,18038250039295952914,8715341777184661819,2097152 --field-trial-handle=2320,i,12998918865880452389,390693146218570151,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6820,i,7871810716323112918,815815381025124870,2097152 --field-trial-handle=2320,i,12998918865880452389,390693146218570151,262144 --variations-seed-version --mojo-platform-channel-handle=6816 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=3512,i,3099795300128955594,10734796937368839621,2097152 --field-trial-handle=2320,i,12998918865880452389,390693146218570151,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7244,i,16385717038390126285,18215542369383022523,524288 --field-trial-handle=2320,i,12998918865880452389,390693146218570151,262144 --variations-seed-version --mojo-platform-channel-handle=7308 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7300,i,9161365700073086435,14408644156742057406,2097152 --field-trial-handle=2320,i,12998918865880452389,390693146218570151,262144 --variations-seed-version --mojo-platform-channel-handle=7336 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7212,i,8012383817689993879,12615765266919224538,524288 --field-trial-handle=2320,i,12998918865880452389,390693146218570151,262144 --variations-seed-version --mojo-platform-channel-handle=7740 /prefetch:83⤵
-
-
C:\Users\Admin\Downloads\winzip77-bing.exe"C:\Users\Admin\Downloads\winzip77-bing.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e597073\winzip77-bing.exerun=1 shortcut="C:\Users\Admin\Downloads\winzip77-bing.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=4044,i,17811762785219916664,12120704841425145222,2097152 --field-trial-handle=2320,i,12998918865880452389,390693146218570151,262144 --variations-seed-version --mojo-platform-channel-handle=7312 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=4328,i,11153916128610480801,7314590621759742223,2097152 --field-trial-handle=2320,i,12998918865880452389,390693146218570151,262144 --variations-seed-version --mojo-platform-channel-handle=3408 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=4372,i,15225750420531738961,10945170279816359234,2097152 --field-trial-handle=2320,i,12998918865880452389,390693146218570151,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=6240,i,2363591829708073822,13919374414584835260,2097152 --field-trial-handle=2320,i,12998918865880452389,390693146218570151,262144 --variations-seed-version --mojo-platform-channel-handle=7208 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7320,i,6490739287090387895,1848873856084445714,2097152 --field-trial-handle=2320,i,12998918865880452389,390693146218570151,262144 --variations-seed-version --mojo-platform-channel-handle=7936 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=4044,i,6274762858308829236,12475490589046605082,2097152 --field-trial-handle=2320,i,12998918865880452389,390693146218570151,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=8428,i,893226074211258378,17041788956895410783,2097152 --field-trial-handle=2320,i,12998918865880452389,390693146218570151,262144 --variations-seed-version --mojo-platform-channel-handle=8336 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=7740,i,10765774019981402660,12130228438644122663,2097152 --field-trial-handle=2320,i,12998918865880452389,390693146218570151,262144 --variations-seed-version --mojo-platform-channel-handle=7544 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7304,i,8167290082356050157,12527922871965907808,262144 --field-trial-handle=2320,i,12998918865880452389,390693146218570151,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=752,i,14473039081677436897,11365638326149282992,2097152 --field-trial-handle=2320,i,12998918865880452389,390693146218570151,262144 --variations-seed-version --mojo-platform-channel-handle=7964 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=7568,i,10937067280325603982,16842537933563344266,2097152 --field-trial-handle=2320,i,12998918865880452389,390693146218570151,262144 --variations-seed-version --mojo-platform-channel-handle=8240 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=4468,i,5758011876659731179,59301660014822598,2097152 --field-trial-handle=2320,i,12998918865880452389,390693146218570151,262144 --variations-seed-version --mojo-platform-channel-handle=8232 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=8004,i,13954986521737373127,8572231883287043622,2097152 --field-trial-handle=2320,i,12998918865880452389,390693146218570151,262144 --variations-seed-version --mojo-platform-channel-handle=8044 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8104,i,2849652297343793685,12309214793170970539,524288 --field-trial-handle=2320,i,12998918865880452389,390693146218570151,262144 --variations-seed-version --mojo-platform-channel-handle=4744 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=8256,i,17702115808128326751,8678188732781926633,2097152 --field-trial-handle=2320,i,12998918865880452389,390693146218570151,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8512,i,8358308545605803852,4861771285484846423,524288 --field-trial-handle=2320,i,12998918865880452389,390693146218570151,262144 --variations-seed-version --mojo-platform-channel-handle=8504 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8636,i,8464504505973664773,9853193314717286505,524288 --field-trial-handle=2320,i,12998918865880452389,390693146218570151,262144 --variations-seed-version --mojo-platform-channel-handle=8640 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8724,i,14622896981520554223,5137727765434074782,524288 --field-trial-handle=2320,i,12998918865880452389,390693146218570151,262144 --variations-seed-version --mojo-platform-channel-handle=8728 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=6928,i,18286610627927562983,14715482558174202606,2097152 --field-trial-handle=2320,i,12998918865880452389,390693146218570151,262144 --variations-seed-version --mojo-platform-channel-handle=6892 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4280,i,17669094125311241072,14748385112756927831,524288 --field-trial-handle=2320,i,12998918865880452389,390693146218570151,262144 --variations-seed-version --mojo-platform-channel-handle=8668 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6800,i,1760496058318420601,1887251541514369207,524288 --field-trial-handle=2320,i,12998918865880452389,390693146218570151,262144 --variations-seed-version --mojo-platform-channel-handle=8824 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4036,i,5422161478972610420,9255019743835241319,524288 --field-trial-handle=2320,i,12998918865880452389,390693146218570151,262144 --variations-seed-version --mojo-platform-channel-handle=7196 /prefetch:83⤵
-
-
-
C:\Program Files\WinZip\winzip64.exe"C:\Program Files\WinZip\winzip64.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookAW
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\WinZip\WzCABCacheSyncHelper64.exe"C:\Program Files\WinZip\WzCABCacheSyncHelper64.exe"3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=winzip64.exe --webview-exe-version="77.0 (206)" --user-data-dir="C:\Users\Admin\AppData\Local\WinZip\WebView2UDF\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --mojo-named-platform-channel-pipe=5968.3732.77187483128693551953⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\WinZip\WebView2UDF\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\WinZip\WebView2UDF\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x178,0x17c,0x180,0x154,0x188,0x7ffdea21b078,0x7ffdea21b084,0x7ffdea21b0904⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\WinZip\WebView2UDF\EBWebView" --webview-exe-name=winzip64.exe --webview-exe-version="77.0 (206)" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1764,i,14290649382410314319,15871892417541027401,262144 --variations-seed-version --mojo-platform-channel-handle=1756 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\WinZip\WebView2UDF\EBWebView" --webview-exe-name=winzip64.exe --webview-exe-version="77.0 (206)" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2068,i,14290649382410314319,15871892417541027401,262144 --variations-seed-version --mojo-platform-channel-handle=2080 /prefetch:34⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\WinZip\WebView2UDF\EBWebView" --webview-exe-name=winzip64.exe --webview-exe-version="77.0 (206)" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2376,i,14290649382410314319,15871892417541027401,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\WinZip\WebView2UDF\EBWebView" --webview-exe-name=winzip64.exe --webview-exe-version="77.0 (206)" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3712,i,14290649382410314319,15871892417541027401,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:14⤵
-
-
-
C:\Program Files\WinZip\winzip64.exe"C:\Program Files\WinZip\winzip64.exe" /admincfg3⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.winzip.com/wzgate.cgi?url=www.winzip.com/buynowwzexit&lang=EN&prod=WNZP&vid=oemg&x-at=bing¶m=prod%3DWNZP%26lang%3DEN%26vid%3Doemg%26ver%3D77.0.16478.0%26mah%3DD583C368EDB0845A95CFF4E075C95B712B09DFA2%26days%3D0%26opened%3D0%26osbits%3D64%26reg%3DEVAL%26wzbits%3D64%26x-at%3Dbing3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://www.winzip.com/wzgate.cgi?url=www.winzip.com/buynowwzexit&lang=EN&prod=WNZP&vid=oemg&x-at=bing¶m=prod%3DWNZP%26lang%3DEN%26vid%3Doemg%26ver%3D77.0.16478.0%26mah%3DD583C368EDB0845A95CFF4E075C95B712B09DFA2%26days%3D0%26opened%3D0%26osbits%3D64%26reg%3DEVAL%26wzbits%3D64%26x-at%3Dbing4⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.winzip.com/instcmplt.cgi?pid=WNZP&ver=77.0.16478.0&lang=en&osbits=64&vid=oemg&x-at=bing2⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://www.winzip.com/instcmplt.cgi?pid=WNZP&ver=77.0.16478.0&lang=en&osbits=64&vid=oemg&x-at=bing3⤵
-
-
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe"2⤵
- Suspicious behavior: GetForegroundWindowSpam
-
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\[Kimochi] RJ01441080\" -spe -an -ai#7zMap14595:102:7zEvent10382⤵
-
-
C:\Program Files\WinZip\winzip64.exe"C:\Program Files\WinZip\winzip64.exe" "C:\Users\Admin\Downloads\[Kimochi] RJ01441080.rar"2⤵
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Windows directory
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookAW
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\WinZip\WzCABCacheSyncHelper64.exe"C:\Program Files\WinZip\WzCABCacheSyncHelper64.exe"3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=winzip64.exe --webview-exe-version="77.0 (206)" --user-data-dir="C:\Users\Admin\AppData\Local\WinZip\WebView2UDF\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --mojo-named-platform-channel-pipe=4496.2416.166261844112346775533⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\WinZip\WebView2UDF\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\WinZip\WebView2UDF\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x194,0x7ffdea21b078,0x7ffdea21b084,0x7ffdea21b0904⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\WinZip\WebView2UDF\EBWebView" --webview-exe-name=winzip64.exe --webview-exe-version="77.0 (206)" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1916,i,3410965934659474930,6490194314807421521,262144 --variations-seed-version --mojo-platform-channel-handle=1848 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\WinZip\WebView2UDF\EBWebView" --webview-exe-name=winzip64.exe --webview-exe-version="77.0 (206)" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=1728,i,3410965934659474930,6490194314807421521,262144 --variations-seed-version --mojo-platform-channel-handle=1956 /prefetch:34⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\WinZip\WebView2UDF\EBWebView" --webview-exe-name=winzip64.exe --webview-exe-version="77.0 (206)" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2280,i,3410965934659474930,6490194314807421521,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\WinZip\WebView2UDF\EBWebView" --webview-exe-name=winzip64.exe --webview-exe-version="77.0 (206)" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3416,i,3410965934659474930,6490194314807421521,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:14⤵
-
-
-
C:\Program Files\WinZip\WzScan.exe"C:\Program Files\WinZip\WzScan.exe" -pinstall3⤵
- Executes dropped EXE
- Checks processor information in registry
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\wzd537\[Kimochi] RJ01441080\SexExorcist.exe"C:\Users\Admin\AppData\Local\Temp\wzd537\[Kimochi] RJ01441080\SexExorcist.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\wz04f2\[Kimochi] RJ01441080\SexExorcist.exe"C:\Users\Admin\AppData\Local\Temp\wz04f2\[Kimochi] RJ01441080\SexExorcist.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\wzcff3\[Kimochi] RJ01441080\SexExorcist.exe"C:\Users\Admin\AppData\Local\Temp\wzcff3\[Kimochi] RJ01441080\SexExorcist.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\wz3a84\[Kimochi] RJ01441080\SexExorcist.exe"C:\Users\Admin\AppData\Local\Temp\wz3a84\[Kimochi] RJ01441080\SexExorcist.exe"3⤵
- Executes dropped EXE
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Modifies system executable filetype association
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 14C8B36B2977AF3FC0ACE80B3753C9D42⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 7A45103ADC08E314E8A6717D751DD1622⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks /Create /SC DAILY /TN "WinZip Update Notifier 1" /TR "\"C:\Program Files\WinZip\WZUpdateNotifier.exe\" -checkType=\"scheduled_9AM\" -show" /ST 09:09 /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks /Create /SC DAILY /TN "WinZip Update Notifier 2" /TR "\"C:\Program Files\WinZip\WZUpdateNotifier.exe\" -checkType=\"scheduled_12PM\" -show" /ST 12:09 /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks /Create /SC DAILY /TN "WinZip Update Notifier 3" /TR "\"C:\Program Files\WinZip\WZUpdateNotifier.exe\" -checkType=\"scheduled_3PM\" -show" /ST 15:09 /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 69A3B759354D5ADE441787CA231AF40F E Global\MSI00002⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\WinZip\FAHConsole.exe"C:\Program Files\WinZip\FAHConsole.exe"3⤵
- Executes dropped EXE
-
C:\Program Files\WinZip\FAHWindow64.exe"C:\Program Files\WinZip\FAHWindow64.exe" register4⤵
- Executes dropped EXE
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe /s "C:\Program Files\WinZip\WXFCMBPDF.dll" /codebase /tlb3⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe /s "C:\Program Files\WinZip\WXFRMPD.dll" /codebase /tlb3⤵
- Modifies data under HKEY_USERS
- Modifies registry class
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe /s "C:\Program Files\WinZip\WXFSGNPDFWINCERTSTORE.dll" /codebase /tlb3⤵
- Modifies data under HKEY_USERS
- Modifies registry class
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe /s "C:\Program Files\WinZip\WXFP2D.dll" /codebase /tlb3⤵
- Modifies data under HKEY_USERS
- Modifies registry class
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe /s "C:\Program Files\WinZip\WXFSGNPDF.dll" /codebase /tlb3⤵
- Modifies registry class
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe /s "C:\Program Files\WinZip\WXFD2P.dll" /codebase /tlb3⤵
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Modifies registry class
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe /s "C:\Program Files\WinZip\WXFWMRK.dll" /codebase /tlb3⤵
- Drops file in Program Files directory
- Modifies registry class
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe /s "C:\Program Files\WinZip\WXFCNVP.dll" /codebase /tlb3⤵
- Modifies registry class
-
-
-
C:\Program Files\WinZip\WzPreviewer64.exe"C:\Program Files\WinZip\WzPreviewer64.exe" -regserver winzip642⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
-
C:\Program Files\WinZip\WzPreloader.exe"C:\Program Files\WinZip\WzPreloader.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\WinZip\winzip64.exe"C:\Program Files\WinZip\winzip64.exe" /noqp /nodesktop /nostartmenu /nomenugroup /autoinstall /lang 10332⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
- Checks whether UAC is enabled
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookAW
-
C:\Program Files\WinZip\WzCABCacheSyncHelper64.exe"C:\Program Files\WinZip\WzCABCacheSyncHelper64.exe"3⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
-
-
-
C:\Program Files\WinZip\winzip64.exe"C:\Program Files\WinZip\winzip64.exe" /precreatehkcu2⤵
- Executes dropped EXE
-
-
C:\Program Files\WinZip\WzUpdater.exe"C:\Program Files\WinZip\WzUpdater.exe" /schedule2⤵
- Executes dropped EXE
-
-
C:\Program Files\WinZip\WZUpdateNotifier.exe"C:\Program Files\WinZip\WZUpdateNotifier.exe"2⤵
- Executes dropped EXE
-
-
C:\Program Files\WinZip\WzBGTComServer64.exe"C:\Program Files\WinZip\WzBGTComServer64.exe" /REGSERVER2⤵
- Executes dropped EXE
-
-
C:\Program Files\WinZip\WzBGTools64.exe"C:\Program Files\WinZip\WzBGTools64.exe" /s2⤵
- Executes dropped EXE
-
-
C:\Program Files\WinZip\ZipSendService.exe"C:\Program Files\WinZip\ZipSendService.exe" /REGAPP Outlook2⤵
- Executes dropped EXE
-
C:\Program Files\WinZip\ZipSendService.exe"C:\Program Files\WinZip\ZipSendService.exe" /REGSERVER3⤵
- Executes dropped EXE
- Modifies registry class
-
-
-
C:\Program Files\WinZip\adxregistrator.exe"C:\Program Files\WinZip\adxregistrator.exe" /install="WZOffice.dll" /privileges=admin /generateLogFile=false /CLRVersion="4.0"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
-
-
C:\Program Files\WinZip\adxregistrator.exe"C:\Program Files\WinZip\adxregistrator.exe" /install="WZOutlok.dll" /privileges=admin /generateLogFile=false /CLRVersion="4.0"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\WinZip\FAHConsole.exe"C:\Program Files\WinZip\FAHConsole.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\WinZip\FAHWindow64.exe"C:\Program Files\WinZip\FAHWindow64.exe" register2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\WinZip\WZUpdateNotifier.exe"C:\Program Files\WinZip\WZUpdateNotifier.exe" -show1⤵
- Executes dropped EXE
-
C:\Program Files\WinZip\WZUpdateNotifier.exe"C:\Program Files\WinZip\WZUpdateNotifier.exe" -showOnly -allowParallelExecution2⤵
- Executes dropped EXE
-
-
C:\Program Files\WinZip\WzUpdater.exe"C:\Program Files\WinZip\WzUpdater.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\WinZip\WzBGTToolsManager64.exe"C:\Program Files\WinZip\WzBGTToolsManager64.exe"1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\wz1b39\[Kimochi] RJ01441080\UnityPlayer.dll"2⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140433⤵
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=C7EBFFE5E9C8FF8546A95DC8AF487706 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=8A7D5E8DB59DCC65F48EA2C613AD99AD --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=8A7D5E8DB59DCC65F48EA2C613AD99AD --renderer-client-id=2 --mojo-platform-channel-handle=1760 --allow-no-sandbox-job /prefetch:14⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=27438E9595B81DE58FAB3068EE6A1781 --mojo-platform-channel-handle=2308 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=CB8470A70A90E56864AC5F03A02617EA --mojo-platform-channel-handle=2416 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=BAE187FCFC4598A617437239158FDD27 --mojo-platform-channel-handle=2372 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault47200dbeh1cebh413fh843fh35e2566d70cc1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault8c8166c1h0297h434ch9859h4606aa61827c1⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Modify Registry
4Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
e5a16d8.rbs
SbkupStub.exe.config
WinZipCourierConfig.exe
WinZip Duplicate File Finder.lnk
WinZip Duplicate File Finder.lnk~RFe5aa29a.TMP
WinZip Image Manager.lnk
WinZip Image Manager.lnk~RFe5aa2c9.TMP
WinZip PDF Express.lnk
WinZip PDF Express.lnk~RFe5aa2f8.TMP
WinZip SafeShare.lnk
WinZip SafeShare.lnk~RFe5aa317.TMP
WinZip Secure Backup.lnk
WinZip Secure Backup.lnk~RFe5aa336.TMP
WinZip Tool Settings.lnk
WinZip Tool Settings.lnk
WinZip Tool Settings.lnk~RFe5aa26b.TMP
WinZip.lnk
WinZip.lnk~RFe5aa25c.TMP
WinZip.lnk
WinZip.lnk~RFe5aa22d.TMP
winzip.77.xml
WinZip.addon
WinZip.addon
WinZip.addon
WinZip.addon
3C42BC945025A34066DAB76EF3F80A05
FE17BEC2A573BC9AE36869D0274FFA19_6DA81F04C5F9EAD2CD0268808FCE61E1
3C42BC945025A34066DAB76EF3F80A05
FE17BEC2A573BC9AE36869D0274FFA19_6DA81F04C5F9EAD2CD0268808FCE61E1
blocklist
settings.dat
settings.dat
LOG.old
LOG.old
MANIFEST-000001
BookmarkMergedSurfaceOrdering
f_000093
f_000094
f_000095
f_000097
f_0000e2
f_0000e3
f_0000e4
f_0000e5
f_0000e6
f_0000ee
f_0000ef
f_0000f0
f_0000f1
f_0000f2
f_0000f3
f_0000f4
f_0000f5
f_0000f6
f_0000f7
f_0000f8
f_0000f9
temp-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe58b263.TMP
27bd0537-0d45-439f-a94d-0c63fcaacb84.tmp
Edge Profile.ico
HubApps
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Sdch Dictionaries~RFe597805.TMP
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe58e24d.TMP
index.txt
the-real-index
the-real-index~RFe5938e8.TMP
sync_diagnostic.log
favorites_diagnostic.log
OperationConfig
OperationConfig~RFe594e26.TMP
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter~RFe595e62.TMP
VariationsRuntimeSeedV1
VariationsSeedV1
27f0c446-bdea-4fe4-b741-f7e12d8e637e.tmp
ipm.corel[1].xml
ipm.corel[1].xml
ipm.corel[1].xml
ipm.corel[1].xml
ipm.corel[1].xml
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
gtm[1].js
IPP_GMT_1783873847.html
log_20260712163000.txt
installer_log_20260712162936.txt
Load.html
common.css
jquery-ui.css
button-normal.png
centerImg.png
close-normal.png
footerImg.png
headerImg.png
header_logo.png
common.js
external.js
jquery-1.11.2.min.js
jquery-ui.min.js
config.js
installerlist.js
installparams.js
stubparams.js
features.js
page.html
page.js
features.js
page.html
page.js
features.js
page.html
page.js
features.js
page.html
page.js
features.js
page.html
page.js
page.js
features.js
page.html
page.js
UnityPlayer.dll
SexExorcist.exe
settings.dat
settings.dat
settings.dat
the-real-index
the-real-index
the-real-index~RFe5b04ee.TMP
index
data_0
data_1
data_2
data_3
000001.dbtmp
TransportSecurity
Preferences
MANIFEST-000001
Local State
Local State
Local State
Local State
Local State~RFe5aee97.TMP
WzRecipientsCache.db
db53b23fd1edbd46.customDestinations-ms
db53b23fd1edbd46.customDestinations-ms
Compat.browser
DefaultWsdlHelpGenerator.aspx
winzip77-bing.exe.crdownload
WinZip Duplicate File Finder.lnk
WinZip Duplicate File Finder.lnk~RFe5aa27b.TMP
WinZip Image Manager.lnk
WinZip Image Manager.lnk~RFe5aa2b9.TMP
WinZip PDF Express.lnk
WinZip PDF Express.lnk~RFe5aa2d9.TMP
WinZip SafeShare.lnk
WinZip SafeShare.lnk~RFe5aa308.TMP
WinZip Secure Backup.lnk
WinZip Secure Backup.lnk~RFe5aa346.TMP
WinZip.lnk
WinZip.lnk~RFe5aa21d.TMP
MSI1A21.tmp
MSI1AED.tmp
MSI1B4F.tmp
DupFFStub64_Shortcut_Desktop.ico
ImgUtilStub64_Shortcut_Desktop.ico
PdfUtilStub64_Shortcut_Desktop.ico
SafeShareStub64_Shortcut_Desktop.ico
SbkupStub64_ShortCut_StartMenu.ico
WinZip64_Shortcut_MenuGroup.ico
metadata-2
{5052edf5-11a0-496c-8b07-1adc47260d4e}_OnDiskSnapshotProp
memory/1132-3261-0x000001A4166F0000-0x000001A41672C000-memory.dmp
memory/1132-3262-0x000001A430E10000-0x000001A431048000-memory.dmp
memory/1464-3533-0x00007FFE1C150000-0x00007FFE1C151000-memory.dmp
memory/1464-3532-0x00007FFE1BF80000-0x00007FFE1BF81000-memory.dmp
memory/1616-2925-0x0000019155310000-0x00000191554B9000-memory.dmp
memory/1616-2803-0x0000019156F80000-0x0000019156F8C000-memory.dmp
memory/1616-2820-0x0000019170320000-0x000001917033E000-memory.dmp
memory/1616-2824-0x0000019972010000-0x00000199721FE000-memory.dmp
memory/1616-2844-0x0000019170640000-0x0000019170648000-memory.dmp
memory/1616-2833-0x0000019170620000-0x000001917062E000-memory.dmp
memory/1616-2804-0x0000019156FC0000-0x0000019156FD4000-memory.dmp
memory/1616-2801-0x00007FFE0CAC0000-0x00007FFE0CB07000-memory.dmp
memory/1616-2821-0x00007FFE0BF70000-0x00007FFE0BF8E000-memory.dmp
memory/1616-2806-0x000001916FAF0000-0x000001916FB82000-memory.dmp
memory/1616-2800-0x0000019157040000-0x0000019157087000-memory.dmp
memory/1616-2835-0x0000019971E20000-0x0000019971E58000-memory.dmp
memory/1764-3227-0x00000270FBEF0000-0x00000270FBF06000-memory.dmp
memory/2632-3243-0x000001DBC0F70000-0x000001DBC0F82000-memory.dmp
memory/2820-3259-0x000002A283D90000-0x000002A283F39000-memory.dmp
memory/3064-3223-0x0000021CA4FC0000-0x0000021CA4FCE000-memory.dmp
memory/3120-2832-0x000001C0F77B0000-0x000001C0F7959000-memory.dmp
memory/3260-2849-0x00007FFE1C110000-0x00007FFE1C120000-memory.dmp
memory/3260-3176-0x0000000008A90000-0x0000000008A91000-memory.dmp
memory/3260-3399-0x0000000002A10000-0x0000000002A11000-memory.dmp
memory/3316-3282-0x0000000004E50000-0x000000000527A000-memory.dmp
memory/3316-3287-0x0000000005680000-0x000000000569E000-memory.dmp
memory/3316-3286-0x0000000005640000-0x0000000005676000-memory.dmp
memory/3316-3285-0x0000000005280000-0x000000000528A000-memory.dmp
memory/3316-3283-0x0000000005830000-0x0000000005DD4000-memory.dmp
memory/3316-3284-0x0000000005320000-0x00000000053B2000-memory.dmp
memory/3568-3231-0x00000195FB800000-0x00000195FB84E000-memory.dmp
memory/3636-3219-0x0000020F43CB0000-0x0000020F43D46000-memory.dmp
memory/3636-3218-0x0000020F29790000-0x0000020F297A0000-memory.dmp
memory/3792-2797-0x0000024D2C100000-0x0000024D2C122000-memory.dmp
memory/4040-3413-0x00007FFE0CC20000-0x00007FFE0CC44000-memory.dmp
memory/4040-3487-0x000001C4FF240000-0x000001C4FF3E9000-memory.dmp
memory/4052-2889-0x0000016AB6340000-0x0000016AB637A000-memory.dmp
memory/4052-2864-0x0000016AB5580000-0x0000016AB55E3000-memory.dmp
memory/4052-2812-0x0000016A9BCE0000-0x0000016A9BD04000-memory.dmp
memory/4052-2813-0x00007FFE0D260000-0x00007FFE0D284000-memory.dmp
memory/4052-2814-0x0000016AB4660000-0x0000016AB4768000-memory.dmp
memory/4052-2826-0x0000016AB49D0000-0x0000016AB4A2A000-memory.dmp
memory/4052-2828-0x00007FFE001A0000-0x00007FFE001C4000-memory.dmp
memory/4052-2827-0x0000016AB4A30000-0x0000016AB4A54000-memory.dmp
memory/4052-2831-0x00007FFDFE280000-0x00007FFDFE2BA000-memory.dmp
memory/4052-2830-0x0000016AB4AA0000-0x0000016AB4ADA000-memory.dmp
memory/4052-2836-0x00007FFDFDC30000-0x00007FFDFDC54000-memory.dmp
memory/4052-2834-0x0000016AB4AE0000-0x0000016AB4B04000-memory.dmp
memory/4052-2842-0x0000016AB4CE0000-0x0000016AB4EA2000-memory.dmp
memory/4052-2843-0x0000016AB4B80000-0x0000016AB4BEF000-memory.dmp
memory/4052-2851-0x0000016AB69A0000-0x0000016AB80EA000-memory.dmp
memory/4052-2858-0x0000016AB4BF0000-0x0000016AB4C5F000-memory.dmp
memory/4052-2859-0x0000016AB4C60000-0x0000016AB4CCF000-memory.dmp
memory/4052-2862-0x0000016AB54A0000-0x0000016AB5506000-memory.dmp
memory/4052-2861-0x0000016AB5430000-0x0000016AB549F000-memory.dmp
memory/4052-2860-0x0000016AB53C0000-0x0000016AB542F000-memory.dmp
memory/4052-2863-0x0000016AB5510000-0x0000016AB5573000-memory.dmp
memory/4052-2865-0x0000016AB55F0000-0x0000016AB5653000-memory.dmp
memory/4052-2868-0x0000016AB57B0000-0x0000016AB581F000-memory.dmp
memory/4052-2867-0x0000016AB5740000-0x0000016AB57A3000-memory.dmp
memory/4052-2870-0x00007FFDFDBE0000-0x00007FFDFDC2D000-memory.dmp
memory/4052-2873-0x0000016AB5D80000-0x0000016AB6148000-memory.dmp
memory/4052-2874-0x0000016AB5870000-0x0000016AB58DE000-memory.dmp
memory/4052-2907-0x0000016AB4EB0000-0x0000016AB524D000-memory.dmp
memory/4052-2906-0x0000016A9B9C0000-0x0000016A9BB69000-memory.dmp
memory/4052-2890-0x0000016AB58E0000-0x0000016AB5906000-memory.dmp
memory/4052-2872-0x00007FFDF3160000-0x00007FFDF31F3000-memory.dmp
memory/4052-2871-0x0000016AB5910000-0x0000016AB59A3000-memory.dmp
memory/4052-2887-0x00007FFE0D370000-0x00007FFE0D38C000-memory.dmp
memory/4052-2888-0x0000016AB5BC0000-0x0000016AB5C2A000-memory.dmp
memory/4052-2886-0x0000016AB5A50000-0x0000016AB5A6C000-memory.dmp
memory/4052-2885-0x0000016AB5CC0000-0x0000016AB5D34000-memory.dmp
memory/4052-2883-0x0000016AB6150000-0x0000016AB6200000-memory.dmp
memory/4052-2884-0x00007FFDF2C00000-0x00007FFDF2CB0000-memory.dmp
memory/4052-2869-0x0000016AB5820000-0x0000016AB586D000-memory.dmp
memory/4052-2866-0x0000016AB56D0000-0x0000016AB5733000-memory.dmp
memory/4052-2875-0x0000016AB59B0000-0x0000016AB5A00000-memory.dmp
memory/4052-2882-0x00007FFDF2CB0000-0x00007FFDF2D21000-memory.dmp
memory/4052-2881-0x0000016AB5C40000-0x0000016AB5CB1000-memory.dmp
memory/4052-2876-0x0000016AB5660000-0x0000016AB5672000-memory.dmp
memory/4052-2880-0x0000016AB5B50000-0x0000016AB5BBF000-memory.dmp
memory/4052-2878-0x0000016AB5A00000-0x0000016AB5A4D000-memory.dmp
memory/4052-2879-0x00007FFDFC760000-0x00007FFDFC7AD000-memory.dmp
memory/4052-2877-0x0000016AB5A70000-0x0000016AB5ADF000-memory.dmp
memory/4120-2829-0x00000230A9BD0000-0x00000230A9D79000-memory.dmp
memory/4716-3294-0x0000000005910000-0x0000000005924000-memory.dmp
memory/4716-3291-0x0000000006310000-0x000000000651A000-memory.dmp
memory/4716-3290-0x0000000006120000-0x0000000006308000-memory.dmp
memory/4720-3247-0x000001DD5C190000-0x000001DD5C19C000-memory.dmp
memory/4772-3239-0x0000023B1F090000-0x0000023B1F09E000-memory.dmp
memory/5232-3526-0x00007FFE1C220000-0x00007FFE1C221000-memory.dmp
memory/5232-3888-0x00000212C1CD0000-0x00000212C1DFA000-memory.dmp
memory/5400-4999-0x0000016068600000-0x000001606872A000-memory.dmp
memory/5468-3235-0x000002A0FBE40000-0x000002A0FBE8E000-memory.dmp
memory/5968-3393-0x00000275E9A30000-0x00000275E9A54000-memory.dmp
memory/5968-3377-0x00007FFDFE270000-0x00007FFDFE2B7000-memory.dmp
memory/5968-4174-0x00000275CDD80000-0x00000275CDF29000-memory.dmp
memory/5968-3401-0x0000027DEAC10000-0x0000027DEAC34000-memory.dmp
memory/5968-3402-0x00007FFDFDBD0000-0x00007FFDFDBF4000-memory.dmp
memory/5968-3411-0x0000027DEAEB0000-0x0000027DEAED4000-memory.dmp
memory/5968-3890-0x00000275CDD80000-0x00000275CDF29000-memory.dmp
memory/5968-4073-0x00000275CDD80000-0x00000275CDF29000-memory.dmp
memory/5968-3410-0x0000027DEAEE0000-0x0000027DEAF38000-memory.dmp
memory/5968-3407-0x0000027DEAD90000-0x0000027DEADCA000-memory.dmp
memory/5968-3376-0x00000275D0080000-0x00000275D00C7000-memory.dmp
memory/5968-3381-0x00000275E9110000-0x00000275E925B000-memory.dmp
memory/5968-3382-0x00007FFDFD110000-0x00007FFDFD25B000-memory.dmp
memory/5968-3394-0x00007FFE0CC20000-0x00007FFE0CC44000-memory.dmp
memory/5968-3397-0x00000275EA650000-0x00000275EA6BF000-memory.dmp
memory/5968-4093-0x00000275CDD80000-0x00000275CDF29000-memory.dmp
memory/5968-4120-0x00000275CDD80000-0x00000275CDF29000-memory.dmp
memory/5968-3408-0x00007FFDFCD30000-0x00007FFDFCD6A000-memory.dmp
memory/5968-3412-0x00007FFDFCD00000-0x00007FFDFCD24000-memory.dmp
memory/6040-2933-0x0000022846F80000-0x0000022846FAE000-memory.dmp
memory/6040-2935-0x00000228601B0000-0x0000022860204000-memory.dmp
memory/6040-2929-0x00000228452A0000-0x0000022845310000-memory.dmp
memory/6516-4079-0x000001FFB2F80000-0x000001FFB3129000-memory.dmp
memory/6540-3637-0x00007FFE1C220000-0x00007FFE1C221000-memory.dmp
memory/6540-3756-0x00000248FACD0000-0x00000248FADFA000-memory.dmp
memory/6716-4939-0x000001B65D8D0000-0x000001B65D9FA000-memory.dmp