Malware Analysis Report

2025-03-14 21:44

Sample ID 250125-q5fcsaxjfn
Target CG_Loader.exe
SHA256 91b99f2ebbabad81a8804730e9671329bd79d4b5ccbbb22c4da2eb365da2c68c
Tags
google defense_evasion discovery execution persistence phishing privilege_escalation upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

91b99f2ebbabad81a8804730e9671329bd79d4b5ccbbb22c4da2eb365da2c68c

Threat Level: Known bad

The file CG_Loader.exe was found to be: Known bad.

Malicious Activity Summary

google defense_evasion discovery execution persistence phishing privilege_escalation upx

Detected google phishing page

Stops running service(s)

Modifies Windows Firewall

Sets service image path in registry

Drops file in Drivers directory

Downloads MZ/PE file

Loads dropped DLL

Checks computer location settings

Deletes itself

Event Triggered Execution: Component Object Model Hijacking

Executes dropped EXE

Checks installed software on the system

Legitimate hosting services abused for malware hosting/C2

UPX packed file

Hide Artifacts: Hidden Files and Directories

Drops file in System32 directory

Launches sc.exe

Drops file in Windows directory

Drops file in Program Files directory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Event Triggered Execution: Netsh Helper DLL

Browser Information Discovery

Unsigned PE

Modifies registry class

Uses Volume Shadow Copy service COM API

Uses Volume Shadow Copy WMI provider

Uses Task Scheduler COM API

Suspicious use of SendNotifyMessage

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Enumerates system info in registry

Modifies data under HKEY_USERS

Suspicious behavior: LoadsDriver

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Views/modifies file attributes

Kills process with taskkill

Suspicious use of WriteProcessMemory

Gathers network information

Suspicious use of FindShellTrayWindow

Checks SCSI registry key(s)

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-01-25 13:50

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-01-25 13:50

Reported

2025-01-25 14:05

Platform

win10ltsc2021-20250113-en

Max time kernel

736s

Max time network

695s

Command Line

"C:\Users\Admin\AppData\Local\Temp\CG_Loader.exe"

Signatures

Detected google phishing page

phishing google
Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Downloads MZ/PE file

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\system32\drivers\etc\hosts.ics C:\Windows\SysWOW64\cmd.exe N/A
File opened for modification C:\Windows\system32\drivers\etc\hosts C:\Windows\SysWOW64\cmd.exe N/A
File created C:\Windows\system32\Drivers\srvpnp.sys C:\Windows\404C0984.dll N/A

Modifies Windows Firewall

defense_evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\srvpnp\ImagePath = "\\SystemRoot\\system32\\drivers\\srvpnp.sys" C:\Windows\404C0984.dll N/A

Stops running service(s)

defense_evasion execution

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2503671516-4119152987-701077851-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\CG_Loader.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2503671516-4119152987-701077851-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\404C0984.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2503671516-4119152987-701077851-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2503671516-4119152987-701077851-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2503671516-4119152987-701077851-1000\Control Panel\International\Geo\Nation C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\404C0984.exe N/A

Event Triggered Execution: Component Object Model Hijacking

persistence privilege_escalation

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\404C0984.exe N/A
N/A N/A C:\Users\Admin\Downloads\Saltanat_Mt2_Setup_3.0.6.exe N/A
N/A N/A C:\Users\Admin\Downloads\Saltanat_Mt2_Setup_3.0.6.exe N/A
N/A N/A C:\Users\Admin\Downloads\Saltanat_Mt2_Setup_3.0.6.exe N/A
N/A N/A C:\Users\Admin\Downloads\Saltanat_Mt2_Setup_3.0.6.exe N/A
N/A N/A C:\Users\Admin\Downloads\Saltanat_Mt2_Setup_3.0.6.exe N/A
N/A N/A C:\Users\Admin\Downloads\Saltanat_Mt2_Setup_3.0.6.exe N/A
N/A N/A C:\Users\Admin\Downloads\Saltanat_Mt2_Setup_3.0.6.exe N/A
N/A N/A C:\Users\Admin\Downloads\Saltanat_Mt2_Setup_3.0.6.exe N/A
N/A N/A C:\Users\Admin\Downloads\Saltanat_Mt2_Setup_3.0.6.exe N/A
N/A N/A C:\Users\Admin\Downloads\Saltanat_Mt2_Setup_3.0.6.exe N/A
N/A N/A C:\Users\Admin\Downloads\Saltanat_Mt2_Setup_3.0.6.exe N/A
N/A N/A C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe N/A
N/A N/A C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe N/A
N/A N/A C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe N/A
N/A N/A C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe N/A
N/A N/A C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe N/A
N/A N/A C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe N/A
N/A N/A C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe N/A
N/A N/A C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe N/A
N/A N/A C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe N/A
N/A N/A C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe N/A
N/A N/A C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe N/A
N/A N/A C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe N/A
N/A N/A C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe N/A
N/A N/A C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe N/A
N/A N/A C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe N/A
N/A N/A C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe N/A
N/A N/A C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe N/A
N/A N/A C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe N/A
N/A N/A C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe N/A
N/A N/A C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe N/A
N/A N/A C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe N/A
N/A N/A C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe N/A
N/A N/A C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe N/A
N/A N/A C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe N/A
N/A N/A C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe N/A
N/A N/A C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe N/A
N/A N/A C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe N/A
N/A N/A C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe N/A
N/A N/A C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe N/A
N/A N/A C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe N/A
N/A N/A C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe N/A
N/A N/A C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe N/A
N/A N/A C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe N/A
N/A N/A C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe N/A

Checks installed software on the system

discovery

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A href.li N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A href.li N/A N/A
N/A href.li N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created \??\c:\windows\system32\driverstore\filerepository\input.inf_amd64_71e43a6eaa912e56\input.PNF C:\Windows\system32\dxdiag.exe N/A
File created \??\c:\windows\system32\driverstore\filerepository\mshdc.inf_amd64_f6ccd5b2c8226c4a\mshdc.PNF C:\Windows\system32\dxdiag.exe N/A
File created \??\c:\windows\system32\driverstore\filerepository\machine.inf_amd64_72ab89a5cc3218be\machine.PNF C:\Windows\system32\dxdiag.exe N/A
File created \??\c:\windows\system32\driverstore\filerepository\netrtl64.inf_amd64_8e9c2368fe308df2\netrtl64.PNF C:\Windows\system32\dxdiag.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\machine.inf_amd64_72ab89a5cc3218be\machine.PNF C:\Windows\system32\dxdiag.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\input.inf_amd64_71e43a6eaa912e56\input.PNF C:\Windows\system32\dxdiag.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\msmouse.inf_amd64_1793a485b491b199\msmouse.PNF C:\Windows\system32\dxdiag.exe N/A
File created \??\c:\windows\system32\driverstore\filerepository\keyboard.inf_amd64_5938c699b80ebb8f\keyboard.PNF C:\Windows\system32\dxdiag.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\keyboard.inf_amd64_5938c699b80ebb8f\keyboard.PNF C:\Windows\system32\dxdiag.exe N/A
File created \??\c:\windows\system32\driverstore\filerepository\hdaudbus.inf_amd64_e89200d3ede2154e\hdaudbus.PNF C:\Windows\system32\dxdiag.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\usbport.inf_amd64_230f9025c8623e5d\usbport.PNF C:\Windows\system32\dxdiag.exe N/A
File created \??\c:\windows\system32\driverstore\filerepository\usbport.inf_amd64_230f9025c8623e5d\usbport.PNF C:\Windows\system32\dxdiag.exe N/A
File created \??\c:\windows\system32\driverstore\filerepository\msmouse.inf_amd64_1793a485b491b199\msmouse.PNF C:\Windows\system32\dxdiag.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\netrtl64.inf_amd64_8e9c2368fe308df2\netrtl64.PNF C:\Windows\system32\dxdiag.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\hdaudbus.inf_amd64_e89200d3ede2154e\hdaudbus.PNF C:\Windows\system32\dxdiag.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_amd64_f6ccd5b2c8226c4a\mshdc.PNF C:\Windows\system32\dxdiag.exe N/A

Hide Artifacts: Hidden Files and Directories

defense_evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Saltanat Mt2\locales\ca.pak C:\Users\Admin\Downloads\Saltanat_Mt2_Setup_3.0.6.exe N/A
File opened for modification C:\Program Files (x86)\Saltanat Mt2\chrome_200_percent.pak C:\Users\Admin\Downloads\Saltanat_Mt2_Setup_3.0.6.exe N/A
File opened for modification C:\Program Files (x86)\Saltanat Mt2\locales\en-US.pak C:\Users\Admin\Downloads\Saltanat_Mt2_Setup_3.0.6.exe N/A
File created C:\Program Files (x86)\Saltanat Mt2\locales\ta.pak C:\Users\Admin\Downloads\Saltanat_Mt2_Setup_3.0.6.exe N/A
File opened for modification C:\Program Files (x86)\Saltanat Mt2\locales\th.pak C:\Users\Admin\Downloads\Saltanat_Mt2_Setup_3.0.6.exe N/A
File opened for modification C:\Program Files (x86)\Saltanat Mt2\locales\vi.pak C:\Users\Admin\Downloads\Saltanat_Mt2_Setup_3.0.6.exe N/A
File created C:\Program Files (x86)\Saltanat Mt2\locales\zh-TW.pak C:\Users\Admin\Downloads\Saltanat_Mt2_Setup_3.0.6.exe N/A
File created C:\Program Files (x86)\Saltanat Mt2\swiftshader\libGLESv2.dll C:\Users\Admin\Downloads\Saltanat_Mt2_Setup_3.0.6.exe N/A
File created C:\Program Files (x86)\Saltanat Mt2\locales\de.pak C:\Users\Admin\Downloads\Saltanat_Mt2_Setup_3.0.6.exe N/A
File opened for modification C:\Program Files (x86)\Saltanat Mt2\locales\te.pak C:\Users\Admin\Downloads\Saltanat_Mt2_Setup_3.0.6.exe N/A
File created C:\Program Files (x86)\Saltanat Mt2\locales\es.pak C:\Users\Admin\Downloads\Saltanat_Mt2_Setup_3.0.6.exe N/A
File created C:\Program Files (x86)\Saltanat Mt2\locales\bg.pak C:\Users\Admin\Downloads\Saltanat_Mt2_Setup_3.0.6.exe N/A
File opened for modification C:\Program Files (x86)\Saltanat Mt2\locales\ko.pak C:\Users\Admin\Downloads\Saltanat_Mt2_Setup_3.0.6.exe N/A
File created C:\Program Files (x86)\Saltanat Mt2\locales\pt-PT.pak C:\Users\Admin\Downloads\Saltanat_Mt2_Setup_3.0.6.exe N/A
File created C:\Program Files (x86)\Saltanat Mt2\locales\zh-CN.pak C:\Users\Admin\Downloads\Saltanat_Mt2_Setup_3.0.6.exe N/A
File opened for modification C:\Program Files (x86)\Saltanat Mt2\resources\app.asar C:\Users\Admin\Downloads\Saltanat_Mt2_Setup_3.0.6.exe N/A
File created C:\Program Files (x86)\Saltanat Mt2\libEGL.dll C:\Users\Admin\Downloads\Saltanat_Mt2_Setup_3.0.6.exe N/A
File created C:\Program Files (x86)\Saltanat Mt2\icudtl.dat C:\Users\Admin\Downloads\Saltanat_Mt2_Setup_3.0.6.exe N/A
File opened for modification C:\Program Files (x86)\Saltanat Mt2\locales\ml.pak C:\Users\Admin\Downloads\Saltanat_Mt2_Setup_3.0.6.exe N/A
File created C:\Program Files (x86)\Saltanat Mt2\locales\sr.pak C:\Users\Admin\Downloads\Saltanat_Mt2_Setup_3.0.6.exe N/A
File opened for modification C:\Program Files (x86)\Saltanat Mt2\locales\uk.pak C:\Users\Admin\Downloads\Saltanat_Mt2_Setup_3.0.6.exe N/A
File opened for modification C:\Program Files (x86)\Saltanat Mt2\v8_context_snapshot.bin C:\Users\Admin\Downloads\Saltanat_Mt2_Setup_3.0.6.exe N/A
File opened for modification C:\Program Files (x86)\Saltanat Mt2\LICENSE.electron.txt C:\Users\Admin\Downloads\Saltanat_Mt2_Setup_3.0.6.exe N/A
File created C:\Program Files (x86)\Saltanat Mt2\locales\lv.pak C:\Users\Admin\Downloads\Saltanat_Mt2_Setup_3.0.6.exe N/A
File created C:\Program Files (x86)\Saltanat Mt2\Uninstall Saltanat Mt2.exe C:\Users\Admin\Downloads\Saltanat_Mt2_Setup_3.0.6.exe N/A
File opened for modification C:\Program Files (x86)\Saltanat Mt2\locales\es.pak C:\Users\Admin\Downloads\Saltanat_Mt2_Setup_3.0.6.exe N/A
File created C:\Program Files (x86)\Saltanat Mt2\uninstallerIcon.ico C:\Users\Admin\Downloads\Saltanat_Mt2_Setup_3.0.6.exe N/A
File created C:\Program Files (x86)\Saltanat Mt2\locales\it.pak C:\Users\Admin\Downloads\Saltanat_Mt2_Setup_3.0.6.exe N/A
File opened for modification C:\Program Files (x86)\Saltanat Mt2\locales\zh-CN.pak C:\Users\Admin\Downloads\Saltanat_Mt2_Setup_3.0.6.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20250125135100.pma C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe N/A
File opened for modification C:\Program Files (x86)\Saltanat Mt2\osmesa.dll C:\Users\Admin\Downloads\Saltanat_Mt2_Setup_3.0.6.exe N/A
File created C:\Program Files (x86)\Saltanat Mt2\natives_blob.bin C:\Users\Admin\Downloads\Saltanat_Mt2_Setup_3.0.6.exe N/A
File opened for modification C:\Program Files (x86)\Saltanat Mt2\locales\hi.pak C:\Users\Admin\Downloads\Saltanat_Mt2_Setup_3.0.6.exe N/A
File opened for modification C:\Program Files (x86)\Saltanat Mt2\locales\hu.pak C:\Users\Admin\Downloads\Saltanat_Mt2_Setup_3.0.6.exe N/A
File opened for modification C:\Program Files (x86)\Saltanat Mt2\locales\ja.pak C:\Users\Admin\Downloads\Saltanat_Mt2_Setup_3.0.6.exe N/A
File opened for modification C:\Program Files (x86)\Saltanat Mt2\locales\mr.pak C:\Users\Admin\Downloads\Saltanat_Mt2_Setup_3.0.6.exe N/A
File opened for modification C:\Program Files (x86)\Saltanat Mt2\locales\sw.pak C:\Users\Admin\Downloads\Saltanat_Mt2_Setup_3.0.6.exe N/A
File opened for modification C:\Program Files (x86)\Saltanat Mt2\swiftshader\libGLESv2.dll C:\Users\Admin\Downloads\Saltanat_Mt2_Setup_3.0.6.exe N/A
File opened for modification C:\Program Files (x86)\Saltanat Mt2\locales\fa.pak C:\Users\Admin\Downloads\Saltanat_Mt2_Setup_3.0.6.exe N/A
File opened for modification C:\Program Files (x86)\Saltanat Mt2\locales\es-419.pak C:\Users\Admin\Downloads\Saltanat_Mt2_Setup_3.0.6.exe N/A
File opened for modification C:\Program Files (x86)\Saltanat Mt2\locales\nb.pak C:\Users\Admin\Downloads\Saltanat_Mt2_Setup_3.0.6.exe N/A
File created C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe C:\Users\Admin\Downloads\Saltanat_Mt2_Setup_3.0.6.exe N/A
File opened for modification C:\Program Files (x86)\Saltanat Mt2\locales\en-GB.pak C:\Users\Admin\Downloads\Saltanat_Mt2_Setup_3.0.6.exe N/A
File opened for modification C:\Program Files (x86)\Saltanat Mt2\libGLESv2.dll C:\Users\Admin\Downloads\Saltanat_Mt2_Setup_3.0.6.exe N/A
File created C:\Program Files (x86)\Saltanat Mt2\locales\hu.pak C:\Users\Admin\Downloads\Saltanat_Mt2_Setup_3.0.6.exe N/A
File created C:\Program Files (x86)\Saltanat Mt2\locales\ro.pak C:\Users\Admin\Downloads\Saltanat_Mt2_Setup_3.0.6.exe N/A
File created C:\Program Files (x86)\Saltanat Mt2\locales\sw.pak C:\Users\Admin\Downloads\Saltanat_Mt2_Setup_3.0.6.exe N/A
File opened for modification C:\Program Files (x86)\Saltanat Mt2\swiftshader C:\Users\Admin\Downloads\Saltanat_Mt2_Setup_3.0.6.exe N/A
File created C:\Program Files (x86)\Saltanat Mt2\locales\et.pak C:\Users\Admin\Downloads\Saltanat_Mt2_Setup_3.0.6.exe N/A
File created C:\Program Files (x86)\Saltanat Mt2\locales\ko.pak C:\Users\Admin\Downloads\Saltanat_Mt2_Setup_3.0.6.exe N/A
File opened for modification C:\Program Files (x86)\Saltanat Mt2\locales\ta.pak C:\Users\Admin\Downloads\Saltanat_Mt2_Setup_3.0.6.exe N/A
File created C:\Program Files (x86)\Saltanat Mt2\ffmpeg.dll C:\Users\Admin\Downloads\Saltanat_Mt2_Setup_3.0.6.exe N/A
File opened for modification C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe C:\Users\Admin\Downloads\Saltanat_Mt2_Setup_3.0.6.exe N/A
File opened for modification C:\Program Files (x86)\Saltanat Mt2\VkICD_mock_icd.dll C:\Users\Admin\Downloads\Saltanat_Mt2_Setup_3.0.6.exe N/A
File opened for modification C:\Program Files (x86)\Saltanat Mt2\icudtl.dat C:\Users\Admin\Downloads\Saltanat_Mt2_Setup_3.0.6.exe N/A
File created C:\Program Files (x86)\Saltanat Mt2\locales\am.pak C:\Users\Admin\Downloads\Saltanat_Mt2_Setup_3.0.6.exe N/A
File created C:\Program Files (x86)\Saltanat Mt2\locales\ar.pak C:\Users\Admin\Downloads\Saltanat_Mt2_Setup_3.0.6.exe N/A
File created C:\Program Files (x86)\Saltanat Mt2\locales\en-US.pak C:\Users\Admin\Downloads\Saltanat_Mt2_Setup_3.0.6.exe N/A
File created C:\Program Files (x86)\Saltanat Mt2\snapshot_blob.bin C:\Users\Admin\Downloads\Saltanat_Mt2_Setup_3.0.6.exe N/A
File opened for modification C:\Program Files (x86)\Saltanat Mt2\ffmpeg.dll C:\Users\Admin\Downloads\Saltanat_Mt2_Setup_3.0.6.exe N/A
File created C:\Program Files (x86)\Saltanat Mt2\LICENSES.chromium.html C:\Users\Admin\Downloads\Saltanat_Mt2_Setup_3.0.6.exe N/A
File opened for modification C:\Program Files (x86)\Saltanat Mt2\locales\am.pak C:\Users\Admin\Downloads\Saltanat_Mt2_Setup_3.0.6.exe N/A
File opened for modification C:\Program Files (x86)\Saltanat Mt2\locales\et.pak C:\Users\Admin\Downloads\Saltanat_Mt2_Setup_3.0.6.exe N/A
File created C:\Program Files (x86)\Saltanat Mt2\locales\gu.pak C:\Users\Admin\Downloads\Saltanat_Mt2_Setup_3.0.6.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\404C0984.dll C:\Users\Admin\AppData\Local\Temp\404C0984.exe N/A
File opened for modification C:\Windows\SystemTemp C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\404C0984.dll N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\404C0984.dll N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\attrib.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\taskkill.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\attrib.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\ipconfig.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\404C0984.dll N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\attrib.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Checks SCSI registry key(s)

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs C:\Windows\system32\dxdiag.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 C:\Windows\system32\taskmgr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 C:\Windows\system32\dxdiag.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs C:\Windows\system32\dxdiag.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID C:\Windows\system32\dxdiag.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 C:\Windows\system32\taskmgr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 C:\Windows\system32\dxdiag.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 C:\Windows\system32\taskmgr.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName C:\Windows\system32\taskmgr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\taskmgr.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName C:\Windows\system32\taskmgr.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID C:\Windows\system32\dxdiag.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\taskmgr.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName C:\Windows\system32\taskmgr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\taskmgr.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Gathers network information

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\ipconfig.exe N/A

Kills process with taskkill

defense_evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133822867889201198" C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\ = "DxDiagClassObject Class" C:\Windows\system32\dxdiag.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\CLSID C:\Windows\system32\dxdiag.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ = "DxDiagClassObject Class" C:\Windows\system32\dxdiag.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider C:\Windows\system32\dxdiag.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider\ = "DxDiagProvider Class" C:\Windows\system32\dxdiag.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7}\ProgID C:\Windows\system32\dxdiag.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject.1\ = "DxDiagClassObject Class" C:\Windows\system32\dxdiag.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject.1\CLSID C:\Windows\system32\dxdiag.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7}\InprocServer32 C:\Windows\system32\dxdiag.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\84094c40 C:\Windows\404C0984.dll N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject.1 C:\Windows\system32\dxdiag.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\CurVer C:\Windows\system32\dxdiag.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\CurVer\ = "DxDiag.DxDiagClassObject.1" C:\Windows\system32\dxdiag.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ForceRemove C:\Windows\system32\dxdiag.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2503671516-4119152987-701077851-1000\{F89E0643-71F8-402D-8EF6-09AF388C2A08} C:\Windows\system32\dxdiag.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\84094c40 C:\Windows\404C0984.dll N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\84094c40 C:\Windows\404C0984.dll N/A
Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2503671516-4119152987-701077851-1000\{D7B60A47-127A-4225-BD0A-FD71A140399A} C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2503671516-4119152987-701077851-1000\{25EE6B1C-B493-40C5-806D-E67A57E59251} C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID C:\Windows\system32\dxdiag.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\84094c40 C:\Windows\404C0984.dll N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\VersionIndependentProgID\ = "DxDiag.DxDiagClassObject" C:\Windows\system32\dxdiag.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ProgID C:\Windows\system32\dxdiag.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider.1\CLSID C:\Windows\system32\dxdiag.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2503671516-4119152987-701077851-1000\{DDDA718E-E1F8-4C78-AF3D-5B05A3C127F2} C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\84094c40 C:\Windows\404C0984.dll N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\84094c40 C:\Windows\404C0984.dll N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject C:\Windows\system32\dxdiag.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ForceRemove\ = "Programmable" C:\Windows\system32\dxdiag.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider.1 C:\Windows\system32\dxdiag.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider\CurVer C:\Windows\system32\dxdiag.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7}\VersionIndependentProgID C:\Windows\system32\dxdiag.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2503671516-4119152987-701077851-1000\{1AFDD125-DA12-44BC-9CE9-207BE7987E46} C:\Windows\system32\dxdiag.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\84094c40 C:\Windows\404C0984.dll N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject.1\CLSID\ = "{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}" C:\Windows\system32\dxdiag.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2503671516-4119152987-701077851-1000\{0FF8F7B1-1865-488D-BDB7-9CFF716CCC09} C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2503671516-4119152987-701077851-1000\{826FCC6E-0A35-4621-BFEE-6DD726F72829} C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\InprocServer32\ThreadingModel = "Apartment" C:\Windows\system32\dxdiag.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7} C:\Windows\system32\dxdiag.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\VersionIndependentProgID C:\Windows\system32\dxdiag.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\InprocServer32 C:\Windows\system32\dxdiag.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider.1\ = "DxDiagProvider Class" C:\Windows\system32\dxdiag.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\CLSID\ = "{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}" C:\Windows\system32\dxdiag.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B} C:\Windows\system32\dxdiag.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ProgID\ = "DxDiag.DxDiagClassObject.1" C:\Windows\system32\dxdiag.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\InprocServer32\ = "C:\\Windows\\system32\\dxdiagn.dll" C:\Windows\system32\dxdiag.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider\CLSID C:\Windows\system32\dxdiag.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider\CurVer\ = "DxDiag.DxDiagClassObject.1" C:\Windows\system32\dxdiag.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2503671516-4119152987-701077851-1000\{203EF18B-0069-4063-9134-A9928853CC19} C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\84094c40 C:\Windows\404C0984.dll N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\84094c40 C:\Windows\404C0984.dll N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\CG_Loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CG_Loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CG_Loader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\404C0984.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\404C0984.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\404C0984.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Windows\404C0984.dll N/A
N/A N/A C:\Windows\404C0984.dll N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Windows\system32\dxdiag.exe N/A
N/A N/A C:\Windows\system32\dxdiag.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Users\Admin\Downloads\Saltanat_Mt2_Setup_3.0.6.exe N/A
N/A N/A C:\Users\Admin\Downloads\Saltanat_Mt2_Setup_3.0.6.exe N/A
N/A N/A C:\Users\Admin\Downloads\Saltanat_Mt2_Setup_3.0.6.exe N/A
N/A N/A C:\Users\Admin\Downloads\Saltanat_Mt2_Setup_3.0.6.exe N/A
N/A N/A C:\Users\Admin\Downloads\Saltanat_Mt2_Setup_3.0.6.exe N/A
N/A N/A C:\Users\Admin\Downloads\Saltanat_Mt2_Setup_3.0.6.exe N/A
N/A N/A C:\Users\Admin\Downloads\Saltanat_Mt2_Setup_3.0.6.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A C:\Windows\404C0984.dll N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CG_Loader.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\404C0984.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\404C0984.dll N/A
Token: SeSecurityPrivilege N/A C:\Windows\404C0984.dll N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\404C0984.dll N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\404C0984.dll N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\404C0984.dll N/A
Token: SeSystemtimePrivilege N/A C:\Windows\404C0984.dll N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\404C0984.dll N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\404C0984.dll N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\404C0984.dll N/A
Token: SeBackupPrivilege N/A C:\Windows\404C0984.dll N/A
Token: SeRestorePrivilege N/A C:\Windows\404C0984.dll N/A
Token: SeShutdownPrivilege N/A C:\Windows\404C0984.dll N/A
Token: SeDebugPrivilege N/A C:\Windows\404C0984.dll N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\404C0984.dll N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\404C0984.dll N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\404C0984.dll N/A
Token: SeUndockPrivilege N/A C:\Windows\404C0984.dll N/A
Token: SeManageVolumePrivilege N/A C:\Windows\404C0984.dll N/A
Token: SeImpersonatePrivilege N/A C:\Windows\404C0984.dll N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\404C0984.dll N/A
Token: 33 N/A C:\Windows\404C0984.dll N/A
Token: 34 N/A C:\Windows\404C0984.dll N/A
Token: 35 N/A C:\Windows\404C0984.dll N/A
Token: 36 N/A C:\Windows\404C0984.dll N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\404C0984.dll N/A
Token: SeSecurityPrivilege N/A C:\Windows\404C0984.dll N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\404C0984.dll N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\404C0984.dll N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\404C0984.dll N/A
Token: SeSystemtimePrivilege N/A C:\Windows\404C0984.dll N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\404C0984.dll N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\404C0984.dll N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\404C0984.dll N/A
Token: SeBackupPrivilege N/A C:\Windows\404C0984.dll N/A
Token: SeRestorePrivilege N/A C:\Windows\404C0984.dll N/A
Token: SeShutdownPrivilege N/A C:\Windows\404C0984.dll N/A
Token: SeDebugPrivilege N/A C:\Windows\404C0984.dll N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\404C0984.dll N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\404C0984.dll N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\404C0984.dll N/A
Token: SeUndockPrivilege N/A C:\Windows\404C0984.dll N/A
Token: SeManageVolumePrivilege N/A C:\Windows\404C0984.dll N/A
Token: SeImpersonatePrivilege N/A C:\Windows\404C0984.dll N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\404C0984.dll N/A
Token: 33 N/A C:\Windows\404C0984.dll N/A
Token: 34 N/A C:\Windows\404C0984.dll N/A
Token: 35 N/A C:\Windows\404C0984.dll N/A
Token: 36 N/A C:\Windows\404C0984.dll N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\404C0984.dll N/A
Token: SeSecurityPrivilege N/A C:\Windows\404C0984.dll N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\404C0984.dll N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\404C0984.dll N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\404C0984.dll N/A
Token: SeSystemtimePrivilege N/A C:\Windows\404C0984.dll N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\404C0984.dll N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\404C0984.dll N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\404C0984.dll N/A
Token: SeBackupPrivilege N/A C:\Windows\404C0984.dll N/A
Token: SeRestorePrivilege N/A C:\Windows\404C0984.dll N/A
Token: SeShutdownPrivilege N/A C:\Windows\404C0984.dll N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\404C0984.dll N/A
N/A N/A C:\Windows\system32\dxdiag.exe N/A
N/A N/A C:\Windows\system32\dxdiag.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3496 wrote to memory of 4372 N/A C:\Users\Admin\AppData\Local\Temp\CG_Loader.exe C:\Windows\SysWOW64\cmd.exe
PID 3496 wrote to memory of 4372 N/A C:\Users\Admin\AppData\Local\Temp\CG_Loader.exe C:\Windows\SysWOW64\cmd.exe
PID 3496 wrote to memory of 4372 N/A C:\Users\Admin\AppData\Local\Temp\CG_Loader.exe C:\Windows\SysWOW64\cmd.exe
PID 4372 wrote to memory of 3892 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4372 wrote to memory of 3892 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4372 wrote to memory of 3892 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4372 wrote to memory of 2544 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 4372 wrote to memory of 2544 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 4372 wrote to memory of 2544 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 3496 wrote to memory of 4900 N/A C:\Users\Admin\AppData\Local\Temp\CG_Loader.exe C:\Users\Admin\AppData\Local\Temp\404C0984.exe
PID 3496 wrote to memory of 4900 N/A C:\Users\Admin\AppData\Local\Temp\CG_Loader.exe C:\Users\Admin\AppData\Local\Temp\404C0984.exe
PID 3496 wrote to memory of 4900 N/A C:\Users\Admin\AppData\Local\Temp\CG_Loader.exe C:\Users\Admin\AppData\Local\Temp\404C0984.exe
PID 4900 wrote to memory of 4816 N/A C:\Users\Admin\AppData\Local\Temp\404C0984.exe C:\Windows\SysWOW64\cmd.exe
PID 4900 wrote to memory of 4816 N/A C:\Users\Admin\AppData\Local\Temp\404C0984.exe C:\Windows\SysWOW64\cmd.exe
PID 4900 wrote to memory of 4816 N/A C:\Users\Admin\AppData\Local\Temp\404C0984.exe C:\Windows\SysWOW64\cmd.exe
PID 4900 wrote to memory of 3104 N/A C:\Users\Admin\AppData\Local\Temp\404C0984.exe C:\Windows\SysWOW64\cmd.exe
PID 4900 wrote to memory of 3104 N/A C:\Users\Admin\AppData\Local\Temp\404C0984.exe C:\Windows\SysWOW64\cmd.exe
PID 4900 wrote to memory of 3104 N/A C:\Users\Admin\AppData\Local\Temp\404C0984.exe C:\Windows\SysWOW64\cmd.exe
PID 4900 wrote to memory of 4688 N/A C:\Users\Admin\AppData\Local\Temp\404C0984.exe C:\Windows\SysWOW64\cmd.exe
PID 4900 wrote to memory of 4688 N/A C:\Users\Admin\AppData\Local\Temp\404C0984.exe C:\Windows\SysWOW64\cmd.exe
PID 4900 wrote to memory of 4688 N/A C:\Users\Admin\AppData\Local\Temp\404C0984.exe C:\Windows\SysWOW64\cmd.exe
PID 4816 wrote to memory of 2116 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\svchost.exe
PID 4816 wrote to memory of 2116 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\svchost.exe
PID 4816 wrote to memory of 2116 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\svchost.exe
PID 4816 wrote to memory of 4320 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 4816 wrote to memory of 4320 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 4816 wrote to memory of 4320 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 4688 wrote to memory of 4828 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4688 wrote to memory of 4828 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4688 wrote to memory of 4828 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3104 wrote to memory of 3744 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3104 wrote to memory of 3744 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3104 wrote to memory of 3744 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4688 wrote to memory of 3748 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 4688 wrote to memory of 3748 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 4688 wrote to memory of 3748 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 3104 wrote to memory of 3688 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3104 wrote to memory of 3688 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3104 wrote to memory of 3688 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4688 wrote to memory of 3112 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\System32\RuntimeBroker.exe
PID 4688 wrote to memory of 3112 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\System32\RuntimeBroker.exe
PID 4688 wrote to memory of 3112 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\System32\RuntimeBroker.exe
PID 4688 wrote to memory of 3856 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 4688 wrote to memory of 3856 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 4688 wrote to memory of 3856 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 3104 wrote to memory of 4700 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3104 wrote to memory of 4700 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3104 wrote to memory of 4700 N/A C:\Windows\SysWOW64\cmd.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3104 wrote to memory of 1308 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3104 wrote to memory of 1308 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3104 wrote to memory of 1308 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4688 wrote to memory of 1596 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\System32\svchost.exe
PID 4688 wrote to memory of 1596 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\System32\svchost.exe
PID 4688 wrote to memory of 1596 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\System32\svchost.exe
PID 4688 wrote to memory of 3416 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4688 wrote to memory of 3416 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4688 wrote to memory of 3416 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4900 wrote to memory of 3732 N/A C:\Users\Admin\AppData\Local\Temp\404C0984.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4900 wrote to memory of 3732 N/A C:\Users\Admin\AppData\Local\Temp\404C0984.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3732 wrote to memory of 1676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 3732 wrote to memory of 1676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4900 wrote to memory of 664 N/A C:\Users\Admin\AppData\Local\Temp\404C0984.exe C:\Windows\SysWOW64\cmd.exe
PID 4900 wrote to memory of 664 N/A C:\Users\Admin\AppData\Local\Temp\404C0984.exe C:\Windows\SysWOW64\cmd.exe
PID 4900 wrote to memory of 664 N/A C:\Users\Admin\AppData\Local\Temp\404C0984.exe C:\Windows\SysWOW64\cmd.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy WMI provider

ransomware

Uses Volume Shadow Copy service COM API

ransomware

Views/modifies file attributes

defense_evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\CG_Loader.exe

"C:\Users\Admin\AppData\Local\Temp\CG_Loader.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c echo|taskkill /F /IM 404C0984.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo"

C:\Windows\SysWOW64\taskkill.exe

taskkill /F /IM 404C0984.exe

C:\Users\Admin\AppData\Local\Temp\404C0984.exe

"C:\Users\Admin\AppData\Local\Temp\404C0984.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c echo|taskkill /F /IM CG_Loader.exe

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c echo y|cacls "C:\Users\Admin\AppData\Local\Temp\IObitUnlocker.sys" /P everyone:f & echo y|cacls "C:\Users\Admin\AppData\Local\Temp\IObitUnlocker.dll" /P everyone:f

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c echo|attrib -h -s -a C:\CG_Files & echo|RD /S /Q C:\CG_Files & echo|DEL /F /Q /A C:\CG_Files

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo"

C:\Windows\SysWOW64\taskkill.exe

taskkill /F /IM CG_Loader.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\SysWOW64\attrib.exe

attrib -h -s -a C:\CG_Files

C:\Windows\SysWOW64\cacls.exe

cacls "C:\Users\Admin\AppData\Local\Temp\IObitUnlocker.sys" /P everyone:f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" RD /S /Q C:\CG_Files "

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\SysWOW64\cacls.exe

cacls "C:\Users\Admin\AppData\Local\Temp\IObitUnlocker.dll" /P everyone:f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" DEL /F /Q /A C:\CG_Files"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://href.li/?https://cheatglobal.com/ui/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7fffbddf46f8,0x7fffbddf4708,0x7fffbddf4718

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c echo|sc stop IObitUnlocker & echo|NetSh Advfirewall Set allprofiles state off & echo|%windir%\404C0984.dll /protection off & echo|%windir%\404C0984.dll /op:uninstall_app & echo y|cacls "C:\Windows\System32\drivers\etc\hosts" /P %username% & echo y|cacls "C:\Windows\System32\drivers\etc\hosts.ics" /P %username%:f & echo y|cacls "C:\Windows\System32\drivers\etc\hosts" /P alla:f & echo y|cacls "C:\Windows\System32\drivers\etc\hosts.ics" /P alla:f & echo y|cacls "C:\Windows\System32\drivers\etc\hosts" /P everyone:f & echo y|cacls "C:\Windows\System32\drivers\etc\hosts.ics" /P everyone:f & echo y|cacls "C:\404C0984" /P alla:f & echo y|cacls "C:\404C0984" /P %username%:f & echo y|cacls "C:\404C0984" /P everyone:f & echo y|cacls "C:\404C0984\*.*" /P alla:f & echo y|cacls "C:\404C0984\*.*" /P %username%:f & echo y|cacls "C:\404C0984\*.*" /P everyone:f & echo y|cacls "C:\Users\Admin\AppData\Local\Temp\IObitUnlocker.dll" /P %username%:f & echo y|cacls "C:\Users\Admin\AppData\Local\Temp\IObitUnlocker.dll" /P alla:f & echo y|cacls "C:\Users\Admin\AppData\Local\Temp\IObitUnlocker.dll" /P everyone:f & echo y|cacls "C:\Users\Admin\AppData\Local\Temp\IObitUnlocker.sys" /P %username%:f & echo y|cacls "C:\Users\Admin\AppData\Local\Temp\IObitUnlocker.sys" /P alla:f & echo y|cacls "C:\Users\Admin\AppData\Local\Temp\IObitUnlocker.sys" /P everyone:f & echo y|cacls "C:\Windows\System32\drivers\etc" /P %username%:f & echo y|cacls "C:\Windows\System32\drivers\etc" /P alla:f & echo y|cacls "C:\Windows\System32\drivers\etc" /P everyone:f & echo y|cacls "%windir%\system32\drivers\etc" /P %username%:f & echo y|cacls "%windir%\system32\drivers\etc" /P alla:f & echo y|cacls "%windir%\system32\drivers\etc" /P everyone:f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo"

C:\Windows\SysWOW64\sc.exe

sc stop IObitUnlocker

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo"

C:\Windows\SysWOW64\netsh.exe

NetSh Advfirewall Set allprofiles state off

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,2368545015883410286,12642580223866988094,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,2368545015883410286,12642580223866988094,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,2368545015883410286,12642580223866988094,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,2368545015883410286,12642580223866988094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,2368545015883410286,12642580223866988094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo"

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\404C0984.dll

C:\Windows\404C0984.dll /protection off

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,2368545015883410286,12642580223866988094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4836 /prefetch:1

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c echo|type "C:\404C0984\Hosts_list.txt" > "%windir%\system32\drivers\etc\hosts.ics" & echo|type "C:\404C0984\Hosts_list.txt" > "%windir%\system32\drivers\etc\hosts" & echo|ipconfig /flushdns

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo"

C:\Windows\404C0984.dll

C:\Windows\404C0984.dll /op:uninstall_app

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" type "C:\404C0984\Hosts_list.txt" 1>"C:\Windows\system32\drivers\etc\hosts.ics""

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\SysWOW64\cacls.exe

cacls "C:\Windows\System32\drivers\etc\hosts" /P Admin

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" type "C:\404C0984\Hosts_list.txt" 1>"C:\Windows\system32\drivers\etc\hosts""

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c echo|"C:\Windows\404C0984.dll" /op:install_driver_registry & echo|"C:\Windows\404C0984.dll" /setitem "C:\Windows\System32\drivers\etc\hosts" Read-only & echo|"C:\Windows\404C0984.dll" /setitem "C:\Windows\System32\drivers\etc\hosts.ics" Read-only & echo|"C:\Windows\404C0984.dll" /settrusted "C:\Windows\System32\cmd.exe" Disabled & echo|"C:\Windows\404C0984.dll" /settrusted "C:\Windows\System32\conhost.exe" Disabled & echo|"C:\Windows\404C0984.dll" /settrusted "C:\Users\Admin\AppData\Local\Temp\404C0984.exe" Enabled & echo|"C:\Windows\404C0984.dll" /protection on & echo|attrib +h -s -a "C:\Windows\System32\drivers\etc\hosts" & echo|attrib +h -s -a "C:\Windows\System32\drivers\etc\hosts.ics" & echo|attrib +h -s -a %windir%\System32\drivers\etc\hosts & echo|attrib +h -s -a %windir%\System32\drivers\etc\hosts.ics

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo"

C:\Windows\404C0984.dll

"C:\Windows\404C0984.dll" /op:install_driver_registry

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo"

C:\Windows\SysWOW64\ipconfig.exe

ipconfig /flushdns

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,2368545015883410286,12642580223866988094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo"

C:\Windows\404C0984.dll

"C:\Windows\404C0984.dll" /setitem "C:\Windows\System32\drivers\etc\hosts" Read-only

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo"

C:\Windows\404C0984.dll

"C:\Windows\404C0984.dll" /setitem "C:\Windows\System32\drivers\etc\hosts.ics" Read-only

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo"

C:\Windows\404C0984.dll

"C:\Windows\404C0984.dll" /settrusted "C:\Windows\System32\cmd.exe" Disabled

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo"

C:\Windows\404C0984.dll

"C:\Windows\404C0984.dll" /settrusted "C:\Windows\System32\conhost.exe" Disabled

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,2368545015883410286,12642580223866988094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:1

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\SysWOW64\cacls.exe

cacls "C:\Windows\System32\drivers\etc\hosts.ics" /P Admin:f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\SysWOW64\cacls.exe

cacls "C:\Windows\System32\drivers\etc\hosts" /P alla:f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo"

C:\Windows\404C0984.dll

"C:\Windows\404C0984.dll" /settrusted "C:\Users\Admin\AppData\Local\Temp\404C0984.exe" Enabled

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\404C0984.dll

"C:\Windows\404C0984.dll" /protection on

C:\Windows\SysWOW64\cacls.exe

cacls "C:\Windows\System32\drivers\etc\hosts.ics" /P alla:f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo"

C:\Windows\SysWOW64\attrib.exe

attrib +h -s -a "C:\Windows\System32\drivers\etc\hosts"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\SysWOW64\cacls.exe

cacls "C:\Windows\System32\drivers\etc\hosts" /P everyone:f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo"

C:\Windows\SysWOW64\attrib.exe

attrib +h -s -a "C:\Windows\System32\drivers\etc\hosts.ics"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo"

C:\Windows\SysWOW64\attrib.exe

attrib +h -s -a C:\Windows\System32\drivers\etc\hosts

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo"

C:\Windows\SysWOW64\attrib.exe

attrib +h -s -a C:\Windows\System32\drivers\etc\hosts.ics

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\SysWOW64\cacls.exe

cacls "C:\Windows\System32\drivers\etc\hosts.ics" /P everyone:f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\SysWOW64\cacls.exe

cacls "C:\404C0984" /P alla:f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\SysWOW64\cacls.exe

cacls "C:\404C0984" /P Admin:f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\SysWOW64\cacls.exe

cacls "C:\404C0984" /P everyone:f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\SysWOW64\cacls.exe

cacls "C:\404C0984\*.*" /P alla:f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\SysWOW64\cacls.exe

cacls "C:\404C0984\*.*" /P Admin:f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\SysWOW64\cacls.exe

cacls "C:\404C0984\*.*" /P everyone:f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\SysWOW64\cacls.exe

cacls "C:\Users\Admin\AppData\Local\Temp\IObitUnlocker.dll" /P Admin:f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\SysWOW64\cacls.exe

cacls "C:\Users\Admin\AppData\Local\Temp\IObitUnlocker.dll" /P alla:f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\SysWOW64\cacls.exe

cacls "C:\Users\Admin\AppData\Local\Temp\IObitUnlocker.dll" /P everyone:f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\SysWOW64\cacls.exe

cacls "C:\Users\Admin\AppData\Local\Temp\IObitUnlocker.sys" /P Admin:f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\SysWOW64\cacls.exe

cacls "C:\Users\Admin\AppData\Local\Temp\IObitUnlocker.sys" /P alla:f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\SysWOW64\cacls.exe

cacls "C:\Users\Admin\AppData\Local\Temp\IObitUnlocker.sys" /P everyone:f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\SysWOW64\cacls.exe

cacls "C:\Windows\System32\drivers\etc" /P Admin:f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\SysWOW64\cacls.exe

cacls "C:\Windows\System32\drivers\etc" /P alla:f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\SysWOW64\cacls.exe

cacls "C:\Windows\System32\drivers\etc" /P everyone:f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\SysWOW64\cacls.exe

cacls "C:\Windows\system32\drivers\etc" /P Admin:f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\SysWOW64\cacls.exe

cacls "C:\Windows\system32\drivers\etc" /P alla:f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\SysWOW64\cacls.exe

cacls "C:\Windows\system32\drivers\etc" /P everyone:f

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,2368545015883410286,12642580223866988094,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6348 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k wsappx -p -s ClipSVC

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x24c,0x250,0x254,0x248,0x224,0x7ff744f65460,0x7ff744f65470,0x7ff744f65480

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,2368545015883410286,12642580223866988094,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6348 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,2368545015883410286,12642580223866988094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,2368545015883410286,12642580223866988094,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5976 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,2368545015883410286,12642580223866988094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,2368545015883410286,12642580223866988094,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,2368545015883410286,12642580223866988094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6372 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,2368545015883410286,12642580223866988094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,2368545015883410286,12642580223866988094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6524 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,2368545015883410286,12642580223866988094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,2368545015883410286,12642580223866988094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:1

C:\Windows\system32\dxdiag.exe

"C:\Windows\system32\dxdiag.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,2368545015883410286,12642580223866988094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1856 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,2368545015883410286,12642580223866988094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6564 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,2368545015883410286,12642580223866988094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6208 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,2368545015883410286,12642580223866988094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6232 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,2368545015883410286,12642580223866988094,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6536 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,2368545015883410286,12642580223866988094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6608 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,2368545015883410286,12642580223866988094,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,2368545015883410286,12642580223866988094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4808 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,2368545015883410286,12642580223866988094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6660 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,2368545015883410286,12642580223866988094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,2368545015883410286,12642580223866988094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6572 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,2368545015883410286,12642580223866988094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,2368545015883410286,12642580223866988094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6520 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,2368545015883410286,12642580223866988094,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4268 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x220,0x224,0x228,0x84,0x22c,0x7fffcc4ecc40,0x7fffcc4ecc4c,0x7fffcc4ecc58

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2040,i,2423679139459900674,12937141744017957085,262144 --variations-seed-version=20250112-180253.846000 --mojo-platform-channel-handle=2036 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1932,i,2423679139459900674,12937141744017957085,262144 --variations-seed-version=20250112-180253.846000 --mojo-platform-channel-handle=2088 /prefetch:3

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2096,i,2423679139459900674,12937141744017957085,262144 --variations-seed-version=20250112-180253.846000 --mojo-platform-channel-handle=2524 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3176,i,2423679139459900674,12937141744017957085,262144 --variations-seed-version=20250112-180253.846000 --mojo-platform-channel-handle=3224 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3184,i,2423679139459900674,12937141744017957085,262144 --variations-seed-version=20250112-180253.846000 --mojo-platform-channel-handle=3484 /prefetch:1

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3748,i,2423679139459900674,12937141744017957085,262144 --variations-seed-version=20250112-180253.846000 --mojo-platform-channel-handle=4072 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4864,i,2423679139459900674,12937141744017957085,262144 --variations-seed-version=20250112-180253.846000 --mojo-platform-channel-handle=4852 /prefetch:8

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4944,i,2423679139459900674,12937141744017957085,262144 --variations-seed-version=20250112-180253.846000 --mojo-platform-channel-handle=5000 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=5160,i,2423679139459900674,12937141744017957085,262144 --variations-seed-version=20250112-180253.846000 --mojo-platform-channel-handle=3916 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=5320,i,2423679139459900674,12937141744017957085,262144 --variations-seed-version=20250112-180253.846000 --mojo-platform-channel-handle=5312 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=3260,i,2423679139459900674,12937141744017957085,262144 --variations-seed-version=20250112-180253.846000 --mojo-platform-channel-handle=5464 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=3268,i,2423679139459900674,12937141744017957085,262144 --variations-seed-version=20250112-180253.846000 --mojo-platform-channel-handle=5324 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5084,i,2423679139459900674,12937141744017957085,262144 --variations-seed-version=20250112-180253.846000 --mojo-platform-channel-handle=4940 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=3488,i,2423679139459900674,12937141744017957085,262144 --variations-seed-version=20250112-180253.846000 --mojo-platform-channel-handle=5484 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=3588,i,2423679139459900674,12937141744017957085,262144 --variations-seed-version=20250112-180253.846000 --mojo-platform-channel-handle=5596 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=5896,i,2423679139459900674,12937141744017957085,262144 --variations-seed-version=20250112-180253.846000 --mojo-platform-channel-handle=6088 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=5472,i,2423679139459900674,12937141744017957085,262144 --variations-seed-version=20250112-180253.846000 --mojo-platform-channel-handle=5136 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=3424,i,2423679139459900674,12937141744017957085,262144 --variations-seed-version=20250112-180253.846000 --mojo-platform-channel-handle=3448 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=3452,i,2423679139459900674,12937141744017957085,262144 --variations-seed-version=20250112-180253.846000 --mojo-platform-channel-handle=3392 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5636,i,2423679139459900674,12937141744017957085,262144 --variations-seed-version=20250112-180253.846000 --mojo-platform-channel-handle=6168 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=6160,i,2423679139459900674,12937141744017957085,262144 --variations-seed-version=20250112-180253.846000 --mojo-platform-channel-handle=6240 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=3916,i,2423679139459900674,12937141744017957085,262144 --variations-seed-version=20250112-180253.846000 --mojo-platform-channel-handle=6300 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5804,i,2423679139459900674,12937141744017957085,262144 --variations-seed-version=20250112-180253.846000 --mojo-platform-channel-handle=6344 /prefetch:8

C:\Users\Admin\Downloads\Saltanat_Mt2_Setup_3.0.6.exe

"C:\Users\Admin\Downloads\Saltanat_Mt2_Setup_3.0.6.exe"

C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe

"C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe"

C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe

"C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe" --type=gpu-process --enable-features=SharedArrayBuffer --no-sandbox --gpu-preferences=KAAAAAAAAACAAwBAAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAKAAAAEAAAAAAAAAAAAAAACwAAABAAAAAAAAAAAQAAAAoAAAAQAAAAAAAAAAEAAAALAAAA --service-request-channel-token=9122412909792388454 --mojo-platform-channel-handle=1540 /prefetch:2

C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe

"C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe" --type=renderer --no-sandbox --enable-features=SharedArrayBuffer --service-pipe-token=11192940874851548037 --lang=en-US --app-path="C:\Program Files (x86)\Saltanat Mt2\resources\app.asar" --user-agent="Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) SaltanatMt2Patcher/3.0.6 Chrome/69.0.3497.128 Electron/4.2.0 Safari/537.36" --node-integration=true --webview-tag=true --no-sandbox --background-color=#fff --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --service-request-channel-token=11192940874851548037 --renderer-client-id=4 --mojo-platform-channel-handle=2172 /prefetch:1

C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe

"C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe" --type=gpu-process --enable-features=SharedArrayBuffer --disable-gpu-sandbox --no-sandbox --gpu-preferences=KAAAAAAAAACAAwBAAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAKAAAAEAAAAAAAAAAAAAAACwAAABAAAAAAAAAAAQAAAAoAAAAQAAAAAAAAAAEAAAALAAAA --service-request-channel-token=243971237677266540 --mojo-platform-channel-handle=3040 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/saltanat

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x144,0x148,0x14c,0x120,0x150,0x7fffbddf46f8,0x7fffbddf4708,0x7fffbddf4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/saltanat

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x148,0x14c,0x150,0x144,0x154,0x7fffbddf46f8,0x7fffbddf4708,0x7fffbddf4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,9807625647113608041,6076858333021523635,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,9807625647113608041,6076858333021523635,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,9807625647113608041,6076858333021523635,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9807625647113608041,6076858333021523635,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9807625647113608041,6076858333021523635,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1552,4940791983867284490,9367317980819503077,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 /prefetch:3

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9807625647113608041,6076858333021523635,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4428 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9807625647113608041,6076858333021523635,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3800 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9807625647113608041,6076858333021523635,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1

C:\Windows\system32\taskmgr.exe

"C:\Windows\system32\taskmgr.exe" /4

C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe

"C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe"

C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe

"C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe" --type=gpu-process --enable-features=SharedArrayBuffer --no-sandbox --gpu-preferences=KAAAAAAAAACAAwBAAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAKAAAAEAAAAAAAAAAAAAAACwAAABAAAAAAAAAAAQAAAAoAAAAQAAAAAAAAAAEAAAALAAAA --service-request-channel-token=8863356762680601012 --mojo-platform-channel-handle=1504 /prefetch:2

C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe

"C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe" --type=renderer --no-sandbox --enable-features=SharedArrayBuffer --service-pipe-token=15433136435056344150 --lang=en-US --app-path="C:\Program Files (x86)\Saltanat Mt2\resources\app.asar" --user-agent="Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) SaltanatMt2Patcher/3.0.6 Chrome/69.0.3497.128 Electron/4.2.0 Safari/537.36" --node-integration=true --webview-tag=true --no-sandbox --background-color=#fff --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --service-request-channel-token=15433136435056344150 --renderer-client-id=4 --mojo-platform-channel-handle=2144 /prefetch:1

C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe

"C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe" --type=gpu-process --enable-features=SharedArrayBuffer --disable-gpu-sandbox --no-sandbox --gpu-preferences=KAAAAAAAAACAAwBAAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAKAAAAEAAAAAAAAAAAAAAACwAAABAAAAAAAAAAAQAAAAoAAAAQAAAAAAAAAAEAAAALAAAA --service-request-channel-token=18407609638924052788 --mojo-platform-channel-handle=3224 /prefetch:2

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe

"C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe"

C:\Windows\system32\taskmgr.exe

"C:\Windows\system32\taskmgr.exe" /4

C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe

"C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe"

C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe

"C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe" --type=gpu-process --enable-features=SharedArrayBuffer --no-sandbox --gpu-preferences=KAAAAAAAAACAAwBAAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAKAAAAEAAAAAAAAAAAAAAACwAAABAAAAAAAAAAAQAAAAoAAAAQAAAAAAAAAAEAAAALAAAA --service-request-channel-token=7402026708377988993 --mojo-platform-channel-handle=1508 /prefetch:2

C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe

"C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe" --type=renderer --no-sandbox --enable-features=SharedArrayBuffer --service-pipe-token=2381878718211540021 --lang=en-US --app-path="C:\Program Files (x86)\Saltanat Mt2\resources\app.asar" --user-agent="Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) SaltanatMt2Patcher/3.0.6 Chrome/69.0.3497.128 Electron/4.2.0 Safari/537.36" --node-integration=true --webview-tag=true --no-sandbox --background-color=#fff --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --service-request-channel-token=2381878718211540021 --renderer-client-id=4 --mojo-platform-channel-handle=2136 /prefetch:1

C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe

"C:\Program Files (x86)\Saltanat Mt2\Saltanat Mt2.exe" --type=gpu-process --enable-features=SharedArrayBuffer --disable-gpu-sandbox --no-sandbox --gpu-preferences=KAAAAAAAAACAAwBAAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAKAAAAEAAAAAAAAAAAAAAACwAAABAAAAAAAAAAAQAAAAoAAAAQAAAAAAAAAAEAAAALAAAA --service-request-channel-token=12357643356432903084 --mojo-platform-channel-handle=3056 /prefetch:2

C:\Windows\system32\taskmgr.exe

"C:\Windows\system32\taskmgr.exe" /4

Network

Country Destination Domain Proto
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 45.89.16.2.in-addr.arpa udp
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 7.98.51.23.in-addr.arpa udp
US 8.8.8.8:53 gitlab.com udp
US 172.65.251.78:443 gitlab.com tcp
US 8.8.8.8:53 78.251.65.172.in-addr.arpa udp
US 8.8.8.8:53 href.li udp
US 192.0.78.26:443 href.li tcp
US 8.8.8.8:53 cheatglobal.com udp
US 104.21.36.223:443 cheatglobal.com tcp
US 8.8.8.8:53 nav.smartscreen.microsoft.com udp
GB 13.87.96.169:443 nav.smartscreen.microsoft.com tcp
GB 13.87.96.169:443 nav.smartscreen.microsoft.com tcp
GB 13.87.96.169:443 nav.smartscreen.microsoft.com tcp
US 8.8.8.8:53 26.78.0.192.in-addr.arpa udp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
GB 216.58.201.98:443 googleads.g.doubleclick.net tcp
US 8.8.8.8:53 223.36.21.104.in-addr.arpa udp
US 8.8.8.8:53 169.96.87.13.in-addr.arpa udp
US 8.8.8.8:53 2.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 42.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 98.201.58.216.in-addr.arpa udp
US 8.8.8.8:53 227.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 edge.msiserver.lan udp
US 8.8.8.8:53 data-edge.smartscreen.microsoft.com udp
GB 172.165.61.93:443 data-edge.smartscreen.microsoft.com tcp
GB 172.165.61.93:443 data-edge.smartscreen.microsoft.com tcp
GB 172.165.61.93:443 data-edge.smartscreen.microsoft.com tcp
US 8.8.8.8:53 cheatglobal.com udp
US 8.8.8.8:53 ep1.adtrafficquality.google udp
GB 216.58.213.2:443 ep1.adtrafficquality.google tcp
US 8.8.8.8:53 93.61.165.172.in-addr.arpa udp
US 8.8.8.8:53 2.213.58.216.in-addr.arpa udp
US 8.8.8.8:53 ep2.adtrafficquality.google udp
GB 142.250.200.33:443 ep2.adtrafficquality.google tcp
GB 142.250.200.33:443 ep2.adtrafficquality.google udp
US 8.8.8.8:53 33.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 arc.srv.lan udp
US 8.8.8.8:53 edge.msiserver.lan udp
N/A 224.0.0.251:5353 udp
GB 216.58.213.2:443 ep1.adtrafficquality.google udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 ntp.srv.lan udp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
US 8.8.8.8:53 edge.msiserver.lan udp
US 8.8.8.8:53 nav.smartscreen.microsoft.com udp
GB 172.165.69.228:443 nav.smartscreen.microsoft.com tcp
GB 216.58.213.2:443 ep1.adtrafficquality.google udp
US 8.8.8.8:53 228.69.165.172.in-addr.arpa udp
US 8.8.8.8:53 www.youtube.com udp
GB 216.58.201.110:443 www.youtube.com tcp
GB 216.58.201.110:443 www.youtube.com udp
US 8.8.8.8:53 i.ytimg.com udp
GB 142.250.178.22:443 i.ytimg.com tcp
US 8.8.8.8:53 110.201.58.216.in-addr.arpa udp
US 8.8.8.8:53 22.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 jnn-pa.googleapis.com udp
US 8.8.8.8:53 static.doubleclick.net udp
GB 142.250.187.194:443 googleads.g.doubleclick.net udp
US 8.8.8.8:53 www.google.com udp
US 8.8.8.8:53 yt3.ggpht.com udp
GB 172.217.16.234:443 jnn-pa.googleapis.com tcp
GB 142.250.179.228:443 www.google.com tcp
GB 142.250.180.6:443 static.doubleclick.net tcp
GB 142.250.187.193:443 yt3.ggpht.com tcp
GB 172.217.16.234:443 jnn-pa.googleapis.com udp
US 8.8.8.8:53 play.google.com udp
GB 216.58.212.206:443 play.google.com tcp
US 8.8.8.8:53 194.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 234.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 228.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 6.180.250.142.in-addr.arpa udp
US 8.8.8.8:53 193.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 3.180.250.142.in-addr.arpa udp
GB 216.58.212.206:443 play.google.com tcp
GB 216.58.212.206:443 play.google.com tcp
GB 216.58.212.206:443 play.google.com udp
US 8.8.8.8:53 206.212.58.216.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 fd.api.iris.microsoft.com udp
IE 20.223.35.26:443 fd.api.iris.microsoft.com tcp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
GB 216.58.213.2:443 ep1.adtrafficquality.google udp
US 8.8.8.8:53 ajax.googleapis.com udp
US 8.8.8.8:53 href.li udp
US 8.8.8.8:53 t.me udp
US 8.8.8.8:53 instagram.com udp
US 8.8.8.8:53 xenforo.com udp
GB 142.250.179.234:443 ajax.googleapis.com tcp
US 8.8.8.8:53 8.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 234.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 edge.msiserver.lan udp
US 8.8.8.8:53 region1.google-analytics.com udp
US 216.239.32.36:443 region1.google-analytics.com tcp
US 8.8.8.8:53 14.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 36.32.239.216.in-addr.arpa udp
US 8.8.8.8:53 checkappexec.microsoft.com udp
GB 51.11.108.188:443 checkappexec.microsoft.com tcp
US 8.8.8.8:53 188.108.11.51.in-addr.arpa udp
US 8.8.8.8:53 203.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 167.57.26.184.in-addr.arpa udp
US 8.8.8.8:53 edge.msiserver.lan udp
US 8.8.8.8:53 cheatglobal.com udp
GB 2.18.27.82:443 www.bing.com tcp
GB 2.18.27.82:443 www.bing.com tcp
US 8.8.8.8:53 r.bing.com udp
US 8.8.8.8:53 th.bing.com udp
GB 2.18.27.76:443 th.bing.com tcp
GB 2.18.27.76:443 th.bing.com tcp
GB 2.18.27.76:443 th.bing.com tcp
GB 2.18.27.76:443 th.bing.com tcp
US 8.8.8.8:53 82.27.18.2.in-addr.arpa udp
US 8.8.8.8:53 login.microsoftonline.com udp
IE 20.190.159.75:443 login.microsoftonline.com tcp
US 8.8.8.8:53 76.27.18.2.in-addr.arpa udp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 237.21.107.13.in-addr.arpa udp
US 8.8.8.8:53 ntp.srv.lan udp
US 8.8.8.8:53 www.google.co.uk udp
GB 216.58.201.99:443 www.google.co.uk tcp
GB 216.58.201.99:443 www.google.co.uk tcp
US 8.8.8.8:53 99.201.58.216.in-addr.arpa udp
GB 142.250.179.228:443 www.google.com udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 edge.msiserver.lan udp
GB 216.58.201.99:443 www.google.co.uk udp
US 8.8.8.8:53 edge.msiserver.lan udp
US 8.8.8.8:53 accounts.server.lan udp
US 8.8.8.8:53 www.google.com udp
GB 142.250.179.228:443 www.google.com udp
GB 142.250.179.228:443 www.google.com tcp
US 8.8.8.8:53 67.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 clients2.google.com udp
GB 142.250.180.14:443 clients2.google.com udp
GB 142.250.180.14:443 clients2.google.com tcp
US 8.8.8.8:53 accounts.server.lan udp
US 8.8.8.8:53 accounts.server.lan udp
GB 142.250.179.228:443 www.google.com udp
US 8.8.8.8:53 content-autofill.googleapis.com udp
US 8.8.8.8:53 update.msiservers.lan udp
US 8.8.8.8:53 beacons.gcp.gvt2.com udp
US 8.8.8.8:53 saltanatmt2-com-tr.webpkgcache.com udp
US 8.8.8.8:53 dns-tunnel-check.googlezip.net udp
US 8.8.8.8:53 tunnel.googlezip.net udp
US 216.239.34.157:443 tunnel.googlezip.net tcp
GB 142.250.187.193:443 saltanatmt2-com-tr.webpkgcache.com tcp
US 8.8.8.8:53 ogads-pa.googleapis.com udp
US 8.8.8.8:53 194.212.58.216.in-addr.arpa udp
US 8.8.8.8:53 157.34.239.216.in-addr.arpa udp
GB 216.58.201.106:443 ogads-pa.googleapis.com udp
GB 142.250.187.193:443 saltanatmt2-com-tr.webpkgcache.com udp
US 216.239.34.157:443 tunnel.googlezip.net tcp
GB 216.58.212.206:443 play.google.com tcp
US 8.8.8.8:53 106.201.58.216.in-addr.arpa udp
GB 216.58.212.206:443 play.google.com udp
US 8.8.8.8:53 consent.google.com udp
GB 216.58.204.78:443 consent.google.com tcp
US 8.8.8.8:53 78.204.58.216.in-addr.arpa udp
US 8.8.8.8:53 saltanatmt2.com.tr udp
US 104.18.12.161:443 saltanatmt2.com.tr tcp
GB 142.250.187.193:443 saltanatmt2-com-tr.webpkgcache.com udp
US 104.18.12.161:443 saltanatmt2.com.tr tcp
US 104.18.12.161:443 saltanatmt2.com.tr tcp
US 104.18.12.161:443 saltanatmt2.com.tr tcp
US 104.18.12.161:443 saltanatmt2.com.tr tcp
US 104.18.12.161:443 saltanatmt2.com.tr tcp
US 8.8.8.8:53 discordapp.com udp
US 104.18.12.161:443 saltanatmt2.com.tr udp
US 162.159.135.233:443 discordapp.com tcp
GB 142.250.179.228:443 www.google.com tcp
US 8.8.8.8:53 cdnjs.cloudflare.com udp
US 104.17.25.14:443 cdnjs.cloudflare.com tcp
US 8.8.8.8:53 233.135.159.162.in-addr.arpa udp
US 8.8.8.8:53 161.12.18.104.in-addr.arpa udp
US 8.8.8.8:53 connect.facebook.net udp
GB 142.250.179.228:443 www.google.com udp
GB 142.250.187.194:443 googleads.g.doubleclick.net tcp
GB 142.250.187.194:443 googleads.g.doubleclick.net tcp
IE 31.13.73.22:443 connect.facebook.net tcp
US 8.8.8.8:53 region1.analytics.google.com udp
US 8.8.8.8:53 stats.g.doubleclick.net udp
US 8.8.8.8:53 www.google.co.uk udp
US 216.239.32.36:443 region1.analytics.google.com tcp
BE 64.233.184.154:443 stats.g.doubleclick.net tcp
GB 216.58.201.99:443 www.google.co.uk tcp
GB 216.58.201.99:443 www.google.co.uk tcp
GB 216.58.201.99:443 www.google.co.uk tcp
GB 142.250.179.228:443 www.google.com tcp
IE 31.13.73.22:443 connect.facebook.net udp
US 8.8.8.8:53 www.facebook.com udp
IE 31.13.73.35:443 www.facebook.com tcp
US 8.8.8.8:53 14.25.17.104.in-addr.arpa udp
US 8.8.8.8:53 22.73.13.31.in-addr.arpa udp
US 8.8.8.8:53 35.73.13.31.in-addr.arpa udp
US 8.8.8.8:53 154.184.233.64.in-addr.arpa udp
GB 142.250.179.228:443 www.google.com udp
US 104.17.25.14:443 cdnjs.cloudflare.com udp
US 216.239.32.36:443 region1.analytics.google.com udp
US 8.8.8.8:53 challenges.cloudflare.com udp
US 104.18.95.41:443 challenges.cloudflare.com tcp
US 104.18.95.41:443 challenges.cloudflare.com tcp
US 104.18.95.41:443 challenges.cloudflare.com udp
US 8.8.8.8:53 41.95.18.104.in-addr.arpa udp
US 8.8.8.8:53 accounts.server.lan udp
GB 142.250.187.194:443 googleads.g.doubleclick.net udp
GB 216.58.201.99:443 www.google.co.uk udp
US 8.8.8.8:53 csp.withgoogle.com udp
IE 31.13.73.35:443 www.facebook.com udp
GB 142.250.187.209:443 csp.withgoogle.com tcp
US 8.8.8.8:53 209.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 cdn.patch.saltanat.epvp.com.tr udp
US 104.21.80.1:443 cdn.patch.saltanat.epvp.com.tr tcp
US 104.21.80.1:443 cdn.patch.saltanat.epvp.com.tr tcp
US 104.21.80.1:443 cdn.patch.saltanat.epvp.com.tr tcp
US 8.8.8.8:53 1.80.21.104.in-addr.arpa udp
US 104.21.80.1:443 cdn.patch.saltanat.epvp.com.tr tcp
US 104.21.80.1:443 cdn.patch.saltanat.epvp.com.tr tcp
US 8.8.8.8:53 8.173.189.20.in-addr.arpa udp
US 8.8.8.8:53 discord.gg udp
US 8.8.8.8:53 nav.smartscreen.microsoft.com udp
US 162.159.133.234:443 discord.gg tcp
GB 51.140.244.186:443 nav.smartscreen.microsoft.com tcp
US 8.8.8.8:53 discord.com udp
US 162.159.138.232:443 discord.com tcp
US 8.8.8.8:53 234.133.159.162.in-addr.arpa udp
US 162.159.138.232:443 discord.com udp
US 8.8.8.8:53 186.244.140.51.in-addr.arpa udp
US 8.8.8.8:53 232.138.159.162.in-addr.arpa udp
US 8.8.8.8:53 cxcs.microsoft.net udp
FR 23.218.22.147:443 cxcs.microsoft.net tcp
GB 2.18.27.76:443 www.bing.com tcp
US 8.8.8.8:53 147.22.218.23.in-addr.arpa udp
US 104.21.80.1:443 cdn.patch.saltanat.epvp.com.tr tcp
US 104.21.80.1:443 cdn.patch.saltanat.epvp.com.tr tcp
US 8.8.8.8:53 cdn.patch.saltanat.epvp.com.tr udp
US 104.21.48.1:443 cdn.patch.saltanat.epvp.com.tr tcp
US 104.21.48.1:443 cdn.patch.saltanat.epvp.com.tr tcp
US 8.8.8.8:53 1.48.21.104.in-addr.arpa udp

Files

memory/3496-0-0x000000007515E000-0x000000007515F000-memory.dmp

memory/3496-1-0x0000000000F80000-0x00000000013DC000-memory.dmp

memory/3496-2-0x0000000005C20000-0x0000000005CB2000-memory.dmp

memory/3496-3-0x0000000005CC0000-0x0000000005D5C000-memory.dmp

memory/3496-4-0x0000000006310000-0x00000000068B6000-memory.dmp

memory/3496-5-0x0000000005DA0000-0x0000000005DAA000-memory.dmp

memory/3496-6-0x0000000005E10000-0x0000000005E66000-memory.dmp

memory/3496-7-0x0000000075150000-0x0000000075901000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\404C0984.exe

MD5 c25c2a6060a71bd7707444a6f6474250
SHA1 ce8bae5c3c5cfda3b3136644abce36c14ca5acde
SHA256 91b99f2ebbabad81a8804730e9671329bd79d4b5ccbbb22c4da2eb365da2c68c
SHA512 1c79d92c755faff11cbb89281e49ebfbb90c86b3b7101bbf6c5c6d5349a8daa281d3e6432306d752e84a73b4a20286f763500e68100194e9e1a90edcec8b4ac4

memory/4900-10-0x0000000075150000-0x0000000075901000-memory.dmp

memory/4900-11-0x0000000000570000-0x00000000009CC000-memory.dmp

memory/3496-12-0x0000000075150000-0x0000000075901000-memory.dmp

memory/4900-13-0x0000000075150000-0x0000000075901000-memory.dmp

memory/4900-15-0x0000000009560000-0x0000000009722000-memory.dmp

memory/4900-14-0x00000000072D0000-0x0000000007314000-memory.dmp

memory/4900-16-0x000000000A020000-0x000000000A54C000-memory.dmp

memory/4900-17-0x0000000009E70000-0x0000000009E9C000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 5408de1548eb3231accfb9f086f2b9db
SHA1 f2d8c7e9f3e26cd49ee0a7a4fecd70b2bf2b7e8a
SHA256 3052d0885e0ef0d71562958b851db519cfed36fd8e667b57a65374ee1a13a670
SHA512 783254d067de3ac40df618665be7f76a6a8acb7e63b875bffc3c0c73b68d138c8a98c437e6267a1eb33f04be976a14b081a528598b1e517cdd9ad2293501acc8

\??\pipe\LOCAL\crashpad_3732_KNIEACOAYDLDSGHT

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3aeb02cf-2223-466c-984a-a477c11ff431.tmp

MD5 e5e3377341056643b0494b6842c0b544
SHA1 d53fd8e256ec9d5cef8ef5387872e544a2df9108
SHA256 e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25
SHA512 83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 254fc2a9d1a15f391d493bff79f66f08
SHA1 6165d5a9de512bb33a82d99d141a2562aa1aabfb
SHA256 2bf9282b87bdef746d298cff0734b9a82cd9c24656cb167b24a84c30fb6a1fd0
SHA512 484a1c99ee3c3d1ebf0af5ec9e73c9a2ca3cf8918f0ba2a4b543b75fa587ec6b432866b74bcd6b5cdd9372532c882da438d44653bd5bccdbc94ebc27852ff9e2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 5887c8caeaf9dd258ecf059ea0172c8d
SHA1 93706bfdb80fa2dc996f1fd2890c3dcf59fa4e9a
SHA256 cf8a780c57ebfd01a032e96287130149d29f1daf93cae961539d45cf9b8bc739
SHA512 73266acd87e50a2be003e584eb6cf4eb6c785e669f04262f26c164b327c6a816c77686d534a9a1a69cd9f0624fbc0de7253417cd232cfc38036b2b78ef6168d2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

MD5 48febe0b0625901956573dfb2378e7ed
SHA1 c324173a8f8fd7a6a7398f6bb24dd2ee11d3cf24
SHA256 f0fae7ad33efdd05845d0d631ce8341ea4b6dfd4c45be844f0c117738df9c0d0
SHA512 fc38a0c64e67e3b5d43f787fe86f700e6f753d8e90bcebc446d4a8c631b9e4362a74fa862a5b2ffc74f3f5236d3ecf006b341042b5469d1cc24f2c325a607a91

C:\Users\Admin\AppData\Local\Temp\IObitUnlocker.dll

MD5 69cdc240b3f2ad30b989e2c6cf705383
SHA1 07f3508c44d503d39fb4b7924ededaab2a9768be
SHA256 e42526f348de6a97f9746686e8409e396b42ce0c552dfdbe34855455c837b805
SHA512 25ea3582470e9fc42e7d4a8a652b8ba37b726cc03a1ab40dcac60b7c695bf9714f501be50b01775a6344d09856ca8d2b3a030f5a27efb34a7d9dc98a68eadbca

C:\Windows\404C0984.dll

MD5 d33241881248aeeedf1f69c56116a0a8
SHA1 bea271b0b46b22194407758d0536f8567e191750
SHA256 6b7f866fe750bcf961b7c035cbc4ad29aab8890f3358fee94c2bc386b90ca950
SHA512 62e730da39b69a945844ba128a1b69af6f9c8437ebd0525a4fc23c0e8b33132664157fa506fd0f844301b5c158ab0ef5c32b9fee49d971e5f2d3dbc28a7c60db

memory/4800-118-0x0000000000950000-0x0000000001199000-memory.dmp

memory/4800-122-0x0000000000950000-0x0000000001199000-memory.dmp

memory/1800-124-0x0000000000950000-0x0000000001199000-memory.dmp

memory/1800-126-0x0000000000950000-0x0000000001199000-memory.dmp

C:\404C0984\Hosts_list.txt

MD5 77a98894d347dbe529f9a1b050d9e889
SHA1 06d8141acad7a09d1da8e83be580a2227a710db1
SHA256 84ae2bb0bf27d419541abbf8867c8c256f38207c28929a902388dcfec4f2b790
SHA512 03e53cc37ffe4f4f8d6ead394aadb14b8dd1c33a8ca6c57a6cdab1676b7b28d2936d4b6f7d55d04de7cd146ba9c0f44705e9455bebec246aa3cbe3f7c84a7529

memory/2376-207-0x0000000000950000-0x0000000001199000-memory.dmp

C:\ProgramData\{CF93D06A-43BB-4aa4-A4FB-99880124E1AC}.log

MD5 507f928b679ef0dacdf32e66d08d5a8f
SHA1 b67227165d6ea10887eda7f1da423be2da136fcf
SHA256 8bf489b16a39a917cecc2599e645208525cd59b7ac382a9f4acc074e8a3b17fc
SHA512 6b847ba12455366d466a7e9b0ed5d2ccea747f0c7b3e9f4c2572255f065621ee8dcc408a867db5d3ccf2049f47cb975999f8a271d4e63d4c91e8086b6d484945

memory/2376-213-0x0000000000950000-0x0000000001199000-memory.dmp

C:\ProgramData\{CF93D06A-43BB-4aa4-A4FB-99880124E1AC}.log

MD5 20d8ca73af02f8aecb8d16942c77275c
SHA1 12aba88bfa62a9d34a8eb395371c9d027403c677
SHA256 6c7959b6f55fb58b218188bd9e29c03f69162e15405ede1319c5109b041934e9
SHA512 17dc7335a32c42a028031c290e522cd08fabb0cea48fe5e2ac71880f2f1b06fad567cef120744caec19e107722b4d3bdede690d53037493bf7b15449ff5e44d4

memory/228-217-0x0000000000950000-0x0000000001199000-memory.dmp

memory/4900-228-0x0000000075150000-0x0000000075901000-memory.dmp

memory/3016-229-0x0000000000950000-0x0000000001199000-memory.dmp

memory/3016-230-0x0000000000950000-0x0000000001199000-memory.dmp

memory/3080-237-0x0000000000950000-0x0000000001199000-memory.dmp

memory/3080-236-0x0000000000950000-0x0000000001199000-memory.dmp

memory/228-226-0x0000000000950000-0x0000000001199000-memory.dmp

memory/1468-240-0x0000000000950000-0x0000000001199000-memory.dmp

memory/1468-242-0x0000000000950000-0x0000000001199000-memory.dmp

memory/3036-245-0x0000000000950000-0x0000000001199000-memory.dmp

memory/1160-252-0x0000000000950000-0x0000000001199000-memory.dmp

memory/1160-247-0x0000000000950000-0x0000000001199000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IObitUnlocker.sys

MD5 47aa03a10ac3a407f8f30f1088edcbc9
SHA1 b5d78a1d3ae93bd343c6d65e64c0945d1d558758
SHA256 c79a2bb050af6436b10b58ef04dbc7082df1513cec5934432004eb56fba05e66
SHA512 3402ca68b00ffd9e2551f97b3895990ee0274f14f117505c3588ea76c716488860ac2da07c1d9275bbc43eb87b88893c52fb04d15f1afe7b7bf7d9a524961101

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

MD5 5144f7c7dcd3ce6090c81561a751960a
SHA1 c3022ab986ba3d4359a5b7a96e5f5f35c2dca9db
SHA256 3a61471d48b8f90e6905a36c03cb8b913d7af8f89b32a335b7219db95a1123d1
SHA512 fa45d2a113120358c0ff29f1b5fc8eec40105bd22a49bac811d22366f46a87da61704ffd5dfb3df090cda9b3255e7c85aecabaee51a6f7c365f86538e8de3962

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

MD5 0a994de62d16e1877db102ec8af849c8
SHA1 59ebdc709183b7f351f5171ee91843c87a888892
SHA256 1f887c30d1b582397b7f493a2dfe5967f634df4be7b8cde1b259acc075a5f758
SHA512 43b3f38ff9fd0aff1573e009439dbbb36c794d439d029a93fd516e8c51d3086852841291cb9c8aba3d1f4f67d0ee7a0cacfabde29def0d36bf4475526f9122c1

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 e791aa8bd642e50b534dd4469fc4a03d
SHA1 ed0b5a8165564f448530fe246a6c65e134752bd5
SHA256 a5f85bdb5e5b2c67b2c7c86e2b16fd91bd1ecbdd1e11ad2164dde1a74b0177dd
SHA512 8f2deec07e119cef3e13a66c930fd7f5faba2f31f8477e762b48b5b8c695e08ed4f01f8f2754ea57ab65b70f3b49e04fc3f10079355a68566542e6ea506308d1

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 23fdb5950cb78c4b7ab0e50106aaf7e3
SHA1 7d8ed5f806b70c7b58c2482444c2fcbe36344631
SHA256 33a6b0b18512e2e89af6bda93608fe2e6331ba391a6a478c752984a3d3902023
SHA512 6d96fc0badefd4d19a1036915477737f447eae6a0d760dce8dec54f2ccf81ec93415d61e69863f4c6af0a1ce1070209bc172a388f265a9b3a60bca20b1740dd7

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

MD5 bc3a0ca62cfef580ff9ebbb7afc92b9b
SHA1 fde9832ce521fcd53850d0701a543ef75b772e3b
SHA256 b0203fb7c3812937e92ac04ad6065a2129bc165a36a60a4d2fdb0accc4499464
SHA512 fc1f3a5bd2106d9b6ed5a678c2f4978550a0d7414172b0ce6954a835b0da01ac28c177955a48c2ef56ea3d517a6672474a9cab873aeccae3f22a45ccf2d070de

memory/3080-338-0x0000000000950000-0x0000000001199000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000023

MD5 dac18388ad86ed5ec1bd4d3bdedd4bb9
SHA1 1e30106429e1e84a697db46be2dff99a6df0f6bf
SHA256 0bbf84d7088148e0a398ffa522218b3e0c12a56f95c613cd5b205fa22414ad4f
SHA512 9b108ca9cdcf79577525ccdc752ce6c753323ca918a23b8f4e99041be4e5411f702d185884494b57fa2f2f58083dbe067c37312a6d4663d6d923990b0c4e499f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 9aaec168302a997b4c82e22d55e2d27b
SHA1 0876a22da3d5013ff1038983fbf7032612dbce0d
SHA256 896fdef973fbb24bf35947c2540ad1e3743060f0ccf12b3bc1521119dd2ebd88
SHA512 f5e7408392f17d314dd9cd627a207d090bbb7f02bf6aa734209d1a952266b422d3c56b80d7c241ff25af9340d1945236e58b80de8a980190437483e0860ffeb0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 3d57c6344d4921b93c520e9990534530
SHA1 d0741f21b8aae2999be9b0a5a1df68f0158b9ece
SHA256 4bbfd9770867183e4c5a755d211b7b74779ee2d74c5b1137098e3083f9dd51da
SHA512 bc0d12333f2fded06103399a743458fde81d21af2bc59447f29edf02f26dfb4598f21f93e007c9efd9ad8e3c2377fa0f3fbf22eb3768ccfe05f2d6de98778fad

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57facb.TMP

MD5 e73149334590655fceb29a7db6d941c3
SHA1 a22e252c1a5544b0d3a708b7af3f36114ddf46dd
SHA256 6760a4ded011a8bf6fd309b397ccfb10637fd0ae45002c44ac2416084f650703
SHA512 45b14bc28a7cf48889d2d585ff24e09fc3030eead63d95958f8f85e537c68a65a0f4cd79ac7777190fdf3dac768095391e67bb20513bdd5086d3f0a64df5bc33

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c40373b1ad3418c01a3982fed8d9ff0083761334\index.txt

MD5 cbbec9ac8e8414cd2498a63727b7854d
SHA1 bd454e37c00108936769d925666da43caf7b6e64
SHA256 23eef83a9052e33fce5b378396b2cf79bd4b521a65ed11a5d3ff6a73b80591ff
SHA512 a61570f76015ed750c60e2bba199457507709f929257c61a7c28bbedbeb45c90ada60ff67d56c539bceed0bcf2af6aec07faf33b2c3cfbe8c944965eab20d45d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 afef2cf89c8ada85994e2fbcaede5395
SHA1 514d88b9d185db51a622018f30756085920979b1
SHA256 a787056232df494e0e25297b703de130d815460036639c07c784901a2aea4bee
SHA512 637033b9afe3fdc509d63296e2ce5fbf5975d5a82ae0fc45a83f84c6f8f8f9c15615845a362bda75f928d243ce65f5cd7c3feecbf3cd3706ae4330a1ee9f00ec

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 073862ac867dcc3055b158b907f78745
SHA1 3a982c776ae1374ffd362f48aa2feb656dff8aaf
SHA256 f1025d398913926e60e9aa1503a24497e7cacf0e3ca80933ff32459b4d127dfa
SHA512 b7af905f0f48b60afecf2837a05a3b1257a63df61ba79f2202b08331397ef769bb373b8dced8c6fb94de55cc7615bb21ca51cc7790827a0f07d1197d8a24d82c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 7240006d213ad3cb4bf75ef95b162b1c
SHA1 1cff65498f26e60e2c023eeb987f8a20198c2418
SHA256 0ecd3897ad3ae669d221fd35003bf2aa2ef6d34c2e1b12d469f478a20a332001
SHA512 b403139dcad71fd4a51bb20618b291ac55a1f20d2cdf4dfd4b05eb954cc6f195a8b2f1faf37cb93dca9dc8013a51df01298ef94a10deada246a6d52955ec69f1

memory/5920-533-0x00000174CEFA0000-0x00000174CEFA1000-memory.dmp

memory/5920-534-0x00000174CEFA0000-0x00000174CEFA1000-memory.dmp

memory/5920-535-0x00000174CEFA0000-0x00000174CEFA1000-memory.dmp

memory/5920-539-0x00000174CEFA0000-0x00000174CEFA1000-memory.dmp

memory/5920-545-0x00000174CEFA0000-0x00000174CEFA1000-memory.dmp

memory/5920-544-0x00000174CEFA0000-0x00000174CEFA1000-memory.dmp

memory/5920-543-0x00000174CEFA0000-0x00000174CEFA1000-memory.dmp

memory/5920-542-0x00000174CEFA0000-0x00000174CEFA1000-memory.dmp

memory/5920-541-0x00000174CEFA0000-0x00000174CEFA1000-memory.dmp

memory/5920-540-0x00000174CEFA0000-0x00000174CEFA1000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe586702.TMP

MD5 a1f379773de86922a71db417f9b74aef
SHA1 e0889825b40c8aa9c3b2e2ea1a6f1ee3e97c3072
SHA256 3353e6f710c1a5d7f169c4a17213f5ddda8fb5b03f7568092bc5c1814c4cb811
SHA512 975cec43eb690fad0e0f6ad6a0650334d860a3d635584452d31b1cecfceb58520a53a67bb395d2df458ed815dab780d1aa1a11d2bd91ad297e21f26f330c55fb

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

MD5 5dc01f070f4faf4862b9754aca02ee36
SHA1 e1ea74cf442efcf42695eea0617db55842bc34a3
SHA256 00ececf97c378e3cc37607c4708ed8dbcd24a48d273888b3d8ead40be52fdc3a
SHA512 983f2e50b15b9389ed6d4d624d9f6add48f732fb51047b09f2759553abe7583f39ca0886e9975f9b0f3674b5fb604dc718e8e87607b56b10be99c1bd28ccc874

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 e79b58432c64ff5d916757978df83ee8
SHA1 58a2ffccc5e62f96b720e66648d5d42e44a29128
SHA256 2ef7bd852bab6ffa5c28db01f39e2334c9ec5b4793f4b0d536663342c56a6d11
SHA512 69c24e003324d4e0ba6d222520c71c0df078d4cdb18cf8ef5f73d3719b426f3373a590adbc19f646931c672ff92e1f99dcef6f606f4eb91eddb7936ec0921852

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 00c6defa72a63c8d4d866056e24d1241
SHA1 6c894fde44ac52a76f25df51aff8f07aed391f4d
SHA256 3bb006525731fa21835d9b2da80859fc6f1b4fe592ed0f78bc809a5e09194807
SHA512 25dd1e55d9a4f40743e6cdf2a50a1f8878c50aca1605c1de5567d1d5375f06354c130b1673771f067720b827b33754d90fc0c752874d7eda8229debef1d1aa3b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c40373b1ad3418c01a3982fed8d9ff0083761334\bce06a4a-0004-4c64-90c3-257a01094dfa\index-dir\the-real-index

MD5 eba5dbe7f1634870e41679fa736b0c5e
SHA1 afb0dc92e365c346fd3716a41c63e3a5b7cb37bb
SHA256 9e7037b1109c1060fef0ce8560d850165817def055d4a7304b020c5e7b2f4653
SHA512 49ad565cda71462f9ae48b2dab76ced59e183296086d4126fa82045ce51f77dcf775cfbd56b1da075bb7980cdb6be6de65b43d9b0d7ba59b8439254e0923d0ea

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c40373b1ad3418c01a3982fed8d9ff0083761334\bce06a4a-0004-4c64-90c3-257a01094dfa\index-dir\the-real-index~RFe5868e6.TMP

MD5 1600dd00496a1f686ec7bb6bd417bf1d
SHA1 bab90ceacc4212e0628f671df224341c591df6b6
SHA256 cb1c0e0624ac5addf812339327564c625b57d87b90763b3abd9a8c483cdadffc
SHA512 a5bbe37574b325ee215fe5b7bd499a109355eafba297084dfeb118f1e7e4a089a1efe1d317707ccbb1f38cf3be92715f5283792a0c369e0c9629891b1cd345c8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c40373b1ad3418c01a3982fed8d9ff0083761334\index.txt

MD5 61dd15c5da81f1f2ee355fbe00e84e21
SHA1 9778e024d52a3b0063852c437273bc68e716c2cf
SHA256 df961215c335392c82c1655ca10134bb110b437c8134b81b1f55b283de4b9242
SHA512 16a99d14279624feb692c6618de43f88d9110b0919b346bf48a7e1af1d8ba722ab4690b670f229e0c3d96795e1867a8c61893dcb09b8c9f36c4a2d70015dd1e7

memory/5920-597-0x00000174CF1F0000-0x00000174CF67E000-memory.dmp

memory/5920-598-0x00000174CF1F0000-0x00000174CF67E000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 968a9f86e718d4bc8376baf85037f65f
SHA1 d45734d68712ccae5f0acf811fa8c9dd252126c7
SHA256 a7d1ba88497586c0a5b9774d2334183a1bbb38d1f48dd82db028d765470fb223
SHA512 97d1239e6da69f862efa9affb362de108e150cfc1c07d391d6b7796868d39441d5963ce853a81c080a5dbf41d5c39fc33d4199749e52e082828336aeb1e396c8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State~RFe58a2d3.TMP

MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 6e15d8b04aa853213e0dfbb08de39ec4
SHA1 9a7766636e4c6bb2b484909ed1569e77524f0d6c
SHA256 8a7c3287a76c3d64f88190b1413f092c63bee2821e7af18a205bc12914017f7a
SHA512 cfd77c653954b3bd907bb19ea7c7bb5a10e8ae4d25a53f1a8e7fba7afe6fcd017ff078cec271d177a2f45ce6ca5547e2a24e5100eb6c691cd882472b7b82e046

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 06f153843de69f6912c67c6ad2d2888e
SHA1 b4e23c0d920006b75dd3c9007c7d632045fdf9ef
SHA256 5841af60118bf558b4f00e8559e9b1333ca2c8da96f0bdd7334764b9bea524e4
SHA512 f0d36e6c2220aa7bdf5253d7c6cf977b64490ecf555f299e53be28d2813c1ade5eeceab8e414a1c2d8bfbcba1bcef715c8510a4c2db7788fd91a8493e4791ecf

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000043

MD5 7b49e7ed72d5c3ab75ea4aa12182314a
SHA1 1338fc8f099438e5465615ace45c245450f98c84
SHA256 747c584047f6a46912d5c5354b6186e04ea24cf61246a89c57077faf96679db6
SHA512 6edf4594e2b850f3ede5a68738e6482dd6e9a5312bffa61b053312aa383df787641f6747ac91fa71bb80c51ed52a0c23cc911f063cd6e322d9a1210aea64e985

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000044

MD5 4a686349993965721f090d158a10a6c4
SHA1 fb0f61ba49cfd7e213111690b7753baf3fcce583
SHA256 65451d12c37acf751e9f4732e9f9f217149b41eebad5b9028eac8bd8d2d46d8f
SHA512 0dc571487fd798b62678378c2dd514fb439f6c131637d244c8c3dd48d5e84267d21fe633c5b20578e621d5e8fe2958c5e58bc18ebe2d4731b18669fec4031489

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 7295ccd42cdb3e3595a59642f78a2719
SHA1 438005407071b2646d358c46c14fe73002d0a82a
SHA256 19fae4f1c5605f9e4d44130f58907e94727b566384a9fc64b1d64b5b023dbd38
SHA512 9caba5f6c19a7b21f9f8f2700f10445b0ee62986fabf1a5dadeaa033dfeda076258cbf0d40ffa1f78569e33df805cc7fea036f0b1fddf26388a19104778ca5b9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 a7226f22cd8df1f72ca3466b84c87808
SHA1 09e03d1207a5497bf3cd715c6a73ef7191f7bce7
SHA256 7bb2be6d233e7d212432defb22d2b69125c9e384ee5eedef0e8293f33e8e57c5
SHA512 0b9f75acb3dff8161c234aff94e4dde791bfca7fc472604e024b10bf9198147c8ca66b7e420839e25b96c8da5a0d515eeb8087d02dfcefb63bf35d50b279948d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 07fc5f2515241f24d41ba7e599084d30
SHA1 9cf1323c68e5059af275e90e9f58f5d34ad79ace
SHA256 44c6ac21d8c4598150dd8abae9648fa445d296ebcb70db024c5536a980f96647
SHA512 e59d4870e22bce780961eb334f9dd196095dd88c1dc1206a488f5c68c73ab0c62692e15841cfdba67554db8915adc72eab62aea5d103919d11d9a486f6c14ae3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 594dd8041e7024954fb40fa6f620ee6b
SHA1 a7c03cbef51620dadb3e4cc6b6dc76e1e1ead0c8
SHA256 a8f54cb2dc2e2a32d061f12e04a10f53aca41add9799c7ee8e94dc90523d1867
SHA512 c728e6779339e59c4864a0bfd9a133dbcee93c62fb9977b52fe42e5729ab434a4dd7be5767572db85cf182539733cd2e8184f3de7c2f238136dc5642f2cf4d82

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 a8ca4c0a82ac0bdcf33c6740f7167ab1
SHA1 c9f21b9fd85a033135f6ed9aa6946753dd4625b0
SHA256 0b95ed0b4e8363b34b0c7c21af1f34c182bcfb2dfe6498c296c119aa24837e63
SHA512 7ee5c770e4d9aea59afd0ca64d9d5382a02b236c43ae45e63c8d7c3bdcbee9e01f8dd708ee6ad4bbce550ac8a7d2c51720d38e1bf941465f9dd10c7a196373ff

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

MD5 38d7eda580b30446ce2c8e2c434c8cfc
SHA1 cd4c70fc5dc57992df981296e4f881364b4b27e5
SHA256 7a5d31c65dd2214ffe4eb8b5641f07f61138cd0572a7ec34abf8d7815dd4f541
SHA512 32bc9ee3f588cb8627c30d8cd22bdbd2452939d0c303bd5942f8455319c048728f281abc75ebbbfe6c9c6d292bb38c37fd79d4eeb59cb4d07d7f9e4ea57d5a70

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

MD5 1ea6e07588d872eb3634d65e3aac539d
SHA1 254d5dffadd556dc66cd5124bc67ca4c67e1a624
SHA256 cde8023989ca2b81a4a1c10c44bd65f69f1006b8288783d6bcf8713114c9ba77
SHA512 79fffbe4013c2503728757ae5511fb0104b98417b39c53fb1745b7562989079106ba25cc24dcaa2248858af8eb37a99242da9103d2e09873375dc32efce51ba5

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 2c8f80b274eb20c3fb5a83dca9f37af7
SHA1 e7d71f452db8f3fe8f7c61f660a5970c875c5685
SHA256 928590794969bbee2a8f8b241f191fff935c553c7ffa701c021ab09d775f2a11
SHA512 5a5e02d5184f3927c98f4e9126242e75562b4bcbe457b0d242d95d7b364db17c814c06960c18f719b811906490da27537c22a0740edb25ca0f6de43e62488d9b

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 962f0942e68c0f3255055013d152693f
SHA1 9d50060e2f518e16081b6ed6dbd5dfab3ab24dd9
SHA256 2edf1cb854d7b434c43a4b61002bfa826a6435b4b6e91aaebd36181cf5009144
SHA512 277a1dc8858be2d6dbea651f7a92f2f67a30b750da2d8a8eaa1050b77962f3f49a854c221e67d9e68f8d38d896ff90db558c07af3157eaba74a7db4182c1f8f2

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 758a7eae6cbe3ea5ead96018a2174780
SHA1 59b5a8ad05684a178cb06413c5e88afa4f835037
SHA256 c0b780f31aa603a089a240e0759e00490f2c64768ec382f4cd7bf197e022abe3
SHA512 4264b1898dd163c3d7ae9e3b82fa52d19cf4de64fe3a03adcc3cc8c9de85c788654c29f73740ee06696d510c0f76a66143d10e835cf87c699e08f3452d7633c2

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

MD5 436d29abb2a5d3ed79a34e739aba2fb8
SHA1 ef73890464f6427efb801cf31e58af07706c7cf1
SHA256 e7735bd5cb23940425cc0e9f038f9f44b3c6510c5280bb3187b11907874a7d97
SHA512 d0c1b473f657cad3170df25d3ddec588d54791caebd52e3cdc4bd50b9422f23c76421bf5f6ab1002c60ceec4410b8b7b13cf1e51d058521eea31a33b2dee482b

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 0daa97cdbab5f4996201a25fb231cf9b
SHA1 349e3428d426feaa0516435eca521815a747802a
SHA256 1f4b2fd3bc9b34da483ea0461e2e3f0b44fda49bf6f7d422c06efca9c7b80897
SHA512 8c7c4c18b492cb15233cd30ac852e400a1ff2f7d5d9153829293c8f6909e7e9e081698258bbb5c9d3510b2ac886df98d0bd64599cc0f2e594a3ef2706e4d1893

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 afd8893c678a40a2b875f1da739922ff
SHA1 8183d00fb2bbf02d0d3210e24065a135322d720e
SHA256 790e7c98e6a1122be0db5bbffd086cc26a476a1702aad893b046ed409380d340
SHA512 89b98758c47269d0a3e494abed3f7ba6042e80a54f0a46dbe56c9645921e7dc2b9b52083962fb8c558d9b533fa8e1557e8d47b21b232e6b4c54c0d5ccc5f411a

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 18afcff2bfe6e57e68359c1f8c74711f
SHA1 01c12cbe9cafcb022c25307eb6e67f3b74d3f947
SHA256 5aeb9ac11ce33494a00ffdf2cb034be6bd93b0ce9a8a0742f9fcf07afe30416f
SHA512 49623144a4c854712f120c38862eec29ef5c93e83ac7615f67e889e0abd7c9963c253a756d4d733e364f0aa633390002f321f98295e9981e2162037a511ee58c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 5d413ed9b666c1b9656c0d36065692c3
SHA1 32646b865c50e7541ece650a8e220c2efe3b8b8f
SHA256 71d7a1874cf77d21e0fc2cb39da05da4ea4a8bd1bf5e7f27be25874159c0552f
SHA512 7853526a4538b6480414023ad0fd758d757bc3e7c8240ca59847863a4f5def66e2f091c0a9dba527b53ff1167acd7575a27a01749f966f5e54cd205fda048434

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 09150ac61f8faabacd099918d92d40a2
SHA1 8b5989a51fa88ef78393306acdc3e8bf43baaa75
SHA256 79802e467c6de84cb046716cca719091bde27cca4bdb70c48ec78c583321d37e
SHA512 c9a5b5d52ed838c63e42b38b42d5b9fa140cf46d721e8998d7d084337275877cc720d5a30803f548caaf8ef0eb6f2974051264729fe5b7c5c64b028c1ca5dbb3

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 24d1bf8b43748c7be65ff869f439343e
SHA1 3704d8c26ffc4c20e140952499bc48877acb0ab0
SHA256 a64b3137d1bf9feb875cfbb65b114b308cbc542358473fb47cd67f0d1b8eae6e
SHA512 36ec593f5d97f993dd9b8ef7cc6a249960c71e90b27af5b8204b914f2eb51eac715cbb93e4d102fda30c23238efb25df7c5f6a5d587163a53f58d00578a692fd

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 c050ceacfd80d44a369e0ecd62cf600b
SHA1 9fde97fcdf4a74093e5776379d0501aa78c52151
SHA256 3a2a20d72573a6eeee7f99eb7ee916f5f9b17e182202e0853e1e350623d10061
SHA512 69037c9b95f7900cc76bab9b9819dcfa01a090160ed78df82e6da97c06dfefce1cbeff263bfe04af6b1a925e501327a0a53ebb780ea060c4782efd12370ac3c8

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 c8e8ddb2981de71372bea0b3c0e23d47
SHA1 3b0232db3279f46e212c70d73f359a8cc5e75da4
SHA256 0c40c70881cb3e32f362466732983e6e8650f6cec32505579ba74253f846e5b7
SHA512 8c4c879daf2302f6f4b041a576f9676ccb111e7766417fd9533e69a1a7a93f7ca040f63da2fa7213eaaf4d0f0a4aea06d12aa4949336da7836f422efd868b20b

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 ffeb190b736233d5eb25e52d9616161e
SHA1 efef940733326468c9e28f74179902e4acae92c9
SHA256 a16459d2dd0d3f675b69a28cc97a8dcbc2dd71d57918a4e89fc80385d6276abd
SHA512 d9fece807c578bc9e592bf0eae9bb61c378d9f63dd5187f226790ada28590410162300051e35262d0e7a524ccde2b6980a46dda17076746da277d41bfe57647a

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 531c61bd763997d9722c937e5e0da7bb
SHA1 9d8f207bf87f2cea2f18d3ff46622c0d93043baf
SHA256 ef2a48420e904ea2d9e6052e315c1dae502177dee817743c692fd5030757f5c2
SHA512 9b602b193cb8c3fb739df748fec6086f86e740041dd6ddca26e6e293f1b9a49f1ea5ffdeeff34ba440a749cd8e15f9b27c742a7eb408b99c2a8b8f7edfa0d709

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 53556df875d55de7d514808eba25369a
SHA1 3816a4b1b8d3210f64399fa2aeb7189a0f559aad
SHA256 18c1523411a0a725a75373ec458f31229a656fbb54b5b04d74b8108e738a3d71
SHA512 d6d3befa389cc827001fefa8b758b123958ebe71a7d38672bc1cd5398b7f4e89de96f790a508462638bfcfdba2f356286eafb0b41abe9f25758b04dd1fcb101b

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000014

MD5 87e8230a9ca3f0c5ccfa56f70276e2f2
SHA1 eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7
SHA256 e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9
SHA512 37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 ccc080b7ef427d09686912630d2bd4c2
SHA1 252153ff9c3ef0c22e7559feb620a510bf659644
SHA256 b42ef44be35a7cba2df706591d956f79498cd1db17f13095d9cf901302aced11
SHA512 bc25fe2cc3964e68f3191ab71ea05757a863d6592b60426bdc881f45d10ef5e66a943269f7fd2e03a2deaf011dfa503566a663ae8635fc8206d289c87be016db

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 67c42998c57dab00b24dcf6405e8acd7
SHA1 8045831049413938ffa6a33972c82371ba891d94
SHA256 3a768d80d8e3a8853384511a5d259191be724004542d4514bdd9aaa98fbb030c
SHA512 3aa1d8b57a3abf48630325e78061484a25cf79f750426781fc87880977685d5883c60dc9cbbb91a39fafe57d2e16664b21816f643af029ca998d8816ab5c6cfa

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

MD5 d8dc0557229c5571739e544945c8b697
SHA1 200002aaa13b3ec9d75aba1faae544a675795343
SHA256 2c29ac55952f2b1b4c1c37afa8c24c44ec12cf16a17cb91ce010ba5b14282b1d
SHA512 071b09a3f4b9b03c9aff639394629289301c52dcc56db2ce2a21eaeab98e7fbe84af80ff30f3fb3bec47c22acf90faa534eb3d8d8d1c8c7d58641cc97f877abb

C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

MD5 f49655f856acb8884cc0ace29216f511
SHA1 cb0f1f87ec0455ec349aaa950c600475ac7b7b6b
SHA256 7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
SHA512 599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

C:\Users\Admin\Downloads\0f40ac86-897f-4630-944a-ca0f28893f05.tmp

MD5 9ec4b13683dc5ada5a81507f3b264931
SHA1 825400c85eb97811f88f6036c3d12b19b7a33391
SHA256 a1d5a9291918770f6b2aab63b6fce1d108813a5474f1e2520e2cbbfef4159c1e
SHA512 0f17384e64cedb28c1316b334e2c56b6796114a724fe08c676157eeb5126f1b84df1114b70c6a5a0a57dd96cbae74115621fdf0f3557ddf31532ca37dba75607

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 5d0967c497f98fee44650b562c32fae4
SHA1 a883bc5c1c4df09f8b27f1a884c8863042f627ce
SHA256 6a258c0cd32b12b82a3acbfdb39cd34caa5418543f8506d76da3cf20376b93b3
SHA512 792956d9e932dead40727726f08cc2841cc0b58f693f1e4f42241e16ecdc8a702c9bb78edaee13d3fd5b368c288bb3b521df0faa4ab4291f4274542c09a86752

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 28e2009a9f74d000939c01b0cf5b4487
SHA1 de3af1b28a80ddceb9fb902a461343415dbb7547
SHA256 bcadc8879343d86f5e57dada2264ab4dd59fa65a341389eda7f374fa13d20eaf
SHA512 08d3606f098f44e8c9080538146221fc6f435eaaa9cc099b92708f8928af6d5da5c6ef074bd8047f6758517eb5b769b3645937ad031dcd5c89b59fe3e1207cb6

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 ddeec7a6c6e7c8399ee13dd236c4e8e8
SHA1 35c2a8f265fc7e377ec537d3049f76d07875a747
SHA256 0a4268f91a307e8c5e95a09ed45667cfb55436cab34262ea888eb9542b9912d0
SHA512 28d841c8df26a19f211e6d9e3ce25930e004904940c9badb5dc5793534fbaf8fd10679fba4eebc45ef4389d8e1066237523c76b7234c55620d3e9b99d873ef60

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 c33bdce9e113a238764134c78575c9e1
SHA1 5de114dfb6fc5c92884724b537867490974b40db
SHA256 192ff6d31d42dcfc67423a2361474acd38e8f6e18f1b5315d5fb2f3b14b8dad7
SHA512 14e85ae0d21b04f1813f0f839a1103214befb7a45c81b74919dfd13af59af46f5506e57557569693feba977cd841c64d3715c6ae7cfa98e734c9d29efda5d721

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 61b4785fa497a01af7656e4412c574d1
SHA1 5b723d847508f2c89db71b6188b17153df06d61d
SHA256 f6cc9d4cd43e50cf07ebb17fb982f33a5d8946292ce41e37d4f1db536b5b6be7
SHA512 3c484fa624a9cb7f1bc30cdea4029b6828980b33ed0e663afe35db2dfca8c10085582dc8dd4dc1dc8a5693ee567f22599926ed896227c053d83218ed090020ea

C:\Users\Admin\AppData\Local\Temp\nsqA5C3.tmp\StdUtils.dll

MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

C:\Users\Admin\AppData\Local\Temp\nsqA5C3.tmp\nsProcess.dll

MD5 f0438a894f3a7e01a4aae8d1b5dd0289
SHA1 b058e3fcfb7b550041da16bf10d8837024c38bf6
SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
SHA512 f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 975da5cc30871e42fbd6da971c5f3919
SHA1 3bfdbb6e3d9ab788ea46ed96cb5e5b1944ac93ac
SHA256 d195d1e204e1e28bde03997b69eba654273962e73c5c2b1334bbe000d289a2bf
SHA512 8c13a680641df36e5e384262abc354d3d02a9c825627e7f86dc765a02cbd88cd90f910d2b9a20b0a956b28ac794210f2ce0b253fe04eda6a34dae5bfa3de3a91

C:\Users\Admin\AppData\Local\Temp\nsqA5C3.tmp\WinShell.dll

MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 9408ab3e15be1db4f9c557192fc5e904
SHA1 03134a3854a2ea1118a7e5d3c76ca5b2a1c1e575
SHA256 c5b3d58dc9777e50d10b23acc0b6bbe79beb8e210eb92bd6de5ca0a008441c4a
SHA512 0b7759ff514589b612a762d997596f632312369556cf7130922e42de371d5beddbcda74af3253ffa167b2ab1856b8d6a11af831bc4d88d3848c9faa069392a09

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 27eafaf2622b9fe83c9a458d82bdfbe4
SHA1 217dd37fd63293547f56894e53babc835e499903
SHA256 2de6839badbcf61aff511cdd441c009077ec2db613505be47a6e442ad9e476d8
SHA512 a823647bb090ea784a502d2f9af18d298277c272a54941f6e6473c8f9fe567f5369bfdb8d64a2672ad2d838121b5c343317d66658d94a6da3da95858bc3bf623

C:\Users\Admin\AppData\Roaming\SaltanatMt2Patcher\GPUCache\data_3

MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

C:\Users\Admin\AppData\Roaming\SaltanatMt2Patcher\GPUCache\data_2

MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

C:\Users\Admin\AppData\Roaming\SaltanatMt2Patcher\GPUCache\data_0

MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

C:\Users\Admin\AppData\Local\Temp\nsqA5C3.tmp\nsDialogs.dll

MD5 466179e1c8ee8a1ff5e4427dbb6c4a01
SHA1 eb607467009074278e4bd50c7eab400e95ae48f7
SHA256 1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
SHA512 7508a29c722d45297bfb090c8eb49bd1560ef7d4b35413f16a8aed62d3b1030a93d001a09de98c2b9fea9acf062dc99a7278786f4ece222e7436b261d14ca817

C:\Users\Admin\AppData\Local\Temp\nsqA5C3.tmp\nsis7z.dll

MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

C:\Users\Admin\AppData\Local\Temp\nsqA5C3.tmp\System.dll

MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

C:\Users\Admin\AppData\Local\Temp\nsqA5C3.tmp\UAC.dll

MD5 adb29e6b186daa765dc750128649b63d
SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 5c6e737e2bdd88e612b154988c766840
SHA1 8f958e9b305298bb9885906729268badd6fc6e7b
SHA256 436526d1765c814e2e83859bab221115960840c3d4148397b50f33b1303312e2
SHA512 cb2c27b62726cf0b51ce1fd2449ae5160ae533d61af1014e4e829b24fd7e04c578f5c7c14535bfcd2d6302c120c2eb3ab1f5a4547fc31c86256a39bd8b4135b0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 f7559abb6cb9598508e424a8cc39ad87
SHA1 f7a05e323a7b662b4824d108d7510b76fb79afdf
SHA256 b7153b53081c3fb748a5aa72e23f233039032f35743084b1c73d173c6040cea6
SHA512 bdae900e74e996faca37dca808bb5968d3d90e9d61acd0d3b0589429b5035573057962960095792e2dd4f529ad68e84fc47c3c2b6a9cf2fabd2088de94a6890b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 f14e66c5064ccdb68694d4f6f1e78c8e
SHA1 4a655b48e6f644412d6fc0a0139ebf974b763e75
SHA256 2ce35281ebf0c3e0d9e73d7603aaeaf716d4117fca7ca206d410cc194977b25a
SHA512 c77cd81bed17a2ae9a9499b642f417b8c47f8e7918b22de19f08e54539b4c9462dba3ffba97d3b68ace9993ea3cbb398c6f6129326939727b37e6ca70d677a89

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\df170b7e-5e78-4b4a-aa68-995404f17d85.tmp

MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 12d4bffc556e6900b545d70a4be6965f
SHA1 33976da8551fe9c481bfeb6cd1194a64e808e4f0
SHA256 cd9598ead4856359e7345b655681d4c17bd3fe9ae9291d828893c922490da89f
SHA512 dbb4ea079964444ce60049ef7e07ff1788364fc35ef5110ad150aa0366c589d61445749cb8d46332b16ba21ce4cb903b5e8b419f5c58eda2be027ec0bbfb00e3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 9fa8bfcce98d3ed59be55c30510e7b74
SHA1 e0e053ee10d4632727c436a5880d93f35f3a600f
SHA256 c73a70e538ad9650817ed4889a12b44a9acd95af7dd3c4f046b19394a7f97ceb
SHA512 ffe21a9893d7adb6796a2913e059ca7602783e5d1defb3330f7e58c61a20d6d0d51b0c1a4378c24eacc255c98cc9dacd2df71a83071a708ed9c9e2252be3bf96

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 74fb89c11a973193235a1b678620e6d0
SHA1 2f6c29c9c5c7da73d6814cde391c94c52b16f795
SHA256 aa6e829524a66bcbcefea21e554fba646ea6bf648f719d0f1cb8fe24fc92570c
SHA512 728cc0d495dd5159301865e717c322e95f1b765e0652c37cefc1ba88ca01b135937601cfbff324ba31a66aedf0fed1538c8f7cdd1602c7a27aed0b3b27f9ea2a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 6d2d4e3f54f2ecde0ab17200eef50d04
SHA1 a54b6a92bafe6de4c4f14252893cb86b256e5b1f
SHA256 cfbfa36855397ff5e0751349b50fb26ff959aae3914548f8784118ebe5fb8e6a
SHA512 1125695832387171072c92be3ff76857333d025598bba8b79ae5916e6b1b873a52df399bcc7fb294a9eb9e6c0b234039cada06e173100b521595a708bee681f6

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 b3ac02a5a55d4fd9ece213bd52e6306e
SHA1 9a538d6e24d8150ad278c89364e39fd695c1a64e
SHA256 82c0bdf80f04dda19bde019d41197638ea2295ff2fc52435a82b66b17f922543
SHA512 7d81fa41ba0109a0cdf6280da87827f250126a599caf5b76856a3a105d234258477d8776e76e285dfd2fdfae855e31dc31379fb12a9ae4e6a30af191e2a5691e

memory/4792-1999-0x0000023CB23B0000-0x0000023CB23B1000-memory.dmp

memory/4792-1998-0x0000023CB23B0000-0x0000023CB23B1000-memory.dmp

memory/4792-2000-0x0000023CB23B0000-0x0000023CB23B1000-memory.dmp

memory/4792-2009-0x0000023CB23B0000-0x0000023CB23B1000-memory.dmp

memory/4792-2008-0x0000023CB23B0000-0x0000023CB23B1000-memory.dmp

memory/4792-2007-0x0000023CB23B0000-0x0000023CB23B1000-memory.dmp

memory/4792-2006-0x0000023CB23B0000-0x0000023CB23B1000-memory.dmp

memory/4792-2005-0x0000023CB23B0000-0x0000023CB23B1000-memory.dmp

memory/4792-2004-0x0000023CB23B0000-0x0000023CB23B1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\9cf3f700-4eee-4477-adec-63ff3e71fe59.tmp.node

MD5 de6d2b157852d831c20371b0dbec45fa
SHA1 71f70e996c88134e48f860f0a661465ee6d934f5
SHA256 ba8f393196c7d3fa0a36df10ee8bd5459e257abd02f90871c64dd428ab9ae024
SHA512 1538aef15fd4a51c91636ece0874cebc087c5278fa1641d92499289c00e6c24c72dac90326069f0dbf39891a209acede5872090d395fd02be0869060be903615

memory/2608-2022-0x000001FF8D790000-0x000001FF8D791000-memory.dmp

memory/2608-2021-0x000001FF8D790000-0x000001FF8D791000-memory.dmp

memory/2608-2020-0x000001FF8D790000-0x000001FF8D791000-memory.dmp

memory/2608-2029-0x000001FF8D790000-0x000001FF8D791000-memory.dmp

memory/2608-2028-0x000001FF8D790000-0x000001FF8D791000-memory.dmp

memory/2608-2027-0x000001FF8D790000-0x000001FF8D791000-memory.dmp

memory/2608-2026-0x000001FF8D790000-0x000001FF8D791000-memory.dmp

memory/2608-2025-0x000001FF8D790000-0x000001FF8D791000-memory.dmp

memory/2608-2024-0x000001FF8D790000-0x000001FF8D791000-memory.dmp

memory/5784-2047-0x000001C2624D0000-0x000001C2624D1000-memory.dmp

memory/5784-2046-0x000001C2624D0000-0x000001C2624D1000-memory.dmp

memory/5784-2045-0x000001C2624D0000-0x000001C2624D1000-memory.dmp

memory/5784-2044-0x000001C2624D0000-0x000001C2624D1000-memory.dmp

memory/5784-2043-0x000001C2624D0000-0x000001C2624D1000-memory.dmp

memory/5784-2042-0x000001C2624D0000-0x000001C2624D1000-memory.dmp

memory/5784-2040-0x000001C2624D0000-0x000001C2624D1000-memory.dmp

memory/5784-2039-0x000001C2624D0000-0x000001C2624D1000-memory.dmp

memory/5784-2038-0x000001C2624D0000-0x000001C2624D1000-memory.dmp