Resubmissions

07/03/2025, 19:43

250307-yfp5pavye1 10

07/03/2025, 19:34

250307-x958bswky3 10

07/03/2025, 19:02

250307-xpxqfsvvbv 10

Analysis

  • max time kernel
    154s
  • max time network
    170s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250217-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/03/2025, 19:43

Errors

Reason
Machine shutdown

General

  • Target

    JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe

  • Size

    1.2MB

  • MD5

    58ef8399e896e60b181961292fb6d666

  • SHA1

    d5b651f75234877814d8efabb6256fbc23c662ed

  • SHA256

    6deff5735317a9b7addf8d9f8d3aeca1de68364e63b69037b2c916bcaee44003

  • SHA512

    b9c4059148ff6ff96b376b69450a5234b4de8684ef41173601c24140da62a2b623f4117f5f483be478c9542be676cd705511d9540689b247cd44215b8c2f7b37

  • SSDEEP

    24576:D6t9iwCQliK/JJDORRrQl9uM1aIcLkNC2brX5qXI8PP:Wt9iwJTDOPsrNcwNbwxP

Malware Config

Extracted

Family

darkcomet

Botnet

enzcrash

C2

whatthe.no-ip.biz:1604

Mutex

DC_MUTEX-F54S21D

Attributes
  • InstallPath

    winupdate.exe

  • gencode

    =fgh�Num+Xi-

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    Windows Updater

rc4.plain

Signatures

  • Blackshades

    Blackshades is a remote access trojan with various capabilities.

  • Blackshades family
  • Blackshades payload 17 IoCs
  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Darkcomet family
  • HawkEye

    HawkEye is a malware kit that has seen continuous development since at least 2013.

  • Hawkeye family
  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Modifies firewall policy service 3 TTPs 3 IoCs
  • Modifies security service 2 TTPs 1 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Windows security bypass 2 TTPs 2 IoCs
  • Adds policy Run key to start application 2 TTPs 2 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Disables RegEdit via registry modification 1 IoCs
  • Disables Task Manager via registry modification
  • Downloads MZ/PE file 2 IoCs
  • Drops file in Drivers directory 10 IoCs
  • Modifies RDP port number used by Windows 1 TTPs
  • Sets service image path in registry 2 TTPs 3 IoCs
  • Checks BIOS information in registry 2 TTPs 8 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 5 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

  • Executes dropped EXE 20 IoCs
  • Impair Defenses: Safe Mode Boot 1 TTPs 2 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 64 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • UPX packed file 20 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 5 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 21 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 26 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 10 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 2 IoCs
  • Enumerates system info in registry 2 TTPs 5 IoCs
  • Modifies Internet Explorer settings 1 TTPs 5 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies registry key 1 TTPs 4 IoCs
  • Modifies system certificate store 2 TTPs 24 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 34 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 16 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 54 IoCs
  • Suspicious use of SendNotifyMessage 37 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 3 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3556
      • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe
        "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3372
        • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe
          "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe"
          3⤵
          • Modifies WinLogon for persistence
          • Checks BIOS information in registry
          • Checks computer location settings
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Checks processor information in registry
          • Enumerates system info in registry
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3200
          • C:\Users\Admin\AppData\Local\Temp\WINDOWSUPDATE.EXE
            "C:\Users\Admin\AppData\Local\Temp\WINDOWSUPDATE.EXE"
            4⤵
            • Adds policy Run key to start application
            • Boot or Logon Autostart Execution: Active Setup
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:4660
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
              5⤵
              • System Location Discovery: System Language Discovery
              PID:4552
              • C:\Windows\SysWOW64\reg.exe
                REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
                6⤵
                • System Location Discovery: System Language Discovery
                • Modifies registry key
                PID:3884
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\WINDOWSUPDATE.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\WINDOWSUPDATE.exe:*:Enabled:Windows Messanger" /f
              5⤵
              • System Location Discovery: System Language Discovery
              PID:2476
              • C:\Windows\SysWOW64\reg.exe
                REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\WINDOWSUPDATE.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\WINDOWSUPDATE.exe:*:Enabled:Windows Messanger" /f
                6⤵
                • System Location Discovery: System Language Discovery
                • Modifies registry key
                PID:2540
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
              5⤵
              • System Location Discovery: System Language Discovery
              PID:740
              • C:\Windows\SysWOW64\reg.exe
                REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
                6⤵
                • System Location Discovery: System Language Discovery
                • Modifies registry key
                PID:4756
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\windowsupdate.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\windowsupdate.exe:*:Enabled:Windows Messanger" /f
              5⤵
              • System Location Discovery: System Language Discovery
              PID:1376
              • C:\Windows\SysWOW64\reg.exe
                REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\windowsupdate.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\windowsupdate.exe:*:Enabled:Windows Messanger" /f
                6⤵
                • System Location Discovery: System Language Discovery
                • Modifies registry key
                PID:2640
          • C:\Users\Admin\AppData\Local\Temp\WINUPDTR.EXE
            "C:\Users\Admin\AppData\Local\Temp\WINUPDTR.EXE"
            4⤵
            • Checks computer location settings
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4636
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c timeout 5 && del C:\Users\Admin\AppData\Local\Temp\WINUPDTR.EXE
              5⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:540
              • C:\Windows\SysWOW64\timeout.exe
                timeout 5
                6⤵
                • System Location Discovery: System Language Discovery
                • Delays execution with timeout.exe
                PID:2060
          • C:\Windows\SysWOW64\explorer.exe
            "C:\Windows\SysWOW64\explorer.exe"
            4⤵
              PID:5024
            • C:\Users\Admin\AppData\Roaming\winupdate.exe
              "C:\Users\Admin\AppData\Roaming\winupdate.exe"
              4⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2584
              • C:\Users\Admin\AppData\Roaming\winupdate.exe
                "C:\Users\Admin\AppData\Roaming\winupdate.exe"
                5⤵
                • Modifies firewall policy service
                • Modifies security service
                • Windows security bypass
                • Disables RegEdit via registry modification
                • Checks BIOS information in registry
                • Checks computer location settings
                • Executes dropped EXE
                • Windows security modification
                • System Location Discovery: System Language Discovery
                • Checks processor information in registry
                • Enumerates system info in registry
                • Suspicious behavior: GetForegroundWindowSpam
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                • System policy modification
                PID:2852
                • C:\Windows\SysWOW64\explorer.exe
                  "C:\Windows\SysWOW64\explorer.exe"
                  6⤵
                    PID:1988
                  • C:\Users\Admin\AppData\Local\Temp\WINDOWSUPDATE.EXE
                    "C:\Users\Admin\AppData\Local\Temp\WINDOWSUPDATE.EXE"
                    6⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:1776
                  • C:\Users\Admin\AppData\Local\Temp\WINUPDTR.EXE
                    "C:\Users\Admin\AppData\Local\Temp\WINUPDTR.EXE"
                    6⤵
                    • Checks computer location settings
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:2640
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\System32\cmd.exe" /c timeout 5 && del C:\Users\Admin\AppData\Local\Temp\WINUPDTR.EXE
                      7⤵
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:1216
                      • C:\Windows\SysWOW64\timeout.exe
                        timeout 5
                        8⤵
                        • System Location Discovery: System Language Discovery
                        • Delays execution with timeout.exe
                        PID:4604
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe"
            2⤵
            • Enumerates system info in registry
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of WriteProcessMemory
            PID:3624
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffd8482cc40,0x7ffd8482cc4c,0x7ffd8482cc58
              3⤵
                PID:4036
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1840,i,3913783707917315457,8910233052634459219,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=1832 /prefetch:2
                3⤵
                  PID:3644
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2156,i,3913783707917315457,8910233052634459219,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2184 /prefetch:3
                  3⤵
                  • Downloads MZ/PE file
                  PID:1512
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2296,i,3913783707917315457,8910233052634459219,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2488 /prefetch:8
                  3⤵
                    PID:3312
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3076,i,3913783707917315457,8910233052634459219,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3180 /prefetch:1
                    3⤵
                      PID:3016
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3220,i,3913783707917315457,8910233052634459219,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3204 /prefetch:1
                      3⤵
                        PID:544
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3876,i,3913783707917315457,8910233052634459219,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4576 /prefetch:1
                        3⤵
                          PID:3532
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4720,i,3913783707917315457,8910233052634459219,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4712 /prefetch:8
                          3⤵
                            PID:4868
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4724,i,3913783707917315457,8910233052634459219,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4848 /prefetch:8
                            3⤵
                              PID:4344
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4440,i,3913783707917315457,8910233052634459219,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4928 /prefetch:8
                              3⤵
                                PID:2476
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4696,i,3913783707917315457,8910233052634459219,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4428 /prefetch:8
                                3⤵
                                  PID:740
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4940,i,3913783707917315457,8910233052634459219,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4748 /prefetch:8
                                  3⤵
                                    PID:3616
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5344,i,3913783707917315457,8910233052634459219,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4836 /prefetch:8
                                    3⤵
                                      PID:4872
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4436,i,3913783707917315457,8910233052634459219,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5456 /prefetch:8
                                      3⤵
                                        PID:684
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4764,i,3913783707917315457,8910233052634459219,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5448 /prefetch:8
                                        3⤵
                                          PID:4344
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5796,i,3913783707917315457,8910233052634459219,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5748 /prefetch:2
                                          3⤵
                                            PID:5600
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=5896,i,3913783707917315457,8910233052634459219,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5920 /prefetch:1
                                            3⤵
                                              PID:6104
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=3300,i,3913783707917315457,8910233052634459219,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3392 /prefetch:1
                                              3⤵
                                                PID:5200
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=4048,i,3913783707917315457,8910233052634459219,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5512 /prefetch:8
                                                3⤵
                                                  PID:5744
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5876,i,3913783707917315457,8910233052634459219,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=6016 /prefetch:8
                                                  3⤵
                                                    PID:5736
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5620,i,3913783707917315457,8910233052634459219,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5264 /prefetch:8
                                                    3⤵
                                                      PID:5964
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5252,i,3913783707917315457,8910233052634459219,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5308 /prefetch:8
                                                      3⤵
                                                        PID:5976
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5948,i,3913783707917315457,8910233052634459219,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5116 /prefetch:8
                                                        3⤵
                                                          PID:2384
                                                        • C:\Users\Admin\Downloads\MBSetup.exe
                                                          "C:\Users\Admin\Downloads\MBSetup.exe"
                                                          3⤵
                                                          • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                          • Downloads MZ/PE file
                                                          • Drops file in Drivers directory
                                                          • Checks BIOS information in registry
                                                          • Executes dropped EXE
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of FindShellTrayWindow
                                                          PID:1452
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=4872,i,3913783707917315457,8910233052634459219,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5672 /prefetch:1
                                                          3⤵
                                                            PID:1504
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --field-trial-handle=5320,i,3913783707917315457,8910233052634459219,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5264 /prefetch:1
                                                            3⤵
                                                              PID:2476
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=6296,i,3913783707917315457,8910233052634459219,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=6256 /prefetch:8
                                                              3⤵
                                                                PID:5136
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=6236,i,3913783707917315457,8910233052634459219,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=6116 /prefetch:8
                                                                3⤵
                                                                  PID:5284
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --field-trial-handle=5988,i,3913783707917315457,8910233052634459219,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5776 /prefetch:1
                                                                  3⤵
                                                                    PID:772
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --field-trial-handle=3208,i,3913783707917315457,8910233052634459219,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5696 /prefetch:8
                                                                    3⤵
                                                                      PID:216
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --field-trial-handle=5304,i,3913783707917315457,8910233052634459219,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=6056 /prefetch:1
                                                                      3⤵
                                                                        PID:5284
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --field-trial-handle=240,i,3913783707917315457,8910233052634459219,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5276 /prefetch:1
                                                                        3⤵
                                                                          PID:5220
                                                                      • C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe
                                                                        "C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe"
                                                                        2⤵
                                                                        • Executes dropped EXE
                                                                        • Loads dropped DLL
                                                                        PID:3572
                                                                        • C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe
                                                                          "C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe"
                                                                          3⤵
                                                                          • Checks computer location settings
                                                                          • Executes dropped EXE
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          • Suspicious use of FindShellTrayWindow
                                                                          • Suspicious use of SendNotifyMessage
                                                                          PID:3020
                                                                      • C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe
                                                                        "C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe"
                                                                        2⤵
                                                                        • Executes dropped EXE
                                                                        PID:5676
                                                                        • C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe
                                                                          "C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe"
                                                                          3⤵
                                                                          • Executes dropped EXE
                                                                          PID:4652
                                                                    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                                                                      "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                                                                      1⤵
                                                                        PID:4128
                                                                      • C:\Windows\system32\svchost.exe
                                                                        C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                        1⤵
                                                                          PID:2516
                                                                        • C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
                                                                          "C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"
                                                                          1⤵
                                                                          • Drops file in Drivers directory
                                                                          • Executes dropped EXE
                                                                          • Impair Defenses: Safe Mode Boot
                                                                          • Loads dropped DLL
                                                                          • Enumerates connected drives
                                                                          • Drops file in Program Files directory
                                                                          • Modifies Internet Explorer settings
                                                                          • Modifies data under HKEY_USERS
                                                                          • Modifies system certificate store
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          PID:5868
                                                                          • C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
                                                                            "C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe" /installmbtun
                                                                            2⤵
                                                                            • Executes dropped EXE
                                                                            • Loads dropped DLL
                                                                            • Drops file in System32 directory
                                                                            • Drops file in Windows directory
                                                                            PID:4640
                                                                          • C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
                                                                            "C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe" /Service /Protected
                                                                            2⤵
                                                                            • Drops file in Drivers directory
                                                                            • Executes dropped EXE
                                                                            • Modifies registry class
                                                                            PID:5288
                                                                        • C:\Windows\system32\AUDIODG.EXE
                                                                          C:\Windows\system32\AUDIODG.EXE 0x2c8 0x31c
                                                                          1⤵
                                                                            PID:5368
                                                                          • C:\Windows\system32\svchost.exe
                                                                            C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
                                                                            1⤵
                                                                            • Drops file in Windows directory
                                                                            • Checks SCSI registry key(s)
                                                                            PID:5336
                                                                            • C:\Windows\system32\DrvInst.exe
                                                                              DrvInst.exe "4" "9" "C:\Program Files\Malwarebytes\Anti-Malware\mbtun\mbtun.inf" "9" "4ba9030c7" "0000000000000154" "Service-0x0-3e7$\Default" "0000000000000140" "208" "C:\Program Files\Malwarebytes\Anti-Malware\mbtun"
                                                                              2⤵
                                                                              • Drops file in System32 directory
                                                                              • Drops file in Windows directory
                                                                              • Checks SCSI registry key(s)
                                                                              • Modifies data under HKEY_USERS
                                                                              PID:2652
                                                                          • C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
                                                                            "C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"
                                                                            1⤵
                                                                            • Drops file in Drivers directory
                                                                            • Sets service image path in registry
                                                                            • Checks BIOS information in registry
                                                                            • Executes dropped EXE
                                                                            • Loads dropped DLL
                                                                            • Enumerates connected drives
                                                                            • Drops file in System32 directory
                                                                            • Drops file in Program Files directory
                                                                            • Checks processor information in registry
                                                                            • Modifies Internet Explorer settings
                                                                            • Modifies data under HKEY_USERS
                                                                            • Modifies registry class
                                                                            • Modifies system certificate store
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            PID:5712
                                                                            • C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exe
                                                                              ig.exe reseed
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              PID:5960
                                                                            • C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exe
                                                                              ig.exe reseed
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              PID:5572
                                                                            • C:\Program Files\Malwarebytes\Anti-Malware\MBAMWsc.exe
                                                                              "C:\Program Files\Malwarebytes\Anti-Malware\MBAMWsc.exe" /wac 0 /status on true /updatesubstatus none /scansubstatus none /settingssubstatus none
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              • Modifies data under HKEY_USERS
                                                                              PID:6620
                                                                            • C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\updatrpkg\mbupdatrV5.exe
                                                                              "C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\updatrpkg\mbupdatrV5.exe" "C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE" "C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\config\UpdateControllerConfig.json" "C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE" "C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\dbclsupdate\staging" /db:dbupdate /su:no
                                                                              2⤵
                                                                              • Checks BIOS information in registry
                                                                              • Executes dropped EXE
                                                                              • Modifies data under HKEY_USERS
                                                                              PID:6440
                                                                            • C:\Users\Admin\AppData\LocalLow\IGDump\X86_02\ig.exe
                                                                              ig.exe timer 4000 17413767892.ext
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              PID:4208
                                                                            • C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exe
                                                                              ig.exe reseed
                                                                              2⤵
                                                                                PID:3104

                                                                            Network

                                                                            MITRE ATT&CK Enterprise v15

                                                                            Replay Monitor

                                                                            Loading Replay Monitor...

                                                                            Downloads

                                                                            • C:\PROGRA~1\MALWAR~1\ANTI-M~1\mbtun\mbtun.cat

                                                                              Filesize

                                                                              10KB

                                                                              MD5

                                                                              8abff1fbf08d70c1681a9b20384dbbf9

                                                                              SHA1

                                                                              c9762e121e4f8a7ad931eee58ee60c8e9fc3ecb6

                                                                              SHA256

                                                                              9ceb410494b95397ec1f8fa505d071672bf61f81cc596b8eccd167a77893c658

                                                                              SHA512

                                                                              37998e0aee93ff47fe5b1636fce755966debe417a790e1aebd7674c86c1583feef04648a7bc79e4dedaabb731051f4f803932ac49ea0be05776c0f4d218b076f

                                                                            • C:\PROGRA~1\MALWAR~1\ANTI-M~1\mbtun\mbtun.sys

                                                                              Filesize

                                                                              107KB

                                                                              MD5

                                                                              83d4fba999eb8b34047c38fabef60243

                                                                              SHA1

                                                                              25731b57e9968282610f337bc6d769aa26af4938

                                                                              SHA256

                                                                              6903e60784b9fa5d8b417f93f19665c59946a4de099bd1011ab36271b267261c

                                                                              SHA512

                                                                              47faab5fff3e3e2d2aea0a425444aa2e215f1d5bf97edee2a3bb773468e1092919036bcd5002357594b62519bf3a8980749d8d0f6402de0e73c2125d26e78f1e

                                                                            • C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe

                                                                              Filesize

                                                                              8.7MB

                                                                              MD5

                                                                              3084e61d7ec183685908bc90aefa32c6

                                                                              SHA1

                                                                              302357c243a0d8db5d51fb0b995de85a5d12b278

                                                                              SHA256

                                                                              486126c0d68a371e90f7c135ec46510dd53c1164f644c72be57716143af53eb6

                                                                              SHA512

                                                                              7ef31dc0e2ad9ccbc936d0931462db2fdd17b88d06c6bd162c9f444bf7c1a77f5ef5afe18128398418b5d7447d049ab18eb97b0a3d6cf46ccc2393e0294d8c33

                                                                            • C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe

                                                                              Filesize

                                                                              2.7MB

                                                                              MD5

                                                                              e04e61828c9fffcee59cd90ef155c90f

                                                                              SHA1

                                                                              7a97b65f11d2b3f30d8e2dde4c44bdf16f3d3b24

                                                                              SHA256

                                                                              05d4d87f43646f7ca2e50520d8850e8808748a508c2761838d5fb92d66d6ce35

                                                                              SHA512

                                                                              04792b998628cde88bc2601534678e55b2d6fde290496e5af08a2955a992ca3bb767bd025dca4373abc55141de8d270f62f628e51c887de54035bbee10379ce9

                                                                            • C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe

                                                                              Filesize

                                                                              291KB

                                                                              MD5

                                                                              74adfb1f3492af639732d896b84eb639

                                                                              SHA1

                                                                              f22c35601ccfd35953760ba6c0d32409bdd941ce

                                                                              SHA256

                                                                              e1a9fdcfaec9dd8e70054d706ff61325d427ce84fae71984036ea7d8e531d9ae

                                                                              SHA512

                                                                              37fb397fa50a3396bdb7872e1279312b6c122a3dc6588e07bcee735a864f0ba93b687997fdc362c2ebfaef225c77b08d2c3a3168f5c17aa6ef79a636261d56fb

                                                                            • C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.json

                                                                              Filesize

                                                                              621B

                                                                              MD5

                                                                              aee69fdf889d8a703e711304ff81cada

                                                                              SHA1

                                                                              bfdd270ec4f47943f958dc3f18d1046c7aa77fb8

                                                                              SHA256

                                                                              0225709fec40da5bad97f46bc1317c088c158c2bd96920ed30d1ca4abfe150fa

                                                                              SHA512

                                                                              3b966baddcce27fc6d75480961d9d3add823cc853f7a22f382f48d66c0d3d9b5ecf694a28c54f93474955f2d69a529d6f924b0c5ae7a9498aea1348e3aa9c312

                                                                            • C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.json

                                                                              Filesize

                                                                              654B

                                                                              MD5

                                                                              b04e5e88eb991aeac7ea16853256edb7

                                                                              SHA1

                                                                              699cb0e7914801c0d9c0c582f72ac38810ff3555

                                                                              SHA256

                                                                              1a30b635096e5a61c133fd4ea5cb25ff4a59d7ddb247ca975ecdbee7511ab86e

                                                                              SHA512

                                                                              499940e3f0ce0f4c310089d83d32121351e33af1f7bbfb147c49944dc75ee602f55e175078107f6e65e05c6ae668e6e63f545ca8ce3360f27e38367002f9695c

                                                                            • C:\Program Files\Malwarebytes\Anti-Malware\ctlrvers.dat

                                                                              Filesize

                                                                              8B

                                                                              MD5

                                                                              44f850482fd540c6f723898a992cb593

                                                                              SHA1

                                                                              937e77cf6f6c2a3d803588e9523a975402a18d94

                                                                              SHA256

                                                                              99e6170cabc08fe64c3ed5e5b0f60dd016a31489fe512960ae1a2c5c8b004d48

                                                                              SHA512

                                                                              5602ae0343eb9a8deb9a77f4fcff76f0d9320fe28d0fdeb9be78c5f4f1d62985c2e61ec3405c8fe3bb02e967eb3e76fdaba17eccdfec5e792a7a3948bded13d2

                                                                            • C:\Program Files\Malwarebytes\Anti-Malware\mb5uns.exe

                                                                              Filesize

                                                                              2.2MB

                                                                              MD5

                                                                              b39ba8b6310037ba2384ff6a46c282f1

                                                                              SHA1

                                                                              d3a136aab0d951f65b579d22334f4dabbebdb4a4

                                                                              SHA256

                                                                              3ecbcb6c57af4456111f5f104b8fb8a317cdb0f16e98412249f7a2d62bca584d

                                                                              SHA512

                                                                              a8b98f47c30503029f2dc80398dacd5f8fc07db562d04c56b8c7902bebf11517223350c41850b81aca770ebc9e68fc365921bd6cce34b57b2c945f1c51b538b7

                                                                            • C:\Program Files\Malwarebytes\Anti-Malware\mbamsi64.dll

                                                                              Filesize

                                                                              3.0MB

                                                                              MD5

                                                                              552132510df12c64a89517369f07d50c

                                                                              SHA1

                                                                              f91981f5b5cdef2bdc53d9a715a47d7e56053d6f

                                                                              SHA256

                                                                              3bfc8b26e3a44d2444837b2125fb5c94eb9901faf3d49a8a5de1e2089a6b50b1

                                                                              SHA512

                                                                              c30a893fa36a056db5ecdb765bcc0fc41adb02696b22a30130737d8b1a9d020b30bc651d45c63ff73b621459eca3668aa51e4a71b01b00a499bffa941cd36930

                                                                            • C:\Program Files\Malwarebytes\Anti-Malware\mbtun.dll

                                                                              Filesize

                                                                              2.8MB

                                                                              MD5

                                                                              2bbf63f1dab335f5caf431dbd4f38494

                                                                              SHA1

                                                                              90f1d818ac8a4881bf770c1ff474f35cdaa4fcd0

                                                                              SHA256

                                                                              f21a980316bd4c57c70e00840ab76d9ad412092d7d2d6a2cff4f1311f7c05364

                                                                              SHA512

                                                                              ebb9834323329dc01ba2c87e5fad1083a4cb86f5ed761cb63299ac5336a9843a1aadd42fbed706797c2295117af1c00f96806422338352653c8e0255fecc2fd5

                                                                            • C:\Program Files\Malwarebytes\Anti-Malware\mbtun\mbtun.inf

                                                                              Filesize

                                                                              1KB

                                                                              MD5

                                                                              5d1917024b228efbeab3c696e663873e

                                                                              SHA1

                                                                              cec5e88c2481d323ec366c18024d61a117f01b21

                                                                              SHA256

                                                                              4a350fc20834a579c5a58352b7a3aa02a454abbbd9eecd3cd6d2a14864a49cd8

                                                                              SHA512

                                                                              14b345f03284b8c1d97219e3dd1a3910c1e453f93f51753f417e643f50922e55c0e23aab1d437300e6c196c7017d7b7538de4850df74b3599e90f3941b40ab4a

                                                                            • C:\Program Files\Malwarebytes\Anti-Malware\offreg.dll

                                                                              Filesize

                                                                              113KB

                                                                              MD5

                                                                              2ccb84bed084f27ca22bdd1e170a6851

                                                                              SHA1

                                                                              16608b35c136813bb565fe9c916cb7b01f0b20af

                                                                              SHA256

                                                                              a538caf4ac94708ddb4240d38b1b99914ca3e82283f0d8a2290be28fc05eaccb

                                                                              SHA512

                                                                              0fd66d241bdebd0052f4972e85b42639e3c5a40affe23170b84bc4068dff8e84446898a77ebf7cc0bef97454abb788faccce508a68bc5e717980ef26d8436986

                                                                            • C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.cat

                                                                              Filesize

                                                                              10KB

                                                                              MD5

                                                                              ddb20ff5524a3a22a0eb1f3e863991a7

                                                                              SHA1

                                                                              260fbc1f268d426d46f3629e250c2afd0518ed24

                                                                              SHA256

                                                                              5fc1d0838af2d7f4030e160f6a548b10bf5ca03ea60ec55a09a9adbbb056639a

                                                                              SHA512

                                                                              7c6970e35395663f97e96d5bf7639a082e111fa368f22000d649da7a9c81c285ee84b6cf63a4fccb0990e5586e70e1b9efc15cf5e4d40946736ca51ec256e953

                                                                            • C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.inf

                                                                              Filesize

                                                                              2KB

                                                                              MD5

                                                                              d87c2f68057611e687bdb8cc6ebea5b8

                                                                              SHA1

                                                                              27b1311d3b199e4c22772fa1b7ea556805775d37

                                                                              SHA256

                                                                              ff93773f55bf4a6a0242adf82276a8c95c0b244b9bc05e515c4e810c81a960e8

                                                                              SHA512

                                                                              4aa65b8911d8a2a0f9ef0ee6e934b94db0a9ad4c2ec543b5edcf21486be43f6ab1fda6617ea2cbb85eff230628c9fa8e7649da915d6de695803b28e55bef5819

                                                                            • C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.sys

                                                                              Filesize

                                                                              233KB

                                                                              MD5

                                                                              246a1d7980f7d45c2456574ec3f32cbe

                                                                              SHA1

                                                                              c5fad4598c3698fdaa4aa42a74fb8fa170ffe413

                                                                              SHA256

                                                                              45948a1715f0420c66a22518a1a45a0f20463b342ce05d36c18b8c53b4d78147

                                                                              SHA512

                                                                              265e6da7c9eede8ea61f204b3524893cf9bd1ed11b338eb95c4a841428927cccbed02b7d8757a4153ce02863e8be830ea744981f800351b1e383e71ddaad36ad

                                                                            • C:\Program Files\Malwarebytes\Anti-Malware\sdk\farflt.cat

                                                                              Filesize

                                                                              11KB

                                                                              MD5

                                                                              a4e1b3baef2bd08db952a4bc84a6a8ab

                                                                              SHA1

                                                                              36dbc7ce7f8015352e711aa485ba19a725c7926f

                                                                              SHA256

                                                                              77af283bc5037f84246a69a41ede4eb8e8a00b776752ec69356f3722a060c91b

                                                                              SHA512

                                                                              6bc5b00e614a5f1028a01aaa6aa38bc1941650aed6f9738fbf5b5d75d12fd1acbf7e90b42bbdc6ecf569444a14c9c4e422d5cd77a6c475ea89f4ab1284e65e55

                                                                            • C:\Program Files\Malwarebytes\Anti-Malware\sdk\farflt.inf

                                                                              Filesize

                                                                              2KB

                                                                              MD5

                                                                              358bb9bf66f2e514310dc22e4e3a4dc5

                                                                              SHA1

                                                                              87bfc1398e6756273eee909a0dfb4ef18b38d17c

                                                                              SHA256

                                                                              ff51780a5a854b2c18f71ae426cb066a13723ef6155e24f4910137c9e8dfdc17

                                                                              SHA512

                                                                              301ec5ec5c0813951843011f2204924240235494999136ea30a557cbf58146fc6043a8866b344fa7deb927d7c83d44e2aaf45adca7d221aba5d36715b9a63e09

                                                                            • C:\Program Files\Malwarebytes\Anti-Malware\sdk\farflt.sys

                                                                              Filesize

                                                                              198KB

                                                                              MD5

                                                                              6dac02d06e9ac695dfb2e0d0aba9bd3d

                                                                              SHA1

                                                                              2d11078037a5288bbb831537601aac5509966467

                                                                              SHA256

                                                                              c70e75264fa5ec083d31188f3e659b2dee0f09d81fe4849b91862f631d54dfc0

                                                                              SHA512

                                                                              314ad60ff9f14abd37997be8095afdc15c3cbf52257c190b2997de0570a4cd1c15082b82b0a0f7188fcd4d4ec56723b00bd19b3a1bbcfdc791d0ecaa798e2e85

                                                                            • C:\Program Files\Malwarebytes\Anti-Malware\sdk\farflt.tmf

                                                                              Filesize

                                                                              64KB

                                                                              MD5

                                                                              df6294ebabdd2abd54326506fed501ba

                                                                              SHA1

                                                                              c079c9b5853278ebf3e1811232a50c85429daf26

                                                                              SHA256

                                                                              2d56e4369bdfaa5aacc1b656c4e00d162c5096b4b6af6e2efe7b4993b80bc597

                                                                              SHA512

                                                                              6967cb154c582955a51f44e2d61227645f0d6cb9c94179d9f51f16d24f6444685c9aea41a89625f3d6ff360a7bbeddd6a16582a25564ed41e2b89992d4ec516f

                                                                            • C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.cat

                                                                              Filesize

                                                                              11KB

                                                                              MD5

                                                                              a32881b0be849d96da6b6bb6d7be8890

                                                                              SHA1

                                                                              5d10d9005ccdb722fce6c2b8ab29fca0dad60e36

                                                                              SHA256

                                                                              45db7e4a12a3565dccc019f1337f71d58d1969841354cc6b6e867f43352c2615

                                                                              SHA512

                                                                              38bb2887a3814ad64a7af6c327fdc37f7e086778f3bb7fdd0fad64914ffec868a7eb21b2af29912f1a711509f6f2f35e49cbb7638b3f48b1054a5684eed7d81b

                                                                            • C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.inf

                                                                              Filesize

                                                                              3KB

                                                                              MD5

                                                                              5a9717e1385703e8f06b27aa10a69e87

                                                                              SHA1

                                                                              84ee67a9167b5eb6560711b9871de98898ad07a5

                                                                              SHA256

                                                                              47b7c516bb57c612de19f0ca865590af95b6e32bf873a0fef9e011b2c5b483d4

                                                                              SHA512

                                                                              dd3c7278c2c11ad15a55fae6d19b96dadd92f85b7f0c8ce934298258af00bb5c052a84a98499b8867b0f43704fb307c67d03692ca69dda4d814c6c17dd73df44

                                                                            • C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.sys

                                                                              Filesize

                                                                              228KB

                                                                              MD5

                                                                              1258a8e1beab105aa96c93aa34dd9ef8

                                                                              SHA1

                                                                              a435a462a0976135e2257b46e52b576fabac3d34

                                                                              SHA256

                                                                              d86b9b20788b6bff70a1a4c4111b2ea33b9ec705cc6b8fe869362fc3899820a3

                                                                              SHA512

                                                                              8feb56e3d5d67484c97f20348899673d1b8aafad35cd339bd6c459194fa0f0f9e07b0a7063615b010378a2788cd11ef9e3744253a24c8fcd0d960d0cada77546

                                                                            • C:\Program Files\Malwarebytes\Anti-Malware\srvversion.dat

                                                                              Filesize

                                                                              9B

                                                                              MD5

                                                                              9e5d32c87a4c96692e1dba76841e5097

                                                                              SHA1

                                                                              9a8e4fe3fb581a32b48b6f7ba5251bc3bb026548

                                                                              SHA256

                                                                              4ed31aadd5843b7227a2b79e3b7385d0ce951e1d71377eb668d0686ed0b50c3d

                                                                              SHA512

                                                                              d8242d52ca08bdaf207662ac2e24dc507e1a92d687d163426c085fbb841f159ce8e5ec04087909d94c69f04789b28acdd2c4e68829e995bedc87ac90960de9e4

                                                                            • C:\Program Files\Malwarebytes\Anti-Malware\version.dat

                                                                              Filesize

                                                                              47B

                                                                              MD5

                                                                              2b5fd9fe1f2786c62ccf2b4328c001ac

                                                                              SHA1

                                                                              f415e81f1854795a587f2f2077a740d932430fa5

                                                                              SHA256

                                                                              08234e2f6c4e1d1b292908f5b22190f168e8ff8418d2a0f80446308065c64dca

                                                                              SHA512

                                                                              bd13dd3259338fad79d6260abe3c7d31a9405e21cf7d50344ed1104b85b056edda8955dccfcbfed1cbb20b934e3f9655e8a1b928dc0769bb99edf5aaecfbafc3

                                                                            • C:\ProgramData\Malwarebytes\MBAMService\ARW\mbarwind.arw

                                                                              Filesize

                                                                              1KB

                                                                              MD5

                                                                              2ac4684638716a4eb8342bbbf4f75d3c

                                                                              SHA1

                                                                              3b28518b1d3fb7f2392197d161fc25a3553032da

                                                                              SHA256

                                                                              e86228e53d74776d48fd61a56af7ea45b57bb992719fa80e0831faa854edb162

                                                                              SHA512

                                                                              8ca6ee45eb54c5486334a2bb71c07df11aa26336e5bd3aa1d0daa162266628d5b172738dd0b2eb05062a3b66e0562d113192c7946a66483a570d69ff8cc2172f

                                                                            • C:\ProgramData\Malwarebytes\MBAMService\ScanResults\d83b6c24-fb8c-11ef-a674-d6a26ba1faea.json

                                                                              Filesize

                                                                              43KB

                                                                              MD5

                                                                              4e011e2b8999e874bab7ccfb2204a137

                                                                              SHA1

                                                                              a6e5f5ba429b4f058ea74d52eed80e7958951efc

                                                                              SHA256

                                                                              12cba976d3bc5f26e3b0af74c4bd2983eed9a7d3c4df170641a968e6fdd7d925

                                                                              SHA512

                                                                              07548bd54560b170cf4dec86394c6176acd42347c54a8992effe24075e69a84fa4832171721acec44ea582eb7ff76404d4d6bdf33c2364568ef43897ce7a65ad

                                                                            • C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json

                                                                              Filesize

                                                                              1KB

                                                                              MD5

                                                                              dc7a5cca76b0a4b8009aca1b10fe8217

                                                                              SHA1

                                                                              d3477259902db5cede3d857913fad80706587749

                                                                              SHA256

                                                                              223911583fabffa946712bd88ae9b25552e4f865d90f18b6d387577cfc99bf4c

                                                                              SHA512

                                                                              01fcdd9e9d3bc015a48145c05b426172afbd054fc1db6a0592d6abde106811df2c7b660fe0cabbb7f5fb23d8df2a470444218a35e6343ed99d0db9e89f70ce5f

                                                                            • C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json

                                                                              Filesize

                                                                              47KB

                                                                              MD5

                                                                              7d93e61361c56b7e285e18d54a9b01e7

                                                                              SHA1

                                                                              dbb89ed775ea177087c113ecc7acbb5a792ea451

                                                                              SHA256

                                                                              be2042b8780da5057aa3348cc918ab0f1a930d3f2374cf0a440273b926356c56

                                                                              SHA512

                                                                              d4f3c6d52a56c2dce7e66332feaa22ea5be4f2653ca4f9b1e53a4ebc1f1207136fdf1bd279c0760a1538b4ffd907e4ad085c0e43872d0ea25efb0eec01cf5032

                                                                            • C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json

                                                                              Filesize

                                                                              66KB

                                                                              MD5

                                                                              22fe0ddd63bfb466790058e147a22771

                                                                              SHA1

                                                                              dd878ec14ba80b8ebe05eb06e783bf6dfc8e3c3f

                                                                              SHA256

                                                                              319843ca59569489a4268b88d89746fa6ee0dbd6b648845dab1898e31cd57ecd

                                                                              SHA512

                                                                              dfd63a8d7d2158440eee3b1be0cc1f2bc0d290b99f234949ad403c09b098f0a07b741f1fa5f9f50140abb565eac0df706094c436e6c5ea5a4cb8666fffe7325d

                                                                            • C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json

                                                                              Filesize

                                                                              66KB

                                                                              MD5

                                                                              040395e2698f85f7b4bc198040c9f989

                                                                              SHA1

                                                                              5939bfa6f3922fc5236e55e9cf4b491fc28344bc

                                                                              SHA256

                                                                              d78e505f0c0800c3d8b1f2c2554357bb3e028f25136fdd8ac9fff78cb2f664c9

                                                                              SHA512

                                                                              1669372ce13590d6d22d8dfb4c390a84fc48d2303c44b80612dc3863fbf9e74b274f17c48b4039b9ece68616aab5dd032c6108f6d4942045142478da751ef5a4

                                                                            • C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json

                                                                              Filesize

                                                                              89KB

                                                                              MD5

                                                                              bf8d7977860e147f2851e595dc695573

                                                                              SHA1

                                                                              2475f964ca523608fc9c5f7001a72073df557fb1

                                                                              SHA256

                                                                              dc734634c94b071855ac5ca19258b39298720b78db8afcb47bd35b2b673a2706

                                                                              SHA512

                                                                              4dc802b4485cebc906ff7879c23970365432b43f346f7557ee97cfaf997bc4739ae09214c93df0b6c015efd821a238cc0a5f157bb992f7813f51ca2d441e47d8

                                                                            • C:\ProgramData\Malwarebytes\MBAMService\config\ArwControllerConfig.json

                                                                              Filesize

                                                                              795B

                                                                              MD5

                                                                              a15f5cbe077a3597c90b6c0b17c5d101

                                                                              SHA1

                                                                              760ffd3fb972c6bf01669eb1e25f36676058db15

                                                                              SHA256

                                                                              c4878deed3d60eb735de9a646e46b4bd1f5a2977b4ef71d0af602ec9dd1a9cf9

                                                                              SHA512

                                                                              ef0994e0e0f8eff437febdbb55dabc3157f4b5255e3047cc52cd9b9090845bac458ab54547267319222c709ecf10c9b1f404925238e09156469377e5c827b0b1

                                                                            • C:\ProgramData\Malwarebytes\MBAMService\config\ArwControllerConfig.json

                                                                              Filesize

                                                                              796B

                                                                              MD5

                                                                              d439cafe500f3d5b2cf18d6eb5252163

                                                                              SHA1

                                                                              67090e834c6c04b2a88b168c0e113ffae9a564f7

                                                                              SHA256

                                                                              477521c5021c8782e77ff6a5b2e7be504e22ae3263407c20783548e88eeeba16

                                                                              SHA512

                                                                              053a473e9388e3e40e7cb60439272ea3d24707e9ef938ea0388174842f2cb872444e00a063ff8ccdb92f34f45b6d02716aadebc5fcf7c2999a4c37746227ed47

                                                                            • C:\ProgramData\Malwarebytes\MBAMService\config\ArwControllerConfig.json

                                                                              Filesize

                                                                              797B

                                                                              MD5

                                                                              63e466b05883fe7eb55fe57b52cecda7

                                                                              SHA1

                                                                              0e8ff98446322a3fa34e0c3682d062a5af74fc87

                                                                              SHA256

                                                                              691b4e34ea5c0d54983af0eb0f333d59209c79d44fca295754bddfba0099a72b

                                                                              SHA512

                                                                              46a2c0b3209ce6e963301ed0145322263232543bd475628ceecd4b3b84ea00fd6e2d0724a48971d8a87011a149cbca0575ef08bb45380225a6b3e2c9e28701a1

                                                                            • C:\ProgramData\Malwarebytes\MBAMService\config\CleanControllerConfig.json

                                                                              Filesize

                                                                              847B

                                                                              MD5

                                                                              db073fd83e4452d9f8f4d4b3e745a755

                                                                              SHA1

                                                                              f0cada640144fde6ed735c012e03dc1de9e5ef5b

                                                                              SHA256

                                                                              442507b3f2dad683e79e306957e0165e18c521ca4cb1f03934fae41184706cdd

                                                                              SHA512

                                                                              47cd087a8d93a8ae0eff646afb64484b65dad3d9169f73a3d94c95bd3ca7b8b3763f66ece55feaf745b2a083e1cad13fc9a860d5bc97aac964fe3b4c8d1da012

                                                                            • C:\ProgramData\Malwarebytes\MBAMService\config\CleanControllerConfig.json

                                                                              Filesize

                                                                              846B

                                                                              MD5

                                                                              c7c5c2da7d231256eaaee200ba184b52

                                                                              SHA1

                                                                              82ac93b5597fd49fe97de8c4b46fef4642611c07

                                                                              SHA256

                                                                              5be267d1990539205b969d55c7fce9e71719084d867f22495a2a06f9536eaa21

                                                                              SHA512

                                                                              d50bdc57a6be01ac855a7121550a2bd1511239c7896aeb8263400d7689889fb78917b715f242633a7983050ec6316e7818ffc98e03a26d39a895d60eb7f8122d

                                                                            • C:\ProgramData\Malwarebytes\MBAMService\config\CloudConfig.json

                                                                              Filesize

                                                                              827B

                                                                              MD5

                                                                              cd127570051258fd1f7d5df181ab4a80

                                                                              SHA1

                                                                              c0e08d8ca214bee8b03b08d82249375e4e75d28a

                                                                              SHA256

                                                                              e9589ecce52081278c5d383a8ed5424b5a0494118bdc555cc8695000b73e1a50

                                                                              SHA512

                                                                              7c0123ab0254384ac939bae98e6dd9fdee9457c109aadd79c52288d4d2bed7b5211c115b86b0a33fe96da1dd4fc8b18da821264d3aa4e014fc9c96b2848a998d

                                                                            • C:\ProgramData\Malwarebytes\MBAMService\config\CloudConfig.json

                                                                              Filesize

                                                                              1KB

                                                                              MD5

                                                                              aae8211738d81ebb378cccb1951a697d

                                                                              SHA1

                                                                              f0f30b0e03dbc6a4a06dbdfdd4bb2107bfd1861f

                                                                              SHA256

                                                                              5deb332983b8320607ade30efa092ba8e3feaea0efae23c88c4ca0d4a2900885

                                                                              SHA512

                                                                              6be2947558574d56867fda218d9a627aa9074724b004354ec30ca277e65bbc9f44afcf4ef65014f7650ccb11e7d61c0e88a9d899e30867e5e30b5af819b4ea94

                                                                            • C:\ProgramData\Malwarebytes\MBAMService\config\CloudConfig.json

                                                                              Filesize

                                                                              2KB

                                                                              MD5

                                                                              241ab054aa2d8006ae1130f441508a8f

                                                                              SHA1

                                                                              778c927b02191687403a02f3f2560149c1a33fb6

                                                                              SHA256

                                                                              8947788e750c1980066cc29a200b5d3ad351d7ddaa72bb14b7fa3b55f3cf3ecd

                                                                              SHA512

                                                                              620d50ca69822e6275d7cdd8a21c5a653e2eb157f2293da76305d04f7b1db7f35cc16c00483d0df1f2ae9ae91baade1b013e7fa242cb2a192dc8c1f8fc720530

                                                                            • C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json

                                                                              Filesize

                                                                              11KB

                                                                              MD5

                                                                              03bbce7fca30919bd190a7224f5afa33

                                                                              SHA1

                                                                              8e32a962b81cab1a8394de8f501a260f23fd2ef3

                                                                              SHA256

                                                                              0e8df2cab26990aafe3aa4ad8f3bfeb2cad049727ac990a412421cfb373355fd

                                                                              SHA512

                                                                              01afdb1402c6dc3f8f9fe06eff74b561163dd014521315c02174b6f0f040eda3d5b87a57ae66ad47dd5505b8fbc097ece8ed63f27d260402285ddae056f0b2e9

                                                                            • C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json

                                                                              Filesize

                                                                              12KB

                                                                              MD5

                                                                              d14e5a1749409f411da4f62e92780468

                                                                              SHA1

                                                                              05f8ad61f2136050e4e0111d514705bb9c27ac25

                                                                              SHA256

                                                                              5a4fd6e7465c8c900d871753cea1727b66902c117dd91a92c90bb9e5ec851f10

                                                                              SHA512

                                                                              a80b0d6ac65f4a2620a3fd57c6e2cd9e36c96d2c364743fa79a0a0e928deca3ccd04605d87f8f7c8d6201d8badb841d5ba8200daa6b81c1d7e8493a6b9554ae8

                                                                            • C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json

                                                                              Filesize

                                                                              12KB

                                                                              MD5

                                                                              19837ef12adbaeab9f652d64002cae99

                                                                              SHA1

                                                                              bd8b5df64ba63ed97d1d06388b970ddeb97ca144

                                                                              SHA256

                                                                              3b33819c98d8be844742e20029d4e805bab7490cdae836091589145bef48055c

                                                                              SHA512

                                                                              9af888687836aeb462fc71af01be83890bc38b498133128d03e7087787baf9cd9bc412cb79b48fd4bdbc42c1b91ace82ae793be817f56d210c5630fdbacd97d2

                                                                            • C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json

                                                                              Filesize

                                                                              12KB

                                                                              MD5

                                                                              42be8d45a0c35e4239c4ebe4fa9b4cb5

                                                                              SHA1

                                                                              7e4af6de7a19df836e7fd0955b4e500436277b00

                                                                              SHA256

                                                                              da2f954ca6aa92e6489dd820dd62ab7d4601e260de5d1a450d7ab2a7abcc86dd

                                                                              SHA512

                                                                              33bfa74c4b860b546ff7155bb943bc8762a774001d5ed91a7fc5630ac7d911e80ba2089b06d3d4d2ce3928e07847295eef2ed050150b07e867664f453b7c613f

                                                                            • C:\ProgramData\Malwarebytes\MBAMService\config\MwacControllerConfig.json

                                                                              Filesize

                                                                              1KB

                                                                              MD5

                                                                              51e9d3866b45cae26298d4174afbce02

                                                                              SHA1

                                                                              f71ad298d6e48b2a9dc504eb4913e6230d3f7abe

                                                                              SHA256

                                                                              fa52daf36754d895156f5cfe6ec4d935c32ef67248b5699720df4620ef46deea

                                                                              SHA512

                                                                              7a7efb6a5fa822395a1aaad41389592f266303686f98948571b429584df11b47edf2d1d8fb3e5deb5d1694afa45994f45bd4941ff5d6f21f50d801e9a45390ed

                                                                            • C:\ProgramData\Malwarebytes\MBAMService\config\MwacControllerConfig.json

                                                                              Filesize

                                                                              2KB

                                                                              MD5

                                                                              7f171ba3a396b326472ffb7e24a3fcff

                                                                              SHA1

                                                                              6f2a3b2714f0e1881262391d5863ad95df21e6a0

                                                                              SHA256

                                                                              9ce82ccb5f19fd4790df13d91fd999707dd1e3c38fdfddbd88cc41e629df20c1

                                                                              SHA512

                                                                              33c2420706cfe47bf354d0c496cc106e31c269a1e439e92f6f2e61a8098e96e0890dc3808b331ccd94144ed298ef43f29e5d0e4e1bced5099549514ee7280f12

                                                                            • C:\ProgramData\Malwarebytes\MBAMService\config\PoliciesConfig.json

                                                                              Filesize

                                                                              814B

                                                                              MD5

                                                                              3cf622b72e9f59f40bb91088a9c61dc2

                                                                              SHA1

                                                                              541491bc9f5dbbee963af83d5003d857f8cc7542

                                                                              SHA256

                                                                              7445e4365f5c931d7b8a5466de962d46a0e39ec7470871f60f48fbb359561b1d

                                                                              SHA512

                                                                              d86f9cbc609965e369a230c53d753d4996dab1e8eebfe74bd95f70ec2ae0d5881e80b35b7326953e45c893164857585e217c1efa6630327c1653f02e6e716769

                                                                            • C:\ProgramData\Malwarebytes\MBAMService\config\PoliciesConfig.json

                                                                              Filesize

                                                                              816B

                                                                              MD5

                                                                              3cd5659ac102a287c0da9fce071525cb

                                                                              SHA1

                                                                              78ec8296df5e6f960c7659d79750855f8fa81cba

                                                                              SHA256

                                                                              96d512ff2ff46b742ab7d98a9505b59b1eab2a897299e067ed75de95601a0b29

                                                                              SHA512

                                                                              654dc2edff039340e2527f9fb429c61f3a847a46937f7a630093f05f8ce93b1cfcd2eee8fa132a43eb34b19046b25750eb5f542f2c586595599f9fe9af5fb112

                                                                            • C:\ProgramData\Malwarebytes\MBAMService\config\RtpConfig.json

                                                                              Filesize

                                                                              1KB

                                                                              MD5

                                                                              7dc958d74fbc52c59aa5943a8ce48aff

                                                                              SHA1

                                                                              e50898546b2ed18d8357413aa6bdc7cc812b2118

                                                                              SHA256

                                                                              6b2e052c706ad632a593508c3bf7c0b6499461b10fe9e19ba89b8e540bdad8bd

                                                                              SHA512

                                                                              4deb4d2f496d850cc523eb696d39ab41ea1a13b2c9a5f3e813e535c35e71130d2e65f65c956d78bea0202b750cd1c202dac8a4d8fbba6afd3cfca1274b42cfff

                                                                            • C:\ProgramData\Malwarebytes\MBAMService\config\RtpConfig.json

                                                                              Filesize

                                                                              1KB

                                                                              MD5

                                                                              8b9ba4916faf00da4431ecc536ace639

                                                                              SHA1

                                                                              e4266e1943681557090a58b117b2eda0f7a07ebb

                                                                              SHA256

                                                                              5530b9bda346db2d403ed165cd52f8df92c33b3fe176f4cf6702f621e808f614

                                                                              SHA512

                                                                              27e5b502d431321dab8447358185af3edd7c199b760568031e12a2bcfa50e66c28610ec4532d9a44102fa935d5559042b92956e399ccb94994d48698be950ed9

                                                                            • C:\ProgramData\Malwarebytes\MBAMService\config\RtpConfig.json

                                                                              Filesize

                                                                              1KB

                                                                              MD5

                                                                              2efedcde76e3cb8457f7dc30253e6a93

                                                                              SHA1

                                                                              fa2539d1b9026f7bbe61787fe8fc08ce7617ae4a

                                                                              SHA256

                                                                              ca338d591f9e63bf4917aba3f14d7b87dccff5c913e55ba2a460e34e2532fb51

                                                                              SHA512

                                                                              8d12fdc2042d80385cd4c20e9eb09181f717822791d37e72ae374fe2ece31452ffb04c8d2df82c56689d7a2f646c206d16d1372e3e1bea60eb46d85a87c39522

                                                                            • C:\ProgramData\Malwarebytes\MBAMService\config\RtpConfig.json

                                                                              Filesize

                                                                              1KB

                                                                              MD5

                                                                              21f847539b89504ab3ba2a42c3162066

                                                                              SHA1

                                                                              31009b6bc524fd12c2c603cd8811cf52320519b2

                                                                              SHA256

                                                                              82dc377a166508b846e50233573df07bb98a7eb3fd59ef8a3fb7728882344598

                                                                              SHA512

                                                                              77af0a8bff32c9047bbd4bee02ed58ba89fedcaf3c59a018c4bafcf64f80c96862277c3bc876a7c4bf26d5832300df691250c51af1acc2c78a4bd3984cd7d57c

                                                                            • C:\ProgramData\Malwarebytes\MBAMService\config\RtpConfig.json

                                                                              Filesize

                                                                              1KB

                                                                              MD5

                                                                              4cc47828adc9c33017532a8bb8426f05

                                                                              SHA1

                                                                              353912024c96983097b45d4fb20e9b4d6b169f08

                                                                              SHA256

                                                                              67494abedd3676455f8e156f1e89b5664f9614b5903ec94f763f766b833a94e4

                                                                              SHA512

                                                                              ffdb84c3dd7fe6f31a8c7953313cca8cd7b75d4c39d316449cf8f64fc71369d6274752adaa7963968e24fc781e77d5f136dfa3ad140f14f945d5ba8b9b887329

                                                                            • C:\ProgramData\Malwarebytes\MBAMService\config\RtpConfig.json

                                                                              Filesize

                                                                              1KB

                                                                              MD5

                                                                              ef81f7472789fc65c9b9a0bd2962e6af

                                                                              SHA1

                                                                              92c0f77120766b60b7574292e864d6aa714fe4ad

                                                                              SHA256

                                                                              1734c5e0ad6c8ccfe7e6d508b4e5e15239fe3b70222a9c622520e52c3a634ba2

                                                                              SHA512

                                                                              24c82d20a586e5171dfb98df55aa5847bcb85f911e88e6be5e352c8261a838b16298d523139b9c9a07fcf32333abb996ffaa3cfc19b6680dd1b9232d78277afa

                                                                            • C:\ProgramData\Malwarebytes\MBAMService\config\RtpConfig.json

                                                                              Filesize

                                                                              1KB

                                                                              MD5

                                                                              1caef354181223d1e21d37ace35cc92a

                                                                              SHA1

                                                                              a6cb00c57f6d5799c3e3d9f5bdbc870d4fa5d3ea

                                                                              SHA256

                                                                              9b801768f84c0c83cd4c8b6f064442d8e5d90499338e5b45374d6357a3f51dc5

                                                                              SHA512

                                                                              b736a96f803f364109896a36ba9335c80b28c5380ad2dd5bcbeda2497e7262eee8f159ae516133bbdf6e5c8e635d4df99c1bd988d28bee6ee8addebaf701b9b0

                                                                            • C:\ProgramData\Malwarebytes\MBAMService\config\RtpConfig.json.bak

                                                                              Filesize

                                                                              1KB

                                                                              MD5

                                                                              40b4176404350956502b801db1c601ae

                                                                              SHA1

                                                                              b09252758cbe52d3405715388ce38de5614079c8

                                                                              SHA256

                                                                              078e0b4efe6ac93e1f3c08ff835834af7956174c98947ff31d28a6840e909286

                                                                              SHA512

                                                                              1b53d6358f40f3a10b9b22a53e7e7e8762c5eb37b6ac9215390d7e5b58ef3116ab00bb2c30aa5c8ed42a0f275bf4370325fb3b9c01543791e259954206b45d9a

                                                                            • C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json

                                                                              Filesize

                                                                              2KB

                                                                              MD5

                                                                              9abd7df7a64445cef90a15bce053b704

                                                                              SHA1

                                                                              c7ba2156fb89e69c82b9fff65077038af1442565

                                                                              SHA256

                                                                              54187622e6f35fb2366b8602d0d687cfb17e3817ae454b7808befd5e152b2f87

                                                                              SHA512

                                                                              921dce193aff2006d07a0e37f85aff95ec4c1c523d12891d2a4ae5a615df10e1d47125f0f9471cde1e0f01767183c2f6921b8de7726e3f7d77edcac47dd3a97e

                                                                            • C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json

                                                                              Filesize

                                                                              4KB

                                                                              MD5

                                                                              0e15aaa5df306d9d4cb1ebdae091521e

                                                                              SHA1

                                                                              61a5b76df6b0eaa4a88e3e7a6b2a6471f9ebd40c

                                                                              SHA256

                                                                              321a99b968f5ea7821a2c8464858708d1cfd71c62c6df3b4003738491615371a

                                                                              SHA512

                                                                              5ba1862fdbc77ad1f55a08f740be0bb34962d0809988ca7c342d596c9af7c3adcf686c458b169f813d9de9ae219dac8b722e5c84c6918b80f5be0a28c44ea41c

                                                                            • C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json

                                                                              Filesize

                                                                              7KB

                                                                              MD5

                                                                              46bc07e7bba3082b45d5a8520c438081

                                                                              SHA1

                                                                              018d39928a5bf725d289bd8090060f381f97a8dd

                                                                              SHA256

                                                                              35a05d95062e388b76bddc8a68df86768fc87b61545b80c706ac2483b4ded763

                                                                              SHA512

                                                                              528dccd2c3a350dd4369cffa347f4db2de1012a3da9769f8ffb17bca6f53bab65b3b09a94543342437680211d91e43de4ba62d258d8b1fe6b6c0f976ed99cd33

                                                                            • C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json

                                                                              Filesize

                                                                              7KB

                                                                              MD5

                                                                              ab765989a654369bf268ce34c8a3a5de

                                                                              SHA1

                                                                              9201ec41f384b46c95c83e9f92b78ee97c298649

                                                                              SHA256

                                                                              8236ff0e1bd9d409e90409b9519780481bc174aa40d55b9db4529178421b966d

                                                                              SHA512

                                                                              9007f638fcd212a7196cf2c47e8e734d23c0fc7e5c32d3c2e5bf499d78475ab9d2fc30ff0635cda67d7060b8bd548ebc02e32ccadf877257a97689d6c6095241

                                                                            • C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json

                                                                              Filesize

                                                                              7KB

                                                                              MD5

                                                                              85b808a66a1b5b15c9238ad6aabaae6a

                                                                              SHA1

                                                                              4400a5a9363b19c8946bcf516242656555eccbdd

                                                                              SHA256

                                                                              a09995fd347d1aae6dd3fe7780270be82b19d18f9e2c36d21896b4b7fa23aa78

                                                                              SHA512

                                                                              611d83b6f19844df531717d51830485320e63afcbdd0c860e8b91e1d55b9f8e2897dadbea71ac426d9ea4a4f0ee28b62961e099a1110a165fa5d9095c9bfae91

                                                                            • C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json

                                                                              Filesize

                                                                              7KB

                                                                              MD5

                                                                              efda57871be560fd4ca24b668d14f209

                                                                              SHA1

                                                                              d241c2243ef221421935b88272d3e7d9a0dfb905

                                                                              SHA256

                                                                              6523ee659f11b797155aea18c7fd70ff570c4d6c69eae4d6106c0b0679905fd5

                                                                              SHA512

                                                                              ae7f371d951e11ac344b22ad42a90975e70f6b1e07aa1ce4978e9b5c5f2d42b0f5fc55436c336bcad99c342de3d70e4db9de676c0c4ca0175fcd9e46f4620c38

                                                                            • C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json

                                                                              Filesize

                                                                              7KB

                                                                              MD5

                                                                              e58200dc5411d9684da6deab9d86f0cf

                                                                              SHA1

                                                                              a51268e7fb7096c8b8e76ce4df5e59355f2622dc

                                                                              SHA256

                                                                              1cd929ab64a341c60c82c185de674f56528297d91058ce6ffbd05fa6fd4cf4c6

                                                                              SHA512

                                                                              7911b8efcceea7061160b74737126bebd4d73b958ee2ec2bc0de9a144d19f3488abf08c03c15db1c79967740c3640fd7cd8c4f3791004953d0013403b29174e5

                                                                            • C:\ProgramData\Malwarebytes\MBAMService\config\SpConfigFile.json

                                                                              Filesize

                                                                              11KB

                                                                              MD5

                                                                              fcac3b71bf6db1b5509c0fad134cf2fa

                                                                              SHA1

                                                                              2892a1dc76e3f5bcf884aa2f8ec007a9411966b3

                                                                              SHA256

                                                                              12abeee88729890e8dd9554ed3595221208c2493fb6839cc1a750ae4e4d0a2f0

                                                                              SHA512

                                                                              c1d2460961eedcf24cb5a0bd8a3164e8ba91123e79a1eee79c6fe0ab1a1e0194febcff7f8d7b36da8ff4515825d0d4218586d10892699b1cbeeec43f7335df8d

                                                                            • C:\ProgramData\Malwarebytes\MBAMService\config\SpConfigFile.json

                                                                              Filesize

                                                                              11KB

                                                                              MD5

                                                                              4206fd59be5f5cf8ab9606eb1d151cc6

                                                                              SHA1

                                                                              9ac96663408f1ce7cc1a03ff247c499df7950d09

                                                                              SHA256

                                                                              1af9c65f7c2c7f45423d56b067f53a6beefd1778061cbe19d74fc96d05d0af2f

                                                                              SHA512

                                                                              a759a435e3135fcd00aeb06528cd72a7bd9c95f32cf92af75cdf99cff5de948c3aa18399c713706c32b58ffc6b1996ad5e38799e53122142ed66635c7a895d59

                                                                            • C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json

                                                                              Filesize

                                                                              1KB

                                                                              MD5

                                                                              8c95903ee09920c65f7e8fe0813b9db2

                                                                              SHA1

                                                                              18463129421cd61e17f09f4af3f99e020a95ae56

                                                                              SHA256

                                                                              5ea823bfa27b9517339e7dc80e8ae9e6f258c1dd4984fb44ecb8086adca07461

                                                                              SHA512

                                                                              5a7a9bf6850af70780dc19aa190cf2d116d194f4d52d4fad04f2d05beacabe412d14db9d53931a1eed8d571e7ac1898c5660279e2741da8abb0e19050655d663

                                                                            • C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json

                                                                              Filesize

                                                                              1KB

                                                                              MD5

                                                                              fc06e10a97a60fd6db5337c2be5f4de2

                                                                              SHA1

                                                                              ced23c787428735ebeb0767bf3ee1cd6f281e3e9

                                                                              SHA256

                                                                              3a0356310a7114e9f9cf4d65f52742e735d821eac77ddb9e79c4d59c31491080

                                                                              SHA512

                                                                              45db9d7d2231504f148405ceeb15255e577086e385e7e5f8e4758f95cf9cf56d726adf6cb18de54d789aa50028707abfa00e128a9c9c3844d13270cdb27d27ce

                                                                            • C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json

                                                                              Filesize

                                                                              1KB

                                                                              MD5

                                                                              e87c68d19eb110e07db5d152f97f2681

                                                                              SHA1

                                                                              2afc51899209bd6591131e57e92f4b32fdf16fb0

                                                                              SHA256

                                                                              fd40a03ab8c66920e1f26f26742ce8619e27e3ac28075cf8acbd4977ee6c3ad7

                                                                              SHA512

                                                                              6f5caac4db7ed09b3782c53278175f3e0eb5c4d5b8422b262461e8c357aef98f0aa3c57a14b91bd5d1b4600089297fa316415ac3a17f2c05db814107d99c0380

                                                                            • C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json

                                                                              Filesize

                                                                              1KB

                                                                              MD5

                                                                              af5ae674b56ea7ed59a9dfe2f05f86c5

                                                                              SHA1

                                                                              def5f83750ebd8e32e1bcc074023cab7705ad6c2

                                                                              SHA256

                                                                              a0203908374961d9dce9902046f2841a5d87912bf419189b6acc0831ae866fdc

                                                                              SHA512

                                                                              db1f828d791a26de42f3d7a739607f7fed5b10a44f7cd703b322c8346f93ce2bca7540c14e2a0a402f0a6de1852e3bdec73b53c31e5c9f0295ce515dc196edcb

                                                                            • C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json

                                                                              Filesize

                                                                              1KB

                                                                              MD5

                                                                              adddc07584c48d602641f670ba91b9cd

                                                                              SHA1

                                                                              baeb60cb826e307eb867bd24bf90ca9642b57eec

                                                                              SHA256

                                                                              5e08a1009d6c5d003aa102fdce8a03e752278781b3eeec4f2365ca747f840896

                                                                              SHA512

                                                                              4c511ca4c400f372d8bef84323489ae8efa0beece6696d0a6c4bb8ba2ea7c17ea9aed782d7557eec2bbaeda0179a2a7e84b35875b2d44626adcf29bce6d2ddcc

                                                                            • C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json

                                                                              Filesize

                                                                              1KB

                                                                              MD5

                                                                              2bc0d9fe4696f61b350d2cd8644f030b

                                                                              SHA1

                                                                              9c429e7ac574d5570ec220487a91f310851a799a

                                                                              SHA256

                                                                              4e27a40467ceb6b5ef83a77ca04f7e67098c536ed1030c83c56c92e9f0e52f72

                                                                              SHA512

                                                                              ca66e958fd33ed20f5118ffaab7e25d9034ce2f5d5f5912938b0a3c0b0f125984886cfefa23d27f57728b1790b63adc22ae681cb80fbd298da418c48107884fd

                                                                            • C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json.bak

                                                                              Filesize

                                                                              1KB

                                                                              MD5

                                                                              89402881609cf2901e002b9810fc710c

                                                                              SHA1

                                                                              bfff578daf2c8f6acf2a212347f28c0c465e122c

                                                                              SHA256

                                                                              252bd2d03941b939f42cc25e580c2422e64eb6944314bd3d28bf52c31cf680eb

                                                                              SHA512

                                                                              07d826fa6482b9d8a28060c9be32b3418992c1639df3a4f1f558231e46f45a4085d47181ae6789a112d63e1f1ad9e413107ef00938166a04f14f8cd7657b369b

                                                                            • C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json

                                                                              Filesize

                                                                              1KB

                                                                              MD5

                                                                              79a82776b769d5b7bc1fa4bb7ce2ca92

                                                                              SHA1

                                                                              eb5daa6e350672206aab3a5c445d19bb6c76c83a

                                                                              SHA256

                                                                              a087bf2c6849b8ceac53e19310c76c0a3e9a999147e8ad5e94d4279f83b5d8e3

                                                                              SHA512

                                                                              7077c831c28757ecc2cacbde63ee9002a1b75ea993fcd568d552c0c9087a4d02978d98c15d71256ee7ac44bb41d432ae80608ad4c0b82d551810cba3f3cc2ff8

                                                                            • C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json

                                                                              Filesize

                                                                              1KB

                                                                              MD5

                                                                              1c9c581e7dd2960a5c5b0d60c796e99e

                                                                              SHA1

                                                                              532f35b128ef72d7f1776a997c956962c28ec7df

                                                                              SHA256

                                                                              0f2bb61baba0da0a3e5de283e207447727d4f19110a109afac29e7952dd2df9a

                                                                              SHA512

                                                                              563060a2bbf9a4e538a87ef09935f80105af7f89ed4e6f9047632cea509e601fccb240f3efb2980f4858e55e2783e9f7f0b2f8e833d70a500373b01d4ce191f7

                                                                            • C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json

                                                                              Filesize

                                                                              1KB

                                                                              MD5

                                                                              ce884ca7d367842bb85726289688573d

                                                                              SHA1

                                                                              043f7a46471cd8c4739d0d648cb358795b82cf9d

                                                                              SHA256

                                                                              84e523739926ddff502731b382004cc91a71f1541653d635cbce2919dd958341

                                                                              SHA512

                                                                              bbe6e525b2b986d5a6937044e5930d6381e344c33a979b7b364fae6091e473f13747fe08d72412be22cbc81f382968e56de07463144f3d852bc9772ef61630de

                                                                            • C:\ProgramData\Malwarebytes\MBAMService\config\VPNControllerConfig.json

                                                                              Filesize

                                                                              1KB

                                                                              MD5

                                                                              1541ec2c87fbb5c76a14aee4e7bfad00

                                                                              SHA1

                                                                              0941ab9b69630d632aec9cd7d0f6a00cbd35cd29

                                                                              SHA256

                                                                              bfcb0805e6fb9e36d9fa727715539373306f2dbcfa701d9b982085159851f1bf

                                                                              SHA512

                                                                              0051e6d57de6bf25a3945da1e725c754cb98297c4ced4cddef2034452ebcf00cd622caa744170671362fbafa818a8b161e6521811abfb99154bd739adebfcfb3

                                                                            • C:\ProgramData\Malwarebytes\MBAMService\config\VPNControllerConfig.json

                                                                              Filesize

                                                                              1KB

                                                                              MD5

                                                                              dac0a38e65671735ea4a41e27c0ae1a2

                                                                              SHA1

                                                                              6b8287bd1a73c81e98e2b5ec28f4cd2354044a41

                                                                              SHA256

                                                                              60b992dc4c82c6d4e04f93661d23b94d65b976ddb2d895a811d340d7423de4f6

                                                                              SHA512

                                                                              1686bba2a01b994c9439944194aa28f0de15fac0c213ef0fa2ff68dfbe870586e4c0dcd3a2e1d86402335398fe6cdd029757e94441b3a1c4cb0800348f4629d3

                                                                            • C:\ProgramData\Malwarebytes\MBAMService\config\VPNServerListConfig.json

                                                                              Filesize

                                                                              125B

                                                                              MD5

                                                                              96b02e16d74f8603faaf739e55164652

                                                                              SHA1

                                                                              2dd2fa25e259d54ca8599d2b25a8cb5411a36e7a

                                                                              SHA256

                                                                              faf828b8d7ccfb5abec33ea93b0a6285ff3f31f7ec5cb6141f930c8ef0f71b18

                                                                              SHA512

                                                                              d8b0495509049cf2c8ff89f56a76777d4d3e41e08d56b0afaae3b351907453a70dce911563104f57fc96db874a5433ebe8c6003264ca2ca0f473c9c7376e7291

                                                                            • C:\ProgramData\Malwarebytes\MBAMService\lkg_db\Actions.dll

                                                                              Filesize

                                                                              4.5MB

                                                                              MD5

                                                                              f802ae578c7837e45a8bbdca7e957496

                                                                              SHA1

                                                                              38754970ba2ef287b6fdf79827795b947a9b6b4d

                                                                              SHA256

                                                                              5582e488d79a39cb9309ae47a5aa5ecc5a1ea0c238b2b2d06c86232d6ce5547b

                                                                              SHA512

                                                                              9b097abeafe0d59ed9650f18e877b408eda63c7ec7c28741498f142b10000b2ea5d5f393361886ba98359169195f2aceeee45ff752aa3c334d0b0cc8b6811395

                                                                            • C:\ProgramData\Malwarebytes\MBAMService\lkg_db\BrowserSDKDLL.dll

                                                                              Filesize

                                                                              5.4MB

                                                                              MD5

                                                                              956b145931bec84ebc422b5d1d333c49

                                                                              SHA1

                                                                              9264cc2ae8c856f84f1d0888f67aea01cdc3e056

                                                                              SHA256

                                                                              c726b443321a75311e22b53417556d60aa479bbd11deb2308f38b5ad6542d8d3

                                                                              SHA512

                                                                              fb9632e708cdae81f4b8c0e39fed2309ef810ca3e7e1045cf51e358d7fdb5f77d4888e95bdd627bfa525a8014f4bd6e1fbc74a7d50e6a91a970021bf1491c57c

                                                                            • C:\ProgramData\Malwarebytes\MBAMService\lkg_db\Global.nm

                                                                              Filesize

                                                                              338KB

                                                                              MD5

                                                                              181d1b26db6ba77d5d6a3e135a1654bb

                                                                              SHA1

                                                                              d44b405d83b0e3af82fabd21c2209a362dbedd62

                                                                              SHA256

                                                                              39cb2bd1d43fd20d4c3f0fa7a4c69e18293abb1bdfd1e39941426f50b6d4be40

                                                                              SHA512

                                                                              6ef62425dd0484a4b4665c9edde3ff3c40ebb06b9a7987cca2875306c941f8aa729dff5379f7ac2c08eecb61824d86b1da577acbc652cb16e3686ccf0439517d

                                                                            • C:\ProgramData\Malwarebytes\MBAMService\lkg_db\Global.sr

                                                                              Filesize

                                                                              30.9MB

                                                                              MD5

                                                                              10498a72d9c7ea11f14f8bde2c7ba616

                                                                              SHA1

                                                                              738f0705bf12affcfc24b7c591d44c1c3750f5aa

                                                                              SHA256

                                                                              db41f81fcd048e6090ae8e0dd742244a301261dc7ad3428369c1701b026a2b15

                                                                              SHA512

                                                                              84c7f2bd2a4d231fa124266e173fa69e8db0ba75261119eafa899da1e080c766687de5a6aefdeb3f88c369a6575263607e4c1544ba0f9626ac832b57a55ffbaf

                                                                            • C:\ProgramData\Malwarebytes\MBAMService\lkg_db\cfg.bin

                                                                              Filesize

                                                                              935B

                                                                              MD5

                                                                              de80d1d2eea188b5d91173ad89c619cd

                                                                              SHA1

                                                                              97db4df41d09b4c5cdc50069b896445e91ae0010

                                                                              SHA256

                                                                              2b68990875509200b2cf5df9f6bdfcda21516e629cab58951aac3be6a1dd470c

                                                                              SHA512

                                                                              7a8f5f83552dbff21be515c66c66f72753305160606c22b9d8a552ab02943a2c4e371d17dce833020d2779c6d9fe184a1e9ef3d1b8285c77aeb17b2bba154b3f

                                                                            • C:\ProgramData\Malwarebytes\MBAMService\lkg_db\clean.mbdb

                                                                              Filesize

                                                                              41KB

                                                                              MD5

                                                                              321869028e8254c0b9869a68d357a71a

                                                                              SHA1

                                                                              c6c0b8e327465bba477005edbe511419d40a4d26

                                                                              SHA256

                                                                              ddde9e4b0c340dd2c33b388b59e495fa92e28009ceb7b294531abf17eb3aece0

                                                                              SHA512

                                                                              5231f29149214cb19503f164ae355cf675cd233295f8823fc41bec3cea67e802e973ef195ab5f9aea298fa657918bad8a9cad630ff5b49b5eedcd13c662bbeae

                                                                            • C:\ProgramData\Malwarebytes\MBAMService\lkg_db\dbmanifest2.dat

                                                                              Filesize

                                                                              924B

                                                                              MD5

                                                                              96125a3c5c367bc9d90ba19f1c39fabd

                                                                              SHA1

                                                                              ede4ab3dcd117cd41e6fb5dc8eeefdf13920025c

                                                                              SHA256

                                                                              8ac1c089f3745b060962e877568940e6594ff5da8e1ac5771ef3c02a671e0dd4

                                                                              SHA512

                                                                              f3105281b5186d0290743631cf592292534d1a74e19da23aea472b2231fd24b70d8dd0bb179f9686af8cea214de439e0a723554e5f129ed1362b64ff8b99b822

                                                                            • C:\ProgramData\Malwarebytes\MBAMService\lkg_db\dynconfig.dat

                                                                              Filesize

                                                                              39KB

                                                                              MD5

                                                                              10f23e7c8c791b91c86cd966d67b7bc7

                                                                              SHA1

                                                                              3f596093b2bc33f7a2554818f8e41adbbd101961

                                                                              SHA256

                                                                              008254ca1f4d6415da89d01a4292911de6135b42833156720a841a22685765dc

                                                                              SHA512

                                                                              2d1b21371ada038323be412945994d030ee8a9007db072484724616c8597c6998a560bc28886ebf89e2c8919fb70d76c98338d88832351823027491c98d48118

                                                                            • C:\ProgramData\Malwarebytes\MBAMService\lkg_db\exclusions.txt

                                                                              Filesize

                                                                              23KB

                                                                              MD5

                                                                              aef4eca7ee01bb1a146751c4d0510d2d

                                                                              SHA1

                                                                              5cf2273da41147126e5e1eabd3182f19304eea25

                                                                              SHA256

                                                                              9e87e4c9da3337c63b7f0e6ed0eb71696121c74e18a5da577215e18097715e2f

                                                                              SHA512

                                                                              d31d21e37b0048050b19600f8904354cff3f3ec8291c5a7a54267e14af9fb88dfb6d11e74a037cc0369ade8a8fb9b753861f3b3fb2219563e8ec359f66c042db

                                                                            • C:\ProgramData\Malwarebytes\MBAMService\lkg_db\ig.exe

                                                                              Filesize

                                                                              1.8MB

                                                                              MD5

                                                                              3789224ec141ef0b7f4efd86ab0b17dc

                                                                              SHA1

                                                                              6960f2b651359577439bafe57fbbeac759b99037

                                                                              SHA256

                                                                              2d563da1db554aca0a775f65e91bee1b928dc6c803430f73e997200d8cde8601

                                                                              SHA512

                                                                              5640d157248f859c0b02b7754550b76cbcbdde0d25b91812b7d1d0c86cbd712faf95f9e8a559afc1b527e1daaa29e1c62b5ad5d536b7a52510eb2b72e4b12c40

                                                                            • C:\ProgramData\Malwarebytes\MBAMService\lkg_db\mbdigsig2.dat

                                                                              Filesize

                                                                              514B

                                                                              MD5

                                                                              8f778de7c8d55e4735efbc753be46014

                                                                              SHA1

                                                                              f1d7413e57e7d1077b5a8168ab7a663db5224806

                                                                              SHA256

                                                                              986608a8b5f4fcb382a194727af4ccd36a03b128e451e9f7803ec5298722af26

                                                                              SHA512

                                                                              9474e47153ad5e596c6c26730ad6709554e68037c50d0b603a4a71027b8e19ea0b7387ce3b3592ac3c07d9ebe1e71dbc90a234b3928ca2c2eaf6af4337817fee

                                                                            • C:\ProgramData\Malwarebytes\MBAMService\lkg_db\prot.mbdb

                                                                              Filesize

                                                                              24B

                                                                              MD5

                                                                              546d9e30eadad8b22f5b3ffa875144bf

                                                                              SHA1

                                                                              3b323ffef009bfe0662c2bd30bb06af6dfc68e4d

                                                                              SHA256

                                                                              6089fbf0c0c1413f62e91dc9497bedc6d8a271e9dc761e20adc0dccf6f4a0c1f

                                                                              SHA512

                                                                              3478f5dcf7af549dd6fe48ad714604200de84a90120b16a32233b6d44fa7240f5f4e5fe803f54b86bbdfd10fa1bfdd88fb85eb6a78e23e426933f98d0a2565ec

                                                                            • C:\ProgramData\Malwarebytes\MBAMService\lkg_db\rdefs.mbdb

                                                                              Filesize

                                                                              24B

                                                                              MD5

                                                                              2f7423ca7c6a0f1339980f3c8c7de9f8

                                                                              SHA1

                                                                              102c77faa28885354cfe6725d987bc23bc7108ba

                                                                              SHA256

                                                                              850a4ea37a0fd6f68bf95422d502b2d1257264eb90cc38c0a3b1b95aa375be55

                                                                              SHA512

                                                                              e922ac8a7a2cde6d387f8698207cf5efbd45b646986a090e3549d97a7d552dd74179bd7ac20b7d246ca49d340c4c168982c65b4749df760857810b2358e7eb69

                                                                            • C:\ProgramData\Malwarebytes\MBAMService\lkg_db\rules.mbdb

                                                                              Filesize

                                                                              10.5MB

                                                                              MD5

                                                                              b30d5b9bc495bf34a57e3d67deeeaf26

                                                                              SHA1

                                                                              ed2ccd27635eeef75239417d0c0b5d3265eed03d

                                                                              SHA256

                                                                              782a5ea931729ef71dedfabe5b9778ef8275a3f96a7075e93edeb3f3372e4480

                                                                              SHA512

                                                                              4f319c284399ec9ae31505a4850256d4f3289575778136b97ca51a436f1b1e8f5273da42632762a5e89059dff748626c67809f8598878591174a30f8f15396a0

                                                                            • C:\ProgramData\Malwarebytes\MBAMService\lkg_db\sample.dll

                                                                              Filesize

                                                                              528KB

                                                                              MD5

                                                                              066fe2077f9a8a997e40e2391565b61c

                                                                              SHA1

                                                                              59f12935d29cf60f51cb0893d1475d6a56ad5ed3

                                                                              SHA256

                                                                              d9f1595366dcd8dcb7631935cd2ff301df82adde05ca5b9bd0dd4d43fab37e9e

                                                                              SHA512

                                                                              91450387c549786ed15622bee96c50cd84b25fd109061854920aa510628cb7ee4b3213e1d3c1aad956f4d7c7bb96b519b5933d1c9fe612d37a1385cf51d8b906

                                                                            • C:\ProgramData\Malwarebytes\MBAMService\lkg_db\scan.mbdb

                                                                              Filesize

                                                                              571KB

                                                                              MD5

                                                                              6ec2c8ddd84a54a64adefb6187fc84f0

                                                                              SHA1

                                                                              c276e00b0b9abd96a8ae8ffcf624ea7f13c7bf18

                                                                              SHA256

                                                                              2d7fcb5336d6c25e64bff75d063e1b9dd761ddb4fb2d727a966bd5019ab20c8f

                                                                              SHA512

                                                                              2b79dd55814482621f21010873c6e4b2ea7b765f594cab2336f60ec1f27499e1ad069906621f48f1f6f4e93d9e738eff17061afc3cfd7680a0f54e77a7396e22

                                                                            • C:\ProgramData\Malwarebytes\MBAMService\lkg_db\tids.mbdb

                                                                              Filesize

                                                                              148KB

                                                                              MD5

                                                                              b486b3009e8e94514c6e62faf90a65df

                                                                              SHA1

                                                                              d26e1ca5aad93bafcdbfb32d6e1950bc9c7c3bd7

                                                                              SHA256

                                                                              57c9ca122e930da4d144f5da9695db9c17751ae0ddc38a869b7adcd5e7833121

                                                                              SHA512

                                                                              af87d72169ff34f76a556e28c1e2a638c428ae6d10400da254eb08e1bc7b3410b9de512f4a40d19ba68ab4ec5e976ff0e8a99382489cc44db92b23fbd1527ddd

                                                                            • C:\ProgramData\Malwarebytes\MBAMService\lkg_db\wprot2.mbdb

                                                                              Filesize

                                                                              19.9MB

                                                                              MD5

                                                                              0f3852fd5954352391c1d35ad3ace6be

                                                                              SHA1

                                                                              de664edf3637884bd10e8cffb1012658ff5fd94e

                                                                              SHA256

                                                                              432b4227fac6823ac81d04bd202b3a39dfde3c93e4cd3c4234eba00241e66c25

                                                                              SHA512

                                                                              eca9f187a95a1198c04bc593447f3eb5b7a53c39492a31844442a77286f9b611c1aeebc9013bc12e280f169e3c647569b78945ec342bc2e68e2ad9b7ba60b3c7

                                                                            • C:\ProgramData\Malwarebytes\MBAMService\pkgvers.dat

                                                                              Filesize

                                                                              75B

                                                                              MD5

                                                                              f8417c8f25c13c03fa0c0fed4cbb39f0

                                                                              SHA1

                                                                              111c75111f70a4a5da3ae28048dfff5dac0a673d

                                                                              SHA256

                                                                              7d80dca16853137c2b53fe4b8745d00c0789df99e1e124a3a118201522e4674b

                                                                              SHA512

                                                                              8a3aacdbe41946cc03295db2f44e8a040bc451f75c4050a170ca9be1c94e83f613aa86ed2f8af7649eb68bcf2c98185eaa9bbc69d5653fc32613174f88a3a406

                                                                            • C:\ProgramData\Malwarebytes\MBAMService\updatrpkg\SdkDbUpdatrV5.dll

                                                                              Filesize

                                                                              2.6MB

                                                                              MD5

                                                                              4ae5b2843ac5a5380465cb735e1e7aa6

                                                                              SHA1

                                                                              96a885853139d84283bb912099979a5ff7639cf6

                                                                              SHA256

                                                                              b2b67621405eadde60621fa1b3d3c4f06c2d6c700aef4da0bae6271895379856

                                                                              SHA512

                                                                              e0022f64991945c332e4c9d470d69221584dfc59095e7149cd6ab1c9fb32a63a048e2d65fc294ec866a018e0a5dbff37907eead96453668d8a6f70e4432622a9

                                                                            • C:\ProgramData\Malwarebytes\MBAMService\updatrpkg\mbupdatrV5.exe

                                                                              Filesize

                                                                              5.9MB

                                                                              MD5

                                                                              c41e65a4673b1a2d1e05914e4d246d35

                                                                              SHA1

                                                                              bd2a5b575018c8a4c65058097c3f0ffc655593ad

                                                                              SHA256

                                                                              aeb17935e9f412280f1f58b49ce02bdd4387d793541058acba0d15eb295b48eb

                                                                              SHA512

                                                                              003914d45d02d155ac5b23de64e6ce491bda2335ca82fa9f059d90a5b792746c76d70bd2714b62898b56150dd228b44696679b9d22315368d326ed39109cfd66

                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                                                                              Filesize

                                                                              649B

                                                                              MD5

                                                                              59a5be8da2a9df6690d2ff8f9c192bec

                                                                              SHA1

                                                                              d799da882401715b19cb465b06611de2b642c279

                                                                              SHA256

                                                                              7923537b089d301ce86686f039ed4cd72e004e3e914597a5bc4887152283f7bd

                                                                              SHA512

                                                                              bb236db680c624e1c39e9b29e1b84bbfa41b315b8376a85e6771e4935fcb263163b30fe4db1f368ae728cde6b084a516700fa8b06818330adc284da573221969

                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                              Filesize

                                                                              864B

                                                                              MD5

                                                                              a571d931b10b6c8a13ad7d7f9b1d8347

                                                                              SHA1

                                                                              4ca364d9a2fec11d02bd493599ed8ecdc98e593e

                                                                              SHA256

                                                                              9934933eede0a9ed88711931719a0de16e289ae16db4c743cf0446fa08700b45

                                                                              SHA512

                                                                              25d0653f2feaf5b6c1ca948d0981730d2e176cc3f28bb0104256673c18bd395eec347dfd39a87f8c63f62b0ccc2bef8924b59a17f33415e24451de64f4c34368

                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                              Filesize

                                                                              1KB

                                                                              MD5

                                                                              3f7faf7279cfd60d7ec5f763c218a302

                                                                              SHA1

                                                                              13f3a8868ae72ea68a044ea3fd4c63c70f41027e

                                                                              SHA256

                                                                              a66fb5115fb68ee6b66e517e80c9f5f26485f4de1aa4f8a02c122122ac46efd4

                                                                              SHA512

                                                                              c685d54253461a45e47d7aad59ff8f2a54043a43b4366b73345c46ead40c5eb623d9a98a92787865ed1281964db8c73791ab987083aaf045c8e6e3aa7bbbc97d

                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1

                                                                              Filesize

                                                                              264KB

                                                                              MD5

                                                                              9ca408d983bab36dc76e5412e4c096f4

                                                                              SHA1

                                                                              5356bda778e2c1b9650682b3ad41156c191d05fb

                                                                              SHA256

                                                                              e6ef63a3221c295a7bb7ce9d69239ff20ee8142fd00b209240fca96305a0a310

                                                                              SHA512

                                                                              f2747f1f409572a7b79f26e219fedf9f0ef0c8e626567f0ac70b3b0253a446f04f372a474876006a018316ae0bce24a7f8be44ed0c516788ad67b47abf756822

                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.89.1_0\_locales\en_CA\messages.json

                                                                              Filesize

                                                                              851B

                                                                              MD5

                                                                              07ffbe5f24ca348723ff8c6c488abfb8

                                                                              SHA1

                                                                              6dc2851e39b2ee38f88cf5c35a90171dbea5b690

                                                                              SHA256

                                                                              6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c

                                                                              SHA512

                                                                              7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.89.1_0\dasherSettingSchema.json

                                                                              Filesize

                                                                              854B

                                                                              MD5

                                                                              4ec1df2da46182103d2ffc3b92d20ca5

                                                                              SHA1

                                                                              fb9d1ba3710cf31a87165317c6edc110e98994ce

                                                                              SHA256

                                                                              6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

                                                                              SHA512

                                                                              939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                                                              Filesize

                                                                              9KB

                                                                              MD5

                                                                              5c74a7d105a0b74ab23a94cb920e9543

                                                                              SHA1

                                                                              46f11ecb2fb80b2017cc562f832c281359790ec0

                                                                              SHA256

                                                                              6372acde45651ff1ec8fc623bf444dfd91f2607b0b006c38620de1c440b33890

                                                                              SHA512

                                                                              fe5c879d894e8959eeba636b3bc3e2808517f3059687f693a19d92c2b37c3b9544bfd3b2daaf36717b90158b8e5c9e5e4097210ea9d24071f3a3f439ae028135

                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                                                              Filesize

                                                                              2B

                                                                              MD5

                                                                              d751713988987e9331980363e24189ce

                                                                              SHA1

                                                                              97d170e1550eee4afc0af065b78cda302a97674c

                                                                              SHA256

                                                                              4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                                              SHA512

                                                                              b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                              Filesize

                                                                              1KB

                                                                              MD5

                                                                              500765fea5b4d3a899fdee853241d530

                                                                              SHA1

                                                                              b38416027b5067bd7273aa405beb7666b7febb9f

                                                                              SHA256

                                                                              c9097bab3c010c437ea29f720a69a51762016d56991d54dbcba84b26d86c9caf

                                                                              SHA512

                                                                              ca66fe92829f0c49e6a578e62675dfe97946b7ba24725102476bf7707e471769e79ff15c7e1088e11416c20b98c72bd15674fcf8ae0a1954ef9ff7269e9e5128

                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                              Filesize

                                                                              356B

                                                                              MD5

                                                                              2994fb218e33504c676e819ffab720ba

                                                                              SHA1

                                                                              e834450b9452298426ec20264643c7f0b18cffc3

                                                                              SHA256

                                                                              844a3828f0ee8d491baf2c35291339a02510e887b8bc21589b36e0168381ffa7

                                                                              SHA512

                                                                              e028ab4d7d5105e57846382fe279f2bc29d3018df1ba12fece0f266a4e4419d47738a09ed776dabcc93023a7097d3aea4b7e2ce8e3438f68406bd30a66a407c8

                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                              Filesize

                                                                              2KB

                                                                              MD5

                                                                              2844a9e6cebd9eac4e9ac1e9b6112f80

                                                                              SHA1

                                                                              38265a98eb3c9f76633630b942e75a3bf7bae7ab

                                                                              SHA256

                                                                              40861eab7e186b9d65009bc6706896262cb445efce072446e239acfce9e692cb

                                                                              SHA512

                                                                              a7d725d1af883baf360b72529a221860a3a6ab47da4ff2301458d62e1c6ca6f8bbfd8af87d10ea6b0796ce73a30e95e6d276f3715d63bcb8c3f8c7a20f107c95

                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                              Filesize

                                                                              1KB

                                                                              MD5

                                                                              aaedc2543af9b629b2af47c57542fb9d

                                                                              SHA1

                                                                              ace4c05c9b45ebdbc68be0d1d5c3a38e159ed421

                                                                              SHA256

                                                                              bffa29ba5ad3254a558ce337867b226dda1dba5bf81b073901e21211a8bc8733

                                                                              SHA512

                                                                              c2d2ed513d31d9c9b2a9080769e4d9a2133842b6dd04c22bf038e840ec59b8d5a79f01ed8911e434bffa90fd10a3129c4d6054bd8899c851c3e0f846ff5d38cc

                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                              Filesize

                                                                              9KB

                                                                              MD5

                                                                              a85212f713fedfc9e36b5b9ba8d01d5b

                                                                              SHA1

                                                                              fc68236c306db25032f49d06e1ad03dae2c37b8a

                                                                              SHA256

                                                                              f218c780b0e5e1c5e9caf221c439d009ffbdcd2b1c16291ccb1f57859e712713

                                                                              SHA512

                                                                              a92e0bd22455e99a43a3737450f7978405b6ae9dc5b9d9f35d96cdec111e4297e5bf63d7e5313837873040ea6d024dffbda5740c426ecdc8f417d405692759c0

                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                              Filesize

                                                                              9KB

                                                                              MD5

                                                                              3951a7ccb3d4efdee5f0c160f841fd2c

                                                                              SHA1

                                                                              8ab121cc40b6344f490a1c8a27e6abcff78d6917

                                                                              SHA256

                                                                              425f9988d6940aaed2b5851d5214b1cef64d31c613fb28376bc21d35729b7142

                                                                              SHA512

                                                                              c5ff5c056b5648debabb98ea8269e6f178fada904cf7a4bf3ab3d891ce1d72d25fb69a78f5a735165dbac6c0f47e2f983895714931b6db39b1442832410d2189

                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                              Filesize

                                                                              10KB

                                                                              MD5

                                                                              7e1f06a9568fb8e5bb30b67b9505992e

                                                                              SHA1

                                                                              d880a1011b79def6e24c1604027836ab204942be

                                                                              SHA256

                                                                              2fcd8c75efae7e1f24e71450967cec3f8144c9e101ce8eb1dec18fd0408d4c5f

                                                                              SHA512

                                                                              bf3d051149380e41a2f405874db2fe128dcb18dea881d38ff124788816552c9ffa9b2de4e4d3ef6ffd21631fa5720d61424576d737c0feb4e68663db0910f0d7

                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                              Filesize

                                                                              9KB

                                                                              MD5

                                                                              75d20087ae10390893d79bc8459c61e7

                                                                              SHA1

                                                                              3b4511ec4996f50afaa4395d4c92d518415034e7

                                                                              SHA256

                                                                              6ef35d87f523925cbbba159f2e3c7332ec283b25f6f06b4a7230dae7d27cb41b

                                                                              SHA512

                                                                              72b0d1506b9d6686fa62ba2d03fb5e8d0d5a6271838ce2774994a46d89badcc9874875f04806706c6ac5670455586a002d6b83b9a7d24e1e2bd42eda8ba26a73

                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                              Filesize

                                                                              10KB

                                                                              MD5

                                                                              96fbff33ebdd28547c79b25449bacc3c

                                                                              SHA1

                                                                              381461c0634182a07ff8b0d8436ae3626f9c811d

                                                                              SHA256

                                                                              1d863e23573a369ccaaabc4a2a1b38792eedc820e2f4420cc86c43272a5a7d13

                                                                              SHA512

                                                                              7e0187b45fae1b83e10e9c25b21f6a46cd631105b2eaf20712dbfa4593ffa9f0570507b53b67d443c4f296a08dd2b2b29311fd209bd04e7ab1dd7b60c8eaa60e

                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                                                              Filesize

                                                                              15KB

                                                                              MD5

                                                                              274e58e97c65f00f0fce6b9f0e393437

                                                                              SHA1

                                                                              4affd7f549ddb2884ab68ee27af590ac0360bdf5

                                                                              SHA256

                                                                              17c2c8f2268c13de35b8431873ead63b34b4b425be0ea8c124a2abd32286702f

                                                                              SHA512

                                                                              8e480ff19f3578a81a95538c48fc121a0ebe2836a2ead3998cfe2bbbfcc0018b1af3a771d42dc6a6ee52a46c96c431c46301ee8305fea3a2d8cb851ddc613880

                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

                                                                              Filesize

                                                                              72B

                                                                              MD5

                                                                              aafaf68b8057225b9d3dae80f7ee6567

                                                                              SHA1

                                                                              37ff678fc9de7e1fb1d37065b6ba4e3f7427fb0e

                                                                              SHA256

                                                                              9121f1d9f8b4c5003bdd9f0c9d2cf2b42878fd90b93b14bc1ce7542022269a55

                                                                              SHA512

                                                                              df77d3585e0b2f45823c37efa2e3d0859eeafe85c679cb0af5ab59274fe8d19d827646af2f89e616a47aee9a437fab10f2a1f9a45e7004d5a91d55509b686ac6

                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                              Filesize

                                                                              246KB

                                                                              MD5

                                                                              368e3c7263fc58b9e0ca6076248c0871

                                                                              SHA1

                                                                              01a989f332400aa78d8fa36e9ef3310c2e992fc2

                                                                              SHA256

                                                                              3c311c2e58d4c1c7b071652aabb7a2e7eeeff41d18d4a1d9bfea29df975bfa82

                                                                              SHA512

                                                                              5da678a588f63870ed617c78f4baea3f47d612fce019624e49c05c0e018f5d702db53bca38ac91cb9bf7f6dfccff5d8247163ddd50746ba5957c38512c818899

                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                              Filesize

                                                                              246KB

                                                                              MD5

                                                                              255ffc859de7ed5585472e5e6efb2e9f

                                                                              SHA1

                                                                              8d64db2a66eb64f268c92f537a72a7981e428127

                                                                              SHA256

                                                                              a1ef99275f655d7e908cf7d7309984fbe56ff5dbda2a0c81942265aa9eba249f

                                                                              SHA512

                                                                              c57924d1ac63da6518a8a2d31b61113430c0a448d2882043ba1586ce8a989493590049d69d443ed09dbf0eae16682022f8e2d267e88598b236446c50010c2374

                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                              Filesize

                                                                              246KB

                                                                              MD5

                                                                              6280df50399614952aae1c1fce5c80b6

                                                                              SHA1

                                                                              e299b957632e2ea35efdb5ef376324c738924293

                                                                              SHA256

                                                                              2431b415dcce063706c813216fb02aab8c4b31270af90bbd28ecb440bb73315f

                                                                              SHA512

                                                                              e54ff1beb03a718627dfb479fb783722745a65c777947d4cb7a291a2105d458f66d01086ece2d8e9955596c705c35c783b1e92850f733996b02056a122b1d1a0

                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\aa9e4dfa-0700-4b3c-902d-4542735dde38.tmp

                                                                              Filesize

                                                                              246KB

                                                                              MD5

                                                                              4bd222f53aa216181bc1a84416d020eb

                                                                              SHA1

                                                                              3c6583c058739aa6d05cc14713ee62eca23d6645

                                                                              SHA256

                                                                              528f358892f8ac3ef640d49e7f74c04f4c0c69bb188e3bc0ae958fcecad1a26b

                                                                              SHA512

                                                                              49d8bdbf83ce09b75174aa726207caa12a0d213c497813b8d90ced2c3beb619eca1c65f000967499651c3789452ff2e44b39849cf007b2822e8a622df8f8e175

                                                                            • C:\Users\Admin\AppData\Local\Temp\WINDOWSUPDATE.EXE

                                                                              Filesize

                                                                              163KB

                                                                              MD5

                                                                              24e2f8699579dc971a255076c08e829f

                                                                              SHA1

                                                                              5b45b15f4993d3112083b73806415d5eb587b9ea

                                                                              SHA256

                                                                              2a05046af890c5c4daa47277ccf630ac99228709ee489bd5517ba019fd0f5750

                                                                              SHA512

                                                                              de76329069c601feb874159360a28e3106dca47c05b069cb4c1d25e80a6fe7a44e6fa756a83c9f4d7da0b1f27628e389aaa60e2db7ae29d5e6d47537acce4a84

                                                                            • C:\Users\Admin\AppData\Local\Temp\WINUPDTR.EXE

                                                                              Filesize

                                                                              340KB

                                                                              MD5

                                                                              55642a17d2b2f4a3b0622380cbd7a398

                                                                              SHA1

                                                                              54a6f1c9d6f207af5dcea9557b420fade8a30f82

                                                                              SHA256

                                                                              c8bb9bc16ff8cebc7ec50e94c4d6ee1c884c5bbe57c61b5dde520e953845fca0

                                                                              SHA512

                                                                              83084e5595f4e5e226f4a924100b8f9d9707b15966aa54956a0169b84c1e852b55f82280f8f9014ec78ece6e151078aa51c4ae2e841f23a44b9c060ad24d0948

                                                                            • C:\Users\Admin\AppData\Local\Temp\scoped_dir3624_36937649\CRX_INSTALL\_locales\en_CA\messages.json

                                                                              Filesize

                                                                              711B

                                                                              MD5

                                                                              558659936250e03cc14b60ebf648aa09

                                                                              SHA1

                                                                              32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825

                                                                              SHA256

                                                                              2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b

                                                                              SHA512

                                                                              1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

                                                                            • C:\Users\Admin\AppData\Local\Temp\scoped_dir3624_36937649\bb069b2a-4965-4e8d-a708-da60cf40ce5f.tmp

                                                                              Filesize

                                                                              150KB

                                                                              MD5

                                                                              eae462c55eba847a1a8b58e58976b253

                                                                              SHA1

                                                                              4d7c9d59d6ae64eb852bd60b48c161125c820673

                                                                              SHA256

                                                                              ebcda644bcfbd0c9300227bafde696e8923ddb004b4ee619d7873e8a12eae2ad

                                                                              SHA512

                                                                              494481a98ab6c83b16b4e8d287d85ba66499501545da45458acc395da89955971cf2a14e83c2da041c79c580714b92b9409aa14017a16d0b80a7ff3d91bad2a3

                                                                            • C:\Users\Admin\AppData\Roaming\chrtmp

                                                                              Filesize

                                                                              114KB

                                                                              MD5

                                                                              4dd07a122751ef8ccbfe3e08472eadb1

                                                                              SHA1

                                                                              f464e924e948caf5ec5017b2cc0418f603a9c79a

                                                                              SHA256

                                                                              8d44ab9149fb07384bdd677b529227726b608c726c57f1710f5c7f08f645bb54

                                                                              SHA512

                                                                              f7a067cb8f844c8b0924006500e18a13026f120c2a7c9e5ff21fc7c1af80d6a3b9f537e3cb9d7c7975a3bd96ee4ab29c2df2198e6abd7b4328fb75af07c58e9c

                                                                            • C:\Users\Admin\AppData\Roaming\winupdate.exe

                                                                              Filesize

                                                                              1.2MB

                                                                              MD5

                                                                              58ef8399e896e60b181961292fb6d666

                                                                              SHA1

                                                                              d5b651f75234877814d8efabb6256fbc23c662ed

                                                                              SHA256

                                                                              6deff5735317a9b7addf8d9f8d3aeca1de68364e63b69037b2c916bcaee44003

                                                                              SHA512

                                                                              b9c4059148ff6ff96b376b69450a5234b4de8684ef41173601c24140da62a2b623f4117f5f483be478c9542be676cd705511d9540689b247cd44215b8c2f7b37

                                                                            • C:\Users\Admin\Downloads\MBSetup.exe

                                                                              Filesize

                                                                              2.7MB

                                                                              MD5

                                                                              1e17ceff00f18d129b514bd6b01d9e85

                                                                              SHA1

                                                                              e2e5b38df2052b7ed3f95e3f0e2dabc079c64f29

                                                                              SHA256

                                                                              64517ef6dd936d54c2ef6a6edad5e018cef9facd71693b9a94dceca2847fce6a

                                                                              SHA512

                                                                              73ace5997c333a8c9d0279a77f51e335a724c39d7bd450b4aab9b162bd5eccc4d457536abab663ce539046e91e6e57a04814426c416418d077ef8320ad672b2d

                                                                            • C:\Windows\System32\CatRoot2\dberr.txt

                                                                              Filesize

                                                                              37KB

                                                                              MD5

                                                                              d9fec63641c7580193b24837efcd950b

                                                                              SHA1

                                                                              598b8653a5e6b3131ac3156163953b84d788a6ab

                                                                              SHA256

                                                                              d38a97cc6d7ab337b6091c39fec8c08b3554d131ed4e8595a1ad4dfc1056d301

                                                                              SHA512

                                                                              731ffb01c01a16fa9c1f2f453a56adad35c016487a8efac6dae97e3af22aa78e098ce2de273c79063894d19392956ae35f20ac15ad37305578b982e8617ddbd3

                                                                            • C:\Windows\System32\catroot2\dberr.txt

                                                                              Filesize

                                                                              37KB

                                                                              MD5

                                                                              5c235b6e593f2632b45d8885b459dc71

                                                                              SHA1

                                                                              15c7ef21ff5f55c7d4666097e13bcc15a28ec4b1

                                                                              SHA256

                                                                              5393f7db340e0a4110ddfcbccece3e26098ee6ae745b6f03b91193e007cda735

                                                                              SHA512

                                                                              73d6b94bf96e9099cf99c53c6958a8b5639a0ae5065b4bcd171c949b66679e9fe10555759aef296caa0dd9956d5432626ea2d9843a15e2c9413a0dd1a66cc51c

                                                                            • C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAEBE581FCB73249406FC21094EA252E_BC0CE803EF41A748738619ED7838EEFC

                                                                              Filesize

                                                                              5B

                                                                              MD5

                                                                              5bfa51f3a417b98e7443eca90fc94703

                                                                              SHA1

                                                                              8c015d80b8a23f780bdd215dc842b0f5551f63bd

                                                                              SHA256

                                                                              bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128

                                                                              SHA512

                                                                              4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399

                                                                            • C:\Windows\System32\drivers\mbam.sys

                                                                              Filesize

                                                                              78KB

                                                                              MD5

                                                                              8b5756ca12a24cf1529c40898ee06d67

                                                                              SHA1

                                                                              8da4e28e0e75f42dcae536b4280deef4202a6990

                                                                              SHA256

                                                                              41b9dd1d972b84b01d6f8ff06c83437b0c59a8a7d3e230867d1d3eed4fd93072

                                                                              SHA512

                                                                              91cba900cd92af2299bfec36ce582c04250fbd535f43a31af222bd00613c8cc2d05898a45b8d86355bfcae61d9a0b82c943cd98f6745a7cbca681cdf23a70a5b

                                                                            • C:\Windows\Temp\MBInstallTempa0f0d97dfb8c11efa3a3d6a26ba1faea\7z.dll

                                                                              Filesize

                                                                              1.6MB

                                                                              MD5

                                                                              3430e2544637cebf8ba1f509ed5a27b1

                                                                              SHA1

                                                                              7e5bd7af223436081601413fb501b8bd20b67a1e

                                                                              SHA256

                                                                              bb01c6fbb29590d6d144a9038c2a7736d6925a6dbd31889538af033e03e4f5fa

                                                                              SHA512

                                                                              91c4eb3d341a8b30594ee4c08a638c3fb7f3a05248b459bcf07ca9f4c2a185959313a68741bdcec1d76014009875fa7cbfa47217fb45d57df3b9b1c580bc889d

                                                                            • C:\Windows\Temp\MBInstallTempa0f0d97dfb8c11efa3a3d6a26ba1faea\ctlrpkg\Malwarebytes_Assistant.runtimeconfig.json

                                                                              Filesize

                                                                              372B

                                                                              MD5

                                                                              d94cf983fba9ab1bb8a6cb3ad4a48f50

                                                                              SHA1

                                                                              04855d8b7a76b7ec74633043ef9986d4500ca63c

                                                                              SHA256

                                                                              1eca0f0c70070aa83bb609e4b749b26dcb4409784326032726394722224a098a

                                                                              SHA512

                                                                              09a9667d4f4622817116c8bc27d3d481d5d160380a2e19b8944bdd1271a83f718415ce5e6d66e82e36819e575ec1b55f19c45213e0013b877b8d61e6feb9d998

                                                                            • C:\Windows\Temp\MBInstallTempa0f0d97dfb8c11efa3a3d6a26ba1faea\ctlrpkg\mbae64.sys

                                                                              Filesize

                                                                              154KB

                                                                              MD5

                                                                              95515708f41a7e283d6725506f56f6f2

                                                                              SHA1

                                                                              9afc20a19db3d2a75b6915d8d9af602c5218735e

                                                                              SHA256

                                                                              321058a27d7462e55e39d253ad5d8b19a9acf754666400f82fe0542f33e733c6

                                                                              SHA512

                                                                              d9230901adeecb13b1f92287abe9317cdac458348885b96ef6500960793a7586c76ae374df053be948a35b44abe934aa853975a6ccd3788f93909903cc718c08

                                                                            • C:\Windows\Temp\MBInstallTempa0f0d97dfb8c11efa3a3d6a26ba1faea\dbclspkg\MBAMCoreV5.dll

                                                                              Filesize

                                                                              6.4MB

                                                                              MD5

                                                                              83f7a43943bfebfdd1064e48c568c1aa

                                                                              SHA1

                                                                              538fca78e3eaa569967b2b5ea4f43f2e4219f7cb

                                                                              SHA256

                                                                              b0b7780651f7d06eaa5a236f7a11d95c4035e87ca4e0d7e442c9aa32a45584aa

                                                                              SHA512

                                                                              511a41484cccdeab4334dcc75018d6bcae39d81fc3394ab543da13c62a595fabb8e21c32e81757ee8dfffd096e089d27459c0ff54ff2bb4ea6de23671fba3d5c

                                                                            • C:\Windows\Temp\MBInstallTempa0f0d97dfb8c11efa3a3d6a26ba1faea\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.36\mscordaccore.dll

                                                                              Filesize

                                                                              1.3MB

                                                                              MD5

                                                                              3050af9152d6bb255c4b6753821bc32c

                                                                              SHA1

                                                                              7a20c030a6473422607661ffa996e34a245b3e2d

                                                                              SHA256

                                                                              97468531d7009e36c338b47fb19e0c6bf210f013610f413c852a4cc27e84b514

                                                                              SHA512

                                                                              ad07c4b0bb995e80a1718d74992afdeb6c2c4f217e72f361691e2d04dae9be9cd8e55b50fd7172d73755b02b6105c00a3b67534ba9469d92f9e0fbaab8e8f1a9

                                                                            • C:\Windows\Temp\MBInstallTempa0f0d97dfb8c11efa3a3d6a26ba1faea\servicepkg\MBAMService.exe

                                                                              Filesize

                                                                              9.0MB

                                                                              MD5

                                                                              2ad48a7f9211bf407521e8fd571898f8

                                                                              SHA1

                                                                              f9192adb5127e1e8c95f0f976509b7646e42e32f

                                                                              SHA256

                                                                              81642eb2c8741c221b541521cf59686575d8fba12933590e03531fa6f923ba2f

                                                                              SHA512

                                                                              48534464022eee44c6143e08d5734fdde9eb6c916e860b86bf62686d6c29139e456dbcd27e73413d6b2fd0c284acf0a4373be42d054b0a92b25512856b1545ed

                                                                            • C:\Windows\Temp\MBInstallTempa0f0d97dfb8c11efa3a3d6a26ba1faea\servicepkg\mbamelam.cat

                                                                              Filesize

                                                                              11KB

                                                                              MD5

                                                                              bd4ceae54af081d6b1dd91ff584c5d61

                                                                              SHA1

                                                                              5ade462d66e042da58bb1447d1b31f1aad901b68

                                                                              SHA256

                                                                              64416d564725416c6869ea951878a2734b1f6940b11f7961a897c45f0d8c6625

                                                                              SHA512

                                                                              37e7abd312f694ee2c8ea54ecf50ed12c16684f1007c61d9a6d1d01cba958be511c5e4e11cd7393a5cd57349fda1c552bebca42962137e0d11695c195761ebb0

                                                                            • C:\Windows\Temp\MBInstallTempa0f0d97dfb8c11efa3a3d6a26ba1faea\servicepkg\mbamelam.inf

                                                                              Filesize

                                                                              2KB

                                                                              MD5

                                                                              5d8c05cc4f9b4304d57ea10b87f2dcf0

                                                                              SHA1

                                                                              2cabe3d39aa5ec16c54c7818284a2ee235d2ddbd

                                                                              SHA256

                                                                              e26c2d3347e5f077da92713c9df3cd3eae438fb7e29810bd5c3afe567d2d3125

                                                                              SHA512

                                                                              55bff23fee9852f229246b71721b3659c916079787935d400a97641449dfda752fc8fbf36f9ea3dc4028f05daeb9006a99660284a61aa5d5a466af0ee966c738

                                                                            • C:\Windows\Temp\MBInstallTempa0f0d97dfb8c11efa3a3d6a26ba1faea\servicepkg\mbamelam.sys

                                                                              Filesize

                                                                              21KB

                                                                              MD5

                                                                              8da81aa1f6b89ce1d2e216e3ea351c59

                                                                              SHA1

                                                                              4baf79cbade9a5584630a540e6368d547579fb12

                                                                              SHA256

                                                                              ded569e249e590314d095f740c6b8934a5a797e4f3edbe0f78eac9d333f12a2a

                                                                              SHA512

                                                                              6d611bbd9d480ef2defd745fd06c4ab86e181267cf689d9d0e124edbaf22fd30fbe2310879cc7bb6dde5bae72c4feea1d329cdecfbf101d95634f85dd0769119

                                                                            • memory/1776-105-0x0000000000400000-0x0000000000474000-memory.dmp

                                                                              Filesize

                                                                              464KB

                                                                            • memory/1776-117-0x0000000000400000-0x0000000000474000-memory.dmp

                                                                              Filesize

                                                                              464KB

                                                                            • memory/2852-120-0x0000000000400000-0x0000000000536000-memory.dmp

                                                                              Filesize

                                                                              1.2MB

                                                                            • memory/2852-5243-0x0000000000400000-0x0000000000536000-memory.dmp

                                                                              Filesize

                                                                              1.2MB

                                                                            • memory/2852-5565-0x0000000000400000-0x0000000000536000-memory.dmp

                                                                              Filesize

                                                                              1.2MB

                                                                            • memory/2852-5127-0x0000000000400000-0x0000000000536000-memory.dmp

                                                                              Filesize

                                                                              1.2MB

                                                                            • memory/2852-828-0x0000000000400000-0x0000000000536000-memory.dmp

                                                                              Filesize

                                                                              1.2MB

                                                                            • memory/2852-3698-0x0000000000400000-0x0000000000536000-memory.dmp

                                                                              Filesize

                                                                              1.2MB

                                                                            • memory/2852-167-0x0000000000400000-0x0000000000536000-memory.dmp

                                                                              Filesize

                                                                              1.2MB

                                                                            • memory/2852-5494-0x0000000000400000-0x0000000000536000-memory.dmp

                                                                              Filesize

                                                                              1.2MB

                                                                            • memory/2852-1030-0x0000000000400000-0x0000000000536000-memory.dmp

                                                                              Filesize

                                                                              1.2MB

                                                                            • memory/2852-618-0x0000000000400000-0x0000000000536000-memory.dmp

                                                                              Filesize

                                                                              1.2MB

                                                                            • memory/2852-4064-0x0000000000400000-0x0000000000536000-memory.dmp

                                                                              Filesize

                                                                              1.2MB

                                                                            • memory/2852-5223-0x0000000000400000-0x0000000000536000-memory.dmp

                                                                              Filesize

                                                                              1.2MB

                                                                            • memory/2852-5363-0x0000000000400000-0x0000000000536000-memory.dmp

                                                                              Filesize

                                                                              1.2MB

                                                                            • memory/2852-97-0x0000000000400000-0x0000000000536000-memory.dmp

                                                                              Filesize

                                                                              1.2MB

                                                                            • memory/2852-98-0x0000000000400000-0x0000000000536000-memory.dmp

                                                                              Filesize

                                                                              1.2MB

                                                                            • memory/2852-99-0x0000000000400000-0x0000000000536000-memory.dmp

                                                                              Filesize

                                                                              1.2MB

                                                                            • memory/2852-794-0x0000000000400000-0x0000000000536000-memory.dmp

                                                                              Filesize

                                                                              1.2MB

                                                                            • memory/2852-118-0x0000000000400000-0x0000000000536000-memory.dmp

                                                                              Filesize

                                                                              1.2MB

                                                                            • memory/2852-5419-0x0000000000400000-0x0000000000536000-memory.dmp

                                                                              Filesize

                                                                              1.2MB

                                                                            • memory/2852-100-0x0000000000400000-0x0000000000536000-memory.dmp

                                                                              Filesize

                                                                              1.2MB

                                                                            • memory/2852-5308-0x0000000000400000-0x0000000000536000-memory.dmp

                                                                              Filesize

                                                                              1.2MB

                                                                            • memory/2852-119-0x0000000000400000-0x0000000000536000-memory.dmp

                                                                              Filesize

                                                                              1.2MB

                                                                            • memory/2852-759-0x0000000000400000-0x0000000000536000-memory.dmp

                                                                              Filesize

                                                                              1.2MB

                                                                            • memory/3200-2-0x0000000000400000-0x0000000000536000-memory.dmp

                                                                              Filesize

                                                                              1.2MB

                                                                            • memory/3200-4-0x0000000000400000-0x0000000000536000-memory.dmp

                                                                              Filesize

                                                                              1.2MB

                                                                            • memory/3200-90-0x0000000000400000-0x0000000000536000-memory.dmp

                                                                              Filesize

                                                                              1.2MB

                                                                            • memory/3200-3-0x0000000002410000-0x0000000002411000-memory.dmp

                                                                              Filesize

                                                                              4KB

                                                                            • memory/3200-0-0x0000000000400000-0x0000000000536000-memory.dmp

                                                                              Filesize

                                                                              1.2MB

                                                                            • memory/3200-1-0x0000000000400000-0x0000000000536000-memory.dmp

                                                                              Filesize

                                                                              1.2MB

                                                                            • memory/4660-136-0x0000000000400000-0x0000000000474000-memory.dmp

                                                                              Filesize

                                                                              464KB

                                                                            • memory/4660-5517-0x0000000000400000-0x0000000000474000-memory.dmp

                                                                              Filesize

                                                                              464KB

                                                                            • memory/4660-588-0x0000000000400000-0x0000000000474000-memory.dmp

                                                                              Filesize

                                                                              464KB

                                                                            • memory/4660-5273-0x0000000000400000-0x0000000000474000-memory.dmp

                                                                              Filesize

                                                                              464KB

                                                                            • memory/4660-137-0x0000000000400000-0x0000000000474000-memory.dmp

                                                                              Filesize

                                                                              464KB

                                                                            • memory/4660-5226-0x0000000000400000-0x0000000000474000-memory.dmp

                                                                              Filesize

                                                                              464KB

                                                                            • memory/4660-736-0x0000000000400000-0x0000000000474000-memory.dmp

                                                                              Filesize

                                                                              464KB

                                                                            • memory/4660-4034-0x0000000000400000-0x0000000000474000-memory.dmp

                                                                              Filesize

                                                                              464KB

                                                                            • memory/4660-21-0x0000000000400000-0x0000000000474000-memory.dmp

                                                                              Filesize

                                                                              464KB

                                                                            • memory/4660-5190-0x0000000000400000-0x0000000000474000-memory.dmp

                                                                              Filesize

                                                                              464KB

                                                                            • memory/4660-791-0x0000000000400000-0x0000000000474000-memory.dmp

                                                                              Filesize

                                                                              464KB

                                                                            • memory/4660-5486-0x0000000000400000-0x0000000000474000-memory.dmp

                                                                              Filesize

                                                                              464KB

                                                                            • memory/4660-3600-0x0000000000400000-0x0000000000474000-memory.dmp

                                                                              Filesize

                                                                              464KB

                                                                            • memory/4660-5104-0x0000000000400000-0x0000000000474000-memory.dmp

                                                                              Filesize

                                                                              464KB

                                                                            • memory/4660-1012-0x0000000000400000-0x0000000000474000-memory.dmp

                                                                              Filesize

                                                                              464KB

                                                                            • memory/4660-824-0x0000000000400000-0x0000000000474000-memory.dmp

                                                                              Filesize

                                                                              464KB

                                                                            • memory/4660-5360-0x0000000000400000-0x0000000000474000-memory.dmp

                                                                              Filesize

                                                                              464KB

                                                                            • memory/5712-4169-0x0000026E8E980000-0x0000026E8EE80000-memory.dmp

                                                                              Filesize

                                                                              5.0MB

                                                                            • memory/5712-5516-0x0000026E8E980000-0x0000026E8EE80000-memory.dmp

                                                                              Filesize

                                                                              5.0MB

                                                                            • memory/5712-5158-0x0000026E8E980000-0x0000026E8EE80000-memory.dmp

                                                                              Filesize

                                                                              5.0MB

                                                                            • memory/5712-5464-0x0000026E8E980000-0x0000026E8EE80000-memory.dmp

                                                                              Filesize

                                                                              5.0MB

                                                                            • memory/5712-5224-0x0000026E8E980000-0x0000026E8EE80000-memory.dmp

                                                                              Filesize

                                                                              5.0MB

                                                                            • memory/5712-5329-0x0000026E8E980000-0x0000026E8EE80000-memory.dmp

                                                                              Filesize

                                                                              5.0MB

                                                                            • memory/5712-5623-0x0000026E8E980000-0x0000026E8EE80000-memory.dmp

                                                                              Filesize

                                                                              5.0MB