Malware Analysis Report

2025-06-15 20:09

Sample ID 250605-sg43cazmv9
Target 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit
SHA256 7855bee142c5abc5a3aa7f58a6a43cfb85df05d94fbb3a07bfe83cb73cf81281
Tags
lockbit credential_access defense_evasion discovery persistence privilege_escalation ransomware spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V16

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

7855bee142c5abc5a3aa7f58a6a43cfb85df05d94fbb3a07bfe83cb73cf81281

Threat Level: Known bad

The file 2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit was found to be: Known bad.

Malicious Activity Summary

lockbit credential_access defense_evasion discovery persistence privilege_escalation ransomware spyware stealer trojan

Suspicious use of NtCreateUserProcessOtherParentProcess

Lockbit family

Rule to detect Lockbit 3.0 ransomware Windows payload

Renames multiple (535) files with added filename extension

Drops file in Drivers directory

Patched UPX-packed file

Downloads MZ/PE file

Modifies RDP port number used by Windows

Sets service image path in registry

Impair Defenses: Safe Mode Boot

Credentials from Password Stores: Windows Credential Manager

Event Triggered Execution: Component Object Model Hijacking

Executes dropped EXE

Loads dropped DLL

Checks BIOS information in registry

Reads user/profile data of web browsers

Deletes itself

Indicator Removal: File Deletion

Drops desktop.ini file(s)

Checks installed software on the system

Enumerates connected drives

Checks whether UAC is enabled

Suspicious use of NtSetInformationThreadHideFromDebugger

Drops file in System32 directory

Sets desktop wallpaper using registry

Drops file in Windows directory

Subvert Trust Controls: Mark-of-the-Web Bypass

Drops file in Program Files directory

Unsigned PE

Browser Information Discovery

System Location Discovery: System Language Discovery

System Network Configuration Discovery: Internet Connection Discovery

Enumerates physical storage devices

Suspicious use of FindShellTrayWindow

Modifies data under HKEY_USERS

Uses Volume Shadow Copy WMI provider

Uses Task Scheduler COM API

Modifies registry key

Modifies Control Panel

Modifies Internet Explorer settings

Checks SCSI registry key(s)

Runs ping.exe

Suspicious behavior: LoadsDriver

Suspicious use of SetWindowsHookEx

Opens file in notepad (likely ransom note)

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Enumerates system info in registry

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Checks processor information in registry

Modifies system certificate store

NTFS ADS

Uses Volume Shadow Copy service COM API

Suspicious behavior: RenamesItself

Suspicious behavior: AddClipboardFormatListener

Suspicious use of AdjustPrivilegeToken

Modifies registry class

Suspicious use of SendNotifyMessage

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-06-05 15:06

Signatures

Lockbit family

lockbit

Rule to detect Lockbit 3.0 ransomware Windows payload

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-06-05 15:06

Reported

2025-06-05 15:17

Platform

win11-20250502-en

Max time kernel

347s

Max time network

622s

Command Line

C:\Windows\Explorer.EXE

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 4948 created 3324 N/A C:\Users\Admin\Downloads\MBSetup.exe C:\Windows\Explorer.EXE

Renames multiple (535) files with added filename extension

ransomware

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\drivers\farflt11.sys C:\Windows\system32\DrvInst.exe N/A
File created C:\Windows\System32\drivers\SETD406.tmp C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\System32\drivers\SETF096.tmp C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\System32\drivers\farflt11.sys C:\Windows\system32\DrvInst.exe N/A
File created C:\Windows\system32\drivers\mbae64.sys C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Windows\system32\DRIVERS\mbamswissarmy.sys C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File opened for modification C:\Windows\System32\drivers\SETD406.tmp C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\System32\drivers\farflt11.sys C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\System32\drivers\SETE28C.tmp C:\Windows\system32\DrvInst.exe N/A
File created C:\Windows\System32\drivers\SETE28C.tmp C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\System32\drivers\SETF171.tmp C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\System32\drivers\farflt11.sys C:\Windows\system32\DrvInst.exe N/A
File created C:\Windows\SysWOW64\drivers\mbamtestfile.dat C:\Users\Admin\Downloads\MBSetup.exe N/A
File created C:\Windows\system32\DRIVERS\MbamElam.sys C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File opened for modification C:\Windows\System32\drivers\SETD28F.tmp C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\System32\drivers\farflt11.sys C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\System32\drivers\SETE1D1.tmp C:\Windows\system32\DrvInst.exe N/A
File created C:\Windows\System32\drivers\SETE1D1.tmp C:\Windows\system32\DrvInst.exe N/A
File created C:\Windows\System32\drivers\SETF171.tmp C:\Windows\system32\DrvInst.exe N/A
File created C:\Windows\system32\DRIVERS\mbam.sys C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File opened for modification C:\Windows\system32\DRIVERS\MbamElam.sys C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File created C:\Windows\system32\DRIVERS\MbamChameleon.sys C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File created C:\Windows\system32\DRIVERS\mwac.sys C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File created C:\Windows\System32\drivers\SETD28F.tmp C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\System32\drivers\farflt11.sys C:\Windows\system32\DrvInst.exe N/A
File created C:\Windows\System32\drivers\SETF096.tmp C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\SysWOW64\drivers\mbamtestfile.dat C:\Users\Admin\Downloads\MBSetup.exe N/A

Modifies RDP port number used by Windows

Patched UPX-packed file

Description Indicator Process Target
N/A N/A N/A N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MBAMSwissArmy\ImagePath = "\\SystemRoot\\System32\\Drivers\\mbamswissarmy.sys" C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mbamchameleon\ImagePath = "\\SystemRoot\\System32\\Drivers\\MbamChameleon.sys" C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MBAMFarflt\ImagePath = "\\SystemRoot\\System32\\Drivers\\farflt11.sys" C:\Windows\system32\DrvInst.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MBAMFarflt\ImagePath = "\\SystemRoot\\System32\\Drivers\\farflt11.sys" C:\Windows\system32\DrvInst.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MBAMFarflt\ImagePath = "\\SystemRoot\\System32\\Drivers\\farflt11.sys" C:\Windows\system32\DrvInst.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MBAMFarflt\ImagePath = "\\SystemRoot\\System32\\Drivers\\farflt11.sys" C:\Windows\system32\DrvInst.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MBAMFarflt\ImagePath = "\\SystemRoot\\System32\\Drivers\\farflt11.sys" C:\Windows\system32\DrvInst.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MBAMFarflt\ImagePath = "\\SystemRoot\\System32\\Drivers\\farflt11.sys" C:\Windows\system32\DrvInst.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MBAMProtection\ImagePath = "\\SystemRoot\\System32\\Drivers\\mbam.sys" C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\updatrpkg\mbupdatrV5.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\updatrpkg\mbupdatrV5.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\Downloads\MBSetup.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\Downloads\MBSetup.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A

Credentials from Password Stores: Windows Credential Manager

credential_access stealer

Deletes itself

Description Indicator Process Target
N/A N/A C:\ProgramData\ABC2.tmp N/A

Event Triggered Execution: Component Object Model Hijacking

persistence privilege_escalation

Impair Defenses: Safe Mode Boot

defense_evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\MBAMService C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\MBAMService\ = "Service" C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A

Reads user/profile data of web browsers

spyware stealer

Checks installed software on the system

discovery

Checks whether UAC is enabled

defense_evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$Recycle.Bin\S-1-5-21-2329104403-2882594830-3136665766-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2329104403-2882594830-3136665766-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\B: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File opened (read-only) \??\P: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File opened (read-only) \??\S: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File opened (read-only) \??\A: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File opened (read-only) \??\M: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File opened (read-only) \??\U: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File opened (read-only) \??\A: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File opened (read-only) \??\B: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File opened (read-only) \??\K: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File opened (read-only) \??\M: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File opened (read-only) \??\S: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File opened (read-only) \??\T: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File opened (read-only) \??\N: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File opened (read-only) \??\T: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File opened (read-only) \??\E: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File opened (read-only) \??\L: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File opened (read-only) \??\N: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File opened (read-only) \??\Q: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File opened (read-only) \??\W: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File opened (read-only) \??\Y: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File opened (read-only) \??\E: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File opened (read-only) \??\J: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File opened (read-only) \??\H: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File opened (read-only) \??\I: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File opened (read-only) \??\R: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File opened (read-only) \??\H: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File opened (read-only) \??\K: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File opened (read-only) \??\Q: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File opened (read-only) \??\V: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File opened (read-only) \??\W: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File opened (read-only) \??\G: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File opened (read-only) \??\O: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File opened (read-only) \??\R: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File opened (read-only) \??\X: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File opened (read-only) \??\Y: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File opened (read-only) \??\V: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File opened (read-only) \??\P: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File opened (read-only) \??\G: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File opened (read-only) \??\O: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File opened (read-only) \??\L: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File opened (read-only) \??\Z: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File opened (read-only) \??\U: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File opened (read-only) \??\X: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File opened (read-only) \??\Z: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File opened (read-only) \??\I: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File opened (read-only) \??\J: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A

Indicator Removal: File Deletion

defense_evasion

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\System32\DriverStore\FileRepository\net7800-x64-n650f.inf_amd64_178f1bdb49a6e2fd\net7800-x64-n650f.PNF C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe N/A
File opened for modification C:\Windows\System32\DriverStore\Temp\{1706c01e-2d40-5748-880d-61be80bf58e9}\farflt11.inf C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\59194E40068A745EF528E8E18DD529F2 C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File created C:\Windows\system32\config\systemprofile\AppData\Local\Malwarebytes\Logs\MBAMSI.alt1.lock C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Malwarebytes\Logs\MBAMSI.alt1.log C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File created C:\Windows\system32\spool\PRINTERS\PP4doo5fbpolxp1iu6cwygav0yc.TMP C:\Windows\system32\printfilterpipelinesvc.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\netrtwlans.inf_amd64_97cd1a72c2a7829c\netrtwlans.PNF C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\net7400-x64-n650.inf_amd64_557ce3b37c3e0e3b\net7400-x64-n650.PNF C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DABA17F5E36CBE65640DD2FE24F104E7 C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\netwtw10.inf_amd64_3b49c2812809f919\netwtw10.PNF C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\netwbw02.inf_amd64_1c4077fa004e73b4\netwbw02.PNF C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\rtwlanu_oldic.inf_amd64_1a82423cc076e882\rtwlanu_oldic.PNF C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\netmlx4eth63.inf_amd64_3809a4a3e7e07703\netmlx4eth63.PNF C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe N/A
File opened for modification C:\Windows\System32\DriverStore\Temp\{80cf33fd-43df-3d49-9558-a4215978498e}\SETA11F.tmp C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\farflt11.inf_amd64_a08c83c14d71bb76\farflt11.inf C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\farflt11.inf_amd64_a08c83c14d71bb76\farflt11.cat C:\Windows\system32\DrvInst.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\netmyk64.inf_amd64_1f949c30555f4111\netmyk64.PNF C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\mbtun.inf_amd64_add82795013a7c3b\mbtun.cat C:\Windows\system32\DrvInst.exe N/A
File created C:\Windows\System32\DriverStore\Temp\{182482ba-2e02-3542-8eeb-536c77530043}\SETE115.tmp C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\System32\fastprox.pdb C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\wceisvista.inf_amd64_3aa3e69e968123a7\wceisvista.PNF C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\netr7364.inf_amd64_310ee0bc0af86ba3\netr7364.PNF C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe N/A
File opened for modification C:\Windows\System32\DriverStore\Temp\{1706c01e-2d40-5748-880d-61be80bf58e9}\SETEF30.tmp C:\Windows\system32\DrvInst.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\netrtwlanu.inf_amd64_1815bafd14dc59f0\netrtwlanu.PNF C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe N/A
File created C:\Windows\System32\DriverStore\Temp\{3798512a-026b-044f-897c-efd19b0540cc}\SETD212.tmp C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\System32\DriverStore\Temp\{3798512a-026b-044f-897c-efd19b0540cc}\farflt11.cat C:\Windows\system32\DrvInst.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\nett4x64.inf_amd64_54eacac1858c78ab\nett4x64.PNF C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\kdnic.inf_amd64_49825a4c00258135\kdnic.PNF C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\farflt11.inf_amd64_a08c83c14d71bb76\farflt11.cat C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\System32\DriverStore\Temp\{1706c01e-2d40-5748-880d-61be80bf58e9}\SETEF2F.tmp C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_CF33567922C393BFB92DE8105C392BE5 C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_6E4F36431D86962EFD432400DF65AC90 C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\netbxnda.inf_amd64_badb18141de40629\netbxnda.PNF C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\netrndis.inf_amd64_bccd4c0a924862b1\netrndis.PNF C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\netsstpa.inf_amd64_8a3d09c4ce3bae33\netsstpa.PNF C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BD96F9183ADE69B6DF458457F594566C_9CEAFBC27D33B97DD28C7AC883265891 C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File opened for modification C:\Windows\System32\CatRoot2\dberr.txt C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\farflt11.inf_amd64_a08c83c14d71bb76\farflt11.sys C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8DFDF057024880D7A081AFBF6D26B92F C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\net8192su64.inf_amd64_66c8bfc7a4b1feed\net8192su64.PNF C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mrvlpcie8897.inf_amd64_07fc330c5a5730ca\mrvlpcie8897.PNF C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\netvwifimp.inf_amd64_bfb9fd6f3a078899\netvwifimp.PNF C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\netv1x64.inf_amd64_30040c3eb9d7ade4\netv1x64.PNF C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\netwtw04.inf_amd64_c8f5ae6576289a2d\netwtw04.PNF C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\net8187bv64.inf_amd64_bc859d32f3e2f0d5\net8187bv64.PNF C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\netimm.inf_amd64_8b2087393aaef952\netimm.PNF C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\86844F70250DD8EF225D6B4178798C21_ACC1A26A3F5A815A00C8D5589432921F C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File opened for modification C:\Windows\System32\DriverStore\Temp\{3798512a-026b-044f-897c-efd19b0540cc}\SETD214.tmp C:\Windows\system32\DrvInst.exe N/A
File created C:\Windows\System32\DriverStore\Temp\{182482ba-2e02-3542-8eeb-536c77530043}\SETE126.tmp C:\Windows\system32\DrvInst.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\net9500-x64-n650f.inf_amd64_e92c5a65e41993f9\net9500-x64-n650f.PNF C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\e2xw10x64.inf_amd64_04c2ae40613a06ff\e2xw10x64.PNF C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\netbc63a.inf_amd64_7ba6c9cea77dd549\netbc63a.PNF C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe N/A
File opened for modification C:\Windows\System32\DriverStore\Temp\{3798512a-026b-044f-897c-efd19b0540cc}\farflt11.sys C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\farflt11.inf_amd64_a08c83c14d71bb76\farflt11.inf C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7D266D9E1E69FA1EEFB9699B009B34C8_1D5A876A9113EC07224C45E5A870E3BD C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\bcmdhd64.inf_amd64_e0bae6831f60ea5f\bcmdhd64.PNF C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\netjme.inf_amd64_752bf22f1598bb7e\netjme.PNF C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe N/A
File created C:\Windows\System32\DriverStore\drvstore.tmp C:\Windows\system32\DrvInst.exe N/A
File created C:\Windows\System32\DriverStore\Temp\{3798512a-026b-044f-897c-efd19b0540cc}\SETD214.tmp C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\farflt11.inf_amd64_a08c83c14d71bb76\farflt11.sys C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141 C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\netax88179_178a.inf_amd64_a8bb8a6e92764769\netax88179_178a.PNF C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\net8185.inf_amd64_7a30f5a9441cd55b\net8185.PNF C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\g0Bwcr1Ri.bmp" C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\g0Bwcr1Ri.bmp" C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Malwarebytes\Anti-Malware\mbamelam.sys C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\MbamUI.Data.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\Serilog.Extensions.Logging.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\assistant.runtimeconfig.json C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.IO.Compression.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\it\ReachFramework.resources.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\Microsoft.WindowsDesktop.App.deps.json C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\pt-BR\System.Xaml.resources.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\SQLitePCLRaw.provider.e_sqlite3.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\Prism.DryIoc.Wpf.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.IO.FileSystem.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.Private.Xml.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.ValueTuple.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\fr\PresentationUI.resources.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\System.Windows.Extensions.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\Microsoft.Extensions.DependencyInjection.Abstractions.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\sdk\farflt11.tmf C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.Xml.XDocument.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\es\ReachFramework.resources.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\wpfgfx_cor3.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.UI.Theme.Dark.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.Formats.Asn1.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\zh-Hans\System.Windows.Forms.Design.resources.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\zh-Hans\System.Windows.Forms.Primitives.resources.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\es\WindowsFormsIntegration.resources.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\pt-BR\UIAutomationTypes.resources.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\System.IO.Packaging.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\sdk\mwac.inf C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.Resources.Reader.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\de\UIAutomationClient.resources.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\de\WindowsBase.resources.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\pt-BR\PresentationCore.resources.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\ja\System.Windows.Controls.Ribbon.resources.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File opened for modification C:\Program Files\Malwarebytes\Anti-Malware\mbuns.exe C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\mscordbi.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\System.Diagnostics.PerformanceCounter.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\System.Drawing.Common.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\DryIoc.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\api-ms-win-crt-runtime-l1-1-0.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\api-ms-win-crt-stdio-l1-1-0.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\de\System.Windows.Input.Manipulations.resources.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\es\System.Windows.Input.Manipulations.resources.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\QRCoder.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.Diagnostics.StackTrace.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.IO.MemoryMappedFiles.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\ru\System.Windows.Controls.Ribbon.resources.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\System.Printing.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\tr\System.Windows.Forms.Primitives.resources.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\tr\System.Windows.Input.Manipulations.resources.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\mbae-api-na.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\sdk\farflt11.sys C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\mbuns.exe\:Zone.Identifier:$DATA C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.Net.WebSockets.Client.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.Security.Cryptography.Algorithms.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.Xml.ReaderWriter.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\ru\System.Windows.Forms.Design.resources.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\CleanControllerImpl.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\RTPControllerImpl.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\Microsoft.Extensions.DependencyInjection.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\d5830726-6a92-4a21-95b8-a2dbec4b90e9 C:\Users\Admin\Downloads\MBSetup.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.Net.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.Runtime.Intrinsics.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\SecurityProductInformation.ini C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\inf\oem3.inf C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\security\logs\scecomp.log C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\inf\oem4.pnf C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\inf\oem4.pnf C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\INF\setupapi.dev.log C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\SystemTemp C:\Program Files\Google\Chrome\Application\chrome.exe N/A
File opened for modification C:\Windows\SystemTemp C:\Program Files\Google\Chrome\Application\chrome.exe N/A
File opened for modification C:\Windows\inf\oem4.inf C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\INF\setupapi.dev.log C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\security\logs\scecomp.log C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\INF\setupapi.dev.log C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\INF\setupapi.dev.log C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\inf\oem4.inf C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\INF\setupapi.dev.log C:\Windows\system32\DrvInst.exe N/A
File created C:\Windows\inf\oem3.inf C:\Windows\system32\DrvInst.exe N/A
File created C:\Windows\inf\oem4.inf C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\inf\oem4.inf C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\inf\oem4.pnf C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\INF\setupapi.dev.log C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\INF\setupapi.dev.log C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\INF\setupapi.dev.log C:\Windows\system32\DrvInst.exe N/A
File created C:\Windows\inf\oem4.inf C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\inf\oem4.inf C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\INF\setupapi.dev.log C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe N/A
File opened for modification C:\Windows\INF\setupapi.dev.log C:\Windows\system32\svchost.exe N/A
File created C:\Windows\inf\oem4.inf C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\INF\setupapi.dev.log C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\inf\oem4.inf C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\INF\setupapi.dev.log C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\INF\setupapi.dev.log C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File opened for modification C:\Windows\inf\oem4.inf C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\security\logs\scecomp.log C:\Windows\system32\DrvInst.exe N/A

Subvert Trust Controls: Mark-of-the-Web Bypass

defense_evasion
Description Indicator Process Target
File opened for modification C:\Users\Admin\Downloads\MBSetup.exe:Zone.Identifier C:\Program Files\Google\Chrome\Application\chrome.exe N/A
File opened for modification C:\Users\Admin\Downloads\NPE.exe:Zone.Identifier C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\ABC2.tmp N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Downloads\MBSetup.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A

System Network Configuration Discovery: Internet Connection Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 C:\Windows\system32\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID C:\Windows\system32\DrvInst.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs C:\Windows\system32\DrvInst.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom C:\Windows\system32\DrvInst.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005\ C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005 C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs C:\Windows\system32\DrvInst.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID C:\Windows\system32\DrvInst.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs C:\Windows\system32\DrvInst.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom C:\Windows\system32\DrvInst.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs C:\Windows\system32\DrvInst.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs C:\Windows\system32\DrvInst.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs C:\Windows\system32\DrvInst.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Phantom C:\Windows\system32\DrvInst.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom C:\Windows\system32\DrvInst.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 C:\Windows\system32\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs C:\Windows\system32\DrvInst.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Phantom C:\Windows\system32\DrvInst.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0014 C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 C:\Windows\system32\DrvInst.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs C:\Windows\system32\DrvInst.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 C:\Windows\system32\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 C:\Windows\system32\DrvInst.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs C:\Windows\system32\DrvInst.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Phantom C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID C:\Windows\system32\DrvInst.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom C:\Windows\system32\DrvInst.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 C:\Windows\system32\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID C:\Windows\system32\DrvInst.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom C:\Windows\system32\DrvInst.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005\ C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID C:\Windows\system32\DrvInst.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID C:\Windows\system32\DrvInst.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs C:\Windows\system32\DrvInst.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags C:\Windows\system32\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID C:\Windows\system32\DrvInst.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0014 C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 C:\Windows\system32\DrvInst.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID C:\Windows\system32\DrvInst.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom C:\Windows\system32\DrvInst.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 C:\Windows\system32\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 C:\Windows\system32\DrvInst.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 C:\Windows\system32\DrvInst.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 C:\Windows\system32\DrvInst.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs C:\Windows\system32\DrvInst.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom C:\Windows\system32\DrvInst.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 C:\Windows\system32\DrvInst.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 C:\Windows\system32\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs C:\Windows\system32\DrvInst.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID C:\Windows\system32\DrvInst.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs C:\Windows\system32\DrvInst.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID C:\Windows\system32\DrvInst.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 C:\Windows\system32\DrvInst.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 C:\Windows\system32\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Phantom C:\Windows\system32\DrvInst.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0014 C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005 C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 C:\Windows\system32\DrvInst.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 C:\Windows\system32\DrvInst.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A

Modifies Control Panel

defense_evasion
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Control Panel\Desktop C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2329104403-2882594830-3136665766-1000\Control Panel\Desktop\WallpaperStyle = "10" C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Malwarebytes.exe = "11000" C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\mbam.exe = "11000" C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\mbamtray.exe = "11000" C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-19\Software\Policies C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0\Common C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:\ C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:\ C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\16.0\Common C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Policies C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\16.0\Common\Security C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Malwarebytes C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\16.0 C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\16.0\Common\Security C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-19\Software\Malwarebytes\FirstRun = "false" C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\16.0\Common C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\system32\DrvInst.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C\Blob = 0300000001000000140000007b0f360b775f76c94a12ca48445aa2d2a875701c190000000100000010000000a344f71a7a52a76ee49b74b1d8816b15040000000100000010000000d91299e84355cd8d5a86795a0118b6e90f000000010000003000000065b1d4076a89ae273f57e6eeedecb3eae129b4168f76fa7671914cdf461d542255c59d9b85b916ae0ca6fc0fcf7a8e641400000001000000140000006837e0ebb63bf85f1186fbfe617b088865f44e425c000000010000000400000000100000180000000100000010000000ffac207997bb2cfe865570179ee037b92000000001000000b4060000308206b030820498a003020102021008ad40b260d29c4c9f5ecda9bd93aed9300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3231303432393030303030305a170d3336303432383233353935395a3069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e6720525341343039362053484133383420323032312043413130820222300d06092a864886f70d01010105000382020f003082020a0282020100d5b42f42d028ad78b75dd539591bb18842f5338ceb3d819770c5bbc48526309fa48e68d85cf5eb342407e14b4fd37843f417d71edaf9d2d5671a524f0ea157fc8899c191cc81033e4d702464b38de2087d347d4c8057126b439a99f2c53b1ff2efcb475a13a64cb3012025f310d38bb2fb08f08ae09d09c065a7fa98804935873d5119e8902178452ea19f2ce118c21accc5ee93497042328ffbc6ea1cf3656891a24d4c8211485268de10bd14575de8181365c57fb24f852c48a4568435d6f92e9caa0015d137fe1a0694c27cc8ea1b32e6cac2f4a7a3030e74a5af39b6ab6012e3e8d6b9f731e1dcade418a0d8c1234747b3a10f6ea3ab6d9806831bb76a672dd2bd441a9210818fb03b09d7c79b325ac2ff6a60548b49c193ede1b45ce06feb26f98cd5b2f93810e6eace91f5bed3fb6f9361345cbc93452883362a66285fb073ce8b262506b283d45cf615194ced62e05e33f2e8e8ec0aa7b0032b91b23679bef7ad081e75a665ccbbe34850f377911afedb50a246c8615898f57c02163c8328ad3986ecd4b70d53d0f847e675308dec30937614a65b4b5d74614d3f129176debf58cb72102941f0d5c56d267668114113589adc262b01f4894d59db78cf814a3e40475fc98150738510232159608a6454c1cc211ae838197c661ccd78384530994fff634f4cbbaa0d0853417c583d47b3fab6ec8c320902cc6c3c0c56110203010001a38201593082015530120603551d130101ff040830060101ff020100301d0603551d0e041604146837e0ebb63bf85f1186fbfe617b088865f44e42301f0603551d23041830168014ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300e0603551d0f0101ff04040302018630130603551d25040c300a06082b06010505070303307706082b06010505070101046b3069302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304106082b060105050730028635687474703a2f2f636163657274732e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63727430430603551d1f043c303a3038a036a0348632687474703a2f2f63726c332e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63726c301c0603551d20041530133007060567810c01033008060667810c010401300d06092a864886f70d01010c050003820201003a23443d8d0876ee8fbc3a99d356e0021aa5f84834f32cb6e67466f79472b100caaf6c302713129e90449f4bfd9ea37c26d537bc3a5d486d95d53f49f427bb16814550fd9cbdb685e0767e3771cb22f75aaa90cff5936ae3eb20d1d55079889a8a8ac1b6bda148187edcd8801a111918cd61998156f6c9e376e7c4e41b5f43f83e94ff76393d9ed499cf4add28eb5f26a1955848d51afed7273ffd90d17686dd1cb0605cf30da8eee089a1bd39e1384eda6ebb369dfbe521535ac3cae96af1a23edb43b833c84f38149299f5ddce546dd95d02141f40337c03e295b2c221757352cb46d8c4341ca2a54b8dcd6f76372c853f1ace26e918be9007b0437f9588208270f0cccaeffd29355c1f893855f7378a8b09a1cb0be9311aff2e195c3971e1be9ca70a06d62667b792e64e5fde7aac49cf2ea47492addb3ca49c861fe3c1561b2b23ff8fb5ea887b706be6a0bafd3a3f45a6c4e81691528b41c048844b964dab4440e38df01528ceedf11856072a2f10c40c08643c338fae288c3ccb8f880b0dbf3bf4ce1e7b8eefb5ebcbb7f07713e6e7283fac12aea52f226c41f9825c1566cc6c0ecac586c3f626330c074ba0d307026a6a4030484b34a85120bbad1b8508e2590d6dca05502bea4a1c9ea5fda0a71f0674e7f2d65290fdaf854821f9573bb49c03ed8645f4b4616ebf68e2266086eac8afa9fe941de7631b3a8656784e C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{ED06E075-D1FD-4635-BA17-2F6D6BB0DFD6}\TypeLib C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B3B24818-1CC9-4825-96A9-1DB596E079C8} C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1861D707-8D71-497D-8145-62D5CBF4222F}\TypeLib C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MB.MBAMServiceController.1 C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MB.UpdateController.1\ = "UpdateController Class" C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7995CBA9-83E0-4F28-A50B-DFDE85EBCCD1}\TypeLib\ = "{783B187E-360F-419C-B6DA-592892764A01}" C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EF7DFB76-BA49-4191-8B62-0AC3571C56D7}\TypeLib C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DBD14E9A-A1B3-4B5A-8A4A-0E4EB25FAA54} C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{90F4450A-B7B2-417C-8ABB-BBD1BDFBFC27} C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E95BF32A-DE84-4E41-B836-E2A7BAB962AF}\TypeLib\Version = "1.0" C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2F14F58B-B908-4644-830F-5ACF8542D27F} C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EF7DFB76-BA49-4191-8B62-0AC3571C56D7}\ProxyStubClsid32 C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{55D0C28B-2BF3-4230-B48D-DB2C2D7BF6F8}\TypeLib\ = "{A82129F1-32E1-4D79-A39F-EBFEE53A70BF}" C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6724C143-DE69-4A93-80ED-19B75DD2AA99} C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{76AD4430-9C5C-4FC2-A15F-4E16ACD735AC}\TypeLib\ = "{FFB94DF8-FC15-411C-B443-E937085E2AC1}" C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{07B91244-8A85-4196-8904-7681CD9C42A6}\TypeLib\ = "{0E2822AB-0447-4F28-AF4C-FFDB1E8595AE}" C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E36A44EC-B16B-41DE-AD94-A59E117F67FF}\TypeLib\Version = "1.0" C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2058A31F-5F59-4452-9204-03F588252FFC}\TypeLib\ = "{783B187E-360F-419C-B6DA-592892764A01}" C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3E3D4AC2-A9AE-478A-91EE-79C35D3CA8C7} C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D7A05281-DB9E-4E02-9680-E4D83CDAA6AB} C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{09F245DA-55E7-451E-BDF3-4EE44637DFF1}\TypeLib C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{46AEAC9A-C091-4B63-926C-37CFBD9D244F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E03FDF96-969E-4700-844D-7F754F1657EF}\ProxyStubClsid32 C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{ECDAC35E-72BB-4856-97E1-226BA47C62C5}\TypeLib C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{44AC1571-055F-4CC8-B7D8-EA022C4CC112}\TypeLib\Version = "1.0" C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{77AD284A-4686-413D-AA76-BDFC1DF52A19}\TypeLib C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7968A0D1-5C9E-4F28-8C2F-E215BC7DF146} C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6655E528-3168-47A4-BF82-A71E9E6AB5F7}\TypeLib C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{02143C0F-1656-4B2E-95E7-EA8178A29E2E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{834906DC-FA0F-4F61-BC62-24B0BEB3769C}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0468FE5A-FFDA-4F57-83F5-79116160E9B8}\ = "IRTPControllerV14" C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{05510285-C4B6-4AFD-971B-EBE3139F45A3}\ = "IPoliciesControllerV11" C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DF39921A-6060-472F-A358-1CE8D2F8779C}\TypeLib C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{106E3995-72F9-458A-A317-9AFF9E45A1F0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{40D6E119-3897-41B3-AC5D-5FE6F088C97B} C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{04F8CDB5-1E26-491C-8602-D2ADE2D8E17A}\TypeLib C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6ED2B0A1-984E-4A35-9B04-E0EBAFB2842A}\TypeLib C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{00A73BC0-754E-44E1-B190-D59E187A5EA1}\TypeLib C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D8891F9E-90C4-4B3D-B87B-92DEA9221EBB}\ProxyStubClsid32 C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{738848E2-18E4-40F8-9C08-60BC0505E9E9}\TypeLib\Version = "1.0" C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F22E03D6-F159-40A0-9476-16F3377B58C9}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{580243BF-3CEE-4131-A599-C6FED66BEB1B}\LocalServer32 C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MB.PoliciesController\CurVer C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A0B9A582-5C93-41EF-A196-75B1DE8D4A8A}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AC5390D0-3831-4D42-BD1D-8151A5A1742C} C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DF39921A-6060-472F-A358-1CE8D2F8779C}\ = "IScanControllerEventsV10" C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3C0ECFDC-317D-406B-ADF5-C0E8217E244F}\ProxyStubClsid32 C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8E1F91DE-30AF-469B-9A09-FCF176207F0F}\ProxyStubClsid32 C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{02E9FB91-8E7C-46BF-958D-EAF5002A59B8}\TypeLib\ = "{FFB94DF8-FC15-411C-B443-E937085E2AC1}" C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0DB6AD16-564C-451A-A173-0F31A62B7A4D}\ProxyStubClsid32 C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{735BE2C0-5A9B-457A-A0A9-4B27FCED2817}\TypeLib\ = "{5709DEEB-F05E-4D5C-8DC4-3B0D924EE08F}" C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1E3F0FEC-3E40-4137-8C7D-090AFA9B6C5E}\TypeLib C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C2E404A3-4E3F-4094-AE06-5E38D39B79AE}\ProxyStubClsid32 C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E7DAEEB9-30B6-4AC4-BB74-7763C950D8EC}\TypeLib\Version = "1.0" C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{616E9BE3-358B-4C06-8AAB-0ACF8D089931}\TypeLib\Version = "1.0" C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7E777BB2-8526-437A-BBE2-42647DE2EC86}\ProxyStubClsid32 C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6DA5636E-CD8F-4F2D-9351-4270985E1EB3}\TypeLib\ = "{5709DEEB-F05E-4D5C-8DC4-3B0D924EE08F}" C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8D488C7C-023D-4561-B377-DD9FB7124326} C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{77EC89F7-64B9-4192-930B-B7B0A3976BBC} C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{07B91244-8A85-4196-8904-7681CD9C42A6}\TypeLib\ = "{0E2822AB-0447-4F28-AF4C-FFDB1E8595AE}" C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E36A44EC-B16B-41DE-AD94-A59E117F67FF}\ProxyStubClsid32 C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B9F73DD6-F2A4-40F8-9109-67F6BB8D3704}\ProxyStubClsid32 C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8FF168C7-A609-4237-A076-E461334BF4EA} C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1EB774AC-23B7-4F52-A9F2-708D194F0C86}\ = "_IArwControllerEventsV5" C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A

Modifies system certificate store

defense_evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2 C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\5A8CEF45D7A69859767A8C8B4496B578CF474B1A\Blob = 0300000001000000140000005a8cef45d7a69859767a8c8b4496b578cf474b1a2000000001000000450500003082054130820329a0030201020213066c9fd29635869f0a0fe58678f85b26bb8a37300d06092a864886f70d01010c05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412032301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f74204341203230820222300d06092a864886f70d01010105000382020f003082020a0282020100ad969f2d9c4a4c4a81795199ec8acb6b605113bc4d6d06fcb0088ddd19106ac7260c35d8c06f2084e994b19b8503c35bdb4ae8c8f89076d95b4fe34ce806364dcc9aac3d0c902b92d4061960ac374479858182ad5a37e00dcc9da64c5276ea439db704d150f655e0d5d2a64985e937e9ca7eae5c954d489a3fae205a6d8895d934b8521a4390b0bf6c05b9b678b7ead0e43a3c125362ff4af27bbe3505a91234e3f36474622c3d00495a28fe3244bb87dd652702713bda4af71fdacdf72155904f0fecae82e19f6bd945d3bbf05f87ed3c2c3986da3fdeec7255eb79a3addbdd7cb0ba1ccefcde4f3576cf0ff8781f6a36514627615be99ecff0a2557d7c258a6f2fb4c5cf842e2bfd0d51106cfb5f1bbc1b7ec5ae3b98013192ff0b57f49ab2b957e9abef0d76d1f0eef4ce86a7e06ee9b469a1df69f633c6692e97139ea587b057108137c953b3bb7ff692d19cd018f4926eda834fa663994ca5fb5eef21647a205f6c648515cb37e9620c0b2a16dc012e32da3e4bf59e3af6174094ef9e910886fabe63a85a33eccb744395f96c695236c7296ffc55035c1ffb9fbd47ebe74947950b4e89220949e0f5611ef1bf2e8a726e8059ff573af97532a34e5feced2862d94d73f2cc811760edcdebdcdba7cac57e02bdf2540854fdb42d092c17544a98d154e1516708d2ed6e7e6f3fd22d81592966cb903995111e7427feddebaf0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414b00cf04c30f405580248fd33e552af4b84e36652300d06092a864886f70d01010c05000382020100aaa8808f0e78a3e0a2d4cde6f5987a3bea0003b0970e93bc5aa8f62c8c7287a9b1fc7f73fd637178a58759cf30e10d10b2135a6d82f56ae6809fa0050b68e4476bc76adfb6fd773272e518fa09f4a0932c5dd28c75857665900c0379b7312363ad788309866884cafff9cf269a9279e7cd4bc5e761a717cbf3a91293936ba7e82f5392c46058b0cc0251185b858d625963b6adb4de9afb26f70027c05d55377499c9507fe3592e44e32c25eeec4c3277b49f1ae94b5d20c5dafd1c8716c643e8d4bb269a45705ea90b3753e2467b27fde046f289b7cc42b6cb28266ed9a5c93ac8411360f7508c15aeb26d1a151a5778e6922ad96590823f6c02afae123a27963604d71da28063a99bf1e5bab47c14b04ec9b11f745f38f651ea9bfa2ca211d4a92d271a45b1afb24e710dc05846d66906cb53cbb3fe6b41cd417e7d4c0f7c72797a59cd5e4a0eac9ba99873797cb4f4ccb9b8070cb2745cb8c76f88a190a7f4aaf9bf673af41a15621eb79fbe3db129af67a112f25810195303301bb81a89f69cbd97038ea309f31d8b21f1b4dfe41cd19f650206ea5cd613b384efa2a55c8c7729a768c06bae40d2a8b4eacdf08d4b389c199a1b2854b88990efca75813e1ef26424c718af4eff479e07f63565a4d30a56fff517646cefa822254993b6df0017da587e5deec51bb0d1d15f2110c7f9f3ba020a2707c5f1d6c7d3e0fb09606c C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0D44DD8C3C8C1A1A58756481E90F2E2AFFB3D26E C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F6108407D6F8BB67980CC2E244C2EBAE1CEF63BE C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa22000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F6108407D6F8BB67980CC2E244C2EBAE1CEF63BE\Blob = 030000000100000014000000f6108407d6f8bb67980cc2e244c2ebae1cef63be2000000001000000f6010000308201f230820178a0030201020213066c9fd7c1bb104c2943e5717b7b2cc81ac10e300a06082a8648ce3d0403033039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412034301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f7420434120343076301006072a8648ce3d020106052b8104002203620004d2ab8a374fa3530dfec18a7b4ba87b464b63b062f62d1bdb087121d200e863bd9a27fbf0396e5dea3da5c981aaa35b2098455d16dbfde8106de39ce0e3bd5f8462f3706433a0cb242f70ba88a12aa075f881ae6206c481db396e29b01efa2e5ca3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414d3ecc73a656ecce1da769a56fb9cf3866d57e581300a06082a8648ce3d040303036800306502303a8b21f1bd7e11add0ef58962fd6eb9d7e908d2bcf6655c32ce328a9700a470ef0375912ff2d9994284e2a4f354d335a023100ea75004e3bc43a941291c958469d211372a7889c8ae44c4adb96d4ac8b6b6b49125333add7e4be24fcb50a76d4a5bc10 C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\2AD974A775F73CBDBBD8F5AC3A49255FA8FB1F8C\Blob = 0300000001000000140000002ad974a775f73cbdbbd8f5ac3a49255fa8fb1f8c2000000001000000620400003082045e30820346a0030201020213077312380b9d6688a33b1ed9bf9ccda68e0e0f300d06092a864886f70d01010b05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412031301e170d3232303832333232323132385a170d3330303832333232323132385a303c310b3009060355040613025553310f300d060355040a1306416d617a6f6e311c301a06035504031313416d617a6f6e205253412032303438204d303130820122300d06092a864886f70d01010105000382010f003082010a0282010100eb712ca9cb1f8828923230af8a570f78b73725955587ac675c97d322c8daa214676b7cf067dae2032ab356125dc6b547f96708a7937a9592180fb4f9f910369a7f2f80b64fba134ec75d531ee0dd96330720d396bc12e4745042a1051373b54f9b4424fe2d7fedbc2285ec362133977506ce271882dce3d9c582078d5e26012626671fd93f13cf32ba6bad7864fcaaff0e023c07df9c0578728cfdea75b7032884dae86e078cd05085ef8154b2716eec6d62ef8f94c35ee9c4a4d091c02e249198caeeba258ed4f671b6fb5b6b38064837478d86dcf2ea06fb76377d9eff424e4d588293cfe271c278b17aab4b5b94378881e4d9af24aef872c565fb4bb451e70203010001a382015a3082015630120603551d130101ff040830060101ff020100300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030106082b06010505070302301d0603551d0e0416041481b80e638a891218e5fa3b3b50959fe6e5901385301f0603551d230418301680148418cc8534ecbc0c94942e08599cc7b2104e0a08307b06082b06010505070101046f306d302f06082b060105050730018623687474703a2f2f6f6373702e726f6f746361312e616d617a6f6e74727573742e636f6d303a06082b06010505073002862e687474703a2f2f6372742e726f6f746361312e616d617a6f6e74727573742e636f6d2f726f6f746361312e636572303f0603551d1f043830363034a032a030862e687474703a2f2f63726c2e726f6f746361312e616d617a6f6e74727573742e636f6d2f726f6f746361312e63726c30130603551d20040c300a3008060667810c010201300d06092a864886f70d01010b05000382010100ad00de0205232e063262b46bb19416e41140de2bfa59c135efe0aa8f2b41b9d1f38739001df23db5a7470c0606c691f3075702d4edbd17c1909abf4875a2074f30dd4a6a42b50d3d15c00ffe845bc63c99cc5752b1d86e12d59692934b94e507e88982086a7a34d49e64e13d876a92909a63a14bf88fb6ea34d305be20c2de06e28c9f738b9f4d3985cace19369d85c99ec9f8503fb67e88a1efca84068b50b40a5ca61c44f1fdc8614060f26125aa07f4c7c27375e40c0b428d04e55f4448995b7b898196a7889d4b0d62e804c4d7feb4e8b26dcaecc01cbc385b1ddf85ce5b7ae3494b6cb9a7ddf405b249ade1c5146bc2ccebcd7fd65869bac3207e7fb0b8 C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 040000000100000010000000cb17e431673ee209fe455793f30afa1c0f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c953000000010000006300000030613021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c07f000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030109000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000009acfab7e43c8d880d06b262a94deeee4b4659989c3d0caf19baf6405e41ab7df1400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331330b000000010000001200000056006500720069005300690067006e0000001d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3617e000000010000000800000000c0032f2df8d6016800000001000000000000000300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e5190000000100000010000000d8b5fb368468620275d142ffd2aade372000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8DA7F965EC5EFC37910F1C6E59FDC1CC6A6EDE16 C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\1C58A3A8518E8759BF075B76B750D4F2DF264FCD C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 5c000000010000000400000000080000190000000100000010000000fd960962ac6938e0d4b0769aa1a64e26030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a1d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e76200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb65809000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e650040000000100000010000000324a4bbbc863699bbe749ac6dd1d46242000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\5A8CEF45D7A69859767A8C8B4496B578CF474B1A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0D44DD8C3C8C1A1A58756481E90F2E2AFFB3D26E\Blob = 0300000001000000140000000d44dd8c3c8c1a1a58756481e90f2e2affb3d26e2000000001000000ba010000308201b63082015ba0030201020213066c9fd5749736663f3b0b9ad9e89e7603f24a300a06082a8648ce3d0403023039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412033301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f7420434120333059301306072a8648ce3d020106082a8648ce3d030107034200042997a7c6417fc00d9be8011b56c6f252a5ba2db212e8d22ed7fac9c5d8aa6d1f73813b3b986b397c33a5c54e868e8017686245577d44581db337e56708eb66dea3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414abb6dbd7069e37ac3086079170c79cc419b178c0300a06082a8648ce3d0403020349003046022100e08592a317b78df92b06a593ac1a98686172fae1a1d0fb1c7860a64399c5b8c40221009c02eff1949cb396f9ebc62af8b62cfe3a901416d78c6324481cdf307dd5683b C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 5c0000000100000004000000001000001900000001000000100000009f687581f7ef744ecfc12b9cee6238f10f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa2140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a2040000000100000010000000be954f16012122448ca8bc279602acf52000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\9E99A48A9960B14926BB7F3B02E22DA2B0AB7280 C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\9E99A48A9960B14926BB7F3B02E22DA2B0AB7280\Blob = 0300000001000000140000009e99a48a9960b14926bb7f3b02e22da2b0ab72801400000001000000140000009c5f00dfaa01d7302b3888a2b86d4a9cf2119183040000000100000010000000c6150925cfea5941ddc7ff2a0a5066920f00000001000000200000008408d5e5010ab8da67eb33a7d79ace944dd0ac103ae6ead3ff30dec571066b0319000000010000001000000014d4b19434670e6dc091d154abb20edc5c000000010000000400000000080000180000000100000010000000fd960962ac6938e0d4b0769aa1a64e264b0000000100000044000000420036003600320034003000420030004600360043003800340042004400340038003500370041004200410036003000430046003500430045003400410030005f000000200000000100000079040000308204753082035da003020102020900a70e4a4c3482b77f300d06092a864886f70d01010b05003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3039303930323030303030305a170d3334303632383137333931365a308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100d50c3ac42af94ee2f5be19975f8e8853b11f3fcbcf9f20136d293ac80f7d3cf76b763863d93660a89b5e5c0080b22f597ff687f9254386e7691b529a90e171e3d82d0d4e6ff6c849d9b6f31a56ae2bb67414ebcffb26e31aba1d962e6a3b5894894756ff25a093705383da847414c3679e04683adf8e405a1d4a4ecf43913be756d60070cb52ee7b7dae3ae7bc31f945f6c260cf1359022b80cc3447dfb9de90656d02cf2c91a6a6e7de8518497c664ea33a6da9b5ee342eba0d03b833df47ebb16b8d25d99bce81d1454632967087de020e494385b66c73bb64ea6141acc9d454df872fc722b226cc9f5954689ffcbe2a2fc4551c75406017850255398b7f050203010001a381f03081ed300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604149c5f00dfaa01d7302b3888a2b86d4a9cf2119183301f0603551d23041830168014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7304f06082b0601050507010104433041301c06082b060105050730018610687474703a2f2f6f2e7373322e75732f302106082b060105050730028615687474703a2f2f782e7373322e75732f782e63657230260603551d1f041f301d301ba019a0178615687474703a2f2f732e7373322e75732f722e63726c30110603551d20040a300830060604551d2000300d06092a864886f70d01010b05000382010100231de38a57ca7de917794cf11e55fdcc536e3e470fdfc655f2b20436ed801f53c45d34286bbec755fc67eacb3f7f90b233cd1b58108202f8f82ff51360d405cef18108c1dda775974f18b96ddef7939108ba7e402cedc1eabb769e3306771d0d087f53dd1b64ab8227f169d54d5eaef4a1c375a758442df23c7098acba69b695777f0f315e2cfca0873a4769f0795ff41454a4955e1178126027ce9fc277ff2353775dbaffea59e7dbcfaf9296ef249a35107a9c91c60e7d99f63f19dff57254e115a907597b83bf522e468cb20064761c48d3d879e86e56ccae2c0390d7193899e4ca09195bff0796b0a87f3449df56a9f7b05fed33ed8c47b730035df4038c C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E\Blob = 030000000100000014000000b51c067cee2b0c3df855ab2d92f4fe39d4e70f0e2000000001000000e1030000308203dd308202c5a003020102020100300d06092a864886f70d01010b050030818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a30818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bdedc103fcf68ffc02b16f5b9f48d99d79e2a2b703615618c347b6d7ca3d352e8943f7a1699bde8a1afd13209cb44977322956fdb9ec8cdd22fa72dc276197eef65a84ec6e19b9892cdc845bd574fb6b5fc589a51052894655f4b8751ce67fe454ae4bf85572570219f8177159eb1e280774c59d48be6cb4f4a4b0f364377992c0ec465e7fe16d534c62afcd1f0b63bb3a9dfbfc7900986174cf26824063f3b2726a190d99cad40e75cc37fb8b89c159f1627f5fb35f6530f8a7b74d765a1e765e34c0e89656998ab3f07fa4cdbddc32317c91cfe05f11f86baa495cd19994d1a2e3635b0976b55662e14b741d96d426d4080459d0980e0ee6defcc3ec1f90f10203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147c0c321fa7d9307fc47d68a362a8a1ceab075b27300d06092a864886f70d01010b050003820101001159fa254f036f94993b9a1f828539d47605945ee128936d625d09c2a0a8d4b07538f1346a9de49f8a862651e62cd1c62d6e95204a9201ecb88a677b31e2672e8c9503262e439d4a31f60eb50cbbb7e2377f22ba00a30e7b52fb6bbb3bc4d379514ecd90f4670719c83c467a0d017dc558e76de68530179a24c410e004f7e0f27fd4aa0aff421d37ed94e5645912207738d3323e3881759673fa688fb1cbce1fc5ecfa9c7ecf7eb1f1072db6fcbfcaa4bfd097054abcea18280290bd5478092171d3d17d1dd916b0a9613dd00a0022fcc77bcb0964450b3b4081f77d7c32f598ca588e7d2aee90597364f936745e25a1f566052e7f3915a92afb508b8e8569f4 C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8DA7F965EC5EFC37910F1C6E59FDC1CC6A6EDE16\Blob = 0300000001000000140000008da7f965ec5efc37910f1c6e59fdc1cc6a6ede162000000001000000450300003082034130820229a0030201020213066c9fcf99bf8c0a39e2f0788a43e696365bca300d06092a864886f70d01010b05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412031301e170d3135303532363030303030305a170d3338303131373030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f74204341203130820122300d06092a864886f70d01010105000382010f003082010a0282010100b2788071ca78d5e371af478050747d6ed8d78876f49968f7582160f97484012fac022d86d3a0437a4eb2a4d036ba01be8ddb48c80717364cf4ee8823c73eeb37f5b519f84968b0ded7b976381d619ea4fe8236a5e54a56e445e1f9fdb416fa74da9c9b35392ffab02050066c7ad080b2a6f9afec47198f503807dca2873958f8bad5a9f948673096ee94785e6f89a351c0308666a14566ba54eba3c391f948dcffd1e8302d7d2d747035d78824f79ec4596ebb738717f2324628b843fab71daacab4f29f240e2d4bf7715c5e69ffea9502cb388aae50386fdbfb2d621bc5c71e54e177e067c80f9c8723d63f40207f2080c4804c3e3b24268e04ae6c9ac8aa0d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604148418cc8534ecbc0c94942e08599cc7b2104e0a08300d06092a864886f70d01010b0500038201010098f2375a4190a11ac57651282036230eaee628bbaaf894ae48a4307f1bfc248d4bb4c8a197f6b6f17a70c85393cc0828e39825cf23a4f9de21d37c8509ad4e9a753ac20b6a897876444718656c8d418e3b7f9acbf4b5a750d7052c37e8034bade961a0026ef5f2f0c5b2ed5bb7dcfa945c779e13a57f52ad95f2f8933bde8b5c5bca5a525b60af14f74befa3fb9f40956d3154fc42d3c7461f23add90f48709ad9757871d1724334756e5759c2025c266029cf2319168e8843a5d4e4cb08fb231143e843297262a1a95d5e08d490aeb8d8ce14c2d055f286f6c49343776661c0b9e841d7977860036e4a72aea5d17dba109e866c1b8ab95933f8ebc490bef1b9 C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\1C58A3A8518E8759BF075B76B750D4F2DF264FCD\Blob = 0300000001000000140000001c58a3a8518e8759bf075b76b750d4f2df264fcd2000000001000000c2040000308204be308203a6a003020102021006d8d904d5584346f68a2fa754227ec4300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3231303431343030303030305a170d3331303431333233353935395a304f310b300906035504061302555331153013060355040a130c446967694365727420496e633129302706035504031320446967694365727420544c53205253412053484132353620323032302043413130820122300d06092a864886f70d01010105000382010f003082010a0282010100c14bb3654770bcdd4f58dbec9cedc366e51f311354ad4a66461f2c0aec6407e52edcdcb90a20eddfe3c4d09e9aa97a1d8288e51156db1e9f58c251e72c340d2ed292e156cbf1795fb3bb87ca25037b9a52416610604f571349f0e8376783dfe7d34b674c2251a6df0e9910ed57517426e27dc7ca622e131b7f238825536fc13458008b84fff8bea75849227b96ada2889b15bca07cdfe951a8d5b0ed37e236b4824b62b5499aecc767d6e33ef5e3d6125e44f1bf71427d58840380b18101faf9ca32bbb48e278727c52b74d4a8d697dec364f9cace53a256bc78178e490329aefb494fa415b9cef25c19576d6b79a72ba2272013b5d03d40d321300793ea99f50203010001a38201823082017e30120603551d130101ff040830060101ff020100301d0603551d0e04160414b76ba2eaa8aa848c79eab4da0f98b2c59576b9f4301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030106082b06010505070302307606082b06010505070101046a3068302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304006082b060105050730028634687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274476c6f62616c526f6f7443412e63727430420603551d1f043b30393037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274476c6f62616c526f6f7443412e63726c303d0603551d2004363034300b06096086480186fd6c02013007060567810c01013008060667810c0102013008060667810c0102023008060667810c010203300d06092a864886f70d01010b050003820101008032ce5e0bdd6e5a0d0aafe1d684cbc08efa8570edda5db30cf72b7540fe850afaf33178b7704b1a8958ba80bdf36b1de97ecf0bba589c59d490d3fd6cfdd0986db771825bcf6d0b5a09d07bdec443d82aa4de9e41265fbb8f99cbddaee1a86f9f87fe74b71f1b20abb14fc6f5675d5d9b3ce9ff69f7616cd6d9f3fd36c6ab038876d24b2e7586e3fcd8557d26c21177df3e02b67cf3ab7b7a86366fb8f7d89371cf86df7330fa7babed2a59c842843b11171a52f3c90e147da25b7267ba71ed574766c5b8024a65345e8bd02a3c209c51994ce7529ef76b112b0d927e1de88aeb36164387ea2a63bf753febdec403bb0a3cf730efebaf4cfc8b3610733ef3a4 C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5 C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\2AD974A775F73CBDBBD8F5AC3A49255FA8FB1F8C C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 040000000100000010000000be954f16012122448ca8bc279602acf5140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a2030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa20f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e1900000001000000100000009f687581f7ef744ecfc12b9cee6238f12000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 5c000000010000000400000000080000190000000100000010000000d8b5fb368468620275d142ffd2aade370300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e56800000001000000000000007e000000010000000800000000c0032f2df8d6011d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3610b000000010000001200000056006500720069005300690067006e0000001400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331336200000001000000200000009acfab7e43c8d880d06b262a94deeee4b4659989c3d0caf19baf6405e41ab7df09000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703017f000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000006300000030613021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c9040000000100000010000000cb17e431673ee209fe455793f30afa1c2000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474 C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2 C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 040000000100000010000000324a4bbbc863699bbe749ac6dd1d46240f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb658140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a190000000100000010000000fd960962ac6938e0d4b0769aa1a64e262000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A

NTFS ADS

Description Indicator Process Target
File opened for modification C:\Users\Admin\Downloads\MBSetup.exe:Zone.Identifier C:\Program Files\Google\Chrome\Application\chrome.exe N/A
File opened for modification C:\Users\Admin\Downloads\NPE.exe:Zone.Identifier C:\Program Files\Google\Chrome\Application\chrome.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\mbuns.exe\:Zone.Identifier:$DATA C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A

Opens file in notepad (likely ransom note)

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\NOTEPAD.EXE N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A
N/A N/A C:\Windows\system32\PING.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
N/A N/A C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Users\Admin\Downloads\MBSetup.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 956 wrote to memory of 484 N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe C:\Windows\splwow64.exe
PID 956 wrote to memory of 484 N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe C:\Windows\splwow64.exe
PID 6108 wrote to memory of 5068 N/A C:\Windows\system32\printfilterpipelinesvc.exe C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
PID 6108 wrote to memory of 5068 N/A C:\Windows\system32\printfilterpipelinesvc.exe C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
PID 956 wrote to memory of 5764 N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe C:\ProgramData\ABC2.tmp
PID 956 wrote to memory of 5764 N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe C:\ProgramData\ABC2.tmp
PID 956 wrote to memory of 5764 N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe C:\ProgramData\ABC2.tmp
PID 956 wrote to memory of 5764 N/A C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe C:\ProgramData\ABC2.tmp
PID 5764 wrote to memory of 3664 N/A C:\ProgramData\ABC2.tmp C:\Windows\SysWOW64\cmd.exe
PID 5764 wrote to memory of 3664 N/A C:\ProgramData\ABC2.tmp C:\Windows\SysWOW64\cmd.exe
PID 5764 wrote to memory of 3664 N/A C:\ProgramData\ABC2.tmp C:\Windows\SysWOW64\cmd.exe
PID 5792 wrote to memory of 4900 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5792 wrote to memory of 4900 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5792 wrote to memory of 2288 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5792 wrote to memory of 2288 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5792 wrote to memory of 2288 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5792 wrote to memory of 2288 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5792 wrote to memory of 2288 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5792 wrote to memory of 2288 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5792 wrote to memory of 2288 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5792 wrote to memory of 2288 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5792 wrote to memory of 2288 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5792 wrote to memory of 2288 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5792 wrote to memory of 2288 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5792 wrote to memory of 2288 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5792 wrote to memory of 2288 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5792 wrote to memory of 2288 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5792 wrote to memory of 2288 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5792 wrote to memory of 2288 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5792 wrote to memory of 2288 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5792 wrote to memory of 2288 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5792 wrote to memory of 2288 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5792 wrote to memory of 2288 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5792 wrote to memory of 2288 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5792 wrote to memory of 2288 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5792 wrote to memory of 2288 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5792 wrote to memory of 2288 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5792 wrote to memory of 2288 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5792 wrote to memory of 2288 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5792 wrote to memory of 2288 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5792 wrote to memory of 2288 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5792 wrote to memory of 2288 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5792 wrote to memory of 2288 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5792 wrote to memory of 3928 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5792 wrote to memory of 3928 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5792 wrote to memory of 4108 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5792 wrote to memory of 4108 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5792 wrote to memory of 4108 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5792 wrote to memory of 4108 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5792 wrote to memory of 4108 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5792 wrote to memory of 4108 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5792 wrote to memory of 4108 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5792 wrote to memory of 4108 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5792 wrote to memory of 4108 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5792 wrote to memory of 4108 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5792 wrote to memory of 4108 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5792 wrote to memory of 4108 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5792 wrote to memory of 4108 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5792 wrote to memory of 4108 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5792 wrote to memory of 4108 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5792 wrote to memory of 4108 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5792 wrote to memory of 4108 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5792 wrote to memory of 4108 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 5792 wrote to memory of 4108 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy WMI provider

ransomware

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe

"C:\Users\Admin\AppData\Local\Temp\2025-06-02_cb6845218d57d663976bf1fa2a4d6ddb_darkside_elex_lockbit.exe"

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc

C:\Windows\system32\printfilterpipelinesvc.exe

C:\Windows\system32\printfilterpipelinesvc.exe -Embedding

C:\Windows\system32\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\g0Bwcr1Ri.README.txt

C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE

/insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{2EC0DA40-7BDE-4056-B74D-1213298BEFFE}.xps" 133936096316520000

C:\ProgramData\ABC2.tmp

"C:\ProgramData\ABC2.tmp"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\ABC2.tmp >> NUL

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff95b42dcf8,0x7ff95b42dd04,0x7ff95b42dd10

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1948,i,17085582500919070640,3947483903663367378,262144 --variations-seed-version --mojo-platform-channel-handle=1944 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=2160,i,17085582500919070640,3947483903663367378,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:11

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2320,i,17085582500919070640,3947483903663367378,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:13

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3216,i,17085582500919070640,3947483903663367378,262144 --variations-seed-version --mojo-platform-channel-handle=3320 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3308,i,17085582500919070640,3947483903663367378,262144 --variations-seed-version --mojo-platform-channel-handle=3392 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4164,i,17085582500919070640,3947483903663367378,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:9

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4504,i,17085582500919070640,3947483903663367378,262144 --variations-seed-version --mojo-platform-channel-handle=4640 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5300,i,17085582500919070640,3947483903663367378,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:14

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5320,i,17085582500919070640,3947483903663367378,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5644,i,17085582500919070640,3947483903663367378,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:14

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5652,i,17085582500919070640,3947483903663367378,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:14

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5416,i,17085582500919070640,3947483903663367378,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:14

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5628,i,17085582500919070640,3947483903663367378,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:14

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5688,i,17085582500919070640,3947483903663367378,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=3484,i,17085582500919070640,3947483903663367378,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=5832,i,17085582500919070640,3947483903663367378,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=6016,i,17085582500919070640,3947483903663367378,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=3420,i,17085582500919070640,3947483903663367378,262144 --variations-seed-version --mojo-platform-channel-handle=3068 /prefetch:12

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x00000000000004EC 0x00000000000004F4

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=5852,i,17085582500919070640,3947483903663367378,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=5944,i,17085582500919070640,3947483903663367378,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=3444,i,17085582500919070640,3947483903663367378,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=5812,i,17085582500919070640,3947483903663367378,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=6432,i,17085582500919070640,3947483903663367378,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:14

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=6444,i,17085582500919070640,3947483903663367378,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:14

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=6452,i,17085582500919070640,3947483903663367378,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:14

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --field-trial-handle=6412,i,17085582500919070640,3947483903663367378,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --field-trial-handle=6716,i,17085582500919070640,3947483903663367378,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --field-trial-handle=3296,i,17085582500919070640,3947483903663367378,262144 --variations-seed-version --mojo-platform-channel-handle=6836 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --field-trial-handle=6388,i,17085582500919070640,3947483903663367378,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --field-trial-handle=3464,i,17085582500919070640,3947483903663367378,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=6900,i,17085582500919070640,3947483903663367378,262144 --variations-seed-version --mojo-platform-channel-handle=6824 /prefetch:14

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --field-trial-handle=6488,i,17085582500919070640,3947483903663367378,262144 --variations-seed-version --mojo-platform-channel-handle=6812 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --field-trial-handle=3616,i,17085582500919070640,3947483903663367378,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --field-trial-handle=6308,i,17085582500919070640,3947483903663367378,262144 --variations-seed-version --mojo-platform-channel-handle=6944 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --field-trial-handle=6940,i,17085582500919070640,3947483903663367378,262144 --variations-seed-version --mojo-platform-channel-handle=7104 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --field-trial-handle=7320,i,17085582500919070640,3947483903663367378,262144 --variations-seed-version --mojo-platform-channel-handle=7084 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --field-trial-handle=6304,i,17085582500919070640,3947483903663367378,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1148,i,17085582500919070640,3947483903663367378,262144 --variations-seed-version --mojo-platform-channel-handle=7204 /prefetch:10

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --field-trial-handle=6172,i,17085582500919070640,3947483903663367378,262144 --variations-seed-version --mojo-platform-channel-handle=3368 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --field-trial-handle=3396,i,17085582500919070640,3947483903663367378,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=6272,i,17085582500919070640,3947483903663367378,262144 --variations-seed-version --mojo-platform-channel-handle=7276 /prefetch:14

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --field-trial-handle=6356,i,17085582500919070640,3947483903663367378,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --field-trial-handle=7664,i,17085582500919070640,3947483903663367378,262144 --variations-seed-version --mojo-platform-channel-handle=7700 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --field-trial-handle=7808,i,17085582500919070640,3947483903663367378,262144 --variations-seed-version --mojo-platform-channel-handle=7656 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=7848,i,17085582500919070640,3947483903663367378,262144 --variations-seed-version --mojo-platform-channel-handle=7988 /prefetch:14

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --field-trial-handle=8056,i,17085582500919070640,3947483903663367378,262144 --variations-seed-version --mojo-platform-channel-handle=8036 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --field-trial-handle=7668,i,17085582500919070640,3947483903663367378,262144 --variations-seed-version --mojo-platform-channel-handle=7700 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --field-trial-handle=8700,i,17085582500919070640,3947483903663367378,262144 --variations-seed-version --mojo-platform-channel-handle=8724 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --field-trial-handle=7796,i,17085582500919070640,3947483903663367378,262144 --variations-seed-version --mojo-platform-channel-handle=7728 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --field-trial-handle=8028,i,17085582500919070640,3947483903663367378,262144 --variations-seed-version --mojo-platform-channel-handle=8708 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --field-trial-handle=8800,i,17085582500919070640,3947483903663367378,262144 --variations-seed-version --mojo-platform-channel-handle=8772 /prefetch:1

C:\Users\Admin\Downloads\MBSetup.exe

"C:\Users\Admin\Downloads\MBSetup.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --field-trial-handle=8356,i,17085582500919070640,3947483903663367378,262144 --variations-seed-version --mojo-platform-channel-handle=4664 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=6752,i,17085582500919070640,3947483903663367378,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:14

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Users\Admin\Downloads\NPE.exe

"C:\Users\Admin\Downloads\NPE.exe"

C:\Users\Admin\Downloads\NPE.exe

"C:\Users\Admin\Downloads\NPE.exe"

C:\Users\Admin\Downloads\NPE.exe

"C:\Users\Admin\Downloads\NPE.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff95b42dcf8,0x7ff95b42dd04,0x7ff95b42dd10

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1916,i,12574192256572951725,7295856759915461300,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=1928 /prefetch:11

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1840,i,12574192256572951725,7295856759915461300,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=1836 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2340,i,12574192256572951725,7295856759915461300,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=2364 /prefetch:13

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3164,i,12574192256572951725,7295856759915461300,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=3308 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3172,i,12574192256572951725,7295856759915461300,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=3352 /prefetch:1

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4196,i,12574192256572951725,7295856759915461300,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=4208 /prefetch:9

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4612,i,12574192256572951725,7295856759915461300,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=4636 /prefetch:1

C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe

"C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"

C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe

"C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe" /installmbtun

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall

C:\Windows\system32\DrvInst.exe

DrvInst.exe "4" "9" "C:\Program Files\Malwarebytes\Anti-Malware\mbtun\mbtun.inf" "9" "4ba9030c7" "0000000000000154" "Service-0x0-3e7$\Default" "000000000000016C" "208" "C:\Program Files\Malwarebytes\Anti-Malware\mbtun"

C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe

"C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe" /Service /Protected

C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe

"C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k AppReadiness -p -s AppReadiness

C:\Users\Admin\Downloads\NPE.exe

"C:\Users\Admin\Downloads\NPE.exe"

C:\Windows\system32\DrvInst.exe

DrvInst.exe "4" "0" "C:\Windows\TEMP\{e7fc427b-be16-0649-a252-d50537bad720}\farflt11.inf" "9" "43b788047" "000000000000016C" "Service-0x0-3e7$\Default" "0000000000000160" "208" "C:\Program Files\Malwarebytes\Anti-Malware\sdk"

C:\Windows\system32\DrvInst.exe

DrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\farflt11.inf_amd64_a08c83c14d71bb76\farflt11.inf" "0" "43b788047" "0000000000000160" "Service-0x0-3e7$\Default"

C:\Windows\system32\DrvInst.exe

DrvInst.exe "5" "2" "C:\Windows\System32\DriverStore\FileRepository\farflt11.inf_amd64_a08c83c14d71bb76\farflt11.inf" "0" "46fa191bf" "0000000000000164" "Service-0x0-3e7$\Default"

C:\Windows\system32\DrvInst.exe

DrvInst.exe "4" "0" "C:\Windows\TEMP\{163e176d-fa7d-7841-aab5-e67a57dfab9d}\farflt11.inf" "9" "43b788047" "0000000000000154" "Service-0x0-3e7$\Default" "000000000000016C" "208" "C:\Program Files\Malwarebytes\Anti-Malware\sdk"

C:\Windows\system32\DrvInst.exe

DrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\farflt11.inf_amd64_a08c83c14d71bb76\farflt11.inf" "0" "43b788047" "000000000000016C" "Service-0x0-3e7$\Default"

C:\Windows\system32\DrvInst.exe

DrvInst.exe "5" "2" "C:\Windows\System32\DriverStore\FileRepository\farflt11.inf_amd64_a08c83c14d71bb76\farflt11.inf" "0" "46fa191bf" "0000000000000180" "Service-0x0-3e7$\Default"

C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe

"C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe"

C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe

"C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe"

C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe

"C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe"

C:\Windows\system32\DrvInst.exe

DrvInst.exe "4" "0" "C:\Windows\TEMP\{0d9fdb20-67c9-0547-b602-4c8f5da7e2d8}\farflt11.inf" "9" "43b788047" "0000000000000154" "Service-0x0-3e7$\Default" "0000000000000164" "208" "C:\Program Files\Malwarebytes\Anti-Malware\sdk"

C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe

"C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe"

C:\Windows\system32\DrvInst.exe

DrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\farflt11.inf_amd64_a08c83c14d71bb76\farflt11.inf" "0" "43b788047" "0000000000000164" "Service-0x0-3e7$\Default"

C:\Windows\system32\DrvInst.exe

DrvInst.exe "5" "2" "C:\Windows\System32\DriverStore\FileRepository\farflt11.inf_amd64_a08c83c14d71bb76\farflt11.inf" "0" "46fa191bf" "000000000000010C" "Service-0x0-3e7$\Default"

C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exe

ig.exe reseed

C:\Program Files\Malwarebytes\Anti-Malware\MBAMWsc.exe

"C:\Program Files\Malwarebytes\Anti-Malware\MBAMWsc.exe" /wac 0 /status on true /updatesubstatus none /scansubstatus none /settingssubstatus none

C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\updatrpkg\mbupdatrV5.exe

"C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\updatrpkg\mbupdatrV5.exe" "C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE" "C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\config\UpdateControllerConfig.json" "C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE" "C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\dbclsupdate\staging" /db:dbupdate /su:no

C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exe

ig.exe reseed

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff95b42dcf8,0x7ff95b42dd04,0x7ff95b42dd10

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2012,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=2008 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=2732,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=2744 /prefetch:11

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2872,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=2892 /prefetch:13

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3752,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=3768 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=4032,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=4044 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4892,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=4928 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5568,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=5580 /prefetch:14

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5792,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=5804 /prefetch:14

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=5676,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=5672 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4144,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=4568 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=6124,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=6128 /prefetch:14

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=4088,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=6120 /prefetch:14

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=6116,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=4988 /prefetch:14

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=6136,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=6100 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=3888,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=5056 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=5984,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=6168 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=4188,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=6176 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=3840,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=3920 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=6396,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=6428 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=6516,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=6568 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=6456,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=6728 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=6512,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=6892 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=6984,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=7020 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --field-trial-handle=7172,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=7176 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --field-trial-handle=7212,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=6836 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --field-trial-handle=6576,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=7328 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --field-trial-handle=7372,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=7368 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --field-trial-handle=6404,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=7404 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --field-trial-handle=7612,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=7636 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --field-trial-handle=7768,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=7792 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --field-trial-handle=7912,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=7948 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --field-trial-handle=7976,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=8088 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --field-trial-handle=8248,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=8276 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --field-trial-handle=8416,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=8432 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --field-trial-handle=8752,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=8780 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --field-trial-handle=8908,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=8760 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --field-trial-handle=8740,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=7772 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --field-trial-handle=7764,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=9092 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --field-trial-handle=6684,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=9200 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --field-trial-handle=8080,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=9232 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --field-trial-handle=9488,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=9528 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --field-trial-handle=9628,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=9652 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --field-trial-handle=9660,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=9864 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --field-trial-handle=9468,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=9844 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --field-trial-handle=10112,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=10156 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --field-trial-handle=10272,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=10296 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --field-trial-handle=10436,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=10448 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --field-trial-handle=10488,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=10620 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --field-trial-handle=10744,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=10776 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --field-trial-handle=10900,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=10916 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --field-trial-handle=11056,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=11080 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --field-trial-handle=11200,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=11236 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --field-trial-handle=11432,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=11456 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --field-trial-handle=11500,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=6372 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --field-trial-handle=8260,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=11804 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --field-trial-handle=11488,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=11764 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --field-trial-handle=11964,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=9632 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --field-trial-handle=12156,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=11548 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --field-trial-handle=12236,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=12244 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --field-trial-handle=12276,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=12436 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --field-trial-handle=12456,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=12596 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --field-trial-handle=12576,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=12740 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --field-trial-handle=12880,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=12896 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --field-trial-handle=13024,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=13052 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --field-trial-handle=13184,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=13208 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --field-trial-handle=13348,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=13368 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --field-trial-handle=13404,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=13524 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --field-trial-handle=13680,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=13516 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --field-trial-handle=13828,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=13836 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --field-trial-handle=13864,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=13988 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --field-trial-handle=14124,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=14152 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --field-trial-handle=14288,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=14304 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --field-trial-handle=14448,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=14464 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --field-trial-handle=14604,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=14620 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --field-trial-handle=14760,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=14776 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --field-trial-handle=12920,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=13652 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --field-trial-handle=11760,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=15308 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --field-trial-handle=15336,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=15364 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --field-trial-handle=15624,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=15344 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --field-trial-handle=15648,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=15772 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --field-trial-handle=15756,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=15404 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --field-trial-handle=15928,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=15960 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --field-trial-handle=16244,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=15512 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --field-trial-handle=15632,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=15508 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --field-trial-handle=16356,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=16456 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --field-trial-handle=16656,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=16628 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --field-trial-handle=16808,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=15924 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --field-trial-handle=16908,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=16916 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --field-trial-handle=17048,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=17060 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --field-trial-handle=17236,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=15608 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --field-trial-handle=16296,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=16260 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --field-trial-handle=17096,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=17128 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --field-trial-handle=4952,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=16820 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=95 --field-trial-handle=15944,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=16060 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=96 --field-trial-handle=16008,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=16520 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --field-trial-handle=16388,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=16416 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=98 --field-trial-handle=16136,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=15932 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=99 --field-trial-handle=15508,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=16132 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=100 --field-trial-handle=16048,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=16128 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=101 --field-trial-handle=15972,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=16168 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=102 --field-trial-handle=15480,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=15444 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=103 --field-trial-handle=15720,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=15696 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=104 --field-trial-handle=16104,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=16100 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=105 --field-trial-handle=16588,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=15992 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=106 --field-trial-handle=17248,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=5856 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=14940,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=16404 /prefetch:14

C:\Users\Admin\Downloads\KVRT.exe

"C:\Users\Admin\Downloads\KVRT.exe"

C:\Users\Admin\AppData\Local\Temp\{a7d923a8-6354-472e-a1ce-8e2de1559314}\648ca394.exe

C:/Users/Admin/AppData/Local/Temp/{a7d923a8-6354-472e-a1ce-8e2de1559314}/\648ca394.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\{82b9eb52-c181-467d-b228-52983f8f9808}\9ad591d4-9cad-431c-8046-067059b39e4d.cmd"

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\{82b9eb52-c181-467d-b228-52983f8f9808}\9ad591d4-9cad-431c-8046-067059b39e4d.cmd" "

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\reg.exe

reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce /v 9ad591d4-9cad-431c-8046-067059b39e4d /f

C:\Windows\system32\reg.exe

reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce /v 9ad591d4-9cad-431c-8046-067059b39e4d /f

C:\Users\Admin\Downloads\KVRT.exe

"C:\Users\Admin\Downloads\KVRT.exe"

C:\Users\Admin\AppData\Local\Temp\{757284c1-b103-4f05-8b1e-76c23a744d06}\868ade56.exe

C:/Users/Admin/AppData/Local/Temp/{757284c1-b103-4f05-8b1e-76c23a744d06}/\868ade56.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\{bb3779b6-c42a-46a0-9485-df2d5667704a}\858dbee8-fb82-4105-8cff-8e04b3152029.cmd"

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\{bb3779b6-c42a-46a0-9485-df2d5667704a}\858dbee8-fb82-4105-8cff-8e04b3152029.cmd" "

C:\Windows\system32\PING.EXE

ping 127.0.0.1 -n 1

C:\Windows\system32\reg.exe

reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce /v 858dbee8-fb82-4105-8cff-8e04b3152029 /f

C:\Windows\system32\reg.exe

reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce /v 858dbee8-fb82-4105-8cff-8e04b3152029 /f

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=15116,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=14800 /prefetch:10

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=109 --field-trial-handle=14800,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=6016 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=110 --field-trial-handle=3600,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=12264 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=111 --field-trial-handle=8252,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=7964 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=112 --field-trial-handle=6884,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=6976 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=113 --field-trial-handle=6936,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=6860 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=114 --field-trial-handle=6968,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=16920 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=115 --field-trial-handle=1516,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=6940 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=117 --field-trial-handle=13584,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=10968 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=120 --field-trial-handle=16952,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=10532 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=119 --field-trial-handle=17140,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=10572 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=118 --field-trial-handle=16844,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=10476 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=116 --field-trial-handle=10928,i,12972369950290244183,6249489406145212382,262144 --variations-seed-version=20250604-180051.210000 --mojo-platform-channel-handle=11028 /prefetch:1

Network

Country Destination Domain Proto
US 8.8.8.8:53 roaming.officeapps.live.com udp
US 52.109.6.63:443 roaming.officeapps.live.com tcp
CA 142.250.69.68:443 www.google.com tcp
CA 142.250.69.68:443 www.google.com tcp
CA 142.250.69.68:443 www.google.com tcp
CA 142.250.69.110:443 clients2.google.com tcp
CA 142.250.69.106:443 ajax.googleapis.com tcp
CA 142.250.69.106:443 ajax.googleapis.com udp
CA 142.250.69.106:443 ajax.googleapis.com tcp
CA 142.250.69.46:443 www.youtube.com tcp
CA 142.250.69.110:443 www.youtube.com tcp
N/A 224.0.0.251:5353 udp
CA 142.250.69.46:443 www.youtube.com udp
CA 142.250.69.97:443 clients2.googleusercontent.com tcp
CA 142.250.69.68:443 www.google.com udp
CA 142.250.69.129:443 www-beforecrypt-com.webpkgcache.com tcp
US 216.239.34.157:443 tunnel.googlezip.net tcp
CA 142.250.69.106:443 ajax.googleapis.com tcp
CA 142.250.69.129:443 www-beforecrypt-com.webpkgcache.com udp
CA 142.250.69.68:443 www.google.com udp
CA 142.250.69.106:443 ajax.googleapis.com udp
CA 142.250.69.46:443 www.youtube.com tcp
US 216.239.34.157:443 tunnel.googlezip.net tcp
US 172.66.43.91:443 www.provendata.com tcp
US 172.66.43.91:443 www.provendata.com tcp
CA 142.250.69.46:443 www.youtube.com udp
US 172.66.43.91:443 www.provendata.com udp
US 108.138.64.36:443 scripts.iconnode.com tcp
CA 142.250.69.68:443 www.google.com tcp
US 13.248.238.122:443 process.iconnode.com tcp
CA 142.250.69.68:443 www.google.com udp
US 151.101.65.140:443 pixel-config.reddit.com tcp
US 157.240.254.7:443 connect.facebook.net tcp
US 23.219.36.106:443 snap.licdn.com tcp
US 3.162.103.56:443 s.adroll.com tcp
AM 5.101.37.37:443 code.jivosite.com tcp
CA 142.250.69.46:443 www.youtube.com tcp
US 172.253.115.156:443 stats.g.doubleclick.net tcp
US 151.101.65.140:443 pixel-config.reddit.com tcp
AM 5.101.37.37:443 code.jivosite.com tcp
US 151.101.129.140:443 alb.reddit.com tcp
US 151.101.1.140:443 alb.reddit.com tcp
US 150.171.22.12:443 px.ads.linkedin.com tcp
US 150.171.22.12:443 px.ads.linkedin.com tcp
CA 142.250.69.68:443 www.google.com tcp
US 52.44.196.123:443 d.adroll.com tcp
US 157.240.254.7:443 connect.facebook.net udp
US 157.240.254.35:443 www.facebook.com tcp
US 157.240.254.35:443 www.facebook.com tcp
US 157.240.254.35:443 www.facebook.com tcp
AM 5.101.37.37:443 code.jivosite.com tcp
US 44.193.97.230:443 x.adroll.com tcp
US 44.193.97.230:443 x.adroll.com tcp
US 104.18.41.41:443 www.linkedin.com tcp
US 34.111.113.62:443 pixel.tapad.com tcp
US 34.117.77.79:443 ml314.com tcp
US 35.211.202.130:443 x.bidswitch.net tcp
AM 5.101.37.37:443 code.jivosite.com tcp
US 35.71.139.29:443 eb2.3lift.com tcp
US 68.67.161.182:443 ib.adnxs.com tcp
US 104.18.26.193:443 dsum-sec.casalemedia.com tcp
US 34.98.64.218:443 us-u.openx.net tcp
US 69.173.151.100:443 pixel.rubiconproject.com tcp
US 35.244.154.8:443 idsync.rlcdn.com tcp
US 64.202.112.191:443 sync.outbrain.com tcp
US 8.28.7.83:443 image2.pubmatic.com tcp
US 141.226.224.48:443 sync.taboola.com tcp
US 34.111.113.62:443 pixel.tapad.com udp
US 35.211.202.130:443 x.bidswitch.net udp
CA 142.250.69.68:443 www.google.com udp
US 104.18.26.193:443 dsum-sec.casalemedia.com udp
US 34.98.64.218:443 us-u.openx.net udp
US 35.244.154.8:443 idsync.rlcdn.com udp
US 34.54.30.30:443 publickeyservice.pa.gcp.privacysandboxservices.com tcp
US 13.249.39.126:443 publickeyservice.pa.aws.privacysandboxservices.com tcp
US 3.33.220.150:443 match.adsrvr.org tcp
US 107.178.254.65:443 pippio.com tcp
RU 158.160.40.132:443 node-ya-8.jivosite.com tcp
RU 130.193.38.59:443 vi-ya-2.jivosite.com tcp
GB 198.244.165.101:443 telemetry.jivosite.com tcp
CA 142.250.69.46:443 play.google.com udp
US 34.160.17.71:443 www.ransomwarehelp.com tcp
US 34.160.17.71:443 www.ransomwarehelp.com tcp
US 34.70.111.192:443 link.msgsndr.com tcp
US 172.67.42.101:443 analyticsplusdev.clientify.net tcp
US 104.18.34.38:443 widgets.leadconnectorhq.com tcp
US 104.18.34.38:443 widgets.leadconnectorhq.com tcp
CA 142.250.69.118:443 i.ytimg.com tcp
US 104.18.34.38:443 widgets.leadconnectorhq.com tcp
CA 142.250.69.46:443 play.google.com tcp
US 172.253.115.156:443 stats.g.doubleclick.net tcp
CA 142.250.69.68:443 www.google.com tcp
US 23.219.36.106:443 snap.licdn.com tcp
CA 142.250.69.123:443 storage.googleapis.com tcp
CA 142.250.69.123:443 storage.googleapis.com tcp
US 172.64.153.218:443 widgets.leadconnectorhq.com tcp
US 172.64.153.218:443 widgets.leadconnectorhq.com tcp
US 172.64.153.218:443 widgets.leadconnectorhq.com tcp
US 172.64.153.218:443 widgets.leadconnectorhq.com tcp
US 172.64.153.218:443 widgets.leadconnectorhq.com tcp
US 172.64.153.218:443 widgets.leadconnectorhq.com tcp
US 172.64.153.218:443 widgets.leadconnectorhq.com tcp
US 104.18.34.38:443 widgets.leadconnectorhq.com tcp
US 13.107.246.40:443 www.clarity.ms tcp
US 13.107.246.40:443 www.clarity.ms tcp
US 172.253.115.156:443 stats.g.doubleclick.net udp
US 150.171.22.12:443 px.ads.linkedin.com tcp
US 150.171.22.12:443 px.ads.linkedin.com tcp
US 157.240.254.7:443 connect.facebook.net tcp
CA 142.250.69.35:80 c.pki.goog tcp
US 52.242.103.142:443 v.clarity.ms tcp
US 52.242.103.142:443 v.clarity.ms tcp
DE 164.92.174.194:443 analytics.clientify.net tcp
US 172.64.153.218:443 widgets.leadconnectorhq.com tcp
CA 142.250.69.68:443 www.google.com udp
US 109.61.86.193:443 fonts.bunny.net tcp
US 109.61.86.193:443 fonts.bunny.net tcp
US 109.61.86.193:443 fonts.bunny.net tcp
US 109.61.86.193:443 fonts.bunny.net tcp
US 104.18.34.38:443 widgets.leadconnectorhq.com tcp
US 109.61.86.193:443 fonts.bunny.net tcp
CA 142.250.69.68:443 www.google.com tcp
US 172.64.153.218:443 widgets.leadconnectorhq.com tcp
US 172.64.153.218:443 widgets.leadconnectorhq.com tcp
US 172.64.146.59:443 services.msgsndr.com tcp
US 20.110.205.119:443 c.clarity.ms tcp
CA 142.250.69.68:443 www.google.com udp
US 150.171.28.10:443 bat.bing.com tcp
US 104.22.37.215:443 analyticsplusdev.clientify.net tcp
CA 142.250.69.46:443 play.google.com udp
US 216.239.34.157:443 tunnel.googlezip.net tcp
US 216.239.34.157:443 tunnel.googlezip.net tcp
CA 142.250.69.33:443 tpc.googlesyndication.com tcp
CA 142.250.69.106:443 ajax.googleapis.com udp
CA 142.250.69.46:443 play.google.com udp
US 52.149.246.39:443 duckduckgo.com tcp
US 52.149.246.39:80 duckduckgo.com tcp
US 52.149.246.39:80 duckduckgo.com tcp
US 142.251.165.94:443 beacons.gcp.gvt2.com tcp
US 142.251.165.94:443 beacons.gcp.gvt2.com tcp
US 142.251.165.94:443 beacons.gcp.gvt2.com udp
US 142.251.165.94:443 beacons.gcp.gvt2.com tcp
US 20.237.39.62:443 links.duckduckgo.com tcp
US 52.149.246.39:443 duckduckgo.com tcp
US 52.149.246.247:443 external-content.duckduckgo.com tcp
US 52.149.246.247:443 external-content.duckduckgo.com tcp
US 52.149.246.247:443 external-content.duckduckgo.com tcp
US 52.149.246.247:443 external-content.duckduckgo.com tcp
US 52.149.246.247:443 external-content.duckduckgo.com tcp
US 142.251.165.94:443 beacons.gcp.gvt2.com tcp
US 23.44.131.219:443 www.bing.com tcp
US 172.64.153.235:443 try.malwarebytes.com tcp
CA 142.250.69.68:443 www.google.com udp
CA 142.250.69.106:443 ajax.googleapis.com tcp
US 3.167.37.14:443 builder-assets.unbounce.com tcp
CA 142.250.69.106:443 ajax.googleapis.com udp
US 192.0.66.84:443 www.threatdown.com tcp
US 34.107.218.251:443 dev.visualwebsiteoptimizer.com tcp
US 23.206.121.48:443 cdn.bizible.com tcp
US 18.160.37.193:443 d9hhrg4mnvzow.cloudfront.net tcp
US 34.107.218.251:443 dev.visualwebsiteoptimizer.com udp
CA 142.250.69.46:443 play.google.com udp
US 138.199.40.58:443 plausible.io tcp
US 34.107.218.251:443 dev.visualwebsiteoptimizer.com udp
US 18.160.41.58:443 static.hotjar.com tcp
US 18.67.65.95:443 fonts.ub-assets.com tcp
CA 142.250.69.46:443 play.google.com tcp
US 172.253.115.156:443 stats.g.doubleclick.net tcp
US 18.67.65.95:443 fonts.ub-assets.com tcp
US 23.219.36.108:443 snap.licdn.com tcp
US 142.251.165.94:443 beacons.gcp.gvt2.com tcp
US 142.251.165.94:443 beacons.gcp.gvt2.com tcp
US 150.171.22.12:443 px.ads.linkedin.com tcp
US 18.160.10.89:443 tag.demandbase.com tcp
US 104.17.73.206:443 go.malwarebytes.com tcp
US 23.206.121.48:443 cdn.bizible.com udp
ES 34.175.83.78:443 e2c71.gcp.gvt2.com tcp
US 23.206.121.58:443 cdn.bizible.com tcp
US 34.96.71.22:443 s.company-target.com tcp
US 13.249.39.126:443 api.company-target.com tcp
US 104.18.26.193:443 dsum-sec.casalemedia.com tcp
US 18.67.76.18:443 tag-logger.demandbase.com tcp
US 142.251.167.94:443 beacons.gvt2.com tcp
US 18.211.212.114:443 partners.tremorhub.com tcp
US 3.167.56.16:443 script.hotjar.com tcp
US 69.173.151.100:443 pixel.rubiconproject.com tcp
US 150.171.27.10:443 bat.bing.com tcp
CA 142.250.69.68:443 www.google.com tcp
US 150.171.22.12:443 px.ads.linkedin.com tcp
US 35.244.154.8:443 id.rlcdn.com tcp
US 99.84.188.56:443 segments.company-target.com tcp
CA 142.250.69.68:443 www.google.com udp
US 207.174.26.219:443 i.ibb.co tcp
CA 142.250.69.46:443 play.google.com udp
US 20.237.39.62:443 links.duckduckgo.com tcp
US 138.199.40.58:443 plausible.io tcp
US 52.149.246.39:443 duckduckgo.com tcp
US 52.149.246.39:443 duckduckgo.com tcp
US 52.149.246.39:443 duckduckgo.com tcp
US 52.149.246.39:443 duckduckgo.com tcp
US 52.149.246.39:443 duckduckgo.com tcp
US 52.149.246.39:443 duckduckgo.com tcp
US 52.149.246.39:443 duckduckgo.com tcp
US 23.44.131.219:443 www.bing.com udp
US 172.64.148.75:443 185c650ccfd84b27aad189f19681365b.js.ubembed.com tcp
US 34.107.218.251:443 dev.visualwebsiteoptimizer.com udp
US 23.206.121.48:443 cdn.bizible.com udp
US 35.244.154.8:443 id.rlcdn.com udp
US 34.96.71.22:443 s.company-target.com udp
CA 142.250.69.68:443 www.google.com udp
US 18.67.76.18:443 tag-logger.demandbase.com udp
US 3.167.37.37:443 assets.ubembed.com tcp
US 142.251.165.94:443 beacons.gcp.gvt2.com udp
US 142.251.165.94:443 beacons.gcp.gvt2.com udp
CA 142.250.69.46:443 play.google.com tcp
US 23.44.131.204:443 www.bing.com tcp
US 192.0.66.233:443 www.malwarebytes.com tcp
US 192.0.66.185:443 web-service.malwarebytes.com tcp
US 192.0.66.185:443 web-service.malwarebytes.com tcp
US 192.0.76.3:443 pixel.wp.com tcp
US 172.64.149.114:443 api.weglot.com tcp
US 104.18.38.142:443 api.weglot.com tcp
US 104.18.86.42:443 cdn.cookielaw.org tcp
US 44.210.218.199:443 genesis.malwarebytes.com tcp
US 104.18.86.42:443 cdn.cookielaw.org tcp
US 104.18.32.137:443 geolocation.onetrust.com tcp
US 172.64.149.114:443 api.weglot.com udp
US 162.247.243.39:443 js-agent.newrelic.com tcp
US 157.240.254.7:443 connect.facebook.net tcp
US 162.247.243.29:443 bam.nr-data.net tcp
US 54.245.86.56:443 tvspix.com tcp
US 157.240.254.7:443 connect.facebook.net udp
US 157.240.229.35:443 www.facebook.com tcp
US 157.240.229.35:443 www.facebook.com tcp
US 157.240.229.35:443 www.facebook.com tcp
US 104.18.32.137:443 geolocation.onetrust.com tcp
US 3.167.99.64:443 downloads.malwarebytes.com tcp
US 3.167.99.64:443 downloads.malwarebytes.com tcp
US 142.251.165.94:443 beacons.gcp.gvt2.com udp
US 3.171.100.78:443 data-cdn.mbamupdates.com tcp
US 23.203.190.73:443 buy.norton.com tcp
US 104.79.84.168:443 buy-static.norton.com tcp
US 23.39.36.184:443 s.go-mpulse.net tcp
US 104.79.86.43:443 www.nortonlifelock.com tcp
US 104.79.86.43:443 www.nortonlifelock.com tcp
US 23.45.193.57:443 assets.adobedtm.com tcp
US 3.234.31.129:443 ensighten.norton.com tcp
US 23.203.190.73:443 buy.norton.com tcp
US 104.96.84.186:443 c.go-mpulse.net tcp
US 3.234.31.129:443 ensighten.norton.com udp
US 44.199.162.139:443 dpm.demdex.net tcp
US 3.234.31.129:443 ensighten.norton.com udp
US 3.167.99.43:443 doh.cq0.co tcp
US 3.234.31.129:443 ensighten.norton.com tcp
US 104.18.10.213:443 cdn.quantummetric.com tcp
US 34.224.209.44:443 symantec.demdex.net tcp
US 63.140.38.77:443 oms.norton.com tcp
US 63.140.39.244:443 oms.norton.com tcp
US 34.196.60.148:443 cm.everesttech.net tcp
US 157.240.254.7:443 connect.facebook.net tcp
US 8.8.8.8:53 68794912.akstat.io udp
US 150.171.27.10:443 bat.bing.com tcp
US 151.101.129.21:443 www.paypal.com tcp
US 35.186.249.72:443 d.impactradius-event.com tcp
US 35.244.142.80:443 cdn.pdst.fm tcp
US 151.101.65.140:443 alb.reddit.com tcp
US 3.167.42.53:443 d34r8q7sht0t9k.cloudfront.net tcp
US 3.167.112.92:443 spider.australiarevival.com tcp
US 23.39.36.184:443 68794912.akstat.io tcp
US 151.101.65.140:443 alb.reddit.com tcp
US 69.147.92.11:443 s.yimg.com tcp
US 151.101.129.140:443 alb.reddit.com tcp
US 34.120.253.250:443 tag.wknd.ai tcp
US 8.8.8.8:53 tag.havasedge.com udp
US 8.8.8.8:53 js.adsrvr.org udp
US 162.159.152.17:443 q.quora.com tcp
US 157.240.254.7:443 connect.facebook.net udp
US 34.212.159.30:443 app.leadsrx.com tcp
US 104.17.209.240:443 siteintercept.qualtrics.com tcp
US 34.42.227.149:443 ingest.quantummetric.com tcp
US 54.245.86.56:443 tvspix.com tcp
US 3.167.37.51:443 tag.havasedge.com tcp
US 68.67.161.182:443 secure.adnxs.com tcp
US 3.171.55.94:443 js.adsrvr.org tcp
US 64.86.199.44:443 gwmtracking.com tcp
US 68.67.161.182:443 secure.adnxs.com tcp
US 151.101.194.132:443 pt.ispot.tv tcp
US 68.67.161.182:443 secure.adnxs.com tcp
US 23.53.11.167:443 trkn.us tcp
US 3.162.103.75:443 websdk.ujet.co tcp
US 99.84.188.109:443 s.dpmsrv.com tcp
US 151.101.65.140:443 pixel-config.reddit.com tcp
US 151.101.131.1:443 t.paypal.com tcp
CA 142.250.69.68:443 www.google.com tcp
US 3.227.190.204:443 bite.australiarevival.com tcp
US 69.147.92.11:443 s.yimg.com tcp
CA 142.250.69.70:443 12346775.fls.doubleclick.net tcp
CA 142.250.69.68:443 www.google.com tcp
US 34.111.8.32:443 events.bouncex.net tcp
US 34.111.170.203:443 pix.cdnwidget.com tcp
US 157.240.254.35:443 www.facebook.com tcp
US 157.240.254.35:443 www.facebook.com tcp
US 157.240.254.35:443 www.facebook.com tcp
US 34.98.72.95:443 assets.bounceexchange.com tcp
US 216.239.36.181:443 analytics.google.com tcp
US 3.33.220.150:443 insight.adsrvr.org tcp
CA 142.250.69.68:443 www.google.com udp
US 172.253.115.156:443 stats.g.doubleclick.net tcp
US 54.160.143.175:443 sp.analytics.yahoo.com tcp
US 52.39.180.155:443 event.havasedge.com tcp
US 52.71.177.235:443 a.dpmsrv.com tcp
CA 142.250.69.70:443 12346775.fls.doubleclick.net udp
US 3.171.55.94:443 js.adsrvr.org tcp
US 68.67.161.182:443 secure.adnxs.com tcp
US 157.240.254.35:443 www.facebook.com udp
US 34.98.72.95:443 assets.bounceexchange.com udp
US 34.121.25.40:443 rl.quantummetric.com tcp
US 69.173.151.100:443 pixel.rubiconproject.com tcp
US 34.107.244.169:443 data.cdnbasket.net tcp
US 35.244.245.94:443 page.cdnbasket.net tcp
US 35.201.89.175:443 view.cdnbasket.net tcp
US 3.33.220.150:443 insight.adsrvr.org tcp
US 8.8.8.8:53 cookie.havasedge.com udp
US 34.98.72.95:443 assets.bounceexchange.com tcp
US 44.236.98.103:443 cookie.havasedge.com tcp
US 3.33.220.150:443 insight.adsrvr.org tcp
US 3.162.103.75:443 websdk.ujet.co tcp
US 23.45.192.38:443 www.norton.com tcp
US 108.138.85.119:443 js.cobrowse.io tcp
US 34.111.170.203:443 pix.cdnwidget.com tcp
US 34.149.99.248:443 nlok-prod-4l9eze7.uw1.ccaiplatform.com tcp
US 34.49.72.173:443 ids.cdnwidget.com tcp
US 34.149.99.248:443 nlok-prod-4l9eze7.uw1.ccaiplatform.com udp
US 34.96.67.107:443 nlok-prod-4l9eze7.cobrowse.uw1.ccaiplatform.com tcp
US 34.111.8.32:443 events.bouncex.net udp
US 34.96.67.107:443 nlok-prod-4l9eze7.cobrowse.uw1.ccaiplatform.com udp
US 23.39.36.184:443 68794912.akstat.io udp
US 34.42.227.149:443 ingest.quantummetric.com tcp
US 162.159.152.17:443 q.quora.com udp
US 23.45.192.38:443 www.norton.com tcp
US 23.45.192.38:443 www.norton.com tcp
US 23.45.192.38:443 www.norton.com tcp
US 23.45.192.38:443 www.norton.com tcp
US 23.45.192.38:443 www.norton.com tcp
US 23.45.192.38:443 www.norton.com tcp
CA 142.250.69.142:443 www.youtube.com tcp
US 23.45.192.38:443 www.norton.com tcp
CA 142.250.69.142:443 www.youtube.com udp
US 3.171.100.108:443 nexus.ensighten.com tcp
CA 142.250.69.142:443 www.youtube.com tcp
US 23.20.189.8:443 mboxedge34.tt.omtrdc.net tcp
US 3.171.100.108:443 nexus.ensighten.com udp
US 13.107.246.40:443 login.norton.com tcp
CA 142.250.69.142:443 www.youtube.com udp
CA 142.250.69.118:443 i.ytimg.com tcp
CA 142.250.69.68:443 www.google.com tcp
CA 142.250.69.33:443 yt3.ggpht.com tcp
CA 142.250.69.46:443 www3.doubleclick.net tcp
US 104.17.208.240:443 siteintercept.qualtrics.com tcp
US 104.17.208.240:443 siteintercept.qualtrics.com tcp
CA 142.250.69.118:443 i.ytimg.com udp
CA 142.250.69.46:443 www3.doubleclick.net udp
US 44.225.129.160:443 api2.amplitude.com tcp
US 23.45.192.38:443 www.norton.com tcp
US 23.45.192.38:443 www.norton.com tcp
US 23.45.192.38:443 www.norton.com tcp
US 162.247.243.29:443 bam.nr-data.net tcp
CA 142.250.69.68:443 www.google.com udp
US 52.207.198.162:443 ark.mwbsys.com tcp
US 18.160.41.24:443 cdn.mwbsys.com tcp
CA 142.250.69.68:443 www.google.com tcp
CA 142.250.69.68:443 www.google.com tcp
CA 142.250.69.68:443 www.google.com tcp
US 52.207.198.162:443 ark.mwbsys.com tcp
CA 142.250.69.106:443 jnn-pa.googleapis.com udp
US 18.160.41.39:443 cdn.mwbsys.com tcp
CA 142.250.69.106:443 jnn-pa.googleapis.com udp
CA 142.250.69.46:443 www3.doubleclick.net udp
US 52.207.198.162:443 ark.mwbsys.com tcp
US 18.160.41.41:443 cdn.mwbsys.com tcp
US 44.207.18.233:443 ark.mwbsys.com tcp
US 18.160.41.41:443 cdn.mwbsys.com tcp
US 44.207.18.233:443 ark.mwbsys.com tcp
US 18.160.41.41:443 cdn.mwbsys.com tcp
US 23.200.197.152:80 www.microsoft.com tcp
SE 45.83.223.233:443 ipv4.am.i.mullvad.net tcp
US 23.21.224.31:443 holocron.mwbsys.com tcp
US 23.21.224.31:443 holocron.mwbsys.com tcp
US 54.71.128.245:443 api2.amplitude.com tcp
US 44.207.18.233:443 ark.mwbsys.com tcp
US 192.0.66.233:443 www.malwarebytes.com tcp
US 54.71.128.245:443 api2.amplitude.com tcp
US 44.207.18.233:443 ark.mwbsys.com tcp
US 192.0.66.233:443 www.malwarebytes.com tcp
US 44.207.18.233:443 ark.mwbsys.com tcp
US 192.0.66.233:443 www.malwarebytes.com tcp
US 192.0.66.233:443 www.malwarebytes.com tcp
US 44.215.191.11:443 iris.mwbsys.com tcp
US 44.207.18.233:443 ark.mwbsys.com tcp
US 192.0.66.233:443 www.malwarebytes.com tcp
US 3.171.61.121:443 lic-iris-content-prod.mwbsys.com tcp
US 3.171.61.121:443 lic-iris-content-prod.mwbsys.com tcp
US 3.171.61.121:443 lic-iris-content-prod.mwbsys.com tcp
US 3.171.61.121:443 lic-iris-content-prod.mwbsys.com tcp
US 18.236.49.214:443 telemetry.malwarebytes.com tcp
US 44.207.18.233:443 ark.mwbsys.com tcp
US 192.0.66.233:443 www.malwarebytes.com tcp
US 44.207.18.233:443 ark.mwbsys.com tcp
US 192.0.66.233:443 www.malwarebytes.com tcp
US 44.207.18.233:443 ark.mwbsys.com tcp
US 192.0.66.233:443 www.malwarebytes.com tcp
US 44.207.18.233:443 ark.mwbsys.com tcp
US 192.0.66.233:443 www.malwarebytes.com tcp
US 44.207.18.233:443 ark.mwbsys.com tcp
US 192.0.66.233:443 www.malwarebytes.com tcp
US 34.233.168.206:443 sirius.mwbsys.com tcp
US 18.160.41.24:443 cdn.mwbsys.com tcp
US 23.21.84.238:443 ark.mwbsys.com tcp
US 192.0.66.233:443 www.malwarebytes.com tcp
US 23.21.84.238:443 ark.mwbsys.com tcp
US 192.0.66.233:443 www.malwarebytes.com tcp
US 23.21.84.238:443 ark.mwbsys.com tcp
US 192.0.66.233:443 www.malwarebytes.com tcp
US 34.202.24.201:443 hubble.mb-cosmos.com tcp
US 23.21.84.238:443 ark.mwbsys.com tcp
US 3.167.69.74:80 crt.rootg2.amazontrust.com tcp
US 192.0.66.233:443 www.malwarebytes.com tcp
US 23.21.84.238:443 ark.mwbsys.com tcp
US 192.0.66.233:443 www.malwarebytes.com tcp
US 23.21.84.238:443 ark.mwbsys.com tcp
US 192.0.66.233:443 www.malwarebytes.com tcp
US 23.21.84.238:443 ark.mwbsys.com tcp
US 192.0.66.233:443 www.malwarebytes.com tcp
US 23.203.176.101:80 evcs-aia.ws.symantec.com tcp
US 23.203.176.101:80 evcs-aia.ws.symantec.com tcp
US 23.203.176.101:80 evcs-aia.ws.symantec.com tcp
US 23.203.176.101:80 evcs-aia.ws.symantec.com tcp
US 23.21.84.238:443 ark.mwbsys.com tcp
US 23.203.176.101:80 evcs-aia.ws.symantec.com tcp
US 192.0.66.233:443 www.malwarebytes.com tcp
US 23.203.176.101:80 evcs-aia.ws.symantec.com tcp
US 23.21.84.238:443 ark.mwbsys.com tcp
US 23.203.176.101:80 evcs-aia.ws.symantec.com tcp
US 192.0.66.233:443 www.malwarebytes.com tcp
US 23.203.176.101:80 evcs-aia.ws.symantec.com tcp
US 23.21.84.238:443 ark.mwbsys.com tcp
US 192.0.66.233:443 www.malwarebytes.com tcp
US 23.203.176.101:80 evcs-aia.ws.symantec.com tcp
US 23.21.84.238:443 ark.mwbsys.com tcp
US 23.203.176.101:80 evcs-aia.ws.symantec.com tcp
US 192.0.66.233:443 www.malwarebytes.com tcp
US 52.36.17.75:443 api2.amplitude.com tcp
US 18.236.49.214:443 telemetry.malwarebytes.com tcp
US 18.236.49.214:443 telemetry.malwarebytes.com tcp
US 34.233.168.206:443 sirius.mwbsys.com tcp
US 23.210.241.182:80 www.microsoft.com tcp
US 18.213.84.101:443 blitz.mb-cosmos.com tcp
US 18.236.49.214:443 telemetry.malwarebytes.com tcp
CA 142.250.69.68:443 www.google.com udp
CA 142.250.69.138:443 jnn-pa.googleapis.com udp
CA 142.250.69.138:443 jnn-pa.googleapis.com udp
CA 142.250.69.46:443 www3.doubleclick.net udp
CA 142.250.69.46:443 www3.doubleclick.net udp
CA 142.250.69.110:443 clients2.google.com udp
US 34.233.168.206:443 sirius.mwbsys.com tcp
US 52.149.246.39:443 duckduckgo.com tcp
US 20.237.39.62:443 links.duckduckgo.com tcp
US 52.149.246.247:443 external-content.duckduckgo.com tcp
BR 18.229.176.75:443 api-router.kaspersky-labs.com tcp
BR 18.229.176.75:443 api-router.kaspersky-labs.com tcp
US 216.239.36.21:443 sgtm.kaspersky.de tcp
US 172.67.70.6:443 7foxepcf7f.kameleoon.io tcp
BR 18.229.176.75:443 api-router.kaspersky-labs.com tcp
FI 65.109.73.219:443 eu-data.kameleoon.io tcp
FI 65.109.73.219:443 eu-data.kameleoon.io tcp
FI 65.109.73.219:443 eu-data.kameleoon.io tcp
BR 18.229.176.75:443 api-router.kaspersky-labs.com tcp
BR 18.229.176.75:443 api-router.kaspersky-labs.com tcp
BR 18.229.176.75:443 api-router.kaspersky-labs.com tcp
RU 87.250.250.119:443 mc.yandex.com tcp
US 216.239.38.21:443 sgtm.kaspersky.de tcp
US 216.239.38.21:443 sgtm.kaspersky.de tcp
US 216.239.38.21:443 sgtm.kaspersky.de tcp
BR 18.229.176.75:443 api-router.kaspersky-labs.com tcp
US 151.101.1.140:443 pixel-config.reddit.com tcp
US 150.171.27.10:443 bat.bing.com tcp
US 104.18.0.22:443 unpkg.com tcp
US 23.219.36.108:443 snap.licdn.com tcp
US 104.18.19.104:443 cdn.gbqofs.com tcp
US 104.18.19.104:443 cdn.gbqofs.com tcp
US 151.101.129.44:443 pips.taboola.com tcp
US 34.197.29.24:443 track.omguk.com tcp
JP 182.22.31.124:443 s.yimg.jp tcp
US 151.101.1.140:443 pixel-config.reddit.com tcp
US 8.8.8.8:53 connect.facebook.net udp
US 8.8.8.8:53 kasperskycom.push4site.com udp
US 8.8.8.8:53 px.ads.linkedin.com udp
US 151.101.129.140:443 pixel-config.reddit.com tcp
CA 142.250.69.68:443 www.google.com tcp
US 23.23.115.233:443 resources.xg4ken.com tcp
US 52.85.132.86:443 js.go2sdk.com tcp
US 150.171.22.12:443 px.ads.linkedin.com tcp
US 104.18.19.104:443 cdn.gbqofs.com tcp
US 157.240.254.7:443 static.xx.fbcdn.net tcp
US 172.67.71.105:443 push4site.com tcp
JP 182.22.31.124:443 s.yimg.jp tcp
CA 142.250.69.70:443 12346775.fls.doubleclick.net tcp
CA 142.250.69.70:443 12346775.fls.doubleclick.net tcp
RU 84.252.130.113:443 api.mindbox.ru tcp
US 104.21.48.1:443 s.retargeted.co tcp
US 150.171.22.12:443 px.ads.linkedin.com tcp
US 151.101.65.44:443 pips.taboola.com tcp
US 151.101.1.140:443 pixel-config.reddit.com tcp
US 216.239.36.181:443 analytics.google.com tcp
CA 142.250.69.70:443 12346775.fls.doubleclick.net udp
IE 52.19.37.141:443 c1001.report.gbss.io tcp
US 157.240.254.7:443 static.xx.fbcdn.net udp
US 172.253.115.155:443 stats.g.doubleclick.net tcp
US 40.90.70.14:443 www.clarity.ms tcp
US 157.240.254.35:443 www.facebook.com tcp
US 172.67.142.222:443 static-event.com tcp
US 104.21.48.1:443 s.retargeted.co tcp
US 157.240.254.35:443 www.facebook.com tcp
US 157.240.254.35:443 www.facebook.com tcp
US 104.21.48.1:443 s.retargeted.co udp
US 104.26.4.117:443 push4site.com tcp
US 104.21.48.1:443 s.retargeted.co udp
US 54.82.168.218:443 i.liadm.com tcp
RU 213.180.193.243:443 storage.yandexcloud.net tcp
US 172.67.142.222:443 static-event.com udp
US 141.226.224.32:443 cds.taboola.com tcp
RU 95.181.182.182:443 web-static.mindbox.ru tcp
RU 95.181.182.182:443 web-static.mindbox.ru tcp
CA 142.250.69.68:443 www.google.com tcp
US 3.228.145.4:443 i6.liadm.com tcp
US 52.242.103.142:443 v.clarity.ms tcp
RU 77.88.21.119:443 mc.yandex.ru tcp
US 104.22.79.92:443 www.techspot.com tcp
US 104.22.79.92:443 www.techspot.com tcp
US 104.22.79.92:443 www.techspot.com udp
US 172.64.152.243:443 6093eccf-6734-4877-ac8b-83d6d0e27b46.edge.permutive.app tcp
US 13.249.39.95:443 cmp.inmobi.com tcp
US 3.167.88.35:443 freyr.futurecdn.net tcp
US 104.16.79.73:443 static.cloudflareinsights.com tcp
US 18.160.54.96:443 static.chartbeat.com tcp
US 3.167.88.125:443 bordeaux.futurecdn.net tcp
IE 34.251.226.5:443 eventsproxy.gargantuan.futureplc.com tcp
US 54.226.80.226:443 ping.chartbeat.net tcp
US 13.249.39.95:443 cmp.inmobi.com tcp
CA 142.250.69.46:443 www3.doubleclick.net tcp
US 34.107.254.252:443 api.permutive.com tcp
US 216.239.36.181:443 analytics.google.com tcp
US 172.253.115.155:443 stats.g.doubleclick.net tcp
US 34.107.254.252:443 api.permutive.com udp
US 68.67.160.24:443 ib.adnxs.com tcp
US 35.241.9.51:443 6093eccf-6734-4877-ac8b-83d6d0e27b46.prmutv.co tcp
US 104.17.108.19:443 cdn.permutive.com tcp
US 3.167.112.11:443 ads.servebom.com tcp
US 54.209.53.107:443 sommelier.futurehybrid.tech tcp
US 207.65.37.181:443 image6.pubmatic.com tcp
US 34.107.254.252:443 api.permutive.com udp
CA 142.250.69.33:443 tpc.googlesyndication.com tcp
US 151.101.2.217:443 scripts.webcontentassessor.com tcp
US 18.160.10.121:443 c.aps.amazon-adsystem.com tcp
US 138.199.40.58:443 cdn.pbxai.com tcp
US 172.64.155.110:443 pub.doubleverify.com tcp
US 99.84.188.35:443 ats-wrapper.privacymanager.io tcp
US 18.154.234.231:443 cdn.prod.euid.eu tcp
CA 142.250.69.33:443 tpc.googlesyndication.com tcp
CA 142.250.69.68:443 www.google.com tcp
US 3.33.220.150:443 insight.adsrvr.org tcp
US 34.227.131.32:443 idx.liadm.com tcp
US 34.107.165.188:443 api.rlcdn.com tcp
US 172.64.155.110:443 pub.doubleverify.com udp
CA 142.250.69.68:443 www.google.com udp
CA 142.250.69.33:443 tpc.googlesyndication.com tcp
CA 142.250.69.33:443 tpc.googlesyndication.com tcp
CA 142.250.69.33:443 tpc.googlesyndication.com tcp
CA 142.250.69.33:443 tpc.googlesyndication.com tcp
CA 142.250.69.33:443 tpc.googlesyndication.com tcp
US 216.239.36.181:443 analytics.google.com udp
CA 142.250.69.46:443 www3.doubleclick.net udp
US 157.240.254.35:443 www.facebook.com tcp
US 3.171.86.171:443 c.amazon-adsystem.com tcp
US 18.160.10.17:443 config.aps.amazon-adsystem.com tcp
US 3.171.86.171:443 c.amazon-adsystem.com tcp
US 3.171.100.54:443 geo.privacymanager.io tcp
US 104.18.28.101:443 cdn-ima.33across.com tcp
US 57.144.174.128:443 scontent-ord5-3.xx.fbcdn.net tcp
US 104.22.53.86:443 cdn.id5-sync.com tcp
US 3.167.69.51:443 tags.crwdcntrl.net tcp
US 157.240.254.7:443 static.xx.fbcdn.net tcp
US 157.240.254.7:443 static.xx.fbcdn.net tcp
US 157.240.254.7:443 static.xx.fbcdn.net tcp
US 157.240.254.7:443 static.xx.fbcdn.net tcp
US 157.240.254.7:443 static.xx.fbcdn.net tcp
US 157.240.254.7:443 static.xx.fbcdn.net tcp
US 52.70.195.169:443 rp.liadm.com tcp
US 35.244.193.51:443 lexicon.33across.com tcp
US 54.221.197.184:443 bcp.crwdcntrl.net tcp
US 157.240.254.7:443 static.xx.fbcdn.net tcp
US 3.220.27.227:443 floor.pbxai.com tcp
US 104.18.26.193:443 htlb.casalemedia.com tcp
US 3.87.46.209:443 match.sharethrough.com tcp
US 69.147.92.12:443 ups.analytics.yahoo.com tcp
US 35.211.202.130:443 x.bidswitch.net tcp
US 23.45.193.13:443 ads.pubmatic.com tcp
US 23.50.64.216:443 secure-assets.rubiconproject.com tcp
US 157.240.254.7:443 static.xx.fbcdn.net udp
US 157.240.254.7:443 static.xx.fbcdn.net udp
US 8.8.8.8:53 lb.eu-1-id5-sync.com udp
US 34.98.64.218:443 us-u.openx.net tcp
US 52.202.205.33:443 ap.lijit.com tcp
US 44.219.22.40:443 cs.yellowblue.io tcp
DE 162.19.138.118:443 lb.eu-1-id5-sync.com tcp
DE 141.95.98.64:443 lb.eu-1-id5-sync.com tcp
US 18.160.3.5:443 aax.amazon-adsystem.com tcp
US 35.71.139.29:443 eb2.3lift.com tcp
DE 135.125.247.202:443 lbs.eu-1-id5-sync.com tcp
US 35.212.18.61:443 visitor.omnitagjs.com tcp
US 18.165.98.12:443 pixel.servebom.com tcp
US 8.8.8.8:53 eus.rubiconproject.com udp
US 18.165.98.12:443 pixel.servebom.com tcp
US 18.165.98.12:443 pixel.servebom.com tcp
US 18.165.98.12:443 pixel.servebom.com tcp
US 125.253.89.186:443 prebid.a-mo.net tcp
US 207.65.37.179:443 hbopenbid.pubmatic.com tcp
US 44.214.38.133:443 tlx.3lift.com tcp
US 104.18.26.193:443 htlb.casalemedia.com tcp
US 35.186.253.211:443 rtb.openx.net tcp
US 199.250.161.129:443 direct.adsrvr.org tcp
US 74.119.117.12:443 grid-bidder.criteo.com tcp
CA 142.250.69.33:443 tpc.googlesyndication.com udp
US 35.211.202.130:443 x.bidswitch.net udp
US 18.165.98.12:443 pixel.servebom.com tcp
US 8.8.8.8:53 match.prod.bidr.io udp
US 23.200.198.128:443 eus.rubiconproject.com tcp
US 69.173.146.10:443 fastlane.rubiconproject.com tcp
US 104.18.42.239:443 vtrk.doubleverify.com tcp
US 38.68.201.140:443 aep.mxptint.net tcp
US 38.68.201.140:443 aep.mxptint.net tcp
US 199.38.167.130:443 a.rfihub.com tcp
US 199.38.167.130:443 a.rfihub.com tcp
US 3.213.237.207:443 match.prod.bidr.io tcp
US 3.213.237.207:443 match.prod.bidr.io tcp
US 74.119.117.16:443 dis.criteo.com tcp
US 44.195.160.123:443 sync.srv.stackadapt.com tcp
US 44.195.160.123:443 sync.srv.stackadapt.com tcp
NL 185.184.8.90:443 creativecdn.com tcp
US 174.137.133.49:443 dsp.adkernel.com tcp
US 174.137.133.49:443 dsp.adkernel.com tcp
US 35.211.118.13:443 r.bidswitch.net tcp
US 98.82.156.207:443 s.amazon-adsystem.com tcp
US 109.61.86.193:443 api.pbxai.com tcp
US 34.111.113.62:443 pixel.tapad.com tcp
CA 142.250.69.129:443 7fdb436f03c9a2859198a3fc118a152a.safeframe.googlesyndication.com tcp
US 3.211.183.116:443 sync.ipredictive.com tcp
US 67.202.105.21:443 ssc-cms.33across.com tcp
US 67.202.105.21:443 ssc-cms.33across.com tcp
US 67.202.105.21:443 ssc-cms.33across.com tcp
CA 51.222.39.187:443 onetag-sys.com tcp
US 69.173.151.100:443 pixel.rubiconproject.com tcp
US 174.137.133.32:443 sync.adkernel.com tcp
CA 51.222.39.187:443 onetag-sys.com tcp
US 23.206.121.35:443 player.aniview.com tcp
US 68.67.160.24:443 ib.adnxs.com tcp
US 52.202.205.33:443 ap.lijit.com tcp
NL 35.214.128.54:443 csync.loopme.me tcp
US 74.214.194.131:443 bh.contextweb.com tcp
US 8.28.7.82:443 image8.pubmatic.com tcp
US 69.194.240.13:443 sync.1rx.io tcp
US 35.207.24.140:443 rtb.mfadsrvr.com tcp
US 23.83.76.53:443 ssbsync-global.smartadserver.com tcp
US 35.212.59.62:443 sync.inmobi.com tcp
US 38.134.110.233:443 ads.stickyadstv.com tcp
US 34.224.66.164:443 ssp.disqus.com tcp
US 23.83.76.53:443 ssbsync-global.smartadserver.com tcp
US 68.67.181.248:443 secure.adnxs.com tcp
US 67.202.105.34:443 de.tynt.com tcp
US 67.202.105.34:443 de.tynt.com tcp
US 67.202.105.34:443 de.tynt.com tcp
US 35.207.24.140:443 rtb.mfadsrvr.com tcp
US 38.134.110.233:443 ads.stickyadstv.com tcp
US 8.28.7.82:443 image8.pubmatic.com tcp
US 69.194.240.13:443 sync.1rx.io tcp
US 74.214.194.131:443 bh.contextweb.com tcp
CA 51.222.39.187:443 onetag-sys.com udp
DE 188.40.16.220:443 ittpx.eskimi.com tcp
US 54.82.168.218:443 i.liadm.com tcp
US 44.240.159.60:443 rtb.gumgum.com tcp
NL 69.173.156.149:443 pixel-eu.rubiconproject.com tcp
US 151.101.1.229:443 cdn.jsdelivr.net tcp
US 80.77.87.166:443 cs.admanmedia.com tcp
NL 82.145.213.8:443 t.adx.opera.com tcp
US 69.173.151.100:443 pixel.rubiconproject.com tcp
US 35.71.139.29:443 eb2.3lift.com tcp
US 207.65.37.181:443 image6.pubmatic.com tcp
US 8.8.8.8:53 pixel-us-east.rubiconproject.com udp
NL 69.173.156.149:443 pixel-eu.rubiconproject.com tcp
US 69.173.151.100:443 pixel-us-east.rubiconproject.com tcp
US 8.8.8.8:53 a.sportradarserving.com udp
US 8.8.8.8:53 c1.adform.net udp
US 3.33.220.150:443 insight.adsrvr.org tcp
US 151.101.1.108:443 acdn.adnxs.com tcp
US 104.18.25.18:443 js-sec.indexww.com tcp
US 125.253.89.187:443 use3-sync.a-mo.net tcp
US 34.98.64.218:443 u.openx.net tcp
US 74.119.117.17:443 gum.criteo.com tcp
US 69.173.151.100:443 pixel-us-east.rubiconproject.com tcp
US 185.167.164.52:443 c1.adform.net tcp
US 52.2.2.72:443 rtb.adentifi.com tcp
US 192.132.33.68:443 bttrack.com tcp
US 35.211.155.243:443 a.sportradarserving.com tcp
US 69.173.151.100:443 pixel-us-east.rubiconproject.com tcp
US 34.111.113.62:443 pixel.tapad.com udp
US 67.202.105.33:443 hde.tynt.com tcp
US 67.202.105.33:443 hde.tynt.com tcp
US 67.202.105.33:443 hde.tynt.com tcp
US 8.8.8.8:53 rtb.bid.com udp
US 8.8.8.8:53 jadserve.postrelease.com udp
US 104.18.26.193:443 dsum.casalemedia.com udp
US 54.88.167.146:443 dpm.demdex.net tcp
DE 80.82.210.217:443 dsp-cookie.adfarm1.adition.com tcp
US 192.184.68.166:443 cms.quantserve.com tcp
US 50.31.142.255:443 b1sync.zemanta.com tcp
US 50.31.142.255:443 b1sync.zemanta.com tcp
US 216.22.16.40:443 rtb-csync.smartadserver.com tcp
US 80.77.84.209:443 usync.smxconv.com tcp
US 18.210.229.239:443 jadserve.postrelease.com tcp
US 23.57.90.69:443 hb.trustedstack.com tcp
US 80.77.84.96:443 csync.copper6.com tcp
US 18.165.98.11:443 api-ssp.spot.im tcp
US 208.115.233.54:443 sync.richaudience.com tcp
US 34.192.199.220:443 ms-cookie-sync.presage.io tcp
US 18.67.76.38:443 staging-ib.3lift.com tcp
US 44.214.38.133:443 staging-tlx.3lift.com tcp
US 204.62.12.186:443 sync.contextualadv.com tcp
US 18.160.10.4:443 check.analytics.rlcdn.com tcp
US 80.77.84.209:443 usync.smxconv.com tcp
US 69.173.151.100:443 pixel-us-east.rubiconproject.com tcp
US 69.173.151.100:443 pixel-us-east.rubiconproject.com tcp
US 80.77.84.96:443 csync.copper6.com tcp
US 208.115.233.54:443 sync.richaudience.com tcp
IE 67.220.226.238:443 aax-eu.amazon-adsystem.com tcp
US 3.211.183.116:443 sync.ipredictive.com tcp
US 69.173.151.100:443 pixel-us-east.rubiconproject.com tcp
US 204.62.12.186:443 sync.clearnview.com tcp
US 35.207.24.140:443 rtb.mfadsrvr.com udp
US 35.211.155.243:443 a.sportradarserving.com udp
US 8.8.8.8:53 www.temu.com udp
US 125.253.89.186:443 use3-sync.a-mo.net tcp
US 20.33.69.37:443 www.temu.com tcp
US 80.77.81.74:443 sync.screencore.io tcp
US 52.45.182.175:443 thrtle.com tcp
US 18.67.76.38:443 staging-ib.3lift.com udp
US 159.127.42.108:443 prebid-match.dotomi.com tcp
US 8.28.7.83:443 simage2.pubmatic.com tcp
US 34.111.113.62:443 pixel.tapad.com tcp
NL 35.214.128.54:443 csync.loopme.me tcp
US 44.240.159.60:443 rtb.gumgum.com tcp
US 80.77.81.74:443 sync.screencore.io tcp
US 107.23.216.106:443 ads.yieldmo.com tcp
US 34.98.64.218:443 u.openx.net udp
US 35.212.18.61:443 visitor-risecode.omnitagjs.com tcp
US 35.212.38.52:443 s.ad.smaato.net tcp
DK 37.157.6.230:443 cm.adform.net tcp
US 69.166.1.67:443 sync.go.sonobi.com tcp
US 23.12.44.83:443 hbx.media.net tcp
US 74.119.117.39:443 ssp-sync.criteo.com tcp
US 69.173.151.100:443 pixel-us-east.rubiconproject.com tcp
US 52.73.214.26:443 staging-eb2.3lift.com tcp
US 52.73.214.26:443 staging-eb2.3lift.com tcp
US 52.73.214.26:443 staging-eb2.3lift.com tcp
US 52.73.214.26:443 staging-eb2.3lift.com tcp
US 52.73.214.26:443 staging-eb2.3lift.com tcp
US 52.73.214.26:443 staging-eb2.3lift.com tcp
US 3.213.166.117:443 pixel.adsafeprotected.com tcp
US 13.249.39.44:443 ib.3lift.com tcp
US 13.249.39.44:443 ib.3lift.com tcp
US 80.77.81.74:443 sync.screencore.io tcp
US 23.105.12.158:443 ssbsync-us.smartadserver.com tcp
US 34.96.71.22:443 s.company-target.com tcp
US 64.202.112.191:443 b1sync.outbrain.com tcp
US 216.34.207.204:443 equativ-match.dotomi.com tcp
US 52.85.132.55:443 cdn.undertone.com tcp
US 8.8.8.8:53 uipglob.semasio.net udp
US 8.8.8.8:53 um.simpli.fi udp
US 8.8.8.8:53 pr-bh.ybp.yahoo.com udp
US 8.8.8.8:53 pubmatic-match.dotomi.com udp
US 69.173.151.100:443 pixel-us-east.rubiconproject.com tcp
US 8.8.8.8:53 pixel-sync.sitescout.com udp
US 8.8.8.8:53 ad.turn.com udp
US 8.8.8.8:53 pmp.mxptint.net udp
US 8.8.8.8:53 cs.media.net udp
US 151.101.66.49:443 sync-tm.everesttech.net tcp
US 34.149.50.64:443 s.seedtag.com tcp
US 69.194.242.12:443 ad.turn.com tcp
US 23.200.196.24:443 cs.media.net tcp
US 35.244.154.8:443 id.rlcdn.com tcp
US 38.68.201.140:443 pmp.mxptint.net tcp
US 172.64.150.63:443 s.tribalfusion.com tcp
US 199.38.167.131:443 p.rfihub.com tcp
US 205.180.85.204:443 pubmatic-match.dotomi.com tcp
US 18.215.216.91:443 pr-bh.ybp.yahoo.com tcp
US 34.150.170.96:443 um.simpli.fi tcp
US 54.83.52.148:443 beacon.lynx.cognitivlabs.com tcp
US 34.36.216.150:443 pixel-sync.sitescout.com tcp
US 50.57.31.206:443 uipglob.semasio.net tcp
US 80.77.82.130:443 cs.krushmedia.com tcp
CA 148.113.153.93:443 pixel.onaudience.com tcp
US 64.202.112.191:443 b1sync.outbrain.com tcp
US 50.31.142.255:443 b1sync.zemanta.com tcp
US 98.82.156.207:443 s.amazon-adsystem.com tcp
US 23.12.44.83:443 hbx.media.net udp
US 98.82.156.207:443 s.amazon-adsystem.com tcp
US 3.213.237.207:443 match.prod.bidr.io tcp
US 8.18.47.7:443 match.deepintent.com tcp
US 34.102.163.6:443 ad.mrtnsvr.com tcp
US 204.62.12.186:443 sync.clearnview.com tcp
US 52.55.8.253:443 crb.kargo.com tcp
US 23.44.129.59:443 cdn.doubleverify.com tcp
US 54.146.247.233:443 sync-amz.ads.yieldmo.com tcp
US 35.244.154.8:443 id.rlcdn.com tcp
US 44.219.45.252:443 sonata-notifications.taptapnetworks.com tcp
US 80.77.82.130:443 cs.krushmedia.com tcp
US 35.211.202.130:443 x.bidswitch.net tcp
DE 162.19.138.118:443 lb.eu-1-id5-sync.com tcp
US 34.102.163.6:443 ad.mrtnsvr.com tcp
DK 37.157.6.230:443 cm.adform.net tcp
US 34.102.163.6:443 ad.mrtnsvr.com tcp
US 44.219.22.40:443 cs-tam.yellowblue.io tcp
US 35.190.90.30:443 odr.mookie1.com tcp
US 54.86.225.137:443 ce.lijit.com tcp
US 69.194.240.13:443 sync.targeting.unrulymedia.com tcp
US 3.171.85.59:443 static.adsafeprotected.com tcp
US 216.22.16.40:443 rtb-csync.smartadserver.com tcp
US 216.34.207.204:443 triplelift-match.dotomi.com tcp
US 8.28.7.83:443 simage2.pubmatic.com tcp
US 8.28.7.83:443 simage2.pubmatic.com tcp
US 8.28.7.83:443 simage2.pubmatic.com tcp
US 80.77.84.96:443 csync.copper6.com tcp
US 107.23.216.106:443 ads.yieldmo.com tcp
US 104.18.37.193:443 s.tribalfusion.com tcp
US 67.202.105.21:443 ssc-cms.33across.com tcp
US 80.77.84.96:443 csync.copper6.com tcp
US 34.117.228.201:443 tps.doubleverify.com tcp
US 107.20.188.173:443 ice.360yield.com tcp
US 23.83.76.53:443 ssbsync-global.smartadserver.com tcp
US 23.50.64.216:443 secure-assets.rubiconproject.com tcp
US 35.212.18.61:443 visitor-risecode.omnitagjs.com tcp
US 150.171.22.12:443 px.ads.linkedin.com tcp
US 172.67.72.91:443 files04.tchspt.com tcp
US 204.62.12.198:443 sync.clearnview.com tcp
US 69.147.92.11:443 pbs.yahoo.com tcp
US 18.165.98.11:443 live.primis.tech tcp
US 172.64.146.152:443 capi.connatix.com tcp
US 23.45.193.13:443 ads.pubmatic.com tcp
US 3.213.166.117:443 pixel.adsafeprotected.com tcp
US 23.200.198.128:443 eus.rubiconproject.com tcp
US 52.21.176.51:443 dt.adsafeprotected.com tcp
US 52.21.176.51:443 dt.adsafeprotected.com tcp
US 52.21.176.51:443 dt.adsafeprotected.com tcp
US 34.117.228.201:443 tps.doubleverify.com tcp
US 34.36.216.150:443 pixel-sync.sitescout.com udp
US 23.33.42.83:443 servedby.flashtalking.com tcp
US 69.147.92.11:443 pbs.yahoo.com tcp
US 207.65.37.182:443 image4.pubmatic.com tcp
US 52.85.132.15:443 sync.intentiq.com tcp
US 3.33.220.150:443 insight.adsrvr.org tcp
US 151.101.66.49:443 rtd-tm.everesttech.net tcp
US 68.67.160.24:443 ib.adnxs.com tcp
US 54.86.225.137:443 ce.lijit.com tcp
US 172.240.45.96:443 sync.aniview.com tcp
US 35.212.18.61:443 visitor-risecode.omnitagjs.com tcp
US 64.202.112.191:443 b1sync.outbrain.com tcp
US 208.115.233.54:443 sync.richaudience.com tcp
US 52.202.205.33:443 ap.lijit.com tcp
US 35.186.253.211:443 rtb.openx.net tcp
US 34.192.199.220:443 ms-cookie-sync.presage.io tcp
US 68.67.181.248:443 secure.adnxs.com tcp
US 35.211.246.180:443 tps-dn-ue1.doubleverify.com tcp
US 99.86.229.20:443 cs.openwebmp.com tcp
US 104.18.12.250:443 a.amxrtb.com tcp
US 3.171.100.93:443 usr.undertone.com tcp
US 3.167.56.72:443 ajs-assets.ftstatic.com tcp
US 184.73.75.189:443 sync.crwdcntrl.net tcp
US 38.68.201.140:443 pmp.mxptint.net tcp
US 35.244.154.8:443 id.rlcdn.com udp
US 69.194.240.13:443 sync.targeting.unrulymedia.com tcp
NL 82.145.213.8:443 t.adx.opera.com tcp
US 74.119.117.39:443 ssp-sync.criteo.com tcp
US 8.28.7.82:443 image8.pubmatic.com tcp
US 185.167.164.52:443 c1.adform.net tcp
NL 185.184.8.90:443 creativecdn.com tcp
US 35.244.154.8:443 id.rlcdn.com udp
US 98.82.156.207:443 s.amazon-adsystem.com tcp
US 98.82.156.207:443 s.amazon-adsystem.com tcp
US 3.171.100.93:443 usr.undertone.com tcp
US 207.65.37.181:443 image6.pubmatic.com tcp
US 35.190.90.30:443 odr.mookie1.com udp
US 64.227.20.15:443 sync.cootlogix.com tcp
US 161.47.50.224:443 sg.semasio.net tcp
US 98.82.156.207:443 s.amazon-adsystem.com tcp
US 34.149.50.64:443 s.seedtag.com udp
US 8.28.7.84:443 simage4.pubmatic.com tcp
US 23.33.42.71:443 global.ib-ibi.com tcp
US 69.166.1.67:443 sync.go.sonobi.com tcp
CA 148.113.153.93:443 pixel.onaudience.com tcp
US 67.202.105.34:443 de.tynt.com tcp
US 54.87.127.173:443 usersync.gumgum.com tcp
US 54.87.127.173:443 usersync.gumgum.com tcp
US 80.77.82.130:443 cs.krushmedia.com tcp
US 192.132.33.68:443 bttrack.com tcp
US 69.173.151.100:443 pixel-us-east.rubiconproject.com tcp
JP 124.146.153.153:443 tg.socdm.com tcp
US 52.73.214.26:443 staging-eb2.3lift.com tcp
US 35.71.139.29:443 eb2.3lift.com tcp
US 74.214.194.131:443 bh.contextweb.com tcp
US 54.87.127.173:443 usersync.gumgum.com tcp
US 8.2.111.13:443 cs.iqzone.com tcp
US 216.34.207.169:443 33across-match.dotomi.com tcp
US 18.154.227.40:443 agen-assets.ftstatic.com tcp
US 192.184.68.166:443 cms.quantserve.com tcp
US 8.8.8.8:53 data.adsrvr.org udp
US 8.8.8.8:53 sync.serverbid.com udp
US 52.45.182.175:443 thrtle.com tcp
JP 124.146.153.153:443 tg.socdm.com tcp
US 44.195.160.123:443 sync.srv.stackadapt.com tcp
US 3.211.183.116:443 sync.ipredictive.com tcp
US 3.171.76.109:443 sync.serverbid.com tcp
US 8.2.111.13:443 cs.iqzone.com tcp
US 3.87.46.209:443 match.sharethrough.com tcp
US 216.200.232.253:443 sync.mathtag.com tcp
US 23.33.42.88:443 ib.mookie1.com tcp
NL 188.166.17.21:443 match.adsby.bidtheatre.com tcp
NL 35.214.128.54:443 csync.loopme.me tcp
US 20.33.69.37:443 www.temu.com udp
US 44.221.2.112:443 cm.adgrx.com tcp
US 52.72.224.227:443 ad-events.flashtalking.com tcp
US 3.162.125.70:443 cdn.flashtalking.com tcp
US 35.186.193.173:443 ipac.ctnsnet.com tcp
US 35.186.253.211:443 rtb.openx.net udp
CA 51.222.39.187:443 onetag-sys.com tcp
US 159.127.42.108:443 prebid-match.dotomi.com tcp
US 34.117.228.201:443 tpsc-ue1.doubleverify.com tcp
US 80.77.82.130:443 cs.krushmedia.com tcp
US 54.82.168.218:443 i.liadm.com tcp
US 74.119.117.17:443 gum.criteo.com tcp
US 138.199.41.120:443 id.a-mx.com tcp
US 13.249.39.128:443 aa.agkn.com tcp
US 50.31.142.255:443 b1sync.zemanta.com tcp
US 8.8.8.8:53 dmp.brand-display.com udp
US 34.117.239.71:443 events-ssc.33across.com tcp
US 34.160.19.107:443 dmp.brand-display.com tcp
US 50.31.142.255:443 b1sync.zemanta.com tcp
US 125.253.89.186:443 use3-sync.a-mo.net tcp
US 69.194.240.13:443 sync.targeting.unrulymedia.com tcp
US 44.240.159.60:443 rtb.gumgum.com tcp
US 54.87.127.173:443 usersync.gumgum.com tcp
US 54.87.127.173:443 usersync.gumgum.com tcp
US 54.87.127.173:443 usersync.gumgum.com tcp
US 34.117.228.201:443 tpsc-ue1.doubleverify.com tcp
FR 51.255.68.171:443 dsp.nrich.ai tcp
US 150.171.28.10:443 c.bing.com tcp
US 64.202.112.191:443 b1sync.outbrain.com tcp
US 125.253.89.187:443 use3-sync.a-mo.net tcp
US 3.162.125.70:443 cdn.flashtalking.com tcp
NL 82.145.213.8:443 t.adx.opera.com tcp
CA 148.113.153.93:443 pixel.onaudience.com tcp
US 50.57.31.206:443 uipglob.semasio.net tcp
US 216.22.16.40:443 sync.smartadserver.com tcp
US 3.171.100.93:443 usr.undertone.com tcp
CA 51.222.39.187:443 onetag-sys.com tcp
US 23.33.42.71:443 global.ib-ibi.com tcp
US 50.31.142.255:443 b1sync.zemanta.com tcp
US 69.194.240.13:443 sync.targeting.unrulymedia.com tcp
US 35.212.18.61:443 visitor-risecode.omnitagjs.com tcp
US 35.212.18.61:443 visitor-risecode.omnitagjs.com tcp
US 125.253.89.175:443 sync.a-mo.net tcp
US 125.253.89.175:443 sync.a-mo.net tcp
US 52.21.176.51:443 dt.adsafeprotected.com tcp
US 35.211.202.130:443 x.bidswitch.net tcp
US 68.67.181.248:443 secure.adnxs.com tcp
US 69.194.242.12:443 d.turn.com tcp
US 54.88.167.146:443 dpm.demdex.net tcp
US 34.117.239.71:443 events-ssc.33across.com udp
US 35.211.202.130:443 x.bidswitch.net tcp
US 74.119.117.39:443 ssp-sync.criteo.com tcp
US 52.45.182.175:443 thrtle.com tcp
US 34.192.199.220:443 ms-cookie-sync.presage.io tcp
US 138.199.41.120:443 id.rtb.mx tcp
US 138.199.41.120:443 id.rtb.mx tcp
US 207.65.37.181:443 image6.pubmatic.com tcp
US 3.167.88.60:443 live.rezync.com tcp
US 125.253.89.187:443 use3-sync.a-mo.net tcp
US 125.253.89.187:443 use3-sync.a-mo.net tcp
US 125.253.89.187:443 use3-sync.a-mo.net tcp
US 125.253.89.187:443 use3-sync.a-mo.net tcp
US 125.253.89.187:443 use3-sync.a-mo.net tcp
US 74.119.117.39:443 ssp-sync.criteo.com tcp
US 35.211.202.130:443 x.bidswitch.net tcp
US 3.167.88.60:443 live.rezync.com tcp
US 18.215.216.91:443 pr-bh.ybp.yahoo.com tcp
US 69.194.242.12:443 d.turn.com tcp
US 35.71.139.29:443 eb2.3lift.com tcp
US 3.33.220.150:443 data.adsrvr.org tcp
US 216.34.207.204:443 triplelift-match.dotomi.com tcp
US 74.119.117.39:443 ssp-sync.criteo.com tcp
US 74.119.117.16:443 dis.criteo.com tcp
US 50.31.142.255:443 b1sync.zemanta.com tcp
US 8.28.7.84:443 simage4.pubmatic.com tcp
NL 35.214.128.54:443 csync.loopme.me tcp
US 44.221.2.112:443 cm.adgrx.com tcp
US 216.34.207.204:443 triplelift-match.dotomi.com tcp
US 35.186.193.173:443 ipac.ctnsnet.com udp
US 74.119.117.39:443 ssp-sync.criteo.com tcp
US 74.119.117.16:443 dis.criteo.com tcp
US 35.71.139.29:443 eb2.3lift.com tcp
US 35.71.139.29:443 eb2.3lift.com tcp
US 35.71.139.29:443 eb2.3lift.com tcp
US 8.28.7.84:443 simage4.pubmatic.com tcp
NL 35.214.128.54:443 csync.loopme.me tcp
US 44.221.2.112:443 cm.adgrx.com tcp
NL 185.184.8.90:443 creativecdn.com tcp
US 185.167.164.52:443 c1.adform.net tcp
US 216.200.232.253:443 sync.mathtag.com tcp
US 8.28.7.83:443 simage2.pubmatic.com tcp
US 74.119.117.39:443 ssp-sync.criteo.com tcp
US 159.89.252.170:443 sync.resetdigital.co tcp
US 69.90.254.78:443 ums.acuityplatform.com tcp
US 80.77.81.74:443 sync.screencore.io tcp
US 35.211.202.130:443 x.bidswitch.net udp
US 98.82.156.207:443 s.amazon-adsystem.com tcp
US 172.253.62.94:443 beacons.gcp.gvt2.com udp
US 69.194.240.13:443 sync.targeting.unrulymedia.com tcp
US 54.82.168.218:443 i.liadm.com tcp
US 23.33.42.88:443 ib.mookie1.com tcp
US 125.253.89.186:443 use3-sync.a-mo.net tcp
US 54.226.80.226:443 ping.chartbeat.net tcp
US 172.253.62.94:443 beacons.gcp.gvt2.com tcp
US 69.194.240.13:443 sync.targeting.unrulymedia.com tcp
US 54.82.168.218:443 i.liadm.com tcp
US 23.33.42.88:443 ib.mookie1.com tcp
US 125.253.89.186:443 use3-sync.a-mo.net tcp
US 54.226.80.226:443 ping.chartbeat.net tcp
US 125.253.89.186:443 use3-sync.a-mo.net tcp
US 69.147.92.11:443 pbs.yahoo.com tcp
US 121.127.42.98:443 id.rtb.mx tcp
US 207.65.32.79:443 ow.pubmatic.com tcp
US 68.67.153.61:443 prebid.adnxs.com tcp
US 121.127.42.98:443 id.rtb.mx tcp
US 207.65.32.79:443 ow.pubmatic.com tcp
US 68.67.153.61:443 prebid.adnxs.com tcp
US 74.119.117.16:443 dis.criteo.com tcp
US 8.2.111.13:443 cs.iqzone.com tcp
DE 80.82.210.217:443 dsp-cookie.adfarm1.adition.com tcp
US 174.137.133.32:443 sync.adkernel.com tcp
CA 148.113.153.93:443 pixel.onaudience.com tcp
US 74.119.117.16:443 dis.criteo.com tcp
DE 80.82.210.217:443 dsp-cookie.adfarm1.adition.com tcp
US 174.137.133.32:443 sync.adkernel.com tcp
CA 148.113.153.93:443 pixel.onaudience.com tcp
US 40.76.134.238:443 us01.z.antigena.com tcp
IE 34.251.226.5:443 eventsproxy.gargantuan.futureplc.com tcp
US 8.2.111.13:443 cs.iqzone.com tcp
US 8.8.8.8:53 pm.w55c.net udp
US 34.150.170.96:443 um.simpli.fi tcp
SI 195.5.165.20:443 core.iprom.net tcp
JP 172.104.64.149:443 gocm.c.appier.net tcp
US 35.212.33.9:443 pm.w55c.net tcp
JP 172.104.64.149:443 gocm.c.appier.net tcp
US 35.212.33.9:443 pm.w55c.net tcp
US 34.194.181.139:443 fdz.flashtalking.com tcp
US 8.2.111.13:443 cs.iqzone.com tcp
US 3.234.8.37:443 ps.eyeota.net tcp
US 107.178.254.65:443 pippio.com tcp
US 35.212.33.9:443 pm.w55c.net udp
US 3.162.125.70:443 cdn.flashtalking.com tcp
US 23.33.42.83:443 ib.mookie1.com tcp
US 18.160.10.95:443 img.flashtalking.com tcp
US 18.160.10.95:443 img.flashtalking.com tcp
US 18.160.10.95:443 img.flashtalking.com tcp
US 18.160.10.95:443 img.flashtalking.com tcp
US 18.160.10.95:443 img.flashtalking.com tcp
SI 195.5.165.20:443 core.iprom.net tcp
US 8.28.7.84:443 simage4.pubmatic.com tcp
SI 195.5.165.20:443 core.iprom.net tcp
US 161.47.50.224:443 su.semasio.net tcp
SI 195.5.165.20:443 core.iprom.net tcp
SI 195.5.165.20:443 core.iprom.net tcp
US 68.67.160.24:443 ib.adnxs.com tcp
US 68.67.160.24:443 ib.adnxs.com tcp
US 161.47.50.224:443 su.semasio.net tcp
US 69.194.242.12:443 d.turn.com tcp
US 151.101.130.49:443 rtd-tm.everesttech.net tcp
US 34.117.228.201:443 tpsc-ue1.doubleverify.com tcp
US 80.77.82.130:443 cs.krushmedia.com tcp
US 80.77.82.130:443 cs.krushmedia.com tcp
US 54.226.80.226:443 ping.chartbeat.net tcp
US 52.21.176.51:443 dt.adsafeprotected.com tcp
US 34.117.228.201:443 tpsc-ue1.doubleverify.com tcp
US 13.249.39.95:443 cmp.inmobi.com tcp
IE 34.251.226.5:443 eventsproxy.gargantuan.futureplc.com tcp
CA 142.250.69.46:443 analytics.google.com udp
US 13.249.39.95:443 cmp.inmobi.com tcp
US 54.209.53.107:443 sommelier.futurehybrid.tech tcp
US 172.64.155.110:443 pub.doubleverify.com udp
US 3.220.27.227:443 floor.pbxai.com tcp
US 52.70.195.169:443 rp.liadm.com tcp
US 157.240.254.35:443 www.facebook.com udp
US 172.253.62.94:443 beacons.gcp.gvt2.com tcp
US 172.253.62.94:443 beacons.gcp.gvt2.com udp
US 172.253.62.94:443 beacons.gcp.gvt2.com udp
US 54.187.107.225:443 api2.amplitude.com tcp
US 172.64.155.110:443 pub.doubleverify.com udp
US 74.119.117.12:443 grid-bidder.criteo.com tcp
US 35.186.253.211:443 rtb.openx.net udp
US 104.18.26.193:443 dsum.casalemedia.com udp
US 207.65.37.179:443 hbopenbid.pubmatic.com tcp
US 8.8.8.8:53 ib.adnxs.com udp
US 125.253.89.186:443 use3-sync.a-mo.net tcp
US 8.8.8.8:53 fastlane.rubiconproject.com udp
US 172.253.62.94:443 beacons.gcp.gvt2.com tcp
US 172.253.62.94:443 beacons.gcp.gvt2.com tcp
US 3.167.112.95:443 ads.servebom.com tcp
US 3.167.100.35:443 aax.amazon-adsystem.com tcp
US 3.220.27.227:443 floor.pbxai.com tcp
US 68.67.161.208:443 ib.adnxs.com tcp
US 199.250.161.129:443 direct.adsrvr.org tcp
US 69.173.146.10:443 fastlane.rubiconproject.com tcp
US 172.64.145.17:443 vtrk.doubleverify.com udp
US 138.199.40.58:443 api.pbxai.com tcp
CA 142.250.69.33:443 tpc.googlesyndication.com tcp
CA 142.250.69.33:443 tpc.googlesyndication.com udp
US 125.253.89.186:443 use3-sync.a-mo.net tcp
US 34.98.64.218:443 u.openx.net udp
US 3.33.220.150:443 data.adsrvr.org tcp
CA 142.250.69.97:443 cdn.ampproject.org tcp
CA 142.250.69.97:443 cdn.ampproject.org tcp
CA 142.250.69.97:443 cdn.ampproject.org tcp
CA 142.250.69.97:443 cdn.ampproject.org tcp
CA 142.250.69.97:443 cdn.ampproject.org tcp
US 199.250.161.129:443 direct.adsrvr.org tcp
CA 142.250.69.33:443 tpc.googlesyndication.com tcp
CA 142.250.69.33:443 tpc.googlesyndication.com tcp
CA 142.250.69.33:443 tpc.googlesyndication.com tcp
CA 142.250.69.68:443 www.google.com tcp
IE 34.251.226.5:443 eventsproxy.gargantuan.futureplc.com tcp
CA 142.250.69.46:443 analytics.google.com udp
US 3.208.175.5:443 tlx.3lift.com tcp
US 74.119.117.17:443 gum.criteo.com tcp
US 68.67.161.208:443 ib.adnxs.com tcp

Files

memory/956-1-0x0000000003280000-0x0000000003290000-memory.dmp

memory/956-0-0x0000000003280000-0x0000000003290000-memory.dmp

memory/956-2-0x0000000003280000-0x0000000003290000-memory.dmp

C:\$Recycle.Bin\S-1-5-21-2329104403-2882594830-3136665766-1000\QQQQQQQQQQQ

MD5 bb4df7426248b21a855048f17e360ffd
SHA1 8b39b81d46d828d3264643d016b49819ddd793ea
SHA256 4d6d5febe580bc36eb21b61d02ab69a1ab4de5133bc2129dc53c804691c87b72
SHA512 dfa893b29ae6e68bd034c0c3adb06a6ecb2c1dd10b2380b522a1a1f05d5f30adb1626ba2f3b763a10a45d7d1efc1e21a91ae6e945a2dd68979b78441c34eec69

C:\g0Bwcr1Ri.README.txt

MD5 12fcb2dec1dbac71a963feda7d45d436
SHA1 c2b8f7b9ca9350e77997905a6b1ab42b7332b32b
SHA256 aa5a23974d3aa4caa9afd4c54a571c559442197cf2782ff175b4a3f6152a468d
SHA512 ad2f8a9a5f816816e7eeceeccafaec7c6f958c82f3c157fbfa122af2e41ec9acf682454962a6136abc219b781ac390dac56af3a8d24400abe86af9584f4ea521

F:\$RECYCLE.BIN\S-1-5-21-2329104403-2882594830-3136665766-1000\DDDDDDDDDDD

MD5 e15de78c23ca6899a32249aa2b45f212
SHA1 3e65d96c02013a520d39e54aaa948dda33bbc826
SHA256 850b2a3b2878c5ac919679f708fed16605432921ac7ddeeb46274e7e1f1fc7a5
SHA512 4ada5cad1a1ab5a36d560d0662ac061337a80919a4115c93a536d6f359f12c4bb9946037b9dc121d7282f74ef9dfa6a944f91c12a701059f89f6ccf43668fe0a

memory/956-3653-0x0000000003280000-0x0000000003290000-memory.dmp

memory/956-3654-0x0000000003280000-0x0000000003290000-memory.dmp

memory/956-3655-0x0000000003280000-0x0000000003290000-memory.dmp

C:\ProgramData\ABC2.tmp

MD5 294e9f64cb1642dd89229fff0592856b
SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

memory/5068-3675-0x00007FF93BCF0000-0x00007FF93BD00000-memory.dmp

memory/5068-3676-0x00007FF93BCF0000-0x00007FF93BD00000-memory.dmp

memory/5068-3674-0x00007FF93BCF0000-0x00007FF93BD00000-memory.dmp

memory/5068-3673-0x00007FF93BCF0000-0x00007FF93BD00000-memory.dmp

memory/5068-3670-0x00007FF93BCF0000-0x00007FF93BD00000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD

MD5 16d2716ac2c5b320cb7a2e52f308ca8a
SHA1 55863e62f09107fa39757f745a1e1f19ad62b9cb
SHA256 e1a048e716ab33fec41f131ca6b72dee3d07e238b1db620b10fbc1e3af3b9974
SHA512 e863a9ab86fef15a5ccc4e68468e64efc2c089d5f3380d315a64a6f53803db90042ee2d709b14c303751548afcca80a190a4ed47099f97913436fd53a86a3f10

memory/5068-3705-0x00007FF939150000-0x00007FF939160000-memory.dmp

memory/5068-3706-0x00007FF939150000-0x00007FF939160000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\{046DDBAA-AAE3-44D2-BED6-91CC7B98CE10}

MD5 611c40a96d3922595ca707f4149edb9d
SHA1 be6c9c403c102c8ab240bac1d5ad328654796625
SHA256 ef94292b4e94582b9b919f341908d7cc45aadfdf3b728db815805be51a575b96
SHA512 f7185e2cb01493b93275f8def509c3590da4b0e4219ab642363ae7a119a83e3d68754b421cb98f30dea26a2c5a84d1ed8535b645e54f2ed095ce8638ae3a3926

C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2

MD5 19f0c006ffa02f32ad6625aae63d9ba2
SHA1 8d052edf56d0663555bab120cab10172eaac475f
SHA256 9c126085fc0027b60edbb41df168a3983c11e19549c0c50d56a52610545f35a4
SHA512 6d7178b9ce73c8d1c8bbe958f28f26d2bebd55b0474eeaea8c7649b5f7e302f7171032a4a39c0e05b0d1d4fe8bf5819d728f68222c622d99ffb15638edcf0c31

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{2EC0DA40-7BDE-4056-B74D-1213298BEFFE}.xps

MD5 44480558bcab47e372caafa11c90aa72
SHA1 2696a570c550b7c7a0f837065beb6228b1768e31
SHA256 a518eeeefaecb0ce48421767643aac958b3745728ab1bfa80a27ae2bd2f2ff27
SHA512 c03f0662d962e518406bc584f6cf8aaad83b2c0f084d06ec2da47ce98366da65f81aea8eb8dbe60214d1357b3dfc15712edf5cce4b9dd059b90e7532d95e22c7

C:\Users\Admin\Documents\OneNote Notebooks\Quick Notes.one

MD5 3ef01df221530206db5469f2c9f71846
SHA1 844bbfd5929608639d31a16edbceb5522cfecd48
SHA256 73cd7a81ce29ee44c5ce2ee963bee0a9349cd323dc2247676c15c4bdb85eac0f
SHA512 0b52e066778be0e60737506b8ff3b593dd202806d4d87332cb6ba2ee6b6c4d5d359907805f62505aa769c565add9b112bedc799507cf53442c77bf5c8a84f1a3

memory/5068-3776-0x00007FF93BCF0000-0x00007FF93BD00000-memory.dmp

memory/5068-3777-0x00007FF93BCF0000-0x00007FF93BD00000-memory.dmp

memory/5068-3779-0x00007FF93BCF0000-0x00007FF93BD00000-memory.dmp

memory/5068-3778-0x00007FF93BCF0000-0x00007FF93BD00000-memory.dmp

\??\pipe\crashpad_5792_ZIDEKJVGDATKSQAK

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico

MD5 505a174e740b3c0e7065c45a78b5cf42
SHA1 38911944f14a8b5717245c8e6bd1d48e58c7df12
SHA256 024ae694ba44ccd2e0914c5e8ee140e6cc7d25b3428d6380102ba09254b0857d
SHA512 7891e12c5ec14b16979f94da0c27ac4629bae45e31d9d1f58be300c4b2bbaee6c77585e534be531367f16826ecbaf8ec70fc13a02beaf36473c448248e4eb911

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

C:\Users\Admin\AppData\Local\Temp\scoped_dir5792_895258282\4d10197f-05ef-4e59-a026-4dde8bb63c88.tmp

MD5 cc05ed3e66468e692745ba6563c69740
SHA1 eae9dbd4d36aa91fd43f7d452ac3d252b103759d
SHA256 fb1311fb7142825abacb3c7aedddf948f5c9b258e447c953ce0f7f4b19c6dfff
SHA512 4b527db02d6ea36b914558a3e44fd3d15772bf2be4ba0a640bf70427af07dcde5ed6967930cc3624a244cfc82290f125eea2754812586216b3d5a37757ce8db4

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

MD5 8782d892c1fc3d12c3917a81f7165a96
SHA1 61de79a20b87d7c3e0d168998efb59e643e1f048
SHA256 d1c983f0ee9d70b150f974925ac9f84ee2e4eff9c4d3f3da9ab77d23a05ce35b
SHA512 0c9d570f0edd56bae1cfb0b0b2998046efd71dcddfb9ac05e3ab7966b39686a455a1c2a1b5c42eb0bf637d7fda324a5a51f68b8ef73cbcc2ee36fa1159c8e41e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 2ae6e06e3d0c7610fe5a7280cbfa2023
SHA1 092f061b15c27bd70ff529a9a32f29acc69e2f8f
SHA256 81742a42a4676feae714f8a4eeea8b2e6763ac8679cbda8f6e06468d5ad1d95a
SHA512 0c1842b5f8a9eb3f9ac20866a179f7259bd9ae174f07fee382f6ffa5f5d6e80e6baa2addd8ec859bdb22964d16da319e1e9a5152080e231357b1163627352a15

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State~RFe5859e3.TMP

MD5 65da6e4244641bbc7aa96bfa2e5e25a2
SHA1 298e340cda09cbcb54adc928db7603b1c9148206
SHA256 92f584b8dfc6dde8703c8721685ce252b679438a92686ce2c934ba6cd3e015f3
SHA512 9e726abe1f1aa9b953c2902afdc5b3bb9372f24b14af85061bedfe4f880044899135b54726da4e032e7df98ad626179ef195db57b0b32439d0590269b7c9ea6d

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 7e9c39816bd8206f28f8fcb593d3bea4
SHA1 832e58d2d90c9f062b3b55d34166f74fb606487a
SHA256 dc72bcc1e0c98dde91f68a67289e3d01c06c8fd536853c0eb11f20031d9bd5f6
SHA512 f253916943f34aec84296b23730344d569f5fb663eedd5b45c2a5f921ae4d914b787f2f9a457e7d2459f8f94080cbf548f5c923821722d0d1a482ac562b554b1

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

MD5 a991c163eb70a9f4035ae54f2b7dab4c
SHA1 f656ddc8054797851c4a4495df0051e7b96cb1e6
SHA256 69556171d259a488b532f1437b8544e3cb76775a78907ce42bfef6d38112efe3
SHA512 b3408cbf8fa19794e1dc0d28abb31dcdf3e1a3e2c0f95b6ff6c4a2c9b166177e4a58a6e09138b8b38ff4e66145d89e8eea9be90584270bf672115ec268b62556

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000025

MD5 4be8adaf33a1f57481cce8789a4b2f8e
SHA1 d51ca58dbda01ef7987c24d23a8801bb5fe10937
SHA256 2f429fb17647097b45b6776460f5bcb2afbb45e35b1c59fe1831c8da42a83e95
SHA512 f631b60560285c9084ceaf32935edb3e5aa7fa036c6585e477b282566b69e9a54836cad84e109e1a8f2f275df65c8b9431b0011c6ecc34a808c2243a3b453a71

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 ec7ffa7dd9a2d713a6175f76a3e87d9f
SHA1 44dcc6e767b03780104c75e45a94f3f7dbcba16e
SHA256 3bffd71cc6af018586acae61edca76f1f6f9715fbee6c309cca2439bed169491
SHA512 0bed38a1a8a088fcd39db9c660b020568848598933de8216213878710b3918dddf9309d3297a748852f34ddb026e67004d63cea3f33ff94fbdca0d8308448a9a

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index

MD5 5eac4e8ca27c5180df8ae1c1beb024a4
SHA1 dbc81a10b1957209d24a87afc22a8d329a0d921c
SHA256 3fd79e7e2bb512186551d00728bb88061cabf20224f9da96a43cdc4c05854171
SHA512 2795505c7e54ab5f4d32d576c5c69e8514cc0efb5b8b6737f01207864f1fe180c8ed8ccc7d24b55034b2ce687ecb9096902e32e7f1424b5688aa27f5948a8c3e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 fbbc7f6bab8103aa77936b10699723c2
SHA1 dedf230b390335f8f773eb05a0c752806226ac90
SHA256 8c72ef6bae4dab2ac1cbecf1bf91db4ab2fc2e864610d3c50b0c751c39d5bf54
SHA512 6e486b636a7eb127feaad4ae55c21dfe03f8550c65b674aa3200ac51ca661f46493e402e0f12c59c5aa38d40624ead05dc975894c24af72a70d083eff7a28b24

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 9f75c885f7e73d2a6bde84290d575a6b
SHA1 06ca85723f1114c50fe4c21bdbcbcf37cb71fda4
SHA256 63e6ab52adb8dfe0e2c6a0b403b7d3997b07da84403e8e20bf4441c793b7a0b1
SHA512 98b9e42b72b8768a1e5e72a27758a208cbf49190d8480b3bbbb086ddf950a91f8c4414568abbfe70faeefabc83cf85df305a8336c95bfc39ebac8f0060bf64ff

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

MD5 8e3b16e10ea5230719754baae7e71be1
SHA1 e23cf42115f9024bb7a07c94a441c9785b78a486
SHA256 9b83622f8e057a991704a94dc1d1f646dbda61f0dc888397f1cb3115bbf631fb
SHA512 d6916de9da15a31b9ddff38ec73190cfc732e50138601106ed2bbf727d5e570cf28a408d2243ce551b8fdf6935c86e09ed36430ea05df018a493c289d9654b1b

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58f306.TMP

MD5 c9e04653b433f65f9cc404a5a978d6e0
SHA1 f71f63a4617b1481f97fe7df2b0d468dd5c6f023
SHA256 2029e8fdfa30ee15400a978357cb311a4c95f74676fe95d74dd7b830f320b774
SHA512 967ebd8fa7aac80195fddfa12ffee1175d9a0136cfa1c65c58e4ca4ac0dda235240f611739690d7aadba428cb54cdf1e963f60b9c003df2c13bccb56c91d96af

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 39e41c80f9051432cff0a8e101e35725
SHA1 8fe07a773b3531180e5a8a132df97acdf1112316
SHA256 5b5fc39ae002e6452bb8c95d3cd707f6a699da5557d9b5ebad3542fd6d89ac1a
SHA512 d11abebb63ba8f22dbdd9ea731e0cb8bd302554d444aecd44159433bf2ac837831006e116e807160c3ef17bf25e92159f84b49110d8483a709ef3190f43b43be

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 06254b2961b15593ab85138413051272
SHA1 6a281b642f6bd022ce71108f0fd172d6f7f4c83c
SHA256 756f15118e25f883a88c6362039473525dadcc58d7486371e47223770cddcf3b
SHA512 f01a6110202a642c4947c217e9661987eef781fe7baaf5bcabc1ebc5232e5836229cda2f60a1c367e2e812d83702298f66259ed0dc8675f9a90c7bac18c7d524

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 f620282ad2ec900655443008995283fb
SHA1 f1fb13d58325c25f792acbac7b131958b90bf372
SHA256 0bd6dfa7a100f421a4034874f6956eaf75c00c736a3c6a3c5aac1a23a965b981
SHA512 f511411b39b8b83adc44c50080690d2345c1fa2de4f201a965293c99ffcb75865330775d550fa0c2752b1ec9f8ce368c1896cfa81f79e38b1cbbf584892076bb

C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 ef9f66d9a67559c0f3dbc18ea3bb123c
SHA1 b35fb22404f74e2768ccad8bbd49445c646b591c
SHA256 9af815aad4d1cdc772156785fc9e18733138d79204f7cfb22d524fefa58e1b4d
SHA512 e2493be286687486daf181892f16dd62f3cedd6645717c39089fbcc1b15315bb269a532074e53b5d842046cc2c10613cf6b31a9899b5b93f4e2d508f06fc6a26

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 c5f720023f8236538241708476f9213a
SHA1 d1a91aa9a8dbb91097f50a0fce03137aac817f09
SHA256 0395dc2a9ffab71f42b68559ecbda3ac4a507f817da713f1fd266c498c2bdf9d
SHA512 3c53dc9bd2ec7d81cfcbd07402c971b24b070e3d6daa2965fd46b9ce8c2738f58b8753de9c5dd8e51f28ad1afac2b8c4df1aacf48fb0056edaa29c4f829ca358

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000002

MD5 40f26892ed29007f68e04f923ade1bfe
SHA1 6154c4b639b14c87677f758de517c1438f4b212d
SHA256 36c7b231cca24cd7fd67a1a3da306753e04f2fce3b7212649951f7943c10bfec
SHA512 335998bf8ff7e5d463972f2f43a334f40eab43eb19d891b82280f951e20d1b8c0a0430f594fc5accf213bba66bf190c1fed4a131c4fd9648b933d136a4520f74

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000003

MD5 0ef2afac2bc5a955206301ac1939854a
SHA1 165ced1515ce1d6bbca5ae40f3f1ea03a2f52479
SHA256 bceb87500274d7bf64956ead380c4f1d8a75e87883878e347dfdb19551ab1fc9
SHA512 ffbe2ae137061627c1ec1ea72bd478caf60ae2bf82d0c1e3ab1dbda691c31e3345cc3bd54056c679e47b3c3ce128cee2173456df224075ea2de55601d3442a60

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000060

MD5 4599e2f2d5a7565f0c576ed0865f00af
SHA1 4f405d603c5f6130735b9fe2fc3d0a58518b80c7
SHA256 ac76383e65afbd98c739f906de8c71fb4af0a3147376257913647f1e410469e6
SHA512 0684e814cd10580cea036e4efd6c9771a50143007d16494e1f93a1c7a63ff58d0e1eca5bd7a493e764bdd16c3b611fd92db9512317a55bec4dfdd39b56b7787e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00007e

MD5 1be5e3582b250ca00eaf42b5fdc48622
SHA1 4c1507ed92d6aee34d023afb39ad6ad323be2eee
SHA256 101d85f599aae6c77a87b71cbff6aeaa05266912e3e9e5e2d33cd1eb4b840e85
SHA512 bb1ec530bf58c26d78dc422f1363d54c613ec49a031f4f86d2764ed0a311d41894439ded90cfbe867f21a230b8ee1c3f6069c6e0c43c22be718859f8bbdb0b3f

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 242e1228e9e1f1b84933e4515311301e
SHA1 5e6f779577fcace6110950031b8f6a1908f6e999
SHA256 1fea2f40482dd94df06b9e6433d67ed9850a73cbf8394ec6c4b7725957eda811
SHA512 befadf277dc4683de7ac86093680228b9ca65ddbd9b5b5f151968e326659dbe14b865226178af19233959b59603cd5906570b88a60a54a3072af662f0a2030d3

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 e5e68cf59d9a2d2c9eec3d2e14feb472
SHA1 f5fa003a6d7a8cb2a56f0d1fb30fd934753f195f
SHA256 4d584a94d4831930b63bac60a9f65e367043289550a0c1700e53f5b766a032a2
SHA512 195e80d5f88170f9098aa99f8ac7c404b2849b1ff7cca6c203db47358e9554fa2bf9755ddb1acb674ff6c0f38ca5349511443f3c19735a7dd7e7f3e0f0bd5ada

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 1a2faa28cd22999a17c5def4fb1049f2
SHA1 c90e00d61e1faec1920bb5340b9efc6731ae1d47
SHA256 492ce4af4596efb5b5b3f289e297416ae70786670f8a2f4bdf7513082a0899f6
SHA512 67800e0e5a2759cd8f45928f52797ab9a59832bfab98fa65d5a69b5feae153961844174e967cc3d7f9bc88f5acdfff05b1f42523a37480c3a8b77409b89ef128

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

MD5 daddb2a1f629a84f9bce1173c29aabd7
SHA1 f9adf3d84821a77616eb048c12ff80c3791e61df
SHA256 1ad7a16e16f4acf3efafc18e8a182fffbc90ba3c355b5d6269f8c7a8a7cfe9be
SHA512 f84a8e6635ba30208284c83eda707e57cbb4c26a8ed6158d51a5aacfb9c6764a1cd4884762eaf5610ad683646f1b84dc09d238acdc7cafcc2a775bd040447229

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00008c

MD5 6ec91c77cee59721ee6ec2d6488a5142
SHA1 2ffba1b6ba92f7ce35d18c3ec1cf8da66f8b95c6
SHA256 43e7696eed6fa069bbc0c07e38c5a84b26a563eb2e907af375fff01ce180c024
SHA512 a80d323e6da89b05c29c1c7746868649e0b8c61454ab1a520a31ff0ada9219440d909877fe92ac66f819cc1cdcee459ddaa8d335b86f65d3734e8e096758ccf3

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00008d

MD5 9ca6f8036651274cc1faef017e2010c7
SHA1 d6c64233dd504604a76066657a1b2e0dee3972aa
SHA256 e4c7965620d8b362e57044af85a100d3125a01bd72a23d517b61e98cf6d6f7c4
SHA512 068678ad4a28d88ba83ee40995e0c4e4aac22baf1bde4b017a633ed94320c0ecadc58a8f92f2b9319edad434f4ec78a07d1c8cea966e542567304747435cb8dc

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\f824b0c7-2dc0-4173-85e4-96c0b470ba8c.tmp

MD5 560e08bf6217bfbbf19fa2eedd5013bb
SHA1 8afc2c28a0d1e56f8a702b25a150970fdc237c1b
SHA256 4be1acac182d03649b664ea577368012e339de315d6121217cae8cc0f3370cd1
SHA512 ee9b0b492ebbfa051b16249e4fd26199bcb848929d8818f4b33ae87d51c163267d3deca7f0089d4da6e53413aa8fe1808be6eee60ddd8a21d4e0f986abdece55

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000098

MD5 87e8230a9ca3f0c5ccfa56f70276e2f2
SHA1 eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7
SHA256 e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9
SHA512 37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000093

MD5 3663f9b94c718db162d83ad60077bb6e
SHA1 9dc167406791676831254d297a41994402f9b9b8
SHA256 96bf23366157ef75d29f31a70b0e2be269ce41bbffbda0eacaa5b74f50931f73
SHA512 6f046720ba5b9001cbcc6bede25930f1408126bc647e2a6e8c724f300f9f7d5b0c83ee73dd0f3011e8203ed2033bfc896ddc4063afbdc5c90068b14c7fdc9a04

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000092

MD5 29a64a135d185a3920418cbe8741c6ac
SHA1 fb447e496996a28ab90aee9ac81167ef034f2577
SHA256 8dc40f36c94e1422a6dcef8d8db479474378b87952bd7839cd8f2687f9279ee3
SHA512 f14207610d2c6e3a73b8540074f120d99127ae44167d0196065f69e7ee9342cc35f9bb241227f9766bad0e5199ba1d34d4182979cc6ea7ece54c54ac32943800

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000097

MD5 731fcd7e1d2ed2b811cb355cbbb8c372
SHA1 7dccd4457e5e336ed1387a2acde713684788b8f8
SHA256 90b241939296fa9b67eba8c6acb9b1b4b529b4e961fcde3dde204ec7a22a4d85
SHA512 9597e235e2a2e8607b478ac380ba69e05a1612a6880b49f7e0827e705cd8ae8082cd4e2437064693d17cbc74ab0a05485be4753f3dd78a2d33574ff92db792d1

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000095

MD5 c9c6e08f92803b6ce2a42802b38356f7
SHA1 60d600a8f9968f0248637228df6d40c81a1be1a5
SHA256 fcb3263f868ffd8e595a04909e79ba059d6c2aee9f2a52635f33db358c9b7973
SHA512 92cc90ba4dcb4f4881c63977af335c9ba2aa8eb21c6ef24b87a5f7f9683c3a78de7d41ebff6f783444c8b05635ab1d2c17a0cb8938a6e02e25acc381e0591dfc

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000a0

MD5 75edd64b4d9f0ac134e60f7673778caf
SHA1 c1008e33f8b171897acdd29d7ad8bbb69b6bfb86
SHA256 3e42cdaebacc80d1770c79413c7359bbac85093689efc6813fa75b2df57123c5
SHA512 be8a817d9919dd85e3b51cf6b1e315eead5f2f5fc423377e6a7b7d675e5276d4a5fcc3db437c4f0a45fcd896e2711942391d64553394c90f892531f61f37cd64

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000a1

MD5 da707168c3649aa5fda66892cb3a3edc
SHA1 3ccb10c5439d4ab3035f724b123971087032164d
SHA256 f638a575ead7ad21ea20a32e1af5dc21bd23f696d95b6ae55244171694dd0071
SHA512 8907487fd05f1f3d7f69d18f318f16cb6cf11604ca155459b1007d9f9c1cfb1c2e9aa0529ac7924ef1baec9b883c40dd35c87d989140e7bf571ee469842a331c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000bb

MD5 40c1320bc877bf54deb60155e22d608a
SHA1 c4735517bdf6903f80e28d80fbae2c58d8e105c7
SHA256 71e7d96e0b15924a58f28b82f88627957a5ea25f7a23930c295186f3412cca2c
SHA512 d52634fb3d303dceec351f3d9dcf5e8387e9b2c1fd4f7f07ad25a557cc1ca0c7f7ec7005a62ab235904596770152bf63ec2c0bb0e2316b31cd330d79818823a1

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000bc

MD5 36e0645bd3392c55e78f2ea848fbb4e8
SHA1 26c60221905666dfc8002072a0083a1f06cbd8c9
SHA256 bbf5ef817d938f8bbb1bada103e55f96170f62fe6cf7b54b4019071e7072ee15
SHA512 404f91a851752fa3e2a6a70be6b341b5fde778d3b2e9134c69da971e00c003c7e9d309f4e681464a2a566aa8e9ad18bba158a2bb10cc1b320d448037da74c717

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000be

MD5 6c2918af41500d21e282f720f0b2e364
SHA1 7c664d8e579fddeba428d0374daa7576edb55af7
SHA256 2d71a55f5dad7cda17ce63dd9d673c81550681f90d9c059ca23e3be81967c602
SHA512 14859485890626032ac253f7d00277675aa460e206ef537d81ba8cec9fa26e90928ec3c6c90ca5a3977698b45f2619a8c58cb8dc9764cd3e2fb27999a46f2b1a

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000bd

MD5 4a8c93f2cb84336bb11796a549941d40
SHA1 78cbc69d480b07951b23865e27437a565822afc8
SHA256 7dfe96249d73eae447d1edadecd5cc098ab76099647c9e2cf8f3b616d5fe5ee7
SHA512 dd9115f956d945e3d34cf85cb4acf326c37a43f7039ceed076e24077b31bf9cddcf5d92aa491ddc4b5bd37134426231b70527037f76420c8bae9e9700df60e8e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000bf

MD5 d3907d0ccd03b1134c24d3bcaf05b698
SHA1 d9cfe6b477b49d47b6241b4281f4858d98eaca65
SHA256 f2abf7fbabe298e5823d257e48f5dc2138c6d5e0c210066f76b0067e8eda194f
SHA512 4c5df954bd79ed77ee12a49f0f3194e7dbf2720212b0989dad1bc12e2e3701c3ef045b10d4cd53dc5534f00e83a6a6891297c681a5cb3b33a42640ae4e01bbfd

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000c0

MD5 0774a8b7ca338dc1aba5a0ec8f2b9454
SHA1 6baf2c7cc3a03676c10ce872ef9fa1aa4e185901
SHA256 e0fd57c0d9537d9c9884b6a8ad8c1823800d94dcfb6a2cc988780fe65a592fe6
SHA512 a0066b2a6b656e54f7789fea5c4c965b8603d0b1c3d0b5560cfbafd469a4cb5a566c143c336bcbd443bae2648e960aa0e635770e7c94d0cb49c19326f6ca7b69

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000c1

MD5 bcb7c7e2499a055f0e2f93203bdb282b
SHA1 d4a23b132e1ca8a6cb4e678d519f6ae00a8aac58
SHA256 f6537e32263e6c49bf59bd6e4952b6bf06c8f09152c5b016365fef70e35856cf
SHA512 89e5e40a465e3786d35e2eba60bdc0fe2e5bd032dd4a9aa128f52e5b4b9e0871c4c4859f5b681c497fe3c9362e24827ed7cdc55515e3da0718f5129dcc82fe40

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000c3

MD5 7c5fb5c899ba5194b526ea1d3b0f27b3
SHA1 a54aae832f961b9abf4a5521156d9ae50ae79678
SHA256 b0edcf80e27bcb4a91befdc06ecc4015106c30aced2ab0a5c7c42e0c21fcd64c
SHA512 00276475fb55f13bda4c0e158f30f2fbc66b5ab891225e3a5d56947f21261818e668780d80a3302edfc15da89f9587a3345a3c40c5ad84fa0dd010b47f51aa1c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000c7

MD5 a90e737d05ebfa82bf96168def807c36
SHA1 ddc76a0c64ebefe5b9a12546c59a37c03d5d1f5b
SHA256 24ed9db3eb0d97ecf1f0832cbd30bd37744e0d2b520ccdad5af60f7a08a45b90
SHA512 bf1944b5daf9747d98f489eb3edbae84e7bc29ff50436d6b068b85091c95d17fe15b721df0bff08df03232b90b1776a82539d7917599b0a3b2f2f299e7525a51

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000c8

MD5 9880989851fcd47652a37312edb17547
SHA1 fcf275884bff18a926de0bcd46c6bc8918356d86
SHA256 1fc4302f08484cb4df0a32e6cf6ce58cc057de2eed9c645cfdabebef1d3306d1
SHA512 53be2da27a9c74be74a9bdad217c8724affd822a4ae7980439f124d1f8a3e1125b8664e16427308e423a1aa05d83a4b015201ddcd89fed09f9d83902b27e44a9

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000c9

MD5 8c9f5d592b2671b4910fbd685ae61401
SHA1 2c38e925773617e94fb911f4d1573bd0f44d607b
SHA256 837bb391f879a1edd4521ce965b614bb760c6a2eeacde80329a57631196bea73
SHA512 458c84f09f7473cc56928085cb0325c893ca2f923e921eacfe62b66d4c926b3c99e1c10c8e17c30e00d4d538200d99a6dc1be74818bfa3c219b28714caede9af

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000a2

MD5 26483924881c754c071f537f4ef13fa5
SHA1 13fa9985d972b7ec676f2c5d74bbdc0762b2c35d
SHA256 8e631ed073f2a47644f441e3e54b7c83392062bf3672a89cd0c59c1b44f07b80
SHA512 ac432b3a877f91c0d6a28e6090e8e048559dd47512974c1726ade40d7cfdad31e46c74ee095bdb6b58186b0d878b8dbbe26c1371582e73d1fa8946c699bb49ab

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000d6

MD5 f2ce97f8c7983df270f5c81b0d00d2ac
SHA1 204982adeafb61e65e0edd42f625304988073f40
SHA256 b4525f4dcd1c35a46b26be5e35c985d5c7e0673f128f96930ec1211d1eae93fc
SHA512 29ad654071bfa5d4dbeb86e59a2340c9e04756fb9554e6ce988e8a3fc1e3ed72034d5311228421fffc9342b66c246f7ed5a3dd387d424ef863bc8ef0f0beabf9

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 35b8385c58e5c2e59f6eafdcacef47a0
SHA1 b3b785a998f356858ce1437684e53e46f59e96ea
SHA256 da42f9b62d927946227cfa708536f3e2db3b53d9f70c2c93ae2b6a42d14edc05
SHA512 2c9bd70b35b392bdd3bc0c9f75add2e0f395e028187de272157905170237a0616b7b28065a5bd6770ee1f0007577dfc5f6a5951bef7425e100d6fc3414a885e1

C:\Users\Admin\Downloads\Unconfirmed 544856.crdownload

MD5 43dc0bee6e91d28d0e2d2a40664dc5ee
SHA1 206f2b1b32692e684145a9aac41317ea71fd1220
SHA256 09f8b72ebed762dd7c8cee790e339be81ada29db13dd9f46feafd1428c40da98
SHA512 e5a37824f8ade100a754f9ff66403ea046c71fdaba34f33ddf9915194c243ff4fb6a1be53691a32d509d86033d373e6b5f4a7b9913f111852998f4386ebfa7a5

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000de

MD5 62fd1704573f0a1ae4c7db83f9f5b470
SHA1 09d03a37492cfd0580ed3b819386bbc4ff64d960
SHA256 3b14ad4d4df0e681fd5aba556473e39e52b31ab98f51dc3db4937bb641a6d667
SHA512 c8108393f8bb91c018ee06ad51d746a33e24ad9041d5cd84792e4c59fb55639b8042ed5c1a424b47263652182ceafe516d0b6adab147e33bbf261d6aee1d3f84

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_us.norton.com_0.indexeddb.leveldb\MANIFEST-000001

MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_us.norton.com_0.indexeddb.leveldb\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 6829f134cab370b041572b504b3d364a
SHA1 b1c3b8a1a45311d384423ffa455390658d9fab28
SHA256 f6eafe1e24905b52c3a708ee87d5b131124d62844e25966ed889b5c1ca01ba7f
SHA512 1fa19d060c0d0702900c29b718024e2ac277e1ce4755e52b44c87ac874bd5b147573ef7d11fb9846de49da7f236d616f005643e5936de3d03a215f871fe62ce8

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\8\CacheStorage\index.txt

MD5 9290b0c1587c4e11484d9e7a50bab146
SHA1 b15fa411392981768f943e1ffc10b21907079049
SHA256 1bd0c73ababa1735d5edb03c1004b91c177380664963f431e21751984b6045e1
SHA512 f776f5b9d278bf7c5a3edc822b23d55800e8e64f804687dd73bd0192953e7b2e0024d2bb14b12f649216b34142da3554095e70b9540ce7a5c2560b2090165abb

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\8\CacheStorage\index.txt~RFe5aa46f.TMP

MD5 198f2715ab171af24334a254255e6aae
SHA1 370c9b83f93e29b2b69e40b2d1399e1e9a205186
SHA256 28b343d6fd51063123fda78b6ee0ccddcbf87eec995d948af58132749aba78ad
SHA512 c4f90f419beee59464d1ecaad846b7fd5608c5227223a11c0e46754f819e2ab1d9497372f4eabf744d3e9ccadf069c0637ae15d51b5d127f11f5cd5bb6ab3618

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\8\CacheStorage\index.txt

MD5 76d1e7b84eea6b3f874efc65ab475745
SHA1 23114ee43455df6c8c3cd3578026c076dc294566
SHA256 0b1c3629ab39c76624d9395a5a3e033f96cb347358add499bac0657afef8682b
SHA512 3a2a4a4f84f6bfd1f7ef4b522410f7ea398a531f4593ba564b3829d8df9e4bac983ad6a48db3fa8332cfa0edb378b19695e856619c82ea3466c23c02a386e32c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 a23fca876bc36b3e941535d59025007e
SHA1 75dd2b09fc0d925ff6cef856385f4c1c24d55cc0
SHA256 d07cc00dc1324a346b674a0a00a4dd87598c3121bdf8d821e3c12b3f75098a9b
SHA512 ede6186cacf21934e4b555ca639b5fbf7f3f4c2d272fa86975405afad28327d507551fe03dfc553b80f2f9a5f26fe98a289bb0e851e9085565a2cf0df87d7a8f

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

MD5 fa06a65f2e0b7b725384265400195a9b
SHA1 f0b9871f57843d1e849ced24149fa316a37f4e70
SHA256 450792fa19716b322daaeacb0493cfe945d5fd666d08f20af278c07518ba23f5
SHA512 fa4ae26be82a8a10c4c0eee8378fcc090ee9628539283aaf119a12c214923f232b7e518573f7e96f1d29d984a319cfd1510d22887e28e012d4b7a1d376eb9497

C:\Users\Admin\Downloads\Unconfirmed 555971.crdownload

MD5 ddfc82cf4eab81965e3ec8ca8915b00a
SHA1 1e5b94be6922e6198afe39a7fc695db291bffcf6
SHA256 4819d87fe9d0d0485fe85a3843a3e3ecd61ebe50a115dad01ec10275272be82a
SHA512 ac08fa6aa1e55a653ad48305bf19c346d0a82a30830ae5b8c84d557e44c57511e39c68deb786044481074fb694d3827f66cb66862ac52fb4437663e82d64ba42

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

MD5 881d67d9dd4f888175ae642d0cb65267
SHA1 75f3ad8c121a60adf6ceffb71c6775667a90fb27
SHA256 67dacb30d64d2531ce0a8a22d721ee1c74799fe36e8ab63a5ec0dad07538d0b3
SHA512 5389b2418aeb72b0fc7c55c75fbbf72c0e68a8395092cc640f556dac4cced8850b657d33e620a10c6573731d6b0dd62ec5da3b101dc8dc214edc271c6e000c6c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 3c50d054033d328598bca8d3fdcdd497
SHA1 7c114135de38c0d20452522198577fd9a1bc43a8
SHA256 3fb3fa0285a6d57be06164e1a4e3bf37f95c2b94c5dc98f1a30cdf99f2e3ce7d
SHA512 aa27a510cb85159cdc6c44b79d2fcb5aeee123108dc0ec7ce4ebdfde3bb29c5a3bda27ea47ed4e43970cd643148cc2288c65d04b12f8e2ecd46624454efd80c6

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 d8e7462caf59038276994164b0e30852
SHA1 a8161b44f1254f1612a4c7982558daed6872e26c
SHA256 63e704b3e2060838c96a38de01e334d14ad3da8de83ef4360c9ef7f86db8a4c7
SHA512 2e619120de03effb1b73c01b1b89f2c562e9ba43e40b2d7482c1e15171f1d89e41f776fa9044a10c4f5c81cf038fc5feb49011433bee55b721f01dfdd7b6e733

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 bc6882f0cbe9fafbfe4770b5661d3f08
SHA1 e6deae4946a362d770f6c304d8bca1c0ceb84899
SHA256 0a52e6891eec614e3900b3788f3155857f145271e65ab29891454349e4af287a
SHA512 49e0352d033fdbb6fbd84c4b6133f10832e77466719f71c7b29fb38ca94d70d07bb6e50a741a10f05119d63902e2bf84a0b1e14b4a30507509e6a070e5d792bd

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 affc5e931002226a99506c6a8cfe04db
SHA1 5f67ed103ece8c8748304f185fb50beda81c4f85
SHA256 ed77e1b3cdbf36c7733b40c0f4fe0e33cb2377d2613c2fdc2f4096cbf865c20c
SHA512 1f664cd620c1f46ba73f2ac412f31c21f2d4795765552f18a7377f65e825f3f90e1a40d226bbbea2d4d1563b880753b8d9d3e487ec2acc79ad487d503c6a0451

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

MD5 7aad585a1c55652fdf899dcc4a04eb4e
SHA1 0671cf27a1728ddca115a44f93fda4fd7a9b63f2
SHA256 6867b0691c43b2968ec23b7b43806b03cd9509f87001e6c228ced8b3579182fa
SHA512 99d1153665cefa027fd5f8b36b7acf6ab78601554c7120b8d44c7beef3186a199fd9033466c401410148ce578cd570b6661fd2d6cb39c08e7c1a71ef1d6f248f

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\data_2

MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\data_1

MD5 02ff234c31702d9496e8432b6f5d633e
SHA1 0a593b98d891f5b913ecfb09a4a5fbcdf93952fc
SHA256 d8e7aff67a0430bc89a23eb004c9bc9b2426bceaf725b82b164812f13329a975
SHA512 db93a191850ab982cdb6acfb6e7f169e84bd44c933668642cc4365239f61ef2fa06c4c29d4b973874268c220f63a41681b619b9eaff3576073dd0b5e76b37e9d

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\data_3

MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\data_0

MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

C:\ProgramData\Norton\{086A63F0-6B13-4F29-9695-134E7A01E963}\LC.INI

MD5 d0cf13b155ece8a82ffa47f44ee7dd7e
SHA1 966dd3ad1a89e3c6a5a88d6d1ec6c57f49e1aabb
SHA256 e60db6772347e021f12cd60c1b69c09a36ccdf027ea3f5bb95b740d5baf2ddbe
SHA512 b7908bbd4390b873390f3810337aaf3c830e8a1fe380a9bfa72046fd735004ce91d3e6e11b6cd44dd66c9c3964396deca31d52d9fd34b92d57cc32e66869b6a0

C:\Users\Admin\AppData\Local\NPE\ErrMgmt\SQCLIENT.dat

MD5 119fac6706ef85ff92a07d3466a4f691
SHA1 adadeb406f2298a9febf11df124d048d91d77774
SHA256 fdebdd108a6a884929a4435d02d5b6df0b798562a5b70b99af346ed1ea4ae326
SHA512 b0f311b3f8ba575011b626887e3a797eb841bdbd7dd1484c21950a8db0a021843923408f3afe8e4a6a4c8cec697cdc08bea2c8773561e3b59ffbca7a48055a9b

C:\Users\Admin\AppData\Local\NPE\ErrMgmt\SQCLIENT.dat

MD5 ab073fba5422a9ba960f1e972ea93fde
SHA1 6572e899fdb5b738ea91907e076d1965f05f8ac0
SHA256 8ff3b9b6abaa25cb80d0a2fb995bd3b73c550a603bf8166a1e8f620855e8e9f5
SHA512 f4aa049827aad90365835cc5e4e0e3af36716dad9dd558b574e460e221dc4fbe5a9efe047e6bcdf9f7a100deb76a42f14721a2d6faa4bee7b1100437a442d29f

C:\ProgramData\Norton\NPE\NPEsettings.dat

MD5 c7262872c94b388580594c540a9bb2aa
SHA1 86236d9ace08a3f7968b3f1fbf95e7f2d7c6b6f5
SHA256 521f4e08654d99ea27218b7766bf45fd8d3a9aa7b75ae5070e72036f78555c5f
SHA512 0696ba2c02ea3323e3d8a7209c82eb34624d07f0c7bd07a6d491cb5739abad82f6183f38b127a1c3bad1ab829df4e0e1088e46af6f5beb9ef4623127c3a21bc0

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\fce7ffcd-ffcf-47ec-a100-ea7aaf10441d.tmp

MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

MD5 766182f52f76ec017017c6cd64624d37
SHA1 dc564864e0b73e553909f0b61a987c407d1363ab
SHA256 635bb26500f4fde434bb2342bfd1cc842f4335bc4bf0e99fdff8baf8d83e44c3
SHA512 25cef6f03f14186338796e307bd48f9bb2c978eec8e62553444dfd9f6f79f5931d984ba52f1e4a36b75cc5c44e3897b0eeca9682ee07d72a426043d86e2f322e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 9b0e7ac00118855e1d79bca3281a4a9d
SHA1 244f1caa9ba7e2e9f21199b2721ed0e2d2c924c5
SHA256 92fdc198f34fa61fcf0e6c7e9b097ae4edfcc69e2ce8fb00d092c5206c9aacfc
SHA512 5a8fa829c23c4dcc102b63bb1dfb7ae71714fd360a596969dc4028e7caa8792a69faf5042bdc5fbce4674a134c59339aba1e4fa2799ed58cfe464247bf11eaa2

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

MD5 61d598f0dc9e1f6d473ca25fe869b507
SHA1 af720c1a8d0399b7eee96c57f9b0fc36dddc846e
SHA256 d5dcc08939d945ad1f751bc989518b6115d21d9a0608baf0668abe0d0086ac28
SHA512 797ecda608910de0bf8589ed783239cb18f9df5e4c4c45b15f5d6b818f054e056306d44750f9027cb78d21809ad4dbb28fe402fafe605c0ff8595f9343ca929b

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 ca65e00b3adf5115690da9ea5db9cc84
SHA1 ed8abe95a5f76441412756cdd46a3b0b2ac3ce33
SHA256 3db5bcb697257a599df70784615d9bf4ae26d0e7bbf8caa3729a32e42de5de8a
SHA512 aecfbb51dc89f89bfbcf3e97cb5e92ef18cdab39b3b82dd3ff48f8ddeba61d8f2c62668a53c41219d32b225b5198548da466647fbd0bf99dcd0fc14f28a3b6b3

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

MD5 403f116c86dee3bb7f13c6ec4ed9e24c
SHA1 88e45b04504b25ff09703f0219a8514cbaf8de5a
SHA256 6a7b9a5af03dd2bb6cee796b39c141056241997c133ad0453e40f8c19f02d621
SHA512 c24e0efa8e65badf61566c09e794260b2ff2dddcd90772ed69fd53ed2c43f8ad2a822623c67be47be263fbd279ae587d2c8ec9cbc348d5ec8e5c435680dbf334

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_0

MD5 68c8adf917b78ece00743b80fec15a00
SHA1 39009a0503e8b7e42e01ca20bb6b380701098d16
SHA256 9992c7133ab8e1acab024bbd9cac5e412ec33a94e8454071356bf2316badb4fe
SHA512 bdfa3e1562fa295c67c4fc7be682572d6e8cad49632ba7dedcf07981fa39919c384767025ad605b8d16d65d7f2130e88d3b609b8b59ff294998c4f66d3b60490

C:\Windows\Temp\MBInstallTemp5125f766421f11f081967e027705a3f7\7z.dll

MD5 3430e2544637cebf8ba1f509ed5a27b1
SHA1 7e5bd7af223436081601413fb501b8bd20b67a1e
SHA256 bb01c6fbb29590d6d144a9038c2a7736d6925a6dbd31889538af033e03e4f5fa
SHA512 91c4eb3d341a8b30594ee4c08a638c3fb7f3a05248b459bcf07ca9f4c2a185959313a68741bdcec1d76014009875fa7cbfa47217fb45d57df3b9b1c580bc889d

C:\Windows\Temp\MBInstallTemp5125f766421f11f081967e027705a3f7\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.36\mscordaccore.dll

MD5 3050af9152d6bb255c4b6753821bc32c
SHA1 7a20c030a6473422607661ffa996e34a245b3e2d
SHA256 97468531d7009e36c338b47fb19e0c6bf210f013610f413c852a4cc27e84b514
SHA512 ad07c4b0bb995e80a1718d74992afdeb6c2c4f217e72f361691e2d04dae9be9cd8e55b50fd7172d73755b02b6105c00a3b67534ba9469d92f9e0fbaab8e8f1a9

C:\Windows\Temp\MBInstallTemp5125f766421f11f081967e027705a3f7\servicepkg\MBAMService.exe

MD5 146e3f89bf318664fc556097eec62865
SHA1 c2d9a1402c7909de2abfe3e9cc0883f1c9ed7800
SHA256 e661413f899c3f5c792198eafd52ff15273c64675ca048b91b0f69e048ac5ea0
SHA512 1dc57614e1ec78617630e6ecda188b9c9b979cb251821ba1201a52187bd2d87ffc8c8bb3f7b6edb44ac2f7771abe2d3bdf21bccf3c50cc1332d92c260de69de6

C:\Windows\Temp\MBInstallTemp5125f766421f11f081967e027705a3f7\ctlrpkg\Malwarebytes_Assistant.runtimeconfig.json

MD5 d94cf983fba9ab1bb8a6cb3ad4a48f50
SHA1 04855d8b7a76b7ec74633043ef9986d4500ca63c
SHA256 1eca0f0c70070aa83bb609e4b749b26dcb4409784326032726394722224a098a
SHA512 09a9667d4f4622817116c8bc27d3d481d5d160380a2e19b8944bdd1271a83f718415ce5e6d66e82e36819e575ec1b55f19c45213e0013b877b8d61e6feb9d998

C:\Windows\Temp\MBInstallTemp5125f766421f11f081967e027705a3f7\dbclspkg\MBAMCoreV5.dll

MD5 40d0e547907ae8b11665dc5fadbee6a9
SHA1 1f255c997f57f38562b6deb03944aa1fc78f370b
SHA256 bdbf74f354ba3582af216c8610d097a56143f48ae034df26c7616514c7390cec
SHA512 31ca56979329f1eea694463850f7cd11e8ab3181f3b74eaa00fac1dcbc83553adcc67f6399251b7e082b028e2e82a83879877a4b9f43a0520d0cc0addef2f974

C:\Windows\Temp\MBInstallTemp5125f766421f11f081967e027705a3f7\servicepkg\mbamelam.sys

MD5 8da81aa1f6b89ce1d2e216e3ea351c59
SHA1 4baf79cbade9a5584630a540e6368d547579fb12
SHA256 ded569e249e590314d095f740c6b8934a5a797e4f3edbe0f78eac9d333f12a2a
SHA512 6d611bbd9d480ef2defd745fd06c4ab86e181267cf689d9d0e124edbaf22fd30fbe2310879cc7bb6dde5bae72c4feea1d329cdecfbf101d95634f85dd0769119

C:\Windows\Temp\MBInstallTemp5125f766421f11f081967e027705a3f7\servicepkg\mbamelam.inf

MD5 5d8c05cc4f9b4304d57ea10b87f2dcf0
SHA1 2cabe3d39aa5ec16c54c7818284a2ee235d2ddbd
SHA256 e26c2d3347e5f077da92713c9df3cd3eae438fb7e29810bd5c3afe567d2d3125
SHA512 55bff23fee9852f229246b71721b3659c916079787935d400a97641449dfda752fc8fbf36f9ea3dc4028f05daeb9006a99660284a61aa5d5a466af0ee966c738

C:\Windows\Temp\MBInstallTemp5125f766421f11f081967e027705a3f7\servicepkg\mbamelam.cat

MD5 bd4ceae54af081d6b1dd91ff584c5d61
SHA1 5ade462d66e042da58bb1447d1b31f1aad901b68
SHA256 64416d564725416c6869ea951878a2734b1f6940b11f7961a897c45f0d8c6625
SHA512 37e7abd312f694ee2c8ea54ecf50ed12c16684f1007c61d9a6d1d01cba958be511c5e4e11cd7393a5cd57349fda1c552bebca42962137e0d11695c195761ebb0

C:\Program Files\Malwarebytes\Anti-Malware\srvversion.dat

MD5 35bc43d96e8be3af32020dd6b7cc3a68
SHA1 e438dd47df198d3182490dacf119fd386d8652de
SHA256 614bae3c6be7bb988df1ee255a3a54d3bf5dbb786e1093c08594fd19b03d1fcd
SHA512 0aeb6c5cb526bd1c7348a7f4e1b0816d3ef02d07a0f9d6a27ac93ffcce284448ae6b439e3876f614135c7881c36b90960b43fc042a41ec2c0ca4adac5c4ca188

C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe

MD5 542fc1f9a068dd02ad0daaf1c621fb55
SHA1 26555907b25572fb79d0f3f1d1cf3dcd60b18764
SHA256 dadb094bb31deb0efc1c8d7022988f7843460fd2d1fd34078704e8c6dbbe66d2
SHA512 7f2c27ff244a43772353c86cbbf71af4744d1ed7b69cfb99f1ec4069a219f4161098f956f0c4dd615a4908cec009b54ac92c93682bc0e43291085b246810be08

C:\Program Files\Malwarebytes\Anti-Malware\version.dat

MD5 bacfe85ba858235a443dfb03790074d1
SHA1 424c972ed61c39e1a6e07d7163aa7f47a28c3008
SHA256 f50bc2373b84f9ef8fbb29c9da7407ea8169fc0f027188f80f5f734cc145cdd2
SHA512 acad0823527ef8a2af934efbd34af19ed6ee37837654a27cd5effa59d4a15ddfd444b092411f04dc817b08f76ab8a9972388930de1e9cd4448384d05c77b8f3e

C:\Program Files\Malwarebytes\Anti-Malware\ctlrvers.dat

MD5 a4a7b1372224ad52f4647180e3d8462f
SHA1 7943e33407f8cf5de73fb22c7d6bf4a6dbfcda81
SHA256 a2f604c40f2f3a0a54449271147b98152d8d9e620374478c646c3909393c3543
SHA512 a5729cfbf230d71925f04884a73efe8d1d3b51a9080cb41cfc552dfa039f71c7656819f256390afa49cd966e2e8504f455452c856e2dbd683e069ac8bf277465

C:\Windows\Temp\MBInstallTemp5125f766421f11f081967e027705a3f7\ctlrpkg\mbae64.sys

MD5 95515708f41a7e283d6725506f56f6f2
SHA1 9afc20a19db3d2a75b6915d8d9af602c5218735e
SHA256 321058a27d7462e55e39d253ad5d8b19a9acf754666400f82fe0542f33e733c6
SHA512 d9230901adeecb13b1f92287abe9317cdac458348885b96ef6500960793a7586c76ae374df053be948a35b44abe934aa853975a6ccd3788f93909903cc718c08

C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.json

MD5 73246f67950aa7ea2875dedfba6f3ce2
SHA1 940ff5314f5dd257c53ba438e2e6c0e780fc5620
SHA256 6d9d23b433b65d1af9573e007c09c791e45e8d348391fd90ea1e07e2fc9c1ab3
SHA512 ccea583e209f1e227da4e0b2784452cbec11505d15972c6be72b5d63f27ed597e977055d0950b3dee33e702d18af72529a1436ca6621d1a6c372fc4c4dec183d

C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe

MD5 e04e61828c9fffcee59cd90ef155c90f
SHA1 7a97b65f11d2b3f30d8e2dde4c44bdf16f3d3b24
SHA256 05d4d87f43646f7ca2e50520d8850e8808748a508c2761838d5fb92d66d6ce35
SHA512 04792b998628cde88bc2601534678e55b2d6fde290496e5af08a2955a992ca3bb767bd025dca4373abc55141de8d270f62f628e51c887de54035bbee10379ce9

C:\Program Files\Malwarebytes\Anti-Malware\mbtun\mbtun.inf

MD5 5d1917024b228efbeab3c696e663873e
SHA1 cec5e88c2481d323ec366c18024d61a117f01b21
SHA256 4a350fc20834a579c5a58352b7a3aa02a454abbbd9eecd3cd6d2a14864a49cd8
SHA512 14b345f03284b8c1d97219e3dd1a3910c1e453f93f51753f417e643f50922e55c0e23aab1d437300e6c196c7017d7b7538de4850df74b3599e90f3941b40ab4a

C:\Windows\System32\DriverStore\Temp\{80cf33fd-43df-3d49-9558-a4215978498e}\mbtun.cat

MD5 8abff1fbf08d70c1681a9b20384dbbf9
SHA1 c9762e121e4f8a7ad931eee58ee60c8e9fc3ecb6
SHA256 9ceb410494b95397ec1f8fa505d071672bf61f81cc596b8eccd167a77893c658
SHA512 37998e0aee93ff47fe5b1636fce755966debe417a790e1aebd7674c86c1583feef04648a7bc79e4dedaabb731051f4f803932ac49ea0be05776c0f4d218b076f

C:\Windows\System32\DriverStore\Temp\{80cf33fd-43df-3d49-9558-a4215978498e}\mbtun.sys

MD5 83d4fba999eb8b34047c38fabef60243
SHA1 25731b57e9968282610f337bc6d769aa26af4938
SHA256 6903e60784b9fa5d8b417f93f19665c59946a4de099bd1011ab36271b267261c
SHA512 47faab5fff3e3e2d2aea0a425444aa2e215f1d5bf97edee2a3bb773468e1092919036bcd5002357594b62519bf3a8980749d8d0f6402de0e73c2125d26e78f1e

C:\ProgramData\Malwarebytes\MBAMService\config\PoliciesConfig.json

MD5 958720c8bb8f22c02a122ec47fc3e12b
SHA1 4887158694f3c481dd6ffa6ff75c875d9e500bbd
SHA256 a1f962425d032ffb5226bd61a4822de8b1f3a06514ee19541c4f003761d294d4
SHA512 7c4cf998ddf0cc9de3b1d0264bea503f4c418c31e92085479147c6f649d931138dc12176f67d45fa76346096a10f770e9fd00112b096d523b92da4018786e440

C:\Windows\Temp\mb_AC79.tmp

MD5 b478a8fcf9835ff33c6602add97bce78
SHA1 d28268d0bfd98be18526d64367ab0fd6e920fc34
SHA256 620224a7442ad2bb00d817bc3d14c837405cb736f939467119b9d13b813065f6
SHA512 72518ad4e828065f709a446409fcaa52a9c1ad48b5dc15d430ca643c7e6a79ee6006abd212ee839df269149f4af0d69b26f0e19a1ff41a75cbc41266f8ceacfb

C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json

MD5 c2e26d6b37129a290f50dcb61a4dc0c6
SHA1 e61887e942bacf7b9c07f7160d2c247279d1d9cb
SHA256 23a48d4570535e744a5a57d0f2432a5fe78ea2dc4304ac48c88aa207976af455
SHA512 52632102cde8862c63b0c52dc7ccaf27dd7a9555bc8642c29b552851753cdf82dda072f33500881df62cbdb72176d62bc7d27170699438d9ee9fdbfaaa7416ba

C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json

MD5 614980f58cb58491233e3ade2dee47bd
SHA1 ba6ad21a1e44665e982f429e083aea6d59f4e839
SHA256 501f031b4325db4400044a566a8a2903f7d8f911b33102494d82c15cba4e4b90
SHA512 8593ae9b9597ca6934abec4482b0c34f92542e0608dab4f086fdc57d10ea5eb9293fbcb1fa33585e31ffa06aa432eac62d75628cc281ce27da0ae9abae2e4a0a

C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json.bak

MD5 3cfa2a11f0ffdc045a8cba8b056bc7a9
SHA1 3659d68c95a8c2c5f735b6ecfbc545426c5b1131
SHA256 7abd1e2b63bdb19b6322ee2f229d8377caed0fa0a43195493086b234a78ba852
SHA512 c3ff8a49f2d7bff693bbab9c99e642d95f0d5457c8a9b199f7d9e157172ad3ebf7397140149a72ab02e151aa925705bb79a662b4d00d84621eeec49fd48b66f7

C:\ProgramData\Malwarebytes\MBAMService\pkgvers.dat

MD5 10dc8252eb1bb4f68085e3e168d75ea4
SHA1 4dfc4aac5a71314bf3b4a40b811cdd3115601b9b
SHA256 ed58927d7488dc493efd0e7bff1f9cd00fa4f539dd4f010ccaf905cdd28ab8c8
SHA512 0e7073b9dcbe202398bd5c371fb8900c0fe8a2d478539aa7e610f8a9044860bb4568ae81b1a647376990b095eb345b3341bae37bd5387c951ec38b6d094624c3

C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json.bak

MD5 8efea825115b958673c05b83d14e765a
SHA1 ae25acd75be53f140ac6fe40be7bd1bf649ef4d1
SHA256 b34b55e791c84e6fc185097ef69593c2ace53ed28ef47da14e1313bef0c4827d
SHA512 c86c7aeefe80cde74c4c3f9041c83754e6f46cd3d2b530625e30132c62d9a80216074b0ed787d731298a98dcbf96a03a4ddafcf0fbdb4fecb7b718dc5265bb7c

C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json

MD5 18856643ee3ff4a17e8391ac3a1942bb
SHA1 6731714e6f7de19058e199703cd8463c50391f98
SHA256 df1647f06153edcc0f9b5c564cc99de3768f74c948fb6dea669675e30b72f455
SHA512 a3ebd0aa09ade64b1eb7086ee9431df8fc5d16067fb1c8a9b4f91dc1f813bfcf75179cdd8e164a038052a175b605e1e35ce7e77376a03e3253200b04682252f9

C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json

MD5 1c9d83c36d07e625f8ed9606ae9c047d
SHA1 8c0abb5d6222f1cc2b68089ecb3f1e1cbd04a5d9
SHA256 eaa1fafe8ea3118847ee35e74a04853be3b99287754c779d159613209839de80
SHA512 49419b8d3784a079259727e56709191298f33644704abb41d9150be92d421694ab6168171c43631ad0200831fcaa3b83b421e4833bc05ae05af1b88390992502

C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json

MD5 0a09b8a60e1574e962cefad365c5ee3b
SHA1 18a3a8ee3fb9b0ead7ff7d827d3710c75ec71e2c
SHA256 3b65441cb92f37aac824eb26ea9253675f900b5e0d8a804c9515a94622d3f5be
SHA512 28f928772098da6f252886be56e701f3824a6b568109f407d0ad5b42025a490b629900d2fafec3310e58c069497cd97c473e06046c07a7d1c5768fa95c2c182b

C:\ProgramData\Malwarebytes\MBAMService\lkg_db\rdefs.mbdb

MD5 2f7423ca7c6a0f1339980f3c8c7de9f8
SHA1 102c77faa28885354cfe6725d987bc23bc7108ba
SHA256 850a4ea37a0fd6f68bf95422d502b2d1257264eb90cc38c0a3b1b95aa375be55
SHA512 e922ac8a7a2cde6d387f8698207cf5efbd45b646986a090e3549d97a7d552dd74179bd7ac20b7d246ca49d340c4c168982c65b4749df760857810b2358e7eb69

C:\ProgramData\Malwarebytes\MBAMService\lkg_db\rules.mbdb

MD5 ba14d8e03dc5fca81c4de145bf49e348
SHA1 a1b4867252a97fe9d17b19c9fdd4544e112c0779
SHA256 1f0c5be8db7597619025a68ccc0503f9cff6cc4d8b4dc5612cc77975e44d5455
SHA512 06a46bfcf83b4c06aa1787ff6f78420ca2b85a1760248127be76aa6e2c427524b28f15e7a111e5a2e25b1ac995fd4f6278d373b1290fa359de754cc6e87741fb

C:\ProgramData\Malwarebytes\MBAMService\lkg_db\prot.mbdb

MD5 546d9e30eadad8b22f5b3ffa875144bf
SHA1 3b323ffef009bfe0662c2bd30bb06af6dfc68e4d
SHA256 6089fbf0c0c1413f62e91dc9497bedc6d8a271e9dc761e20adc0dccf6f4a0c1f
SHA512 3478f5dcf7af549dd6fe48ad714604200de84a90120b16a32233b6d44fa7240f5f4e5fe803f54b86bbdfd10fa1bfdd88fb85eb6a78e23e426933f98d0a2565ec

C:\ProgramData\Malwarebytes\MBAMService\lkg_db\scan.mbdb

MD5 97d65405ba0a627d87b309f6d3149209
SHA1 0a61340f1ac38a90e81526d8f2ee88f6f30c726b
SHA256 91b331609c5184b3832bbb115163c0678b25d486986b6d8ad410b93e9c131e6e
SHA512 681bed00f05532cc15cf12fe4ba9005021152b0c2ad9a4f847c80ea423666881af3beab931091f48635caea9b9bfab35b33abb956025db8c1bc3036d59ad96f6

C:\ProgramData\Malwarebytes\MBAMService\lkg_db\BrowserSDKDLL.dll

MD5 956b145931bec84ebc422b5d1d333c49
SHA1 9264cc2ae8c856f84f1d0888f67aea01cdc3e056
SHA256 c726b443321a75311e22b53417556d60aa479bbd11deb2308f38b5ad6542d8d3
SHA512 fb9632e708cdae81f4b8c0e39fed2309ef810ca3e7e1045cf51e358d7fdb5f77d4888e95bdd627bfa525a8014f4bd6e1fbc74a7d50e6a91a970021bf1491c57c

C:\ProgramData\Malwarebytes\MBAMService\lkg_db\Actions.dll

MD5 f802ae578c7837e45a8bbdca7e957496
SHA1 38754970ba2ef287b6fdf79827795b947a9b6b4d
SHA256 5582e488d79a39cb9309ae47a5aa5ecc5a1ea0c238b2b2d06c86232d6ce5547b
SHA512 9b097abeafe0d59ed9650f18e877b408eda63c7ec7c28741498f142b10000b2ea5d5f393361886ba98359169195f2aceeee45ff752aa3c334d0b0cc8b6811395

C:\ProgramData\Malwarebytes\MBAMService\lkg_db\dynconfig.dat

MD5 10f23e7c8c791b91c86cd966d67b7bc7
SHA1 3f596093b2bc33f7a2554818f8e41adbbd101961
SHA256 008254ca1f4d6415da89d01a4292911de6135b42833156720a841a22685765dc
SHA512 2d1b21371ada038323be412945994d030ee8a9007db072484724616c8597c6998a560bc28886ebf89e2c8919fb70d76c98338d88832351823027491c98d48118

C:\ProgramData\Malwarebytes\MBAMService\lkg_db\exclusions.txt

MD5 aef4eca7ee01bb1a146751c4d0510d2d
SHA1 5cf2273da41147126e5e1eabd3182f19304eea25
SHA256 9e87e4c9da3337c63b7f0e6ed0eb71696121c74e18a5da577215e18097715e2f
SHA512 d31d21e37b0048050b19600f8904354cff3f3ec8291c5a7a54267e14af9fb88dfb6d11e74a037cc0369ade8a8fb9b753861f3b3fb2219563e8ec359f66c042db

C:\ProgramData\Malwarebytes\MBAMService\lkg_db\mbdigsig2.dat

MD5 314c4f0ea99225300f2f9d5cb680ed81
SHA1 344d3f41c45a23c7afa991b5714320aad778a0e0
SHA256 12a81c30d678db08f50ba03e1c7fa584321c914efb47e63ab8e2a9b3837edc2d
SHA512 3222caa518bf34501f4ae5f989a1394bb232dd7c4bf69c80ac9a7a00fa4e5eaf17158b1f06ed583f7378ab10fc65050d0611f902b9b934125c4be36d0b0995b1

C:\ProgramData\Malwarebytes\MBAMService\lkg_db\dbmanifest2.dat

MD5 b8dc52812581b32bb4f7ae6ba874c1df
SHA1 74e251a8b81181d8946c9f4c3b9831cf8fc2d9c2
SHA256 650d5babcf265fd041458c0ab613a193fa06209f441fea1d331e9cc8a5389cae
SHA512 e76cf9466a18164c6b74b7ba0e164613a34b694ab6c02ee8492443d5678adc60a14f0c785f944142d5395ede4acec5784b508b6bbc32762f28c5210cac7b0432

C:\ProgramData\Malwarebytes\MBAMService\lkg_db\cfg.bin

MD5 a9ffdb4a6e4249032d1eca20ca7a174d
SHA1 fdf353bd6300444a7190584a0773cbe42e6b18f2
SHA256 2197a0fb87f14228f6100c05de73e7940f0694ff87907ff2f91003f388080e02
SHA512 8bed00085a9ebec6d529421586008742e891f9476d4e13aaf9f142e361dde40b3a4859451c7c0bb34b568c12ce9a230c069821f0179f586c3e1e34e4762be3eb

C:\ProgramData\Malwarebytes\MBAMService\lkg_db\Global.nm

MD5 3436dd8d4ae3fb60383e86b0e21bc93e
SHA1 221a75dd1d0a0e3d63b520a12e2a1cb0874d87e0
SHA256 33e8177838b4f6349416c835a94887ac1a470cc82bf0c9678113c8ab72c833c1
SHA512 75a495e5b2da3952f912239a6c881a885e5527e548914c9f1f1c90aae74774a1cc245a7183d3974873a920579fab1dd9bef58f8b447fb89adee6a7e3bc20f601

C:\ProgramData\Malwarebytes\MBAMService\lkg_db\Global.sr

MD5 115e62934e5f1bdc060354c9fc567603
SHA1 9a21aecd842c3cceb1fe7d92b7c6110ce2bdea82
SHA256 0b8f4d8e09350ef4ae9992e8da3ea9f6ec49c3a7715d703b0f7d3b93e98f1a45
SHA512 d94fd66c553aacbc6472481ac0a7dc85fce9aae275720f5251a96dff6d6d804a8183a83b98211ebed29b70823be4d2956a2a3ecd91f90b71ef2d80ba303c75f6

C:\ProgramData\Malwarebytes\MBAMService\lkg_db\clean.mbdb

MD5 9b46c41e7e26b87dc4db926420a8887c
SHA1 15cb62d32db0bf38a68cc655880eba3efb92fed9
SHA256 f20033e9936c2568766712a8f6716d848ac7f4ac1f410b3d895af8650d1dbab8
SHA512 c98cb2df12755e6f6b87c037bd1e6d134be5532497de3bb277d98e844f7d4fab6bb5820f4ba3d6104871d1e331ad3b722b84dd1a85185ea68b87ac2eafa43df7

C:\ProgramData\Malwarebytes\MBAMService\lkg_db\wprot2.mbdb

MD5 d770ec21647c6b89466c6103850be3a4
SHA1 87bb079ba1a4f6caee638cb4e63354ebdc246555
SHA256 45e081ca51fb50cb9df83850d1b9041e9bc75127bc9e446dab2853968b46ec34
SHA512 381f83d4714f31aea40e835e1169cd2d4b500e6c19ed6312f06a1ded5e0440aa26edec19df522a3812407531b1c0760f94c6fd8fab9d0db9f2a2ab257cf0b59f

C:\ProgramData\Malwarebytes\MBAMService\lkg_db\tids.mbdb

MD5 3c143bb032052057e6e52716433028e0
SHA1 292fff309edf8d9d07f94e67f095f70b7104b4dc
SHA256 f5deef46d902025651b9349fda864b1cfd3408be853b62f9b52cb88fdf2146e3
SHA512 665b48845e57c80cb580182b5e8aca1fc898b838fe327ac57b3f3163c7fa3b5dc39e6ccda0014d57f6487894a3515acd3b02066fa03f825beb0c5a483816c758

C:\ProgramData\Malwarebytes\MBAMService\lkg_db\ig.exe

MD5 6eb2d3a129c43e806142866f2d4a6e2a
SHA1 efe15b3e52e19ff8f4e5b98338e55974e87149bf
SHA256 d3737d54309d24919a57fba5e6172e4b52632be19f7ac0746ff3b20ab79ba4de
SHA512 57626d1c052fa5c49428b5d392cd37101995359c09c7ce961437e5a44c2f6bbb582e03bd8a42a4d167bb2b89450728b4fc1bbd0ba5b8209c083ac36207ff30f4

C:\ProgramData\Malwarebytes\MBAMService\lkg_db\sample.dll

MD5 3a955f6950e2c4ab5adc54cdfa9ab039
SHA1 12e9865a0100879664ada2c58b2cbdae4789e47f
SHA256 243f54f8219798ff435ab1d3356765145d26fe4d5a387dfca64a9aaea17df80b
SHA512 34304dd4fe01dc035daed29dfc7e2c7190df21cd17f0b50a2df41a59bb7c011199c5c989fe3e5b607d704236add098e6e72384e90e1e2dbc9429107d043c7e88

C:\ProgramData\Malwarebytes\MBAMService\config\CloudConfig.json

MD5 099107f44bf52efd9f9e9b870a695d80
SHA1 1cd22fafbad6c09f9fd8ba56cff94acb6ec254f2
SHA256 99370941d009b6254231d9364ba34b66ed059501afa88debbd67886bd08b0a79
SHA512 e1b12a9d4bae29ba4b096125bc940388f1eabd2d0e8a87b385b669da7492a1e17633b99f74a34877554acaca5c803053efb5d586f8b1f7e12c06af89a4f32ffc

C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json

MD5 d8f2aad9521be4c1d28c425effcf6453
SHA1 02be7f2a89eb5c84e59a4ecff957aee5c6fa8bc8
SHA256 69a51dfc865d8739003ad566dc4b075a3a6c3de0fdb5852797298c3e048261c7
SHA512 0029d3779e31bab5c72f6c22e026fbfe7006087cd6088c720e7883d20c77310f86c8684cab2a8e355c41fa1f079e0f371752f784f70f9fdf86a8d7bb488ee832

C:\ProgramData\Malwarebytes\MBAMService\config\CleanControllerConfig.json

MD5 ba47b70160f7a278c89642059e4c4187
SHA1 f70daefd59875d1cf38aed01f02e08af37333307
SHA256 df94044129e070de8e7080e22666ae03ae8014ec264572883bf2fb9a4de13392
SHA512 4f974fb475ee0601ea10e57a6edbadda143ccdf7ebec07d00ebed8f3f601ffcc0f1a6900cdf52d706ad996d8d95c045ba8e099b58315fc6d31b6a1ce73c1b730

C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json

MD5 53257493d2a02512dd899fc669872a8a
SHA1 a9db6fb13547b48d33f393e138a8fa93ad0226c4
SHA256 632676a4e81f25b1480c96f6f254f3359df5afa2798a7877a914d6da759db8ec
SHA512 57cb453c59247f836100b1f4f217b4d91e01a8d77b66e049cd240a609ee9deac8678a8c6b08b6cdde5d7a4c0ee371324afe8af22a985e0626008df43589d40f3

C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.sys

MD5 9d1296e9af8ad4ce9b8f161bbe2185f9
SHA1 8f2fa73c857cb53bfe5d35281be06bf11a45efaa
SHA256 59232d92bc9488780dd4350e502c652b3c15d7c19ecda5fdc863968518cc0002
SHA512 65517117dc05e9469cf4935cb8b8e727074fcc3d72c0a771976c4e8f9f1273df6497e058472872aab31051ec088cb31a9d38307149606c33dd93268e9df3646a

C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.inf

MD5 d87c2f68057611e687bdb8cc6ebea5b8
SHA1 27b1311d3b199e4c22772fa1b7ea556805775d37
SHA256 ff93773f55bf4a6a0242adf82276a8c95c0b244b9bc05e515c4e810c81a960e8
SHA512 4aa65b8911d8a2a0f9ef0ee6e934b94db0a9ad4c2ec543b5edcf21486be43f6ab1fda6617ea2cbb85eff230628c9fa8e7649da915d6de695803b28e55bef5819

C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.cat

MD5 32c31ea6efea58c6c3f93399e7688ec3
SHA1 afcc8357a33b4fb8284b8fe2874bf9b112c751e9
SHA256 0331d37b99a984f0b96ef7ea988953a072478a2f71ef7850763e13602e558f8d
SHA512 3c081ee50f77400ee95ad21bd8857f9b0196361c94dffe2e0d65865bce4d776f40c31dd57cc918526684e5557848d3d8681601ef420027e79da8d70fb5ba5349

C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json

MD5 d323e6013791ac0b59ca47d90291e6a4
SHA1 0eb3bd8dd871873c3a7e7145408f646b33fda9f9
SHA256 fc7a07faec7adfa918e21a113ace663a57fad7aaa97286f0b04b722d14f6dbb7
SHA512 ccdd2e88eb240527bc77b9938539d2db6b39d2769e80ad1743d51ee65663bec09c8706de2b70ffc8a9372b395d39e56f7a9d2f110cda2d12a27487b49ce2fc8c

C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json

MD5 449a5e899f42321381c84887dc240e76
SHA1 db6a31a1207a4de75ac74c59f98e36b9aa3ed890
SHA256 af69598f0887367fc788c25e8a5eff7043631197575cf02189ccd157f49520cf
SHA512 9c0971312e5c7559f06325f8e08a2101988a3d34f4da1b5273f8104430868fea01718de5659cd22c9b7974ffb0249bb381e45e5dd0c0473fcc9cf4773b79d9a3

C:\Windows\System32\catroot2\dberr.txt

MD5 34dbab5f052cf5ccc1c56cb8335511f4
SHA1 9d5f7e4501d3125db41b37d7ebf35511787e1528
SHA256 7d157b07708047e324639fcd7013d69b1d02e68a02e2821cba9a76bcd083196e
SHA512 6bfe1d87b5acd7ad2dc56179eb78a8956c2d74abe2b6cce74339d0f63662292ef96748ebb62d720340836dde62126dceee982d8108e6f2f07e27e7b927b0f70c

C:\ProgramData\Malwarebytes\MBAMService\config\RtpConfig.json

MD5 728f7d03ccdf3d8d7394e518bbe95fd0
SHA1 e00b06df7ee5ac6eab2cf17677785b9e3d979778
SHA256 7c121b4715dfa286417ecb801d165000d6c6ea6eeed2af5576d139745809d80e
SHA512 9ed456134389aea726b1bbc54ba097fb1aa83dd3b9a86e4e1d3bc8141c0ac93137dcedcfdec888f0276d13b34185dd0f07a859a49cde68ca26fa4355ef8b95aa

C:\ProgramData\Malwarebytes\MBAMService\config\MwacControllerConfig.json

MD5 133a9bfeac30d964dc70e5b1e1152469
SHA1 df008ede3efb29be1b73489afd950c9de27b23e4
SHA256 dcdedd255baea498f066207f894f622216aad0a36884b10b945cc9ac28f8a792
SHA512 8cac78a494666d57cf4e4afd2af531fab03100d093730c905a53dbfd63f7c2b81745de931da5051c7e289239d5228b7b0764d3ecc52b0b6b33a44c80ca86d914

C:\ProgramData\Malwarebytes\MBAMService\config\MwacControllerConfig.json

MD5 15d4452282b8d114566105d1beef1a52
SHA1 f63ef385397de739abf7a6dc764eef460f8f24f0
SHA256 f7661cfd62c3fa6b66a7e996aaa3e73e233e5062e1b732389623891929cda6cd
SHA512 02cfd80d6e599be564350fa2435d8d9ad18a9594dd4c141f08e2222aa27a4b4c783bb1e26d4c5bab5c45664e2272743b85fa3958cb72fd1c1df9d772d0d96bcd

C:\ProgramData\Malwarebytes\MBAMService\config\ArwControllerConfig.json

MD5 f24ed0e4e634d189c99606d9d090be04
SHA1 e8bae3acfb88eed59f285409afee6345fe258a9e
SHA256 73d335f95163a00513faf7eccdc278a7b5c868c7970968db60d3258c0b4d7ee0
SHA512 f3f0d47d52ee335ea4d5c666fc52494349f39f87b0d3d93070ddab42ae8f499a687681e25467b0ed0c26341b18d25fd0477281cb5bf86760f1442a8d2ad0a536

C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json

MD5 21518dea28ffd98033e8f1408e899556
SHA1 c33182a7adda0d3e87e05bbd8987bb1fae9d40b3
SHA256 62ffa3310cd93607b5084ad9ddaaf9c0b0f11f2f6bb57c96dd4e62a1be7c61d7
SHA512 0abc81a5714b7f78b761bd9cb78e92b5f40aa81144e99331983db558af888cbafd1a0af6efe55850589bafd03dadf0c751e6d35b9b98ca9f23a6b5407e01630d

C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json

MD5 3d1050448d7e42125df4c327e7c88bd3
SHA1 876bd0e16b5daacf0f3e2a523e20ad5a00e9b1b3
SHA256 bd61cbeab1a1d15daef0889ba4e1f6fc290af2a1def13b9d5b36c33f67e511b8
SHA512 849a5fe9e94360352860171c49de74229e46946391a6f9a153297d66c59eeacf4c8a95d0628998183749757f3e8a2897e70f739d31bb9ae4a4440b4441dbebd3

C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json

MD5 1badcb18bb0158ba2711fb0d525b0fb6
SHA1 f3db33e9b2db556c20df1b9dd07c85ac779c769c
SHA256 a6eadef08012363af6ea2f7fd6aa1d3e2886830da8be69e28e11559048fc65c6
SHA512 d78e1cf8b0eab60020f023ba348702daa214ad16e0c8ca1c8abf02c8ff5d529a9d4d6b50464488c1249e11bd3f3241fba4583c3c17842ffa26e3b41d848bdbe1

C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json

MD5 bcf612c8fc829c7687ab55772206c5f8
SHA1 f093c789d1cae16eb607d41d2d2d878fdb367edf
SHA256 01efdbdee96bffcc37c4449d307ddd0ac05b7abf7cca32ff246f95a21a4f0ccb
SHA512 b795646415e2ae3b64e0150f363592084cdcff96447c686712b5d32df9ce3b73433ae3152a4275e3cef12fd202088a3d85d399fa4cb39b3202f0f45d288667ec

C:\ProgramData\Malwarebytes\MBAMService\config\SpConfigFile.json

MD5 2d8b13c115cae9759c824accef5bf04b
SHA1 1cbbc408594dcdd1d37dce326aacdcfab2e5a5f6
SHA256 7e1d11f1046e87a86dab9a3f494559655e42310684d6a805c80fdc185c97c686
SHA512 d5db8aa887946be398a6f7408df2025ee206bd3f1975efffa468bbd7afb502c6f7eaaaff91bfcb2e336266e0139b0349f1053cf81d7ff28351d35398edd26b8f

C:\ProgramData\Malwarebytes\MBAMService\config\VPNControllerConfig.json

MD5 4e5af720c8361f6eaecccb69fd3c92b0
SHA1 d7743358d665aee57b3ba88a86f07c6ef32eef52
SHA256 5a7afd42560d29d76e14940aae9acb01990b038e9208814c6a8d8ea98845d542
SHA512 7ab00b42ec4a9bb4d53144241c683936d393d45ee049a266894c476d6032e056aed0df1bb6fb55602b55f6692cfa86829077be5a97fac3f159daf5cf75227954

C:\ProgramData\Malwarebytes\MBAMService\config\VPNServerListConfig.json

MD5 fc615c75e7586630cfa9aa1ebf45b0bd
SHA1 60433f13be793f131d14e56e7afe1cf141dd7998
SHA256 0c1ea2fc0fe6ae7c3fd82e6adbd3ec1415067d0af900311f83cf69a2d658934e
SHA512 7fb68e6bd43363ea77178722cbb53d87ea2a7c997ae7628ed8adcf460ec98c1fd36827dc234dc445a6ed04d0476970eab260e7e7a831d2d840dc25f9144f1039

C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json

MD5 97ebaab4b2c2fd8f9c5be2143c257571
SHA1 ad971138ae5059be99a9d6128efdce8e2d9afe6f
SHA256 a82861244e40b53d372841e6485074bf4e7c11b6b3b3a76d75afe312ffe805ba
SHA512 e7b434feafaf6c2be03934b308e470b4e8469387967ebe26d87baaed18c5f74f75a5a3d6db3c9bfc350e888c921146048d88f9f388acc93b6a25c1305c93b976

C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.json

MD5 9087d71177efeec9974bd4dbc2b0a016
SHA1 c5d95c8c40360b5e34d897be2f26d7429a35f01a
SHA256 7bb8167b626a9da4d50cfc199877bc997f55874c73e83a56ce758d97cc0d99ea
SHA512 a700ae3b1d6478fdb672130848b22899eaefa86d0fd8bad9848408961bf5c4b7b9184db81519fc4b730c4461ee9b3c86a47d29a4e1ba2706950a273f464d7fbd

memory/1136-9733-0x0000023E358C0000-0x0000023E35DBA000-memory.dmp

C:\ProgramData\Malwarebytes\MBAMService\config\VPNControllerConfig.json

MD5 07a11a0bc47536b85f3c596de023aca6
SHA1 be6efd88c038d48342ab85bef3e3dd5fe5303ab6
SHA256 a476192c5673f463195a8c23b56edcb894a192dac373cc2d4a8b42c1d5670709
SHA512 c8002edf533f118fbe0d10a7c959104dcc64c4b82f3860902457fcfceb3f6200f020e61a6398674ea0a5d3b8566dfe006cc27922e4ee72d10aa26a4a077aa125

C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json.bak

MD5 e6a84c185946d4db8f01dc902322b334
SHA1 59c3fcdd54610f6eab7592e479e1e069eadcff2d
SHA256 6779ee0db269cdc644d1518089cd635739519c73f8825cb026cac6a72339d91f
SHA512 8000d0fa16f2b43379764901a2a2ba0eede7b81a8fec408e5b384d6398d2ce8dd49362ebe7dc46a32ee03d609438478cdd77e906d1434766d1ac3bd77fd95b9a

C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json

MD5 107ff8b7e3cc735287b6dc5acaecda09
SHA1 0060c49dc52e63f19d0dd9bb0b14bf44f8828c4c
SHA256 8963a14f36a3353f0546e115a68d40af8b57c4cfc69880a69bf1de6c8d28d0c3
SHA512 9dd652b0f56e48ac49e12d5f65d8a4e693c8902135665922ebc14e14b67980ce0a3c4702ae702690550d5ec34eb7df86d0b6186d8989a6c44dababa6e0a0c760

C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json

MD5 b938c3c72e1129a935a46bf5acc3d01d
SHA1 794debc3fcf4e2fdc3512589fcab86a5180c4065
SHA256 27ef4da926e277b83a116e3ab4a6422261703ec978cbd76214e148d75c9b6c18
SHA512 e45a771f5731bd4959ece2cc70ddb13a8bc80565b8a3a0f331859a51fba1c29a806765600470fba343edabea236780e9dbebef0ede4bcd1567ebca680e75b903

C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json

MD5 5a16670ff5c50b17ead31c315c06da43
SHA1 defa46fa48faaa9017e69d391ff0db8799d9f57c
SHA256 6a56728e5278c0ce8fe338495c5a6846936499837487388f8c5cccc145e8caa3
SHA512 303ec11dc2d27293e2725ab90f90cc89ef86eaf8eca87565ff56435e4604014016da389291cdd877ded6cc1491449a5de01888beb621a230e38934b094061765

C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.inf

MD5 5a9717e1385703e8f06b27aa10a69e87
SHA1 84ee67a9167b5eb6560711b9871de98898ad07a5
SHA256 47b7c516bb57c612de19f0ca865590af95b6e32bf873a0fef9e011b2c5b483d4
SHA512 dd3c7278c2c11ad15a55fae6d19b96dadd92f85b7f0c8ce934298258af00bb5c052a84a98499b8867b0f43704fb307c67d03692ca69dda4d814c6c17dd73df44

C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.sys

MD5 1258a8e1beab105aa96c93aa34dd9ef8
SHA1 a435a462a0976135e2257b46e52b576fabac3d34
SHA256 d86b9b20788b6bff70a1a4c4111b2ea33b9ec705cc6b8fe869362fc3899820a3
SHA512 8feb56e3d5d67484c97f20348899673d1b8aafad35cd339bd6c459194fa0f0f9e07b0a7063615b010378a2788cd11ef9e3744253a24c8fcd0d960d0cada77546

C:\Program Files\Malwarebytes\Anti-Malware\sdk\farflt11.inf

MD5 9924a26e2fb32c82e9683a01d65d4a78
SHA1 f707880f584131c0f69fdbf1dda753c88cb75125
SHA256 142f7bef5d7c91cc29537e423e4c10fc409b085adc66b75552252bb5c7b38697
SHA512 600665fcc54d8b76f2e9b059bfe7e4f7f1c3b4e2e635c8f97eee4a34b478485312998e42db4dadfb221eaba817082283b7b7be5938557fe24339302177e353bc

C:\Program Files\Malwarebytes\Anti-Malware\sdk\farflt11.sys

MD5 481798295e7ea2c32c94feb253e55850
SHA1 7eada1e2767fde709e73875eba09f129493e1e96
SHA256 f6ba6b1f004a08ed35a145c3b3c0063d1283a00c89ac73427e42c474d1b900bb
SHA512 1430cca5eb980d529417dcaadc2cd3f26be39b43e698b18e1ddf8fe052f7f34da0a68bd7b3bc3b10bf57a9a6cf983229ad5db75601791c36a2ceafa98881bf83

C:\Program Files\Malwarebytes\Anti-Malware\sdk\farflt11.cat

MD5 7b1a6547fddf8efd2b7fe719f80fa758
SHA1 ca6d34d44cd0dd99ee9ab86470a03c5e2cc48d3f
SHA256 bda25b8dd0fb8950b842c3c1c7a82edf1ffbb3b19e6c156e172a6f3210dd1741
SHA512 f47807e6c25b2fbce007bcef0b836a4cbedec05057598c484e2247bd5ffa6a430936bf3089f7d97afea1d93ed5a30290cfcfed7ccc570afffaa63a8b3977c29d

C:\ProgramData\Malwarebytes\MBAMService\config\SpConfigFile.json

MD5 414442339b9a6f13b67fe37196ed5c9b
SHA1 312a6927df40b43b030e972897907123450fd284
SHA256 41bdf873ffa4e77915c8822a5ac7c97773ff163a31dbd46beb930e4d63c4b52a
SHA512 5cdbe545498ca654c2c3c3bfd0db75d18dff181096f7d1a7211530f95452494d649aeb95adea7ee2b12a8f395722b967dcbbb7e49b0d7cd7dc019d7ae4dac7fa

C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json

MD5 ef23f976127fd3aea73cc99863ad5458
SHA1 df43d8a97bc819a7e020558a8f0436e90c809fe1
SHA256 1fecc4eb3143a540130fbfcb1e923c80757cf385a3a42eb38899087306f8de37
SHA512 87025616c1dad381c5149dbdd180d676fef419c532bb2ec9009fdc2f1f59972845c315be57c65486f34339baa7d4e7d23057b84134b0d2a95dc22d266aecbcfa

C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json

MD5 938292dd30e6bdbafe13152f601012e9
SHA1 bd9949cb2da210eb3f1b70171588071d20c9287e
SHA256 8c931029b951a79a383a37b1d1c970f82eea20dbcaa558ba5647ccc501600741
SHA512 8074245b1f1fd31b93b61999f798265ae87508745de7c35035298b5525ad54088db25b7ebfec08241efb5cf82528ae4a9ae52be702729502cb4a72867f87cb3f

C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json

MD5 22bffae0ef6de1650f4b361ad2ee7c18
SHA1 be978503714055571430a116dc9130fa899cbf31
SHA256 7f733dccd10ec6bc31f2bb2d0cd8422fb1b16ebbe65dcda442b5dc036dbc6a63
SHA512 710e14154f1b8133c588f2cc06c2312dea313087a2e5e0d4579ea7ffd2be81dc37d4a80112582f23235746dbcbbb7005a18fe91ce4a859cb7a9f7692f60d7f14

C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json

MD5 d5f4de3923c703147ee33b71d282c26d
SHA1 8c9fbe19e691222ff3ef6e53f92e2f68636e15d7
SHA256 880459dc3e46edd991ecd4b54122ce099baf169c784d0e9c6d3d2025bd4d9a00
SHA512 cb6fd5e209510f9132a4056045948cc86777143ecc1393f69fb9d0e08ad4707b31a4150ad08c3484eaabb68f1d1e59d5025199a02ab6c093239b675d8a5e1d7a

C:\Program Files\Malwarebytes\Anti-Malware\mb5uns.exe

MD5 b39ba8b6310037ba2384ff6a46c282f1
SHA1 d3a136aab0d951f65b579d22334f4dabbebdb4a4
SHA256 3ecbcb6c57af4456111f5f104b8fb8a317cdb0f16e98412249f7a2d62bca584d
SHA512 a8b98f47c30503029f2dc80398dacd5f8fc07db562d04c56b8c7902bebf11517223350c41850b81aca770ebc9e68fc365921bd6cce34b57b2c945f1c51b538b7

C:\ProgramData\Malwarebytes\MBAMService\LOGS\mbae-default.log

MD5 cb72f3cc06501b36d15c2c4953a099b2
SHA1 9c0e427693f6fefab204df707dbcd648bb4fd74b
SHA256 ed58052c56b047f324b7417cae7d2bdf4f716f29774cba852a7263833fdf41e0
SHA512 3b4ef0eef1c60028368e8867978d24f5c7f9357c3827a28e4fdd369370f996289700ecaedd59d3906c40a566540b695b6c836347309067ea176243d49d5f55b2

C:\ProgramData\Malwarebytes\MBAMService\config\RtpConfig.json

MD5 a8682c0c6ea6defdf5c7416b1abd0e57
SHA1 05113bc474adacd4bb4f12a4362bb1310790de1a
SHA256 f1dd58c3a943422f84b1eb313e696a829b275a2b4aff9b4d276e01e0938efafc
SHA512 50590a4cb4d050845235e222d64ff1625ff8b3cb8f4768d71a3c9a1de5481ef67ccaaf7c0594267f4e2fc7c76ae0103b76039928b37ed308de98f13c25739a10

C:\ProgramData\Malwarebytes\MBAMService\config\ArwControllerConfig.json

MD5 fecbe1950b4c3819e7bab1cb21e646df
SHA1 70ffb1e3b120be0e03a6412cb798d14016380849
SHA256 593237a8940e2ba2359f912d82cbfe619e0cba77c7beb1fe668eb9708f1e6be8
SHA512 0bc99ef7a4519937e98635c2e2125ae5e9e68695e8f9b2b6ee21608ad25fdb6fbb06699251eaf5706a81626de210d71b12b92cdb436178073e53f937924326f9

C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json

MD5 a9a8c1a786be513234e69c29f0a81f93
SHA1 6fa200eec11c323608b21c4eb3091453eda5a4ef
SHA256 3d4e1a6beb97aef27e45cf2d6d5fdee5e753d7608c10973f4f4bf780e45f65e9
SHA512 c8123a40c772e03b1425cc2a07e1605e865809e318b736e02b8eb555ad2fc8a2b8a3ae144df99a55fbd0ca9189ab4198538ed46bb14d2e5c0ff94cee2c761aaa

memory/1136-11013-0x0000023E358C0000-0x0000023E35DBA000-memory.dmp

C:\ProgramData\Malwarebytes\MBAMService\config\CleanControllerConfig.json

MD5 e307f60d115630aaa0d349264024a054
SHA1 5b8f178d6040d6d4c1b87191b0a7ad00760fcfbc
SHA256 685bb9a48bba8f499d0c3840bef3491e368ac3a0c4ceab2e78ce9d6b0ab067b2
SHA512 d74215ec489219cdd8ca8cf81cfc4b900c27c8f6e7235fc612bc5e2dc88d350e2d48223b4fd53568b84b8fdaafe30695e9e73d48d7814db0ffca364ff0ce1d5b

C:\ProgramData\Malwarebytes\MBAMService\config\PoliciesConfig.json

MD5 b4c3f88d99ffc3e18cf27deedddb6bf8
SHA1 c5d5402c307b07129b7b3d606fbf7757802ce6f8
SHA256 e3a0b6aa57657aa2f027b71e91d306f89ce595ef8767b6d431720ccdc38ecc1d
SHA512 0d328bf08cea48306506c216eb74ddea640d489c7c79e1e70826da7a47e0894ac1d7c298145616b1c8af821a9486c3d56ac1abb8bcd31d6fdc04814fb48cb7a3

C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.cat

MD5 a32881b0be849d96da6b6bb6d7be8890
SHA1 5d10d9005ccdb722fce6c2b8ab29fca0dad60e36
SHA256 45db7e4a12a3565dccc019f1337f71d58d1969841354cc6b6e867f43352c2615
SHA512 38bb2887a3814ad64a7af6c327fdc37f7e086778f3bb7fdd0fad64914ffec868a7eb21b2af29912f1a711509f6f2f35e49cbb7638b3f48b1054a5684eed7d81b

C:\ProgramData\Malwarebytes\MBAMService\config\RtpConfig.json

MD5 f4520fc160730140a64311f873e77ba3
SHA1 fd6fe3585796d0bc8320f4698014c76ef3de8ea2
SHA256 bdb0afd702633f5d7616d47aadb36efe1dcdf205d03e340cdf7b95ccadda2f07
SHA512 2746bc810fb9b88cf7ab95e3e9644278d1c04c9452030d48fa9629cd09be85476990ba52f4d7e9c33b0d1e71e555910c04645593342f1347f15210acadcc058c

C:\ProgramData\Malwarebytes\MBAMService\config\UI_IrisSettings.json

MD5 8774318b36fc7316fdd4ae3e9ff179ee
SHA1 32e87980c0768b918c561d262aeeae2732cb9577
SHA256 8e006fae1b296510ac3dba9c7ac2c3f0f4cd27aad2238ba10d95933c95486d59
SHA512 173fe0691f541925e451dc01029715293a9e6daa255ba1de0e0a1d2e68669b0ac50c08177af05e3c26f4fb4c25aa8dfea2f12fd3e762f37d016f151fb97bcc8e

C:\ProgramData\Malwarebytes\MBAMService\config\UI_IrisSettings.json

MD5 bac7bf429f88ea49931ca1e99a77d181
SHA1 2f1a3e2a37d4723b14b1d4e328baacbc478e6532
SHA256 1da307086dcdd49dce6483b9618d29d6d1e21c373d0ca671a3be66644ed4f80d
SHA512 0f6d4386ad7c284698c0b66e6f24e3f448fb7e689493c9af5c9b636cc9a7089a3d33186efdc2d68542187ccd4f217e9fbb4825004b0a9b6c4dec7eeabc9df1e8

memory/1136-11159-0x0000023E358C0000-0x0000023E35DBA000-memory.dmp

C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json

MD5 763308d5365e412ead2bef046d187b53
SHA1 139dd3216594dc1ec2f5651d29f906a38c765dc7
SHA256 828f8eededf0f2efcc062b02abc165e0aa60e2328816bbdb8fbd9930d6939cf8
SHA512 9aec79a081b3fb8f96fda9707c591d13e65ed60ee21543c497be569c512a9c3adf6956c8665a0b141d7e7064dfc4d2e9f2f2aba7b5f6d8b003552028b0adf78b

C:\ProgramData\Malwarebytes\MBAMService\updatrpkg\SdkDbUpdatrV5.dll

MD5 4597fbe9c9da2695f2f1767714baf760
SHA1 e6cc5c9c416c39180283d1cd88d872d36c6e39bc
SHA256 f84932697d9bb893e1478cc31aa0ce8c94e20a51479eafeab507e00e227b1837
SHA512 a60b364b3a242ab4c9708b9ca8924331dea8cd37b1b05858ec6bc4b22ca07c211f23b7c85f8215632c431939c9a9a58f3292d5e6c67f8c45c472025422868d0a

C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json

MD5 8a4d178e833355b2c6cbe7119258f071
SHA1 e10aa90f3f27b4654b2c7411c8415d6fce22576b
SHA256 c951be93e78810e456f119c0a2516946985f2539b61cd271b9203999dd04dc8d
SHA512 765d68c900ae4a676121634e816e5f9833d5d425cb9b97676ee4940055ae908487a57b98df7e78fc1144601cf4541d96a72638d1cc000482049574c686e5fecd

C:\ProgramData\Malwarebytes\MBAMService\updatrpkg\mbupdatrV5.exe

MD5 47cfd454ae2fbc2656960d7bda20dff5
SHA1 3939f3dbda1eb0b5efccff561b1ca79e39727e71
SHA256 ebf912ce2dc6b5c375098518af4bb30d8530c80a7e6460a2008b99741a6f86b0
SHA512 0ab44528d4433856dd2f054730d48449773e9182ef1c0f201de62eb7e3a10d88833ad125941b80e61cc67310951b5a036189c55f87d2e52d8168783936242de3

C:\ProgramData\Malwarebytes\MBAMService\config\CloudConfig.json

MD5 6c9f0ec3ed0638934c7517d9b28deefa
SHA1 1069e369ade03940f4dd482a1fadc6f3d84a027a
SHA256 76870a737900c69e56e44bc56a79866d1a1b520015ac3eefcbec05508c54ece7
SHA512 ed29ee5364df58e2d206efbf8c8c70fd3d7d3cbe9c781b0c931a68e6e247022c70e2f57d06f639222337335cbdba5a2d4ddf0af11241e95f103ae7581f77d21c

C:\ProgramData\Malwarebytes\MBAMService\config\RtpConfig.json

MD5 66ce3531e759f8a0d4c66bafc6e535e5
SHA1 a6b451701331cbfea74f94c9fc49cd4ad6d39e47
SHA256 51acf5ed96e698b135206efe20dae6ebb7cef28a0d2485b9905f1f3ab8221a6d
SHA512 dcc2fe5e3df59fa2e98bdadbcc97ac264939c17a8cc6d1906f97b7e1eb46d8bd39bfed17adb7c27e4a47f56977a08a6f26e6b366066fb1141e4d9d734bd84d2f

C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json

MD5 dbb88d89bd30af7eb192759945578530
SHA1 c59a43241c33997c0b6efefabb091d4841fad350
SHA256 f41f483258dbba64c81cde809a1fb341c6a76bbcd182144f1097808cde4db91c
SHA512 621d60729f7247a339dc72e10301f2e2b578a068aa22960b8abf3719e6fe09b677042e8bc5f2fe0b4c26c79fa3dd932cd22edb15f8c5a0a7e1be7a15aca1757b

C:\ProgramData\Malwarebytes\MBAMService\config\RtpConfig.json

MD5 c79fe4d7507b7b62cff0f20e95e7a730
SHA1 e2ce1570e9fabc9066e37ca392ebb8349998c6b9
SHA256 0cd5916d747bbfdedf18094f725d9a16942a9e7611259707a0b1414fd93d9ca7
SHA512 9a800fbf0f0e3adf3c3b972744e62caababeb5c307ced4c182120310e43c8098d8333379812f1e65e55ccebebb2360d024d023b012ec47892533c60fada71281

C:\ProgramData\Malwarebytes\MBAMService\config\RtpConfig.json

MD5 2567f1b7d20c0debd60b877fd2639fd2
SHA1 449e974ffd0a2e18620fbf96cbd88a5dddc25e97
SHA256 de515b5bb4016c9dc3a4727b380192933cbc2d8a15859f7bc8dff1e001bf4eaa
SHA512 4a3c22315b851c8236dbeb314ac2332d5b7122fc2fa0cc15561109543c3faf2eb1f8abdcefd4c3c4a475c024efc8943d9a81667d9ce39b3b5cd7f5f533e1b6b7

C:\ProgramData\Malwarebytes\MBAMService\config\RtpConfig.json

MD5 e10909d3ac80de6465af845e7ae26fb3
SHA1 d5c8c114db2ece3d48b71a4ed43b9c3dcb50444e
SHA256 3828ea527b8424e573a51bbff16ead78238ff5739cb0c7d63fbac52db3c2f55f
SHA512 f5cc05b61b76314ff59aa80683e790e31db863afc4888de8d83fd17078d4069e0b1564f20c03b6558ae69d363f0e6d95953da03ac3c61eacd1d4504b3046e6ed

C:\ProgramData\Malwarebytes\MBAMService\config\ArwControllerConfig.json

MD5 7e045ad9db9a824f962b4978adea99b6
SHA1 7db29381afbcd3dbab0d0b86e4e0a3cb76e73955
SHA256 aeb584560b1d594549877d1c4d2182a30ac1c00f058a146a403c86a68866b0ab
SHA512 840639e888f29f346c80f15a1ae852451b43816015e4d59c12acec6e4e25795a9ca540aa2fafc0ce595a3a23ad70327a7875a613e4ae328f0b370fe38b69c6bb

memory/1136-11262-0x0000023E358C0000-0x0000023E35DBA000-memory.dmp

C:\ProgramData\Malwarebytes\MBAMService\config\CloudConfig.json

MD5 5e2469d5df2f7b49d2b2632b8e785ed5
SHA1 1d708677714edb13237f8193a4ea34f0ad81de0a
SHA256 1b350800c546fb3c99eb334a193de6729cfc01f2f5b65b605ca99d56575ea4af
SHA512 d483a9af062f1467959cdf9c0837cb1463fb2ddc099a15e2f0c89979feb9d5954fb330a4c7fb7009944215fa2cd6a724f5a7e929156380a1e494b808a791b829

memory/1136-11282-0x0000023E358C0000-0x0000023E35DBA000-memory.dmp

C:\Windows\System32\drivers\mbam.sys

MD5 5f1edd6b0547827e758aae590440f0e9
SHA1 69591840c4c0be49a92933df9f2cb9fb31f7841c
SHA256 861f7b527f36d4acd8a60b973a48f89a17e6fa348e2f138b116e6f1e1fe52733
SHA512 cbacab7dd2bf1b57ebb39e137fa7a23ca3edb33c428230f94fe9c87b671b37964de935198e4e2098528fc971bb8c9b24366ed1a4b5cd22ae2b1b74b4a189d49b

C:\Program Files\Malwarebytes\Anti-Malware\mbamsi64.dll

MD5 7fe2f24d9a7ecd129a033f2f2dd115af
SHA1 fd2e9350b7646c5d9902709acd3349cfede498da
SHA256 1dce9e18ab4b5a6ba797b59abd9376b9d7a1e80193d35986ea515619845e7220
SHA512 a030dffefce7c4426d01e09ba97698f74a03ca57ca6eab6aa2adc62abd84d195c1381d81a76a6855503c1965e19c4c702a586f8236760bbc1e431072ce45c19c

C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json

MD5 af8b1dc268c227fb56c64263cfcd1e29
SHA1 512c1e55c06c4a38b8b02795078729d57d43f758
SHA256 99b6e854b4c0cc8d09dd78536084d1fabd742cc3e30637e427f53377f04bedd6
SHA512 a794f197ebdd80361cef3cd44f50f38e30deaf293b8805f136411584abd4bc9f2ff5fadc28f0969bae156bf8cbe17da26b9b7dd938cf65698b788c12db048a28

C:\ProgramData\Malwarebytes\MBAMService\version.dat

MD5 b3fe5f8ff980d84be3e7405a78d1a644
SHA1 1b345daea9b06a30ea24e2a17610bda06e81d13b
SHA256 0c7d59d596a170969f828a7e7d0135e01758dd8fe7e17cf04dc538d5ad65c1be
SHA512 290aa0820a9e327f0a632bc9794f871c56753186128df2bbb80fbfa898b42024f4210ed4704402d0c55887cfe2b548fc55cc44d9fd77881104810c26b2d4d351

memory/1136-11409-0x0000023E358C0000-0x0000023E35DBA000-memory.dmp

C:\ProgramData\Malwarebytes\MBAMService\updatrpkg\expapply64.dll

MD5 76a6c5124f8e0472dd9d78e5b554715b
SHA1 88ab77c04430441874354508fd79636bb94d8719
SHA256 d23706f8f1c3fa18e909fe028d612d56df7cd4f9ad0c3a2b521cb58e49f3925d
SHA512 35189cc2bf342e9c6e33fd036f19667398ac53c5583c9614db77fb54aadf9ac0d4b96a3e5f41ec7e8e7f3fe745ae71490bdcf0638d7410b12121e7a4312fae9e

C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json

MD5 53fef27c4160364a119f6c2aed1f00c6
SHA1 ce269152b286eb3e06d03d3ea696470b8eb9ae42
SHA256 8f9a1dc1fd1af17dd6797a7c25b7679628dad2b10eb96211d289bf9019a79349
SHA512 42f513605abbcbbe2b7bac243627e3d3e8c69b7abdaf96a5d137fad7b86ac110ad622f57a2765f6f3a0dd3dea4221114dfddcb85faf3b80ca7a905e0c25c51d2

C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json

MD5 9a472b5deb17c4a1c82da329289f5042
SHA1 0e5c4ae40cd8289704a4dea2c4d66535bb99baa1
SHA256 ef04ec24a2d641dd2b6a0e75eecbcf7c682c007c0142ceca196c3c114cd5e879
SHA512 46ab940b8c86370dff63052497f9e57b3b5650a6cdb8b07632b65b14830d584aa87990c815a4b10ed8e93446cd5d978f6e1f2ac8dd97fb51a129afa0c5f0be9e

C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAEBE581FCB73249406FC21094EA252E_BC0CE803EF41A748738619ED7838EEFC

MD5 5bfa51f3a417b98e7443eca90fc94703
SHA1 8c015d80b8a23f780bdd215dc842b0f5551f63bd
SHA256 bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128
SHA512 4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399

C:\ProgramData\Malwarebytes\MBAMService\config\CloudConfig.json

MD5 4f8054c28556c08c7e668d70c52d7771
SHA1 d069bf9ade1da830f576d719072627e94c112b1a
SHA256 c16cd6c65883b445fefad019a973620ac1170f6429b0c5301343bb888a34afa0
SHA512 3407a7499ca8b2e9437ca235241959f8a8a94c27ce61b06ca6d8cf3ebd82f8f91295acea890a22fe37ecdc3df013b23b219b775f82d58ca1ae5af33770bfecde

memory/1136-11487-0x0000023E358C0000-0x0000023E35DBA000-memory.dmp

C:\ProgramData\Malwarebytes\MBAMService\config\UI_IrisSettings.json

MD5 cbe23d14102131e96aa7419e724d052c
SHA1 ca8519502fbe40f26afb252b657d8c3fb80a9765
SHA256 258bb4ed559590737b531cef23f04b3481d94e9f469251f5c61160995cbf6594
SHA512 fd1d179768e7a711ab4afbc59403d70dee11c95548b8702c2ba53eb11d9e79a059db656da2fcffd29f7a5baa83c1d2536ee217fa45d91ab4bae83c15c0f35195

C:\ProgramData\Malwarebytes\MBAMService\config\UI_WhatsNewSettings.json

MD5 904b930e2f920c922caa0ce40084d301
SHA1 2e96782b5597dd4d77981f43f50f2c841f68d496
SHA256 98c07800378530a72d1d5ba0338fb9c9c1a5e2944aa427cf677bf190953163b6
SHA512 fcabe9409690b2b7f8012ad17a3f0acbdceeb520ce3b69d770bc210bd111ed3016482c3171bc90dd380606df2a888dd4450963ccb8f023f9732ab8cf12bc4662

C:\ProgramData\Malwarebytes\MBAMService\config\UI_IrisSettings.json

MD5 60de1e99e9af3318264cfb53718d165b
SHA1 78ce3e10be3310d56e0291ed6c3cf46fb3df219d
SHA256 f6fc81131f822d374d3665fc1dbc386dbe0e15b0f57fd451253a4d0bc79b733b
SHA512 399678e595a9613e1477885c4e06577834b7e38084c948266e451efdd96c8a88715273621e693c752eee1fa73effa0a10550b9faa39f40075b50329ae325690b

C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json

MD5 52c171c6de3e85b8256f4593d2d61620
SHA1 5957f4dfa089ef036b7e7f9c34db6d1405fad621
SHA256 1d6b63eff56fc0f1b42589fcca3be9977bc8bed13d1833ca4e4ddd4caac138c8
SHA512 3b5803e02870c4e0a535cdcf4f84850c29029510d1d49ed8344f4110499ec451a56df7d98691e9504dc95e8f439bba8ec8a5c7049f59401ffe846e964b4716e9

C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json

MD5 bda5de460d8b3cf1204adbabebbd9f74
SHA1 3f56daef6349ad77997a8f564ee1f90f55183d43
SHA256 7eded156eb343615d70ce471996d0821c080aa21701200203c75c9ec6ac3cdbc
SHA512 d20c84dc25a5e8814ea2187aa5bfc3515b3490ef8b200ae0c73877d97ccd9f6200b06e69ade2e3cff640be5b4a6c65dac5be8096450cb6fed25c8212c3af6f7d

C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json.bak

MD5 47678119b778d44410d2f67b9e853089
SHA1 00ca3457c96023c9fb522094c4ca42f153770482
SHA256 8eec9daee81bfe71d1b3469b13a1fbd8805c10bbbb9f61f1e51fba223e207ee6
SHA512 c6d98f84290b2348cba6eafd611e497b63485587603714dcf91286af79ff5a13b09788961b6b023c1f41cb8e3cc2dbae5bc73c495205e7ca9ed393e1004d2539

memory/1136-11607-0x0000023E358C0000-0x0000023E35DBA000-memory.dmp

C:\ProgramData\Malwarebytes\MBAMService\ScanResults\79e094a4-421f-11f0-82a5-7e027705a3f7.json

MD5 ef2c85326402ef223cf8bd95bfe9e177
SHA1 8667f7271dcdc8fab59f79d498571ec08f1df014
SHA256 a1386d4f51bd016da75964a756d4cbebb7850598261571841a93ce00006a54a0
SHA512 a4a834ae6a9ebdfa1d5fcf7f0c3c93110193ddea688dcc3df773bb0a10d39d6a0067a1f3b221287adfa55f8f8a73ff8c823f810458dba86fc5288923916db7c5

C:\ProgramData\Malwarebytes\MBAMService\ScanResults\79e094a4-421f-11f0-82a5-7e027705a3f7.json

MD5 be86403ccd0d704a3359984af4a0cc8c
SHA1 add1f53271f5d1d0f3901faa49957bac55c11750
SHA256 425a3a0c6f567f9199260c013e95dd7be2eadd55b16627b42e09a4a47878bede
SHA512 6b607afaa9485d70f1c947fa62c915ef6b3e4ad93da5939160725a5519bf6977eaaa3e5f484ef10a79329abfbea236b184ed1a72bf74999a42a14e193b470f19

C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json

MD5 def16c1241a33f80970767cb98f13914
SHA1 8ef24209ec11bee56ca0deb57acfda484889b1be
SHA256 7eb75b083d7e4076819624fdf700243adacf2b3275221332b8c9510362e7a1fa
SHA512 81a944d55f9e6d7322f348e8de1f0613110b4836a5fa1feb8daea053e163d4cbe6aa1e3b12432f56ea543ec9e4e8e93b34e3793f7d621181f2494f341f2c17d8

memory/1136-11654-0x0000023E358C0000-0x0000023E35DBA000-memory.dmp

C:\Windows\Temp\tmp1136caaaaa

MD5 4d08579f34ab97c0663b766148d8bbf8
SHA1 1658dc864e1e7fd985bb7f5c82041d4e83053ca1
SHA256 9631f4533a69eec02ab9cbba4ac35b1c9ac288edff04975865fd03e336082acb
SHA512 35cc1a8b6c0bee6544434820937bd84be9850e93838081ab6cdb443c9b23054916e6432fcf919e48b03461ff3ff226712c89b262d971929babbead52754a9070

C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json

MD5 513a2857674af7cfca781542288fcb22
SHA1 74e99424696659c6b1ae9bcf248ee0236c1fff2e
SHA256 a5f58dadef181dd0db155d67723f5dd62b9fd867e222bb315fdf0fda1e431964
SHA512 0888d1aae488a71e4cac21e2538bc9c40dfc1734b91e4152a674bad9b2c907a998bc7e158186053df1443ea2da3d8f56c269b85fa2b4b13f4cf029ff05668468

C:\ProgramData\Malwarebytes\MBAMService\Quarantine\8e42587e-421f-11f0-9705-7e027705a3f7.data

MD5 3f8f985202d71a526142e7d06946b4b9
SHA1 ca0e2f60cbee146facee26d663999bd9c08a1ae6
SHA256 9d726eb54e49c53b9930bc980d17e21a0e600bad54bd9c724f9a4d0c79b4e0e8
SHA512 780e1f89c16e304cce1723e2b4fd05f381f5274527d902452da331f8e354d259c35857482184b9bd78b51920859e665c6fa46c988555dc80fb17b4043379e650

C:\ProgramData\Malwarebytes\MBAMService\Quarantine\8e50b054-421f-11f0-8c48-7e027705a3f7.data

MD5 994bd6f54edcd87898ddd39ef8caa786
SHA1 7e489342dc37f64b6e12945cdc9b7a921b001e80
SHA256 286292981cad21fa61708abd76e0a2c91243d94b295fca8ef54b3f11a7525845
SHA512 1a50c2ae9633eb4d67d27f2ae9c3b8c3fc333ebb6f28f5029f42df80884246a3a1bd5ac46b55d3553c846de74af53eae1ceb6ffaeb608d611ded6b12603f77e3

C:\ProgramData\Malwarebytes\MBAMService\Quarantine\8e54a81c-421f-11f0-aa27-7e027705a3f7.data

MD5 a5521531b14d4818b951bc50b2e9ec53
SHA1 a87264562a496c0d25715874bc66148f4b78cfb1
SHA256 aba85c9414bd3f52a3d2d9d633765cf4b97e9783194b15ebc31ea7d5e3d7cda0
SHA512 a515028a22a440309c3de71bef5e85d2a2088248d5adfb38fce7f85ab3f158592324778ddb346b5a5fca7129baf4ed639e99b628c7f4718d6edacc2fc04de078

C:\ProgramData\Malwarebytes\MBAMService\Quarantine\805213f8-421f-11f0-91a8-7e027705a3f7.data

MD5 d3169dbfbc0847da7268bc7e829ed953
SHA1 6caf233978b468370d08adb8077f3d5a06cfd530
SHA256 09b936f239aaef4500005fe339b8120f5211379206ce6de794c30ef890a35120
SHA512 2b12178305396a72020ab02e35771ee8e3beeacef7cad6898d6c5bd77d87d298c727d6921e1f8406d533fbc24b76a4875f41b228d10e988dda762efc262db30b

C:\ProgramData\Malwarebytes\MBAMService\config\UI_SecurityAdvisorSettings.json

MD5 35836520a99e88d825d0f8836b9f4c49
SHA1 2ffe5c2370d21c8849f1412d4ffbdacd8fd511d0
SHA256 6a2fea6ed271bf6453ebca02cf194c5cb0af50fed253b28678658adf6623f81e
SHA512 aaf166b02fef3ab2ff2f47d024b4972e9f0dff70799de7d2952f6614bda17f9685eedba48d0de9414fcbd688fd3e855e67d76a910e37425aa59f8949e05d6c50

C:\ProgramData\Malwarebytes\MBAMService\config\telemetry.json

MD5 3a98374e54c444e4830598282e225448
SHA1 76c65a48cd3b6436ce485f382cc356190ffd0d5f
SHA256 590ff81305caccae3dd913077ebfa76bd05173497c81638d6caa2640786d9d9d
SHA512 15536a5b832c5f5c1d86248093ff9b43e4a4d61fcce26f81f9ca049230d2dd13b188b9f9ca3f96241557f197057751b9b39b34cb9d3a7b9c85aeda0a87b0e239

C:\ProgramData\Malwarebytes\MBAMService\Quarantine\824ecf0c-421f-11f0-ab9c-7e027705a3f7.data

MD5 e9e14dcd0fd7cb102d5bb30781dcec19
SHA1 51b433a033ba9c27be56b41b65259995dbe2cb38
SHA256 5abb6a1673762aa0d1cd52725081ccb8c8217d5c0561c57cdaad858a067bf202
SHA512 f16f8e50f8526dc36ace2d458380b4178dab0f777aa8ab11b9750587a145fc54f94118bb9f040d92c7c20029b72fb8bda6defd0b1e3e271c654a8fc591efa964

C:\ProgramData\Malwarebytes\MBAMService\Quarantine\8debd418-421f-11f0-9818-7e027705a3f7.data

MD5 17b4d15beddc538276e2fe9d4d912438
SHA1 6d523bb160f3f7f61a6c9352ce79ad5cf98f3447
SHA256 ead5a439b3bb9a5c84c4c75c1e38109b34340bf92426540ebb3dbac183642c76
SHA512 e850f1a1c3f7e5c4ef6dc4edf73afb3c5bda414c286bf699969e30f7eac5e74071c6782e2860c77a1d10b74c76303096ba1bf64da6dc57785ca855b3ea90b3cd

C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1F657678CDAD5400251B323D207EA54F

MD5 af548aaa2dfc9c80187f077a964394d0
SHA1 7bb3c3089e0a7daa8ddc6d379eff1699df6ad8b3
SHA256 5b05b09626e71309caa6b38c3284464848f5e24572cdad075d947aee0a8e10d7
SHA512 ed03cdb4cea9badde85c567ef93db1603e6739ca170df11103fa1f4c7aa756650d336eac7a984534196e3a17d67e5cbb42d90b6d1c64cbd8722682773f2e81fb

C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1F657678CDAD5400251B323D207EA54F

MD5 839a3145057932596326b0129d44a1d5
SHA1 3caf9ba2db5570caf76942ff99101b993888e257
SHA256 9cbf22fae0dd53a7395556ce6154aa14a0d03360aa8c51cfea05d1fd8819e043
SHA512 5d8af91fa36f786a64e2b8f1e79808aea3013ce47d25cd04668e2fedcf7b2693644e59b246c8c61995c3423276d1bf0866227726d1f0a7af2696678706056621

C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\59194E40068A745EF528E8E18DD529F2

MD5 55d4b40847f123a0a412f2a144d3712d
SHA1 cd12ec004fcdae09ee62998e83a0d1d53b4ac5f6
SHA256 88676b4e0da2aa5c2b9d677565a2016c19138f89b69bf374b654c54f23a13b35
SHA512 88c27d6b0a743a153a822eefda5bd250935fe258388b730ed05f781798578c76bd151c60192871cd16fcd6dd8dd37590d2dd6467af55705cfb8ab89376cd7dd4

C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\59194E40068A745EF528E8E18DD529F2

MD5 b7a7b4605e33389f48b33d17cae73006
SHA1 8bfe3107712b3c886b1c96aaec89984914dc9b6b
SHA256 9aad6c1a83a1b974ba574a995af35b8ca772da919270db1605a8b81e1bbc896f
SHA512 9920eab816951cd79c09884159be354ba260d84091a7f72582299005a1ad2fece5037efd47a2799b52420b2c25ff40d5b9b9521728ca497ad395dae728f20139

C:\Windows\SystemTemp\TmpA7DC.tmp

MD5 187ad47a1cc6f6da72f679beb1a832a0
SHA1 0bdebddb52a97f672148f4990c28685e27bf70be
SHA256 5a0e18888cb77699886200789f85168dd05d5ee5210ed7cbd7a05016a77340ca
SHA512 27540e31f3b9c441e964bad037481748b07b4cd5990146d9db9511b3b378f197953b80346f831cbd25e76f069eb34c505ec48973f103bc5c8a6574c8cfb34900

C:\ProgramData\Malwarebytes\MBAMService\config\CloudConfig.json

MD5 d4e7fd482e8ae2775830fbc39ab1ba32
SHA1 eeba5c263f6fe6521fdcd00271304bb148e54261
SHA256 ea34e464b5f4340089717d2f0dffa1447a0f76fb10896ea57ef3e3b95911ed62
SHA512 006f0e643a0886eb1179b5ac8428b93b67cf324c722c0e10e80eba010e32d43d89810bd549cdf8d07053df566ea6327e5601882977cb5c194ac7b711865c052d

C:\ProgramData\Malwarebytes\MBAMService\config\CloudConfig.json

MD5 16ff346797289d055206795f95a60059
SHA1 c50b6392a400ef8261c2840f9bb0e102c349a558
SHA256 fdc9244b33d86d80492560f8fe837f82408d1c5f8f351b60c6d35fe766f22d66
SHA512 f5992479d303603951605888ce9c0a338e50f6d92a425662e9771508b593b3034b4bec0094e86d953c8fde9060578f6ab391e3a1221e4cf35ad0cc5493f11fc2

C:\ProgramData\Malwarebytes\MBAMService\config\CloudConfig.json

MD5 652ad24964fd2580621e0913b0a74717
SHA1 be2b1d34117b71631a7b3a3686416bcf264da460
SHA256 17cf147daa2bc1d941a3e0e211548664b2f106ef62577c2d755a2cb162a698b7
SHA512 c155a475c939e91e71ef98d891e07b1bc294b31dc77792e759938cc5e00e4ba8f4ee89083cbdd8eba002eb1317422173c01d6222ccda977c3f089c7aa4418334

C:\Windows\SystemTemp\TmpB79D.tmp

MD5 b792700ed2c0b3e03cbcabb55125e5a6
SHA1 3814b4c6beabcea21a343bf8d1e2086680c2b159
SHA256 46f85289b20cf4eb89e6cfc4eaa3aa1de47d38a5708a6355bb8fc17864935fa6
SHA512 8931d67cff7579af3256f68e4f3a5d204f67b96eb6c4cf37fd3e6d1a02763f5fec5b1ae4c7305824304da5dacba15f6adbe2b14a4e34173187fb4f6bf5e79045

C:\ProgramData\Malwarebytes\MBAMService\config\CloudConfig.json

MD5 ec1ebe824148dcdd784bc5202066a063
SHA1 b8158a195edf50e237a3e484c95808750892e135
SHA256 77b726d520ffab5c8d7775460541ca4425814c0a983f79fe41d38ffb83e9ba2d
SHA512 d09d54398055aed32cb820d241630aa3fc693853d1bd20c17725373499b3f480d9d551cdce9b7b64142f52ed9f9f171dd27a0786be992c9b61b8a7f9e0ab4cb7

C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json

MD5 d7f2483eb2040c07c45810af61d9511e
SHA1 ecd65ea22491e2ec52a5a3d636e900e1611ab960
SHA256 92b7a042d0a08174067a1011e27dd18fd29b67740a5c9ed1e4ed3308e5b6c89e
SHA512 8161148466ea3c88313e5b5e60cabf357b3852074d6b92e893838cdea277dafec5031ac926e84394724a829c769c59a5b1a04780f28ce13d03be220c84e7bb90

memory/1136-11935-0x0000023E358C0000-0x0000023E35DBA000-memory.dmp

C:\ProgramData\Malwarebytes\MBAMService\config\CloudConfig.json

MD5 a2d0805e1a80b26cb259c7729d917c26
SHA1 3c9f14df5d289572de62684bb41af6f8ca9adfc2
SHA256 4f93e9370fd867f6cc02185c73b208a46b3637a7e3ca2fafa75265677033c795
SHA512 389e51ae85e23092c761a16eab2b8c42c2f9d4b291b818403846e364c2e1159a6acfd9f2896891844537469a40761904decab53439a23aec6a27bf3a57927ed2

C:\ProgramData\Malwarebytes\MBAMService\config\CloudConfig.json

MD5 4c04267b9b1658659dc105b062c2cc34
SHA1 be9e118ecffdbc947876a9bb8108803036db260d
SHA256 8761aaa19358b818f9b772324e86567140e4b9dfe4a37e99e84fb4b2c66e9881
SHA512 966b9f34b0c727e13563ffb889eb22e3bd9bc3b214b015ac28ef7638aa16015607d138b42f04fc3dad47011f5731841c8a8da41d4bab0d3879cbd30aa1ade523

C:\ProgramData\Malwarebytes\MBAMService\config\UI_IrisSettings.json

MD5 fafe08d00b746b5f85fa50be1802180a
SHA1 4256fb909aaef022be1712e0d0416f07547ee1db
SHA256 6ab8b101238a1d863e6584b4d3d5c93433bc6315e32809b3090ab804eaeaa874
SHA512 692abb2712ae3d61bf328a93bfef26a5d2f83f4a9db8d7e9565d0ad151a4c85c38d1e15f03459f7bf3492c2e8eb13de085dbd9945b82bd9f8539a8e90c1da03e

C:\ProgramData\Malwarebytes\MBAMService\config\UI_IrisSettings.json

MD5 269f63fbd42704d04d5930de8ba87ccd
SHA1 2ac2e4dea1b23530337b4ff9ac3fff8cd8cc350b
SHA256 016068a433eab6ce6a9d0fe2cc06ce3c5cd63db8a836e6c874ec34c9af18a3c1
SHA512 47ac1a12bbac535856c8b255f37e02b159412234eaee522bfd420ee4ebc57942a899239537399c7a250d812d7662d8fade0803f03d0bdfdec465126a06e71039

C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json

MD5 d3522fb9b7fc451b495af80970f540ee
SHA1 fb996f1c1f539b43770441c3338932eac615b8e3
SHA256 1f3a50ccae4df3003f2c9d0ad98412b86572f02f83408f2624a1f3c9d2ed1c1c
SHA512 e69f2de505065be1d9bf695fad7f62d014f4710ccdff7b0f1364a7ebc6e36c02db13382d31826cdf2f54476e1cdf8ff019ddc34c664f26dbf7a6629d04506ec8

C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json

MD5 e4607eda492a4560748a2ba5e15b8ffc
SHA1 9847a5c4ce7666b80468c55ba685384d3d7ead72
SHA256 6d625e99631cf48d2940bdf1c3ea955d57110da5c0f70a5b75ce17e5bc50a70d
SHA512 c480402c9224db4ad0a33884345ac0b40a8392209aa789765f98baf04f031aabcef2576809b9ec41c8cb74e9d63c2ae35014a72df1fbb0247191a6c3f03bd78a

memory/1136-12023-0x0000023E358C0000-0x0000023E35DBA000-memory.dmp

C:\ProgramData\Malwarebytes\MBAMService\ScanResults\9f8dddba-421f-11f0-bd4d-7e027705a3f7.json

MD5 83f512f740a203a246e141ca83ab55d8
SHA1 04f3b82d7ffc36bc1e9a3f284b5482fd0a6e9c5e
SHA256 bd670ef1799c46b25961b1e859e250df3c0b9a085e81c8d6a01f2dc734348624
SHA512 cf8f9bad00a02dae61c0bdd0b5c504ac30b69d9f405a4e0e684b267bac37573fa7b2aad0264f2756cd37644a16e9d55c5c502029162f2ca44af1995f15a6f916

memory/1136-12070-0x0000023E358C0000-0x0000023E35DBA000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 0e24d34358dcb000dc9739e9eec6bca7
SHA1 6125fe3acb7c72133f36c890c484d87a016cabc8
SHA256 83b444bb30b9bdb788f7881f3c55d8537f32914be9bec47a1fc9fc7de537c46b
SHA512 8640f2aec667b5a96e827d2ca1f26a1ff3b32daa26eae0b131f2eb4743b55abf4b415a1a53901a7e0e75a09f00c908936fb01182858fca163dbc6d35ec612e0f

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 56ad20b1aaf4356bbe8ceefa6014e906
SHA1 fcc5821b5ee8d602ce21dd451a3f98a6041f18be
SHA256 672e6121e16b6175867ebf71fa0df0c1b00a3347072f7dec5c95df0b0d3f88c0
SHA512 6c309f7eaeeaed62a6c147a1274094d55850413a700730478669ec804803d5634085c5911ae2e01e98b767094c6853a9414fc3605c9610078798b0e9f7d29c72

memory/1136-12127-0x0000023E358C0000-0x0000023E35DBA000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 c0afab2a299f125b1706feff14d66cb1
SHA1 ccfd4d2d42c4275790d8494980a718a1dd35c3d4
SHA256 63d74ca7988b7e3492ca661811a5475f8e646dd5c01dda60b4d644ec30188bae
SHA512 5d844bf5ca45465da4987fe7b56b7f200369db8a8f8d31088c48d526ddaa2bad174bd61d798e4d06fe638d7b7843e52fd6fe6ef4e2bde53f423fabf9bb88bf4a

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 d76f5c73143206ec239f4af02129d8c6
SHA1 0b1cda8a0c016af144119a037d9f9c88dde897e2
SHA256 c2b681c302c7ef020870d0fd8d6d259e375681add253d3eb24f1cd1e0dd72562
SHA512 b3e7564c6f5ca62841a755c57b25514ee652daf1cdf6bd3cbd89823ca09e82321039439ff67de30ab2a3bce5caedd42b129ffc9de621ec5ec8b05b162c36edb3

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000120

MD5 0f2c924e441b9183bbe7dc7c960c255f
SHA1 a467130a8d021a7867a83a2af98b23e6230437e0
SHA256 99bc878d4cebad117b274470d6e64d079a2feca260e9b5ab2ea3c8f80353086c
SHA512 7be1a35b9c04ec278c0150dce6bf611933c55b3dd7d47869be8e30c88acae4fcea35b8148264905d7213087e88dd2c209629be7bd450ca9f8e0a8d901152c507

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 4523944240da76df9034863bc75a22bf
SHA1 7e9872385776b16dc4c5ee2a12170620a43a329a
SHA256 53b9e36068fdbfbb53bb1f9dc23df3a4e920ae05d9a985119ad67ada6b3b1dfb
SHA512 afd29a164424847e1db64a58149230911bc5255be2b953aabf6538829b2b1f7e8cf69559be0e8d0920a893526f76b259193efa3baa3ad4d74965dae9b853e6a6

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00015a

MD5 5e0ab04b1eba4cc8285092534378bee2
SHA1 7d954602cfb2cb63c5c4fbe92aff1c04ae2c1d32
SHA256 8dae9e7e190d1759e43ad152c412e0eedadca265e879e5993c0df8be3acee698
SHA512 eccf81c91cc83c7ce005baa9a3ff33e999cb74c86d284eff9c47b233af12d6baa6e114bc8802c2cc014d4c800519c62de7ab9d1a630118accdb5e557512e44c8

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 6dd432220f835fe980423f5ef8da4453
SHA1 033434eb5e678c9fc9658db30b4b67408099f125
SHA256 f2977cc3ef1d727384dd8fbd196cb0c764cf528db09674b345c5a3d60c6e433b
SHA512 cf728e49283aac4ae4492d8487fc02eab1b60a729d930abc8e84ab83f55fda3c2c1068e4ac0821d26aec256fe2373ce21c193a2aab0ceaa18b62f11e60b6c87b

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

MD5 ba0e871ad77141322dc0a742e21ca011
SHA1 6078706aa48f461466c08681536e99ad7694090e
SHA256 e4b4bf34eb2452ee103b745c310df4d097c60d75993b6950a92acf6e55249fb1
SHA512 cdae0831fdc517c88656dc81f2a9d82b6c8cf35da193de301e9ab25ed9adfc11733bb02fc611b71a83ee3728ec175459d0658a29101035f098c66d477d4cdcee

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000158

MD5 6ea5db71beaa95a2091507836daebe9f
SHA1 197e2e8a81f95c6e5f2187253eacb919ac536071
SHA256 52ef1e774f9b9e87bbb68286812fdd174de540b3866e2ab29d8301865946846c
SHA512 fd39ae4f88812a5824046baefcfed8fba25d55c6452a53bfd34fc991cd760bf2e53b2838b36cc1af9977ef80c80115095e5125f99dde5e29240c46b66206fb87

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index

MD5 8786b928abdf9b0b993437fa5402d860
SHA1 3d7e1a4b82348bb4a9497c95f9946eb5d7e6eeea
SHA256 d11c708bea933672330b1f0474162b321346907ff9223ebe2936310ef674aa61
SHA512 d27b5bdf3db4712662a202a8093a13d8dc183aea8d20be90447661deb79077846618de1f9ef8919608a51039a7a4ffe3ee8e5e565e3e4533a998f3ca44a45d51

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 96eb5a882a46e0af65c32d0d8a540c80
SHA1 f5da1f9018a11aedfb2a902a35c3b3726c68be6d
SHA256 c2e03047a15a268281de1620fdbc0fdf4e3e0824e05a75683b6420d5fc330748
SHA512 674b21d589abb5be67a74489fc594d20733a1b47c7e6a3cdb49a8be586d7fc4b8dc94a2559da6421b6be52702a2ff7c5fd5a8f2308b8ee8058cf514d48cc0891

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 5ffa14f161d10b46251ca78190847100
SHA1 e591a4d4cb81558ce0e94a1917df5c26190f9d40
SHA256 a9a7a500d2a2f4c111d9988bac09f3b742aace4bf977892ad6a328ba5027bda5
SHA512 780c469979af0286b348294e6658655164af5c64f7809475c7c0d62da793a7762d7dc8c7d340367c7356cd67dfee9052d3351cebcc884a3521a8c508c4744c21

C:\Users\Admin\AppData\Local\Temp\{a7d923a8-6354-472e-a1ce-8e2de1559314}\KVRT.exe

MD5 3fb0ad61548021bea60cdb1e1145ed2c
SHA1 c9b1b765249bfd76573546e92287245127a06e47
SHA256 5d1a788260891c317f9d05b3387e732af908959c5ad4f5a84e7984bee71084f1
SHA512 38269c22fda1fdee5906c2bfdfc19b77b5f6d8da2be939c6d8259b536912f8bc6f261f5c508f47ade8ab591a54aafbfbcc302219820bad19feb78fcc3586d331

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 adabdb7e6aaf863631016b62af93e053
SHA1 22fa24d5a39a3425a9d940e1d05912f0218b92e6
SHA256 d4b6aea2f8ac05207f7653c81b45ef547e6c24e524e2d8781de26e9d06197ff0
SHA512 49d767ad39498025867d6bc2e395a2a4743f58bc13c45f0441068523f27430228bdca72030bb5e0c08d39ab21146386f858253509478da0207a58b86788b8893

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000137

MD5 8e1ac1522f1bd8478b220ecdfef5829e
SHA1 7d8bbb878f5a48ddd30fe51f48dbc5dbea466a03
SHA256 1a60abb25f6ad2d9b0336d42484f9151b691f1abbf27dab6be0a588bf1c79c1a
SHA512 8d1a7c237a4f771963c85946b2272e2836aeecf84108839f101892baebb1ea5b27e936fe2113b0ef2137f628b3c65a636c1ae38b22cbbd9589902fd57d19fb0d

C:\ProgramData\Malwarebytes\MBAMService\config\UI_IrisSettings.json

MD5 4ab5872ca946d820872564104a3a80c3
SHA1 ec1c753d950072492a92a2d629109799463eeba7
SHA256 f6aa929e438d19872f554ada174fff76a354a117284b1e9bfa498dbb04fc2874
SHA512 56886b78741f8e514589335fd1f75d47c55c1aad2cfba6951f086fd2712a31df4486b97680155d4a427a102bb9c8871d5fe81fee29676dfbb6d8cd56b37b7470

C:\Users\Admin\AppData\Local\Temp\{757284c1-b103-4f05-8b1e-76c23a744d06}\Bases\KSN\log0

MD5 1b70928521e595d40d000ab6fe8ff600
SHA1 9a19d3aab76bc10bcf6ec2012f8c48abde0ed6f3
SHA256 4547263ab0b742b7cdaa68217ffc5a15017cd3141811209a03b78350fb501844
SHA512 e0347029fdb23f9bb3571211d34b237282173de4abdd1b744d94f21780ada26eded7232284672f86ee106edcf20b6e81607162ec98c3bb07e8309cb491402811

C:\KVRT2020_Data\Legal notices\qt_temp.Hp7876

MD5 6ef1ecde78c4561f5a4bf45b14590c46
SHA1 e45938a2e5450fe69dc1db2dcb660d54d3679bab
SHA256 a6a422a0230c87f8c4e0dd4a5a02b12f60bd5527ee02eb175653ae0d673148b1
SHA512 5fcace1f1234612eca5ac79273fbff1925822c3171a63c09bbb74742d22d36289b2d3b99d66f8a392cc273a0af9d4756b2232f694711d2ebad86b5f2777cbf18

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

MD5 1c8ef9f8fcb21d8aa5ef5009066c0797
SHA1 e5dae27d303e4fc4a6564d3cc8c0e16d779c947e
SHA256 9b0099e0f5f97e07081a59798509166cc94d6849d0f0dec491a8541180764a54
SHA512 11801ded143502e34b98d252f68a7eb4a6d9ddff7c9ecc72f2b27ddc2519cfa508a82dcd0d5e3428a480ef21f750cdb7ed3b6dbc08d05df8537528b58a935358