Malware Analysis Report

2025-08-05 14:54

Sample ID 250704-v2m1nsxlv8
Target http://malwarebytes
Tags
discovery adware credential_access defense_evasion persistence privilege_escalation ransomware spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V16

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

Threat Level: Known bad

The file http://malwarebytes was found to be: Known bad.

Malicious Activity Summary

discovery adware credential_access defense_evasion persistence privilege_escalation ransomware spyware stealer trojan

Suspicious use of NtCreateUserProcessOtherParentProcess

Downloads MZ/PE file

Modifies RDP port number used by Windows

Sets service image path in registry

Drops file in Drivers directory

Patched UPX-packed file

Event Triggered Execution: Component Object Model Hijacking

Loads dropped DLL

Impair Defenses: Safe Mode Boot

Executes dropped EXE

Checks BIOS information in registry

Credentials from Password Stores: Windows Credential Manager

Reads user/profile data of web browsers

Legitimate hosting services abused for malware hosting/C2

Network Share Discovery

Drops desktop.ini file(s)

Enumerates connected drives

Checks whether UAC is enabled

Checks installed software on the system

Drops file in System32 directory

ConfuserEx .NET packer

Drops file in Windows directory

Subvert Trust Controls: Mark-of-the-Web Bypass

Drops file in Program Files directory

Browser Information Discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

NTFS ADS

Suspicious behavior: EnumeratesProcesses

Modifies data under HKEY_USERS

Delays execution with timeout.exe

Uses Task Scheduler COM API

Uses Volume Shadow Copy WMI provider

Enumerates system info in registry

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Modifies registry class

Modifies Internet Explorer settings

Checks processor information in registry

Modifies system certificate store

Checks SCSI registry key(s)

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious use of SendNotifyMessage

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Uses Volume Shadow Copy service COM API

Suspicious behavior: LoadsDriver

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-07-04 17:29

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-07-04 17:29

Reported

2025-07-04 17:44

Platform

win10v2004-20250619-en

Max time kernel

873s

Max time network

885s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://malwarebytes

Signatures

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\chrome_Unpacker_BeginUnzipping2748_1841941547\office_endpoints_list.json C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Program Files\chrome_Unpacker_BeginUnzipping2748_1588645368\travel-facilitated-booking-kayak.js C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Program Files\chrome_Unpacker_BeginUnzipping2748_1588645368\manifest.fingerprint C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Program Files\chrome_Unpacker_BeginUnzipping2748_922506108\manifest.fingerprint C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Program Files\chrome_Unpacker_BeginUnzipping2748_924701253\manifest.json C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Program Files\chrome_Unpacker_BeginUnzipping2748_601936245\ct_config.pb C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Program Files\chrome_Unpacker_BeginUnzipping2748_1841941547\smart_switch_list.json C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Program Files\chrome_Unpacker_BeginUnzipping2748_142104429\manifest.fingerprint C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Program Files\chrome_Unpacker_BeginUnzipping2748_1588645368\travel-facilitated-booking-bing.js C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Program Files\chrome_Unpacker_BeginUnzipping2748_1269963770\female_names.txt C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Program Files\chrome_Unpacker_BeginUnzipping2748_2090256682\manifest.json C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Program Files\chrome_Unpacker_BeginUnzipping2748_2090256682\_metadata\verified_contents.json C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Program Files\chrome_Unpacker_BeginUnzipping2748_1588645368\automation.js C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Program Files\chrome_Unpacker_BeginUnzipping2748_1588645368\classification.js C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Program Files\chrome_Unpacker_BeginUnzipping2748_1588645368\extraction.js C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Program Files\chrome_Unpacker_BeginUnzipping2748_1269963770\english_wikipedia.txt C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Program Files\chrome_Unpacker_BeginUnzipping2748_287549654\manifest.fingerprint C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Program Files\chrome_Unpacker_BeginUnzipping2748_1841941547\manifest.json C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Program Files\chrome_Unpacker_BeginUnzipping2748_1841941547\manifest.fingerprint C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Program Files\chrome_Unpacker_BeginUnzipping2748_2090256682\manifest.fingerprint C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Program Files\chrome_Unpacker_BeginUnzipping2748_142104429\keys.json C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Program Files\chrome_Unpacker_BeginUnzipping2748_771950032\manifest.json C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Program Files\chrome_Unpacker_BeginUnzipping2748_924701253\manifest.fingerprint C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Program Files\chrome_Unpacker_BeginUnzipping2748_594449378\autofill_bypass_cache_forms.json C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Program Files\chrome_Unpacker_BeginUnzipping2748_594449378\edge_autofill_global_block_list.json C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Program Files\chrome_Unpacker_BeginUnzipping2748_594449378\manifest.json C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Program Files\chrome_Unpacker_BeginUnzipping2748_594449378\regex_patterns.json C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Program Files\chrome_Unpacker_BeginUnzipping2748_956244015\safety_tips.pb C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Program Files\chrome_Unpacker_BeginUnzipping2748_601936245\manifest.json C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Program Files\chrome_Unpacker_BeginUnzipping2748_1269963770\manifest.json C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Program Files\chrome_Unpacker_BeginUnzipping2748_1269963770\surnames.txt C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Program Files\chrome_Unpacker_BeginUnzipping2748_922506108\deny_full_domains.list C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Program Files\chrome_Unpacker_BeginUnzipping2748_594449378\manifest.fingerprint C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Program Files\chrome_Unpacker_BeginUnzipping2748_1300695322\manifest.json C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Program Files\chrome_Unpacker_BeginUnzipping2748_1269963770\male_names.txt C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Program Files\chrome_Unpacker_BeginUnzipping2748_1269963770\manifest.fingerprint C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Program Files\chrome_Unpacker_BeginUnzipping2748_142104429\manifest.json C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Program Files\chrome_Unpacker_BeginUnzipping2748_922506108\deny_domains.list C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Program Files\chrome_Unpacker_BeginUnzipping2748_922506108\deny_etld1_domains.list C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Program Files\chrome_Unpacker_BeginUnzipping2748_922506108\manifest.json C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Program Files\chrome_Unpacker_BeginUnzipping2748_771950032\manifest.fingerprint C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Program Files\chrome_Unpacker_BeginUnzipping2748_1906224085\manifest.fingerprint C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Program Files\chrome_Unpacker_BeginUnzipping2748_2090256682\sets.json C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Program Files\chrome_Unpacker_BeginUnzipping2748_142104429\LICENSE C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Program Files\chrome_Unpacker_BeginUnzipping2748_555418456\data.txt C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Program Files\chrome_Unpacker_BeginUnzipping2748_1906224085\manifest.json C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Program Files\chrome_Unpacker_BeginUnzipping2748_1906224085\typosquatting_list.pb C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Program Files\chrome_Unpacker_BeginUnzipping2748_1300695322\manifest.fingerprint C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Program Files\chrome_Unpacker_BeginUnzipping2748_1269963770\us_tv_and_film.txt C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Program Files\chrome_Unpacker_BeginUnzipping2748_287549654\manifest.json C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Program Files\chrome_Unpacker_BeginUnzipping2748_287549654\protocols.json C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Program Files\chrome_Unpacker_BeginUnzipping2748_142104429\_metadata\verified_contents.json C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Program Files\chrome_Unpacker_BeginUnzipping2748_555418456\manifest.fingerprint C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Program Files\chrome_Unpacker_BeginUnzipping2748_601936245\kp_pinslist.pb C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Program Files\chrome_Unpacker_BeginUnzipping2748_43306389\manifest.json C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Program Files\chrome_Unpacker_BeginUnzipping2748_2090256682\LICENSE C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Program Files\chrome_Unpacker_BeginUnzipping2748_956244015\manifest.json C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Program Files\chrome_Unpacker_BeginUnzipping2748_43306389\manifest.fingerprint C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Program Files\chrome_Unpacker_BeginUnzipping2748_956244015\manifest.fingerprint C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Program Files\chrome_Unpacker_BeginUnzipping2748_813971715\manifest.json C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Program Files\chrome_Unpacker_BeginUnzipping2748_813971715\nav_config.json C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Program Files\chrome_Unpacker_BeginUnzipping2748_1475076640\manifest.fingerprint C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Program Files\chrome_Unpacker_BeginUnzipping2748_813971715\manifest.fingerprint C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Program Files\chrome_Unpacker_BeginUnzipping2748_1588645368\manifest.json C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Browser Information Discovery

discovery

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133961237755395381" C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4097847965-469305640-2969917343-1000\{5DD0CBA7-824D-49B1-A9F8-2332D7AA05CA} C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2748 wrote to memory of 556 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2748 wrote to memory of 556 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2748 wrote to memory of 824 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2748 wrote to memory of 824 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2748 wrote to memory of 1960 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2748 wrote to memory of 1960 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2748 wrote to memory of 824 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2748 wrote to memory of 824 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2748 wrote to memory of 824 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2748 wrote to memory of 824 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2748 wrote to memory of 824 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2748 wrote to memory of 824 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2748 wrote to memory of 824 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2748 wrote to memory of 824 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2748 wrote to memory of 824 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2748 wrote to memory of 824 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2748 wrote to memory of 824 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2748 wrote to memory of 824 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2748 wrote to memory of 824 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2748 wrote to memory of 824 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2748 wrote to memory of 824 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2748 wrote to memory of 824 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2748 wrote to memory of 824 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2748 wrote to memory of 824 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2748 wrote to memory of 824 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2748 wrote to memory of 824 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2748 wrote to memory of 824 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2748 wrote to memory of 824 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2748 wrote to memory of 824 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2748 wrote to memory of 824 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2748 wrote to memory of 824 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2748 wrote to memory of 824 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2748 wrote to memory of 824 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2748 wrote to memory of 824 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2748 wrote to memory of 824 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2748 wrote to memory of 824 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2748 wrote to memory of 824 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2748 wrote to memory of 824 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2748 wrote to memory of 824 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2748 wrote to memory of 824 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2748 wrote to memory of 824 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2748 wrote to memory of 824 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2748 wrote to memory of 824 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2748 wrote to memory of 824 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2748 wrote to memory of 824 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2748 wrote to memory of 824 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2748 wrote to memory of 824 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2748 wrote to memory of 824 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2748 wrote to memory of 824 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2748 wrote to memory of 824 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2748 wrote to memory of 824 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2748 wrote to memory of 824 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2748 wrote to memory of 824 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2748 wrote to memory of 824 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2748 wrote to memory of 824 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2748 wrote to memory of 1364 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2748 wrote to memory of 1364 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2748 wrote to memory of 1364 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2748 wrote to memory of 1364 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2748 wrote to memory of 1364 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2748 wrote to memory of 1364 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2748 wrote to memory of 1364 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2748 wrote to memory of 1364 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2748 wrote to memory of 1364 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://malwarebytes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x2d8,0x7ffc6353f208,0x7ffc6353f214,0x7ffc6353f220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2328,i,12255870388743836315,10217812382371812121,262144 --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=2376,i,12255870388743836315,10217812382371812121,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2308,i,12255870388743836315,10217812382371812121,262144 --variations-seed-version --mojo-platform-channel-handle=2952 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3472,i,12255870388743836315,10217812382371812121,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3480,i,12255870388743836315,10217812382371812121,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4156,i,12255870388743836315,10217812382371812121,262144 --variations-seed-version --mojo-platform-channel-handle=4164 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4208,i,12255870388743836315,10217812382371812121,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5016,i,12255870388743836315,10217812382371812121,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5332,i,12255870388743836315,10217812382371812121,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5352,i,12255870388743836315,10217812382371812121,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5428,i,12255870388743836315,10217812382371812121,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5704,i,12255870388743836315,10217812382371812121,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5704,i,12255870388743836315,10217812382371812121,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6024,i,12255870388743836315,10217812382371812121,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6200,i,12255870388743836315,10217812382371812121,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=6360,i,12255870388743836315,10217812382371812121,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3588,i,12255870388743836315,10217812382371812121,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6348,i,12255870388743836315,10217812382371812121,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6684,i,12255870388743836315,10217812382371812121,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6716,i,12255870388743836315,10217812382371812121,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6708,i,12255870388743836315,10217812382371812121,262144 --variations-seed-version --mojo-platform-channel-handle=6872 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6884,i,12255870388743836315,10217812382371812121,262144 --variations-seed-version --mojo-platform-channel-handle=6896 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --field-trial-handle=6560,i,12255870388743836315,10217812382371812121,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --field-trial-handle=6868,i,12255870388743836315,10217812382371812121,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=704,i,12255870388743836315,10217812382371812121,262144 --variations-seed-version --mojo-platform-channel-handle=7108 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3632,i,12255870388743836315,10217812382371812121,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4256,i,12255870388743836315,10217812382371812121,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --field-trial-handle=2088,i,12255870388743836315,10217812382371812121,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3440,i,12255870388743836315,10217812382371812121,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6852,i,12255870388743836315,10217812382371812121,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3784,i,12255870388743836315,10217812382371812121,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6336,i,12255870388743836315,10217812382371812121,262144 --variations-seed-version --mojo-platform-channel-handle=7008 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --field-trial-handle=3428,i,12255870388743836315,10217812382371812121,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5204,i,12255870388743836315,10217812382371812121,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2620,i,12255870388743836315,10217812382371812121,262144 --variations-seed-version --mojo-platform-channel-handle=6980 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5628,i,12255870388743836315,10217812382371812121,262144 --variations-seed-version --mojo-platform-channel-handle=3416 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6992,i,12255870388743836315,10217812382371812121,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=2092,i,12255870388743836315,10217812382371812121,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6356,i,12255870388743836315,10217812382371812121,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5504,i,12255870388743836315,10217812382371812121,262144 --variations-seed-version --mojo-platform-channel-handle=6804 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7004,i,12255870388743836315,10217812382371812121,262144 --variations-seed-version --mojo-platform-channel-handle=2728 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6740,i,12255870388743836315,10217812382371812121,262144 --variations-seed-version --mojo-platform-channel-handle=3956 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5488,i,12255870388743836315,10217812382371812121,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=2728,i,12255870388743836315,10217812382371812121,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --field-trial-handle=5240,i,12255870388743836315,10217812382371812121,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6832,i,12255870388743836315,10217812382371812121,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5136,i,12255870388743836315,10217812382371812121,262144 --variations-seed-version --mojo-platform-channel-handle=3400 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6856,i,12255870388743836315,10217812382371812121,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3484,i,12255870388743836315,10217812382371812121,262144 --variations-seed-version --mojo-platform-channel-handle=3308 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5824,i,12255870388743836315,10217812382371812121,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6104,i,12255870388743836315,10217812382371812121,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3312,i,12255870388743836315,10217812382371812121,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3524,i,12255870388743836315,10217812382371812121,262144 --variations-seed-version --mojo-platform-channel-handle=6876 /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 clients2.google.com udp
US 8.8.8.8:53 clients2.google.com udp
US 150.171.27.11:80 edge.microsoft.com tcp
US 8.8.8.8:53 copilot.microsoft.com udp
US 8.8.8.8:53 copilot.microsoft.com udp
US 150.171.27.11:443 edge.microsoft.com tcp
IE 172.253.116.102:443 clients2.google.com tcp
US 23.4.84.96:443 copilot.microsoft.com tcp
IE 172.253.116.102:443 clients2.google.com tcp
US 23.4.84.96:443 copilot.microsoft.com tcp
US 150.171.27.11:443 edge.microsoft.com tcp
US 150.171.27.11:443 edge.microsoft.com tcp
US 8.8.8.8:53 clients2.googleusercontent.com udp
US 8.8.8.8:53 clients2.googleusercontent.com udp
IE 74.125.193.132:443 clients2.googleusercontent.com tcp
US 8.8.8.8:53 msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com udp
US 8.8.8.8:53 msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com udp
GB 23.56.238.90:443 msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com tcp
FR 2.22.251.54:443 www.bing.com tcp
US 150.171.27.11:443 edge.microsoft.com tcp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 150.171.27.11:443 edge.microsoft.com tcp
US 8.8.8.8:53 edgeassetservice.azureedge.net udp
US 8.8.8.8:53 edgeassetservice.azureedge.net udp
US 13.107.246.64:443 edgeassetservice.azureedge.net tcp
US 13.107.246.64:443 edgeassetservice.azureedge.net tcp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 150.171.28.11:443 edge.microsoft.com tcp
US 150.171.27.11:443 edge.microsoft.com tcp
US 150.171.27.11:443 edge.microsoft.com tcp
FR 2.22.251.54:443 www.bing.com udp
US 150.171.27.11:443 edge.microsoft.com tcp
US 8.8.8.8:53 edge-consumer-static.azureedge.net udp
US 8.8.8.8:53 edge-consumer-static.azureedge.net udp
US 13.107.246.64:443 edge-consumer-static.azureedge.net tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 static.edge.microsoftapp.net udp
US 8.8.8.8:53 static.edge.microsoftapp.net udp
US 13.107.246.64:443 static.edge.microsoftapp.net tcp
US 8.8.8.8:53 edge-mobile-static.azureedge.net udp
US 8.8.8.8:53 edge-mobile-static.azureedge.net udp
US 8.8.8.8:53 edge-cloud-resource-static.azureedge.net udp
US 8.8.8.8:53 edge-cloud-resource-static.azureedge.net udp
US 13.107.246.64:443 edge-cloud-resource-static.azureedge.net tcp
US 13.107.246.64:443 edge-cloud-resource-static.azureedge.net tcp
US 8.8.8.8:53 msedge.b.tlu.dl.delivery.mp.microsoft.com udp
GB 23.56.238.66:80 msedge.b.tlu.dl.delivery.mp.microsoft.com tcp
US 23.4.84.71:443 www.bing.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 c.pki.goog udp
IE 209.85.202.94:80 c.pki.goog tcp
US 8.8.8.8:53 msedge.b.tlu.dl.delivery.mp.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
FR 2.22.251.50:443 www.bing.com udp
US 8.8.8.8:53 msedge.b.tlu.dl.delivery.mp.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 msedge.b.tlu.dl.delivery.mp.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edgeassetservice.azureedge.net udp
US 8.8.8.8:53 edgeassetservice.azureedge.net udp
US 13.107.246.64:443 edgeassetservice.azureedge.net tcp
FR 2.22.251.55:443 www.bing.com udp
US 8.8.8.8:53 msedge.b.tlu.dl.delivery.mp.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 msedge.b.tlu.dl.delivery.mp.microsoft.com udp
US 8.8.8.8:53 msedge.b.tlu.dl.delivery.mp.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 150.171.27.11:443 edge.microsoft.com tcp
GB 2.18.27.82:443 www.bing.com udp
US 8.8.8.8:53 msedge.b.tlu.dl.delivery.mp.microsoft.com udp
US 150.171.27.11:443 edge.microsoft.com tcp
US 8.8.8.8:53 msedge.b.tlu.dl.delivery.mp.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
GB 2.18.27.76:443 www.bing.com udp
US 8.8.8.8:53 msedge.b.tlu.dl.delivery.mp.microsoft.com udp
GB 2.18.27.76:443 www.bing.com udp
US 8.8.8.8:53 msedge.b.tlu.dl.delivery.mp.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
GB 23.56.238.66:80 msedge.b.tlu.dl.delivery.mp.microsoft.com tcp
US 8.8.8.8:53 msedge.b.tlu.dl.delivery.mp.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 150.171.27.11:443 edge.microsoft.com tcp
US 8.8.8.8:53 edgeassetservice.azureedge.net udp
US 8.8.8.8:53 edgeassetservice.azureedge.net udp
US 13.107.246.64:443 edgeassetservice.azureedge.net tcp
GB 23.56.238.66:80 msedge.b.tlu.dl.delivery.mp.microsoft.com tcp
US 8.8.8.8:53 msedge.b.tlu.dl.delivery.mp.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
GB 23.56.238.66:80 msedge.b.tlu.dl.delivery.mp.microsoft.com tcp
US 8.8.8.8:53 msedge.b.tlu.dl.delivery.mp.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 150.171.27.11:443 edge.microsoft.com tcp
GB 23.56.238.66:80 msedge.b.tlu.dl.delivery.mp.microsoft.com tcp
US 8.8.8.8:53 msedge.b.tlu.dl.delivery.mp.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 msedge.b.tlu.dl.delivery.mp.microsoft.com udp
US 199.232.210.172:80 msedge.b.tlu.dl.delivery.mp.microsoft.com tcp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 6481d4385cab00f18e19f815bea6fe7c
SHA1 b8df1e58539491f552cca0a2735bf1834ef6c3e8
SHA256 6c5841beb22d999d61f7b58e0197b1edc24649a0f7eb202e7b46173df29f009b
SHA512 71d09192d4400afaab1545854d61bbcbf994a9f3d764fa6e8c697b6eb974837e511cbd45fd69d43d713ee8960dd9b8d22759a1eecb664ba087e91807046a4fe6

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 fbeb3acf31862638732a625199aac9c6
SHA1 1774daa444f8a3c6bf2a03aece284bf09d530515
SHA256 4216ac18594f51610fb8470e3d7fc5dbaf05ddaa02eec4d5a15c40390aae47e7
SHA512 3a32addfa49268be5ab693af92f50b8625a9fc4ab1af4b2043c51691946f93d644ac9646e075aae0c9c3c43e9eb320cc04f67917fe419a0dd89c521d05a339b9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 fd90687074e6959cda9c630483b0cdec
SHA1 c409d10113e87b44448ae1dc04446279b8371249
SHA256 99a713741f229683242761adb72430d065879c1e59717cb33372f599b18baf4f
SHA512 db619f87ec23bc0d297cd8d8df628fe0a62806c1e56f00a3ece4ba9b5b42bf319f1928e0cdfdcee1ab67a6d4425441cb60a2664dacd83779808a95a3d66ac525

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 0fd4a0e92c8a1897aab600ab92275489
SHA1 857ac84f0fbcf53dd9eb0f49d34258ed0d559476
SHA256 d1235f9f2c9d3af7e9b1db3aa48a2ef252e0b763879024da51f12da3829a9251
SHA512 45954b0954e5b382af0dd8bf420511347e661efc6497eca474f54683066209d88cedd20031539cb7de15bc306e18e6aa6ef9892023a82a567b6d2633a039a831

\??\pipe\crashpad_2748_YEZUEXSBZGXXOVYW

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

MD5 164a788f50529fc93a6077e50675c617
SHA1 c53f6cd0531fd98d6abbd2a9e5fbb4319b221f48
SHA256 b305e470fb9f8b69a8cd53b5a8ffb88538c9f6a9c7c2c194a226e8f6c9b53c17
SHA512 ec7d173b55283f3e59a468a0037921dc4e1bf3fab1c693330b9d8e5826273c917b374c4b802f3234bbb5e5e210d55e52351426867e0eb8c9f6fba1a053cb05d4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

MD5 7e1817ec665781abf77beacde0e77d55
SHA1 5138098b88c425f6e84f09d2d4c75a2f047b96d4
SHA256 d69a1bea0f8e9608d74f10331a528890a38ece80118128250ff05852292ff6e4
SHA512 0eb8b923ce3e03c52ce8cccd0d90e4599067ad4263378252ce73a57787f784b86d91ba6ff47089db8b9f1adcd44d8a55fa3493785409953414bbe47ac8abe807

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

MD5 8c5ba7b49bc6f450d2413fd6a9d62bea
SHA1 e3954088ce84a8bb241bf7ef79d5c96809646ddf
SHA256 f36f10b39f9660ca7901d21cbe9498b56320d794df4b3174f85b773ab0df5203
SHA512 fa21f85b32f60281bb76da23acb8ae06627f05a6fd77e135eb80ea098958f2a861b47b170fa1373721c1f0b17e93f5bd089bebc31dfc8ba43b3e3a5f7dc66947

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

C:\Users\Admin\AppData\Local\Temp\scoped_dir2748_576759634\e661539d-b91a-4ec6-854a-f3bbf518bb63.tmp

MD5 b384b2c8acf11d0ca778ea05a710bc01
SHA1 4d3e01b65ed401b19e9d05e2218eeb01a0a65972
SHA256 0a6b11a5b642bf6c1938189707e109a1f48eb02018cfb146f09e74a753567d1b
SHA512 272dd92a3efbf6cefe4b13127e09a9bd6455f5fc4913e7477c6712e4c3fd67efe87bd0d5bf1ec6b1e65f8d3aa0ac99d5bcf88d8a44d3f3116527253a01dde3be

C:\Users\Admin\AppData\Local\Temp\22609c48-1ef0-43ae-8cc2-1646902f512c.tmp

MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

C:\Users\Admin\AppData\Local\Temp\fea9267a-d157-460b-b763-62d45ed1b2dd.tmp

MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

MD5 06d55006c2dec078a94558b85ae01aef
SHA1 6a9b33e794b38153f67d433b30ac2a7cf66761e6
SHA256 088bb586f79dd99c5311d14e1560bbe0bb56225a1b4432727d2183341c762bcd
SHA512 ec190652af9c213ccbb823e69c21d769c64e3b9bae27bea97503c352163bf70f93c67cebbf327bfc73bfd632c9a3ae57283b6e4019af04750fe18a2410a68e60

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js

MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 afd02d1dfd557dbf8030821c7746bf62
SHA1 28e11452360373deaf47d8ee76d2ba98e72c84d0
SHA256 81c78365d08d8e411fbf962bf702fd2d14027737d7ff36ee733192762b79d82a
SHA512 1c0bd4fea4640d7ccf945a2409b0f79652fa521dffc29443889fc60024e711afa83cd8c1c92710c72dfb68382cd0a7d8a873c6f8d0933b13e049b61df4597a74

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

MD5 3a7fb16a11ae274cde4eae1495545de7
SHA1 759163dfa8a1aa7a11ddab9aedc27ab608152e65
SHA256 3b5eab8990921b0aff88a90df0e29ff35b942e6fc60b9b0716b4ca2b48073552
SHA512 9439ab4312541a11b783b8e12653dfb2324f1c609708910b047ca172aca84b21d4becd8bd01938899a95e70e98d6aaa2bddc6c05594e4f115346e3850095b6d9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 fa844789cc52571aca0dfd2441b45697
SHA1 141c27e1589feb6a97d9726e17bfa90c4ab81625
SHA256 06f9f6f74970605c8b8b9d983f82b8ec6638431adfe86324a58795b9c3166ea0
SHA512 53a54cb855a12dcefaca16760e24a7a3c2b8f907f6b906ad43af3580fb7e17d593f79399cbc6542c6c632b840f33f5dcf090ab269d159057c86d6900e2c5eb9f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe57e8d9.TMP

MD5 ed1ebbf4f033b647fa0103333f9643e4
SHA1 3cf2076fb54dc919a2e6de769ab936ba583936e0
SHA256 bd66e0a32b2031ec6419b367dfab9164f43cb3b70de1e76199dd9d9077d85963
SHA512 9847eae89a8d1b51827d309b03d2c91ef16765a1624a85391c766e204e7bcb525557ec5e71d69c0e5d611de5aa58f49db751232cbc1e5841c05373b11b00561a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 1085433923126ab5566215ac965462dc
SHA1 7d8419757e55778626bc909d7e1462e734b30c80
SHA256 66bd7ac61825fd2afc0772cf77212cd3c586adffff91f3013ceb8a3f9c35e52e
SHA512 612ad80616920cbb74681135095352bef51321fe81c277b0378519990d28bccf368f1521409b722d8de61a2e1db7045cc543fec3aeabef99bc6406c5ec18cecd

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog~RFe588410.TMP

MD5 5b418cad129162e90a053e14ba4cfed0
SHA1 a536420853b34af847e16bcdcf0811ab6726f759
SHA256 31e9b1e0a2749aa34bf8495c4d6f022d712c911b35beb731151cb6de9cc87768
SHA512 43334ea2421b1ddbb8f1d91cc10b70cfdac657b4e20e254ac5943313d713a4ad1a35b08ce4e288b7d4b0f3909e890348277ba70a073c151f1dc354cc2b77b7a7

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

MD5 1bffff303d402713ab09a7fd5cb4d188
SHA1 b47af05e9b65442710b297809c9391962d381cc0
SHA256 3d583e70bebb8bde6b1cfe93d516277374210ce58dca5ab246706d44aa84354e
SHA512 703900627deeafba4429c9e14cd316c18c3bc0be14df6fbf69d2a83d249dd68af71cfb3d0974557400dcb499ab0c57ade3170a387777f9aff8cebb9c220bdf33

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

MD5 0e3580004efc9e812f2a0062ddb5e9c2
SHA1 a8a3016a9f6fbd04794730517c7b3fbff0a5664b
SHA256 e03da5a98dfbe43697cfabbe03130951fbd90fbe8292915c6a459a4f78c2aee3
SHA512 e70955e603e14d77ad577c0cd7169be720854d2d0b7d3f54f41b54af60527b7baabb3487093b01b6c1a2d743ee8ee2e49c49a2c2b3e21eb150688657c3d6613a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe58850a.TMP

MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712

C:\Program Files\chrome_Unpacker_BeginUnzipping2748_1475076640\manifest.json

MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 977042f68ef8b42e8ed5517360aab988
SHA1 36696f01bb777ccaa07fd5cae2a16a3ab3b18cc0
SHA256 e20990ec035cd2a984ac55ea4a6b3a78ddf8d8d9cdfab76223e38e0328a6a8b4
SHA512 722ef0b9dd66969acbbcdbc3f60e96b9bdac2d13cef2afc05a1204cf3364dee184448fe5a4ed3d35a242585e7787a8b031bf44549d38fe9bb5b28a2b9e77b021

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

MD5 77d94e989146ee969d99da6111e0372f
SHA1 e261469b2859b1a2c8236a34acce0a765d253d15
SHA256 8ac37a4f1c2acdb8e65095d5f89131804f4ca18a6f03c6f2faf510482e112b93
SHA512 658348950fbebce2a6c7b03e7792df046eab82331de47f43198b7c6272ddf53e2a127afe0957f19116f63a42d8a32d304ff7536f4f82bb452df56e3c45c7ef2b

C:\Program Files\chrome_Unpacker_BeginUnzipping2748_287549654\manifest.json

MD5 049c307f30407da557545d34db8ced16
SHA1 f10b86ebfe8d30d0dc36210939ca7fa7a819d494
SHA256 c36944790c4a1fa2f2acec5f7809a4d6689ecb7fb3b2f19c831c9adb4e17fc54
SHA512 14f04e768956bdd9634f6a172104f2b630e2eeada2f73b9a249be2ec707f4a47ff60f2f700005ca95addd838db9438ad560e5136a10ed32df1d304d65f445780

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.9\protocols.json

MD5 f9fd82b572ef4ce41a3d1075acc52d22
SHA1 fdded5eef95391be440cc15f84ded0480c0141e3
SHA256 5f21978e992a53ebd9c138cb5391c481def7769e3525c586a8a94f276b3cd8d6
SHA512 17084cc74462310a608355fbeafa8b51f295fb5fd067dfc641e752e69b1ee4ffba0e9eafa263aab67daab780b9b6be370dd3b54dd4ba8426ab499e50ff5c7339

C:\Program Files\chrome_Unpacker_BeginUnzipping2748_1841941547\manifest.json

MD5 a24a1941bbb8d90784f5ef76712002f5
SHA1 5c2b6323c7ed8913b5d0d65a4d21062c96df24eb
SHA256 2a7fe18a087d8e8be847d9569420b6e8907917ff6ca0fa42be15d4e3653c8747
SHA512 fd7dfec3d46b2af0bddb5aaeae79467507e0c29bab814007a39ea61231e76123659f18a453ed3feb25f16652a0c63c33545e2a0d419fafea89f563fca6a07ce2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2.0.0.0\office_endpoints_list.json

MD5 94406cdd51b55c0f006cfea05745effb
SHA1 a15dc50ca0fd54d6f54fbc6e0788f6dcfc876cc9
SHA256 8480f3d58faa017896ba8239f3395e3551325d7a6466497a9a69bf182647b25e
SHA512 d4e621f57454fea7049cffc9cc3adfb0d8016360912e6a580f6fe16677e7dd7aa2ee0671cb3c5092a9435708a817f497c3b2cc7aba237d32dbdaae82f10591c3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 f48744759f5bdac224d5f4a2b5599de4
SHA1 b311de62cd2cb259481a8b6902cd13a1f0c43364
SHA256 b8b58f08667222626b1c2db9c937414987019ae863d5314149cf11de55eed48a
SHA512 fb901615f31af600a67a92ccb87d9890842d8c7b2198e5b5b89634276825e1ae18a70a80c5531915f2caa48f1a60d46b5bc1022b1bfd9846c924466523e35bb2

C:\Program Files\chrome_Unpacker_BeginUnzipping2748_2090256682\manifest.json

MD5 e0909520982fc48e47a6451443b11741
SHA1 0e46425274933c153ebf5a03f25e693267a8cea2
SHA256 2e9e6138305d702f3c9b89d6e9dc4931b548c69bb86db64e585fa2e37b8ef654
SHA512 3fdf504cb0bf39a807fa15a8ec31a6efd8083888692935ec31d70b4ef6eef89b8527c6a75a46bf7ae3efeeaa507ac3c7cccda5246a2f073ac603a7ffa10d20a8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

MD5 29d9a14babc8d183b559cae45fab2692
SHA1 170ed460934f7efc8ae587aceb4eb110c754ab3a
SHA256 0caa0dcaf709bdeefed65a72edaf985253e66ebf702eed230fe75007bc1d384f
SHA512 7e16760a9b2914001cbcaead2a7f4cc07348fb8f74fceed81d74e8d1c816cc3442fb58a587d94f705ba8134fb6da34c26d4f985bb3683e523367baab22814259

C:\Program Files\chrome_Unpacker_BeginUnzipping2748_142104429\LICENSE

MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

C:\Program Files\chrome_Unpacker_BeginUnzipping2748_142104429\manifest.json

MD5 89217e000f3145a2523e43f947208e79
SHA1 cd7915d003ee87f2babc9ee9add12841022710ac
SHA256 6722a860c855cf94a54fd1ffdd3801c4c949f5b67d8601ad300264931057f2bb
SHA512 385257ef9c67d80006eb350ac79718f30e08d810a1568454806f2505b482e0093f784d0d4cd24078317f863db500898343ce69391c0ae7fc767697f6da38eeaf

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2025.5.15.1\keys.json

MD5 03f15dff10ac451682f8a308674ddf77
SHA1 c723e23c49bed8a52b8f947b2cb8879a110fc94b
SHA256 f967e18d5b1839ba801212f032e7e6dd92f7ba6958bc3ae9b122d9fadf2b1bf4
SHA512 df8fdc89cc1e6f2edce49b41bd9f71dc7f7a8daab40f1355415119f9c0a0d5067337d966472ad49f855ecb9a89bee8d1711d8a869589a03e469530ee8d7e0f3e

C:\Program Files\chrome_Unpacker_BeginUnzipping2748_1588645368\manifest.json

MD5 4055ba4ebd5546fb6306d6a3151a236a
SHA1 609a989f14f8ee9ed9bffbd6ddba3214fd0d0109
SHA256 cb929ae2d466e597ecc4f588ba22faf68f7cfc204b3986819c85ac608d6f82b5
SHA512 58d39f7ae0dafd067c6dba34c686506c1718112ad5af8a255eb9a7d6ec0edca318b557565f5914c5140eb9d1b6e2ffbb08c9d596f43e7a79fdb4ef95457bf29a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

MD5 394fc1241331e47e78db217370fac83e
SHA1 b09e710d0e5a96d17836b4e3ae85bce162101d4e
SHA256 7917b252f67f0d35da1173460103a6030483836aad6908dd59cef860222aa773
SHA512 2c1dbed51cab154c3e788430f6ee9c337fad6084df5d8a2fb0451d26b9e377be92a06c4fd66e521a92582ad314d355217b4378fca2f486349651b8a0e33b0cc6

C:\Program Files\chrome_Unpacker_BeginUnzipping2748_922506108\manifest.json

MD5 8177721150435a9b333475e2b8a6e691
SHA1 8aa8981617e8f3d8967a0a4a2d20315317eba293
SHA256 8a4800ed5f63b9371a024c501ee2b031af94539e32e6753214e6d99c625c018c
SHA512 540c4c52030c6a4e1efcfab5eb59760c696bb3e3f1b8f93c97a6368639a911ba3d395190fc0798d99f3c63e25b6dcf2ded482bbda34d36ddd874dd20c2cfdf74

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

MD5 f01dbfd1b3b1eed5909eff5941d4e39a
SHA1 c30c78737eecbcb6b280b847e31cb544a34e6660
SHA256 283ca5dc0c638b07a6fb045f5fcd77a2df09040178d0c2bedaf5aeebfd7475a6
SHA512 4ce60607ab3d297abc8a1522e115d25c7cb8599020ce3ce2346db6c0f3afe382b20c9662b872b721daa49cf973e198ab8fc75a869a2dd4104ffc82b54d4cd29f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation\6498.2024.12.2\crl-set

MD5 846feb52bd6829102a780ec0da74ab04
SHA1 dd98409b49f0cd1f9d0028962d7276860579fb54
SHA256 124b7eeba31f0e3d9b842a62f3441204beb13fade81da38b854aecba0e03a5b4
SHA512 c8759e675506ccc6aa9807798252c7e7c48a0ab31674609738617dc105cee38bce69d4d41d6b95e16731466880b386d35483cbeea6275773f7041ba6e305fae9

C:\Program Files\chrome_Unpacker_BeginUnzipping2748_771950032\manifest.json

MD5 e6cd92ad3b3ab9cb3d325f3c4b7559aa
SHA1 0704d57b52cf55674524a5278ed4f7ba1e19ca0c
SHA256 63dfb8d99ce83b3ca282eb697dc76b17b4a48e4065fc7efafb77724739074a9d
SHA512 172d5dc107757bb591b9a8ed7f2b48f22b5184d6537572d375801113e294febfbe39077c408e3a04c44e6072427cbe443c6614d205a5a4aa290101722e18f5e8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old

MD5 df3f1a6a3a91b2adc4e74b5c4ecdf7c5
SHA1 01592763950873e841c40268f4fc1890561137fa
SHA256 20ef8a6a2e5fb83f3325c24eb9d0e04709ef35f3ae7b4a825073339a8e2435de
SHA512 005e7623c1d878ed0982a4dfd9a59c386d9dab36e957f469798a462c6a7235913d451e15cfcd1f4f925451140cc83904c94aba439b7bf06606f1a76a89fd129c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 ce0888f1a5b5dbcc2ad45fcdf70dde66
SHA1 caba41ba36ae5cd978fe08b5cc1c43f7c2d1040e
SHA256 ca3108ad22788c567d93fc9f8afa04f4aef8d4bacdb7cbecd4675bce671a6b59
SHA512 2121562e4afcd4b353e6ba15886e69d866687dd169e767e5228fa15058c8bfc349c480c6fd67cddcbcb597d719aa1b292d65df85cdc524810af625c7c5a2ab53

C:\Program Files\chrome_Unpacker_BeginUnzipping2748_924701253\manifest.json

MD5 15b69964f6f79654cbf54953aad0513f
SHA1 013fb9737790b034195cdeddaa620049484c53a7
SHA256 1bdda4a8fc3e2b965fbb52c9b23a9a34871bc345abfb332a87ea878f4472efbd
SHA512 7eeee58e06bba59b1ef874436035202416079617b7953593abf6d9af42a55088ab37f45fdee394166344f0186c0cb7092f55ed201c213737bb5d5318e9f47908

C:\Program Files\chrome_Unpacker_BeginUnzipping2748_594449378\manifest.json

MD5 390af74c5ae643320cad0cef4fa8fee1
SHA1 22ce727f9bcff9a914eb1d58ba8384de6fbda7e1
SHA256 1148c28e540b9b96237b35170a547a13165d6c7c039b8fff9e4b2cd774b92f5a
SHA512 deaeeeffdddea1a9047e97d82e3bb701fb865adcd77ef9e985bb0ec5e4057155e7b83cad4f9f3dd256edf89f19d1075349cea5005dffff8420da4d0646be413a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.24\autofill_bypass_cache_forms.json

MD5 9357a694006d8bec3d0f8c9607b76ff8
SHA1 6335ce691999ec10de742cd07d074eb648631259
SHA256 b6c37df977f149c5a444c72ea4469ce666c7975d34c6e2e0d9d8ec416f57dd44
SHA512 87c2d0192f3a78b13a691cda14da507f260d13331b792eb973869bd6dbd0f207faa48f68882be691641b46c06ed12ee8b9728a3b596df67a1f9a4831b4369a44

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.24\v1FieldTypes.json

MD5 c1a0d30e5eebef19db1b7e68fc79d2be
SHA1 de4ccb9e7ea5850363d0e7124c01da766425039c
SHA256 f3232a4e83ffc6ee2447aba5a49b8fd7ba13bcfd82fa09ae744c44996f7fcdd1
SHA512 f0eafae0260783ea3e85fe34cc0f145db7f402949a2ae809d37578e49baf767ad408bf2e79e2275d04891cd1977e8a018d6eeb5b95e839083f3722a960ccb57a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.24\edge_autofill_global_block_list.json

MD5 adb5f6058f82680a26d6ed02b44e5a21
SHA1 6197ee74e40c742e184357dcb6dfcc7e32818cae
SHA256 7655c9afb5f2ea39b18e302498b34009ca02b72451f82a6d4e7fb4d8d954f050
SHA512 742dd8f6eaf1bd5f24b37e90d7a3dce7bd0a8edf399c2dec25cd92d2bd6e1d663ebab3c68234812f0144061d4f22f0c2c43de890f60e24d93133bbfe23a6d1c5

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

MD5 0396a9d14a2e5d8ca99b30925c1f4310
SHA1 126c1fc664a65fd95b9aa3397969292563afd058
SHA256 842728e8b96ee1ca2edf3fa4e78585e9742f5d385e71dd444e0bef0b7839852c
SHA512 e708b39a646fcc712bd09363d910bffe4065f54e8fe217038398a66ccd6546ea0876480ffef503122c06d67bca656ac32b58af4878d63a08087bccec341182f9

C:\Program Files\chrome_Unpacker_BeginUnzipping2748_956244015\manifest.json

MD5 a30b19bb414d78fff00fc7855d6ed5fd
SHA1 2a6408f2829e964c578751bf29ec4f702412c11e
SHA256 9811cd3e1fbf80feb6a52ad2141fc1096165a100c2d5846dd48f9ed612c6fc9f
SHA512 66b6db60e9e6f3059d1a47db14f05d35587aa2019bc06e6cf352dfbb237d9dfe6dce7cb21c9127320a7fdca5b9d3eb21e799abe6a926ae51b5f62cf646c30490

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SafetyTips\3057\safety_tips.pb

MD5 bd6846ffa7f4cf897b5323e4a5dcd551
SHA1 a6596cdc8de199492791faa39ce6096cf39295cd
SHA256 854b7eb22303ec3c920966732bc29f58140a82e1101dffe2702252af0f185666
SHA512 aa19b278f7211ffaf16b14b59d509ce6b80708e2bb5af87d98848747de4cba13b6626135dd3ec7aabd51b4c2cfb46ed96800a520d2dae8af8105054b6cd40e0b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SafetyTips\3057\typosquatting_list.pb

MD5 17c10dbe88d84b9309e6d151923ce116
SHA1 9ad2553c061ddcc07e6f66ce4f9e30290c056bdf
SHA256 3ad368c74c9bb5da4d4750866f16d361b0675a6b6dc4e06e2edd72488663450e
SHA512 ad8ed3797941c9cad21ae2af03b77ce06a23931d9c059fe880935e2b07c08f85fc628e39873fb352c07714b4e44328799b264f4adb3513975add4e6b67e4a63c

C:\Program Files\chrome_Unpacker_BeginUnzipping2748_555418456\manifest.json

MD5 b4d869dd7052d78d29b3e439565f1600
SHA1 caa2cfa31729f4348a02514eba0235e72b88ce5a
SHA256 0f8ee89c4a420bda691d058cdd96c874c2edeec84145c81c957e98d05e351d3c
SHA512 1fda3488df8c43ad413b2e69a5e2292322fe837f7b27b88302b4e591e7e13fdceacb0af9b8bb92ca7c0d2b39abffc776c6cc35d18abb86ce91f55c719b43480e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.3.11\data.txt

MD5 1bee2c36cebf096d8a559d5c4eeacff7
SHA1 c695eda67f31d729dfc336b8a471ad6346a39031
SHA256 5e4014e267eec120e673cfbc407e4340c234a7898319b35a304ed6ea343a7999
SHA512 ba520d383be95d8b15140b7e38e4e7ac03077bbbb8ee5326ac4162be9403bc9f0576e53840fc22cd9c4038f19f60bdeb7b4e8e0125da6ed80670238de812b4b5

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

MD5 7138ba81920ce0a5a62a49b6d453c6f2
SHA1 68a5057d100523005d82fdd7c8f34a62a91cd58f
SHA256 fa8dffc715fe40feac071ccbe86073839659a31df377b3a5c698472b3102137c
SHA512 8a1156489b8dcf8cb9c70c1d80f32650b8833cde8be017ee34caa9cdd635cb3ac63b7c460d10b9b3c91f97f37a4dd44c40a153ade14a72bd96c402738b9572a5

C:\Program Files\chrome_Unpacker_BeginUnzipping2748_1906224085\manifest.json

MD5 0abdce2e93f6542edfc9dfbcfb61ce89
SHA1 08067386e18ea1d48d916ecae2d2583a5f6df6ce
SHA256 d912b0ee06353fc36393d1c187a22d37d467e14ddb389a930ff7317b6760531c
SHA512 ec60d26c4b1c1e437c5c88fd9efc504843551a51d3c1b036a5b518cbaccec6e86fddca534b96d490872c6fd53a874f765367d3784473b948f112a51addc9f730

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2025.7.2.1\typosquatting_list.pb

MD5 8aeeb5c136b1deeeee3677f4b93e2575
SHA1 c716557d8d504577e2d22bb710e94663b91c80f3
SHA256 b8d2c9ee5824a35ef1bcc746200cc710bad4951d4ee16be4acb8a8f503bd4856
SHA512 a5b927c20ade622589e09a7443e7fef2ae2b445b22aa773c4bd05c248d48f0bd0e7e2f3595441bd40957c08f29d660f27b7238030c51303d338738e2b1c51b17

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

MD5 b508d62ec65c6281e1f6123cddc11b5a
SHA1 c8cc162b27238b2cff93c78c592e6be3e75050c4
SHA256 64c583406f7748696ecc201175facc645eadc7e3b180f61ddd1092070efbedfd
SHA512 7d50b34095ca1f6f46f5bc3c2d8d1681ff3796a44d68cad38264053450ffd7cb27a5d365dfc7cffcac71242736067b4613d3cfa76dd01d45a8a58eea25507a51

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old

MD5 529908cf4a524377ee99f1b03fe49366
SHA1 e55d903ba7d3db6c5a738fa4d2fea8efdcfc6a40
SHA256 32e1c138188c2221a924d95c2920efd9e1bde0e26ac2d3f30680471c5ec9d257
SHA512 41b9eaa62b93e7a3049d15f8b84aa2ec4c20c81d07b75452557968821711e19d27dff8f3fa6ef838d16d0a1b87475ff1cd74e0ca2d2de76581c0251372efa2c4

C:\Program Files\chrome_Unpacker_BeginUnzipping2748_601936245\manifest.json

MD5 b0e549dcc425951a670808d628ab5181
SHA1 63c37e4fd9193836f0100cee2bf76585787ae94b
SHA256 b2c8ee75956c3bb7ea6865137c441b916badfb99c922c17785875e784c96e29a
SHA512 d6dc7c7ddd5ad8ca06a831faa6bd399c8af77e0b21cfd039c608f366fb54b8d4553fc8f947a070544f472966190cf1ca5a236d1084be824b06684b6c6e8de0dc

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\24.0.0.0\kp_pinslist.pb

MD5 563bdb2192acf2c106832f696df5d84c
SHA1 898eee38d08e09254c39dd0d1707c98f95cb2fa6
SHA256 2efcd280779456d767025a4f2915012cb9b11af2b8e199d3f32152232bf09460
SHA512 550e3dbaa0a5d74763465318b6f14035e16e1d70602ca36a5636d159875b527fae51f0c7f81e380797b4871283dbddb964017e7a16857228a621284d7aef00f5

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\24.0.0.0\ct_config.pb

MD5 4fdf7c8ca48768f459c97b25fdd10d9b
SHA1 d1f0ac34a53294875dd7bc03dfbdf5c7ae65a4d0
SHA256 6a350094ab9a19b758f6660a58afdecc44e83b3ce8c3521fe3b831d5945a3911
SHA512 7322c942946b83ed8cf8875613f72ab5fa5fcb4ca1671bba22bd02404546f8ce099b2941cb0897b3209aecb85b6ac2f1b98f2d11678e5304b55ae3974192042d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\24.0.0.0\crs.pb

MD5 916f38644626b7201f29c01bc659525b
SHA1 c259bfd1ccbf1347b6a0bac43e7aead100ca7092
SHA256 8ba4acc8582041e5caa5dc4c73ade421b52a8b018e70f12b7a1437f74c6a955e
SHA512 33539525ec8bf13ee832365994dd6b3bc2162ef64e032baa1ab6e45d701125d08009504c254e85b763b69abd93f10366a4b44e5e62f7705c988c089aea447d19

C:\Program Files\chrome_Unpacker_BeginUnzipping2748_1300695322\manifest.json

MD5 811f0436837c701dc1cea3d6292b3922
SHA1 4e51a3e9f5cbf8c9c96985dabe8ffc2de28dae87
SHA256 dbfb38a16e33a39c35ac50bd81782e4608be14954f1df69ac8272c0b9ce87a5d
SHA512 21e7bf2f8333b2900bcbcb871ede14684073249597d105095dc7d3f101e7ccc326068732f11d4a167365f245a3f2205793f520c7666d7f948e70919b40b43d35

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Well Known Domains\1.2.0.0\well_known_domains.dll

MD5 f5f5b37fd514776f455864502c852773
SHA1 8d5ed434173fd77feb33cb6cb0fad5e2388d97c6
SHA256 2778063e5ded354d852004e80492edb3a0f731b838bb27ba3a233bc937592f6e
SHA512 b0931f1cae171190e6ec8880f4d560cc7b3d5bffe1db11525bd133eaf51e2e0b3c920ea194d6c7577f95e7b4b4380f7845c82eb2898ad1f5c35d4550f93a14b6

C:\Program Files\chrome_Unpacker_BeginUnzipping2748_1269963770\manifest.json

MD5 b721bdf2924d658186ac8868dbd2c008
SHA1 914aacc65bb7933bd73aa06f8bd2ca0b04de3858
SHA256 dc6a19395ad3a24ee3805f6e90c6b16fdc141a51ac7fbb99fb784e423f8962f3
SHA512 4c1c16f714a2e2436697bc801f7e2f684010c833e3d5fe6ed68d6f3e630afa495412ea5a1b46f4bbbb1102feede84e72f32686910492510cbce71888a85b5fda

C:\Program Files\chrome_Unpacker_BeginUnzipping2748_43306389\manifest.json

MD5 ba25fcf816a017558d3434583e9746b8
SHA1 be05c87f7adf6b21273a4e94b3592618b6a4a624
SHA256 0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
SHA512 3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f

Analysis: behavioral2

Detonation Overview

Submitted

2025-07-04 17:29

Reported

2025-07-04 17:44

Platform

win10ltsc2021-20250619-en

Max time kernel

870s

Max time network

739s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://malwarebytes

Signatures

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1740_1837523682\male_names.txt C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1740_1257096708\Part-ZH C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1740_1259620029\json\i18n-hub\fr-CA\strings.json C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1740_1218739164\manifest.json C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1740_1218739164\manifest.fingerprint C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1740_1686888158\auto_open_controller.js C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1740_1259620029\json\i18n-hub\en-GB\strings.json C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1740_1259620029\json\i18n-notification\fr-CA\strings.json C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1740_1259620029\shopping_iframe_driver.js C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File opened for modification C:\Windows\SystemTemp C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1740_1257096708\Part-RU C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1740_1259620029\json\i18n-notification-shared\pt-BR\strings.json C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1740_1259620029\json\i18n-tokenized-card\en-GB\strings.json C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1740_354741708\hyph-cs.hyb C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1740_1259620029\json\i18n-notification\el\strings.json C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1740_1259620029\wallet-webui-560.da6c8914bf5007e1044c.chunk.js C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1740_1193672459\manifest.fingerprint C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1740_1837523682\manifest.fingerprint C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1740_354741708\hyph-it.hyb C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1740_1686888158\shopping_fre.html C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1740_1259620029\json\i18n-notification-shared\id\strings.json C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1740_1259620029\Notification\notification.bundle.js.LICENSE.txt C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1740_1567704060\data.txt C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1740_354741708\hyph-en-gb.hyb C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1740_1259620029\bnpl\bnpl.bundle.js C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1740_1259620029\json\i18n-notification-shared\fi\strings.json C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1740_1259620029\json\i18n-notification-shared\fr-CA\strings.json C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1740_1259620029\json\i18n-shared-components\fi\strings.json C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1740_1259620029\json\i18n-tokenized-card\zh-Hant\strings.json C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1740_609146271\_metadata\verified_contents.json C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1740_354741708\hyph-de-ch-1901.hyb C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1740_1259620029\buynow_driver.js C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1740_1259620029\json\i18n-mobile-hub\pt-BR\strings.json C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1740_1259620029\json\i18n-shared-components\pt-BR\strings.json C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1740_1259620029\json\wallet\wallet-checkout\checkoutdata.json C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1740_1259620029\webui-setup.js C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1740_1259620029\Mini-Wallet\mini-wallet.html C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1740_354741708\hyph-sv.hyb C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1740_354741708\hyph-ta.hyb C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1740_1259620029\json\i18n-hub\sv\strings.json C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1740_1259620029\json\i18n-mobile-hub\it\strings.json C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1740_1259620029\json\i18n-notification\en-GB\strings.json C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1740_1259620029\json\i18n-notification\ko\strings.json C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1740_354741708\hyph-bg.hyb C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1740_354741708\hyph-kn.hyb C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1740_1686888158\manifest.json C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1740_1259620029\json\i18n-ec\da\strings.json C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1740_354741708\hyph-cu.hyb C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1740_1259620029\json\i18n-ec\es\strings.json C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1740_1259620029\json\i18n-hub\pl\strings.json C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1740_1259620029\json\i18n-mobile-hub\pt-PT\strings.json C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1740_1259620029\json\i18n-shared-components\ar\strings.json C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1740_1259620029\json\i18n-shared-components\zh-Hans\strings.json C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1740_1259620029\json\i18n-tokenized-card\ru\strings.json C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1740_1259620029\json\wallet\wallet-eligibile-aad-users.json C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1740_1259620029\json\i18n-ec\pt-PT\strings.json C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1740_1259620029\json\i18n-notification-shared\zh-Hant\strings.json C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1740_1259620029\json\i18n-shared-components\pl\strings.json C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1740_1259620029\Tokenized-Card\tokenized-card.html C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1740_1259620029\vendor.bundle.js C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1740_1259620029\Wallet-BuyNow\wallet-buynow.bundle.js C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1740_1259620029\Wallet-Checkout\wallet-drawer.html C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1740_1259620029\json\i18n-mobile-hub\fr\strings.json C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1740_1259620029\json\i18n-notification\de\strings.json C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Browser Information Discovery

discovery

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133961237795118659" C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2480555372-1462975536-333993236-1000\{6190C71B-A577-40CB-9442-A078C47A9882} C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1740 wrote to memory of 1348 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1740 wrote to memory of 1348 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1740 wrote to memory of 5708 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1740 wrote to memory of 5708 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1740 wrote to memory of 4460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1740 wrote to memory of 4460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1740 wrote to memory of 4460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1740 wrote to memory of 4460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1740 wrote to memory of 4460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1740 wrote to memory of 4460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1740 wrote to memory of 4460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1740 wrote to memory of 4460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1740 wrote to memory of 4460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1740 wrote to memory of 4460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1740 wrote to memory of 4460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1740 wrote to memory of 4460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1740 wrote to memory of 4460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1740 wrote to memory of 4460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1740 wrote to memory of 4460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1740 wrote to memory of 4460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1740 wrote to memory of 4460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1740 wrote to memory of 4460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1740 wrote to memory of 4460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1740 wrote to memory of 4460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1740 wrote to memory of 4460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1740 wrote to memory of 4460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1740 wrote to memory of 4460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1740 wrote to memory of 4460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1740 wrote to memory of 4460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1740 wrote to memory of 4460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1740 wrote to memory of 4460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1740 wrote to memory of 4460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1740 wrote to memory of 4460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1740 wrote to memory of 4460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1740 wrote to memory of 4460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1740 wrote to memory of 4460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1740 wrote to memory of 4460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1740 wrote to memory of 4460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1740 wrote to memory of 4460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1740 wrote to memory of 4460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1740 wrote to memory of 4460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1740 wrote to memory of 4460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1740 wrote to memory of 4460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1740 wrote to memory of 4460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1740 wrote to memory of 4460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1740 wrote to memory of 4460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1740 wrote to memory of 4460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1740 wrote to memory of 4460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1740 wrote to memory of 4460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1740 wrote to memory of 4460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1740 wrote to memory of 4460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1740 wrote to memory of 4460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1740 wrote to memory of 4460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1740 wrote to memory of 4460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1740 wrote to memory of 4460 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1740 wrote to memory of 3848 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1740 wrote to memory of 3848 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1740 wrote to memory of 3848 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1740 wrote to memory of 3848 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1740 wrote to memory of 3848 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1740 wrote to memory of 3848 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1740 wrote to memory of 3848 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1740 wrote to memory of 3848 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1740 wrote to memory of 3848 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://malwarebytes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x314,0x7ff8c828f208,0x7ff8c828f214,0x7ff8c828f220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1940,i,6488492707043206903,2061542866497925391,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2252,i,6488492707043206903,2061542866497925391,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=1956,i,6488492707043206903,2061542866497925391,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3452,i,6488492707043206903,2061542866497925391,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3480,i,6488492707043206903,2061542866497925391,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4344,i,6488492707043206903,2061542866497925391,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=5252,i,6488492707043206903,2061542866497925391,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5212,i,6488492707043206903,2061542866497925391,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3708,i,6488492707043206903,2061542866497925391,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4928,i,6488492707043206903,2061542866497925391,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5928,i,6488492707043206903,2061542866497925391,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5928,i,6488492707043206903,2061542866497925391,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:8

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=4308,i,6488492707043206903,2061542866497925391,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3484,i,6488492707043206903,2061542866497925391,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3692,i,6488492707043206903,2061542866497925391,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3728,i,6488492707043206903,2061542866497925391,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=3992,i,6488492707043206903,2061542866497925391,262144 --variations-seed-version --mojo-platform-channel-handle=3216 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6376,i,6488492707043206903,2061542866497925391,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5444,i,6488492707043206903,2061542866497925391,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5880,i,6488492707043206903,2061542866497925391,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --field-trial-handle=6092,i,6488492707043206903,2061542866497925391,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5408,i,6488492707043206903,2061542866497925391,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2936,i,6488492707043206903,2061542866497925391,262144 --variations-seed-version --mojo-platform-channel-handle=2068 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5580,i,6488492707043206903,2061542866497925391,262144 --variations-seed-version --mojo-platform-channel-handle=3204 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5112,i,6488492707043206903,2061542866497925391,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4840,i,6488492707043206903,2061542866497925391,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5352,i,6488492707043206903,2061542866497925391,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3348,i,6488492707043206903,2061542866497925391,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5100,i,6488492707043206903,2061542866497925391,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=2800,i,6488492707043206903,2061542866497925391,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6428,i,6488492707043206903,2061542866497925391,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=1256,i,6488492707043206903,2061542866497925391,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --field-trial-handle=6528,i,6488492707043206903,2061542866497925391,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6460,i,6488492707043206903,2061542866497925391,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5060,i,6488492707043206903,2061542866497925391,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=1200,i,6488492707043206903,2061542866497925391,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3416,i,6488492707043206903,2061542866497925391,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6416,i,6488492707043206903,2061542866497925391,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 copilot.microsoft.com udp
US 8.8.8.8:53 copilot.microsoft.com udp
US 8.8.8.8:53 api.edgeoffer.microsoft.com udp
US 8.8.8.8:53 api.edgeoffer.microsoft.com udp
US 150.171.28.11:80 edge.microsoft.com tcp
US 150.171.27.11:443 edge.microsoft.com tcp
US 13.107.246.64:443 api.edgeoffer.microsoft.com tcp
FR 2.22.251.67:443 copilot.microsoft.com tcp
US 13.107.246.64:443 api.edgeoffer.microsoft.com tcp
FR 2.22.251.67:443 copilot.microsoft.com tcp
US 150.171.27.11:443 edge.microsoft.com tcp
US 150.171.27.11:443 edge.microsoft.com tcp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 150.171.27.11:443 edge.microsoft.com tcp
FR 2.22.251.54:443 www.bing.com tcp
US 8.8.8.8:53 update.googleapis.com udp
US 8.8.8.8:53 update.googleapis.com udp
IE 74.125.193.94:443 update.googleapis.com tcp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 150.171.28.11:443 edge.microsoft.com tcp
US 8.8.8.8:53 edgeassetservice.azureedge.net udp
US 8.8.8.8:53 edgeassetservice.azureedge.net udp
US 13.107.246.64:443 edgeassetservice.azureedge.net tcp
US 150.171.27.11:443 edge.microsoft.com tcp
US 8.8.8.8:53 edge-consumer-static.azureedge.net udp
US 8.8.8.8:53 edge-consumer-static.azureedge.net udp
US 13.107.246.64:443 edge-consumer-static.azureedge.net tcp
US 8.8.8.8:53 static.edge.microsoftapp.net udp
US 8.8.8.8:53 static.edge.microsoftapp.net udp
US 13.107.246.64:443 static.edge.microsoftapp.net tcp
US 150.171.28.11:443 edge.microsoft.com tcp
US 8.8.8.8:53 msedge.b.tlu.dl.delivery.mp.microsoft.com udp
GB 23.56.238.51:80 msedge.b.tlu.dl.delivery.mp.microsoft.com tcp
FR 2.22.251.48:443 www.bing.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 msedge.b.tlu.dl.delivery.mp.microsoft.com udp
US 8.8.8.8:53 c.pki.goog udp
IE 209.85.202.94:80 c.pki.goog tcp
US 8.8.8.8:53 msedge.b.tlu.dl.delivery.mp.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
FR 2.22.251.6:443 www.bing.com udp
US 8.8.8.8:53 msedge.b.tlu.dl.delivery.mp.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 msedge.b.tlu.dl.delivery.mp.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
FR 2.22.251.20:443 www.bing.com udp
US 8.8.8.8:53 msedge.b.tlu.dl.delivery.mp.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 150.171.27.11:443 edge.microsoft.com tcp
US 8.8.8.8:53 msedge.b.tlu.dl.delivery.mp.microsoft.com udp
US 8.8.8.8:53 msedge.b.tlu.dl.delivery.mp.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 150.171.27.11:443 edge.microsoft.com tcp
US 23.4.84.73:443 www.bing.com udp
US 8.8.8.8:53 msedge.b.tlu.dl.delivery.mp.microsoft.com udp
US 8.8.8.8:53 msedge.b.tlu.dl.delivery.mp.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 msedge.b.tlu.dl.delivery.mp.microsoft.com udp
US 23.4.84.73:443 www.bing.com udp
US 8.8.8.8:53 msedge.b.tlu.dl.delivery.mp.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 23.4.84.73:443 www.bing.com udp
GB 23.56.238.51:80 msedge.b.tlu.dl.delivery.mp.microsoft.com tcp
US 8.8.8.8:53 msedge.b.tlu.dl.delivery.mp.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
GB 23.56.238.51:80 msedge.b.tlu.dl.delivery.mp.microsoft.com tcp
US 8.8.8.8:53 msedge.b.tlu.dl.delivery.mp.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 150.171.28.11:443 edge.microsoft.com tcp
US 8.8.8.8:53 edgeassetservice.azureedge.net udp
US 8.8.8.8:53 edgeassetservice.azureedge.net udp
US 13.107.246.64:443 edgeassetservice.azureedge.net tcp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 2e5857b0fc9db0d8c1a5b8bd22f8da38
SHA1 4487199992f24e32a0a06673d85caf6334683746
SHA256 71acce55790bfb015408747395c0676b96af40c001dc01757b3a994d7ad8aec3
SHA512 8e90ad6ed56a4d0231146759d2cef2df2ab1bfabefe2d6bb189f2ab687b0868963a84d34698651c4670c054d1bdf33613855dafedcd1b392f4400b56ab8078d3

\??\pipe\crashpad_1740_EDQSZCUOJIORUQWS

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 ccfb5b9132fc8538343de901128a6000
SHA1 8a25c6620b5bf4cb254071784edad540bb269222
SHA256 84849ac0ded0022a405716a4785406d69ae5c9a44a07af3b2f9deb7eb4deb17f
SHA512 552ef082f8cdcacac3053dd7ed00d23354c8456ad636b23d142e0fc773c1c1bf8df7bac15f1453d43f2af54895fea761b1ac089ae4cd78678e67a436c4e98869

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

MD5 91732c9dade52d6ed7d2d449e97e15a6
SHA1 f3a2cd26beb63f06dbad11b2f2b086bf4857501b
SHA256 1a3e9d31c95b347327f36bf4b28fb2a886fe191e22a9aac0c9e21a7b43316b24
SHA512 4c1b4db6c3f09a695a757ab4c75850719d94999973e118c8eba25b5e9e70d32838dd76aa79b6e8b6bc71f614c975fb015cf36e7bcecee784bffe6c8809ca531d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

MD5 e489970ae5035d5c8791687fcb57e244
SHA1 4e423a929edfefe58ac48ab6771adbbae779741b
SHA256 a5e5302e0f8157fe02fd6bbd34d4302e7ba2b3205fac0ec3fee1cb6bb7b80c6a
SHA512 c739d00019f5cbcd2c8a97d69c08f00d10de29efe8447f58ce856949484fe12ef9303a62ec462caea58013f32d7c419e98fd50c909b49214804cb2f46feaf591

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

MD5 06d55006c2dec078a94558b85ae01aef
SHA1 6a9b33e794b38153f67d433b30ac2a7cf66761e6
SHA256 088bb586f79dd99c5311d14e1560bbe0bb56225a1b4432727d2183341c762bcd
SHA512 ec190652af9c213ccbb823e69c21d769c64e3b9bae27bea97503c352163bf70f93c67cebbf327bfc73bfd632c9a3ae57283b6e4019af04750fe18a2410a68e60

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 da6949bcbea94292480c4c2f727b5e2d
SHA1 8eaf07eb0e4bdf2df3d74b11f8305d9871e0e26e
SHA256 f67c57cdd15149105dadc02a691066fa64c5eccc6d49374dba6ecedb67d6b8b7
SHA512 5d1a261734702e43fb43336bff2d9bb4d250d8c1685351cf1deac8f665bdfe01c7074ab47e4efd3a95d054b99f0de6dcd5a0452735de6329aacf5df5fbe11a58

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 3f4baef29d26e248764f2d83fb89c4a2
SHA1 4106d033d65cd252e47f15be44a4e0c3d06eb756
SHA256 844181a5d97ec33ae94df057c1427c440e399818e7c892bb42dc6f363c0fb76c
SHA512 707216ccade351e15576c77c2d9f2d7b9666c8bab2b3ceda16291a12889dbdd9948f6ea39b5ddf9d1d9464ca7f6a69446139b0a3fa231d22ccd2a63f6ebf58fa

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

MD5 0ec423fdf46fb153783a1fad170c2ec0
SHA1 4e9f448f07ea7850e115d088b1e1ecadcfec4d0c
SHA256 952051c4dde5a96b6d0f84f7ac5a49a74732204a135c026ce14b620eb75bc53d
SHA512 8ddfa83d9e71de06f0e7ebbddf0915914f851ac242f0322ec070af4eb618b3d271e3a88ef369da9fea51d0bcdff14dd62b7e1b7b8fd5bd55ea6015419f8c1921

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 73c7b6db5680c7308b333053bfb5c2f3
SHA1 366dab4a95c3f31647eaab457790e7b0eda5df06
SHA256 65dedc871326439409329f5c8e490bb2ef5d94a3f784768888d2e0a505424c23
SHA512 e2db2cb9777e724baeae381b1f3c03d3807ef401a88ae788224b17fc0f9f687dc0f65fa5fc0118f401f30d8982827168d50069c89b5bd6f3190f61e774397270

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

MD5 a3db280b328864642f321add20528df7
SHA1 cca789e5231b3f8d7600d4ea9576df89a69ea9e1
SHA256 0b42ef11b99571b6f5e8cda6183f1ee78a52443693c04dbc760b742f27ef0032
SHA512 aa82cf4a9739be9f42ea56332ebce6d9ede32fe1d2f92c8e2ce7fe067bd475c00ad530f9a628973e7dfa4cc5c86ca4cfdefbd286927c1fbf0e0c9d69ef34b6cc

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 a2dae552a3b590179084f64365f3a947
SHA1 cde499355b659fbd28aab0330fdd3102705a7afc
SHA256 9b0c9d9fbba2815a4035da9f369d8f99e3b822a5722eaffbfc8c75260b85145f
SHA512 758c2bf2d7c789b099d78c382155f993abf4138ac567bc89e9b1ca81db71fb01813ff0a36d8f56f1a079765c978968f3bd641d7cd3c93820bde0e6a0cde37cab

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

MD5 fa4deef880bb47d44d00ae037733370c
SHA1 73eb06ed0a8cf8f26f3ce9091510483d7df0e2a1
SHA256 6cd3a78c1791a0f5d04a5a1ae12ccae2e49227a1ddfb075e7d6e35ee95550659
SHA512 4381e66f15d9d71064c36513ecc11e12a98756905c12329d49c9ea9f3de09182ae2fbc6ca4ccdbf04464063064b8cd34ee0b928f4b7ea24f04f16db57bae3b21

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 eff59175011d7c829f3a3b9ba9073143
SHA1 446dd1366c9a851da3d9355b96815ed0542937b1
SHA256 b77a35df2f88eac6a20bdf22aa916ef91ce6b5cf66910b53518b73b39623067a
SHA512 f2a893f4c7f78d7ed055288a1b40dc5633d3140201e71468f64e9f66855f645d80c5e7b82b7aade6632cc823cbc35e2654b88255c54e015189b45c904e6cc218

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

MD5 34477aa83bef52043d94e8998b20217b
SHA1 522f9fce3639639b1fde1ac028d9b2cf94dca67b
SHA256 1fab8a554beb9d70e900730dcf11178f706aea4719ecb3b2adffc782bdfbdf87
SHA512 5facd9f67871447d437f12885090045ab38a1c799fd9db92b86e5f6803ec66abce811efeacf3c8412e489c8afacdea3e6a6c722fb5777f5811e569e600c624e8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old

MD5 1ca49c657c5cae7ec10e834d6ac8270f
SHA1 f002b3f8fcfebe22a5fc23c89ac4f16000408465
SHA256 233440edf4e66bcc7965734d49614885d332145449db813ad8cec6437aa7e3db
SHA512 d8b6d45da70cc90b68f7039f0f470260ad5c4de0566cb5850f4cf5615f8e20e7a13aca2792ce26b64438ecafdfc9d0ffb0e6a985259dbc802d3b79aa4037dc0e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

MD5 af486adb42ed8bc9f3559ea327ab63d5
SHA1 c21a47339b7728639363248856b9cdec53a13e6e
SHA256 e2dc37f162097f27aa9447f06adef3d55a7dffa078316736054db4ab3405fd94
SHA512 11a2f6b1701c0f678f5325aea4bdaa9f435db64668339b86348fa92c53208fc7b978da870ff7f49fa8662d24d1711b04d4d0e3fa6405b137e4256bb8be421935

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Well Known Domains\1.2.0.0\well_known_domains.dll

MD5 f5f5b37fd514776f455864502c852773
SHA1 8d5ed434173fd77feb33cb6cb0fad5e2388d97c6
SHA256 2778063e5ded354d852004e80492edb3a0f731b838bb27ba3a233bc937592f6e
SHA512 b0931f1cae171190e6ec8880f4d560cc7b3d5bffe1db11525bd133eaf51e2e0b3c920ea194d6c7577f95e7b4b4380f7845c82eb2898ad1f5c35d4550f93a14b6

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

MD5 611c0830e72b317a7516e2c5f6df7803
SHA1 c05542c29d897b03fca32dc97b0e17cd715f6c20
SHA256 b02ff53353ec668f8cfc457573ced7ec847ce8548d9f697999cb93121adf15a8
SHA512 ff83ce759d382d50657f603e84adc16903a026d98d33d6707a3df806028d442d929837f832b4cce575b3750e999b82128f688d743f9c407e93123df22ba76005

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old

MD5 f1154dc7cfcdf9f98c4a489f9cdd541d
SHA1 3c0cded0e5d5aa371a92cf22f816b576e5ec7ea9
SHA256 12912f680393207ef22162c39932a72132a0dc0cc7848596de2432fbc578b134
SHA512 bb9548a35032e5d9a1686bd60e9e3068c6f2b23d1e5e33d0e47d7e40000d71e42137cd9fafba0a38db03c3fc6726cee2a0d8c5fee36d290575454f1bd79a9f33

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1740_354741708\hyph-bn.hyb

MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1740_354741708\hyph-mr.hyb

MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1740_354741708\hyph-nn.hyb

MD5 f2d8fe158d5361fc1d4b794a7255835a
SHA1 6c8744fa70651f629ed887cb76b6bc1bed304af9
SHA256 5bcbb58eaf65f13f6d039244d942f37c127344e3a0a2e6c32d08236945132809
SHA512 946f4e41be624458b5e842a6241d43cd40369b2e0abc2cacf67d892b5f3d8a863a0e37e8120e11375b0bacb4651eedb8d324271d9a0c37527d4d54dd4905afab

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

MD5 15874a3fc3d02bf579092fe7ef92506c
SHA1 4a01e384e4e97d5871975c15896dbb289d29a321
SHA256 586e7ebd6ebdd86ecb062579eafa797e1e90e756f555d6d1eefe5a18c2bc99bb
SHA512 f2e9fa4c34e982a315ef2d520da316676556336eb4f651a4b2f331579143f6ff6590080d918bd2f762b392efaecf091613a45a9553fcb4c872bc2e6c37f87ceb

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1740_1686888158\edge_checkout_page_validator.js

MD5 03afb46c48ec22865708e6826a3a302b
SHA1 6566e24acf922c9d4034850bf1dac39786be0655
SHA256 03daef0d9039418880c9414c6cc56841b9d3facd790b2480e302c1803296b003
SHA512 6df8038a494df3412e2224b238da025d26ab477a02a1cd9ad809369047ac54fa745faf7bff4c209457fea59da64d23ff953b8213ed12cc1a2f4151a057df6c10

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

MD5 f374e9a1187c5d19d6b194ccc6f4b381
SHA1 b5ceada8e8b9900fa85258580aa14e6e48b8e143
SHA256 579bbfccd081ef7b31dc0013cb8afb5bb5f309d364d2bb5a79e0d8661325214f
SHA512 036898acef43c87a45a31c2938fa316f98c69d13ad85f13e11aaf781a03d88c25d1da74eaa9dbab8139a377a26081607d40e59dfe65d462ddf32d38afd0fd146

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1740_1259620029\Notification\notification.bundle.js.LICENSE.txt

MD5 8595bdd96ab7d24cc60eb749ce1b8b82
SHA1 3b612cc3d05e372c5ac91124f3756bbf099b378d
SHA256 363f376ab7893c808866a830fafbcd96ae6be93ec7a85fabf52246273cf56831
SHA512 555c0c384b6fcfc2311b47c0b07f8e34243de528cf1891e74546b6f4cda338d75c2e2392827372dc39e668ed4c2fd1a02112d8136d2364f9cab9ee4fa1bd87f5

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1740_1259620029\Mini-Wallet\miniwallet.bundle.js.LICENSE.txt

MD5 7bf61e84e614585030a26b0b148f4d79
SHA1 c4ffbc5c6aa599e578d3f5524a59a99228eea400
SHA256 38ed54eb53300fdb6e997c39c9fc83a224a1fd9fa06a0b6d200aa12ea278c179
SHA512 ca5f2d3a4f200371927c265b9fb91b8bcd0fbad711559f796f77b695b9038638f763a040024ed185e67be3a7b58fab22a6f8114e73fdbd1cccdda6ef94ff88f3

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1740_1259620029\json\i18n-tokenized-card\fr\strings.json

MD5 cd247582beb274ca64f720aa588ffbc0
SHA1 4aaeef0905e67b490d4a9508ed5d4a406263ed9c
SHA256 c67b555372582b07df86a6ce3329a854e349ba9525d7be0672517bab0ac14db5
SHA512 bf8fa4bd7c84038fae9eddb483ae4a31d847d5d47b408b3ea84d46d564f15dfc2bae6256eac4a852dd1c4ad8e58bc542e3df30396be05f30ed07e489ebe52895

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

MD5 852c2334888585befe4cbe113ad88039
SHA1 bce39c47cdee089a959b3f560b86c899850a279a
SHA256 b7232bacdb75c2aaf9f6f96dc17420f726c34bd3389a06f3536b1c2613d3546d
SHA512 57956ab37d4d9965ca0edb1950b49cb3bf254ccd92eb5ef7bf7cc7a5c51832fcf57e009f87315b42d708e6581801c6bb380b0fafcc1db121e038efab2717277b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old

MD5 22f92048d88eeeb1a790039c567f235a
SHA1 5d052ad40cd49907754e0e187cf944a56170bf81
SHA256 f8d42788694763de7967a1a7bb0dbf82f6c93b518b48b461e71b7769af36c492
SHA512 80445f469ae8cdedec10deb4f1a21e78c4871c2d12bf8f4474456918ebb94323586ed0e1eb8c1aac5f4646f25682476108868f93bfcb61ff8887986e2d298b58

Analysis: behavioral3

Detonation Overview

Submitted

2025-07-04 17:29

Reported

2025-07-04 17:59

Platform

win11-20250619-en

Max time kernel

1799s

Max time network

1800s

Command Line

C:\Windows\Explorer.EXE

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 5812 created 3288 N/A C:\Users\Admin\Downloads\MBSetup.exe C:\Windows\Explorer.EXE

Downloads MZ/PE file

Description Indicator Process Target
N/A N/A C:\Users\Admin\Downloads\MBSetup.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\drivers\mbamtestfile.dat C:\Users\Admin\Downloads\MBSetup.exe N/A
File created C:\Windows\system32\DRIVERS\MbamElam.sys C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File created C:\Windows\system32\DRIVERS\mwac.sys C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File opened for modification C:\Windows\System32\drivers\SET452.tmp C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\System32\drivers\farflt11.sys C:\Windows\system32\DrvInst.exe N/A
File created C:\Windows\System32\drivers\SET55B.tmp C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\System32\drivers\SET2046.tmp C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\system32\DRIVERS\MbamElam.sys C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File opened for modification C:\Windows\System32\drivers\SET55B.tmp C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\System32\drivers\farflt11.sys C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\System32\drivers\farflt11.sys C:\Windows\system32\DrvInst.exe N/A
File created C:\Windows\System32\drivers\SET2046.tmp C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\System32\drivers\farflt11.sys C:\Windows\system32\DrvInst.exe N/A
File created C:\Windows\system32\drivers\mbae64.sys C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Windows\System32\drivers\SET123C.tmp C:\Windows\system32\DrvInst.exe N/A
File created C:\Windows\System32\drivers\SET12C9.tmp C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\System32\drivers\farflt11.sys C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\System32\drivers\SET1F8B.tmp C:\Windows\system32\DrvInst.exe N/A
File created C:\Windows\system32\DRIVERS\mbam.sys C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File created C:\Windows\system32\DRIVERS\mbamswissarmy.sys C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File created C:\Windows\system32\DRIVERS\MbamChameleon.sys C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File created C:\Windows\System32\drivers\SET452.tmp C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\System32\drivers\SET123C.tmp C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\System32\drivers\farflt11.sys C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\System32\drivers\SET12C9.tmp C:\Windows\system32\DrvInst.exe N/A
File created C:\Windows\System32\drivers\SET1F8B.tmp C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\SysWOW64\drivers\mbamtestfile.dat C:\Users\Admin\Downloads\MBSetup.exe N/A

Modifies RDP port number used by Windows

Patched UPX-packed file

Description Indicator Process Target
N/A N/A N/A N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MBAMFarflt\ImagePath = "\\SystemRoot\\System32\\Drivers\\farflt11.sys" C:\Windows\system32\DrvInst.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MBAMSwissArmy\ImagePath = "\\SystemRoot\\System32\\Drivers\\mbamswissarmy.sys" C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mbamchameleon\ImagePath = "\\SystemRoot\\System32\\Drivers\\MbamChameleon.sys" C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MBAMFarflt\ImagePath = "\\SystemRoot\\System32\\Drivers\\farflt11.sys" C:\Windows\system32\DrvInst.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MBAMFarflt\ImagePath = "\\SystemRoot\\System32\\Drivers\\farflt11.sys" C:\Windows\system32\DrvInst.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MBAMProtection\ImagePath = "\\SystemRoot\\System32\\Drivers\\mbam.sys" C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MBAMFarflt\ImagePath = "\\SystemRoot\\System32\\Drivers\\farflt11.sys" C:\Windows\system32\DrvInst.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MBAMFarflt\ImagePath = "\\SystemRoot\\System32\\Drivers\\farflt11.sys" C:\Windows\system32\DrvInst.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MBAMFarflt\ImagePath = "\\SystemRoot\\System32\\Drivers\\farflt11.sys" C:\Windows\system32\DrvInst.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\updatrpkg\mbupdatrV5.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\updatrpkg\mbupdatrV5.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\Downloads\MBSetup.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\Downloads\MBSetup.exe N/A

Credentials from Password Stores: Windows Credential Manager

credential_access stealer

Event Triggered Execution: Component Object Model Hijacking

persistence privilege_escalation

Impair Defenses: Safe Mode Boot

defense_evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\MBAMService C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\MBAMService\ = "Service" C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A

Reads user/profile data of web browsers

spyware stealer

Checks installed software on the system

discovery

Checks whether UAC is enabled

defense_evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files\jjsploit\jjsploit.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files\jjsploit\jjsploit.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files\jjsploit\jjsploit.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Users\Admin\Documents\desktop.ini C:\Program Files\Mozilla Firefox\firefox.exe N/A
File opened for modification C:\Users\Public\desktop.ini C:\Program Files\Mozilla Firefox\firefox.exe N/A
File opened for modification C:\Users\Public\Documents\desktop.ini C:\Program Files\Mozilla Firefox\firefox.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\Q: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File opened (read-only) \??\Y: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File opened (read-only) \??\I: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File opened (read-only) \??\W: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File opened (read-only) \??\N: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File opened (read-only) \??\T: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File opened (read-only) \??\U: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File opened (read-only) \??\T: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File opened (read-only) \??\Z: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File opened (read-only) \??\Z: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File opened (read-only) \??\X: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File opened (read-only) \??\T: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File opened (read-only) \??\U: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File opened (read-only) \??\X: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File opened (read-only) \??\Q: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File opened (read-only) \??\V: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File opened (read-only) \??\N: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File opened (read-only) \??\E: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File opened (read-only) \??\B: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File opened (read-only) \??\E: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File opened (read-only) \??\H: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File opened (read-only) \??\G: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File opened (read-only) \??\L: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File opened (read-only) \??\P: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File opened (read-only) \??\X: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File opened (read-only) \??\I: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File opened (read-only) \??\O: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File opened (read-only) \??\P: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File opened (read-only) \??\R: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File opened (read-only) \??\W: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File opened (read-only) \??\J: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File opened (read-only) \??\H: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File opened (read-only) \??\O: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File opened (read-only) \??\A: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\System32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A

Network Share Discovery

discovery

ConfuserEx .NET packer

Description Indicator Process Target
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\System32\DriverStore\FileRepository\netr28x.inf_amd64_5d63c7bcbf29107f\netr28x.PNF C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mrvlpcie8897.inf_amd64_07fc330c5a5730ca\mrvlpcie8897.PNF C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\netrtwlans.inf_amd64_97cd1a72c2a7829c\netrtwlans.PNF C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe N/A
File created C:\Windows\System32\DriverStore\Temp\{c7ed77e6-6e26-e64b-bc66-93d79f092772}\SET11EF.tmp C:\Windows\system32\DrvInst.exe N/A
File created C:\Windows\System32\DriverStore\drvstore.tmp C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\net9500-x64-n650f.inf_amd64_e92c5a65e41993f9\net9500-x64-n650f.PNF C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe N/A
File opened for modification C:\Windows\System32\DriverStore\Temp\{c846d233-5679-9b49-a824-3bfc016cf911}\SET3D5.tmp C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\229169D96B9C20761B929D428962A0A2_FC65190A8D1232A1711F16F9F20C5149 C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B4D2AF6F530C54A75160B3511A502C76 C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\netwew00.inf_amd64_325c0bd6349ed81c\netwew00.PNF C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\netnvm64.inf_amd64_35bbbe80dec15683\netnvm64.PNF C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\bthpan.inf_amd64_a31306bfdf7135b0\bthpan.PNF C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe N/A
File opened for modification C:\Windows\System32\ntdll.pdb C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File opened for modification C:\Windows\System32\combase.pdb C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\netelx.inf_amd64_7812e4e45c4a5eb1\netelx.PNF C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\bcmdhd64.inf_amd64_e0bae6831f60ea5f\bcmdhd64.PNF C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\netrtwlane_13.inf_amd64_992f4f46e65f30d4\netrtwlane_13.PNF C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe N/A
File opened for modification C:\Windows\System32\DriverStore\Temp\{c846d233-5679-9b49-a824-3bfc016cf911} C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3E3E9689537B6B136ECF210088069D55_E93D4349D1D2AF4AE2F3CBFF382A5C9D C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\netl160a.inf_amd64_e4cbe375963a69e9\netl160a.PNF C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\farflt11.inf_amd64_a08c83c14d71bb76\farflt11.cat C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1B1401C7EC8E96BC79CBFD92F9DF762D_E35D496D1CD0B884BEBCAFED0FE61600 C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\netvchannel.inf_amd64_532c2a6259a26a38\netvchannel.PNF C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\netwtw10.inf_amd64_3b49c2812809f919\netwtw10.PNF C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe N/A
File opened for modification C:\Windows\System32\DriverStore\Temp\{c846d233-5679-9b49-a824-3bfc016cf911}\farflt11.cat C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\System32\DriverStore\Temp\{22e1bb3a-b308-4b48-beb1-851d5355398e} C:\Windows\system32\DrvInst.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\net7800-x64-n650f.inf_amd64_178f1bdb49a6e2fd\net7800-x64-n650f.PNF C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\netmlx5.inf_amd64_7aeb3e6bfcb2f0f1\netmlx5.PNF C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\netnvma.inf_amd64_7080f6b8ea1744fb\netnvma.PNF C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\netloop.inf_amd64_09e02e589e7afd83\netloop.PNF C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\rtcx21x64.inf_amd64_d2a498d51a4f7bec\rtcx21x64.PNF C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50 C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\farflt11.inf_amd64_a08c83c14d71bb76\farflt11.cat C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\farflt11.inf_amd64_a08c83c14d71bb76 C:\Windows\system32\DrvInst.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\dc21x4vm.inf_amd64_d54f628acb9dea33\dc21x4vm.PNF C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe N/A
File opened for modification C:\Windows\System32\DriverStore\Temp\{eac9abe7-4a88-284d-8211-0b390067f1ab}\SETCB6A.tmp C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141 C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1F657678CDAD5400251B323D207EA54F C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\net1ic64.inf_amd64_1e173acb8f2f340f\net1ic64.PNF C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\athw8x.inf_amd64_55014eff4ceefbdf\athw8x.PNF C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe N/A
File created C:\Windows\System32\DriverStore\drvstore.tmp C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\farflt11.inf_amd64_a08c83c14d71bb76\farflt11.sys C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\netbc63a.inf_amd64_7ba6c9cea77dd549\netbc63a.PNF C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\netvg63a.inf_amd64_9f5493180b1252cf\netvg63a.PNF C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BD96F9183ADE69B6DF458457F594566C_9CEAFBC27D33B97DD28C7AC883265891 C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1B1401C7EC8E96BC79CBFD92F9DF762D_E35D496D1CD0B884BEBCAFED0FE61600 C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\netg664.inf_amd64_84cd7b2798e0a666\netg664.PNF C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe N/A
File created C:\Windows\System32\DriverStore\Temp\{eac9abe7-4a88-284d-8211-0b390067f1ab}\SETCB5A.tmp C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\mbtun.inf_amd64_add82795013a7c3b\mbtun.sys C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\farflt11.inf_amd64_a08c83c14d71bb76\farflt11.inf C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File created C:\Windows\System32\DriverStore\Temp\{22e1bb3a-b308-4b48-beb1-851d5355398e}\SET1F3E.tmp C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\farflt11.inf_amd64_a08c83c14d71bb76\farflt11.cat C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1F657678CDAD5400251B323D207EA54F C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\ndisimplatformmp.inf_amd64_206e9e544d84356f\ndisimplatformmp.PNF C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C673308159E4A1FDD3892600FF53926B C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\206742EA5671D0AFB286434AEACBAD29 C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\qcwlan64.inf_amd64_71c84e1405061462\qcwlan64.PNF C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\netl1c63x64.inf_amd64_4d6630ce07a4fb42\netl1c63x64.PNF C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\net7400-x64-n650.inf_amd64_557ce3b37c3e0e3b\net7400-x64-n650.PNF C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\38D10539991D1B84467F968981C3969D_C92678066E2B4B4986BC7641EEC08637 C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\cs\WindowsBase.resources.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\de\PresentationFramework.resources.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\de\PresentationUI.resources.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\System.IO.Packaging.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\zh-Hans\ReachFramework.resources.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File opened for modification C:\Program Files\Malwarebytes\Anti-Malware\mbuns.exe C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\clretwrc.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.IO.Compression.Native.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.tmf C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File opened for modification C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.json C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File created C:\Program Files\jjsploit\resources\luascripts\jailbreak\policeesp.lua C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.Diagnostics.TraceSource.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\fr\PresentationUI.resources.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\fr\ReachFramework.resources.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\it\PresentationCore.resources.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\pl\System.Windows.Forms.Design.resources.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\PresentationUI.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\tr\ReachFramework.resources.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.Drawing.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.Threading.Tasks.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\zh-Hant\System.Windows.Forms.Primitives.resources.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\Microsoft.EntityFrameworkCore.Sqlite.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File opened for modification C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exe C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.Text.Encoding.CodePages.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\cs\System.Windows.Forms.Design.resources.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\it\UIAutomationClient.resources.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\ja\PresentationCore.resources.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\ko\System.Windows.Controls.Ribbon.resources.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\ru\Microsoft.VisualBasic.Forms.resources.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\SecurityProductInformation.ini C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\SdkDbUpdatrV5.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.ComponentModel.TypeConverter.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\mscorlib.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.Collections.Concurrent.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\de\WindowsFormsIntegration.resources.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\es\ReachFramework.resources.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\pt-BR\System.Windows.Input.Manipulations.resources.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\System.Drawing.Design.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\zh-Hant\UIAutomationClientSideProviders.resources.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.IO.Pipes.AccessControl.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.Net.WebSockets.Client.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\zh-Hans\Microsoft.VisualBasic.Forms.resources.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\SQLitePCLRaw.provider.e_sqlcipher.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\IdentityModel.OidcClient.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\MBAMCrashHandler.exe C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\api-ms-win-core-processthreads-l1-1-1.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\fr\System.Windows.Forms.resources.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.Data.Common.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.Runtime.InteropServices.RuntimeInformation.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.Xml.Linq.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\PresentationFramework.Aero.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\tr\System.Windows.Forms.Design.resources.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\tr\UIAutomationProvider.resources.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\PoliciesControllerImpl.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\mbae-api-na.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\api-ms-win-core-console-l1-2-0.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.ObjectModel.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.Security.Cryptography.Csp.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\fr\UIAutomationTypes.resources.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\pl\WindowsFormsIntegration.resources.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\ActionsShim.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\MBAMCore.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\MwacLib.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\cs\UIAutomationTypes.resources.dll C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\security\logs\scecomp.log C:\Windows\system32\DrvInst.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1488_1283939760\json\i18n-ec\ar\strings.json C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1488_1283939760\json\i18n-notification\ru\strings.json C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_613449461\kp_pinslist.pb C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1488_1311401035\hyph-de-1901.hyb C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_862379018\hyph-ta.hyb C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1488_798493313\Part-ZH C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1488_1283939760\json\wallet\wallet-pre-stable.json C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1488_1283939760\runtime.bundle.js C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File opened for modification C:\Windows\INF\setupapi.dev.log C:\Windows\system32\DrvInst.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1488_302635715\male_names.txt C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1488_1311401035\hyph-lv.hyb C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1488_1283939760\json\i18n-mobile-hub\de\strings.json C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1488_1283939760\manifest.fingerprint C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1488_1311401035\hyph-bg.hyb C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_862379018\hyph-as.hyb C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1488_1283939760\json\i18n-notification\es\strings.json C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1488_1283939760\json\i18n-notification\fr\strings.json C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1488_1283939760\webui-setup.js C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1488_1311401035\hyph-cu.hyb C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1488_1283939760\json\i18n-ec\fr-CA\strings.json C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1488_1283939760\json\i18n-notification\ko\strings.json C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1488_1283939760\manifest.webapp.json C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_714966809\manifest.fingerprint C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_862379018\hyph-uk.hyb C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_862379018\manifest.fingerprint C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1488_1283939760\json\i18n-shared-components\ko\strings.json C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1488_1020904075\manifest.json C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1488_105829525\deny_etld1_domains.list C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1488_1020904075\manifest.fingerprint C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1488_899069524\auto_open_controller.js C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1488_1283939760\json\i18n-notification\it\strings.json C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1488_1283939760\Notification\notification.html C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1488_1283939760\json\i18n-ec\pt-BR\strings.json C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1488_1283939760\json\i18n-tokenized-card\it\strings.json C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1488_1311401035\hyph-et.hyb C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1488_1283939760\wallet.html C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1488_183777469\ct_config.pb C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1488_302635715\english_wikipedia.txt C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1488_899069524\shopping.js C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_862379018\hyph-et.hyb C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_862379018\hyph-nn.hyb C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_862379018\manifest.json C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1488_1283939760\json\i18n-ec\ja\strings.json C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1488_1283939760\json\i18n-hub\pl\strings.json C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1488_1311401035\hyph-hy.hyb C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_2143859322\manifest.fingerprint C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1488_1283939760\json\i18n-hub\pt-BR\strings.json C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1488_1283939760\json\wallet\wallet-checkout-eligible-sites-pre-stable.json C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1488_1283939760\json\i18n-notification-shared\fr-CA\strings.json C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1488_1283939760\json\i18n-shared-components\sv\strings.json C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1488_1942513005\manifest.json C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\inf\oem4.inf C:\Windows\system32\DrvInst.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1488_1311401035\hyph-de-ch-1901.hyb C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_54020848\_metadata\verified_contents.json C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1488_1283939760\hub-signature.txt C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1488_1283939760\json\i18n-ec\fi\strings.json C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1488_1283939760\json\i18n-hub\hu\strings.json C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1488_1283939760\json\i18n-hub\sv\strings.json C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1488_1311401035\hyph-el.hyb C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1488_899069524\shopping_fre.html C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\~DF80E6618D308FCCFA.TMP C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1488_1311401035\hyph-mn-cyrl.hyb C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1488_798493313\Part-IT C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Subvert Trust Controls: Mark-of-the-Web Bypass

defense_evasion
Description Indicator Process Target
File opened for modification C:\Users\Admin\Downloads\MBSetup.exe:Zone.Identifier C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Downloads\MBSetup.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\timeout.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\MsiExec.exe N/A

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 C:\Windows\system32\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs C:\Windows\system32\DrvInst.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom C:\Windows\system32\DrvInst.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0014 C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005 C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000004ae506513090e61c0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800004ae506510000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809004ae50651000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d4ae50651000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000004ae5065100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Windows\system32\vssvc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 C:\Windows\system32\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs C:\Windows\system32\DrvInst.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID C:\Windows\system32\DrvInst.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 C:\Windows\system32\DrvInst.exe N/A
Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Windows\system32\vssvc.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs C:\Windows\system32\DrvInst.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005\ C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom C:\Windows\system32\DrvInst.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID C:\Windows\system32\DrvInst.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs C:\Windows\system32\DrvInst.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs C:\Windows\system32\DrvInst.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs C:\Windows\system32\DrvInst.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom C:\Windows\system32\DrvInst.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 C:\Windows\system32\DrvInst.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags C:\Windows\system32\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs C:\Windows\system32\DrvInst.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom C:\Windows\system32\DrvInst.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005\ C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0014 C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom C:\Windows\system32\DrvInst.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 C:\Windows\system32\DrvInst.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 C:\Windows\system32\DrvInst.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID C:\Windows\system32\DrvInst.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom C:\Windows\system32\DrvInst.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0014 C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs C:\Windows\system32\DrvInst.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom C:\Windows\system32\DrvInst.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID C:\Windows\system32\DrvInst.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters C:\Windows\system32\vssvc.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom C:\Windows\system32\DrvInst.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005 C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom C:\Windows\system32\DrvInst.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs C:\Windows\system32\DrvInst.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 C:\Windows\system32\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom C:\Windows\system32\DrvInst.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 C:\Windows\system32\DrvInst.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID C:\Windows\system32\DrvInst.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0014 C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 C:\Windows\system32\DrvInst.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom C:\Windows\system32\DrvInst.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 C:\Windows\system32\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom C:\Windows\system32\DrvInst.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs C:\Windows\system32\DrvInst.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 C:\Windows\system32\DrvInst.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID C:\Windows\system32\DrvInst.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr C:\Windows\system32\vssvc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 C:\Windows\system32\DrvInst.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID C:\Windows\system32\DrvInst.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs C:\Windows\system32\DrvInst.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom C:\Windows\system32\DrvInst.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 C:\Windows\system32\svchost.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz C:\Program Files\Mozilla Firefox\firefox.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz C:\Program Files\Mozilla Firefox\firefox.exe N/A

Delays execution with timeout.exe

defense_evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\mbamtray.exe = "11000" C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Malwarebytes.exe = "11000" C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\mbam.exe = "11000" C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:\ C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\updatrpkg\mbupdatrV5.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Malwarebytes\FirstRun = "false" C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Malwarebytes C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\updatrpkg\mbupdatrV5.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\15.0 C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\16.0\Common\Security C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\updatrpkg\mbupdatrV5.exe N/A
Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:\ C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\16.0 C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\16.0\Common\Security C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\updatrpkg\mbupdatrV5.exe N/A
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe N/A
Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{278637DA-FDFB-45C7-8CD8-F2D8A9199AB0}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1861D707-8D71-497D-8145-62D5CBF4222F} C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A0101B90-FD0B-40CF-90E4-33650F09A80F}\TypeLib\Version = "1.0" C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A23C190D-C714-42C7-BDBB-F4E1DE65AF27}\1.0 C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D829C1D7-B423-43AB-A4F8-598382EB0716}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{566DC5CA-A3C4-4959-AB92-37606E12AAFF}\TypeLib\ = "{59DBD1B8-A7BD-4322-998F-41B0D2516FA0}" C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CCEFCD43-B934-4168-AE51-6FE07D3D0624}\TypeLib\Version = "1.0" C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BDCB7916-7DE8-44C8-BAF6-F1BBB3268456}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F1C46F8-E697-4175-B240-CDE682A4BA2D}\ProgID\ = "MB.MWACController.1" C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36A65E46-6CC1-4CA2-B51E-F4DD8C993DDC}\VersionIndependentProgID C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31A02CB9-6064-4A3B-BCB4-A329528D4648}\ProxyStubClsid32 C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9704115C-F54E-4D64-8554-0CAF8BF33B1B}\ProxyStubClsid32 C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{620A01DD-16D2-4A83-B02C-E29BE38B3029}\TypeLib C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BF474111-9116-45C6-AF53-209E64F1BB53}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9A30501F-26D0-4C5F-818A-9F7DFC5F8ABC}\TypeLib C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{960F2BB5-E954-45C5-97DF-A770D9D8C24B}\ProxyStubClsid32 C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{735BE2C0-5A9B-457A-A0A9-4B27FCED2817} C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F49090F8-7DC6-4CBC-893A-C1B3DCF88D87}\TypeLib\ = "{A82129F1-32E1-4D79-A39F-EBFEE53A70BF}" C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{503084FD-0743-46C7-833F-D0057E8AC505}\ProxyStubClsid32 C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{19184D37-6938-4F54-BAFD-3240F0FA75E6}\TypeLib\ = "{49F6AC60-2104-42C6-8F71-B3916D5AA732}" C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D829C1D7-B423-43AB-A4F8-598382EB0716}\ProxyStubClsid32 C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0E2822AB-0447-4F28-AF4C-FFDB1E8595AE}\1.0 C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3C871BA6-4662-4E17-ABF4-3B2276FC0FF4}\ProxyStubClsid32 C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FA6C70E7-6A6D-4F4A-99BF-C8B375CB7E0C}\ = "ILinker" C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5ABC7CB0-FA59-4326-A92E-BD47C0BD9B42}\TypeLib C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{71B13605-3569-4F4A-B971-08FF179A3A60}\TypeLib C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5D448EF3-7261-4C0C-909C-6D56043C259D} C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{ADA09B8D-A536-4429-8331-49808442D24B}\TypeLib\ = "{5709DEEB-F05E-4D5C-8DC4-3B0D924EE08F}" C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{19E8B60E-50A1-4E29-9138-A13421D2BF7D}\TypeLib\Version = "1.0" C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EA248A19-F84E-4407-ADD3-8563AFD81269}\TypeLib\Version = "1.0" C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A10434E2-CAA7-48C4-9770-E9F215C51ECC} C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7DD05E6E-FF07-4CD3-A7BA-200BEC812A5C}\ = "IAEControllerV5" C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MB.CloudController.1\ = "CloudController Class" C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E230930A-6CC2-4B9D-8CE1-03F86A8EDA05}\TypeLib\ = "{5709DEEB-F05E-4D5C-8DC4-3B0D924EE08F}" C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3C0ECFDC-317D-406B-ADF5-C0E8217E244F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DE351550-6C4E-4662-AD87-FEB0707F6C62}\TypeLib\ = "{332AFEBA-9341-4CEC-8EA6-DB155A99DF63}" C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2E3F70EF-D9BE-485F-A6F5-816DD0EDC757}\TypeLib\ = "{FFB94DF8-FC15-411C-B443-E937085E2AC1}" C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B34A461-332D-479F-B8C4-7D168D650EBD}\ = "IAEControllerEventsV5" C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6A66A096-E54B-4F72-8654-ED7715B07B43}\ProxyStubClsid32 C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{172ABF99-1426-47CA-895B-092E23728E8A}\ = "ICloudControllerEvents" C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8D488C7C-023D-4561-B377-DD9FB7124326} C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8ED8EAAB-1FA5-48D4-ACD4-32645776BA28} C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B44D50B8-E459-4078-9249-3763459B2676} C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0468FE5A-FFDA-4F57-83F5-79116160E9B8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A9D47FCC-ECEC-453C-9936-2CD0F16A8696}\TypeLib C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C0D8223D-D594-4147-BAD8-1E2B54ED1990}\TypeLib C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FA1D4FDD-C9C8-4575-A2A1-4179C3A3473D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{02143C0F-1656-4B2E-95E7-EA8178A29E2E}\TypeLib\Version = "1.0" C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{63A6AB57-4679-4529-B78D-143547B22799}\TypeLib C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{638A43D2-5475-424B-87B8-042109D7768F}\TypeLib C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B59F38D8-23CF-4D7F-BAE8-939738B3001B}\TypeLib\Version = "1.0" C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C367B540-CEF4-4271-8395-0C28F0FDADDA}\TypeLib\ = "{0E2822AB-0447-4F28-AF4C-FFDB1E8595AE}" C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1C5B86F3-CEB8-44E3-9B83-6F6AF035E872}\ProxyStubClsid32 C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5091804-600E-4226-BF28-80ABFDF4AFAB}\TypeLib\ = "{5709DEEB-F05E-4D5C-8DC4-3B0D924EE08F}" C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AC5390D0-3831-4D42-BD1D-8151A5A1742C}\TypeLib\ = "{5709DEEB-F05E-4D5C-8DC4-3B0D924EE08F}" C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8153C0A7-AC17-452A-9388-358F782478D4}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B9F73DD6-F2A4-40F8-9109-67F6BB8D3704}\TypeLib C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{557ADCF9-0496-46F6-A580-FF8EC1441050}\TypeLib C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B1D8E799-D5A2-45B4-9524-067144A201E4} C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8ED8EAAB-1FA5-48D4-ACD4-32645776BA28}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FB81F893-5D01-4DFD-98E1-3A6CB9C3E63E}\ = "IMWACControllerV12" C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{55E4B8FB-921C-4751-8B2D-AE33BD7D0B74}\ = "_IMWACControllerEventsV6" C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5A7F7475-8272-40DE-A4FA-A98C38BDB458}\ProxyStubClsid32 C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{18C5830A-FF78-4172-9DFB-E4016D1C1F31}\TypeLib\Version = "1.0" C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A

Modifies system certificate store

defense_evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2 C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\5A8CEF45D7A69859767A8C8B4496B578CF474B1A\Blob = 0300000001000000140000005a8cef45d7a69859767a8c8b4496b578cf474b1a2000000001000000450500003082054130820329a0030201020213066c9fd29635869f0a0fe58678f85b26bb8a37300d06092a864886f70d01010c05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412032301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f74204341203230820222300d06092a864886f70d01010105000382020f003082020a0282020100ad969f2d9c4a4c4a81795199ec8acb6b605113bc4d6d06fcb0088ddd19106ac7260c35d8c06f2084e994b19b8503c35bdb4ae8c8f89076d95b4fe34ce806364dcc9aac3d0c902b92d4061960ac374479858182ad5a37e00dcc9da64c5276ea439db704d150f655e0d5d2a64985e937e9ca7eae5c954d489a3fae205a6d8895d934b8521a4390b0bf6c05b9b678b7ead0e43a3c125362ff4af27bbe3505a91234e3f36474622c3d00495a28fe3244bb87dd652702713bda4af71fdacdf72155904f0fecae82e19f6bd945d3bbf05f87ed3c2c3986da3fdeec7255eb79a3addbdd7cb0ba1ccefcde4f3576cf0ff8781f6a36514627615be99ecff0a2557d7c258a6f2fb4c5cf842e2bfd0d51106cfb5f1bbc1b7ec5ae3b98013192ff0b57f49ab2b957e9abef0d76d1f0eef4ce86a7e06ee9b469a1df69f633c6692e97139ea587b057108137c953b3bb7ff692d19cd018f4926eda834fa663994ca5fb5eef21647a205f6c648515cb37e9620c0b2a16dc012e32da3e4bf59e3af6174094ef9e910886fabe63a85a33eccb744395f96c695236c7296ffc55035c1ffb9fbd47ebe74947950b4e89220949e0f5611ef1bf2e8a726e8059ff573af97532a34e5feced2862d94d73f2cc811760edcdebdcdba7cac57e02bdf2540854fdb42d092c17544a98d154e1516708d2ed6e7e6f3fd22d81592966cb903995111e7427feddebaf0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414b00cf04c30f405580248fd33e552af4b84e36652300d06092a864886f70d01010c05000382020100aaa8808f0e78a3e0a2d4cde6f5987a3bea0003b0970e93bc5aa8f62c8c7287a9b1fc7f73fd637178a58759cf30e10d10b2135a6d82f56ae6809fa0050b68e4476bc76adfb6fd773272e518fa09f4a0932c5dd28c75857665900c0379b7312363ad788309866884cafff9cf269a9279e7cd4bc5e761a717cbf3a91293936ba7e82f5392c46058b0cc0251185b858d625963b6adb4de9afb26f70027c05d55377499c9507fe3592e44e32c25eeec4c3277b49f1ae94b5d20c5dafd1c8716c643e8d4bb269a45705ea90b3753e2467b27fde046f289b7cc42b6cb28266ed9a5c93ac8411360f7508c15aeb26d1a151a5778e6922ad96590823f6c02afae123a27963604d71da28063a99bf1e5bab47c14b04ec9b11f745f38f651ea9bfa2ca211d4a92d271a45b1afb24e710dc05846d66906cb53cbb3fe6b41cd417e7d4c0f7c72797a59cd5e4a0eac9ba99873797cb4f4ccb9b8070cb2745cb8c76f88a190a7f4aaf9bf673af41a15621eb79fbe3db129af67a112f25810195303301bb81a89f69cbd97038ea309f31d8b21f1b4dfe41cd19f650206ea5cd613b384efa2a55c8c7729a768c06bae40d2a8b4eacdf08d4b389c199a1b2854b88990efca75813e1ef26424c718af4eff479e07f63565a4d30a56fff517646cefa822254993b6df0017da587e5deec51bb0d1d15f2110c7f9f3ba020a2707c5f1d6c7d3e0fb09606c C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0D44DD8C3C8C1A1A58756481E90F2E2AFFB3D26E\Blob = 0300000001000000140000000d44dd8c3c8c1a1a58756481e90f2e2affb3d26e2000000001000000ba010000308201b63082015ba0030201020213066c9fd5749736663f3b0b9ad9e89e7603f24a300a06082a8648ce3d0403023039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412033301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f7420434120333059301306072a8648ce3d020106082a8648ce3d030107034200042997a7c6417fc00d9be8011b56c6f252a5ba2db212e8d22ed7fac9c5d8aa6d1f73813b3b986b397c33a5c54e868e8017686245577d44581db337e56708eb66dea3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414abb6dbd7069e37ac3086079170c79cc419b178c0300a06082a8648ce3d0403020349003046022100e08592a317b78df92b06a593ac1a98686172fae1a1d0fb1c7860a64399c5b8c40221009c02eff1949cb396f9ebc62af8b62cfe3a901416d78c6324481cdf307dd5683b C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F6108407D6F8BB67980CC2E244C2EBAE1CEF63BE C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F6108407D6F8BB67980CC2E244C2EBAE1CEF63BE\Blob = 030000000100000014000000f6108407d6f8bb67980cc2e244c2ebae1cef63be2000000001000000f6010000308201f230820178a0030201020213066c9fd7c1bb104c2943e5717b7b2cc81ac10e300a06082a8648ce3d0403033039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412034301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f7420434120343076301006072a8648ce3d020106052b8104002203620004d2ab8a374fa3530dfec18a7b4ba87b464b63b062f62d1bdb087121d200e863bd9a27fbf0396e5dea3da5c981aaa35b2098455d16dbfde8106de39ce0e3bd5f8462f3706433a0cb242f70ba88a12aa075f881ae6206c481db396e29b01efa2e5ca3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414d3ecc73a656ecce1da769a56fb9cf3866d57e581300a06082a8648ce3d040303036800306502303a8b21f1bd7e11add0ef58962fd6eb9d7e908d2bcf6655c32ce328a9700a470ef0375912ff2d9994284e2a4f354d335a023100ea75004e3bc43a941291c958469d211372a7889c8ae44c4adb96d4ac8b6b6b49125333add7e4be24fcb50a76d4a5bc10 C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 040000000100000010000000be954f16012122448ca8bc279602acf5140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a2030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa20f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e1900000001000000100000009f687581f7ef744ecfc12b9cee6238f12000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5 C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C\Blob = 0300000001000000140000007b0f360b775f76c94a12ca48445aa2d2a875701c1400000001000000140000006837e0ebb63bf85f1186fbfe617b088865f44e42040000000100000010000000d91299e84355cd8d5a86795a0118b6e90f000000010000003000000065b1d4076a89ae273f57e6eeedecb3eae129b4168f76fa7671914cdf461d542255c59d9b85b916ae0ca6fc0fcf7a8e64190000000100000010000000a344f71a7a52a76ee49b74b1d8816b155c000000010000000400000000100000180000000100000010000000ffac207997bb2cfe865570179ee037b92000000001000000b4060000308206b030820498a003020102021008ad40b260d29c4c9f5ecda9bd93aed9300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3231303432393030303030305a170d3336303432383233353935395a3069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e6720525341343039362053484133383420323032312043413130820222300d06092a864886f70d01010105000382020f003082020a0282020100d5b42f42d028ad78b75dd539591bb18842f5338ceb3d819770c5bbc48526309fa48e68d85cf5eb342407e14b4fd37843f417d71edaf9d2d5671a524f0ea157fc8899c191cc81033e4d702464b38de2087d347d4c8057126b439a99f2c53b1ff2efcb475a13a64cb3012025f310d38bb2fb08f08ae09d09c065a7fa98804935873d5119e8902178452ea19f2ce118c21accc5ee93497042328ffbc6ea1cf3656891a24d4c8211485268de10bd14575de8181365c57fb24f852c48a4568435d6f92e9caa0015d137fe1a0694c27cc8ea1b32e6cac2f4a7a3030e74a5af39b6ab6012e3e8d6b9f731e1dcade418a0d8c1234747b3a10f6ea3ab6d9806831bb76a672dd2bd441a9210818fb03b09d7c79b325ac2ff6a60548b49c193ede1b45ce06feb26f98cd5b2f93810e6eace91f5bed3fb6f9361345cbc93452883362a66285fb073ce8b262506b283d45cf615194ced62e05e33f2e8e8ec0aa7b0032b91b23679bef7ad081e75a665ccbbe34850f377911afedb50a246c8615898f57c02163c8328ad3986ecd4b70d53d0f847e675308dec30937614a65b4b5d74614d3f129176debf58cb72102941f0d5c56d267668114113589adc262b01f4894d59db78cf814a3e40475fc98150738510232159608a6454c1cc211ae838197c661ccd78384530994fff634f4cbbaa0d0853417c583d47b3fab6ec8c320902cc6c3c0c56110203010001a38201593082015530120603551d130101ff040830060101ff020100301d0603551d0e041604146837e0ebb63bf85f1186fbfe617b088865f44e42301f0603551d23041830168014ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300e0603551d0f0101ff04040302018630130603551d25040c300a06082b06010505070303307706082b06010505070101046b3069302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304106082b060105050730028635687474703a2f2f636163657274732e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63727430430603551d1f043c303a3038a036a0348632687474703a2f2f63726c332e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63726c301c0603551d20041530133007060567810c01033008060667810c010401300d06092a864886f70d01010c050003820201003a23443d8d0876ee8fbc3a99d356e0021aa5f84834f32cb6e67466f79472b100caaf6c302713129e90449f4bfd9ea37c26d537bc3a5d486d95d53f49f427bb16814550fd9cbdb685e0767e3771cb22f75aaa90cff5936ae3eb20d1d55079889a8a8ac1b6bda148187edcd8801a111918cd61998156f6c9e376e7c4e41b5f43f83e94ff76393d9ed499cf4add28eb5f26a1955848d51afed7273ffd90d17686dd1cb0605cf30da8eee089a1bd39e1384eda6ebb369dfbe521535ac3cae96af1a23edb43b833c84f38149299f5ddce546dd95d02141f40337c03e295b2c221757352cb46d8c4341ca2a54b8dcd6f76372c853f1ace26e918be9007b0437f9588208270f0cccaeffd29355c1f893855f7378a8b09a1cb0be9311aff2e195c3971e1be9ca70a06d62667b792e64e5fde7aac49cf2ea47492addb3ca49c861fe3c1561b2b23ff8fb5ea887b706be6a0bafd3a3f45a6c4e81691528b41c048844b964dab4440e38df01528ceedf11856072a2f10c40c08643c338fae288c3ccb8f880b0dbf3bf4ce1e7b8eefb5ebcbb7f07713e6e7283fac12aea52f226c41f9825c1566cc6c0ecac586c3f626330c074ba0d307026a6a4030484b34a85120bbad1b8508e2590d6dca05502bea4a1c9ea5fda0a71f0674e7f2d65290fdaf854821f9573bb49c03ed8645f4b4616ebf68e2266086eac8afa9fe941de7631b3a8656784e C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474 C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa22000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800001900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa20f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b4040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\2AD974A775F73CBDBBD8F5AC3A49255FA8FB1F8C C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d0140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b4030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3490f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d578112861900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8DA7F965EC5EFC37910F1C6E59FDC1CC6A6EDE16\Blob = 0300000001000000140000008da7f965ec5efc37910f1c6e59fdc1cc6a6ede162000000001000000450300003082034130820229a0030201020213066c9fcf99bf8c0a39e2f0788a43e696365bca300d06092a864886f70d01010b05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412031301e170d3135303532363030303030305a170d3338303131373030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f74204341203130820122300d06092a864886f70d01010105000382010f003082010a0282010100b2788071ca78d5e371af478050747d6ed8d78876f49968f7582160f97484012fac022d86d3a0437a4eb2a4d036ba01be8ddb48c80717364cf4ee8823c73eeb37f5b519f84968b0ded7b976381d619ea4fe8236a5e54a56e445e1f9fdb416fa74da9c9b35392ffab02050066c7ad080b2a6f9afec47198f503807dca2873958f8bad5a9f948673096ee94785e6f89a351c0308666a14566ba54eba3c391f948dcffd1e8302d7d2d747035d78824f79ec4596ebb738717f2324628b843fab71daacab4f29f240e2d4bf7715c5e69ffea9502cb388aae50386fdbfb2d621bc5c71e54e177e067c80f9c8723d63f40207f2080c4804c3e3b24268e04ae6c9ac8aa0d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604148418cc8534ecbc0c94942e08599cc7b2104e0a08300d06092a864886f70d01010b0500038201010098f2375a4190a11ac57651282036230eaee628bbaaf894ae48a4307f1bfc248d4bb4c8a197f6b6f17a70c85393cc0828e39825cf23a4f9de21d37c8509ad4e9a753ac20b6a897876444718656c8d418e3b7f9acbf4b5a750d7052c37e8034bade961a0026ef5f2f0c5b2ed5bb7dcfa945c779e13a57f52ad95f2f8933bde8b5c5bca5a525b60af14f74befa3fb9f40956d3154fc42d3c7461f23add90f48709ad9757871d1724334756e5759c2025c266029cf2319168e8843a5d4e4cb08fb231143e843297262a1a95d5e08d490aeb8d8ce14c2d055f286f6c49343776661c0b9e841d7977860036e4a72aea5d17dba109e866c1b8ab95933f8ebc490bef1b9 C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 040000000100000010000000324a4bbbc863699bbe749ac6dd1d4624140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a0f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e650190000000100000010000000fd960962ac6938e0d4b0769aa1a64e262000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8DA7F965EC5EFC37910F1C6E59FDC1CC6A6EDE16 C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\5A8CEF45D7A69859767A8C8B4496B578CF474B1A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\1C58A3A8518E8759BF075B76B750D4F2DF264FCD C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\2AD974A775F73CBDBBD8F5AC3A49255FA8FB1F8C\Blob = 0300000001000000140000002ad974a775f73cbdbbd8f5ac3a49255fa8fb1f8c2000000001000000620400003082045e30820346a0030201020213077312380b9d6688a33b1ed9bf9ccda68e0e0f300d06092a864886f70d01010b05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412031301e170d3232303832333232323132385a170d3330303832333232323132385a303c310b3009060355040613025553310f300d060355040a1306416d617a6f6e311c301a06035504031313416d617a6f6e205253412032303438204d303130820122300d06092a864886f70d01010105000382010f003082010a0282010100eb712ca9cb1f8828923230af8a570f78b73725955587ac675c97d322c8daa214676b7cf067dae2032ab356125dc6b547f96708a7937a9592180fb4f9f910369a7f2f80b64fba134ec75d531ee0dd96330720d396bc12e4745042a1051373b54f9b4424fe2d7fedbc2285ec362133977506ce271882dce3d9c582078d5e26012626671fd93f13cf32ba6bad7864fcaaff0e023c07df9c0578728cfdea75b7032884dae86e078cd05085ef8154b2716eec6d62ef8f94c35ee9c4a4d091c02e249198caeeba258ed4f671b6fb5b6b38064837478d86dcf2ea06fb76377d9eff424e4d588293cfe271c278b17aab4b5b94378881e4d9af24aef872c565fb4bb451e70203010001a382015a3082015630120603551d130101ff040830060101ff020100300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030106082b06010505070302301d0603551d0e0416041481b80e638a891218e5fa3b3b50959fe6e5901385301f0603551d230418301680148418cc8534ecbc0c94942e08599cc7b2104e0a08307b06082b06010505070101046f306d302f06082b060105050730018623687474703a2f2f6f6373702e726f6f746361312e616d617a6f6e74727573742e636f6d303a06082b06010505073002862e687474703a2f2f6372742e726f6f746361312e616d617a6f6e74727573742e636f6d2f726f6f746361312e636572303f0603551d1f043830363034a032a030862e687474703a2f2f63726c2e726f6f746361312e616d617a6f6e74727573742e636f6d2f726f6f746361312e63726c30130603551d20040c300a3008060667810c010201300d06092a864886f70d01010b05000382010100ad00de0205232e063262b46bb19416e41140de2bfa59c135efe0aa8f2b41b9d1f38739001df23db5a7470c0606c691f3075702d4edbd17c1909abf4875a2074f30dd4a6a42b50d3d15c00ffe845bc63c99cc5752b1d86e12d59692934b94e507e88982086a7a34d49e64e13d876a92909a63a14bf88fb6ea34d305be20c2de06e28c9f738b9f4d3985cace19369d85c99ec9f8503fb67e88a1efca84068b50b40a5ca61c44f1fdc8614060f26125aa07f4c7c27375e40c0b428d04e55f4448995b7b898196a7889d4b0d62e804c4d7feb4e8b26dcaecc01cbc385b1ddf85ce5b7ae3494b6cb9a7ddf405b249ade1c5146bc2ccebcd7fd65869bac3207e7fb0b8 C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 5c0000000100000004000000001000001900000001000000100000009f687581f7ef744ecfc12b9cee6238f10f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa2140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a2040000000100000010000000be954f16012122448ca8bc279602acf52000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 5c000000010000000400000000080000190000000100000010000000fd960962ac6938e0d4b0769aa1a64e260f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e650030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7040000000100000010000000324a4bbbc863699bbe749ac6dd1d46242000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 5c000000010000000400000000080000190000000100000010000000d8b5fb368468620275d142ffd2aade370300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e56800000001000000000000007e000000010000000800000000c0032f2df8d6011d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3610b000000010000001200000056006500720069005300690067006e0000001400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331336200000001000000200000009acfab7e43c8d880d06b262a94deeee4b4659989c3d0caf19baf6405e41ab7df09000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703017f000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000006300000030613021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c9040000000100000010000000cb17e431673ee209fe455793f30afa1c2000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E\Blob = 030000000100000014000000b51c067cee2b0c3df855ab2d92f4fe39d4e70f0e2000000001000000e1030000308203dd308202c5a003020102020100300d06092a864886f70d01010b050030818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a30818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bdedc103fcf68ffc02b16f5b9f48d99d79e2a2b703615618c347b6d7ca3d352e8943f7a1699bde8a1afd13209cb44977322956fdb9ec8cdd22fa72dc276197eef65a84ec6e19b9892cdc845bd574fb6b5fc589a51052894655f4b8751ce67fe454ae4bf85572570219f8177159eb1e280774c59d48be6cb4f4a4b0f364377992c0ec465e7fe16d534c62afcd1f0b63bb3a9dfbfc7900986174cf26824063f3b2726a190d99cad40e75cc37fb8b89c159f1627f5fb35f6530f8a7b74d765a1e765e34c0e89656998ab3f07fa4cdbddc32317c91cfe05f11f86baa495cd19994d1a2e3635b0976b55662e14b741d96d426d4080459d0980e0ee6defcc3ec1f90f10203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147c0c321fa7d9307fc47d68a362a8a1ceab075b27300d06092a864886f70d01010b050003820101001159fa254f036f94993b9a1f828539d47605945ee128936d625d09c2a0a8d4b07538f1346a9de49f8a862651e62cd1c62d6e95204a9201ecb88a677b31e2672e8c9503262e439d4a31f60eb50cbbb7e2377f22ba00a30e7b52fb6bbb3bc4d379514ecd90f4670719c83c467a0d017dc558e76de68530179a24c410e004f7e0f27fd4aa0aff421d37ed94e5645912207738d3323e3881759673fa688fb1cbce1fc5ecfa9c7ecf7eb1f1072db6fcbfcaa4bfd097054abcea18280290bd5478092171d3d17d1dd916b0a9613dd00a0022fcc77bcb0964450b3b4081f77d7c32f598ca588e7d2aee90597364f936745e25a1f566052e7f3915a92afb508b8e8569f4 C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0D44DD8C3C8C1A1A58756481E90F2E2AFFB3D26E C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\1C58A3A8518E8759BF075B76B750D4F2DF264FCD\Blob = 0300000001000000140000001c58a3a8518e8759bf075b76b750d4f2df264fcd2000000001000000c2040000308204be308203a6a003020102021006d8d904d5584346f68a2fa754227ec4300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3231303431343030303030305a170d3331303431333233353935395a304f310b300906035504061302555331153013060355040a130c446967694365727420496e633129302706035504031320446967694365727420544c53205253412053484132353620323032302043413130820122300d06092a864886f70d01010105000382010f003082010a0282010100c14bb3654770bcdd4f58dbec9cedc366e51f311354ad4a66461f2c0aec6407e52edcdcb90a20eddfe3c4d09e9aa97a1d8288e51156db1e9f58c251e72c340d2ed292e156cbf1795fb3bb87ca25037b9a52416610604f571349f0e8376783dfe7d34b674c2251a6df0e9910ed57517426e27dc7ca622e131b7f238825536fc13458008b84fff8bea75849227b96ada2889b15bca07cdfe951a8d5b0ed37e236b4824b62b5499aecc767d6e33ef5e3d6125e44f1bf71427d58840380b18101faf9ca32bbb48e278727c52b74d4a8d697dec364f9cace53a256bc78178e490329aefb494fa415b9cef25c19576d6b79a72ba2272013b5d03d40d321300793ea99f50203010001a38201823082017e30120603551d130101ff040830060101ff020100301d0603551d0e04160414b76ba2eaa8aa848c79eab4da0f98b2c59576b9f4301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030106082b06010505070302307606082b06010505070101046a3068302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304006082b060105050730028634687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274476c6f62616c526f6f7443412e63727430420603551d1f043b30393037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274476c6f62616c526f6f7443412e63726c303d0603551d2004363034300b06096086480186fd6c02013007060567810c01013008060667810c0102013008060667810c0102023008060667810c010203300d06092a864886f70d01010b050003820101008032ce5e0bdd6e5a0d0aafe1d684cbc08efa8570edda5db30cf72b7540fe850afaf33178b7704b1a8958ba80bdf36b1de97ecf0bba589c59d490d3fd6cfdd0986db771825bcf6d0b5a09d07bdec443d82aa4de9e41265fbb8f99cbddaee1a86f9f87fe74b71f1b20abb14fc6f5675d5d9b3ce9ff69f7616cd6d9f3fd36c6ab038876d24b2e7586e3fcd8557d26c21177df3e02b67cf3ab7b7a86366fb8f7d89371cf86df7330fa7babed2a59c842843b11171a52f3c90e147da25b7267ba71ed574766c5b8024a65345e8bd02a3c209c51994ce7529ef76b112b0d927e1de88aeb36164387ea2a63bf753febdec403bb0a3cf730efebaf4cfc8b3610733ef3a4 C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2 C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 040000000100000010000000cb17e431673ee209fe455793f30afa1c0f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c953000000010000006300000030613021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c07f000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030109000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000009acfab7e43c8d880d06b262a94deeee4b4659989c3d0caf19baf6405e41ab7df1400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331330b000000010000001200000056006500720069005300690067006e0000001d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3617e000000010000000800000000c0032f2df8d6016800000001000000000000000300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e5190000000100000010000000d8b5fb368468620275d142ffd2aade372000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A

NTFS ADS

Description Indicator Process Target
File created C:\Program Files\Malwarebytes\Anti-Malware\mbuns.exe\:Zone.Identifier:$DATA C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
File opened for modification C:\Users\Admin\Downloads\jjsploit_8.12.2_x64_en-US.msi:Zone.Identifier C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File opened for modification C:\Users\Admin\Downloads\MBSetup.exe:Zone.Identifier C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\Downloads\MBSetup.exe N/A
N/A N/A C:\Users\Admin\Downloads\MBSetup.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\Downloads\MBSetup.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Mozilla Firefox\firefox.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A
N/A N/A C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1488 wrote to memory of 832 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 832 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 1224 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 1224 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 4952 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 4952 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 4952 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 4952 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 4952 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 4952 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 4952 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 4952 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 4952 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 4952 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 4952 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 4952 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 4952 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 4952 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 4952 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 4952 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 4952 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 4952 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 4952 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 4952 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 4952 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 4952 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 4952 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 4952 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 4952 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 4952 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 4952 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 4952 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 4952 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 4952 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 4952 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 4952 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 4952 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 4952 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 4952 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 4952 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 4952 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 4952 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 4952 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 4952 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 4952 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 4952 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 4952 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 4952 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 4952 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 4952 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 4952 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 4952 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 4952 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 4952 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 4952 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 3788 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 3788 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 3788 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 3788 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 3788 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 3788 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 3788 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 3788 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1488 wrote to memory of 3788 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy WMI provider

ransomware

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://malwarebytes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2e0,0x2f4,0x7fffcff7f208,0x7fffcff7f214,0x7fffcff7f220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1800,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:11

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2136,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=2132 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2448,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=2480 /prefetch:13

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2468,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3440,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4676,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=3708,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4896,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:14

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4916,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:14

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5604,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:14

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5612,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:14

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5612,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:14

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe

cookie_exporter.exe --cookie-json=1128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5828,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:14

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=5876,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3660,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:14

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=6248,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=3592,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=5736,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=6520,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --field-trial-handle=6708,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --field-trial-handle=6848,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=6880 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --field-trial-handle=7024,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=7000 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=732,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=7192 /prefetch:14

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7212,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=7276 /prefetch:14

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3496,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=7308 /prefetch:14

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --field-trial-handle=5124,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=7292 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4852,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=7376 /prefetch:14

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5168,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=7668 /prefetch:14

C:\Users\Admin\Downloads\MBSetup.exe

"C:\Users\Admin\Downloads\MBSetup.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=8684,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=8276 /prefetch:14

C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe

"C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7376,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=6844 /prefetch:14

C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe

"C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe" /installmbtun

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall

C:\Windows\system32\DrvInst.exe

DrvInst.exe "4" "9" "C:\Program Files\Malwarebytes\Anti-Malware\mbtun\mbtun.inf" "9" "4ba9030c7" "0000000000000150" "Service-0x0-3e7$\Default" "0000000000000160" "208" "C:\Program Files\Malwarebytes\Anti-Malware\mbtun"

C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe

"C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe" /Service /Protected

C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe

"C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k AppReadiness -p -s AppReadiness

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=876,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:14

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7560,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=8896 /prefetch:14

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C timeout /t 1 & "C:\Program Files\Mozilla Firefox\firefox.exe" -install -extension "C:\Users\Admin\AppData\Local\Temp\{242af0bb-db11-4734-b7a0-61cb8a9b20fb}.xpi"

C:\Windows\SysWOW64\timeout.exe

timeout /t 1

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -install -extension "C:\Users\Admin\AppData\Local\Temp\{242af0bb-db11-4734-b7a0-61cb8a9b20fb}.xpi"

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -install -extension C:\Users\Admin\AppData\Local\Temp\{242af0bb-db11-4734-b7a0-61cb8a9b20fb}.xpi

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=8428,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=7568 /prefetch:14

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1964 -prefsLen 27097 -prefMapHandle 1968 -prefMapSize 270279 -ipcHandle 2072 -initialChannelId {4176334c-2bde-4d8e-a62b-2494c0c21df4} -parentPid 7892 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7892" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=8316,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=7500 /prefetch:14

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=8456,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=7512 /prefetch:14

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2440 -prefsLen 27133 -prefMapHandle 2444 -prefMapSize 270279 -ipcHandle 2452 -initialChannelId {a2e7196a-37b7-4d56-a4dd-544b16da1eb2} -parentPid 7892 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7892" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3564 -prefsLen 27274 -prefMapHandle 3568 -prefMapSize 270279 -jsInitHandle 3572 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3580 -initialChannelId {83cd0ff1-c003-4ac7-b7dc-0106f95d5399} -parentPid 7892 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7892" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3952 -prefsLen 27274 -prefMapHandle 3956 -prefMapSize 270279 -ipcHandle 3964 -initialChannelId {8fb70981-5442-480c-af68-aed6fbc3243b} -parentPid 7892 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7892" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3740,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:14

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3236 -prefsLen 34773 -prefMapHandle 3200 -prefMapSize 270279 -jsInitHandle 3204 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2968 -initialChannelId {e5912674-761a-4b22-82ef-f7396b56cb5a} -parentPid 7892 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7892" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5104 -prefsLen 35010 -prefMapHandle 5108 -prefMapSize 270279 -ipcHandle 5112 -initialChannelId {21cf8fb1-166c-4d1a-8dd6-e0fd3c8d824b} -parentPid 7892 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7892" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4320 -prefsLen 32952 -prefMapHandle 5628 -prefMapSize 270279 -jsInitHandle 5668 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5632 -initialChannelId {7948f054-f3dc-4f2f-ab6e-9e4e7a239bb6} -parentPid 7892 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7892" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5836 -prefsLen 32952 -prefMapHandle 5840 -prefMapSize 270279 -jsInitHandle 5844 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5852 -initialChannelId {d9bfa49b-73cf-4c9a-999e-395565336267} -parentPid 7892 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7892" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab

C:\Program Files\Mozilla Firefox\firefox.exe

"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6024 -prefsLen 32952 -prefMapHandle 6028 -prefMapSize 270279 -jsInitHandle 6032 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6040 -initialChannelId {3f88a1f0-c947-4054-b543-6e6e0b4a2133} -parentPid 7892 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7892" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2952,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=7320 /prefetch:10

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=8432,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=7536 /prefetch:14

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5848,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:14

C:\Program Files\Malwarebytes\Anti-Malware\mbambgnativemsg.exe

"C:\Program Files\Malwarebytes\Anti-Malware\mbambgnativemsg.exe" "C:\Program Files\Malwarebytes\Anti-Malware\mbam.firefox.manifest.json" {242af0bb-db11-4734-b7a0-61cb8a9b20fb}

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=8300,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:14

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4776,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=2032 /prefetch:14

C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe

"C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe"

C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe

"C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5332,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=8940 /prefetch:14

C:\Windows\system32\DrvInst.exe

DrvInst.exe "4" "0" "C:\Windows\TEMP\{78e959f8-a3fe-6c43-baf7-9761380c5af4}\farflt11.inf" "9" "43b788047" "0000000000000178" "Service-0x0-3e7$\Default" "000000000000017C" "208" "C:\Program Files\Malwarebytes\Anti-Malware\sdk"

C:\Windows\system32\DrvInst.exe

DrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\farflt11.inf_amd64_a08c83c14d71bb76\farflt11.inf" "0" "43b788047" "00000000000000F0" "Service-0x0-3e7$\Default"

C:\Windows\system32\DrvInst.exe

DrvInst.exe "5" "2" "C:\Windows\System32\DriverStore\FileRepository\farflt11.inf_amd64_a08c83c14d71bb76\farflt11.inf" "0" "46fa191bf" "000000000000017C" "Service-0x0-3e7$\Default"

C:\Windows\system32\DrvInst.exe

DrvInst.exe "4" "0" "C:\Windows\TEMP\{ef8abc05-ebd6-2849-8bd2-a09c65556e5c}\farflt11.inf" "9" "43b788047" "000000000000014C" "Service-0x0-3e7$\Default" "0000000000000168" "208" "C:\Program Files\Malwarebytes\Anti-Malware\sdk"

C:\Windows\system32\DrvInst.exe

DrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\farflt11.inf_amd64_a08c83c14d71bb76\farflt11.inf" "0" "43b788047" "0000000000000168" "Service-0x0-3e7$\Default"

C:\Windows\system32\DrvInst.exe

DrvInst.exe "5" "2" "C:\Windows\System32\DriverStore\FileRepository\farflt11.inf_amd64_a08c83c14d71bb76\farflt11.inf" "0" "46fa191bf" "00000000000000F0" "Service-0x0-3e7$\Default"

C:\Windows\system32\DrvInst.exe

DrvInst.exe "4" "0" "C:\Windows\TEMP\{33fb8359-67ff-884e-bcaf-6b0c2b3d1253}\farflt11.inf" "9" "43b788047" "000000000000017C" "Service-0x0-3e7$\Default" "00000000000000BC" "208" "C:\Program Files\Malwarebytes\Anti-Malware\sdk"

C:\Windows\system32\DrvInst.exe

DrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\farflt11.inf_amd64_a08c83c14d71bb76\farflt11.inf" "0" "43b788047" "00000000000000BC" "Service-0x0-3e7$\Default"

C:\Windows\system32\DrvInst.exe

DrvInst.exe "5" "2" "C:\Windows\System32\DriverStore\FileRepository\farflt11.inf_amd64_a08c83c14d71bb76\farflt11.inf" "0" "46fa191bf" "000000000000010C" "Service-0x0-3e7$\Default"

C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exe

ig.exe reseed

C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exe

ig.exe reseed

C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exe

ig.exe reseed

C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exe

ig.exe reseed

C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exe

ig.exe reseed

C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exe

ig.exe reseed

C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exe

ig.exe reseed

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --field-trial-handle=7464,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=7064 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --field-trial-handle=5840,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --field-trial-handle=7064,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=8876 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --field-trial-handle=7500,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4712,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=7056 /prefetch:14

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --field-trial-handle=6560,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:9

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c ""C:\Program Files\Malwarebytes\Anti-Malware\mbambgnativemsg.exe" chrome-extension://bojobppfploabceghnmlahpoonbcbacn/ --parent-window=0" < \\.\pipe\chrome.nativeMessaging.in.4dc9467f232cacdd > \\.\pipe\chrome.nativeMessaging.out.4dc9467f232cacdd

C:\Program Files\Malwarebytes\Anti-Malware\MbamBgNativeMsg.exe

"C:\Program Files\Malwarebytes\Anti-Malware\mbambgnativemsg.exe" chrome-extension://bojobppfploabceghnmlahpoonbcbacn/ --parent-window=0

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --field-trial-handle=6900,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=6944 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --field-trial-handle=8360,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --field-trial-handle=8968,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=6944 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --field-trial-handle=6988,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=6952 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --field-trial-handle=5624,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=7472 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --field-trial-handle=7084,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=3924 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --field-trial-handle=6640,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=3052 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --field-trial-handle=5256,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=8820 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6916,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:14

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --field-trial-handle=6624,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --field-trial-handle=3320,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --field-trial-handle=7468,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --field-trial-handle=5716,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --field-trial-handle=5764,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6456,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=4156 /prefetch:14

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --field-trial-handle=7280,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --field-trial-handle=5796,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=4672 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --field-trial-handle=6920,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --field-trial-handle=6588,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --field-trial-handle=7096,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --field-trial-handle=4660,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6732,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:14

C:\Windows\System32\msiexec.exe

"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\jjsploit_8.12.2_x64_en-US.msi"

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding 1CA96F58E61C9AE33DC012EB53C0E47A C

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Program Files\Malwarebytes\Anti-Malware\MBAMWsc.exe

"C:\Program Files\Malwarebytes\Anti-Malware\MBAMWsc.exe" /wac 0 /status on true /updatesubstatus none /scansubstatus none /settingssubstatus none

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --field-trial-handle=3664,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:1

C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\updatrpkg\mbupdatrV5.exe

"C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\updatrpkg\mbupdatrV5.exe" "C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE" "C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\config\UpdateControllerConfig.json" "C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE" "C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\dbclsupdate\staging" /db:dbupdate /su:no

C:\Windows\system32\srtasks.exe

C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2

C:\Program Files\jjsploit\jjsploit.exe

"C:\Program Files\jjsploit\jjsploit.exe"

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=jjsploit.exe --webview-exe-version=8.12.2 --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=2612.8856.4232895733381840381

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x168,0x16c,0x170,0x144,0x88,0x7fff8bd8b078,0x7fff8bd8b084,0x7fff8bd8b090

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.12.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1660,i,8697715772394697968,8550614353955445864,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1652 /prefetch:2

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.12.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1980,i,8697715772394697968,8550614353955445864,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1844 /prefetch:11

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.12.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1324,i,8697715772394697968,8550614353955445864,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:13

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.12.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3364,i,8697715772394697968,8550614353955445864,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3388 /prefetch:1

C:\Program Files\jjsploit\jjsploit.exe

"\\?\C:\Program Files\jjsploit\jjsploit.exe"

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=jjsploit.exe --webview-exe-version=8.12.2 --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=2836.6652.6578232438530437470

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x164,0x168,0x16c,0x140,0x174,0x7fff8bd8b078,0x7fff8bd8b084,0x7fff8bd8b090

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.12.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1732,i,13933276122914260891,13800586704635429911,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1728 /prefetch:2

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.12.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1656,i,13933276122914260891,13800586704635429911,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1948 /prefetch:11

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.12.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1584,i,13933276122914260891,13800586704635429911,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2152 /prefetch:13

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.12.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3364,i,13933276122914260891,13800586704635429911,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3396 /prefetch:1

C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exe

ig.exe reseed

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4996,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=1964 /prefetch:14

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --field-trial-handle=5284,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=6888 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://lootdest.org/s?FiuBqZiH&data=JTEovJn4INFLF/gJ3pLGy9SLa/2aKvT%2BNXbATJKyL4gZWnmRVvBsjsV4v42tiy%2Bc

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --always-read-main-dll --field-trial-handle=6448,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --always-read-main-dll --field-trial-handle=5248,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=872 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --always-read-main-dll --field-trial-handle=6884,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --always-read-main-dll --field-trial-handle=6616,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --always-read-main-dll --field-trial-handle=8984,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=7352 /prefetch:1

C:\Program Files\jjsploit\jjsploit.exe

"\\?\C:\Program Files\jjsploit\jjsploit.exe"

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=jjsploit.exe --webview-exe-version=8.12.2 --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=7604.2636.16164788802710653176

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x164,0x168,0x16c,0x140,0x174,0x7fff8bd8b078,0x7fff8bd8b084,0x7fff8bd8b090

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.12.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1932,i,4805203553298155684,4922950700045960594,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1916 /prefetch:2

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.12.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1664,i,4805203553298155684,4922950700045960594,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:11

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.12.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2268,i,4805203553298155684,4922950700045960594,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:13

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.12.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3444,i,4805203553298155684,4922950700045960594,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5312,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=7140 /prefetch:14

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5312,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=7140 /prefetch:14

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5320,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:14

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.12.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4772,i,4805203553298155684,4922950700045960594,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:14

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.12.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4816,i,4805203553298155684,4922950700045960594,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:14

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.12.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4812,i,4805203553298155684,4922950700045960594,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:14

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.12.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=5012,i,4805203553298155684,4922950700045960594,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:14

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --always-read-main-dll --field-trial-handle=6704,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:1

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.12.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=5016,i,4805203553298155684,4922950700045960594,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:10

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.12.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=5052,i,4805203553298155684,4922950700045960594,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:14

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6632,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:14

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.12.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4352,i,4805203553298155684,4922950700045960594,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4608 /prefetch:14

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6680,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=8312 /prefetch:14

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.12.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4228,i,4805203553298155684,4922950700045960594,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4560 /prefetch:14

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.12.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=5028,i,4805203553298155684,4922950700045960594,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4016 /prefetch:14

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.12.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4560,i,4805203553298155684,4922950700045960594,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4016 /prefetch:14

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe

"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView" --webview-exe-name=jjsploit.exe --webview-exe-version=8.12.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4832,i,4805203553298155684,4922950700045960594,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:14

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5000,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:14

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6368,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:14

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5824,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:14

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6348,i,13605422003395996331,2228592434728061502,262144 --variations-seed-version --mojo-platform-channel-handle=7140 /prefetch:14

Network

Country Destination Domain Proto
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 150.171.27.11:80 edge.microsoft.com tcp
US 150.171.28.11:443 edge.microsoft.com tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 api.edgeoffer.microsoft.com udp
US 8.8.8.8:53 api.edgeoffer.microsoft.com udp
US 8.8.8.8:53 copilot.microsoft.com udp
US 8.8.8.8:53 copilot.microsoft.com udp
US 150.171.28.11:443 edge.microsoft.com tcp
US 13.107.246.64:443 api.edgeoffer.microsoft.com tcp
FR 2.22.251.27:443 copilot.microsoft.com tcp
US 150.171.28.11:443 edge.microsoft.com tcp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 150.171.27.11:443 edge.microsoft.com tcp
FR 2.22.251.63:443 www.bing.com tcp
US 8.8.8.8:53 update.googleapis.com udp
US 8.8.8.8:53 update.googleapis.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 150.171.28.11:443 edge.microsoft.com tcp
US 8.8.8.8:53 edgeassetservice.azureedge.net udp
US 8.8.8.8:53 edgeassetservice.azureedge.net udp
US 13.107.246.64:443 edgeassetservice.azureedge.net tcp
US 150.171.28.11:443 edge.microsoft.com tcp
FR 2.22.251.63:443 www.bing.com udp
FR 2.22.251.63:443 www.bing.com tcp
US 8.8.8.8:53 r.bing.com udp
US 8.8.8.8:53 r.bing.com udp
US 8.8.8.8:53 th.bing.com udp
US 8.8.8.8:53 th.bing.com udp
FR 2.22.251.53:443 r.bing.com tcp
FR 2.22.251.53:443 r.bing.com tcp
US 23.4.84.73:443 th.bing.com tcp
US 23.4.84.73:443 th.bing.com tcp
FR 2.22.251.53:443 r.bing.com udp
FR 2.22.251.53:443 r.bing.com udp
US 23.4.84.73:443 th.bing.com udp
US 8.8.8.8:53 rewards.bing.com udp
US 8.8.8.8:53 rewards.bing.com udp
US 150.171.28.10:443 rewards.bing.com tcp
US 8.8.8.8:53 login.microsoftonline.com udp
US 8.8.8.8:53 login.microsoftonline.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
IE 40.126.31.69:443 login.microsoftonline.com tcp
US 150.171.27.11:443 edge.microsoft.com tcp
US 8.8.8.8:53 www.malwarebytes.com udp
US 8.8.8.8:53 www.malwarebytes.com udp
US 192.0.66.233:443 www.malwarebytes.com tcp
US 192.0.66.233:443 www.malwarebytes.com tcp
US 8.8.8.8:53 web-service.malwarebytes.com udp
US 8.8.8.8:53 web-service.malwarebytes.com udp
US 8.8.8.8:53 dev.visualwebsiteoptimizer.com udp
US 8.8.8.8:53 dev.visualwebsiteoptimizer.com udp
US 192.0.66.185:443 web-service.malwarebytes.com tcp
US 8.8.8.8:53 stats.wp.com udp
US 8.8.8.8:53 stats.wp.com udp
US 34.107.218.251:443 dev.visualwebsiteoptimizer.com tcp
US 192.0.76.3:443 stats.wp.com tcp
US 34.107.218.251:443 dev.visualwebsiteoptimizer.com udp
US 34.107.218.251:443 dev.visualwebsiteoptimizer.com udp
US 192.0.66.185:443 web-service.malwarebytes.com tcp
US 8.8.8.8:53 plausible.io udp
US 8.8.8.8:53 plausible.io udp
US 8.8.8.8:53 cdn.weglot.com udp
US 8.8.8.8:53 cdn.weglot.com udp
US 8.8.8.8:53 api.weglot.com udp
US 8.8.8.8:53 api.weglot.com udp
US 8.8.8.8:53 genesis.malwarebytes.com udp
US 8.8.8.8:53 genesis.malwarebytes.com udp
GB 79.127.237.132:443 plausible.io tcp
US 104.18.38.142:443 api.weglot.com udp
US 172.64.149.114:443 api.weglot.com udp
US 3.92.150.205:443 genesis.malwarebytes.com tcp
US 8.8.8.8:53 sso.malwarebytes.com udp
US 8.8.8.8:53 sso.malwarebytes.com udp
GB 79.127.237.132:443 plausible.io tcp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 pixel.wp.com udp
US 8.8.8.8:53 pixel.wp.com udp
US 8.8.8.8:53 cdn.cookielaw.org udp
US 8.8.8.8:53 cdn.cookielaw.org udp
US 3.211.126.207:443 sso.malwarebytes.com tcp
US 150.171.28.11:443 edge.microsoft.com tcp
US 104.18.86.42:443 cdn.cookielaw.org tcp
US 104.18.86.42:443 cdn.cookielaw.org tcp
US 8.8.8.8:53 geolocation.onetrust.com udp
US 8.8.8.8:53 geolocation.onetrust.com udp
US 104.18.32.137:443 geolocation.onetrust.com tcp
US 8.8.8.8:53 dailystats.in udp
US 8.8.8.8:53 dailystats.in udp
US 8.8.8.8:53 www.google.com udp
US 8.8.8.8:53 www.google.com udp
US 8.8.8.8:53 privacyportal.onetrust.com udp
US 8.8.8.8:53 privacyportal.onetrust.com udp
US 8.8.8.8:53 connect.facebook.net udp
US 8.8.8.8:53 connect.facebook.net udp
US 8.8.8.8:53 bat.bing.com udp
US 8.8.8.8:53 bat.bing.com udp
US 8.8.8.8:53 tvspix.com udp
US 8.8.8.8:53 tvspix.com udp
US 104.21.112.1:443 dailystats.in udp
IE 209.85.203.103:443 www.google.com udp
US 172.64.155.119:443 privacyportal.onetrust.com tcp
US 150.171.27.10:443 bat.bing.com tcp
US 52.89.13.250:443 tvspix.com tcp
FR 157.240.202.1:443 connect.facebook.net udp
US 8.8.8.8:53 td.doubleclick.net udp
US 8.8.8.8:53 td.doubleclick.net udp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 google.com udp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
IE 74.125.193.155:443 googleads.g.doubleclick.net tcp
IE 74.125.193.155:443 googleads.g.doubleclick.net tcp
IE 74.125.193.155:443 googleads.g.doubleclick.net tcp
IE 172.253.116.113:443 google.com udp
IE 74.125.193.155:443 googleads.g.doubleclick.net udp
US 8.8.8.8:53 region1.analytics.google.com udp
US 8.8.8.8:53 region1.analytics.google.com udp
US 8.8.8.8:53 stats.g.doubleclick.net udp
US 8.8.8.8:53 stats.g.doubleclick.net udp
US 8.8.8.8:53 www.google.co.uk udp
US 8.8.8.8:53 www.google.co.uk udp
US 216.239.34.36:443 region1.analytics.google.com tcp
IE 74.125.193.155:443 stats.g.doubleclick.net tcp
US 8.8.8.8:53 bat.bing.net udp
US 8.8.8.8:53 bat.bing.net udp
US 150.171.28.10:443 bat.bing.net tcp
US 150.171.28.10:443 bat.bing.net tcp
US 8.8.8.8:53 www.facebook.com udp
US 8.8.8.8:53 www.facebook.com udp
GB 163.70.147.35:443 www.facebook.com udp
GB 163.70.147.35:443 www.facebook.com udp
US 8.8.8.8:53 edge-consumer-static.azureedge.net udp
US 8.8.8.8:53 edge-consumer-static.azureedge.net udp
US 13.107.246.64:443 edge-consumer-static.azureedge.net tcp
US 216.239.34.36:443 region1.analytics.google.com udp
US 192.0.76.3:443 pixel.wp.com udp
IE 74.125.193.155:443 stats.g.doubleclick.net udp
IE 74.125.193.155:443 stats.g.doubleclick.net udp
US 13.107.246.64:443 edge-consumer-static.azureedge.net tcp
US 8.8.8.8:53 downloads.malwarebytes.com udp
US 8.8.8.8:53 downloads.malwarebytes.com udp
GB 216.137.44.52:443 downloads.malwarebytes.com tcp
GB 216.137.44.52:443 downloads.malwarebytes.com tcp
US 8.8.8.8:53 data-cdn.mbamupdates.com udp
US 8.8.8.8:53 data-cdn.mbamupdates.com udp
GB 3.166.65.55:443 data-cdn.mbamupdates.com tcp
US 54.203.55.171:443 api2.amplitude.com tcp
US 3.234.75.5:443 ark.mwbsys.com tcp
US 8.8.8.8:53 static.edge.microsoftapp.net udp
US 8.8.8.8:53 static.edge.microsoftapp.net udp
US 13.107.246.64:443 static.edge.microsoftapp.net tcp
US 150.171.28.11:443 edge.microsoft.com tcp
GB 18.244.124.57:443 d3uee2l94rethg.cloudfront.net tcp
US 3.234.75.5:443 ark.mwbsys.com tcp
GB 18.244.124.63:443 d3uee2l94rethg.cloudfront.net tcp
US 3.234.75.5:443 ark.mwbsys.com tcp
GB 18.244.124.112:443 d3uee2l94rethg.cloudfront.net tcp
GB 23.56.238.51:80 msedge.b.tlu.dl.delivery.mp.microsoft.com tcp
US 3.234.75.5:443 ark.mwbsys.com tcp
GB 18.244.124.112:443 d3uee2l94rethg.cloudfront.net tcp
US 3.234.75.5:443 ark.mwbsys.com tcp
GB 18.244.124.112:443 d3uee2l94rethg.cloudfront.net tcp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
DE 23.222.10.99:80 www.microsoft.com tcp
US 52.71.246.99:443 holocron.mwbsys.com tcp
US 52.71.246.99:443 holocron.mwbsys.com tcp
US 52.71.246.99:443 holocron.mwbsys.com tcp
US 34.209.220.251:443 api2.amplitude.com tcp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com udp
GB 23.56.238.90:443 msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com tcp
US 52.73.214.207:443 ark.mwbsys.com tcp
US 192.0.66.233:443 www.malwarebytes.com tcp
US 52.73.214.207:443 ark.mwbsys.com tcp
US 192.0.66.233:443 www.malwarebytes.com tcp
US 34.36.137.203:443 spocs.getpocket.com udp
US 34.36.137.203:443 spocs.getpocket.com udp
US 34.36.137.203:443 spocs.getpocket.com tcp
US 34.110.138.217:443 merino.services.mozilla.com udp
US 34.110.138.217:443 merino.services.mozilla.com tcp
IE 209.85.202.94:80 c.pki.goog tcp
US 8.8.8.8:53 cloudflare-dns.com udp
US 34.107.221.82:80 detectportal.firefox.com tcp
US 52.73.214.207:443 ark.mwbsys.com tcp
GB 84.201.209.71:80 msedge.b.tlu.dl.delivery.mp.microsoft.com tcp
US 150.171.28.11:443 edge.microsoft.com tcp
US 192.0.66.233:443 www.malwarebytes.com tcp
US 52.73.214.207:443 ark.mwbsys.com tcp
US 192.0.66.233:443 www.malwarebytes.com tcp
US 52.73.214.207:443 ark.mwbsys.com tcp
US 192.0.66.233:443 www.malwarebytes.com tcp
N/A 127.0.0.1:54571 tcp
N/A 127.0.0.1:54744 tcp
US 52.73.214.207:443 ark.mwbsys.com tcp
US 192.0.66.233:443 www.malwarebytes.com tcp
US 52.73.214.207:443 ark.mwbsys.com tcp
US 192.0.66.233:443 www.malwarebytes.com tcp
US 52.73.214.207:443 ark.mwbsys.com tcp
US 192.0.66.233:443 www.malwarebytes.com tcp
US 52.73.214.207:443 ark.mwbsys.com tcp
NL 2.18.121.79:80 a19.dscg10.akamai.net tcp
US 192.0.66.233:443 www.malwarebytes.com tcp
US 34.104.35.123:443 edgedl.me.gvt1.com tcp
US 52.73.214.207:443 ark.mwbsys.com tcp
US 192.0.66.233:443 www.malwarebytes.com tcp
US 34.107.152.202:443 firefox-settings-attachments.cdn.mozilla.net tcp
US 52.73.214.207:443 ark.mwbsys.com tcp
US 192.0.66.233:443 www.malwarebytes.com tcp
US 35.190.72.216:443 prod.classify-client.prod.webservices.mozgcp.net udp
US 35.190.72.216:443 prod.classify-client.prod.webservices.mozgcp.net tcp
US 151.101.3.19:443 archive.mozilla.org tcp
US 52.73.214.207:443 ark.mwbsys.com tcp
US 192.0.66.233:443 www.malwarebytes.com tcp
US 52.73.214.207:443 ark.mwbsys.com tcp
US 192.0.66.233:443 www.malwarebytes.com tcp
US 52.73.214.207:443 ark.mwbsys.com tcp
US 192.0.66.233:443 www.malwarebytes.com tcp
US 52.73.214.207:443 ark.mwbsys.com tcp
US 192.0.66.233:443 www.malwarebytes.com tcp
GB 84.201.209.99:80 msedge.b.tlu.dl.delivery.mp.microsoft.com tcp
US 52.73.214.207:443 ark.mwbsys.com tcp
US 192.0.66.233:443 www.malwarebytes.com tcp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 52.73.214.207:443 ark.mwbsys.com tcp
US 192.0.66.233:443 www.malwarebytes.com tcp
US 52.73.214.207:443 ark.mwbsys.com tcp
US 192.0.66.233:443 www.malwarebytes.com tcp
US 3.209.195.233:443 ark.mwbsys.com tcp
US 192.0.66.233:443 www.malwarebytes.com tcp
US 3.209.195.233:443 ark.mwbsys.com tcp
US 192.0.66.233:443 www.malwarebytes.com tcp
US 50.112.143.215:443 api2.amplitude.com tcp
US 8.8.8.8:53 malwarebytes.com udp
US 8.8.8.8:53 www.malwarebytes.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 www.facebook.com udp
US 8.8.8.8:53 www.linkedin.com udp
US 8.8.8.8:53 x.com udp
US 54.187.98.183:443 api2.amplitude.com tcp
US 192.0.66.233:443 www.malwarebytes.com tcp
US 18.232.199.242:443 iris.mwbsys.com tcp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 52.71.246.99:443 holocron.mwbsys.com tcp
US 54.152.52.18:443 sirius.mwbsys.com tcp
GB 18.244.124.63:443 d3uee2l94rethg.cloudfront.net tcp
FR 2.22.251.7:443 www.bing.com udp
US 8.8.8.8:53 dev.visualwebsiteoptimizer.com udp
US 8.8.8.8:53 dev.visualwebsiteoptimizer.com udp
US 34.107.218.251:443 dev.visualwebsiteoptimizer.com udp
US 8.8.8.8:53 r.bing.com udp
US 8.8.8.8:53 r.bing.com udp
US 8.8.8.8:53 th.bing.com udp
US 8.8.8.8:53 th.bing.com udp
US 8.8.8.8:53 region1.analytics.google.com udp
US 8.8.8.8:53 region1.analytics.google.com udp
US 8.8.8.8:53 www.google.co.uk udp
US 8.8.8.8:53 www.google.co.uk udp
US 8.8.8.8:53 bat.bing.net udp
US 8.8.8.8:53 bat.bing.net udp
FR 2.22.251.65:443 r.bing.com udp
US 23.4.84.71:443 th.bing.com udp
US 23.4.84.71:443 th.bing.com udp
US 216.239.34.36:443 region1.analytics.google.com udp
US 150.171.28.10:443 bat.bing.net tcp
US 8.8.8.8:53 login.microsoftonline.com udp
US 8.8.8.8:53 login.microsoftonline.com udp
IE 40.126.31.1:443 login.microsoftonline.com tcp
US 8.8.8.8:53 wearedevs.net udp
US 8.8.8.8:53 wearedevs.net udp
US 104.26.6.147:443 wearedevs.net udp
US 8.8.8.8:53 cdn.wearedevs.net udp
US 8.8.8.8:53 cdn.wearedevs.net udp
US 8.8.8.8:53 cdn.jsdelivr.net udp
US 8.8.8.8:53 cdn.jsdelivr.net udp
US 8.8.8.8:53 cdnjs.cloudflare.com udp
US 8.8.8.8:53 cdnjs.cloudflare.com udp
US 151.101.193.229:443 cdn.jsdelivr.net tcp
US 151.101.193.229:443 cdn.jsdelivr.net tcp
US 104.17.24.14:443 cdnjs.cloudflare.com udp
US 8.8.8.8:53 static.cloudflareinsights.com udp
US 8.8.8.8:53 static.cloudflareinsights.com udp
US 104.16.79.73:443 static.cloudflareinsights.com tcp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
IE 74.125.193.157:443 googleads.g.doubleclick.net udp
US 8.8.8.8:53 region1.google-analytics.com udp
US 8.8.8.8:53 region1.google-analytics.com udp
US 216.239.32.36:443 region1.google-analytics.com tcp
US 8.8.8.8:53 fundingchoicesmessages.google.com udp
US 8.8.8.8:53 fundingchoicesmessages.google.com udp
IE 209.85.203.138:443 fundingchoicesmessages.google.com tcp
IE 209.85.203.138:443 fundingchoicesmessages.google.com udp
IE 209.85.203.138:443 fundingchoicesmessages.google.com udp
US 8.8.8.8:53 lh3.googleusercontent.com udp
US 8.8.8.8:53 lh3.googleusercontent.com udp
IE 74.125.193.132:443 lh3.googleusercontent.com tcp
US 104.26.6.147:443 cdn.wearedevs.net udp
US 8.8.8.8:53 o438337.ingest.sentry.io udp
US 8.8.8.8:53 o438337.ingest.sentry.io udp
US 34.120.195.249:443 o438337.ingest.sentry.io tcp
US 151.101.193.229:443 cdn.jsdelivr.net udp
US 104.17.24.14:443 cdnjs.cloudflare.com udp
US 8.8.8.8:53 github.com udp
US 8.8.8.8:53 github.com udp
GB 20.26.156.215:443 github.com tcp
GB 20.26.156.215:443 github.com tcp
US 8.8.8.8:53 raw.githubusercontent.com udp
US 8.8.8.8:53 raw.githubusercontent.com udp
US 8.8.8.8:53 mbgc-c-3-0-20.telemetry.malwarebytes.com udp
US 8.8.8.8:53 mbgc-c-3-0-20.telemetry.malwarebytes.com udp
US 52.32.30.22:443 mbgc-c-3-0-20.telemetry.malwarebytes.com tcp
US 34.120.195.249:443 o438337.ingest.sentry.io udp
US 23.4.84.71:443 th.bing.com udp
FR 2.22.251.7:443 r.bing.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 150.171.28.11:443 edge.microsoft.com tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 jjsploitexecutor.com udp
US 8.8.8.8:53 jjsploitexecutor.com udp
US 172.67.223.246:443 jjsploitexecutor.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 150.171.28.11:443 edge.microsoft.com tcp
US 8.8.8.8:53 repelispluss.b-cdn.net udp
US 8.8.8.8:53 repelispluss.b-cdn.net udp
FR 143.244.56.52:443 repelispluss.b-cdn.net tcp
FR 143.244.56.52:443 repelispluss.b-cdn.net tcp
US 34.232.153.166:443 sirius.mwbsys.com tcp
GB 18.244.124.54:443 d3uee2l94rethg.cloudfront.net tcp
DK 104.121.237.231:80 www.microsoft.com tcp
GB 2.22.142.222:80 evcs-ocsp.ws.symantec.com tcp
GB 2.22.142.222:80 evcs-ocsp.ws.symantec.com tcp
US 44.217.213.11:443 hubble.mb-cosmos.com tcp
GB 2.22.142.222:80 evcs-ocsp.ws.symantec.com tcp
US 8.8.8.8:53 sirius.mwbsys.com udp
US 8.8.8.8:53 sirius.mwbsys.com udp
US 54.152.52.18:443 sirius.mwbsys.com tcp
US 8.8.8.8:53 cdn.mwbsys.com udp
US 8.8.8.8:53 cdn.mwbsys.com udp
GB 18.244.124.63:443 cdn.mwbsys.com tcp
US 23.4.84.71:443 www.bing.com udp
GB 18.244.124.63:443 cdn.mwbsys.com tcp
US 8.8.8.8:53 forum.wearedevs.net udp
US 8.8.8.8:53 forum.wearedevs.net udp
US 104.26.6.147:443 forum.wearedevs.net udp
US 8.8.8.8:53 region1.google-analytics.com udp
US 8.8.8.8:53 region1.google-analytics.com udp
US 216.239.34.36:443 region1.google-analytics.com tcp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:443 dns.google tcp
US 8.8.8.8:443 dns.google tcp
US 8.8.8.8:443 dns.google tcp
US 8.8.8.8:443 dns.google udp
US 216.239.32.36:443 region1.google-analytics.com udp
GB 18.244.124.63:443 cdn.mwbsys.com tcp
US 104.21.67.56:443 udp
GB 18.244.124.63:443 cdn.mwbsys.com tcp
GB 18.244.124.63:443 cdn.mwbsys.com tcp
US 172.67.71.2:443 forum.wearedevs.net udp
US 35.190.80.1:443 tcp
US 35.190.80.1:443 udp
US 8.8.8.8:53 api.mboost.me udp
US 8.8.8.8:53 api.mboost.me udp
US 172.67.214.146:443 api.mboost.me udp
US 44.237.9.237:443 mbgc-c-3-0-20.telemetry.malwarebytes.com tcp
US 34.36.137.203:443 spocs.getpocket.com udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:443 dns.google tcp
US 8.8.4.4:443 dns.google tcp
US 8.8.4.4:443 dns.google tcp
US 8.8.4.4:443 dns.google udp
US 216.239.34.36:443 region1.google-analytics.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 150.171.27.11:443 edge.microsoft.com tcp
GB 2.18.27.76:443 www.bing.com udp
US 8.8.4.4:443 dns.google udp
US 216.239.34.36:443 region1.google-analytics.com udp
US 104.21.42.103:443 udp
US 8.8.8.8:53 lootdest.org udp
US 8.8.8.8:53 lootdest.org udp
US 172.67.135.229:443 lootdest.org udp
US 8.8.8.8:53 cdn.jsdelivr.net udp
US 8.8.8.8:53 cdn.jsdelivr.net udp
US 151.101.65.229:443 cdn.jsdelivr.net tcp
US 8.8.8.8:53 d3m6crjuedf6o.cloudfront.net udp
US 8.8.8.8:53 d3m6crjuedf6o.cloudfront.net udp
GB 18.244.141.155:443 d3m6crjuedf6o.cloudfront.net tcp
US 8.8.8.8:53 fingerprinting36542.s3.us-east-1.amazonaws.com udp
US 8.8.8.8:53 fingerprinting36542.s3.us-east-1.amazonaws.com udp
US 8.8.8.8:53 api.taboola.com udp
US 8.8.8.8:53 api.taboola.com udp
US 8.8.8.8:53 d3h26c51lqz4go.cloudfront.net udp
US 8.8.8.8:53 d3h26c51lqz4go.cloudfront.net udp
US 151.101.65.44:443 api.taboola.com tcp
GB 3.166.57.215:443 d3h26c51lqz4go.cloudfront.net tcp
US 52.216.184.150:443 fingerprinting36542.s3.us-east-1.amazonaws.com tcp
US 8.8.8.8:53 nerventualken.com udp
US 8.8.8.8:53 nerventualken.com udp
US 172.67.197.84:443 nerventualken.com udp
US 172.67.197.84:443 nerventualken.com udp
US 8.8.8.8:53 creators.lootlabs.gg udp
US 8.8.8.8:53 creators.lootlabs.gg udp
US 8.8.8.8:53 app.unlockr.app udp
US 8.8.8.8:53 app.unlockr.app udp
US 8.8.8.8:53 unpkg.com udp
US 8.8.8.8:53 unpkg.com udp
US 8.8.8.8:53 d1wzdj81h1hubn.cloudfront.net udp
US 8.8.8.8:53 d1wzdj81h1hubn.cloudfront.net udp
US 104.21.81.47:443 app.unlockr.app udp
GB 143.204.176.41:443 creators.lootlabs.gg tcp
US 104.18.1.22:443 unpkg.com udp
GB 18.245.206.122:443 d1wzdj81h1hubn.cloudfront.net tcp
GB 18.245.206.122:443 d1wzdj81h1hubn.cloudfront.net tcp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 150.171.27.11:443 edge.microsoft.com tcp
US 151.101.65.229:443 cdn.jsdelivr.net udp
US 8.8.8.8:443 dns.google udp
US 8.8.8.8:443 dns.google tcp
US 150.171.27.11:443 edge.microsoft.com tcp
US 8.8.8.8:53 api.mboost.me udp
US 8.8.8.8:53 api.mboost.me udp
US 104.21.67.56:443 api.mboost.me udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:443 dns.google tcp
US 8.8.8.8:443 dns.google tcp
US 8.8.8.8:443 dns.google tcp
US 8.8.8.8:443 dns.google udp
US 216.239.32.36:443 region1.google-analytics.com udp
US 216.239.32.36:443 region1.google-analytics.com tcp
US 23.4.84.73:443 www.bing.com udp
US 8.8.8.8:53 a.nel.cloudflare.com udp
US 8.8.8.8:53 a.nel.cloudflare.com udp
US 35.190.80.1:443 a.nel.cloudflare.com tcp
US 35.190.80.1:443 a.nel.cloudflare.com udp
US 44.224.68.254:443 api2.amplitude.com tcp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 150.171.27.11:443 edge.microsoft.com tcp
US 8.8.8.8:443 dns.google udp
US 8.8.8.8:443 dns.google tcp
US 150.171.28.11:443 edge.microsoft.com tcp
US 150.171.28.11:443 edge.microsoft.com tcp
US 150.171.28.11:443 edge.microsoft.com tcp
US 150.171.28.11:443 edge.microsoft.com tcp
US 150.171.28.11:443 edge.microsoft.com tcp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.4.4:443 dns.google udp
US 104.21.67.56:443 api.mboost.me udp
US 8.8.8.8:53 mbgc-c-3-0-20.telemetry.malwarebytes.com udp
US 8.8.8.8:53 mbgc-c-3-0-20.telemetry.malwarebytes.com udp
US 44.237.9.237:443 mbgc-c-3-0-20.telemetry.malwarebytes.com tcp
US 150.171.28.11:443 edge.microsoft.com tcp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:443 dns.google udp
US 150.171.28.11:443 edge.microsoft.com tcp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 150.171.28.11:443 edge.microsoft.com tcp
US 8.8.8.8:53 edgeassetservice.azureedge.net udp
US 8.8.8.8:53 edgeassetservice.azureedge.net udp
US 13.107.246.64:443 edgeassetservice.azureedge.net tcp
US 150.171.28.11:443 edge.microsoft.com tcp
US 150.171.28.11:443 edge.microsoft.com tcp
US 104.21.67.56:443 api.mboost.me udp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 150.171.27.11:443 edge.microsoft.com tcp
N/A 127.0.0.1:443 tcp
N/A 127.0.0.1:443 tcp
N/A 127.0.0.1:443 tcp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:443 dns.google udp
US 34.107.152.202:443 firefox-settings-attachments.cdn.mozilla.net tcp
US 34.107.152.202:443 firefox-settings-attachments.cdn.mozilla.net tcp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
GB 23.56.238.51:80 msedge.b.tlu.dl.delivery.mp.microsoft.com tcp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
GB 23.56.238.51:80 msedge.b.tlu.dl.delivery.mp.microsoft.com tcp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 44.237.9.237:443 mbgc-c-3-0-20.telemetry.malwarebytes.com tcp
US 199.232.210.172:80 msedge.b.tlu.dl.delivery.mp.microsoft.com tcp
US 8.8.8.8:53 edge.microsoft.com udp
US 8.8.8.8:53 edge.microsoft.com udp
US 150.171.27.11:443 edge.microsoft.com tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 c20e33972749540065628270cfaa4dda
SHA1 c084ee54a85a6bf1ffb1a9af2972ede31458ed1b
SHA256 8f5788592016cec21db4050e2478a282603ce8d68ba63050bff557cc215637c3
SHA512 2ac88203e1d015215a53a57fc52e3ba7b2e84a8b7148c54f11d1f032e67f3dcdf3f827bdec702ade9a067374377128a0345ba446e6f18a2e3414998a004dbc5a

\??\pipe\crashpad_1488_EQRCGXKSBSQAIAII

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 6017e3f3fcca2244a025a1359b9706d8
SHA1 93a1336b70343a2ce6acb73deba1a1872060be6e
SHA256 9f64241015f38224418e393d7238bb902fdd41237b18ce98e8a178ab436c93e9
SHA512 2fe4daf85a84038ac8160fc2756b3c6fe1870272a80ca4ed3e3109f77c4e70e49f3165be0eece206bec74995f41a083932c4bceeefb2459f4109bf1730e42cc8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\94a9c993-de78-4a35-83de-8213efa34c7c.tmp

MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

MD5 6ab0ad03c3e60a06dfc0c18896916a3e
SHA1 50167ff00a98e581e0bc5261563bfc7b94ecac91
SHA256 d4e952fca12c3ddc1b05441c041d714fcee72604b1148e9b0e1aa18a2cdd9685
SHA512 c70e4f9bd1b4ffced9360f594868b912a82ee59742a4d6481aca8abb351ecc49c71cffa6f867bcac5f7570d8792c6ced903e1b9859ffdce218ece5a8d97730f6

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

MD5 06d55006c2dec078a94558b85ae01aef
SHA1 6a9b33e794b38153f67d433b30ac2a7cf66761e6
SHA256 088bb586f79dd99c5311d14e1560bbe0bb56225a1b4432727d2183341c762bcd
SHA512 ec190652af9c213ccbb823e69c21d769c64e3b9bae27bea97503c352163bf70f93c67cebbf327bfc73bfd632c9a3ae57283b6e4019af04750fe18a2410a68e60

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 2831059e784fc5ff1fbbe572bdf19d29
SHA1 82a9a9f9c961efa63ecbb21753710e36595373ed
SHA256 f9cf6d868c7405764bc7ff883530d7f9947c42e624b403fc43f725d1847266b0
SHA512 b9b1e75db616a945342212db5a2c230dd8be57376cf117c6c0c75fc35c4480b628e30e8dd48cb69d5d920bb920dad029ad0f1c685a2b282af707bc5bfb855ca4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 6f2aa3f946d6befe800fe294ab5d22d4
SHA1 0189eb35c94d7a2c2ea11cc7bd7bc4582e0e341e
SHA256 598247da9650af507760b1ff3528c2611df70f093bba8cfe1d90a8ff5b806883
SHA512 2847e127a2bd261dd776b74a7c2f1cd5a365fbc7b711451df19c07fc20725fcd600a64ea54e797649173a7b3cd80065d21e7d2605e68086734c38fa21b8f2771

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

MD5 84e12e569fd730075972dd880a3c45b5
SHA1 2848fb740064f8cf3c5f020045f5c19e42adcdfc
SHA256 cd724d40f8dd43f68a1d77b0079ec3c4732af8cbe8fb164f0581c0d6790ef4d8
SHA512 e30822d648b69b4548289a22cd4c86dee1b77f372000ec29c8fe5128d30c2801498b5cae74a7707fc6a106f098728d2cb038fe6a1f44023fb86883991008b6c3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 5b94f427ad400b4e0efc8e202c4863b6
SHA1 70fd461d32725719b7f50cc4c89220202eab837e
SHA256 e90c47e6e20dbab656ed53fae8a17aef398e9844b844453ae69a961bf045b34c
SHA512 13b65bb3f60c63a6c021dba3bdc024103ea830a60dfe13c97f486e80586bb71d5aef2663e29687189fd8602b6f9f33da7c831ab6eface309f7fb3b7bf6720b6b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 6d8e25f62fbd1ecc10c163c3181517cc
SHA1 d5daa85fa442114d02e65f385a1373cb04bc6993
SHA256 2fa25678d1cae55e60ce03a907d04fd12c139d0f6b91d00282cff40338651916
SHA512 88bca03028461053aefc4995799c5bd1f9c04a1e7fdc45aff247ea0b4ab8532989e5c1b5cc9cd29985de8972d6115cb228a588550643dca41389f7e333e4bcdf

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 60e7daa9252400b8d7063be8e2c558c9
SHA1 4d0e514a42d81fa6b51a64523aff6f700c3d1bf1
SHA256 a82515aecc46a5a12f1ea71d753a574dca3fa5869533ca195c0075d4a8991254
SHA512 d56b001791959709bcabf328b915d0ed9a5192282199c9e007528217aca443bbad2781668d5a207400d297d292267a2ef9ce02c544c505a9e46d3c35cf8a4d45

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000079

MD5 36e0645bd3392c55e78f2ea848fbb4e8
SHA1 26c60221905666dfc8002072a0083a1f06cbd8c9
SHA256 bbf5ef817d938f8bbb1bada103e55f96170f62fe6cf7b54b4019071e7072ee15
SHA512 404f91a851752fa3e2a6a70be6b341b5fde778d3b2e9134c69da971e00c003c7e9d309f4e681464a2a566aa8e9ad18bba158a2bb10cc1b320d448037da74c717

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000074

MD5 40c1320bc877bf54deb60155e22d608a
SHA1 c4735517bdf6903f80e28d80fbae2c58d8e105c7
SHA256 71e7d96e0b15924a58f28b82f88627957a5ea25f7a23930c295186f3412cca2c
SHA512 d52634fb3d303dceec351f3d9dcf5e8387e9b2c1fd4f7f07ad25a557cc1ca0c7f7ec7005a62ab235904596770152bf63ec2c0bb0e2316b31cd330d79818823a1

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007c

MD5 375645dff4a3b1431341328ecb2b2d6a
SHA1 34dab3ff5e6716cd65086f53c4fb309ba9d5dfbd
SHA256 c2f69a05a116e66a0b5b70abb84ad35c1d37fc441b9dca3e9d3a0f8497899059
SHA512 595160a77ecaaf0ad1e106a5953690a2419defe501cff7e2a9c6665a8ac1aa5734dfae00e9918cfabeb9b07e1c1c17cd1eeb034a9c8c0a731466ec89423f9da4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007b

MD5 4a8c93f2cb84336bb11796a549941d40
SHA1 78cbc69d480b07951b23865e27437a565822afc8
SHA256 7dfe96249d73eae447d1edadecd5cc098ab76099647c9e2cf8f3b616d5fe5ee7
SHA512 dd9115f956d945e3d34cf85cb4acf326c37a43f7039ceed076e24077b31bf9cddcf5d92aa491ddc4b5bd37134426231b70527037f76420c8bae9e9700df60e8e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007a

MD5 6c2918af41500d21e282f720f0b2e364
SHA1 7c664d8e579fddeba428d0374daa7576edb55af7
SHA256 2d71a55f5dad7cda17ce63dd9d673c81550681f90d9c059ca23e3be81967c602
SHA512 14859485890626032ac253f7d00277675aa460e206ef537d81ba8cec9fa26e90928ec3c6c90ca5a3977698b45f2619a8c58cb8dc9764cd3e2fb27999a46f2b1a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000083

MD5 8c9f5d592b2671b4910fbd685ae61401
SHA1 2c38e925773617e94fb911f4d1573bd0f44d607b
SHA256 837bb391f879a1edd4521ce965b614bb760c6a2eeacde80329a57631196bea73
SHA512 458c84f09f7473cc56928085cb0325c893ca2f923e921eacfe62b66d4c926b3c99e1c10c8e17c30e00d4d538200d99a6dc1be74818bfa3c219b28714caede9af

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000082

MD5 9880989851fcd47652a37312edb17547
SHA1 fcf275884bff18a926de0bcd46c6bc8918356d86
SHA256 1fc4302f08484cb4df0a32e6cf6ce58cc057de2eed9c645cfdabebef1d3306d1
SHA512 53be2da27a9c74be74a9bdad217c8724affd822a4ae7980439f124d1f8a3e1125b8664e16427308e423a1aa05d83a4b015201ddcd89fed09f9d83902b27e44a9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000080

MD5 a90e737d05ebfa82bf96168def807c36
SHA1 ddc76a0c64ebefe5b9a12546c59a37c03d5d1f5b
SHA256 24ed9db3eb0d97ecf1f0832cbd30bd37744e0d2b520ccdad5af60f7a08a45b90
SHA512 bf1944b5daf9747d98f489eb3edbae84e7bc29ff50436d6b068b85091c95d17fe15b721df0bff08df03232b90b1776a82539d7917599b0a3b2f2f299e7525a51

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000077

MD5 bcb7c7e2499a055f0e2f93203bdb282b
SHA1 d4a23b132e1ca8a6cb4e678d519f6ae00a8aac58
SHA256 f6537e32263e6c49bf59bd6e4952b6bf06c8f09152c5b016365fef70e35856cf
SHA512 89e5e40a465e3786d35e2eba60bdc0fe2e5bd032dd4a9aa128f52e5b4b9e0871c4c4859f5b681c497fe3c9362e24827ed7cdc55515e3da0718f5129dcc82fe40

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000076

MD5 0774a8b7ca338dc1aba5a0ec8f2b9454
SHA1 6baf2c7cc3a03676c10ce872ef9fa1aa4e185901
SHA256 e0fd57c0d9537d9c9884b6a8ad8c1823800d94dcfb6a2cc988780fe65a592fe6
SHA512 a0066b2a6b656e54f7789fea5c4c965b8603d0b1c3d0b5560cfbafd469a4cb5a566c143c336bcbd443bae2648e960aa0e635770e7c94d0cb49c19326f6ca7b69

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000075

MD5 d3907d0ccd03b1134c24d3bcaf05b698
SHA1 d9cfe6b477b49d47b6241b4281f4858d98eaca65
SHA256 f2abf7fbabe298e5823d257e48f5dc2138c6d5e0c210066f76b0067e8eda194f
SHA512 4c5df954bd79ed77ee12a49f0f3194e7dbf2720212b0989dad1bc12e2e3701c3ef045b10d4cd53dc5534f00e83a6a6891297c681a5cb3b33a42640ae4e01bbfd

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000089

MD5 6a72c9902e1260a898e45268802545be
SHA1 7b60fd74af4736cc3923779dd9d61eaf7d0bce9a
SHA256 de3a7d8c14ba43c76e42677bc32816ce784e5ab53ae428eb24b37789cf10117c
SHA512 e73a2fefbe1a7317c62f022d1d24b88d1efe34a74282e5578063edae4c0171b8a05dfa5356761b2b281f30908435429984dcafc06ab461648f8ec0be40a75b7a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008a

MD5 6a0a894109f87d03647bc7d5de9bc1c7
SHA1 f84e5e3cfee7fde472d4801c406046cfb5933a07
SHA256 196ffa5fbb2ebfef5df4237cda3adf5f236a094af1ec6512b4258128ad0709e3
SHA512 212f7a217def49d2fd7f71b419f4846ef65f20fc31c20f0206e2113da451d4280ebc8d8c1132fe9a940b05da6afb6701307f9a6511dc2a6429ea3f6badedabf6

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

MD5 985108305a7ed8a8dd06bf4c1c664f54
SHA1 53f678a9da16aadd6bf258f796e5e1ea6987b76e
SHA256 c38a595936808dcbba02b7a8245e2f98dd21b61f1f0fcd772fb6df9a70f91d22
SHA512 91c0131b8a9f6da657704982247cafa3cf2770cdbd02cec05f1c4ac6214ee4f50902c8b98cb0a3376cec916270fc2a5fe1d70c2b3b8a1b65758bd481461fb267

C:\Users\Admin\Downloads\MBSetup.exe:Zone.Identifier

MD5 fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1 d59fc84cdd5217c6cf74785703655f78da6b582b
SHA256 eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
SHA512 aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

MD5 615c1a611b424c7f42211809f32c1ec0
SHA1 3b9bcea96dee12a2069e5d69fd562f9aec31c2e5
SHA256 f39c27b7fafc78c3201105be4c924a9f09da79ccb26b1d05ff834407da9e844f
SHA512 18f4a203ee5c7616f206ec0063f144d7b24a70e575c9dc40c5375fa10f39f3e25197a526da3a0e727ce470cf82b293477e149ec58751247cbf7cce986ba2d671

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe582258.TMP

MD5 28f64ab8fdcb62b2729bfda4cd363a28
SHA1 d992ae428619596ce8265d56e8a4dbaf5d153e80
SHA256 0bced5bc26f56ad3a0c293e47028ed5b60beee438145ef32bfa7ab4efce3d2fa
SHA512 338eba40b54e89279dd53f60ab23564bba1e6e62b5e1304ce715e762451e6ba80741cb1e21925449ee9b27e992a263f3fb57ed28c96420264be8b4325ad4a4e0

C:\Users\Admin\Downloads\MBSetup.exe

MD5 43dc0bee6e91d28d0e2d2a40664dc5ee
SHA1 206f2b1b32692e684145a9aac41317ea71fd1220
SHA256 09f8b72ebed762dd7c8cee790e339be81ada29db13dd9f46feafd1428c40da98
SHA512 e5a37824f8ade100a754f9ff66403ea046c71fdaba34f33ddf9915194c243ff4fb6a1be53691a32d509d86033d373e6b5f4a7b9913f111852998f4386ebfa7a5

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 b3e1f52f162a8206cdce3e7a4d56cc88
SHA1 0c3b28de15e19fd232ed0b6ce3e08db4f82da80b
SHA256 e4301cfa5c889710c375c2518ae691f6423e257111c8007e436e67ce6bb5c8d1
SHA512 23e020678f184d0ca046affe8932d1e77e208f789bc50b674a2aa7071053f0dfc758c7d5e6bfbf3ad34d54829938b31b0581d2c27585cbc7aa102da4559dbe30

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58466a.TMP

MD5 fc302711b54fdd7d47957adc722fbf54
SHA1 bd7270d5f2d02efbbb9e72bbac0b1e7610f0dc2b
SHA256 efb177f56e3cd2531711f2ea75fd63844517763d499f8629dc746390012f19ab
SHA512 4fb21ba77aebfb6330f81577d66d0b4e245d3bffd30e02ad1998ffa56ac4f544987c03e6d64f9172c614d8b004f17097142cde6fbcb663117ae70dbe7bfc407f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

MD5 5dca9ca490bf281477e936c48e063878
SHA1 5cf889e24eaef27283bf6dac041e93087e90272c
SHA256 2614611c78d16013c13fb96acdb421ead016bdfceeb80a97df403e1f8c15140c
SHA512 8212865a535a680ce0b13f627f3691b63014fd0c68f96f9976c3ba1b3b9e16eeceed3d3231292ccb0db1d8408e1ee4a131166694d38278856e7baf478b3bc6c8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 2d8fffcca0a7c52ef63c48188c2410b4
SHA1 9a720a6ea814fc47b376ed4cf50d18158ca1ba72
SHA256 ae0645c33227334843ce219177469d0e8172c5fa9670264b0c8719baadb5cdeb
SHA512 8da464ba0a6a66440500d8ebdaa5844faf9cbf3acd3c66a75f6a8b907d69cadc23b84768556f026bbf5ed3e8a22134845b8a42cd7105c89301a293b8025702cb

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

MD5 22a3336bcc91d7b88126ec6438ef82f9
SHA1 f0f26e51da67e70eb659e1b7772afbd372e9fbc7
SHA256 f7c3075eadcf88b9ea9eef62aeded3e07e18a87a0075644ee9d44860e46f17d5
SHA512 7900f8cd369e954f68c7b617959e0a8d77a5608b1084170e85b58d900204559c57c86a1bdca7179518e8913370108a482b9e4260f361ae5696e0fbe8b76dc02b

C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe

MD5 c81029e817a7812ff9de07a9460b1936
SHA1 796fe3b557afc10de9dc6a217a39fe151698dcc0
SHA256 62d826fc76a6f192ed7666404416a549794cefcacd35e21c864f65409291ccd9
SHA512 433277ace204e04497df4536e522a97d371ae741e8c02cb20e25cb9c2f29589c6339458444018f6f779ea22fb062f980283451684b1b8e0d2cb96e6fc203f5f9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe587edf.TMP

MD5 e211442c56441aeff9ea5ec807d80dce
SHA1 4747bee9cec22323276b569b4f75179a845032ca
SHA256 0cbe625631e479ecd6dfadfcc4462cc7b8057b2a1aaca798933f3814a7a28cd5
SHA512 0663749d8aba2013c9baa9d6fb2f0495c99e9c6bf5c7171a088aad28062df7ade73bb7394b9ec7d928ee71a651b9bcd65dde5274b805b320f5738034465b917c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

MD5 a1a2ae8698e976c9fe8828bd5c9d45e0
SHA1 f1e544dbe71d10da1cecc0e8b97aaef439754fdc
SHA256 0810793f7d34cc10534103848005b3f228dd5d92cbc292f1b435a0604d797682
SHA512 ec1f43a6280c2828c60ed2846d871a33f4f4561fa523435aaa47cb574b39436640128cd3800fff9406ed2989828588ab0826201227b09f3426d4cb5ffd2c25f4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 d2ecb50b4c6321029faca888269659f8
SHA1 4bf2446b506d7e3f3b52deafd58c96a434a4dbb6
SHA256 d3144a965489fdede815bef6a65e262c7c6bbc67e9b2022b125e1dd8cfdd858e
SHA512 79554c8f1532ccb0fa54959f839593a0d173578d04cac7d77abbaf1828bada12c18113628c5c5a6193b8125ef1396bf2567b7893c71a7e6f7a9db71b6f1fb226

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

MD5 1d4187643935787582ba05321e17cbd6
SHA1 f45500bb39dae81d688b1e4371096df3e64db49f
SHA256 259688641900394e728e4d7de0d26d9ebf530be890ee710c44f731a77cc5171e
SHA512 cacb8fdd0185fe3534821d476a2e1645a482b40653cb15aed882b9ff6c63d0a8987af2d182df889fa55474a3839998ea74b8493c22c8c8316513d378bbfbfeba

C:\Windows\Temp\MBInstallTemp974627e358fc11f09eb8c6f2a85d96c9\7z.dll

MD5 3430e2544637cebf8ba1f509ed5a27b1
SHA1 7e5bd7af223436081601413fb501b8bd20b67a1e
SHA256 bb01c6fbb29590d6d144a9038c2a7736d6925a6dbd31889538af033e03e4f5fa
SHA512 91c4eb3d341a8b30594ee4c08a638c3fb7f3a05248b459bcf07ca9f4c2a185959313a68741bdcec1d76014009875fa7cbfa47217fb45d57df3b9b1c580bc889d

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1488_886068560\manifest.json

MD5 e0909520982fc48e47a6451443b11741
SHA1 0e46425274933c153ebf5a03f25e693267a8cea2
SHA256 2e9e6138305d702f3c9b89d6e9dc4931b548c69bb86db64e585fa2e37b8ef654
SHA512 3fdf504cb0bf39a807fa15a8ec31a6efd8083888692935ec31d70b4ef6eef89b8527c6a75a46bf7ae3efeeaa507ac3c7cccda5246a2f073ac603a7ffa10d20a8

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1488_886068560\LICENSE

MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

C:\Windows\Temp\MBInstallTemp974627e358fc11f09eb8c6f2a85d96c9\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.36\mscordaccore.dll

MD5 3050af9152d6bb255c4b6753821bc32c
SHA1 7a20c030a6473422607661ffa996e34a245b3e2d
SHA256 97468531d7009e36c338b47fb19e0c6bf210f013610f413c852a4cc27e84b514
SHA512 ad07c4b0bb995e80a1718d74992afdeb6c2c4f217e72f361691e2d04dae9be9cd8e55b50fd7172d73755b02b6105c00a3b67534ba9469d92f9e0fbaab8e8f1a9

C:\Windows\Temp\MBInstallTemp974627e358fc11f09eb8c6f2a85d96c9\servicepkg\MBAMService.exe

MD5 146e3f89bf318664fc556097eec62865
SHA1 c2d9a1402c7909de2abfe3e9cc0883f1c9ed7800
SHA256 e661413f899c3f5c792198eafd52ff15273c64675ca048b91b0f69e048ac5ea0
SHA512 1dc57614e1ec78617630e6ecda188b9c9b979cb251821ba1201a52187bd2d87ffc8c8bb3f7b6edb44ac2f7771abe2d3bdf21bccf3c50cc1332d92c260de69de6

C:\Windows\Temp\MBInstallTemp974627e358fc11f09eb8c6f2a85d96c9\ctlrpkg\Malwarebytes_Assistant.runtimeconfig.json

MD5 d94cf983fba9ab1bb8a6cb3ad4a48f50
SHA1 04855d8b7a76b7ec74633043ef9986d4500ca63c
SHA256 1eca0f0c70070aa83bb609e4b749b26dcb4409784326032726394722224a098a
SHA512 09a9667d4f4622817116c8bc27d3d481d5d160380a2e19b8944bdd1271a83f718415ce5e6d66e82e36819e575ec1b55f19c45213e0013b877b8d61e6feb9d998

C:\Windows\Temp\MBInstallTemp974627e358fc11f09eb8c6f2a85d96c9\dbclspkg\MBAMCoreV5.dll

MD5 48176305c4c9c09b0cd416dfbe4595e7
SHA1 ee3017b3e1a2423cbde0c2ffb72ebcd5a47742a3
SHA256 ae48d10f8af483c5c7a1035cca83a815adf5cd24f5ff9f5bf37b178ffbc824b8
SHA512 10aeccf58eddc4679aef0939dea010a028176c1310a5593600f887c3fc7d9718a6ad52eff920f96c0797a53f1303d5cd50ac5ff1d1a3ab8babb61d82c8a5246f

C:\Windows\Temp\MBInstallTemp974627e358fc11f09eb8c6f2a85d96c9\servicepkg\mbamelam.inf

MD5 5d8c05cc4f9b4304d57ea10b87f2dcf0
SHA1 2cabe3d39aa5ec16c54c7818284a2ee235d2ddbd
SHA256 e26c2d3347e5f077da92713c9df3cd3eae438fb7e29810bd5c3afe567d2d3125
SHA512 55bff23fee9852f229246b71721b3659c916079787935d400a97641449dfda752fc8fbf36f9ea3dc4028f05daeb9006a99660284a61aa5d5a466af0ee966c738

C:\Windows\Temp\MBInstallTemp974627e358fc11f09eb8c6f2a85d96c9\servicepkg\mbamelam.cat

MD5 bd4ceae54af081d6b1dd91ff584c5d61
SHA1 5ade462d66e042da58bb1447d1b31f1aad901b68
SHA256 64416d564725416c6869ea951878a2734b1f6940b11f7961a897c45f0d8c6625
SHA512 37e7abd312f694ee2c8ea54ecf50ed12c16684f1007c61d9a6d1d01cba958be511c5e4e11cd7393a5cd57349fda1c552bebca42962137e0d11695c195761ebb0

C:\Windows\Temp\MBInstallTemp974627e358fc11f09eb8c6f2a85d96c9\servicepkg\mbamelam.sys

MD5 8da81aa1f6b89ce1d2e216e3ea351c59
SHA1 4baf79cbade9a5584630a540e6368d547579fb12
SHA256 ded569e249e590314d095f740c6b8934a5a797e4f3edbe0f78eac9d333f12a2a
SHA512 6d611bbd9d480ef2defd745fd06c4ab86e181267cf689d9d0e124edbaf22fd30fbe2310879cc7bb6dde5bae72c4feea1d329cdecfbf101d95634f85dd0769119

C:\Program Files\Malwarebytes\Anti-Malware\srvversion.dat

MD5 0f3424c6eaa7c9cdffeee6e889207745
SHA1 dfbb6b2a66321a58d42ba80093626eb6b94091a5
SHA256 9138e494a5722b302415b9c7c96ff733dbc73de9252eac0630eea445b87bac7f
SHA512 29c694945586d4bffa43c49cef3c67d86054825d80ae8a643aa4d0171deba24de6ce097001722e5d24928dc14f24a5d40fb00f31362f15a036ea9b861982a920

C:\Program Files\Malwarebytes\Anti-Malware\version.dat

MD5 30a382cf6e3648fa57db13367ab0b083
SHA1 ec324cc279dd51ed39064b7616a3acbc7e7ddee1
SHA256 f25cdc8364bcc05146116ccc271cc2594af5c8ee8c935ec4f57e2854fbb9d565
SHA512 2be00fa2993a153a7b563c38476ecd2056e079504b27e4898cd41c98f9283f0e5ea66d9f678874e6d5a53c24025f37c2051b023583da6a00c9a92b69c6d73add

C:\Program Files\Malwarebytes\Anti-Malware\ctlrvers.dat

MD5 755abb3f76f49f90ee1de815b3b52111
SHA1 4e6cb5881c6adfcef9f33393a9a0f54b23670db0
SHA256 601e29ba551f05ae6e290dd32077030e93e9aa26a9d9c6b0fc08b19e65fba71a
SHA512 caa16034c067cc68be0f7b20f31c0e8a1172c71aa780796454acb3f8afabd89eacded830085d3a4314ddd426e88d664b34ff4be747dfe8a6d712a45430c252f6

C:\Windows\Temp\MBInstallTemp974627e358fc11f09eb8c6f2a85d96c9\ctlrpkg\mbae64.sys

MD5 95515708f41a7e283d6725506f56f6f2
SHA1 9afc20a19db3d2a75b6915d8d9af602c5218735e
SHA256 321058a27d7462e55e39d253ad5d8b19a9acf754666400f82fe0542f33e733c6
SHA512 d9230901adeecb13b1f92287abe9317cdac458348885b96ef6500960793a7586c76ae374df053be948a35b44abe934aa853975a6ccd3788f93909903cc718c08

C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe

MD5 a80ac5d8cd6fe7a2163a8ea1e02f1a21
SHA1 dd514fc8b861e3f58712350759401b53e7f72f31
SHA256 d627a2eea7f79567e7d67c32dc07a784f1580702ad4681eaaff00cd22f09fdd6
SHA512 c91f1da039e366906764806185b50ec1e1f459cf805892bad1a2482f79bdb339258ee125baf4784bef740af21716955f9dad29c9640a31f55f983f5d3975f093

C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.json

MD5 81b69cca5f367024327e1d3b95e62045
SHA1 504b976b1575422b80b6cdff3531467074009512
SHA256 f96c63040216b66226c5b10f7592e60f5b940ebc8b69547265da8aac2558108e
SHA512 7389e1865c36809a296d08fbb0e9601d3e44dcba05052da68fcb72d8f552723200ba37fdbbd5aa14418519c7586987d071da54143cb70adccf239395e83c1be7

C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe

MD5 e04e61828c9fffcee59cd90ef155c90f
SHA1 7a97b65f11d2b3f30d8e2dde4c44bdf16f3d3b24
SHA256 05d4d87f43646f7ca2e50520d8850e8808748a508c2761838d5fb92d66d6ce35
SHA512 04792b998628cde88bc2601534678e55b2d6fde290496e5af08a2955a992ca3bb767bd025dca4373abc55141de8d270f62f628e51c887de54035bbee10379ce9

C:\Program Files\Malwarebytes\Anti-Malware\mbtun.dll

MD5 2bbf63f1dab335f5caf431dbd4f38494
SHA1 90f1d818ac8a4881bf770c1ff474f35cdaa4fcd0
SHA256 f21a980316bd4c57c70e00840ab76d9ad412092d7d2d6a2cff4f1311f7c05364
SHA512 ebb9834323329dc01ba2c87e5fad1083a4cb86f5ed761cb63299ac5336a9843a1aadd42fbed706797c2295117af1c00f96806422338352653c8e0255fecc2fd5

C:\Program Files\Malwarebytes\Anti-Malware\mbtun\mbtun.inf

MD5 5d1917024b228efbeab3c696e663873e
SHA1 cec5e88c2481d323ec366c18024d61a117f01b21
SHA256 4a350fc20834a579c5a58352b7a3aa02a454abbbd9eecd3cd6d2a14864a49cd8
SHA512 14b345f03284b8c1d97219e3dd1a3910c1e453f93f51753f417e643f50922e55c0e23aab1d437300e6c196c7017d7b7538de4850df74b3599e90f3941b40ab4a

C:\PROGRA~1\MALWAR~1\ANTI-M~1\mbtun\mbtun.cat

MD5 8abff1fbf08d70c1681a9b20384dbbf9
SHA1 c9762e121e4f8a7ad931eee58ee60c8e9fc3ecb6
SHA256 9ceb410494b95397ec1f8fa505d071672bf61f81cc596b8eccd167a77893c658
SHA512 37998e0aee93ff47fe5b1636fce755966debe417a790e1aebd7674c86c1583feef04648a7bc79e4dedaabb731051f4f803932ac49ea0be05776c0f4d218b076f

C:\PROGRA~1\MALWAR~1\ANTI-M~1\mbtun\mbtun.sys

MD5 83d4fba999eb8b34047c38fabef60243
SHA1 25731b57e9968282610f337bc6d769aa26af4938
SHA256 6903e60784b9fa5d8b417f93f19665c59946a4de099bd1011ab36271b267261c
SHA512 47faab5fff3e3e2d2aea0a425444aa2e215f1d5bf97edee2a3bb773468e1092919036bcd5002357594b62519bf3a8980749d8d0f6402de0e73c2125d26e78f1e

C:\Windows\System32\CatRoot2\dberr.txt

MD5 2d8f2e5b92233edd4ccf8b5b1c4ab7bb
SHA1 818d9424b6327504601b51940858f1bcdc900735
SHA256 32fdb886c287708de9ca198ea82e67c3261449b47831dbc1b2fb7d040c92ca37
SHA512 2ee9b3b18c01d9ff8c09047717459cf28cde24e67405e4d53738121f1781f3a4ad08e49a40a93e592ab0058fafb17699806962ab0dc9da02cf792e442e5e6a4a

C:\Program Files\Malwarebytes\Anti-Malware\offreg.dll

MD5 2ccb84bed084f27ca22bdd1e170a6851
SHA1 16608b35c136813bb565fe9c916cb7b01f0b20af
SHA256 a538caf4ac94708ddb4240d38b1b99914ca3e82283f0d8a2290be28fc05eaccb
SHA512 0fd66d241bdebd0052f4972e85b42639e3c5a40affe23170b84bc4068dff8e84446898a77ebf7cc0bef97454abb788faccce508a68bc5e717980ef26d8436986

C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\PoliciesControllerImpl.dll

MD5 18641c1028572ac38861472767bbd51c
SHA1 a23e7b0403799ab88e83d653e17b98b1a9ad2adc
SHA256 2630ff28ce0009638f1af8a8a603946b585e985f64fcf159ede3c81c2eba7d90
SHA512 cda2372d9a8e09786b30cf27b480c840bf752a149b5cfe9e1c11160447eb0e9ef3d8e67c253c633b6d36d23102d7ed07b5b1c27f87dc06371f1267e50d643501

C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll

MD5 6e3bb32d3350e4438bf47220b65b319e
SHA1 a113d724edf80282abb958116cc486574f0d3639
SHA256 045548918d1dc7cf58ab3022a30918b8fd40382b193cde5e1e4b360df2a0fbb0
SHA512 8eed12b08d11af06334f624435ef817ed031fb9dc854e35f9079960ed7083f372d82b6b8b27fd9164b3038ccf6bd2e7304d77a722341452675e6c7fcf1836659

C:\ProgramData\Malwarebytes\MBAMService\config\PoliciesConfig.json

MD5 848b05e3f78d45849248c60b446ddef7
SHA1 6a1ba98f6c1a1f9ca3595703928f950d32fce8b8
SHA256 9d13e8cc73526883aa8076e0ebd9f764a9629340c63e58b41cc1981fa7a7db49
SHA512 528819b15462bac334cd3319a90923502bd11e372b59b66c3dec9cad0ad653b8b374be758152047ed1cda9ec80821a45fbd6f876d885e1836f3183fa91154547

C:\Windows\Temp\mb_D627.tmp

MD5 b478a8fcf9835ff33c6602add97bce78
SHA1 d28268d0bfd98be18526d64367ab0fd6e920fc34
SHA256 620224a7442ad2bb00d817bc3d14c837405cb736f939467119b9d13b813065f6
SHA512 72518ad4e828065f709a446409fcaa52a9c1ad48b5dc15d430ca643c7e6a79ee6006abd212ee839df269149f4af0d69b26f0e19a1ff41a75cbc41266f8ceacfb

C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\LicenseControllerImpl.dll

MD5 fdd046da9d395052a74cba975e58a29c
SHA1 359a47e9e8ab682539211025e95dcd49834bcf1e
SHA256 8ca449b57df9b70ebac3aba5993d0b7ee4edb2c24f534229a14add96209e9c69
SHA512 de02e6d461630c2707f84676a5f707c4e19e6c10c5c9851c8fcfb68b8d21f19c7eb1fe85bc667fab8c996b7d5242fff547f3a552452ca6d545117ae1f4c84290

C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json

MD5 d8e27a043e9bb6ee69be79f3fcc9961d
SHA1 fc6207a12765bc145d525b4c5524e75ce0fc3ec2
SHA256 ae1754c2ca36a51e7cc32723b52faa749d898d3fc9b12c9fa9b2f8dfc83a2029
SHA512 17b213c155e3beb808d3101688c78eacd28133d0146886eda8bd363c8ab77e5c60e55e845783bf6a2e9e07b572071520114ec71bf7039f231eb91fa4f5939613

C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\UpdateControllerImpl.dll

MD5 4fe0bec13b02be1587dcd00e62b14849
SHA1 20cce46db5cee5b892e0fd02c44a59b5da2678c3
SHA256 154e96500600eee8ec0a011ee95ebb7eaf4b977056a757429c126ad05f8862f3
SHA512 e77c63e7f867645d73577b9df6b7442d41160aef5561cf4711e90333bdccc6f08f89d47aa52e43865502b4b8b70d37715eefb0d311a6e14c24d690d21bc71644

C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\pkgvers.dat

MD5 c40a33de6c551fff77107c5fa910aef4
SHA1 28c290dfbc8a2e2b5197a72ebf892dfe4b3d62c7
SHA256 0505bbbc4a4f973e03d80c40a35122755dc99879fb053e13ce426163518ba627
SHA512 e9a204cf54744fbbf61f7a9ccbd387e7e8504e411e26b1c2a44367dca24d40404e217911c1bd211c34cee6b28732aa3042f42024833194247c6e1ab29ae40b1e

C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json.bak

MD5 5edb8ae7e0a216d403b301efba07c3d8
SHA1 8daea3fe1972021c6802fadf605b7a1b98356fd4
SHA256 b1b5ce3e7395fe8ba7b903e93ca10ffab798f9c62bb48ab4f6dc263b59fad4a4
SHA512 deadd7b9c7e344411a273155fe18518084b3f56e18579ddc5f8b54e01ff4da115bf56e41531b66c3fb33e02982a09ea552b7c421eeccd4cda365af6e14003baf

C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json.bak

MD5 0bb48fae2370eee47d703f68811e9c13
SHA1 a7698e966407db8a67c3004521887e20d7e1cc57
SHA256 8f00eed0f8957b1e5eed2274363c4a16c5e319d7ff5e13ae629bde20d1f83027
SHA512 74ccd2cd94a6d37481f57919ab1e00050f32f896980ccf5d2bffeb3af082a15ef2d7dd494804d8ca6ded6d654a7b963cae5751edfc1e53e9bdcce19e1de989e1

C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json.bak

MD5 01c025e855fe3df0b84289838042bcce
SHA1 74cfb7857c599f6bc1aee34b9292ff97f70dbe76
SHA256 d8e6d6a0d556e7fe3ceeee50b252a1914871a51309c2d0f7798806c693f43b2f
SHA512 c5b51d525bc24f0a8eab4f5cc22e58c0e859a0a84d76485fa751c233c67fa5c9793d4624bbde878a47a3bb32879db4dc1b020700fae18f80b5a16080104167ba

C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json.bak

MD5 64dba6f07f984a206670701559f6d256
SHA1 f2101da4459ca05c3eac6d36ee982ea08a9c918e
SHA256 340906a47315ff7c572b02a484de7fdf079da87d4e22c6662dbdd11634bdcac4
SHA512 5a99a12fb49ac17f4221aca160972f5f789e5fc42a412d363213cf2530978fec9a129525087e54aa54360dfeb9a098c775fe8e188cc57c7021db6bcab6edc5f7

C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json.bak

MD5 ca848a0181191d6ce1327181fad534b3
SHA1 36d401ec925ea29a98c48a3b6a75e8728df8506b
SHA256 83fddd9c2b2050d26d7117f84acb4f869d116a7b82ae8df7c52d1e91e9ac6d50
SHA512 1c1d387235c6bed7979ee73b9f34ff01d8da4fe83074c3f9cd576fd3d6f2ae856ec2650b036880b0740143671c331d7954040f0b8fe704bb8186257b4c73f283

C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json.bak

MD5 822b05940d4494ca1703292fceeb75c7
SHA1 66fc602cbdc205e96ba3968f6164178e8e4133ea
SHA256 40a92f9ae65359d3c7e0eb820ceb346abf25783becd7f251648592c22b1bc2e6
SHA512 498f6e4c1c74b448936a5c918632061b96453a0845c560a4e6446ecfcb4faca856d14bc2cd3bae41f05254e73e11ee948e1bb211276d1313609fbd38988fb501

C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json

MD5 5fe95e6613d4bc69520473f7ba5020f3
SHA1 efb439ee38ad4220e9a5af0a6626dbad58ed94f9
SHA256 3100cb0fad9d68925c28a0809a7d365fc2d87fbe3c1cf5ac635907aab4353589
SHA512 5283a919c8c77a173bcf687d3d3f2ca29ba99ecee7dc67652d1e981de5c2acc524b0995358531d4b31addf4c4c10cf38fc9e65511bd863e3be31419b248039ad

C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\dbmanifest2.dat

MD5 3cdbcf64ea6ead8da5e1d1e95f9d107e
SHA1 eea11de1e7a3d12d9a82e91ba06edad2e4ff9e76
SHA256 2783ce11c1d21cbd6c935df2c55403b9ca758a3e452a921b5ac8d27bb40e6235
SHA512 213768cd1b025de74e4fe108925316e6855aa4b55fa5dbea849ddef16159ae13a348298fc812ed3e15c4c537f662a9db21a93d3822bdd102f5901f4b5228e33a

C:\ProgramData\Malwarebytes\MBAMService\lkg_db\rdefs.mbdb

MD5 2f7423ca7c6a0f1339980f3c8c7de9f8
SHA1 102c77faa28885354cfe6725d987bc23bc7108ba
SHA256 850a4ea37a0fd6f68bf95422d502b2d1257264eb90cc38c0a3b1b95aa375be55
SHA512 e922ac8a7a2cde6d387f8698207cf5efbd45b646986a090e3549d97a7d552dd74179bd7ac20b7d246ca49d340c4c168982c65b4749df760857810b2358e7eb69

C:\ProgramData\Malwarebytes\MBAMService\lkg_db\prot.mbdb

MD5 546d9e30eadad8b22f5b3ffa875144bf
SHA1 3b323ffef009bfe0662c2bd30bb06af6dfc68e4d
SHA256 6089fbf0c0c1413f62e91dc9497bedc6d8a271e9dc761e20adc0dccf6f4a0c1f
SHA512 3478f5dcf7af549dd6fe48ad714604200de84a90120b16a32233b6d44fa7240f5f4e5fe803f54b86bbdfd10fa1bfdd88fb85eb6a78e23e426933f98d0a2565ec

C:\ProgramData\Malwarebytes\MBAMService\lkg_db\rules.mbdb

MD5 0b1515c15f143d50a704ecf59c041d90
SHA1 c0277c30fc2332c10c57c9011f8d6f35ee7b8f96
SHA256 d0cac9abb928a625525979da1b2c6580fa9eac5ce997611c997b357395beb89a
SHA512 fffcea5ea2e4f601f790e4ac8ccd0491acb20a553e6e7afa2903b089ad0fda8d26488749c6c87ebff251a3d6919f76800c12091328ec9291c6b603b439a52fe1

C:\ProgramData\Malwarebytes\MBAMService\lkg_db\tids.mbdb

MD5 ca732ddf5a3d3d6620b611ca1308af1e
SHA1 ac0b531c7f528736d7b899639c77d3126c035ed6
SHA256 d1754fedca9243fa0bd1b5e3291cde20c60c19814e26f1ab95c1ebb482474b4f
SHA512 c56ac37debf72b20a208d82e9a58b69c5d3ba379d819a1b0e86630b86de095bb1a34eeb17bef7f1194f3847951f27763ded8072aac0c765c09945cf918fd3bc3

C:\ProgramData\Malwarebytes\MBAMService\lkg_db\scan.mbdb

MD5 461e286d631e800fcecddab8711d9785
SHA1 619c88a9ea87d4d04f15971fec070cdd2767bb70
SHA256 924f0b4b8d27b10768173caf87f1faeee989ee15a815c75533f078b854cf3e61
SHA512 df00cf605c40a8c80b222442fb077bc1d7e6b3e98488bc3989137877972d7bfedbfcc3f1f8d7ab36a92cb7178ee1583b27f5a5d9f7c1827c45d4f3a6bbae00d3

C:\ProgramData\Malwarebytes\MBAMService\lkg_db\wprot2.mbdb

MD5 ea4aba1b118dcc96ef2dc89a2eb9d0ef
SHA1 6f32be9460ec2074c39c294a7a3541e72582e376
SHA256 040a9d8bf17e37bddd5f5d12b9f3e2c42321fa89efe107ece960f4b3ccdc2c94
SHA512 d740625602fa5338699dc79df206a277569c9ecd7b875ef41cb83296f1c8277081c3cf3575bb43c06ec054c3f8c97adc1bc229813878f9b3828bee337f418f5a

C:\ProgramData\Malwarebytes\MBAMService\lkg_db\clean.mbdb

MD5 221615eaffb1bd168fa868e63bdbf171
SHA1 3e783710dd6c659c0dc4f1372771f25e794987e6
SHA256 ecdfd364cef1cd09919dadf824f00d9cf3bf7fcb874472655d89f30321b19c4c
SHA512 06f5689c4b10ae467edcc4f494a1697aa646bbc1dd69f920ef1aa1d7de76ed8831623a133a4249d50c44de3c3e47427ea61a7491842cb014d7c621a113bbfc24

C:\ProgramData\Malwarebytes\MBAMService\lkg_db\cfg.bin

MD5 a9ffdb4a6e4249032d1eca20ca7a174d
SHA1 fdf353bd6300444a7190584a0773cbe42e6b18f2
SHA256 2197a0fb87f14228f6100c05de73e7940f0694ff87907ff2f91003f388080e02
SHA512 8bed00085a9ebec6d529421586008742e891f9476d4e13aaf9f142e361dde40b3a4859451c7c0bb34b568c12ce9a230c069821f0179f586c3e1e34e4762be3eb

C:\ProgramData\Malwarebytes\MBAMService\lkg_db\Global.nm

MD5 58ba20addf3f031f0f5c367876c5c1ff
SHA1 ee1571ff3e039a6feed683c301046ed33b34fab9
SHA256 906c99710ac9318ab77882a04c05ae8cfc8c8b578a15cb4053f69bfa6076c84d
SHA512 fe94b7992dcfe0d91434281aa7bd15e20e19095cbfad4dca62fa01ac82e529e042c328ac848b244195a6b8b9240cd6953832bbed1528657ae33e40ad083fd23f

C:\ProgramData\Malwarebytes\MBAMService\lkg_db\Global.sr

MD5 8b9113fb2eefc28703738421e25a361f
SHA1 8c52eeffd8a1be3b9ca31203fb9369685f69fa7a
SHA256 4c84ff332276af77a9e3b5f44b02c665ef99ec3bbf4bb425f99e78c5a18283e9
SHA512 e0a4918aa9aaaea06763c5f4afba5dbc62609ccab762f30f95937d4a136b30c5987ae7d92d222100c04968a4b443c33ed6053eee5ac935cb73923c6e131b8fe6

C:\ProgramData\Malwarebytes\MBAMService\lkg_db\Actions.dll

MD5 f802ae578c7837e45a8bbdca7e957496
SHA1 38754970ba2ef287b6fdf79827795b947a9b6b4d
SHA256 5582e488d79a39cb9309ae47a5aa5ecc5a1ea0c238b2b2d06c86232d6ce5547b
SHA512 9b097abeafe0d59ed9650f18e877b408eda63c7ec7c28741498f142b10000b2ea5d5f393361886ba98359169195f2aceeee45ff752aa3c334d0b0cc8b6811395

C:\ProgramData\Malwarebytes\MBAMService\lkg_db\dynconfig.dat

MD5 10f23e7c8c791b91c86cd966d67b7bc7
SHA1 3f596093b2bc33f7a2554818f8e41adbbd101961
SHA256 008254ca1f4d6415da89d01a4292911de6135b42833156720a841a22685765dc
SHA512 2d1b21371ada038323be412945994d030ee8a9007db072484724616c8597c6998a560bc28886ebf89e2c8919fb70d76c98338d88832351823027491c98d48118

C:\ProgramData\Malwarebytes\MBAMService\lkg_db\exclusions.txt

MD5 aef4eca7ee01bb1a146751c4d0510d2d
SHA1 5cf2273da41147126e5e1eabd3182f19304eea25
SHA256 9e87e4c9da3337c63b7f0e6ed0eb71696121c74e18a5da577215e18097715e2f
SHA512 d31d21e37b0048050b19600f8904354cff3f3ec8291c5a7a54267e14af9fb88dfb6d11e74a037cc0369ade8a8fb9b753861f3b3fb2219563e8ec359f66c042db

C:\ProgramData\Malwarebytes\MBAMService\lkg_db\mbdigsig2.dat

MD5 8903fbbd3eba8ccf3bce8638cf968a91
SHA1 b82589dfeeec713ba9e968885ef969fc83714786
SHA256 090193ae3c7d742a5201961d937bf5b8820404d1683443fe8b7f65fb9bd6db87
SHA512 fbada3f6c6ab7d1c3ffef3058007747e80c2da3154753dc4d4964c6885709b0fe6b2ca909a0757eed766e3ef62f4c8d3314c83dc465dde811ad8cda34a9fd62d

C:\ProgramData\Malwarebytes\MBAMService\lkg_db\ig.exe

MD5 974e7d396ee57c31500a959f87b4c1c7
SHA1 2bf6f9283053b2ca67890e18750f653a2b6a724d
SHA256 672abcf78608ccc77baf6170daa49160903baf15ebdb04cf4bbc8cc916637735
SHA512 616ee561576c1bbb0a944fd34ff65232c8acf1b3c6fe41356a9158445994430503b91439b02042810833887eb91b6417fa34d0819f3eb2680f68b9dd210665fb

C:\ProgramData\Malwarebytes\MBAMService\lkg_db\sample.dll

MD5 60c9b632f13990ff5fb9ddeeae3644a8
SHA1 4daf3300db713890453d7cf906841dc0e190a92f
SHA256 7a603a228fba7494ac05d95a44759936a8c61cf26410700f6c14bcb774bbfee2
SHA512 727a6f7283b07f6a0cd51cabff17c4fb0bbd268c6af5a044814c8f1974bd84ab0d06b39bda7bc460d919a189ca9eef314d2e89698c663d7b17ec16419f9ae2c4

C:\ProgramData\Malwarebytes\MBAMService\lkg_db\BrowserSDKDLL.dll

MD5 956b145931bec84ebc422b5d1d333c49
SHA1 9264cc2ae8c856f84f1d0888f67aea01cdc3e056
SHA256 c726b443321a75311e22b53417556d60aa479bbd11deb2308f38b5ad6542d8d3
SHA512 fb9632e708cdae81f4b8c0e39fed2309ef810ca3e7e1045cf51e358d7fdb5f77d4888e95bdd627bfa525a8014f4bd6e1fbc74a7d50e6a91a970021bf1491c57c

C:\ProgramData\Malwarebytes\MBAMService\config\CloudConfig.json

MD5 29b7a4eebc7af190fa081c84e08a06e4
SHA1 871a6d70fa28f6a90ad8ffe4d21be315a0dfc72e
SHA256 455044c064a104ea5003c6c680bd685f0ad2bcc15f1b4fe61a6744c14d708682
SHA512 9d0b1bf9a6b3642f1ef1aac4dccb3a18edf064cf8a5a2d5496e72ba7dab1bbea43841aed9f79db604f194a1fded5b5fdadc574f50ee986bde0faab49b0bd4974

C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json

MD5 8ed6d81aa4c6dc3a51c72aade7f568eb
SHA1 cdf823b06ea260d7e62e8f9fc60ec9e99d9d8575
SHA256 483c6725b4e3a41f50edb60111c6a518c855c9f7c2f504ca1f6133b88a609c2c
SHA512 46806a2c7815b3c35868b33c71e88bffedbc6be6b1e64fecd50404fea2884dd39a8e9c38fa6664e201a07e9855dcbdcceeb218edf286ab6f31a2a0ced178e932

C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json

MD5 2fefde08a0b4cf190bdd77516e791f0c
SHA1 b14da25a25abf81e79345fbf737eabaeb647fb70
SHA256 02df94beb64b6cd2e8387bd950aa4be68b6c374462ec710d39a376e40c19bbf8
SHA512 d4b8363109172b35a6decbd16a767865825febd4a00e6434feea53f398da1d996d247f27a4c497946b396b979494d1ad4cbb4b6072204eaa93ad6a5680548d95

C:\ProgramData\Malwarebytes\MBAMService\config\CleanControllerConfig.json

MD5 aea2987337f3d6d6f83f58eb76995ee4
SHA1 900a1deeed2070b68feec5f826b0e89654a92328
SHA256 bdbe8e966fb8a1c6cfe260313ab8139f45bbe70905c3ed17bb38062d1086e5cc
SHA512 b8ba8f6ba2f9c5e304ca9fee0cce31445e7f5896b2aa5fd24cc68c9c283c7e28cd4252c760889cadb953a048f355691e98b35a237d20ef0cf973c686a18ad3f2

C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json

MD5 eedd59efbb0c090deab258f18ce8f4a7
SHA1 23294b396465f0f01ee5749406938393c42d9559
SHA256 9c42483bb5c1352bee3afee87c879f47b6beded7eb0fc7d18ca93da8cede8f84
SHA512 d0d026b4665dc1891b8b149acde563b5c1e765e8b6c953582e01726429f9c6d874345e8680b013cf7796fdce6b9d985a38862e9f6dd3731763b5489d4b5637da

C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json

MD5 413c9640e0af281a34709dcb5e0910a9
SHA1 28653730a4ac88a6b1320d6437e2fa6f61643e70
SHA256 a44bb522e72e9113447f97832559c79d86d93d8dd7a32099fae943220366143b
SHA512 df48fe7a7a7a2dda6b1926a21112e5283fc6763a2f78ea0572f50d771aeaff460dbefca67ef9744adaea54e099532db152444997653b8441156655727375b9ff

C:\Windows\System32\drivers\mbamswissarmy.sys

MD5 9d1296e9af8ad4ce9b8f161bbe2185f9
SHA1 8f2fa73c857cb53bfe5d35281be06bf11a45efaa
SHA256 59232d92bc9488780dd4350e502c652b3c15d7c19ecda5fdc863968518cc0002
SHA512 65517117dc05e9469cf4935cb8b8e727074fcc3d72c0a771976c4e8f9f1273df6497e058472872aab31051ec088cb31a9d38307149606c33dd93268e9df3646a

C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json

MD5 be1111b535b86745c08abb51bffb356e
SHA1 5a617e0b4e3e6e1915f23e45430532217e649187
SHA256 89b8fed091c5015f1c6606f007fac279b19e5616c98b6c98b275f43a8fd1dea8
SHA512 24e0dffeeb79afd5467941990c7ff1f97e97685522e49a7a4cb1f39adbb284166cf63c9a96c63816852563bb1209bbfabaa86ff3513eeea9b9987f77ddc5f2e5

C:\ProgramData\Malwarebytes\MBAMService\config\RtpConfig.json

MD5 b33e27eb26cb344dca178f42c42052f5
SHA1 d1d0ae5c56b438bd6dd58347a4c558cfeea37f1b
SHA256 8d5c2a7a0d1d9a02546bbef018d0ab5af45fa3dfc244edfbacc3f6404f3c0782
SHA512 6c8ed84af864048f225ba7fdae913f8395cf6e21b8f42698ca69188017356d1db34364516aead6d9e508727b3c65a46058fee2e5848482dc4fb923ddaabe025a

C:\ProgramData\Malwarebytes\MBAMService\config\MwacControllerConfig.json

MD5 85665a35ff4c7c4d642039c7aa7628c0
SHA1 9f957c1039d02d5582d3ee4d866cd7145c9efd39
SHA256 fc45825d199cefb00a2704ca6bf2bf7e8adfb7f1df355548e7a6ace6ff259dc9
SHA512 a0e3c7e57d721f5f8c49269fda33d81adab5e94e413e319abb018c860cd1b223f6ad0c38949539891072233d49d407f426613280929f76b6580bc3ea87f9ed52

C:\ProgramData\Malwarebytes\MBAMService\config\MwacControllerConfig.json

MD5 cb1eec16bb70d014997accf6f1347bc4
SHA1 a212ee689904d6555c814f18998e749b83dc2779
SHA256 94d958a3ef012e37ccbe7911ee6ed846da45c407a0f5636c1cce60aa1e2bf07e
SHA512 028736931bf2b384e7561f86a873780687722ee956015f1c65b7b3d6de561b0572ae80495b41b2326f41e6519ddc1bb43701ffb16f06e8b6dbb857bf1c8d4cad

C:\ProgramData\Malwarebytes\MBAMService\config\ArwControllerConfig.json

MD5 de084cd1eb348d26a9bca6be0942fece
SHA1 877bfe35ef131fc4f3fcefa9fae66762f746d39c
SHA256 c8c44c21c9a65b07573d31def087b70c34f05fb73b3ee581175e7300fbad9477
SHA512 c4b6fb8ff1d60adb8dc042eeff7f69566394c75a9f1783778832155379d31b9ab411b70821d735c41b0abf9eba8d4a9d577ca91b93703acd3ff2ed120cd61f48

C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json

MD5 5c28dbb28b4fe678bdba2e38bc65525c
SHA1 a5a98eaef6e1cb44a2c4f7edb4fa2980b826d199
SHA256 51cdb252f68ef74e39ea66d80b19bc7082b40386b8f784caa68185747aab58d5
SHA512 956715c382537caa32baf34f74f7f207fb1e2e0e250f9049427e268088cf0800f734bbdcccbf0b7d92b8889d7d9fbcca9004a3efb08fbda6c5e0eb863c11781a

C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json

MD5 2c440a73914e565a4ca6f073d5cf13f0
SHA1 e9d2ab0c791653ad16047376679965c7af06e9a8
SHA256 c66111bfeb3c965f3483279617d591825ab3b32fc4af357d81d2fa5ceddba0c1
SHA512 eec4187cb7593b84bd165296d84fe51e7dbd528f7a35605d8f0c984b5306aa7597494ed40c71d1a396b2b0c61dc7023673774f405b721e437ca3d9312f76a5b9

C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json

MD5 06ad00d3179ccd37afad41a857452262
SHA1 3e1bc4b118585a468d22ef3427160a64dba4172f
SHA256 2a7d1e62f22724ee4804a9b60f98dc02d024fd4231debc6be2713320c5468d5c
SHA512 dd4864e1759592660951b1646d907b3bc5e71fba96c4212aa9a68ae99ec7e20c141b44d1849c09473d3b3ac9e3e71b11343f7628bf8dc5214d2106e18bc01457

C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json

MD5 75ba3c1099cfd59fcb1d4ff5b54bc83d
SHA1 56a10ae18cae48898c9d225545faa10ee7f2c44b
SHA256 f01f221cfd675cf4dea82e085f800a07348b5209bb7ae7c40d99394c2521b245
SHA512 b912b07dfbd997131ecc307ab00e4bbed9c23f214ccd2ca7f99ecfcd2c6dfd86208a0362d97af645929c982241f08fba2ddb4c66d30a460e30dca598282186e4

C:\ProgramData\Malwarebytes\MBAMService\config\SpConfigFile.json

MD5 77b3638e32fbcdd9f0b40842876022cf
SHA1 7c5e29b07bf1f2bfd0cc6304ac053cc820f4333f
SHA256 d8549cc786aeb1e4dd9325a2eb39670f5ecd5b5da58ec0f3b152e7f7d57687e1
SHA512 64faaea1d335d02caf78a062f90f71b5642fcb2772bb5a3a9a737ed1da05b5d0146c1e8c7e1aac8fd77ae77442ce89243754cc7bc91445d0fcd51204df9e632b

C:\ProgramData\Malwarebytes\MBAMService\config\VPNControllerConfig.json

MD5 b43078c6850904b937eb54e5b27f3791
SHA1 fcebaf0b0a240823e825d4cbaace8ed23a443c2a
SHA256 8c736bf434dd70fbe6f5d6cadca3ff3e2de5eb8ab90f8efb5d6e198bfb99071b
SHA512 1af409cdabea67048764b0ebb3ed9f4779d89952247defa5804313b8105a5575623f0c2a36cf4acc16504c5444806882bac84fe272d60ed0c31cf2f8cd248e9a

C:\ProgramData\Malwarebytes\MBAMService\config\VPNServerListConfig.json

MD5 24fb1dba02f769dd3bab9dfe33dd7445
SHA1 c720ab5a0e8b3e62e02667668a585b2f6c16839f
SHA256 7a2ea8e3529bf32898e0e7a0aec1e19ee6942422171301141f69a6fd3a292a9a
SHA512 6f99d76259594448eef0766f407545ae7664e024d15fa95cee0acbdbaa0a60f1379b6f35ccada5284aa1ceced51a736242db9ad1ed0a01d4e50eadeefd5a2c31

C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.json

MD5 a73177c703bc007e5d07b9ced2e4ac8f
SHA1 cba73a4656dec266477a55d459ff1fc7ae7c43f9
SHA256 0d5a475d9d1b7f8cc0a56f4e4ebe81c0bf106db67b8a626baecc3748ebbc5b8f
SHA512 d279c0d98eda7bb5dd798cd8e3385475d6f6b533fa2cda1d45685533de127479f64c808a3f562e29ee2d41be74075112679eebb1b3a118c0f1bf7d8783ecce29

C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json

MD5 da83406917b319e5ce414467bee9db42
SHA1 a1c0e2ccf969785b7f5923d31200b724abb58241
SHA256 6766534eb05ea3ff7da51b18b7d83d19e37427794c7e2944e98714e249126b9d
SHA512 bafd1acaf7faf906c2454d68d9913805e2b836a4bff2a1b785c7275c0d7618e5ec4aa9e6ec404d4a6ed44958d57cef396552bd435626ce63d057822cb3a8f456

C:\ProgramData\Malwarebytes\MBAMService\config\VPNControllerConfig.json

MD5 d4a6c8a4cda3c9661e12e07c3843a969
SHA1 e700fc2db38a06e32d47d9f4769b40148598e7cf
SHA256 c3f85f5e9f8c0cf588114a41fae9ba2ead6690dbf125d21a4d0e36bb235bb3f9
SHA512 33b73ab900ffff6eb40409f4d088f0ba3453e17933e8b8c084ddbd42ebb573dd9a4de0c06c194b019ed9132d4b2dc8eb185809d8ae5923329bb209cd3390f46c

C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json

MD5 e88c339d025b41033d5d94b88d5a7c31
SHA1 6804c1e86e79d595af0359b7ce960df60b99b961
SHA256 ededb018f708faa04974ef7c0ebf8245b265e43bef0fc9cb0e52448b0ed2aaa0
SHA512 42f71725464f7c026b28b5b9c8d4194304a1cf495d0fd066490ebca043d265922c1f17fda84bc3a378aa2aa454f4661becf4db298a10daca1a9e36312c3bab44

C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json

MD5 b73080f967c6afa34327b42f259e177b
SHA1 63b99cb73aa84062cd5b4115c053b79680474990
SHA256 05d76bcd09f02ba27a14c2017684aa80ae30e01e3839a114a5fea819bd2d8d3e
SHA512 a05e40467d118586d654e89acf1e0a86ee718e14a8e0a9e69a4dd33c7aa91dd6469fb9830009f1ed2b4e1b00c2bad279f58f9960e1f265d0e10526820d5e34ff

C:\Program Files\Malwarebytes\Anti-Malware\mb5uns.exe

MD5 b39ba8b6310037ba2384ff6a46c282f1
SHA1 d3a136aab0d951f65b579d22334f4dabbebdb4a4
SHA256 3ecbcb6c57af4456111f5f104b8fb8a317cdb0f16e98412249f7a2d62bca584d
SHA512 a8b98f47c30503029f2dc80398dacd5f8fc07db562d04c56b8c7902bebf11517223350c41850b81aca770ebc9e68fc365921bd6cce34b57b2c945f1c51b538b7

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1488_105829525\manifest.json

MD5 8177721150435a9b333475e2b8a6e691
SHA1 8aa8981617e8f3d8967a0a4a2d20315317eba293
SHA256 8a4800ed5f63b9371a024c501ee2b031af94539e32e6753214e6d99c625c018c
SHA512 540c4c52030c6a4e1efcfab5eb59760c696bb3e3f1b8f93c97a6368639a911ba3d395190fc0798d99f3c63e25b6dcf2ded482bbda34d36ddd874dd20c2cfdf74

C:\Users\Admin\AppData\Local\Temp\85b7218a-b7b9-4ea6-8b58-7c2f973acfe2.tmp

MD5 413c4ad5f5700e317dcdd979a1844081
SHA1 dadeced4d5b245a32e14a42a4630667aa9dde198
SHA256 3dd8b6b22ac5a195412eeceece1f7ce110747769876095d9dedc38e219078031
SHA512 a037521e9969ecc78ec1ac77fad9dbaf4fe520d1d3b24ff28a650abde102fc550915db9eb51e3170b2b9d8a04468f0dc672b0f7833fc0acb188c0a3710d6c973

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\SiteSecurityServiceState.bin

MD5 a7e242a003c3e1aeebcb1a5f0df3018d
SHA1 856af8386e0077ea1f5993a4155b6a4278aab1ac
SHA256 5972204c02df1b602b9a7a15dc3737e12490008627a0d14bb1aa9e1a91620ea8
SHA512 1dc16f428d1c8b2c1bf80613f6b82ff30e298e792ac66ca3c661b8c0ba19dd801990fab134a025e22c87c4cdd6cabc6bdd39c85a12d5200da60bb3ebade15a43

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\datareporting\glean\pending_pings\ee18159e-db7d-4e57-8495-96d6162a370d

MD5 1250dbf27d8c46b83ef6be4eeb9f2217
SHA1 c4a91ff75e186163fb8116978efc13f6352bce6b
SHA256 85c53a32705de30c47c9118b3371bdf4d0fbdc74b219110c10c1ae8e08521900
SHA512 a010371f53ff36a0a52fe00d5af9e5deda4c365b145c46fa0ff13ab33a7acdc2d09ca2f63e8c3f31a4a168ad9d9816ecb02b6f60fc11cd6edfdb5db3005aa68f

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\datareporting\glean\pending_pings\b1d5488f-7716-4c5c-81d8-b213fa4c961f

MD5 8004b25e1251dd5e23a576f90f5043dc
SHA1 a58e155e4bc972252f863e1b527da85fca06cd6a
SHA256 b61afec0cab599bf89743afe3a18126209207a8ec4bf22403eb446ea6533a00d
SHA512 7c8020a4c1e339a94b305d044edd035edaf939334bdcf75a49d0334a185270788d4e742396ba9f823a59acc0dbd781cff54889195d30b9061df83cc580e39ee1

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\datareporting\glean\pending_pings\ae08763c-3c46-458b-8cb9-0d93911853af

MD5 2a54d18a81c50635f0f34c2428a43212
SHA1 6178108d91591f7048a7b186a2c22d893cf99540
SHA256 fa4dbae702a346c2dd340523448c3e78cb687721163e63a320c22331c450c731
SHA512 bb4d9925d793e8306ef02f56a8b351a298b59a3758e67a01a09a43ec3b7e1fe8a03cde455209ce587e85dee1483a4f2bd8cf40744695ca01c2fc1e1aa7752547

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\datareporting\glean\pending_pings\5eed60ca-6e36-406d-9839-b37875063c3b

MD5 7f7dfcdf4d6630c9a9723830595c6038
SHA1 690f03eb9b1c8224f16790bd70cc43cde18a381e
SHA256 fd99977dc476c0fd288b6318b86abf9cc6dcf1305ed44ed8f66fafe098e71397
SHA512 3b9a962033a5de0592aa97eed632aa275a255794d57af65224816eee54f03e1822edfca83c06dec0f480cf382addd3ff85c12b025f992197861c00534e71754b

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\datareporting\glean\pending_pings\48de223c-ebd1-47b0-87e8-5ee871e9f5a6

MD5 5a86c7f3b5cdeb56b3c18e2e49a5be56
SHA1 5af4ceb112939379f9044bdc208b7d30baaee0b0
SHA256 cc7fa9069cf2556d74be5df6ed470db7ddf60e14fc84ac2d8fd58cbb0584b7a5
SHA512 454b971c7d1316d121564d54d9ab6b25cb39ffebd5847cc16d6d161df2810e306bd0635b4696beee0dc83e9612ef7825beda3b37577a4392682e8fd0a0bdc083

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\datareporting\glean\pending_pings\1fad48a5-8a49-4d1f-9f13-7b1fcf562528

MD5 aec138ebc19693612b839d9466634efc
SHA1 b98635568fa0f2b24c6529674724cf8348fb6cef
SHA256 7a19ec974e11d4e620a4b3f570867e1d8309ae65f046c57eab57738e63c5a0f9
SHA512 f5ba18e4b5c910b58a4a076fa07f6437d435cb0e3b42e3f3b968c8c62f152c173f736f39899f31a46b448646494cb3f3b0c03916b8d38f465b95cc441492ed23

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\datareporting\glean\events\events

MD5 71ea6ccb2cee15664a5803a990cdb736
SHA1 3999e5c8a3d301e28fca03701218eff1e7959288
SHA256 5fc4817c8e46ce49dbd9a53b9e09ba008e3b47fccaa95ccb2cde2c2953d5ce4b
SHA512 1af9a38f9377dd73ce7c0bac1a92ed157d51414424116a5952d84c4e9f128aedd7f2e5f754e0932460022c4d74fc3ad449a3f4b3d89e9c40d292a96a7791374e

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\datareporting\glean\db\data.safe.tmp

MD5 3118dec77f60ba200ea87db5ada18b35
SHA1 55c9d27d8a66c97c6259cb0c4921a7a36a17900e
SHA256 7e16aa9384f4f865e7a05635588e820b32ddc8b0e2b226ec5010c2807e2d7766
SHA512 9d265f46eb160695d11c7dcec9c82789fe2ed98942ec9c74715aa5b90a79865858118f1abaf60dfaf9b8ba536470ecafd5d8f6c8fc110bdb5e5cabfa0cdba542

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\datareporting\glean\db\data.safe.tmp

MD5 d8cf28a4891fb8ab3094847e22021f77
SHA1 2e0a3bac7006f528f6088c1568486f4fec0eaeec
SHA256 46a7ab2168ced4726b44db1fcc487900e95edba1902605d591cf711c7f8f5238
SHA512 c3b9209458e0ab0dd1fcf5aa5511b5d2e730125e0bdd4fd6a870f628e5cd656de2a00e77995fd067769c24a047f46ec84fd32e309012743eb208000cdc58f37f

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\prefs.js

MD5 fbf3be40929bae18045e35493db5fe40
SHA1 b8a0973fe19fdcca20dfea9c570daa56653fb7e0
SHA256 f9bcab90d7c896ffa3615686b4261d1261795b3492dec1aca6219d05236f35f7
SHA512 5ee0ab5c49a18ff026ce62b12c86b967b6ae4612ffc49ac1811568c985d7b83b09cc1fc555545700ab72961e7d3e3f7fd3cd9bbfe32f71e6650b23e0d52c032b

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\activity-stream.discovery_stream.json

MD5 602afc9ea42ba7109c4b125a12dc1074
SHA1 26aece99b7881047cfd6294b8783d77c981e1361
SHA256 acf1abbdcf63b1324c8aa7682f05d87894eb23614f45f47a57526da3847d2944
SHA512 1fbd1ad7196dfb3913b5ac92ab907fd27b5574cac6aef48a25c0206fdfb8f9457b5302eb87aa071fc4d5df572b0b487a9b061a74f6a33c6f9d0be2a8f3f63c44

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\prefs-2.js

MD5 2b85f17d1d57173c8700325179fc5232
SHA1 aaef6baa13e3266ae4a977222cb206a80b201cf3
SHA256 73fe56b865cf9cb22aae22d46eb1be9c46db4557a1749fa1c34cb2f73ba1bb0f
SHA512 10d7e7e84f215d7f4db7fcf370312e48b7860dbf36cce5f1ad21e8c8573caa508d24145662a6ea57a1e3fb2283c1670af622b4a0c810ba833e93d5188c8f886f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

MD5 5234c6131444c26274c4a2e658ff7d0b
SHA1 b420d0c58b70d798debd08db6737c0157e8e49d3
SHA256 dd3ee35dd08b09b035ede9f6cb1ec18d290bdf3f0574594c934ff00e30050f98
SHA512 e786441f68723a18125e912524eb080f64356db251bde39e4ce1cf1bd1c1ade6d24a7d43f5e3157378a79bebf9e2193295acd62d90836574ad7658b718d69f46

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 87b60f6ad9d0669d1c928a8e6bf18069
SHA1 d7ac909e6e2125a729c0f6716f709504c7843ae6
SHA256 828436c2aaeb5b2ea8de0caf759c5dc92aa85549e43b93b09de1b6f30a49deab
SHA512 1f0fa3e8ffb60310d4502fac88a230d1ea5a771529ba9181c62abdc1768895c1b9eaf7c1da5793a4979bb445d153e4954b2dacda9151242dd876eb4fd362ada6

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\sessionstore-backups\recovery.jsonlz4

MD5 4d1fc702318d72c68d59180fd7a4f361
SHA1 4f0f59f6b4dbc65189e95889343e8f04f271ea70
SHA256 3beedf8f8bdb089f69ed1be9f06073eae60358211d840eec0bf9f4480796484c
SHA512 e4d538b09574409b30406850a04b1884ea760e38d8cd9933237b17b7d295665ea8ccc6512c36ff04db77b2c909d34c2b5a19cb29c16d94ffbe187e337e1ec16b

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1488_1601574382\manifest.json

MD5 390af74c5ae643320cad0cef4fa8fee1
SHA1 22ce727f9bcff9a914eb1d58ba8384de6fbda7e1
SHA256 1148c28e540b9b96237b35170a547a13165d6c7c039b8fff9e4b2cd774b92f5a
SHA512 deaeeeffdddea1a9047e97d82e3bb701fb865adcd77ef9e985bb0ec5e4057155e7b83cad4f9f3dd256edf89f19d1075349cea5005dffff8420da4d0646be413a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.24\edge_autofill_global_block_list.json

MD5 adb5f6058f82680a26d6ed02b44e5a21
SHA1 6197ee74e40c742e184357dcb6dfcc7e32818cae
SHA256 7655c9afb5f2ea39b18e302498b34009ca02b72451f82a6d4e7fb4d8d954f050
SHA512 742dd8f6eaf1bd5f24b37e90d7a3dce7bd0a8edf399c2dec25cd92d2bd6e1d663ebab3c68234812f0144061d4f22f0c2c43de890f60e24d93133bbfe23a6d1c5

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.24\autofill_bypass_cache_forms.json

MD5 9357a694006d8bec3d0f8c9607b76ff8
SHA1 6335ce691999ec10de742cd07d074eb648631259
SHA256 b6c37df977f149c5a444c72ea4469ce666c7975d34c6e2e0d9d8ec416f57dd44
SHA512 87c2d0192f3a78b13a691cda14da507f260d13331b792eb973869bd6dbd0f207faa48f68882be691641b46c06ed12ee8b9728a3b596df67a1f9a4831b4369a44

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.24\v1FieldTypes.json

MD5 c1a0d30e5eebef19db1b7e68fc79d2be
SHA1 de4ccb9e7ea5850363d0e7124c01da766425039c
SHA256 f3232a4e83ffc6ee2447aba5a49b8fd7ba13bcfd82fa09ae744c44996f7fcdd1
SHA512 f0eafae0260783ea3e85fe34cc0f145db7f402949a2ae809d37578e49baf767ad408bf2e79e2275d04891cd1977e8a018d6eeb5b95e839083f3722a960ccb57a

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll

MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info

MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d

C:\Users\Admin\AppData\Local\Temp\tmpaddon

MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\prefs-2.js

MD5 3920a68ad6934143b2b056c97635b31a
SHA1 79f7884cfc013a4cc3a91548f3567a4ad36fbd46
SHA256 2c79edabeb2c0d99541d1f6bc20a9316087e0fad5cf64ee28cd9e49aa6a04ea0
SHA512 150d017393d707dff1327730e2950c4260d717c195f592a5a25bcc1e11123134d15c53021a209e5e6032360fdd7bcd5c8c5dccc5671db28af6a520278fecfdfa

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\cache2\entries\CD39AD244C65ED2DD0F139D0BABEEB26DFBD83CC

MD5 23994fdf4bd0508233568c36b3248590
SHA1 890a133db5e26982b19f5a2b195a00a408c3360a
SHA256 dc88839990de06d3aa63945ec03912f1272ec5005cb9625dfeaa5abb45706e27
SHA512 220fae20cf42fe219916532d763868178b7883b9096eb352702d2c58e90d864ec69a0e271108add28c0db1b6cf210a41419d81e89d9c7d6e07dd572f7c3344f7

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\cache2\entries\C9AD8D046AE823121AEB5E0FE6D1B61D65686C5C

MD5 b850ed2daae384df59942604de10af45
SHA1 25e5f76f2f7711bbdad820f51e9a3fbf4e85fed5
SHA256 be2eb3c6ed5a744f1d63100986482d9fa09e981489834f426d3a0db36f05ff61
SHA512 a281827ee197f56babbeabed2da70933e1ca9a380d1955bbea0dbe1b80016e568ab5ec4296446da021dd32a8ccd58f0757996c962ea8fab687485ef38fec4c15

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\gmp-widevinecdm\4.10.2891.0\manifest.json

MD5 32aeacedce82bafbcba8d1ade9e88d5a
SHA1 a9b4858d2ae0b6595705634fd024f7e076426a24
SHA256 4ed3c6389f6f7cd94db5cd0f870c34a296fc0de3b1e707fccf01645b455790ce
SHA512 67dfe5632188714ec87f3c79dbe217a0ae4dfb784f3fac63affd20fef8b8ef1978c28b3bf7955f3daaf3004ac5316b1ffa964683b0676841bab4274c325c6e2b

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\gmp-widevinecdm\4.10.2891.0\widevinecdm.dll

MD5 1b32d1ec35a7ead1671efc0782b7edf0
SHA1 8e3274b9f2938ff2252ed74779dd6322c601a0c8
SHA256 3ed0dec36754402707c2ae4fbfa887fe3089945f6f7c1a8a3e6c1e64ad1c2648
SHA512 ab452caa2a529b5bf3874c291f1ffb2a30d9ea43dae5df6a6995dde4bc3506648c749317f0d8e94c31214e62f18f855d933b6d0b6b44634b01e058d3c5fcb499

C:\Users\Admin\AppData\Local\Temp\tmpaddon

MD5 bcceccab13375513a6e8ab48e7b63496
SHA1 63d8a68cf562424d3fc3be1297d83f8247e24142
SHA256 a6af95a209b2e652ed6766804b9b8ad6b6a68f2c610b8f14713cd40df0d62bf9
SHA512 d94483deaae98bf9212699f1ab0bd913f6151a63e65ebc1ea644ab98d5e3ebd74ecaa08f70aca31e11a5d2c64d1504b723817af35bbe9d7b05c758dd6945d484

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 f015af0a07f5e2cd27cfdde6b613bb64
SHA1 2f61f3b864497a330cd7187ede8cfdb44fb01a29
SHA256 1ade95d150c2ddef30b2179c2bf0620dc2ac4b25a5a2aaa0adfc25a48cc12db8
SHA512 5f7e36cc55aefcfed33abb08c826378075860e7fd95c620334ce1f928f18e2c2b2702702d9a10603a5a2626d29c3d6cc9b548efd24d5e3f32b2c2a37874a0d29

C:\Users\Admin\AppData\Local\Temp\b68bbf7c-347a-40c8-9a38-c6afcdf1e6b7.zip

MD5 96cc7d992e892c48e041427678e933d6
SHA1 944905c50a15c2a17f3d80bc4862b45230fc8ddf
SHA256 e89a5f80e93df1a71df3f84aa5b13c17a8d1d650fca3431eb602dc6637dba1f8
SHA512 df872603cd919f1de5d636b430e7d1d662d467541b3977144f2ecacdc0597c94c6d31749dafa4e5c57f348ed9f86529ba2a09c91dc51054f97e3018675a26a1f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

MD5 9c6382a9b98c425115b58e56db0efa72
SHA1 c69178d1286d337282cdc323bfbd03c064100a0f
SHA256 9b8d19912a63fb5dd01600a68d7fb3ac2ee81351ae1beaa72036c8f523f0904b
SHA512 e115990ae37f3ea95f41dbb4592724a97f520b5e829f8569e43f419539033529cbed3d8b3ef52f91b7b0f5ff4f9bec4215173f49718cb4e2c667c156fd51b094

C:\Users\Admin\AppData\Local\Temp\tmpaddon

MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\extensions.json

MD5 e78aea5773dbfc0876b1214a24fb0dc6
SHA1 e1636958dddc4e80ead9f79e2e412ab2fa11c9af
SHA256 16c976e9407f20044514dfb8946cd8234f18077ce7511368d0f1e6901e65351f
SHA512 65c39e6ef7bc1d2d229b5eee294122e75da8e59c5d43322298c7b66817f7932732387bd3708c34698cc453db2d1a751bb16d31b75cdecbfb7d4a84fc746f009c

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\prefs-2.js

MD5 98622e01546903b5e32d2d72209578c6
SHA1 b0486bc2316d517051c626b7eca3f9dd17e5f997
SHA256 a4245af8c09936bfd07828fb8196d7af97bd93df746b747793b32f8e3591c153
SHA512 a5c353ca0e86da00c57e3c88dfacf7acfef18cd92928626df50ebe577f9abbf6f92d069c2e9ff442d5ddc13868b5e8d4fb33553da9bfdfb57ac670a8fd129355

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\datareporting\glean\db\data.safe.tmp

MD5 bcde7d61eb39a4ad316b9af60e5e3006
SHA1 c5a0921aa548345b1dac63239af0550f45222f5f
SHA256 4273f5ee781596b2419eced04f93718a9c251e5d98cb024b543282c629d9ef68
SHA512 51b8e14e29d191fd4dd72b35868cf5ce5a2269eea0cc66aa9a811a2a47818fd69fe0c9fa53f1e54e529a78f27eae95c712c085135d2d2c0c71b1eb187154b916

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\datareporting\glean\db\data.safe.tmp

MD5 d81184b12584fe1cb4c0073ec547fc46
SHA1 7046c5a5393b39e45b8a71a2a3bf2a7a9c56e32b
SHA256 30b0c46f666eb6ec4c9d1cfd433eb0d0d36ea22ba39b1d677bc66677e937a8bb
SHA512 0e3a1044847254ed53cc6b1b7d3c68bc24590d1581613ca33d1c4f948bd4172e466af76b8a9859aaa0a69eb02db74502f0cff0b82b85b6c1d7203622038444f4

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\datareporting\glean\db\data.safe.tmp

MD5 0b02de104eef8561c39a8b15ca474581
SHA1 2aed5829a5c8ea903b9f30ee165a1fe400a3d04d
SHA256 72afa58d8612fb555939c4ca61a1ed06806e8cab8a3214fd4dae036299086e77
SHA512 0a3c3338e5473ab81a31bffbc8d64a78534dedf01c9b8b2c38ab8f0a43961750782e475d4d59582ff95248012c6994b49010f44e0bcea28eb14bec83adcf59f5

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1488_1944222503\manifest.json

MD5 a30b19bb414d78fff00fc7855d6ed5fd
SHA1 2a6408f2829e964c578751bf29ec4f702412c11e
SHA256 9811cd3e1fbf80feb6a52ad2141fc1096165a100c2d5846dd48f9ed612c6fc9f
SHA512 66b6db60e9e6f3059d1a47db14f05d35587aa2019bc06e6cf352dfbb237d9dfe6dce7cb21c9127320a7fdca5b9d3eb21e799abe6a926ae51b5f62cf646c30490

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SafetyTips\3057\safety_tips.pb

MD5 bd6846ffa7f4cf897b5323e4a5dcd551
SHA1 a6596cdc8de199492791faa39ce6096cf39295cd
SHA256 854b7eb22303ec3c920966732bc29f58140a82e1101dffe2702252af0f185666
SHA512 aa19b278f7211ffaf16b14b59d509ce6b80708e2bb5af87d98848747de4cba13b6626135dd3ec7aabd51b4c2cfb46ed96800a520d2dae8af8105054b6cd40e0b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SafetyTips\3057\typosquatting_list.pb

MD5 17c10dbe88d84b9309e6d151923ce116
SHA1 9ad2553c061ddcc07e6f66ce4f9e30290c056bdf
SHA256 3ad368c74c9bb5da4d4750866f16d361b0675a6b6dc4e06e2edd72488663450e
SHA512 ad8ed3797941c9cad21ae2af03b77ce06a23931d9c059fe880935e2b07c08f85fc628e39873fb352c07714b4e44328799b264f4adb3513975add4e6b67e4a63c

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\datareporting\glean\events\events

MD5 e9976b25e8125b6772503fab52079ea5
SHA1 a01c16e1563cbd093104ff41fe4051c5463f0102
SHA256 47239438e2d0f452b410ae8cfae41a84003e8dcdcc34829b790f3719e52f9cb1
SHA512 91f43e5d9b8f9da62946b6a9a08a29c75e1bb63ecaa5375991664b98162fcaab0cf2c45e364870f1f7a860e461e79a0cdd218d1e9c8fd69acd00a3160d1883cb

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\extensions\{242af0bb-db11-4734-b7a0-61cb8a9b20fb}.xpi

MD5 8003e1e676fa9dd84e948f838e3cee8d
SHA1 e37a12f65442cd86e8a7d71cdd335cf0ea4ef379
SHA256 0221f9cadd6512af6b8078dc4ac27b50a8a038cb738c5fb923893dc0035cc6ad
SHA512 34203d70a017cea4b2e20cef6e5099b7791de86188d8ecab6f75feaed4716737edae4b161233a502a50dd456dabc066ece688ad06998bb2f9146da33ac106550

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\extension-dnr\e1e9f9b7-bbeb-44f3-a006-d735b77d964c.json.lz4

MD5 2c0b9587fa9761837457e06632b656ed
SHA1 0714b6f640db225d69513110049b9f205892daa9
SHA256 97f85bb76dab82225aec05c9f6d6a2e14945aec84cdd4f147f4d65b168a9ff02
SHA512 e7219fdee36edf6fefc0dbad773ba8be8ef6d7cbf2edf6d965b568a642d436b259179d992cfa3076261a73b076445715ed4da607866c8e6859ecb47b3feab31f

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\storage\default\moz-extension+++e1e9f9b7-bbeb-44f3-a006-d735b77d964c\idb\2791846577cearcohteSdsLgo.sqlite

MD5 191262cf4947defc0949dbc4e7171c7c
SHA1 274cd7c528512192cabf295147792cef339d434c
SHA256 66ea6c185a5b7ec659400a54fdcf7720327e9d71d005282a85874465e3eb40f9
SHA512 4fa115514c457a7fed8c6ce09c33a806df572f91f3b0bfd336e19d4382f6c7fa1171d0d47d1991e0ef801597a77380d0f621d85f021d74b47d8d2f244e9046ab

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\AlternateServices.bin

MD5 663cbf65b549df82970f60eb23ed0de7
SHA1 55f6d39a6692376e886abb1afa96c2b5a467a3c2
SHA256 3dab62839ed25269c0fc36d7022529aeab6bdee578790ef6f909ade121e103fc
SHA512 42f0809906830ca2c0988e8ea9c246f9e2b6838320347576b24eea84a33762fae7c2b7298056eeb314a11f3766269f717b2731085b794c5083181a0d1721e1a7

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1488_1942513005\manifest.json

MD5 b4d869dd7052d78d29b3e439565f1600
SHA1 caa2cfa31729f4348a02514eba0235e72b88ce5a
SHA256 0f8ee89c4a420bda691d058cdd96c874c2edeec84145c81c957e98d05e351d3c
SHA512 1fda3488df8c43ad413b2e69a5e2292322fe837f7b27b88302b4e591e7e13fdceacb0af9b8bb92ca7c0d2b39abffc776c6cc35d18abb86ce91f55c719b43480e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.3.11\data.txt

MD5 1bee2c36cebf096d8a559d5c4eeacff7
SHA1 c695eda67f31d729dfc336b8a471ad6346a39031
SHA256 5e4014e267eec120e673cfbc407e4340c234a7898319b35a304ed6ea343a7999
SHA512 ba520d383be95d8b15140b7e38e4e7ac03077bbbb8ee5326ac4162be9403bc9f0576e53840fc22cd9c4038f19f60bdeb7b4e8e0125da6ed80670238de812b4b5

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\sessionstore-backups\recovery.baklz4

MD5 c35fcd55ee48399ce667b64f32dff8ce
SHA1 8e20700904da5a132bb31453457f89b787635d5d
SHA256 4fedb58c0427d3417105091efd4defee05be9c9289b0c3b70be0691135ded62f
SHA512 d9cf4b2a61e4ee83a2508e397c992a273c06878f386daf8145afbd9b1f3a24091acea2e83208d0c37ea8c0101802c3892a5661493b87aa9564a9e426221e2651

C:\ProgramData\Malwarebytes\MBAMService\config\RtpConfig.json

MD5 6d6b2769b35782e2fc0527130ad01c34
SHA1 dc1b70d981e8d45aa688347d79807ed63b0e31e6
SHA256 d08596a680b85e782081735a21a927ac228fe06bef318df91d4471587cc86be7
SHA512 9dcaf939ea7eda3edb1c8917127260b148e57471026f8e5cc019334f492ac4d82feb12c85e4402543c8aee9c3ab3082db839358767fcadcb431d5f01d891e8b2

C:\ProgramData\Malwarebytes\MBAMService\config\CleanControllerConfig.json

MD5 0ad5c8f7dbe0ab146cb6081cf184c801
SHA1 9b624863d3061f3376e8729e951f10bac420ff62
SHA256 b24fc88dfcc2ca16c42132f36d04704cd8c6c0ba3b4736f25c5f6c57ef7e64e4
SHA512 270fcab1f005f6a681f361250e4baef3499f25f1d2b9e5ea68c9b3285a7d7d5e840029b81d5e70d063fb19a647b4be249342ff6e8bb2b635d3b288a2568f8de8

C:\ProgramData\Malwarebytes\MBAMService\config\PoliciesConfig.json

MD5 a12d575bcd4debdc21b3985d233ba2d0
SHA1 117dbe13ad276431205596aed94dcb4b93bf0e64
SHA256 ff6eda2e263650f8ddcfbeeccec7ccd873deef4e47ee4e78ebcee128570c94ec
SHA512 4963363e7ccb88e19f53a3726b8c1ff1d69897b27ca1e2343928b8ac9dc8ec70c73470586f640b8ad13a223274e6d38cb9fb7fc0dff2ac6d9c3b7a248d17ef75

C:\ProgramData\Malwarebytes\MBAMService\config\CloudConfig.json

MD5 b761dfcbd2e6772b884c489f78efe39a
SHA1 350424d2630648426011153bd62a9faa8a2df7b8
SHA256 6b64e2c0bef9891580656e1b15963e01d7331ae4e1414b763895216cfdedc589
SHA512 21b605b98de8631b375f692791ac6ca341cca6d4eb871f5de20e69575171472f8c735cbc217efdbae0bacf265986da50747f89b56b0c22c77d559e1c043a91f3

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1488_511457497\manifest.json

MD5 0abdce2e93f6542edfc9dfbcfb61ce89
SHA1 08067386e18ea1d48d916ecae2d2583a5f6df6ce
SHA256 d912b0ee06353fc36393d1c187a22d37d467e14ddb389a930ff7317b6760531c
SHA512 ec60d26c4b1c1e437c5c88fd9efc504843551a51d3c1b036a5b518cbaccec6e86fddca534b96d490872c6fd53a874f765367d3784473b948f112a51addc9f730

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2025.7.2.1\typosquatting_list.pb

MD5 8aeeb5c136b1deeeee3677f4b93e2575
SHA1 c716557d8d504577e2d22bb710e94663b91c80f3
SHA256 b8d2c9ee5824a35ef1bcc746200cc710bad4951d4ee16be4acb8a8f503bd4856
SHA512 a5b927c20ade622589e09a7443e7fef2ae2b445b22aa773c4bd05c248d48f0bd0e7e2f3595441bd40957c08f29d660f27b7238030c51303d338738e2b1c51b17

C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json

MD5 0e2c86fb1091cfbe0fe5e97f385792d8
SHA1 ce175feb647eae68e0b7225074b16791a036ba23
SHA256 690b0386fe3058b219c0ec786799916dc9bd7967ed8a60f05c9495320ac36f89
SHA512 78cbea7fd5bbb73ea6ea538140c40d8591c2ba4e82a612af9cfe67297cb337e2f02a58674add48828962b2068666dfe5caf606b5f749e5c280914322b31edc46

C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json.bak

MD5 f7a0108d23f65d4cd4e54d85b7b43cf9
SHA1 bf88dbf38da5a48446a4c4df688cef918d50e2af
SHA256 586dd10c3e79a4d0a340086269a57e2807d053fae459429e902333e05cc95759
SHA512 02911ba69d3d62b125b35e8e06aba15fb14a4c31eea298f47507d7a71710e754432ecddc70e2e075f1d3b9164ee21212c3ab3f6201a48c867ea63db811617a8b

C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json

MD5 feda469de32d1c0aadad36c340df248e
SHA1 7c26050dbc0d0a703711acdecd0a9dbac7a7e726
SHA256 5c8aa671cac620e6f0fdef75df45dfebe76b6a5c8fa2909343c3f0a745ac3165
SHA512 fd38101bde54fa9e55a7cfc9a8925ac1c20f0b2265a76bd754f6d0a7bc0481f45327cebbbe7474fcda3f03c13b649d241c1146c0bb150ff18abcaa190839918e

C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.inf

MD5 5a9717e1385703e8f06b27aa10a69e87
SHA1 84ee67a9167b5eb6560711b9871de98898ad07a5
SHA256 47b7c516bb57c612de19f0ca865590af95b6e32bf873a0fef9e011b2c5b483d4
SHA512 dd3c7278c2c11ad15a55fae6d19b96dadd92f85b7f0c8ce934298258af00bb5c052a84a98499b8867b0f43704fb307c67d03692ca69dda4d814c6c17dd73df44

C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.sys

MD5 1258a8e1beab105aa96c93aa34dd9ef8
SHA1 a435a462a0976135e2257b46e52b576fabac3d34
SHA256 d86b9b20788b6bff70a1a4c4111b2ea33b9ec705cc6b8fe869362fc3899820a3
SHA512 8feb56e3d5d67484c97f20348899673d1b8aafad35cd339bd6c459194fa0f0f9e07b0a7063615b010378a2788cd11ef9e3744253a24c8fcd0d960d0cada77546

C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json

MD5 0dd099502e942fb12f05abebc6b98b60
SHA1 bf7d9fc02a0765238d0501348fec7d1bea7e6a38
SHA256 4fa8de33a09c4e9354448b011b7af8766eddc22920f321940bc30ee073a0f326
SHA512 3bf53566d52da5ee6812914bf9ec02709dd8038b361c10822615a3ec6e94559a3a51cf9b613122e29cfc76596e9bebf471eb64db3db0ffcd7c01d913fa1597ab

C:\Program Files\Malwarebytes\Anti-Malware\sdk\farflt11.sys

MD5 481798295e7ea2c32c94feb253e55850
SHA1 7eada1e2767fde709e73875eba09f129493e1e96
SHA256 f6ba6b1f004a08ed35a145c3b3c0063d1283a00c89ac73427e42c474d1b900bb
SHA512 1430cca5eb980d529417dcaadc2cd3f26be39b43e698b18e1ddf8fe052f7f34da0a68bd7b3bc3b10bf57a9a6cf983229ad5db75601791c36a2ceafa98881bf83

C:\Program Files\Malwarebytes\Anti-Malware\sdk\farflt11.cat

MD5 7b1a6547fddf8efd2b7fe719f80fa758
SHA1 ca6d34d44cd0dd99ee9ab86470a03c5e2cc48d3f
SHA256 bda25b8dd0fb8950b842c3c1c7a82edf1ffbb3b19e6c156e172a6f3210dd1741
SHA512 f47807e6c25b2fbce007bcef0b836a4cbedec05057598c484e2247bd5ffa6a430936bf3089f7d97afea1d93ed5a30290cfcfed7ccc570afffaa63a8b3977c29d

C:\ProgramData\Malwarebytes\MBAMService\config\SpConfigFile.json

MD5 439a613ce36741d6f9a315ececabf880
SHA1 8d45dc70c766fd8592502aec52e5b62afeaad550
SHA256 d478de774d13bc965b947239051e023e273b46ea4f5f00522bc85467dfb83505
SHA512 2f3fd2c268aff5a32cab733c9a12ff5c0cac4bcb628076dc37046cae213a5b6fe0ad71ddf97a96ca40f82c8889eb73d7fc61ebb8272deb790fc66881f96ecbdd

C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json

MD5 dd5fa02447a722b4533f4265a64bab1a
SHA1 0237e846f9e8843dc99c95152609455d261a0b95
SHA256 161c9ef4b037dc292790c398991ae0b96af3941c446394b0ba01bda2f7a17e45
SHA512 d06e730567733dd806e83238753d0e4a353c964515301fa04b33eb8994470d338c26dba42ea54db19eae99c07cd50f4d845890ef24a9a11ad14c3aa991941ec5

C:\Windows\System32\catroot2\dberr.txt

MD5 eb829be6bc261b3f138e72cd28de82fa
SHA1 5513a7fed9ae2d30785a4ca2fdd6ac8448a7532d
SHA256 504184af288db159a9e37b1a3bbcb70573f4f2744a08620acf5e5b8f782c2095
SHA512 45aaf457dd6bf47ad78418533abcccd0899d7652e79b50bb2777bb17c55432cf62a6529e7fe1e2db95cc8ce435921a47e5bb9ef5eccc2bcdfc075c84069388f1

C:\Program Files\Malwarebytes\Anti-Malware\sdk\farflt11.inf

MD5 9924a26e2fb32c82e9683a01d65d4a78
SHA1 f707880f584131c0f69fdbf1dda753c88cb75125
SHA256 142f7bef5d7c91cc29537e423e4c10fc409b085adc66b75552252bb5c7b38697
SHA512 600665fcc54d8b76f2e9b059bfe7e4f7f1c3b4e2e635c8f97eee4a34b478485312998e42db4dadfb221eaba817082283b7b7be5938557fe24339302177e353bc

C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json

MD5 ba8901fc5d658350a6cdacd436191beb
SHA1 4bd29ab783230e183f6d6dc0e9a89657a3ac6989
SHA256 78a1657ad850720f706275757d91a10e11a94fbc81fdaf9fc22786b5a82b1650
SHA512 c7c2625aa969fc4057361d0f726e9cb7bbec00908efea0e441665de5d61cab4138cd37ae964385fb45ca557725ce49e56de70d0feabe754645a9f10a9e9d4b78

C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json

MD5 e19df3e07eef24915dbd5561a03da6f4
SHA1 7732970006e4416a31dd2086d7bae8508259ef5e
SHA256 03e52fe990e0cbbda235afc5d7a2b2eeba6304ab704f12a86b113e05a26a9c82
SHA512 e8b5928e26df7ba75b8933adfc43ad2eec7aacebdfadeb132611c21bad66c5cb67c648eb08a4034541f42d47811db9fe7385bc1ae5471d407f0acf91aab4b2b1

C:\ProgramData\Malwarebytes\MBAMService\config\ArwControllerConfig.json

MD5 53a447b0e4321aad4d8984f4fe2e138a
SHA1 55e7b1ef210a6243930750eaa33d71752462b443
SHA256 1c1b10dbf7fea8f53e5be9c1f66a6f585de4d97b986b8c289e063a1199d41cc2
SHA512 431097312aa2f8828a40e4551e3d9a804a48393f36c2382d32d06be1f95d62319b65414d6b81138defff88e90318b862ab736ec7f212239ba343723688cdc614

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\prefs-2.js

MD5 d7b85d0459bae282c8320f4b1117e530
SHA1 b017f5fd6b1a01b8730f848234b851c7c3925eef
SHA256 d0db1f03bfc65e4c075ffe95aef164646db29e521c485308d41b608ec5587f70
SHA512 38549ef5c3413a4d3832dd3dbf5bccc02078703cd64637c0276035ef72855a7c9255869c038399f5d31c4ca76b75574b76c74b7dabbd699a38dcb664299fe672

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\storage\default\moz-extension+++e1e9f9b7-bbeb-44f3-a006-d735b77d964c\idb\2325712684IbDdB-FBiDl-eesgSatro.sqlite-wal

MD5 67f5f7ee677468584d89486ce0f75078
SHA1 8ca1cf033098bce2e009031460a58ae3a516e746
SHA256 64ce1dafec0b98d967818c17fce3d36843b0919ebeb82fefca5794f39855764f
SHA512 42e9f5e126dcd92679c4daed7f328e82e902557ee60c3b9d6503f3759b94a2afd8a67b4c6c3dc6e64f56169ff405dc744bd4d6a0e9d4e044361b837b8b065900

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\storage\default\moz-extension+++e1e9f9b7-bbeb-44f3-a006-d735b77d964c\idb\2325712684IbDdB-FBiDl-eesgSatro.files\2

MD5 e33fb675cf0d70a4c775da14ea9e2a9b
SHA1 06e8028a699f2ad3e8d8f3297551f14d8451c3eb
SHA256 b7a77ba0b1bb5bc57befd1bc572c0d156c0f7563fafafb04e49fcf77322ebc47
SHA512 cf35d15da66db3fdabbfd85c5e1dd0c602d4c7adf45dc34eb3932ee1b2c4a9045b12475427848a7be38d7f542bd799d3df7d31795a1598c2e6f6e513373e528d

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\storage\default\moz-extension+++e1e9f9b7-bbeb-44f3-a006-d735b77d964c\idb\2325712684IbDdB-FBiDl-eesgSatro.files\3

MD5 a40579e45eb0c5898dc0fd1eb6466fc3
SHA1 b74e042e1ffa5ed1b94fadfe973277c102bcdb34
SHA256 995d027cde6fe3e512081d09312172918bf05e5ac157736e9dcc520a539540a9
SHA512 0b9fab9f91fc9c13a4d38290f119c453b8ab3d74f550ed431dfb534911e5409bcf6f34ecedef429476ffb053b3d97464c9a49e0d8c4e908e35ed042fe1b87524

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\storage\default\moz-extension+++e1e9f9b7-bbeb-44f3-a006-d735b77d964c\idb\2325712684IbDdB-FBiDl-eesgSatro.files\5

MD5 fd3a44355b488a5b67f0f658aefc4153
SHA1 a72d891190c57eb2b855bb18a6e0b800f67b9b0e
SHA256 6b949175be03225e8ea9496877567ca7a9b8d2aa8ab41f00509d8c73d5868990
SHA512 5e5403776f68d0f55ba9005b43753bb08a881fcf65106af1a9e63a433aa2207bd8fef1b2d312cd25885dbf4193a488065b963796ec9ac868c11234142d326e50

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\storage\default\moz-extension+++e1e9f9b7-bbeb-44f3-a006-d735b77d964c\idb\2325712684IbDdB-FBiDl-eesgSatro.files\1

MD5 047ae1cc1559873c37814f4ca2bf21db
SHA1 411624d2d5717d41713d6cb382f6ca94d8a3c287
SHA256 523ab2f2d6a40ef61c87d93cefd189b27f3b90f3debda01ec95d8e5505854231
SHA512 fa153c741fe951d6e17cbfeb18a94133973c82a3de8b1bab4cf8a8244fa826c004b722a05f7a311d40ce17b1833fb204bfad6df80f8c9aa50834a22ccc43b3bb

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\storage\default\moz-extension+++e1e9f9b7-bbeb-44f3-a006-d735b77d964c\idb\2325712684IbDdB-FBiDl-eesgSatro.files\6

MD5 13b871686d599fe23c9a170683ebcf8e
SHA1 8989f4e3323cc892a37d857bc9d3fa18b72f5325
SHA256 2253841cfa424fcbe5de1cc2b59c82ddde3c63419ae6bdb81314da4b24429040
SHA512 5cbdf622b5a5eec66b2e67fa3d3a9974fe2aeb96b3871a2e99d0475d28bed6a6747f7aabdcc1ed6556c388bcc7161e933e8c020ebb09f9129a24e4df52feabcb

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\storage\default\moz-extension+++e1e9f9b7-bbeb-44f3-a006-d735b77d964c\idb\2325712684IbDdB-FBiDl-eesgSatro.files\8

MD5 d14c9568d02c4ef3038250737f555099
SHA1 ac0f35011233b8d502a3bbbbff71ec09f19d5376
SHA256 2ad94e946634fa7c2fea4f749fae9220ee1e62c8a23db5ae7dee4b1fa3759c3f
SHA512 578fc4ee521985755e62eabdf39bb06b6c9774c12c7a2273e95dbe5c55ec36d75e2dece413add6dda8b3e81a94438b64a247eeb6c22fd225eff826760d9e0327

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\storage\default\moz-extension+++e1e9f9b7-bbeb-44f3-a006-d735b77d964c\idb\2325712684IbDdB-FBiDl-eesgSatro.files\11

MD5 370d4f6bdffce93306329c38fd21a40d
SHA1 8688c2070d792b61df349ec4ba2c1d03f481373b
SHA256 1516645ab710757f11cce305c27ef1bcec57534a6da457d832b0198d3f0769a1
SHA512 26b195f29a21506029153a13a17416622c0971b583004fc1af5b27b020dea798e34356f8d033d06f9b167827d9628f2a368eb458418c1d4ff1bdb0222234f9ab

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\storage\default\moz-extension+++e1e9f9b7-bbeb-44f3-a006-d735b77d964c\idb\2325712684IbDdB-FBiDl-eesgSatro.files\7

MD5 d8340433142455aa5581f6ba8c5ffbf8
SHA1 a117f950377f3edbbc84466622d8e324b0e43753
SHA256 eeb9ae488491d1634bef4c0afa8c6240279550ca516a1d0230e0f9280c37cb57
SHA512 3481326db6eb4698a5e675da13cdaf27a48a41768a99c8aa33d90cb3b3a0afb2064a5779bdea694aa0437a1504cd2f9c002c5b940533b07158effa8070dd4b06

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\storage\default\moz-extension+++e1e9f9b7-bbeb-44f3-a006-d735b77d964c\idb\2325712684IbDdB-FBiDl-eesgSatro.files\9

MD5 94f1a3bfeb0d1c03320ffbd22433fb2b
SHA1 23d16841a025a181ecd825e0ca8739f9077e3cea
SHA256 8880aba8d150b7cdc2c6a73e1e8d7c4315370de0f9806b75cbc9100fc1eb627e
SHA512 5873ebc5ee6103cb8a2bb64b9597f6abffa6465b9653b95a218a3e02f2a450658bf85c9fbff021a424d1078c7d36c765a7f2301dee9dcfdff4a1d84ff1ca02f9

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\storage\default\moz-extension+++e1e9f9b7-bbeb-44f3-a006-d735b77d964c\idb\2325712684IbDdB-FBiDl-eesgSatro.files\4

MD5 85203f2a93db4cc4e3bb5d3f791c8a06
SHA1 0961e6ed4f60f2eb0438a6a5f99ca531cc6e32ad
SHA256 40808f7600a975f2688f58b3606494ac89537bb001c07cc14a4804d4fe09c221
SHA512 1fca7da8ed825f027cbad7fb43279ef9f9302026599008fb06a03b8ae3effcc93ccb74a0f4e56115e9a872160bc57f4b194554d9b6baac7b66994dee03a00585

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\storage\default\moz-extension+++e1e9f9b7-bbeb-44f3-a006-d735b77d964c\idb\2325712684IbDdB-FBiDl-eesgSatro.files\10

MD5 fd21dc7804315d10e375d4c4a51387c6
SHA1 3ba359e50d00519f6ac9acd2c27bc109a53126af
SHA256 0dc337075f1fbb7f26d0c62ad470c3719ca803cd4a1dfb1131ee524ad021e0ae
SHA512 c98ed9c89c09f3d1ae892a901905e68799ce2b067be10011052d349ee140050daf97bfbb35dde724e8a3aff6117929aac66a800b60b7573afdc0185a8d018b67

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\storage\default\moz-extension+++e1e9f9b7-bbeb-44f3-a006-d735b77d964c\idb\2325712684IbDdB-FBiDl-eesgSatro.files\14

MD5 9620d1f2207a9ad89c5c6efbf5d4152b
SHA1 5b566457bfebc06f88178879bcea797ceb9a628e
SHA256 136644222df8663e3a27c9286cc5957332b2c9799560054deed5a3cc02e2a39a
SHA512 25aca4fc42babbb46f83781a3829c820be8611f4db885255d3bb56ead68802da5f55a5915f3372014c4b26df777bd2c0f82e4e5159fbb311088478fdc5058e21

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\storage\default\moz-extension+++e1e9f9b7-bbeb-44f3-a006-d735b77d964c\idb\2325712684IbDdB-FBiDl-eesgSatro.files\17

MD5 f180fa065cf42cdaa219b204954aa25d
SHA1 083b1c998fcc6874e8efdff0b89d9f1857943474
SHA256 a757753bf84e71b19ae91cd28d5b41fe970a9686f55ab81cb489820c9b11b9a6
SHA512 d99bc826e4a173cb13b432945f2b2d1e033f68b86114b43fa5e58b0d1b659c36618686614ed0b1808280ee07a529a771369ee91b683e2439a38b17cf419c3b5c

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\storage\default\moz-extension+++e1e9f9b7-bbeb-44f3-a006-d735b77d964c\idb\2325712684IbDdB-FBiDl-eesgSatro.files\24

MD5 3179f35c7eee057e7d88f0f44f50b0bd
SHA1 fb2f196bf0eef500826d74f9789af75af8a5be47
SHA256 0a8919d1fe00703e418ec550994499182cc66834e81a6975ee42d11ca3d8bd7f
SHA512 7d7bcd34f7a608ca8649f05fbd88a07491dc0aa50c924e44b2733779e99eb213cd8e1e0ee0617a1da833b297e1909b928a6ca3ee1831f296091137363d2c7a45

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\storage\default\moz-extension+++e1e9f9b7-bbeb-44f3-a006-d735b77d964c\idb\2325712684IbDdB-FBiDl-eesgSatro.files\21

MD5 a484855ce9dad422312a5bcbe24e17c8
SHA1 cd69354be9e13c613f10273ff97f3d8b06540322
SHA256 e5c521e616fa1ed07a5495bb4a2768837c79b05a070577a6a189e0fed536d795
SHA512 b573d4bc28a929201d89e55d8dcb4deef8aa2ae5d3316834ad2c10bb55cca47bb7c041e644867d63dc50b66b72eb1e4554be296f120d9314ef1341b99c55f64b

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\storage\default\moz-extension+++e1e9f9b7-bbeb-44f3-a006-d735b77d964c\idb\2325712684IbDdB-FBiDl-eesgSatro.files\18

MD5 1918b51915227a9729c72faa8515db73
SHA1 23f652c4b5b83cbcb47fc13a803b16509e522107
SHA256 a0726898d3188acfe81cff860503daaf94a7e8c20bddde574b3d4b1d9b2d9d6e
SHA512 9858ca0aaa17369718ccd3284d9719040ff274f3e6e4c028f5e2738eb92366935601dbd591d9b97bbfeaed3d60a3a26cc4257415c864e25f106f036ab7e2ea95

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\storage\default\moz-extension+++e1e9f9b7-bbeb-44f3-a006-d735b77d964c\idb\2325712684IbDdB-FBiDl-eesgSatro.files\13

MD5 c8e8f228cde73ebc77675c23da2fe392
SHA1 52725692a26e05f2dfba1357a9d4ba590aaa8d42
SHA256 cfb574528f6af21ac27e0ac0a72111a25ae937cb7de5d7f7216055698ac2da4c
SHA512 6ef5364a26cc1246647539f5feea4b25e98cf6c9a00c74150ef33bbd8226fb7fead19691af68cc59ba8f7d952a7da0a8a715148618837169a9213afb1b5de1ac

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\storage\default\moz-extension+++e1e9f9b7-bbeb-44f3-a006-d735b77d964c\idb\2325712684IbDdB-FBiDl-eesgSatro.files\15

MD5 9d344f46b4274fb3a9fc6a79633a1a97
SHA1 41e3712e1be7ae2a950d0adfde0705b0c71a483d
SHA256 7d4a8d11e0ebd6c9bdedafd9e04bf7ff04a99c2f38292aebaf4005b61d179edc
SHA512 2c1b5a90ddb99cdb7ea87f8da113f6a7bd818ab53f781e5f3abd7a2cc4fb9beb098ae3cee611f51a8ba918746e3f060b1f3aca9244fd5e48095224e8c9a71d2d

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\storage\default\moz-extension+++e1e9f9b7-bbeb-44f3-a006-d735b77d964c\idb\2325712684IbDdB-FBiDl-eesgSatro.files\12

MD5 452ec8ee53b34d1ab3debeff36e19c3c
SHA1 d2c8576f9725bbf49781976062bd55ae746166e9
SHA256 1e90e2667a1056db9c135e16b77b18044788a49835e04e7041cdf17ebe296026
SHA512 42d1fff69d6a84b0662e7bc360252834fc755dee298e69ca8f436df3e3090cee6c2c365d160f8a3b8cdce1f86329259cf963bc8aa7187b8e91e3efb76d8d44a7

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\storage\default\moz-extension+++e1e9f9b7-bbeb-44f3-a006-d735b77d964c\idb\2325712684IbDdB-FBiDl-eesgSatro.files\16

MD5 e7380ebc6e0c86aa1e4cf6462e8c5afb
SHA1 d8f502f5e9439e44e813431f42d3c1f0d6b85953
SHA256 04003e38843579f8e82e1fa95ceba2eecb4d1f143900a3785664afcfa335b077
SHA512 23a9c0e03c924da5a7ef2723c49f63b9bd3aee1ab78485c349d8a3c29e9aa024b85b5e2b17b69756400d720791b3914d696042f9951ccddd59bc7db365b78de9

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\storage\default\moz-extension+++e1e9f9b7-bbeb-44f3-a006-d735b77d964c\idb\2325712684IbDdB-FBiDl-eesgSatro.files\27

MD5 9b81c51d45d140e67faf9e630aa439f9
SHA1 9fdfdabfa96ac485b4f54f915c1636d668a7e393
SHA256 81cd22e92314df7e1628792e7c41cc7dd41bbd5e04197b6cc8353214e5cec428
SHA512 210c3aff38bcd90f9d3275423ce61f8f6e1e724fb9e26ee9ff93a78accc3f780fff2912a618299fd5d563f205a6e536d0493c3c411aae0f62ebd96b18c1c939d

C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.cat

MD5 a32881b0be849d96da6b6bb6d7be8890
SHA1 5d10d9005ccdb722fce6c2b8ab29fca0dad60e36
SHA256 45db7e4a12a3565dccc019f1337f71d58d1969841354cc6b6e867f43352c2615
SHA512 38bb2887a3814ad64a7af6c327fdc37f7e086778f3bb7fdd0fad64914ffec868a7eb21b2af29912f1a711509f6f2f35e49cbb7638b3f48b1054a5684eed7d81b

C:\ProgramData\Malwarebytes\MBAMService\config\RtpConfig.json

MD5 b2e3a7835755260e4a91c5c848c481c1
SHA1 72179a8fb63642df933f09a793462166c96e8622
SHA256 5cccb43851d4884bbf173f72686f6cb08480acf2f9f41226ba7e0ac95a7cfd75
SHA512 f46f2757beaaf186c4897f7bb55759a9b4e9d9b2627f210a5429fe7e652d154c91a38ca38bb0210d8e2bbecfb0a91164b8ea50c4d0595aae4f1a6d20342f452e

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\storage\default\moz-extension+++e1e9f9b7-bbeb-44f3-a006-d735b77d964c\idb\2325712684IbDdB-FBiDl-eesgSatro.files\19

MD5 f2f320abf1560610a141a8c0a285359f
SHA1 75843659c6b2a324aee3e05495969db928c670b0
SHA256 9974fc4ff228af243bcd7f8fdab929a185385f3b024f9069d513772d2f7eba26
SHA512 f5b74b46c0ee0834a8f128eac94e794e9fa4d3e693a4a196a1361f9e550d84e55323cf15e2735683e0eacd0623ca67490005481112135217aa3bb85f6086a310

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\storage\default\moz-extension+++e1e9f9b7-bbeb-44f3-a006-d735b77d964c\idb\2325712684IbDdB-FBiDl-eesgSatro.files\29

MD5 bffc21f8b0bda8916a05eb7ea686f315
SHA1 27a50421a39e542ca2ea38adee0128201cecfdf9
SHA256 e1231210585bdbdfbe687b1539004cba84f696197c6b571e1dd0eddd2db8693a
SHA512 c9809fb4f7f3704092db732a0443693abff0ca3768598af4f0c31df06652cb7e3b1cd79da69497ac7730988c4e6ebada6b8b2056d7bc8587162568b6707bae69

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\storage\default\moz-extension+++e1e9f9b7-bbeb-44f3-a006-d735b77d964c\idb\2325712684IbDdB-FBiDl-eesgSatro.files\26

MD5 1cc979ea05ced639024d40e9a0113e06
SHA1 4178b3f4e9d400f25f97d9a5c85f0a0b1d3e0e1e
SHA256 fef0dc6811f1443699aa0fcecfe29858678a2f6eae538423e6b62ffabadda253
SHA512 1571957b89407c44587b08892bb477fb160efea49c165f10953fbf066944d2b85cc468406db7dd98505bc02230d1f72299396deb429a018b3f9b66e53a0318b3

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\storage\default\moz-extension+++e1e9f9b7-bbeb-44f3-a006-d735b77d964c\idb\2325712684IbDdB-FBiDl-eesgSatro.files\39

MD5 725db430f4c1badcdc7284f5ba4362c1
SHA1 949ec7eb02dfd79243643843688b7fbdaf69c82f
SHA256 ffce5f9c06543331407b75a30b87f398517607e132caf14214657160ea68870c
SHA512 fa57755a0f8bb832d23b9379315433c33f384d4acd64e21320d69dd036150fae554be399a737d5112a76848dbe93534aabfdb8f3c3eb9478aa49ec5744e8987a

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\storage\default\moz-extension+++e1e9f9b7-bbeb-44f3-a006-d735b77d964c\idb\2325712684IbDdB-FBiDl-eesgSatro.files\35

MD5 b74265eaf26d371041d8c3f6484595ab
SHA1 944661a98f71ee614134b0cc1fbadc23b5d52188
SHA256 6477cfdca5ca7dec287800f31cb35d9f1a08a787c4daed828f85cc2b18127be7
SHA512 2ca23f91d402573a483c2c77094ec284833ebc8bbb27e3aa639eb0a462bf2df23091d43d990702acf4c3f4e053f2345424e41da7d7db177cfa1e3d84cc07f271

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\storage\default\moz-extension+++e1e9f9b7-bbeb-44f3-a006-d735b77d964c\idb\2325712684IbDdB-FBiDl-eesgSatro.files\36

MD5 6a2a06da68a77b64e773cfb825458a8e
SHA1 e2346d83dfdfe9d04687ce1e5918b42faa23e276
SHA256 ae9b8b88dc266cf56f3b6ba14e201a6c45b7dae1693e74ece966b20cf3c68d59
SHA512 2b7d455803fb7c7b6190112c79aa73a66d206afd88078c7bad37ac2a131e5761bd8e4fc1dc7fb446ecb62d16147c27283377ca827db1a3afef7cb37b133528f7

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\storage\default\moz-extension+++e1e9f9b7-bbeb-44f3-a006-d735b77d964c\idb\2325712684IbDdB-FBiDl-eesgSatro.files\32

MD5 3198a379d2fc3e3c2602635fe7d2da84
SHA1 56f804e0cc42ce500e95aae709e1ab743b1af20d
SHA256 f55252a5df6dc6098e430f8bdc49a1a78bc7ccefffe72702f4cb1ae8063e3fe8
SHA512 e73249da2b7fb57cc1c9ac3f3a922e5cd01eed3dd100a59858683d1188731dec58135ef5164565786dc761a96aa063bd108082e60230bc1e19d3c75dfd184ec7

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\storage\default\moz-extension+++e1e9f9b7-bbeb-44f3-a006-d735b77d964c\idb\2325712684IbDdB-FBiDl-eesgSatro.files\33

MD5 e5aa4f072f7a3b35bb2c19fa204f156a
SHA1 55c7ad6fd92d568935121c71e449666e8f794ac0
SHA256 5c93fc586ed7da679d3149a829bca7f15f650f9b647bc0c17cde69a13f3b794c
SHA512 dde75ccddf04f0540c7b9240281d3c56fb95b188936ee9d078de57c4000dfca1178e816981bee1439e94155c2efc94bd686c747be44b04741a4ee9fbd1461614

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\storage\default\moz-extension+++e1e9f9b7-bbeb-44f3-a006-d735b77d964c\idb\2325712684IbDdB-FBiDl-eesgSatro.files\23

MD5 79d78a6a8e3948cc9d3f63a098261f61
SHA1 19e68af0933042e8787f44ea190cdc3af34a733e
SHA256 be0e6a760c002377e3806aa44007325c76ee47ede914df7b68c0493422503fda
SHA512 dcdc4178f4ad464dc2ff965a025b776f5da9045161a933d858b590202f5403bb5c757509d89b9aa47c4d8ccc7a5da5c91a94c35e96f074aa06714a40df0f96de

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\storage\default\moz-extension+++e1e9f9b7-bbeb-44f3-a006-d735b77d964c\idb\2325712684IbDdB-FBiDl-eesgSatro.files\45

MD5 d7e4d086295a744106107a76984d8103
SHA1 25e2a07173b1f2e29d6eb34816787a29fc15eac7
SHA256 5193d248934fd81bb92c1d37070f7b4d777c4c309d4c826a6d1400b867034f3f
SHA512 f5574c14978889df2b90efd00eaa1e9a1cf16ab5e2c03b726b090ab4230f5f9c4747373a4286012d26240bde8026c6822614140671604a09dba786e5a516c99d

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\storage\default\moz-extension+++e1e9f9b7-bbeb-44f3-a006-d735b77d964c\idb\2325712684IbDdB-FBiDl-eesgSatro.files\25

MD5 c467ecd7d7c48c9ee90b495fe464b51b
SHA1 35a6229bba166f57a4a8b556b5441a6ca67f6506
SHA256 2140b50414e98586c53c4fcc3f959563544803f0e24d78372f8888a1c8bdab28
SHA512 b903fd9756325bdd777671948f94982a0a733b30f49fd45d6b1ff824c908d7c3caeea166bce97a722f657c656ed90f06d343a304276a37dd8117885208359175

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\storage\default\moz-extension+++e1e9f9b7-bbeb-44f3-a006-d735b77d964c\idb\2325712684IbDdB-FBiDl-eesgSatro.files\41

MD5 11ed5f68ea44bc17c130d915891c0ff1
SHA1 a26cd9200639e4b7040e71a5b9a2b23b1127b668
SHA256 7a294f40b9ff73641c05d3dfcb245a0edd0e638a157f73d7c9f0dc32bb83ed79
SHA512 d9bd3191119d841f4357edffd4b708a49259d532aaaf4fea732ba80c046d06362da72fdb4429535c338fd7e8df99b53dbae4b87fa58f609bbbf28049fffb14ed

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\storage\default\moz-extension+++e1e9f9b7-bbeb-44f3-a006-d735b77d964c\idb\2325712684IbDdB-FBiDl-eesgSatro.files\42

MD5 c7ac4b687a1aa411738a812e72355495
SHA1 d852a78f30e926ce0add819024e25beabd33ef68
SHA256 d0a7f16caf0ba825d9f63133e43ee71583f1f8caa9b8b814e22713c9765a4530
SHA512 f3f5194d88bb6f6ae062c3ef2ae3120d9a16fb4ccab547fa75debcc5b3b024be2b565db325bd683b3a4ebc04ce46c6268922417558538f24a0ac50cf8e185ce1

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\storage\default\moz-extension+++e1e9f9b7-bbeb-44f3-a006-d735b77d964c\idb\2325712684IbDdB-FBiDl-eesgSatro.files\22

MD5 069baba2d7fa33100279d3db60c0d720
SHA1 0079b8aa32af49ce182346448a1835838f31f53c
SHA256 42733120e1ab86a7bb2bbfe527c96b92cd8a5c642b676e7e6d4c71e1bcbf211b
SHA512 1497b7ac5536caf0fe6042d2a2a2691e091d9a3abc369468143d2431168a7747c4764890862e1da3cdd373af74268c223fde0123462c209defb15bd4e37ca517

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\storage\default\moz-extension+++e1e9f9b7-bbeb-44f3-a006-d735b77d964c\idb\2325712684IbDdB-FBiDl-eesgSatro.files\38

MD5 77e1c09ba980e126949c2a06378755c3
SHA1 50e3a161f0427b6a86bf0b66c351d72745a00af1
SHA256 d19451783be978b57a6fce75ae871fd0a1f92864b614597a90468e550a4631d7
SHA512 afd88531cada13d9a21acadba354a03f2ace21202a34699be72488eeca7e55474a4bb4d47cca89d6a1f6a149ceb1706bb211491f1b42a883963c98ff402d648e

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\storage\default\moz-extension+++e1e9f9b7-bbeb-44f3-a006-d735b77d964c\idb\2325712684IbDdB-FBiDl-eesgSatro.files\30

MD5 589ee1dc4aefa6912f44e4c1ee5007cf
SHA1 9772810a2e3166a8349173cd98a44922b9027545
SHA256 19348ffacd31286b513ff29f0174b1efc99efe40ef3c6efdd50b4dc4a1527c6d
SHA512 f849980880b5e76ce19cca89f1fd72960b1639f297ff97b7f51c40f9f323c134113706e98e66303affea727169839bc49fae8a557e23f2d266ff5b24b6f6ec6a

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\storage\default\moz-extension+++e1e9f9b7-bbeb-44f3-a006-d735b77d964c\idb\2325712684IbDdB-FBiDl-eesgSatro.files\20

MD5 ca2d0dd276223d7c57f73c41939aa4e0
SHA1 7985715a9dd99ad765cfec6ddff93203e243226e
SHA256 d36ef5bf8bb766b5697aa30f9e0befadcc9b6f1b33f4c83e602d4d21cd68cc22
SHA512 e42356770f831c5ebc8c72d0721f1de4402e6b4666e99fde6e7e3d3bf92af97037bca4199fabad4fadfbd8c5636fbb20d1085c03fc3a41c97162b7b217ed6684

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\storage\default\moz-extension+++e1e9f9b7-bbeb-44f3-a006-d735b77d964c\idb\2325712684IbDdB-FBiDl-eesgSatro.files\31

MD5 981bd7fd430f125fd6b99f68c294c243
SHA1 cef615e14da21ecbe27b2a005e5d39ffb4c06448
SHA256 0f05c6b92305aeb85b278160bf43edc4124dc6020a32032d7f87cd5719dc452f
SHA512 67cdf9feb67678045bc567574103872a632288c293bd46895bedc8a3234bf2decbae6d18be9a98e4f8b92f2596057baeb2dbf155575af37c150c22a54b116919

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\storage\default\moz-extension+++e1e9f9b7-bbeb-44f3-a006-d735b77d964c\idb\2325712684IbDdB-FBiDl-eesgSatro.files\43

MD5 310c8c8ff98a5e876ba36f32affdd3cc
SHA1 9c49bed3f57a3cf591d19048a5782a3168fa58fc
SHA256 04e977e8e08629e3783fb1dd10ddec43edc2268273b7ba068603e3a840ec7d07
SHA512 098fcf77aa19fda6171364a369d2d105bb008b54a649f3a13ee35ad2ecdf72d3481582c7acf6beb727c33a5accfcef25aca7af1f55ebdb4b4be91f05810fc81b

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\storage\default\moz-extension+++e1e9f9b7-bbeb-44f3-a006-d735b77d964c\idb\2325712684IbDdB-FBiDl-eesgSatro.files\46

MD5 f2936a570bf5cd6f65d7986d49260091
SHA1 dc88568b0821ce50c37db95fe47d12512c032207
SHA256 07c39de29ab3b54a24bc03587a9e99abe94be5bdce8a6db3d46841f0c12dd25b
SHA512 184e188f09e921782e748a6bdd9468533655b9bd5fa1c88a9420063da3e3333ba71ec1a5b6e944d5433de43c753cf4f444521ce12b8e21fedbc06410fbb1e984

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\storage\default\moz-extension+++e1e9f9b7-bbeb-44f3-a006-d735b77d964c\idb\2325712684IbDdB-FBiDl-eesgSatro.files\40

MD5 fdce8db73952cd41e5feaf5177207461
SHA1 64514be34e2a87e794b12de8af589d59257e6127
SHA256 73361690b821c6424f07862ace097176f5ad0fa67ee524213ed4bcde44bfd760
SHA512 aedc3cbbd6985d9d172babe73ad202ccd7ee9e474e20a396bd0d201b32496e63b34a60a8074ace8c92e6483fa766f39c8ba0a031d57eeb46977b1a69e537f50a

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\storage\default\moz-extension+++e1e9f9b7-bbeb-44f3-a006-d735b77d964c\idb\2325712684IbDdB-FBiDl-eesgSatro.files\37

MD5 b526c6147a5bc35823c36caf93433bb9
SHA1 c791f8f72bdc2d9b2e3387db28a571acfd709c74
SHA256 4b661da092c61ace2930100edc4f7f4156e0d485144757c54f69cfeda7f2e38e
SHA512 4c53994390b86b7830e0238bdf167ad5be33832a394db0aa249383f0c4cd509872340c82612c7e14b9caa59c9374b010a902e557de9f4534794364e4c86490d6

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\storage\default\moz-extension+++e1e9f9b7-bbeb-44f3-a006-d735b77d964c\idb\2325712684IbDdB-FBiDl-eesgSatro.files\34

MD5 d28b27ca195a8d679317d6b9783f16e7
SHA1 670b3227b1599db6cffab1550720ab8500cbebaa
SHA256 f192c3caf927dfbf7572c093887fddd3f5b6fb147c0f2c991dd59e3b564b5f1d
SHA512 3612acd14c95f765f58dc22b5a6b5f3410920162948246780edd69667cc278d8f2f8533dc26c18625f1cc9453c6ab025b547349bd3b305e1741ea3265ee2750b

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\storage\default\moz-extension+++e1e9f9b7-bbeb-44f3-a006-d735b77d964c\idb\2325712684IbDdB-FBiDl-eesgSatro.files\44

MD5 597cfd809a6c3991a938ef1f607bfd73
SHA1 498fc9c093fc0bf6d158bac408149ec5c24f4c55
SHA256 11332f5dfbefea0895802c4adbef3a5c1a0ff589949019ea8dbffd1fc75b01f8
SHA512 1f1db1e02012352e6e6fb1ce1ec48c20ca204a2605f3040c84b2edc34cc12c70ca2ca6bdc5da1fb2a70d48509bf776c83f37cc5c480366f46ce4df6f0e60ed4d

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\storage\default\moz-extension+++e1e9f9b7-bbeb-44f3-a006-d735b77d964c\idb\2325712684IbDdB-FBiDl-eesgSatro.files\28

MD5 134070c2d13007dc9eb294e52162d8ef
SHA1 3ed2c3fd39be584ba384691979f7db4e025cc6e8
SHA256 f35d227a691cbbaa202fa9a34748d5c554c6a0f80170ce430ba4a2ac03edc1b9
SHA512 5c85760f0832bd32a2493eec1587bd7abe6bc0c35f4aa6ad2fc5813b4b83fd91d989238a305915b079672477927984d8537334e316a8bb6f302787ee95e5bb5b

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\startupCache\webext.sc.lz4

MD5 1d2834ff890d36dca7f9856d1180638f
SHA1 bcef28e8e04861c01cd819fdb073d9cc48dbb26a
SHA256 102b0e0a59af89d60d539e2076e87e8c15ab6c7b5bfd7bd7bf91df65a5088737
SHA512 7d8598f7074102b25c2b4af5d6a13681af1b90619811a4b856e2de2e18d6ce32381996428cc44af0678d4f76e1dac496e6775f6d96e423c498ec41b6d8b55aed

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006b

MD5 423885818d67bfcf00e21be13f6f3a71
SHA1 a79144758af1204bb161fcd79e74c1f692afb7a5
SHA256 5bb552beb00af20a3a39660decabba8520cf53ff43594d1cd923f9217081d169
SHA512 99343f25ec96fe803d57a1787ceff649a5350de6e5624990214d604cdd6cb3a4c5a8c069a024712c83e70ab91424ac1ac1f7d3c7e16f9fd498342c46ded593a2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006d

MD5 56d57bc655526551f217536f19195495
SHA1 28b430886d1220855a805d78dc5d6414aeee6995
SHA256 f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4
SHA512 7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006c

MD5 e6940bda64389c1fa2ae8e1727abe131
SHA1 1568647e5acd7835321d847024df3ffdf629e547
SHA256 eef5dd06cf622fb43ea42872bc616d956de98a3335861af84d35dbaf2ab32699
SHA512 91c07e84e5188336464ae9939bfc974d26b0c55d19542527bdcd3e9cac56d8c07655dc921acaa487ed993977a22a0f128dc3c6111273273ff1f637b20bb56fb6

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006e

MD5 1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5
SHA1 6dd8803e59949c985d6a9df2f26c833041a5178c
SHA256 af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725
SHA512 b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006a

MD5 cf2d86b24b1e5f44953f183e05c970b4
SHA1 a8b639da353b80b99dea733cd24e1b562cbe21b6
SHA256 ca128b01db8fdf7397b9ba4a5dc21e3349be348c35becb79aa2ff76669bb8486
SHA512 895092fe5106a26cc9be5c6f9c0b4a00cdf52fd6c044224d3a9f2c16107bb3e92fad6bac6b3e803628fb03667bde39269c2e6c9b8215e85f29140d4982d5592b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 eca0fb2cf4e6f575b6b5ff19e293236f
SHA1 210018721ec1366110b2240465f19ba6f2915409
SHA256 e016c692a810879f892a00a1d96ed72462e3e100a206195ba076d17039f76403
SHA512 5ca6bca7e4c3e9bae2f37d26ba0d59d3c8122e6a90973aaf59b3279cbf1f6c41a91f6ee00136bf7c25252e30ee07a5ceced59f147e21e24ee66e5d19206d6882

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

MD5 5ca68aef9fa233d03f3916ddadd31bfc
SHA1 707e5cdf64fb92f1c1fe50fb831947f59ab93336
SHA256 44bd9df0e63ab654488715ae7fe3045d75d6d182096017b777b3ce18ea022ffc
SHA512 1c6644fe6f5a5a6672254bb35027a4c327bcb15b52d6d1a4d46f6005b41e60e6c97695246e91eb2cef96694eff290ff1988ee5e115e219ab8f1ca6e226741775

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1488_183777469\manifest.json

MD5 b0e549dcc425951a670808d628ab5181
SHA1 63c37e4fd9193836f0100cee2bf76585787ae94b
SHA256 b2c8ee75956c3bb7ea6865137c441b916badfb99c922c17785875e784c96e29a
SHA512 d6dc7c7ddd5ad8ca06a831faa6bd399c8af77e0b21cfd039c608f366fb54b8d4553fc8f947a070544f472966190cf1ca5a236d1084be824b06684b6c6e8de0dc

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\24.0.0.0\ct_config.pb

MD5 4fdf7c8ca48768f459c97b25fdd10d9b
SHA1 d1f0ac34a53294875dd7bc03dfbdf5c7ae65a4d0
SHA256 6a350094ab9a19b758f6660a58afdecc44e83b3ce8c3521fe3b831d5945a3911
SHA512 7322c942946b83ed8cf8875613f72ab5fa5fcb4ca1671bba22bd02404546f8ce099b2941cb0897b3209aecb85b6ac2f1b98f2d11678e5304b55ae3974192042d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\24.0.0.0\crs.pb

MD5 916f38644626b7201f29c01bc659525b
SHA1 c259bfd1ccbf1347b6a0bac43e7aead100ca7092
SHA256 8ba4acc8582041e5caa5dc4c73ade421b52a8b018e70f12b7a1437f74c6a955e
SHA512 33539525ec8bf13ee832365994dd6b3bc2162ef64e032baa1ab6e45d701125d08009504c254e85b763b69abd93f10366a4b44e5e62f7705c988c089aea447d19

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\24.0.0.0\kp_pinslist.pb

MD5 563bdb2192acf2c106832f696df5d84c
SHA1 898eee38d08e09254c39dd0d1707c98f95cb2fa6
SHA256 2efcd280779456d767025a4f2915012cb9b11af2b8e199d3f32152232bf09460
SHA512 550e3dbaa0a5d74763465318b6f14035e16e1d70602ca36a5636d159875b527fae51f0c7f81e380797b4871283dbddb964017e7a16857228a621284d7aef00f5

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

MD5 3759a686f3e683e04389fd4469b8d87e
SHA1 7737dce4cbbe9bc8839affd5edbf22c6fd320cbf
SHA256 a6dd799d6c5cce179a9285df27242a61843a712f7f41b5c4f4606e7b1edeb8cf
SHA512 e92cb3e55e7451a01763026ded939dd8f92460ff943c212f77483fdc549a63474c2a608581e17b49d01b0ef22a4dad7002c10b34ea69fa9e27ff2f187713b219

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

MD5 4342eb014b4a3ece03cb8e13ba1ee3be
SHA1 a14f31ddaffe812eeab6e29b2ca168b7e7dd74d7
SHA256 45c9d8ac998b05084397b0d102877f0f85e9728bea0626d8e9e44ea6fe8d4a3b
SHA512 0fb1f95890844a1b4fa4f8a6c1c1907e4602f3b405b68bd98381ebb304ba21607e0bccb7fad3ac3337fa094ea6a7ce47ae28fc0f185973ceefc098916b31683b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\bojobppfploabceghnmlahpoonbcbacn\3.0.20_0\db\mbgc.mv3.easyprivacy_ff_1.json

MD5 dedd1f9308a621a5d395d55d8527ab97
SHA1 c4fa8e55eed51f54bb732e332c71a11701a668fb
SHA256 b4b7fa26d008e0a832219974d5703113dd4364a2efb862d9489b5a512536e9be
SHA512 ee286578f76c3b50360f88b1b30f6c5ebfe624bd637a30330cd7d16f1780c83651c098b9e31faf5d19cddee80b8e0edb9098613c2ef23f19f15d7d341dabd5f8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\bojobppfploabceghnmlahpoonbcbacn\3.0.20_0\content-scripts.js

MD5 a69b64fcb7e24c7258a2bbfadfd433f4
SHA1 d7258967b59b54bd1a2fa7a5145f48821b411bf9
SHA256 65fafebec7a2881e84f82201a94bdd31d6ac537e5ec9cc95eeb912a55f67cfec
SHA512 90bc94755ed65cbb442ea5f928aa7b0cc614d001f4f08f3ab1c80fd4eb6a578b8bcdf3a0180ef12bd1c49792ff438e73c68d0e800f7881cb521d62d544bd9541

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\bojobppfploabceghnmlahpoonbcbacn\3.0.20_0\content-debugging.js

MD5 b5a65b6f58d4ad57079cc4519ac9ed79
SHA1 0e6a45082fad0f60979e6f098b83a979ff5cda72
SHA256 aceeb6256f1e0fcb984ff03553fd24abf06a8b7d7560585b589f89308a134c60
SHA512 d32a2f425b83527d1ff1868456296cb54238a33297114f15c06be26adeec326cd47eb5c92186343685ad9f043027c0bf9fc91edaa6c96634b239c01afa57d9d9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\bojobppfploabceghnmlahpoonbcbacn\3.0.20_0\injection-tss-mv3.js

MD5 c6f341ff988b9541a2399091d8ebabf1
SHA1 825e8ac10d626a34156328d2fa82154e2758dfc1
SHA256 dc185cc97b113723cfaa2ff66b9f2bdb4d869b1959671e3d22a0217a144bdf4d
SHA512 1a848b262b00747bb40b1aac96f9122bbdb103457b367b0d25897bff6ee7643ef75580798debc85b583e9a63e8fb1952bb8932197e4b927908d30adeec6960e6

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\chrome-extension_bojobppfploabceghnmlahpoonbcbacn_0.indexeddb.leveldb\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\bojobppfploabceghnmlahpoonbcbacn\3.0.20_0\_locales\en\messages.json

MD5 f120594c0c971dce020193e2f9f90daf
SHA1 72c18fac21ba63f27a029be5ee2b83599506324a
SHA256 6547f40c5b5ae96aa15e5ed0153129dce0651e0dc9a775aed7002cc49eba320b
SHA512 79fdfd5a6a577e6a1a6515689f6eee1434f2275a6eb3de3e52aaa48b8ea86ede282a0e0602b02f327ef8445f1c934588434c52776c75e206a5aa3d8616ad9aea

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\bojobppfploabceghnmlahpoonbcbacn\MANIFEST-000001

MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\bojobppfploabceghnmlahpoonbcbacn\3.0.20_0\app\assets\bg-icon\bg-favicon-16x16.png

MD5 94464c7c084783a1d397d2fc8af288c8
SHA1 66a9c48904e52ce23cd122fbe0ae368950329282
SHA256 b767f090475c376f1227389a8d4d84ac29eb46983df8a22a1138f3f345387bd2
SHA512 cf9cdc9453a865458ea0991c5495e1412d0f6f6df6bd06c3cd02e5ade157480e0e5917fedd79fc323304cc25798b368b35875e1e8b85a39e9d181b68b01ea1bd

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\bojobppfploabceghnmlahpoonbcbacn\3.0.20_0\app\assets\bg-icon\bg-favicon-32x32.png

MD5 1075d6b13c6849af208da4f68cc957f9
SHA1 c83276fda68ff1c140c5048941d5a1e6e8155bbc
SHA256 ccf2df7df78d52d191dbb1fe554b129327f55631bc2b7f092c2d0f847aeb89ce
SHA512 fe84a6f22215e6761a82f404857e9465a4059dc7cd107de36090a734573b8d9d2e0b309d824d278fd1db4668fb3abbbb7800bb772bd209bd9851705bf32de602

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

MD5 966849317672001fdbcab7634fa955d7
SHA1 cb9ad26f9050ac9406bc39590fe233fd8a02cb86
SHA256 fc3db21e1fa22300b450b2002597e1717028ad0f41f8708f5969a6bcc0521b73
SHA512 e95db3531691050eb5f0c95ace2ef91e34ac1bc1bf7b08d3109446d3bc430c452d0be4d2687f7cc119a973375b9d9fb18e4caeffb09cf6981f59abf0b22f47d3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\bojobppfploabceghnmlahpoonbcbacn\3.0.20_0\app\eventpages\welcome-dark.css

MD5 faf7ef40c1f5665339611943316184d3
SHA1 33d3b901d79d9f5dbba890d209cd8480d469ab06
SHA256 c772b79aeb49793ef353af8c593ac881f20f42821e0235c8558b58cf51c24b38
SHA512 70835d85b98e10ee50206b2e6ceb0fa92609fe2b473ee5c8458784a732f48eb05552666a3edbbc13bf1bfa238d3c0af799287e74a0dbc01cb24419574ee81f30

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\bojobppfploabceghnmlahpoonbcbacn\3.0.20_0\app\assets\tooltip-black.svg

MD5 7fa6ff207c7ee40d20e8bcd8106fb3f7
SHA1 536e31442aec3b14845ba1ce6d3ba2d67a051421
SHA256 318f6d36200609a8f82e336c7c0eb5627a9e970c67a1d3c5e87690d26097d5a4
SHA512 787cd6555279de9b3edd73180e547a6ba4863a10a81d1de562e91ae9a40767c9b15198c9d21e05250d734e31ac22861ce00e0cf06de08a1d9f6c1631c23d3538

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 3e422fa5f2c3cb125515b51df6ba61ab
SHA1 d9203c8050a94c27867e05ac15e0cb868ab3b549
SHA256 8956364ee1aa5b194a6e8d5d49d6ddcb3c39e1007fbb17a1387e16954e4d1437
SHA512 b81bbfee193bd1926ea24aa2014b5ba988718f28fcce6a36b4155ac38f71bb12d787176dcd3a22f9904ca72218273691e261f34c0c560c12e45eb1611f02fd97

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\bojobppfploabceghnmlahpoonbcbacn\3.0.20_0\app\assets\level-up-illustration.svg

MD5 654530887587ea6c25496619b01c6d07
SHA1 3387fc1420016445a51dde530582a86bfd49adc6
SHA256 9d4425b5d11cf9476b72a37b836d23d6bf340bb4648fdc7fa0d443c6987a7b6d
SHA512 4ccadb00a920266eccfff6c63af10eb09259aeb26b1fac71bf246c70a20fad08eaacd4d751959ee6e474481cbe5915b56e68550fce8fe46e3a54e07d0a2185d5

C:\ProgramData\Malwarebytes\MBAMService\config\UI_IrisSettings.json

MD5 d8d2afe6a51a8a17d51a0baeb6f1eb66
SHA1 8c237e9dc93dc55ff7c2fd891f1669fdfaa15b71
SHA256 1f9076934c846637dbc4c7e44780686d65bd4f97e27b281079fe8a5c721d95a5
SHA512 b7d48a3e35948c4950b475bf3fee927d90b5dfa6ef3f2cc0a0f773c6fc1b3c2b2b1410b71ec1183994542ef5627cde36da39dea79c8d58bb29a47a0afec953c0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

MD5 0035b91c7b45caa22fa7832d23dde05b
SHA1 fdfe86d612265ea4f6c902694e261deb875975d1
SHA256 9ae1749fdaf09e70c85b7a20f6d9ae008119cc7463a99f6cc974105e64ab1521
SHA512 88aa23ddf68d61e002de4553c2d8ef317d0dab1a663373b6011c21641276b75349161300aaaf4fcf8c0daa67ba0f930c17e0e29ab18595ead4ee9531118e9deb

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\bojobppfploabceghnmlahpoonbcbacn\3.0.20_0\offscreen\offscreen.html

MD5 0d45527873feef87a0c48b9b9140ea1d
SHA1 12c2934009f852776b7a55a6cadc8165a682474f
SHA256 427829a4f6db12b889e6d2472a76fa016efa2384b8f2b0b41e20604b0895cb6a
SHA512 5a459b171f1f50265aedac29cb731907a5050813805c36956318f59d9370b4f544e92d866481044ee2230b8bf1ca05ce45f9829d8e077916e3c119bb398c82f3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\bojobppfploabceghnmlahpoonbcbacn\3.0.20_0\offscreen\offscreen.js

MD5 79f4c86353e1df29fa8eae9c2b383a16
SHA1 8f7beac13df43fbd94437cbdb3d558cfeebb0649
SHA256 d4e9e1e92cf4be3b030488b17e42cbf1065b3b831a9d5b010cebdf3f42551098
SHA512 9196b6f9669ad857386c873b040f23ca82be7f1d7c6f79dc09c68c30fa1911606cf7bf270e81767f0f9de7ec07ead2bd9b05f4527b7b40bd0147e616800cb755

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DNR Extension Rules\bojobppfploabceghnmlahpoonbcbacn\rules.json

MD5 92dfc7067413482c37e84d542ed8485b
SHA1 902501059fb0ab6dd99cec9a9ef7c52a8a208aec
SHA256 9d626e34ae2b2dcaa5606a08382d9c7baf7fcdb710636bc8818d22751418ea54
SHA512 ce26c742fe929cf8893f5e44dbc7dec91a5fb9b1ac77b0db2266f2ea5a45079fc5c889d57a3adc94d082de95a519af1b2fb64976c3d23e3f99443d9fe0236b81

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\bojobppfploabceghnmlahpoonbcbacn\3.0.20_0\vendor\vendor.js

MD5 2cb4b23337c33b72f7a7c7036e603080
SHA1 0cc4eb8f34bf88444eed0b205d523e94c231d232
SHA256 6371b5a5897988c1ab79cd266a9f3ce992191f355569b14c141ffc9cd5cd8f6c
SHA512 b37e2e03f1424ff7003bd6055254dd7e94adcb39a7879f0aa998681dd5dfacb6acff776f4143ba1574d564c15a68b68346fbfe9a08ddbaf021df4db603af3bae

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\bojobppfploabceghnmlahpoonbcbacn\3.0.20_0\app\assets\browser-guard-logo.svg

MD5 e019798930e3b334ee9c40f06b17c717
SHA1 4b407f428d968268887611fbee28c7284db08056
SHA256 49367283b835f8b4e7a057ba606cd7fcb7a1bb24d7a00082c3f73e8509de7879
SHA512 7e46f2c41fc16887cde19f8e86c196637bdd5f33ec384f3e5cc435d6b06101c29781f36ce212bb5f78967e870a2bc342ce333d50fed19c83543e5c8681544ff8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\bojobppfploabceghnmlahpoonbcbacn\3.0.20_0\app\assets\arrow-back-light.svg

MD5 40c3547cbcfd2b62e83c7d4569dc3e48
SHA1 dec17685ead5db29cdf70c02ad6b489280d0fe26
SHA256 bf995d63320762b2ab0d33b26348b1b6c0599cb6f9cfc3a3befd42bdcea32a0f
SHA512 a6409ab0b7d05dba3981e93d75f23fa9aff59ea8b38d0931f625b56e47fedb7743e8160bb8976c1f1c011f3efb63b24eb2c72e301a16b75f4cd25a545805d06a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

MD5 1922ebec0bc5606e68c5d4dd8a284f0d
SHA1 1bf0fccd9a2052b7f71369e70a8162faab51d8d0
SHA256 9d03bbfc2ccc495e2f605dcbb6b895f38a03a666d0d46a4e5435a63501c13ca2
SHA512 dc0838c9870296a35c62d0e5119311f5ee4724a0dfd7eebb8dffc91d4b9faddcbdb5b1350a88a869b4497a8ea71ee3ccada2addbb71826e2aa08f9ed0763f1d3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old

MD5 8878ef8a6c0395bb4362e2f4bc98da8d
SHA1 fecea03df5c74be4a8ae3dd5bd8e0ebb608a4a53
SHA256 17ffd67b425e37388205cfa7420f424dd0bd59cc0162faa288cdf064c2458c84
SHA512 8c995865b1fe4f67bb2a94a8ce51b9846ab5494b3180cf160bd99614348b63747d8a88c96ad4a9cc33485ee3e196cb6a75e548c6e175300161723c4e768eebbf

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001

MD5 6567f9952f3ce901f4f7d902f5ecce4b
SHA1 0324ef45eb1b0471c2934838d9dad03f4e3e5624
SHA256 d412734531c594078722a99f7779e5524c440ea35c9617ee3cffc4e58dffb367
SHA512 5b3073340162825937675ff4a04d9f478cadfa2490b9ace87e6bed5c128544d818105c72d85d180df6f7d9d2802ab8ba82368fab0a83fcaf827ca9490c0c0fc5

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\datareporting\glean\db\data.safe.tmp

MD5 5eba445f6ddc75ed97c4ab8ef422ec90
SHA1 8dcf51e2ee6b0d95d8316554bd1932cf49b23009
SHA256 665ee8299fabbff0220c233770a49045904f07d5159f4bacc27ba27a1bbc7ae4
SHA512 afd8136323e3e94a085d45585e8125d2eae8332221141dda178a970186b26bfa5da46a1faeeca8635a78be0621b701070dc54423c8cd7556d101df403a3eb065

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

MD5 111ac3f5108fe1e2a158eee9692d729b
SHA1 8d280236555a98777b6bb500a1bc79e2fd2c9c62
SHA256 43f95e91918baef1c199fb221bb56aaa512e875e375e8f31d2ca1ab2453b6468
SHA512 25a2d4f128a6333969027e8a6ddefaf8867f53c525f83ef7eae067b1854454d6d943909801b3c5800b6c4dd04fd8055ea62d7166af44eeb17b29390cb5325b4c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\bojobppfploabceghnmlahpoonbcbacn\3.0.20_0\injection-topics.js

MD5 24a574eaabdc3cdb2c18576cc3cf2efe
SHA1 965ec031b68ff9a17c4868bc3e9f6c99fe33153d
SHA256 bec1b0421b44b4a769c1cf8f2bddc748429642924b97e51d706bbd65889b6abb
SHA512 86d615d15ee733f6ed6d10a73d1436295cb84eddd4a8b1a5aec9ecb2d2c8e292b7f3b9b32f1a8e0bf96da55b3208339ba6441b9e4113cabcc14cf6a64d7df7c4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\bojobppfploabceghnmlahpoonbcbacn\3.0.20_0\app\content-style.css

MD5 faba4a870d9fabb6fdb5b59866404db1
SHA1 ce14440efa1fa54e045d333873303898b7205dd7
SHA256 960b642c556f39926954b9c512ed03a8394502390ee4d52cb971a42debb227cb
SHA512 28691bc27fc52c7802b607eedba488c1e2951e84a29c379901dd93784ef0eee9e63f52e856a6f6be47d380da1bb567f238992653f6da53a7247c23c7b8303ffb

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1488_1020904075\manifest.json

MD5 811f0436837c701dc1cea3d6292b3922
SHA1 4e51a3e9f5cbf8c9c96985dabe8ffc2de28dae87
SHA256 dbfb38a16e33a39c35ac50bd81782e4608be14954f1df69ac8272c0b9ce87a5d
SHA512 21e7bf2f8333b2900bcbcb871ede14684073249597d105095dc7d3f101e7ccc326068732f11d4a167365f245a3f2205793f520c7666d7f948e70919b40b43d35

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Well Known Domains\1.2.0.0\well_known_domains.dll

MD5 f5f5b37fd514776f455864502c852773
SHA1 8d5ed434173fd77feb33cb6cb0fad5e2388d97c6
SHA256 2778063e5ded354d852004e80492edb3a0f731b838bb27ba3a233bc937592f6e
SHA512 b0931f1cae171190e6ec8880f4d560cc7b3d5bffe1db11525bd133eaf51e2e0b3c920ea194d6c7577f95e7b4b4380f7845c82eb2898ad1f5c35d4550f93a14b6

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 97a40237a02b7c30e460b77bf3c6259b
SHA1 ebad4888865bb8cf4f516f9c9bef33a36b79b226
SHA256 9bcffaabf4c7d0819de8a3d5b793b2925c5869878026e43af45c32ad257502c6
SHA512 736c3c2acc3c11c4bc9be8604372c979fe832d7b2c02b6d7fefd869e8a79a0d5ede715891252b82e4c5b993a16e967c3ce0a45a05999a1271c9581307253d585

C:\Users\Admin\Downloads\jjsploit_8.12.2_x64_en-US.msi.crdownload

MD5 d8be6f14b4dd7a85a5b5479e88b940da
SHA1 4c1ed04a00fb4fc31cc4c10172d0e6f310faacef
SHA256 c3daa5b6503c601bf868de990dc5fe055c266a7cba6e269115290c37fb8a4d05
SHA512 77964855eddaf57ebf7810185eacf2bd40bfdd883473ac063223ea496744d81db678c171707d44cfe19077df1fcfb8888a54021fc6af7cb4547dcc464ce717ea

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

MD5 f95585cbe92dabcb195a0f48ebaf465c
SHA1 a13542e5eb59c55b1c8140292e9399bbac7cab4a
SHA256 acc99a0c1b6a9c577526a76af4521f63256e76efd2b7c8caf39e683a3ab581c1
SHA512 161ab8e64268fb9aec14ade7346b9bd1d77bd11e975308a1251a68dc68f2f9614c0af57e55898718cbf038a450ae15432b71c73001a58a41b7696f6ce4e662d3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ac01df32-88b9-434f-b6ce-94d706338646\index-dir\the-real-index

MD5 2549e62c7bed95b6dfb0d8e5df49dd63
SHA1 1099cca4f3793968a6181f3e15873b1dc5745f48
SHA256 90aa4a1f5cf23b4b215cf8fe1d5e0c10f173b3b2cdfa92f48d43b96242399e36
SHA512 8eb4fb45dbcc6b2682bd96717beeb8c4c4465a3d45d683ca4460bc71668e4d506c0895dbeef2d22b67957d314cc35796bb22f6bf5cfaf49904bc66e340bab62d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ac01df32-88b9-434f-b6ce-94d706338646\index-dir\the-real-index~RFe5c67f9.TMP

MD5 a50c92ec59deb979e23d883ffdd677ad
SHA1 28bc8c92c23caea81357c7cbd29791f9cbe796a0
SHA256 5792c89f156bcf2f82fca4a64bc1f90e54351f95a669f060663eb9f028ac3196
SHA512 5d17bc9942138c48d2b7f176a24d07028511354e4fa0a5245b289d90384a4f9312a208bf2a545ad73d5d7c97708af92ef4e9c85827529e77be5ad461a41f6859

C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json

MD5 ebfab13dd60fe403680b0384a2c07025
SHA1 44f777fccb9c493bb840842b424e2797ebd55424
SHA256 07c7f1b452c376ae1bb896b68d2423eca6ef2e693f120480e04363fd4848efe3
SHA512 4e318a7120b178274ed02aab1fbdc45b889d942d07b6d0e8134eb407cbf0435c08ada0c1fa09bfc9675a932069980cd18401b8344cbab024c10da14526478539

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 7674b7b924da8bd838a1bfd7055cedce
SHA1 12b50b86536c6484bbc0237f9eea81a72940733d
SHA256 85107ff8167b5f7c5d18e21e7e490ba5886fbe795fac37f1656ec06a62b3f31a
SHA512 cf97cb6320e7047a88c95474ef915e01838dc8838d69bdda278e2b4780c64678f301b3e86fe683814e697745598aac1a24431d6b7a9886ac5799291accb329e4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 55985034e8fafd70bb450863f7255479
SHA1 182866ba8d3cfe53628e06b6c95606297182a7d6
SHA256 ed12f80c718d91cb0282adda74e63b2966e37776605e5bdbf5dbb4c84f38f597
SHA512 1ad55b6c81e8db4209cf343ffb3774d169b89ed45e953aa27c9196c0dc5efeaaef2d1b77d5cd0e72ce3ba50c59d3f0649a15184832491a485c6c8d1d71562eaa

C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json

MD5 7ca95684f79e6d4a3b553d071ceda24e
SHA1 14147939d1e2acb0ea3c05af90c4839a06232b58
SHA256 b62614164875f4c902cfe7ef705c224aa62712a9b2e81dcda11ebcfe02a8a8a6
SHA512 1e38ee1092da8d140c857f52188e8fa916f2add2fd947efdeb538195aaf1c2f63ade1be7cc81e9b4df2e6b2d460bb763348b746a226571db6a9e5c15ba5f0ce0

C:\ProgramData\Malwarebytes\MBAMService\updatrpkg\mbupdatrV5.exe

MD5 76650a9dd8117e99d36532aeadd650ca
SHA1 8f4ebba62b107d02f49f647a0ed8900e4cfe69bc
SHA256 2130a6bf4b955b8cb693ededf4f9232dbbfa3a730a2ddb48b97f4ac666ceecc0
SHA512 1bd1a78573da0540cadb663fa047cf8fb87ba281f95bb124a59f67eb32ea27b8cccc892a40677f0f369805282d3f990f0f9260a9ebfc9f437be342248f7f177e

C:\ProgramData\Malwarebytes\MBAMService\updatrpkg\SdkDbUpdatrV5.dll

MD5 4597fbe9c9da2695f2f1767714baf760
SHA1 e6cc5c9c416c39180283d1cd88d872d36c6e39bc
SHA256 f84932697d9bb893e1478cc31aa0ce8c94e20a51479eafeab507e00e227b1837
SHA512 a60b364b3a242ab4c9708b9ca8924331dea8cd37b1b05858ec6bc4b22ca07c211f23b7c85f8215632c431939c9a9a58f3292d5e6c67f8c45c472025422868d0a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

MD5 ec8ce373f2cf9ad50642a45a413d627d
SHA1 c2ebcb8a9aa31fc56d1a61d4891fbf1db3698964
SHA256 a588ebe640d69c76019406849518ccd342d0cb4a15fbd942aeed6b675f10381b
SHA512 5f0dfd18e139e35ebff57ae7337a7b366c5e6f6580b6f5a046b5f0d5b7af10f76eafd62c84e16e5da116609890bdb5cc16566919071938163f1dc27e6742d06a

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\jjsploit\jjsploit.lnk~RFe5c8d44.TMP

MD5 835bb38b376bf3328c56f5f9ad5e6a42
SHA1 44cf9131a9b8fefd3bc876bc84fcd83be1324d62
SHA256 b7758075d3cf02bb7f81d7276e134bcb20f8a18577a4db5b581d1eedd1a9567f
SHA512 aa7111f3c1dbe79edb24f058fbc59d1bcbeed586fd40c4fe62b426ece7a40d6fc6641ce4469c13276073e0256ee97a0af18b5a1861669000b2a1d4544c372cbd

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\jjsploit\jjsploit.lnk

MD5 831d3e9c2ef15882a31557d4a1150d50
SHA1 99eb53e17b99fae8c777581cc2ad02c9caacfd0e
SHA256 0f7f149242ef45a4dd01afa5049162897d5bb7217a1d91db6afc66a50937f717
SHA512 69951ddbae259501e13f878249c0aca9bde3956077e1abc8cb2606633c204c70895e167192a6dcabbb9846acd858e32316f6d33a6a8ff60bae0aaa1e7dab2f45

C:\Program Files\jjsploit\jjsploit.exe

MD5 b393f1b89a320d6a0b42190c6dcb6860
SHA1 209e800233976ec908a87db948b5aa175d99b1e8
SHA256 ca45895af0e91692514e6f4b8b494e68392821fa18503526243091d7d49e3064
SHA512 21be0b7a232e7182455206b13beada6e9614335a0b3ada9875a68620efc14f43723778910dfb6070a47ee8f177d02add1d5a2e60d616fec914a88b9ecb01f0eb

C:\Config.Msi\e5c8b8f.rbs

MD5 6b30edbf89003471630baacdacdbf979
SHA1 15da88a5b346c692ae1fbb8086cf02f0a88c099e
SHA256 95300a62922e424a8d2de984fe269ca2a91393e76b694d0cf0099a459860d6b9
SHA512 e42b018b20fe62f88d0369d3846d0e9f6eb0bc960686aaa5ae7fcebb53e6cebae624a9de6c62491ede1a9c1d57acd0c5ec7f9510fbef54544bc17b3a083b2caa

C:\ProgramData\Malwarebytes\MBAMService\config\RtpConfig.json

MD5 5e1a126bb723d2c9a0f7072c60c9aac8
SHA1 07f7e84d046b56325dcdead3489df226277f727e
SHA256 50211b1b1a8e00c5646a99c0cdcdc4e38d33322ffaf6568f48d4e25236fdf115
SHA512 36fb6197d035d687eec83c6113255f13d971e91aaba89b59166cb9401197cb35b10a0d9e5e29f9f301e1e5bbb3446f87559ce7dbb14d67553eb5ba389abde3a8

C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json

MD5 364a7314970a697d2d0767a6e433d524
SHA1 079aaa0d995818b76e39ff8a575221c869282a10
SHA256 9f9c8660cfdf48c8d4ba32b80fc44f95cc04a7476f40446aff43adc7eb39fb88
SHA512 acf3b8f79af34aecffbadc33cb23ee7b372bb3dab47ef8291ebbb253af7235f401eb0a8169622535078e5e9855aa11a284280992e77b6f21867b05bc95b05fbf

C:\ProgramData\Malwarebytes\MBAMService\config\RtpConfig.json

MD5 597feaa563982aeb711109c6a37c27fb
SHA1 fb3b9ed63da9f86abfdd3ca94790001dcfdd53b9
SHA256 72363eb5f05bb8ef4833ce35586ca976952a71f7218a910808a304f4c06eba19
SHA512 4d47ac9b91221a4cf6a12af4e3323f93f5dec44809383a8a19252c9bb1b4fc8b80f3655653bc9f64d28367e0b75efbeae5010a78c9d1f8381ded4ad7f7e651a8

C:\ProgramData\Malwarebytes\MBAMService\config\RtpConfig.json

MD5 342bd1ad38524ebdd7af8f8d0ebcae80
SHA1 c7ded486b217c61ca41657df56fa71c340908c53
SHA256 fc856987303db9835a9936ab470cf9c4ae55296f090ee2a8e62cc3770841d7f1
SHA512 170b0117b85dd7c09ffa27341d2a814e01e32d506cb7c6abe094f1772de187c5ec79e691cadc090487de5e4fd3d52eb49751d64ba20df924cbd8a558d314baca

C:\ProgramData\Malwarebytes\MBAMService\config\RtpConfig.json

MD5 2974d44b9024a662ac593ffe41c69431
SHA1 c826f289202b836b60c9716d6c667de45fd5f6c0
SHA256 333e9def75ebdbe7e518bd66f98a14f405e52734b0674b935f2607790a2e8a8c
SHA512 f0d86cd83d110ad1ebc020fcffce14ebd12ef7da389ac418f55295dd0fb255891cded66e5e7a05283920173138c09890bad4366e0a4980a9735efdbb8e179f18

C:\ProgramData\Malwarebytes\MBAMService\config\ArwControllerConfig.json

MD5 429d0ad71e433011dbb28d5e513c89fb
SHA1 f2825bfbeef477b9a2bfce277220606346a809e9
SHA256 545df77d0167715cc5797630b972819d6fd1aa9a28323fcdd1f026e5530b7d69
SHA512 5550ab64286cd2bbd706020952e181ba57aecd81a70bfd3610fcbfbd26fb64daa8c30ceda2a2dc2b34132e1c7577fc8ba4c50c15d78029ddc084ed77d940971f

C:\ProgramData\Malwarebytes\MBAMService\config\UI_IrisSettings.json

MD5 1178a7f72cef39801a12a39c4588c4d7
SHA1 4402a3397a5079126004ff881f6b16e7fb9311fe
SHA256 2b4087eba8f0140a60bce7e856fe4a9c7cb2500625ae20503967913f1ca517d8
SHA512 44efab2a488345b2e287f99cdc8a43cc2683282b49e3011584db5325d63b5a22dc66e28afe77e64ce040dd115e90a3fa548d573b9356c42bed05e7fd182a022a

C:\Windows\System32\drivers\mbam.sys

MD5 5f1edd6b0547827e758aae590440f0e9
SHA1 69591840c4c0be49a92933df9f2cb9fb31f7841c
SHA256 861f7b527f36d4acd8a60b973a48f89a17e6fa348e2f138b116e6f1e1fe52733
SHA512 cbacab7dd2bf1b57ebb39e137fa7a23ca3edb33c428230f94fe9c87b671b37964de935198e4e2098528fc971bb8c9b24366ed1a4b5cd22ae2b1b74b4a189d49b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt

MD5 663d4a452f8db98abc3b604b260d749c
SHA1 c3a619645315695f04520e364464620c2ba0dc86
SHA256 4dcd2b399e439be9f1734f512990462d2a05fe4b166598f41b1a009efc626bc7
SHA512 905e8442eb7dcae2f8c57adb6b8642e2e0cc399f069d7918dcf80eda0351718115d0b96ae30310804465e756548856ad5f383c06bb9778911ee4f19b8d813754

C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json

MD5 32381f2df4c477dd4cc4b9116d58bdda
SHA1 19bf2c642eddd74aae741aae1e14d639682c700f
SHA256 adbe6af09e5e13d2e07ec638b7a090a00009cf7261a795d7b6f81bd180f590eb
SHA512 b82c83085e3dbb2190ac3cfc7cfee23eafd9d6d292c90b1796a4c6d7169a9ddb554081a1a531938c90761af15a6f5e3c588c9a8f4a309bbaa06c351006138cd8

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

MD5 1502bc748a6b894f04422166cd7d9c4d
SHA1 15ac35083567f5c58449c34490fecb5247cbfb2c
SHA256 9c632b8203adc37a90a57514d477754550f97ac38a9b19277316fe966e40aeaa
SHA512 0ee632e83b534d435448ae3867f29267b888b397870e70b6a3776b30a4aae6b28db7645dfbab6abd112fbbc1d6920af9fa7e5395877cf7c7cc58db438f0957b2

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

MD5 9fc8c5eed81ba7fa76008fd165390669
SHA1 f9bc43c50032ebd7063f53f5740b3178037c0212
SHA256 b72c7edadd5d20142b8c04e233c813d3348cb1d92ab44ec936f26d1a2093b00a
SHA512 1e15084d7ef867ab275679f6cabea4bbf8bb03b556696d47b838a05d66152e1633ad6aae0f256f1041894a21ec6fd9091e67f9a5d56af42905636023a668de27

C:\Program Files\Malwarebytes\Anti-Malware\mbamsi64.dll

MD5 7fe2f24d9a7ecd129a033f2f2dd115af
SHA1 fd2e9350b7646c5d9902709acd3349cfede498da
SHA256 1dce9e18ab4b5a6ba797b59abd9376b9d7a1e80193d35986ea515619845e7220
SHA512 a030dffefce7c4426d01e09ba97698f74a03ca57ca6eab6aa2adc62abd84d195c1381d81a76a6855503c1965e19c4c702a586f8236760bbc1e431072ce45c19c

C:\ProgramData\Malwarebytes\MBAMService\updatrpkg\expapply64.dll

MD5 76a6c5124f8e0472dd9d78e5b554715b
SHA1 88ab77c04430441874354508fd79636bb94d8719
SHA256 d23706f8f1c3fa18e909fe028d612d56df7cd4f9ad0c3a2b521cb58e49f3925d
SHA512 35189cc2bf342e9c6e33fd036f19667398ac53c5583c9614db77fb54aadf9ac0d4b96a3e5f41ec7e8e7f3fe745ae71490bdcf0638d7410b12121e7a4312fae9e

C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAEBE581FCB73249406FC21094EA252E_BC0CE803EF41A748738619ED7838EEFC

MD5 5bfa51f3a417b98e7443eca90fc94703
SHA1 8c015d80b8a23f780bdd215dc842b0f5551f63bd
SHA256 bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128
SHA512 4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399

C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json

MD5 d6375097de4c231c1dfc3be49fc15ac7
SHA1 193cdd99cfcc59fa2dd2443fdb6635fa59dd9900
SHA256 4f56ed899c611114b7e418e95374c232c6ec84e8c7d71e60ebe0cae939dad3da
SHA512 78d43bad880cd5c5be6c9359097bfea1579c5346c24415426182e7cde03a22358aa521540c06b38af7b8f3b50c75dcf3eb9b22685a8f7cecaf820d371145b2dd

C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json

MD5 5786432f1bf010181d740bda85cec229
SHA1 01371941f4e11f9a9e990ff8b0f36a8697ee28ef
SHA256 77c1019a4a0a6276a4905c7195742af0d4adeb4853d90a8672dd41bd3d4cf2de
SHA512 a909a040d1e0b3d172e8bef609aae9801a795d009b46f51012a4ca588a69621ab80cd408e1df25053ce494348630d8d8da3af2ec47bfa4dccda8e86b835902bd

C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json

MD5 4176cd4cb9e5816c73c3c5d8a714cf6a
SHA1 4786c47b5bcfd1d5b26f5ebe48bf52725ca1b3bb
SHA256 3b2a8cebac66dabf837543ecc9fdda79d1e2610047f4e34b58595572929d4482
SHA512 279657e911e35716fb120bdf7e8e5199763c466d231a1c00ffa2eceff11ffc367e6a6e9cb9f3470699dea1be1f5579010f3176f9038f826c7fddc57913096c88

C:\ProgramData\Malwarebytes\MBAMService\config\CloudConfig.json

MD5 9c44b0274ff34a342e059a45f3bd0a1e
SHA1 cff1a309081d215f29cc65cddf26598dfd0daf5f
SHA256 3e076f286dc472c954fca5e4e35a9ed7feab82a5f9bb73be987241e28b7083e4
SHA512 e0176b9c960f28b045090946b183e65a390340c230842dd62f1f679bfa712c4a14fbb938255072119929ecb714867267892f9df885543b0a187f51e4ba0e5a6e

C:\ProgramData\Malwarebytes\MBAMService\lkg_db\version.dat

MD5 810e00bcc6d8748874ce18a08ebb38db
SHA1 c7f03f900a0056558c4a488abb1c4ddd3ce109a2
SHA256 7dda2f2b5d438166992a336d7f22043195510470fc8205b30252b9653762d48f
SHA512 b24df1b91b65b4899c316da09c02981d11a6dda6847af1df8539e29c9c2fa089222624610d7374575cad56a82526bc587548e993d909ae1c4087a9881dfc727e

C:\ProgramData\Malwarebytes\MBAMService\config\CloudConfig.json

MD5 0c7fbd5f5080b649d2f642cf00f7d7a1
SHA1 38f8964467b1a9c8b146c7396fab6edff8e2eee9
SHA256 ac3c433d02697b26698b775dc35af096ba1607b42bb5a287372514b4902958ba
SHA512 d69cd9e4dfc91a36651c3a403bc3753de121d27e41abd811b0fa5fa63cfee6426b549fc2281ec766460a547db6cf25c178b3e5ee51b8088c69734506fbc06b71

C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\59194E40068A745EF528E8E18DD529F2

MD5 2c75f13b009e5908b7ea3a1c7aff3422
SHA1 a397da54d54257048af59a36db8ae9e56ff259d6
SHA256 7f7bb4981d0cf8f438317bc0b8dbbec4a9e6583640383bd78a4a3e872d10a40c
SHA512 3697747308c0aed6d9ba61f4db79325cbc21b763e0caa1d0b6d201548e3d31434fdba0128a462956cc304d46858b2ec73d0cde92c5c6d0ebbfcc6dda77a95d8c

C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\59194E40068A745EF528E8E18DD529F2

MD5 b7a7b4605e33389f48b33d17cae73006
SHA1 8bfe3107712b3c886b1c96aaec89984914dc9b6b
SHA256 9aad6c1a83a1b974ba574a995af35b8ca772da919270db1605a8b81e1bbc896f
SHA512 9920eab816951cd79c09884159be354ba260d84091a7f72582299005a1ad2fece5037efd47a2799b52420b2c25ff40d5b9b9521728ca497ad395dae728f20139

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State

MD5 ee9eb1e62be3a7f0ae476ca390104184
SHA1 58d84eac7846bf30c3c3b6828bdf060f2a175d3f
SHA256 12b708f3f4b8e7461e61de424eb86f2e37da7cd990598f18eb08e6fcd4c9494a
SHA512 5ecdcc53f09bde2af0ef3b252f7584ad61d4341daa1d3d4413a8519cacd8b827155fdb4cf5bae5cf6f7f889e6a3e16a6a667d89ce22d7141402ed08f1098cf13

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State~RFe5d322e.TMP

MD5 70879a5a2f91f86c635bb3822d849614
SHA1 147d1a2003b7fb63f674dd7172f368e456fc72bc
SHA256 255e5a965c4523aff5a80588413175770ff5190ed769836d278990800bdb3b43
SHA512 157ecb7bbc662e55a330d5e3f6abbfdc177ead7276451b463adbd1cdb2a472715820deb0f3156723e271509bf8e3885d5f300cee006ca1084f87ed50315820c0

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State

MD5 875bf5b189d7473927e98cf22a6fba02
SHA1 d655a329e8355a48b70387f7a5fd80807ef4368d
SHA256 743c57a6e450d4d020be92389e7c80ec6238742bcedfe97f5ab051073af2f186
SHA512 0bb018b4c2edcffa2caaea18dd189f89b175c16a4f22832ffe79b19e333838c985cc3b3933608ec38f82b5bded7696d656f440eca0ae0b9525db335f01bc6a8c

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State

MD5 b72113ba4e4460fe2feedc133b9bdd1c
SHA1 8963410c362d79045818a2522ff1273865b76c11
SHA256 d835e6f26a1eb205eff8195e6f65ffa78fdeeeaf3b8d9f72d223e8891f020bf4
SHA512 557fb3495fd8a6957da15238b65d4085bc5f3b17e4c32d21df7861ac77db1403ecde2540ead8f2cf704ec5d6668918bffbbb3bd961f7e29938cb2adec211830b

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad\settings.dat

MD5 5fc630d38f9a1b7f3c2a3ad2e8d709a7
SHA1 98d1fb05c91b8c70f6a30161144118992b1bf84b
SHA256 e89dc340c383be3705ab6af84b6b9926ae683a02e42d2d54cf9ac042a35b04ff
SHA512 51d02a48d20f867e80782f73e788fde0ae6b2089c1ebab12c9d2e3cc88936c08aad5204eac607981a5c482c6d8d001bc405d98b3b3f3df84f87cc73a888adb93

memory/7696-15737-0x00007FFFDE000000-0x00007FFFDE001000-memory.dmp

memory/6520-15763-0x00007FFFDE000000-0x00007FFFDE001000-memory.dmp

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\GrShaderCache\data_2

MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\GraphiteDawnCache\data_3

MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\GraphiteDawnCache\data_1

MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\GraphiteDawnCache\data_0

MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1F657678CDAD5400251B323D207EA54F

MD5 bd32f984c0df3f3be45d1099d5d493c8
SHA1 4650c16dc0edf7ac489f003aba99f326a5da0be7
SHA256 1d7f789ce5fa26de45c9f8acab9c5e0251d1c8580e792e188f2900000ac2b50d
SHA512 8d8a5cbe64c7e32af8504f85e2a3ff407ee6a9418bea26e5cbb5ae9d2fbf549a69626db7eb018ecb7a1caffc53504d47a46e6f22c48a097ebee3cd05269ec825

C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1F657678CDAD5400251B323D207EA54F

MD5 839a3145057932596326b0129d44a1d5
SHA1 3caf9ba2db5570caf76942ff99101b993888e257
SHA256 9cbf22fae0dd53a7395556ce6154aa14a0d03360aa8c51cfea05d1fd8819e043
SHA512 5d8af91fa36f786a64e2b8f1e79808aea3013ce47d25cd04668e2fedcf7b2693644e59b246c8c61995c3423276d1bf0866227726d1f0a7af2696678706056621

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State

MD5 e4e1fd11b9bb1885e30fbb93b68f32c2
SHA1 126bbb89cbe81d8dc20bf134e79ef2ee63baa6b4
SHA256 ea838e4d924e3e1b12d7ecd92809254db6a47dbfbfe1dfc7c965844746f7c903
SHA512 b58c53a727c79908e339dab8977b9a9d5075e7a17cc166769dcd134a61edfd3a6fa5dbdc0f64f75faf3eaa33c965d767cd57c0ed5cbf965191b02044bcf9c1f5

C:\ProgramData\Malwarebytes\MBAMService\config\CloudConfig.json

MD5 f926849f08b897feb5e39a2b92453f7d
SHA1 47ec27a7b1a2f4c724a871c3b6ef38160b78b8de
SHA256 b79e543552ec09fcb7b9ecfabfe0ae66b2bc54f591384e4486b692f4ad03b443
SHA512 8e01a2d5eae6aa0cdfaff44f5e4c55208b16ece165cafb5b982baafd4f713d1c125aa8f66f5f4a6348bbe8fb0fe19cc13f4a01849dfdecb61628b9100e0bf8b8

C:\Windows\SystemTemp\Tmp6E5E.tmp

MD5 187ad47a1cc6f6da72f679beb1a832a0
SHA1 0bdebddb52a97f672148f4990c28685e27bf70be
SHA256 5a0e18888cb77699886200789f85168dd05d5ee5210ed7cbd7a05016a77340ca
SHA512 27540e31f3b9c441e964bad037481748b07b4cd5990146d9db9511b3b378f197953b80346f831cbd25e76f069eb34c505ec48973f103bc5c8a6574c8cfb34900

C:\ProgramData\Malwarebytes\MBAMService\config\CloudConfig.json

MD5 65b10bf136ec5e6e0b9aa26ad571410d
SHA1 8c19735392fbcb902495b29aea4c151e6f434b4c
SHA256 d5261603dca5d46ef8bf0dcfb720a997891dda4eefede49cca0d5a00f6402558
SHA512 c922fcc7e33fee798511bc798623d4ac08b58ceb57955d81b1ec04779f17127a9a72e0a17474dba6495234add429f0b3d9d36e4dec3522d49172b162ce6455f4

C:\Windows\SystemTemp\Tmp798A.tmp

MD5 b792700ed2c0b3e03cbcabb55125e5a6
SHA1 3814b4c6beabcea21a343bf8d1e2086680c2b159
SHA256 46f85289b20cf4eb89e6cfc4eaa3aa1de47d38a5708a6355bb8fc17864935fa6
SHA512 8931d67cff7579af3256f68e4f3a5d204f67b96eb6c4cf37fd3e6d1a02763f5fec5b1ae4c7305824304da5dacba15f6adbe2b14a4e34173187fb4f6bf5e79045

C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json

MD5 e9adc585d6f91687a765dc198d4418f3
SHA1 6a001336436f92688a930814d15f4a7158c405cc
SHA256 ed36681071956349b6ec87363d3bca8b069cc41403a68f503fff13177f84e8bb
SHA512 b13821e8730d0785e93c2d2fa8130a6348005485012da9a67e23b6d6dcdedd803eabe84fa790d221dab511fc00243daae7bd62fd1b73dbe4447ffb9644a3fe47

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 e6711f9a12831496a81f134552d56018
SHA1 d6b03aebfc338b5c11372b6dd3a6bdd5c1dddd22
SHA256 4b89eca55baf00f685d641641d7c1d8cecc3af563ebdcc5c63c8b2e128fe0241
SHA512 89212bba1e2057d185e328619ee060bfd69a31dcdab7706b3813fa9458d8a107ffa19458e22dcb3e92b7228c2932e470026f0a06b3915ccb0db0aa3f71fbfddb

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity~RFe5d8e87.TMP

MD5 10c9d7281212b6ef1be15612a4ed0361
SHA1 39757cb0061e1eadf1d3c3f5129e5befffc22d37
SHA256 093dee777a6bbb03969e4d7860b6f7b808581665babe6cad8214bbcccf5726a8
SHA512 8fb2feacb15fb8ee50237de0242e23f167c097aee90ce822239465d5e49c6dae5c88d060f70a63953abbe99bc0d20991e6367270dff8245ba3cbad8d5c796bc2

C:\ProgramData\Malwarebytes\MBAMService\config\CloudConfig.json

MD5 f7c90202ffaa252d5688af6027eddbff
SHA1 f721b9430e7f89aee93a595638b137b6c2f6b377
SHA256 110f560a67f6b2572942f928753cfc8d7b40b845ece69bdb106c18fa142a714f
SHA512 099d8858973427fcb024100f2b1be3ad5f67ee897d7b9259ee667693a726a3b7430ce8a2b54524147f48834de5822a148f146364f68449186169d8fca99873f0

C:\ProgramData\Malwarebytes\MBAMService\config\UI_IrisSettings.json

MD5 2e7141d7c6ecd97d53360d0a5c3b41d3
SHA1 ddae58c1c3d5d955925bb99a5031af150a7938fb
SHA256 86d791f52b8d5739e8dc35bb62431e3c1b08b45ec379d3b41f0763de3f92d262
SHA512 58639f48cac24df95c4060c4e62bf7eab44e3fa2e4931094885521368d9c45ebc20480bd6bde7f7b88cc5d9ea805bcd0562c9a9c8d14c8839484a479abee70ee

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State

MD5 76698efbdac9ebd41ebd56bcfdd4d6b2
SHA1 d61d461c8d3e07366e5ccd8ef801d48e4b9471a2
SHA256 1b9e3625dc34114bcf097210e426634e4b3b64faabbd51b98fc204d4ca74e171
SHA512 d1eb170df37b02f1c3d0db49b6cd90e00b73811bad9af7907b6e29bed1aaa62b870f55ad203c50ce407c22bd226b3fb85c62950d438d85afc5d0d2889c8f493a

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State

MD5 0df213cba8fdf11f07844bab08b68a29
SHA1 2d913a1d4856be2e06e3e3ef2984be2302839308
SHA256 8f21492f202ff262e9e7ac8399b5b45c0b156f011fd62df6a552ae8c67ee70e3
SHA512 34461ed1a25d1a4940fa6d03b6ab620699a44931ecd7d99c871dc1b2a433a65672921dcd9c498a521115c78cd2682c0297430a5f9627c37421ce6f1416235586

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Preferences

MD5 d1c179b3df6c4c03fed8fdb62fc8d736
SHA1 d9cb4b54d29c5618ff1fac453287e77f1f7e24a7
SHA256 e085fc253448262862768a89ac1594f4a3bf1952c79f7a680c15f0145b334cab
SHA512 aabe336505e7162372490118776240e74121e73a8309482c961c865e22fbdfdc3bae2499be47be844eb133f0a04dca9005392244f1e0328c42e050c813850990

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Preferences~RFe5da75e.TMP

MD5 daaa99de6de00225edcded238f78dd2f
SHA1 63f26db6bde41885dae7b47e1adbbb419cf40097
SHA256 08f5b8ed3517f637a7dde78f58301ab84aa77cc13b77cf667b04b4a5a31e4cbb
SHA512 c1bc89e4d0860332cbabc88802245f1054e66e5198117e641783d1bab1cc77824333ea27509b36e4632538e605b97f84c4b9b17c9ac90af32eda1302d32a498c

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Code Cache\js\index-dir\the-real-index

MD5 5f9bbe0353c0344b8a61b3becb0c75c2
SHA1 597b88fda272d925cc0ab4ae66304f9210a927a0
SHA256 72ee7bcbc86c3136e87c2b063bccbf8f7ed3cb438e48eaa4af7792c02d9998db
SHA512 47495ada90dd97a0147bbcb7f387ed77007a7d2f3f67fb64ab0faa55601130a09cb22266c97beebb7123852bea3d4d53ac738d17974b0c36d6dd4927a60dcdd0

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Code Cache\js\index-dir\the-real-index

MD5 b3180b690142d3dfd530498b592c139d
SHA1 f11264462c47a4144de7e1fc3ab7c184dfdba02f
SHA256 a001e23e846c9fab3551196b4d7c0a45922fbd46f22330359d323366696e15e0
SHA512 40a70fe11061a17be4ce49045f1f5213d93e0636e3f16460dcb323c318c1592f4dbdfc6dbd2bc96782e5fbbe59340497a46aaf5502d6b82e2b96cf762c249e72

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 4f2b0a64b7b7a23dcb04b38a5240d56f
SHA1 befc2e4f87552ded7045ae314917730df3e3c7fb
SHA256 264ebf0a3e453a0953f7cc1c76c7b68fd88b32485a837be36c02e8aecb448aad
SHA512 04e8982a7274989fcb92bde80787cf0c847995d79061a0b0e90e0fbcbd7eb0c3aa7d19845b841be88f268b2d4bdedaf9d13dc7559050a0bfb4e451da0d6e969e

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\Network Persistent State

MD5 8dec0dec4b5dd4652b7fcb875d155776
SHA1 8f8a51b737b093fc956cd3460770c5bb760d5787
SHA256 26a84cbf5cd0ecc7e63733b6d9f3dca976841dbecc34c0f8f19daf7e26628a54
SHA512 4feb4ff9ed2aa31e7861fcdcbf071e0834533ee4c37babec17965ff86bd1fe5042f1621b20dddab0c4998e0cc42dca4722d3bb228d471080faa8cfe111c33073

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\Network Persistent State~RFe5da79d.TMP

MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

memory/6520-16192-0x000002602E0F0000-0x000002602E1C6000-memory.dmp

memory/7696-16235-0x000001DED8CD0000-0x000001DED8DA6000-memory.dmp

C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json

MD5 cc71c8d409400cc50a500cd60dfef837
SHA1 bed741a8e26a0d7ad6005e064a5019affb881f81
SHA256 e8026ed57ff98d418f7421a4e6662e4a34f9b1a045cb75b829f76cee76b634b7
SHA512 c4b40fd41579195a53969b182a21883a25af0f409cc93bfe9752a3bf2dc7008ad6fa0aeb6da7733fda9a6a164e62a8abf4cc1215dabf87df881c3876dda5d3b9

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad\settings.dat

MD5 41ba5480f590d8aa3b31f582ba9f8814
SHA1 b9fa2128cc50ce232f55185d2f7aa6127acc735b
SHA256 f45c2e6a72166aad2ee6111be78284bca7914f78cdefe6c53d795a9f0bd989de
SHA512 eab30d7a96b66abb46766ca4e22e20bef11631713589953af64ddefb5474882e6aa07c33faa791c679b28560e7cd1d812f5cb49bb5f1b218e980eb67f174bcb2

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State

MD5 89f10b9b61e13e1183195a675902d332
SHA1 bb6acf14beba7cf609b663b256e5d463eaef88cd
SHA256 cae00d80e233186581d886f79c03168e25e9c7eafed70c6c6044cea78d7f9272
SHA512 b1d0b42cc8727da128e4e3096b6938380f182b2225b5692532c32e01d96aff8525371a1faafc9314edf5b6beaf4c4de59e88d07ae19927ff4366029565b02bf1

C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json

MD5 872fcc85794da62247aee8580a930d07
SHA1 b13e1e8b034b388be1f51bd861789b8f6ddc4b9a
SHA256 629cb5a967b0ce971698969621abe5527fabef2214105e636f97ac8681369cbc
SHA512 75ee8e83c2789f0cbffd70929d0b3cd780fb466aee3c3098771f1ac722ff729147cf223f19ffbbe9f35aea0f060601d6c6330825da4f369a29b06846933fd27c

C:\ProgramData\Malwarebytes\MBAMService\ScanResults\34f858d2-58fd-11f0-85ec-c6f2a85d96c9.json

MD5 3ce986b8316d28301012b14c2be2b6b4
SHA1 07b4f175ba93e5c6e98c506b5c39519664fdc4d1
SHA256 54482fb63c95d92e1d9034598f5f6fcc5574aab5c905484341f73738643e0931
SHA512 4f939b0fd764f9ca448845e7b5917f217c36b5ff260c5b8fb21549815b392a12757c349e688f9b7f5a2c6f6a9870802261915ca95dc72a9384e3d1d587e088ae

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\datareporting\glean\db\data.safe.tmp

MD5 a814afeba11ce912b85657c3dabdbf84
SHA1 d4a7c9d4650ab5511d44ad9a0f0ff51753398508
SHA256 5f17ce14b20c34b40798bfbead7e808d90b31c3037db47a5430cedd594c3997b
SHA512 317dc7ebf9a01204a102cdc9dac9d5f122effa31c6810adae354aa042811937512bc881ca526b0fccd2d8827f5a3f98c2581256cd3a1fd8604aefc85849cddf6

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\activity-stream.contile.json

MD5 9fab33f45b79b2b550cac749da792d36
SHA1 066c37aa19291e0617f7a85c6e3246e30fb2c036
SHA256 f323a9a3ec11d6d4876b8d685004d297b172c90419c7981cb124ae60f7ad547a
SHA512 0b0a2776153f86882c3bd33625b261859e388751a987fab55aae45ca72c62d96ab96db966cab93e6402a5a808c0771d20fad9547ffd82045db8ee234489fba53

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\datareporting\glean\db\data.safe.tmp

MD5 43ecbd015383ff61c444a100e79911d3
SHA1 e5cb15a44aa15e2df9313085791f51993c77d240
SHA256 dfd61a8ca561639a4544fa59e81597c80c8c58df464dbed1ca1fefc8cd42f27a
SHA512 4cab68160e1e40d7a9ec2f4898e3c7ef938dcbe864b2c6f699417afbef7789d9604e40bdce6746d774a7c3c2d5770ebdcb3ac4f65d406bcfbe2e20ef69398087

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Preferences

MD5 bc0691e404570a2d97e3e8bf7f15e9e5
SHA1 9a9f3bf69be66e263bbf2f972356d066010dee43
SHA256 a4ec8e2fea5ff34773347dd60a8d1c9e0e33c0a07729e9d72d5256921d0051f4
SHA512 493bc01f5afc28de4c283da1c5851a005b441fd2dd694f5cee7c5ad74e34796bff1332c70b3bae1f78afa81e0e7620f379b3b90a43e137e8e0f8dfadbe5f03c3

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State

MD5 6c7c8bf81617137c90a983e78dafd785
SHA1 44082f1fbff053d6cb71bb1139a3debaf16770a0
SHA256 f0f554ca6eb8b0dcbbb473f2a84964647a8ad6f2b7811d405a3cf9e83a690076
SHA512 b1996419b4c44037768b1a5943266ad18fc018a71ea10f1dd12ad14c316f299a14f52021167e5a71a6b8a9874b97b2d3517186c0a278ccd3cf2f754b0e90de18

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 26957a505b4f75afb42683f3643c1dc1
SHA1 4b3452671b491aec36f8954a0af877cc0b18e8c9
SHA256 6a0c45b1e4e69cb9b807ff20b5f6b2d2000dc0b2d8920b07477b8b9cc71fcb2b
SHA512 e0f4bb558aa03656fb56ada5703c39f2112aeae7aa84cbd8b4bfd11c3c857bae8b3a63f9bcc4e5ef4cd0d7569ad8eb7100dc39afd7f0325102ea89165a6232f0

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\prefs-2.js

MD5 d65c1ab937758dec1e310bc821e483c2
SHA1 afe3aeedadebcc9ac65930b353f019a16598ab7e
SHA256 82cd180afd12e54b95cb96e34829bb0cf5f31554f18782ddecbacbf77ad73715
SHA512 7bfd8e2da73203e0c5306f67bd3f9f3124cc3dee2b322c0ecf3439af5381237346877974b5954de3bc832ab6ea7a20b7919f397762b93de0f2a1e52ff1641e3b

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Code Cache\js\index-dir\the-real-index

MD5 009548d48ba918c002f061b8a45bc515
SHA1 48db4d722e84191dbbfcc3cbb6ca6beb0e518b96
SHA256 9bc6c6765f83e0532a2f0da0a2f42d2d0d75eea2c6c16d7111daff4fdc99c934
SHA512 df69f7b9ff19c39f8ca752308d20c8ea2b2c15e4238b2b8c5436abbe2b1d245c9c5dc0e3d1dc7cb6867e9f29e4a0b685a95c7913cdbb0285becb0760f154e001

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 982b14c5317353b52712c59d472017fd
SHA1 f4abab691641204930cd43e3d50ff90e9b048d58
SHA256 abeeb5d9e2e610caf2413acad6af7eddfe041e7c33e6db663e7a563252c466e8
SHA512 53ad2b748ca69916d3f03f9098ffe0447723a787ab12e584b7fe13566bb16680748e011bd13be17d8c3853312e4336f0ebde756a123e4af8bdbce500a90e0876

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 677397c9c0ff2457d9291a1abde80dba
SHA1 a04e4ff4a1c7eefc0bf25478abbc61adbb089e28
SHA256 cc58ef11b5883661a0414543b6e1d4e08e854ebacc10f08a0ee769958bcb1cef
SHA512 97aa8d8b38532f918d3392f3ebea5a4bcf9609f50c5c539f1624b935e9d92821df890b12b1b969a41648ae9b09172507785d9322c167ddd34527d9cad9951195

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Preferences

MD5 a5642738b4d4b7e21657fd70a382b07b
SHA1 eaa87c1407dadc3c544d3c87065f28b04d71e352
SHA256 5ae37fb325eb0d33a813e3b234364fe0ccd4c2ece593565dc6330695d606aa03
SHA512 885d8108d4fda67da4db72f3815d304d1430e5053bd2222b7092632e39b141aa917638c4585e580194f453538c903952fcfe58965d0bd9757fac77015c3dbf0d

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 11fe4c8d16af5373260f78c77eaea249
SHA1 df0ad8056fee2a11fdb16223757bc74ef3386246
SHA256 e551d30a77ede891157856b032705436238eedc873a3eca97efae2758e2981dd
SHA512 6090dfe4266f94f04cef63dc3ec398bc30243a3693891776f23dc23c1c3cab6c52ad0fe24d1d5a80e3da34148591bc8f44a875862fc3670e8df67523ba0e65a9

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 95f32cd64ddccbcd664a35240df133be
SHA1 be14e0f25e018566f45c2283ec846694f51a8cb7
SHA256 0bd43c3f1243618206c0eb3118e517ed4f67eabdb483759dd0b476c425b366b1
SHA512 d73d3c7c77bed15cfdd8b2b9536cc57b79b75b102ac8ecb6c1642faa4ba2ff1cf27ff8e531cee5c6dbb11b37f67870b2246f80984f01fa393dfaf7863b318e82

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State

MD5 b2ab2217a8155f917169bdef1cf3576a
SHA1 896d86747f12d84b626eeeaa76b9098fccac4815
SHA256 d2da9d2a9cb9a79fc00ae3c306ef93b4f04d8630f97f6ef558edc581d801cc42
SHA512 5c77c216cf952f85093fda515e6a597cda657d9291958678cf593f322d5a6e646df8c81afa09b13fac2d7f999367c4fb014203c343506574a35ccad8bb2c316c

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Preferences

MD5 036720626d84d82c867d2e57f53bd1a7
SHA1 49ccfa9b6d57327d6208175fe122900ac3704e83
SHA256 f49f84942360623a3e9680bded60d7fdfd1d65a88ce05ccb85316825ec9041ce
SHA512 629bdeb1f8b9c6b8756658c0c546cb1603dbb76308e02144b01b0a9a7eb7832ad0336843d20bd56a78813479858533db090ae29acbb0bdfd1a7d9a064269c94e

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Local State

MD5 0a9caac6a2b68ba196a5286ed75f54db
SHA1 6dc51c60ea532909a8a2939c962205ce86059941
SHA256 be641b634a562263a1a9a32aec43a0e942f3a179fb4bb6a5abca045659c4dbee
SHA512 6f1e5afe96972c50ce8dc18d209c30a766e26b95295a8218a269141cbfbc7da97ccfc465727b910de16db0460366502bba39874cca7bbaef5a0614518308df2f

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 65b133c304e79388f3cf6a6de8301368
SHA1 22725b2c35a31f65610ba656b321d3388d193556
SHA256 fdf07e9e983db8846e6d9cc2eb16ea5aca1cbbfefab2e5200d19720541bb0f0d
SHA512 b5e8d3a19f8aabce390ff50bb545ca074a75103494125f64e6af26e175993f59c4823ddba4055bf45593ac80d36ce702304eb96334c15fb13cfeb6a3a0b600b8

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\Network Persistent State

MD5 efa3394c74a2bc83ac0ea2e138169c1f
SHA1 3659bfd8a00cfb6a66f93c2535adadfa13f72851
SHA256 9c7bd5510616a1e04b57fdd7aec5405ee7f799d2e7b69481c8e0b34b6a9c6a88
SHA512 388a20623bfbb62fdb69e92a4f608b4aa1b012af11a46fd6561874ff5c55df1660fd9914fa470a0478d9831f9409a36a179282446b1ca95dcbbcfd8b32c3f173

memory/8820-16882-0x00000206BA6D0000-0x00000206BA7A6000-memory.dmp

memory/7480-16881-0x000001E04E4F0000-0x000001E04E5C6000-memory.dmp

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Crashpad\settings.dat

MD5 efe2f44cc3b91dbc40b1fa153dd5477f
SHA1 2857e7d528939d718ae12f964ba4aac7fb667040
SHA256 0713cbcf951377adfa47144165ccaf82b744eb88a06526532280086d2bb69fe8
SHA512 526268512eb3ef2cc2ad8126796d483d1f059cdcd51f9a13d406a2ea5ac68cfbb7f7ce8c90bbf3fe2126d0235894aaae8b87001550215ba29808e5782f7be96e

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

MD5 9486da5c00b51937b01f73e0e0a1c047
SHA1 097f10b71abc56a8d9758807146a09fb817a566a
SHA256 a6871d650877f93362f47b54a681582c866cd0277488a17609c209bbd770a3ee
SHA512 7e013ffbf29cb8ebb82fd87c0b0f5a54d13dfa65aa6bd8450f3ce2d6430341cf2f423691c5a7a2988de62c72597971ac5eb431e355d260b6fedaa2fc9610001f

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Preferences

MD5 acfd8ef4f85f194c14a9f51db00c39ef
SHA1 c42bab6083790d708fed128d1ef7f0414c796bda
SHA256 a0ebb68641dca3acbea2ef7b82cd07580afd5aca1873f125b09f6cbe7c61bad9
SHA512 90d2be1de525f32cab25e83b5efc5dfd06101fd2e1364e81b482a877708f55b885caefcff219a207e0411508635c4ab58957cfce9cb8c13bf9d085c2dd5f0181

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 018ee505f73f6596003b2860454f44cd
SHA1 fbc5639d95941c7e54420b3fcefc5aedea9d17a2
SHA256 65be4182203b1b35f9e84e3f822bb78d629f3543dc9f767e4b9377bfc5c31c64
SHA512 300efd3bf670c8c4cce8127c4c37bedfbbcd79b43ed72bda9cee40650bc9ad6a0030f2064380f4063fea1e23da83262bfba5fa7d9c91c86685c5eb029bfa8135

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 d9261b0b36708d11038604b20bd556a6
SHA1 c2809163ba86059188fef4dce80f637218ec67f3
SHA256 f7c7258de9c59f7c4f77f677074d59a23ef0b2fee7c2e96ad67aabf0eecc9cc1
SHA512 45739f8dc1aa74759f0a4bc02976cbe49f09612991da8af0265b4771f30e6e6ab9975be6c9a2583d3f21d90f58590d0562d8495d7a45faad75f5dcc553a47a39

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Code Cache\js\index-dir\the-real-index

MD5 a689f691f0b315734014e5647bbd32b6
SHA1 bc21374e5fde93038e7b4c02c58065700fce3c3e
SHA256 73026eabe7596ffe85def92a7e819662ccbaa6d3d8b2655f8faaf06f0bf10935
SHA512 517f4be8caa36723654bea36e5b460cfd793b92c7f90065a6ec0309a4236360415466e9b5183aa9ad2420bd8b408f0ae75f173e8614a81474ad301045d318b41

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 224fe317dcf53b8af1a05edde3104564
SHA1 5051a302c7aa5d35753197e7a54016b65470a0ee
SHA256 80085a4925e2816054d11fe65b1651b4dc2eb48a68f9d1d74532ab3d56fe35af
SHA512 e2d73d5077f9b5341f92bf9763d4a5fd88c176fa194f895908ecc69ecd0b2aa00d872ffc13e2b0d2b5760d75671958efe6a2106f7f4ef58bbdbe3feede4da3ef

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 1ce442f5eb06d46ac80f6839db1f6580
SHA1 58aa96d8b2e03d974f5bb986b152a162d0e537d4
SHA256 356c4a94af09ffbeb8bb2418305fc55ea0edf50cc9aed96f415500b773e71e7d
SHA512 ff46ce2617a761439dcddc64c09786649e4ba95d444207d98ccb958123b34544a5849949c25fa1d66fd3e74deffa794c5ef503eeafcfced57e4225d99ab82381

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 5e98ab9802db54d14ec2fd1968ac5d3e
SHA1 69e59a07762e246fd0b7b0b537c619e76ec7c086
SHA256 84df9edebf3fd020442690248e5a78c5ed3df35d9d9860fc8958e926de18d720
SHA512 29b68978bf73b74a014d0bfbf1e180438e08746abb0192e96bb55e3a8291dda692cd5fa72cd98cd53de3562d8c70d309432ea8f26b79a885300e71ca6e15708f

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1488_1341948127\manifest.json

MD5 ba25fcf816a017558d3434583e9746b8
SHA1 be05c87f7adf6b21273a4e94b3592618b6a4a624
SHA256 0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
SHA512 3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 90b8d75cc4bc05766e7d3321eac4ef54
SHA1 d292b3edda62e0d986051978ea70da0fd9438178
SHA256 2cc9aa04b9106fe924cbf13b75ce3a9f4f0cdd35b20e834e858d7b37ddcd132f
SHA512 6ae686676d4f376b8876a5b4a4f316c80d96b083667b243b7a8dc06768935679c8bebf75c4b554ff4097133b549f95374e1b68e2460bd5720669f409958142ef

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\datareporting\glean\db\data.safe.tmp

MD5 b84f1ca38c665a8d41d368489e6706e6
SHA1 198becd81836bb86115d1a7a44cacb569c8ae1e9
SHA256 02ba4e0328a7971da59ff80b4fad6f55620e1e17eb89f63e12008d19e25685f7
SHA512 8d428b4a611bb1f7144c56ea2a002c94e08272e796689e1ce57f5e2f07137d4df372f440efbefeca8299f612d84f162eca5da148c7d25e4b263ccb99043a671c

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 8afe5a81e885e377127a3fde587c3e5f
SHA1 a71bab97f109f935795533c13da0b6292315e828
SHA256 ba52a72cf5d01f95122a3ca07b191a3ae7ec99e8f58983ab131dd1c039e0adcf
SHA512 e490b35db7765fc37c3cfde3f150fcd5d9accf0f9d28873459f7866ee95ccaebc790c3673950a223ef6d7ec933ff370cb17125405c9918ad06422970c3b4d62c

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_948187008\manifest.json

MD5 b721bdf2924d658186ac8868dbd2c008
SHA1 914aacc65bb7933bd73aa06f8bd2ca0b04de3858
SHA256 dc6a19395ad3a24ee3805f6e90c6b16fdc141a51ac7fbb99fb784e423f8962f3
SHA512 4c1c16f714a2e2436697bc801f7e2f684010c833e3d5fe6ed68d6f3e630afa495412ea5a1b46f4bbbb1102feede84e72f32686910492510cbce71888a85b5fda

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_948187008\manifest.fingerprint

MD5 e7a26ab178e9ed4a5a4692aeaeeb9b4e
SHA1 42189eb71f91f26a154692007ee05ffde8eaf996
SHA256 5d0a3dfcedb4d70e2c78eb294f80646aefdf460606e982be3687c41930590767
SHA512 5113e6749f1a2c17ebe06d8d701a3472b991055b4c770e2c285a638a600db921b6889fbfa184439fcda700a84927d943f90263ad019a347db54563fac2a74e78

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_948187008\us_tv_and_film.txt

MD5 9c2d1b4b6932aa765231e0d0ed2c4f99
SHA1 918ac9249d731d039953f7f999facf71cb911623
SHA256 f146e15ecba3f37adcd7aa4fb23797555d1ab55489fbb0b989c60073f638aaa0
SHA512 87154719c51c1a50da28c612b155cbd96ba7ff72017fecf8e67ec102871e58f26764a7a97cd6e62824277487b25962ab2213c09f6e716c9c8cdf2ed0b510afcd

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_948187008\test.txt

MD5 29b933a8d9a0fcef0af75f1713f4940e
SHA1 9fbc3fafddca353898269a2f4069e4653083bcdb
SHA256 92b772380a3f8e27a93e57e6deeca6c01da07f5aadce78bb2fbb20de10a66925
SHA512 9751ea443fd632e147831566ccb822482220188993cd1269edbe98d2e2d69beb5fb4b631c5001f47491dfe7550cb68035267fae518f1ff119e465b54379389fb

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_948187008\surnames.txt

MD5 fd371a8cb1595f425332063f52f8e842
SHA1 9fc966ae07e49f5e06baf122cd85418753a140c4
SHA256 3362648c77af4ee84a6383800fb5a5cb0493703d4bfc1557e05f315fc41b2699
SHA512 a8fd0b89ca8e12719adfda79a76bf8809e037ddcfe9625ab0b6dbf0243054b7c344bb5b79ac687c88cf494b41fd1c219ff983a525ed46ebe4ee220f84b6a2521

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_948187008\ranked_dicts

MD5 959460a18173908111523bbf4c39073e
SHA1 c42a9a7042f6d87a6a9de7f9bf378f1fe9485fcc
SHA256 5820d0bf9cfc363ff929492b1eb6df430039f4ac0e212a5b5411f7c2614f79d0
SHA512 291decc0f58cf71d7929a52d2c21a07590c02bcd202b73fb20391d6d0c7dcbe3aec24e02606f22dbd589ee2546a0eb8414c232f74ec646a1f26496c280705600

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_948187008\passwords.txt

MD5 c1934045c3348ea1ba618279aac38c67
SHA1 e4e7ac07dc6cd20611711ac6436de0eab4abb19d
SHA256 f65b16793f0d335c87bf5bb4b19bcfc457462396169080b8c11a7c6f1d8b3731
SHA512 a98d72c13a38b7774d9cfcce8aa94676c3c91d49555b85a1104d728d38e43ced23ab7f0532372f64b62728a2ff6ef27614b3671c628b4d520c99f240617fbb69

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_948187008\male_names.txt

MD5 0951d82428623061017b1254cad02f4d
SHA1 21939c83cf37e7ff1c6608080371142758f6343e
SHA256 34519e42ef61ea5eae6b9f74a735926c86ed8d1c19d21726da1af6039a66c688
SHA512 6a189748c14b2f2f4330ea8be16985b041fa6692b7642945da2b249520b86a904e55d5b30d8dee9231d7140d2d368cc5133b563be5ed829ffe718990aa440965

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_948187008\female_names.txt

MD5 826b02933e2bbf07ebf69e3da323d389
SHA1 187c6bcf250fa920b2d7c46fa3eaba673c17e8fc
SHA256 08346ad80d8d829fda1064485420da1e0771ba1e0dcd954252d43b61c5116aaf
SHA512 9d9d151773c9e8340a5c443ef1d56874d06c0d374b0aae4d0c703f3286e6588ec813214bd8e9aa6d88bf2b7c3140258c563813085ded4c1fd558a4e171165c38

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\ZxcvbnData\3.1.0.0\english_wikipedia.txt

MD5 5713cf8a57fe61cb28fc99a88323cbde
SHA1 688a076a14c9f659b21a22ca74eb6106afab0c04
SHA256 b29af10c62218f948eb299e0c68b176ab1c5ecdfe9813bd957bf2c434e90813e
SHA512 28bb4b59cb035160f44cdd19f6e40d94bb11a28680d430c359d086cf1b29de773a42a5d3078b862a8b4bc27d184f809c5c03241ab5aa7cbaa3b794bc353ed57e

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\Network Persistent State

MD5 0dc4b04f55c705cab14cd25d5c413c98
SHA1 5c87a55ed1926b0d3ea48936987930def6fdbdb8
SHA256 df6b11f26ec3f9735f79f78ea5d3f6c1946243247868037fe66f5dc16b9a4259
SHA512 37314ae0bc1afac1ea15bcc654ddaa3d13ca2919a9f08a83376a93e4a27991b06b0c7f1ae3bf6c4b4ac6c8e390f63040b5230ab0727a0671ea1b2edfc933a893

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\AutoLaunchProtocolsComponent\1.0.0.9\protocols.json

MD5 f9fd82b572ef4ce41a3d1075acc52d22
SHA1 fdded5eef95391be440cc15f84ded0480c0141e3
SHA256 5f21978e992a53ebd9c138cb5391c481def7769e3525c586a8a94f276b3cd8d6
SHA512 17084cc74462310a608355fbeafa8b51f295fb5fd067dfc641e752e69b1ee4ffba0e9eafa263aab67daab780b9b6be370dd3b54dd4ba8426ab499e50ff5c7339

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_1904758017\manifest.json

MD5 049c307f30407da557545d34db8ced16
SHA1 f10b86ebfe8d30d0dc36210939ca7fa7a819d494
SHA256 c36944790c4a1fa2f2acec5f7809a4d6689ecb7fb3b2f19c831c9adb4e17fc54
SHA512 14f04e768956bdd9634f6a172104f2b630e2eeada2f73b9a249be2ec707f4a47ff60f2f700005ca95addd838db9438ad560e5136a10ed32df1d304d65f445780

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 32eb62609660b22c0715f0d2901112b5
SHA1 a696d3cbbfa74b230a817dc75b7834df7463e51a
SHA256 76f645773602cdc515a84ed9cfd7582950168bd9b7b9a3690d2219d4b1e34757
SHA512 59bfa15132e92a0b9fc8b0be285b46f60732c390f2204abe30c9480179152f41a72b3319ef3444f0fbe7201dfc348d623358b1e920ca575ddd9865458c3acea5

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_613449461\manifest.fingerprint

MD5 ae77ce47a94ce85d131eaf52ab9c6180
SHA1 43ea9fa33b215b8a0f8080ab38840e2d6a4d233e
SHA256 6ec69655420295110323ab5dd26914e3a7f0e01c8df3b5b8bf24901fa9e0e63b
SHA512 fbd3e8531969222e2a5d501c54776bb320a926cc53aa5ae7f340a0c229470f04d47cf50f6613068418bc5f6fafb3e6860c8ffc9bec6b144a0da8b6d025afc024

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 09db3f91fce9a5d66d1638fc427ebf0d
SHA1 d4502b371176a7ed46d4265d43f95a55cfed5a48
SHA256 84a8fb19fd4e9d5aab60162d100b25cf1189e43cbc4997032a31e457995947c4
SHA512 b9a56c147fb9e04bb82a561f1fea4fe37567671677436767e22f567b94548ac3eeff9ad2f5a7b55365c442ce0f71e11356fab57a75a39aeb30012b2844c45045

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 054c80a3d0f03da63ae3681c5640cd39
SHA1 243c0ec95539f5775b6c63ced5087be03ee335c8
SHA256 a83084fd68282be8a2550f5858fc3e2750d6b0c4552d84559d73f8cf6dabb0bb
SHA512 24b49ef6f59247c3a9af111e955aed8368b7b3c2f6b2ba7bbd170cddfac8021fb872221632504660946e38c36eb557bdf86df005f90ef93b0c0138d87dd731f6

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_760080286\manifest.json

MD5 89217e000f3145a2523e43f947208e79
SHA1 cd7915d003ee87f2babc9ee9add12841022710ac
SHA256 6722a860c855cf94a54fd1ffdd3801c4c949f5b67d8601ad300264931057f2bb
SHA512 385257ef9c67d80006eb350ac79718f30e08d810a1568454806f2505b482e0093f784d0d4cd24078317f863db500898343ce69391c0ae7fc767697f6da38eeaf

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\TrustTokenKeyCommitments\2025.5.15.1\keys.json

MD5 03f15dff10ac451682f8a308674ddf77
SHA1 c723e23c49bed8a52b8f947b2cb8879a110fc94b
SHA256 f967e18d5b1839ba801212f032e7e6dd92f7ba6958bc3ae9b122d9fadf2b1bf4
SHA512 df8fdc89cc1e6f2edce49b41bd9f71dc7f7a8daab40f1355415119f9c0a0d5067337d966472ad49f855ecb9a89bee8d1711d8a869589a03e469530ee8d7e0f3e

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 26863fd913ce6a6db93331c5b1240404
SHA1 039d4e263f4c8632c65bda439c654b5d59dc23ce
SHA256 d488810771ece524a2f19f88ab6a2ecbc0ade8ba74e8499597c79f52a4870ee0
SHA512 20f0f5d7dc5609f875282af3183a77fbedf3d74ee91b17dce3c0b02551cea79ab62d4b8cd6ca88819224f685c7bb296f5d6e18e3a323359bf1a5920bac99265b

memory/8540-17529-0x000002152C1D0000-0x000002152C1D1000-memory.dmp

memory/8540-17530-0x000002152C1D0000-0x000002152C1D1000-memory.dmp

memory/8540-17531-0x000002152C1D0000-0x000002152C1D1000-memory.dmp

memory/8540-17541-0x000002152C1D0000-0x000002152C1D1000-memory.dmp

memory/8540-17540-0x000002152C1D0000-0x000002152C1D1000-memory.dmp

memory/8540-17539-0x000002152C1D0000-0x000002152C1D1000-memory.dmp

memory/8540-17538-0x000002152C1D0000-0x000002152C1D1000-memory.dmp

memory/8540-17537-0x000002152C1D0000-0x000002152C1D1000-memory.dmp

memory/8540-17536-0x000002152C1D0000-0x000002152C1D1000-memory.dmp

memory/8540-17535-0x000002152C1D0000-0x000002152C1D1000-memory.dmp

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_714966809\manifest.fingerprint

MD5 5bbd09242392aacbb5fac763f9e3bd4e
SHA1 14bb7b23b459ce30193742ed1901a17b4dcf9645
SHA256 22b55f5d9b1bafb80e00c1304cf5e0d6057a304a2e8757b4f021b416f4397297
SHA512 541e4c7998e91a5113f627c2c44e32b54878fe225b3b9476572f025f51f2b4ec4a44b102498adcc22b8fe388970645bacfafb6e7fc8a216df4d7bbfc8b0ff670

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_714966809\Microsoft.CognitiveServices.Speech.core.dll

MD5 0ee2b50c85a110689352fccfa77b5b18
SHA1 d9ecc4b12d2d50e3cbce40e75edad804c9988b25
SHA256 62a13d8459e0992c311dc3551bf3c2d1ce167ea7fa40f0ec62193f3bd760b36e
SHA512 a4f94a05a69b5ae3a0ecf8bdb7592f698d0df81e2f1fae679f38890ad04a2384883837bc792c73848955ff4af7afed49d38839f7ab174454e61919ed78655bff

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 dc1072d379983dd72b3a9576eaa4c601
SHA1 3b48c59ae88cd140a70e005f15f64ddd36a97743
SHA256 be11df25245d5ff85f2c2ce2e18e1b1728bda04723e28fa3de71df06e0191934
SHA512 12197476a96c5759bea7fc597b3409057391d55e1e0bfc7c77e8adc80e3424b0b77a31bb666cf9027a26220cdfa13a1dc721c6dca968ff798f44bc5d8659079c

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 09fbafb6ddf461c9900ca2291355d39e
SHA1 f88314a3df9b1caf64309a772f1e9c6f2cc069cf
SHA256 7954c4c2b700c99b6a0b771f0327978f6fb3330368faf1a53b766c2dd978af4a
SHA512 e87c9db2eb9b3ccf39bd31250c22d25d3e0a86f550ee8d240fc92652b9ef4bf4a1380e52a57297fa42a72ece72da885ffb9faacede670f9a0cdafc62e49a5e41

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old

MD5 487b5e3478953ca9b1897927295ad0a8
SHA1 55f6d8596ebf2141ab00b457c9524115433fed8f
SHA256 902f846fb3c2ccb4c2096b15233294fe7099b01b843c8f1ee32adfcfd28f5075
SHA512 6f389df198a8345288fd7a5eab44ee7af5fc327abf753084648dc7141ccddae66481b7a7f241fd5142b749a6240f6b120a52cfe326d0887d60e320c058441a66

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_1210266651\manifest.json

MD5 e6cd92ad3b3ab9cb3d325f3c4b7559aa
SHA1 0704d57b52cf55674524a5278ed4f7ba1e19ca0c
SHA256 63dfb8d99ce83b3ca282eb697dc76b17b4a48e4065fc7efafb77724739074a9d
SHA512 172d5dc107757bb591b9a8ed7f2b48f22b5184d6537572d375801113e294febfbe39077c408e3a04c44e6072427cbe443c6614d205a5a4aa290101722e18f5e8

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\CertificateRevocation\6498.2024.12.2\crl-set

MD5 846feb52bd6829102a780ec0da74ab04
SHA1 dd98409b49f0cd1f9d0028962d7276860579fb54
SHA256 124b7eeba31f0e3d9b842a62f3441204beb13fade81da38b854aecba0e03a5b4
SHA512 c8759e675506ccc6aa9807798252c7e7c48a0ab31674609738617dc105cee38bce69d4d41d6b95e16731466880b386d35483cbeea6275773f7041ba6e305fae9

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 e62ddc688b0ab7ab5b69ebfa692c1f46
SHA1 c6baba46ac530cf85d51bd1fdac47a9a12cb3689
SHA256 304d1ab7feab8d6b6382a3026dc854eb4410a5c268ae3a74637d291f360cdaef
SHA512 a413d18187edcc06df13d5165c7c04a0a0169a279bc92f3dcc12034ab9bf63953fa5f3c52f68ebd528d3c196c132e0e28dc07554cfbc7680d44a0f2bfe5057b6

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\Network Persistent State

MD5 9e31376ef135bb00e8e9463d575418a5
SHA1 c9bb31c8fc91c9b1df7b7f39f0a39c4490010a27
SHA256 1d75dce3b938ad2297b4239fbab60fd9549ac76749257c3159e7747fa3d972c3
SHA512 dce7e6df4559811d50c046b0cc4667b81b2f4617cf2dd32f0dd459dab2dfd50cdc3577515945c5e54db4ba0938a82d77cffe40acdfaab21853156cc0d1e7e386

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1488_1311401035\hyph-as.hyb

MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1488_1311401035\hyph-hi.hyb

MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1488_1311401035\hyph-nb.hyb

MD5 677edd1a17d50f0bd11783f58725d0e7
SHA1 98fedc5862c78f3b03daed1ff9efbe5e31c205ee
SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
SHA512 c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1488_1311401035\manifest.json

MD5 2617c38bed67a4190fc499142b6f2867
SHA1 a37f0251cd6be0a6983d9a04193b773f86d31da1
SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
SHA512 b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 aff01db82ca2d1db6b5c7967cb958f3f
SHA1 cd8b4652d5101b14080d32984311a541b33b7e54
SHA256 9065954bcb839f05a5bcd54afcb11154e6be0761e67e09d5c1d25d3b320681ef
SHA512 36877f9a35968d1147b0f3266c0459238feccf27e93c28f7a4f556891b88500417bdfdc311bdcf3ace3cdafa62a0e4edf1dcc16b816ecf8342ab0e78814f7999

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 b4c778b88cb9f3acc0a8df904329d874
SHA1 955dfc92cca3c31a85571ba41825bbfc531fc621
SHA256 bbbcc94b08edf171c49ec1df8b22263cffe53ad9bcddb0ee76162f84fbe938da
SHA512 89a5025e34009be2dc2c8eefdad0b21ba3a495acac6b4a3ae6379b7268d4eecd1d11ff0c34850644ea98aee44b50283e28a77ae895080aa730750c9294587213

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_862379018\hyph-af.hyb

MD5 ffa9db945f0f0c15b8bba75a6e064880
SHA1 49217a9d5bb7a868464403b4e3c82e80df53456c
SHA256 5487ee44a4cd706d0086522e90c59c76cdf2ac68ce506fd3eae6054b9220c0cf
SHA512 cc67b2dfbbb009dd3fdb999fe86410425455613c12dac755a3cded435cd25ca4363782d70f3b7bb7c0fdd63e2eb649ae6a4053d929f463b646b43d7dbfda79c0

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_862379018\hyph-be.hyb

MD5 087de134f3b23a9944afd711a9667a0b
SHA1 1b67d0a65ef91295207d66e62b682803aa74ef00
SHA256 25b7cfa039f82ac92990e1789de40988d490db9b613852fb24036b38ff87893c
SHA512 42c0b51e0e28109a7058d3fc03fa7bef8b25c9b3c8bb74933574fad06c061fd1636b53eeeacf652e438d4df08002db449681be9e6e6821ec23d32a8be1778998

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_862379018\hyph-bg.hyb

MD5 e8a4f8f5238f9a0ff6968ad8dba2755f
SHA1 abf002ff28b3aa2a59948225e5e600096348caa7
SHA256 7593f0395081e3eeb2d8516d10746608afd826cffd4e7e37d53936993d200a13
SHA512 b54811e1be6e63bf19e408ac4ae9da86e1473e4e8f1e9d517d907e025be20fa6979517339ec6defd0ec30613ed42a97d88111d39297214afa7606597cba5ea86

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_862379018\hyph-cs.hyb

MD5 e8b1509f86508e807d61216614b3dd58
SHA1 b2334509e9d1589ad2e8b80c187018eadb15872b
SHA256 97a4755fe9e653a08969f1933e3db19c712078b227bd5aa6799093abc5a0edc3
SHA512 fb340fef9d0dba342fd85b8b18c0090391aed717fe92a8da7c5d939dc9c0aa5235d4423b590e52b0decddd4f4ad8bd4652361161c193617601ff490dd1be97fe

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_862379018\hyph-cu.hyb

MD5 b4e5921b1df85ba9f2ebe6ce578915f6
SHA1 b5f2e813667aae32e65cab9c9a0dd291421ada0b
SHA256 2baee19d5024ff87dcf3a1b9d0da1b3ac5a1e506adeead3b96a4de5395d0290e
SHA512 41696a9e25ca004acdc8def265766392ce3568747560ff73cd08ac9fa4a99e4c4654fb84dc602845b3e444a8312fb099c72932471f7e830874cd7cfa184b63b7

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_862379018\hyph-cy.hyb

MD5 b0f32ed7b4b8a068a962d820627b7229
SHA1 76734e58bd33c4d1450228bf05e53cfe169a02e6
SHA256 4d0569fe2f4b41b3164cf610310e1d996fd2c553cc39de6062e50f4e033cc207
SHA512 8f20253985c217401627e0c7d31aa1bf213fa220bb498869e11e1e532c3c82dbc2abe6ffa27c69243913243af1aeb35806175511d77d730c914b1cadd71aa7a0

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_862379018\hyph-da.hyb

MD5 d0e160dca547eda390d6cc7c4a1f7ac6
SHA1 7eb71819675e82b1bb92428e07fa6b05cd1854d8
SHA256 86fdfc8db62cdaa11f615dad3712da1f4708294e029a4aad0fc285d4ea16c4bd
SHA512 9be5f673962c6049ed1c796a81aa7be72a1c7715fc2d4610cf6565541c7bb145d068b94b5fdadd30bdb5f5287ccc2055ec1dc9e11e4c5b8965d59ef73ab145c4

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_862379018\hyph-de-1996.hyb

MD5 e7a9906b316d478b55bf8ebcbbb1d1c5
SHA1 5688453de9afb7405960980dc93adf9296aa2f4a
SHA256 d673805547a0228d2f57a5ad551b8760cfcc521f38c49284ed3976e3515bca49
SHA512 36e6beaba33a16203f996d6e8fd987347028d590a4b4bcd4d2a129876c486e03b9ba13f279f301e91aec1e0f8e91bf109a27f2b464f15a3e1a2b56d03473b69c

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_862379018\hyph-en-us.hyb

MD5 b2693233d14890c81d322bec948549e7
SHA1 7ea8e42e319305010d3e6568fb4983171583dd06
SHA256 03727cd6f4aa71b203c4c74ca6987ac7d87f13037337ac6f4b6996c2a0dc5f8c
SHA512 1bcb5a9c3db408fba6a6d02162a294c5c7264d4b202eb332da8d02c0c662cb070cf1534d5aa0754788d35abc88273f3337ca5f302ada95bcad077eaa52804915

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_862379018\hyph-es.hyb

MD5 f6bd0377237fca3c4b7c6a6cb244298b
SHA1 b8df975889cfb06fc97db3d63a7820b7cf621f40
SHA256 137461792537a2e56a6475e81e2b9ad7a2bdabf1f4738fae186dca3022357349
SHA512 0a36860580e295122f5e49091127386edc762eedba80a2d7ad958ab33307aabcd420173e08ae797a19664bc830800d92c548f3e434bf19bfd7791e50e0c45c2a

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_862379018\hyph-fr.hyb

MD5 092e0a95d6dada26ca56d2ed558749a3
SHA1 40bd8296e5e852fe725c7119083a8d5614037cf9
SHA256 00bd8b2d398d77575da2bfbbc5ec641aad7f2a87d4a31186ec169e85a27de5b7
SHA512 c04ba62f4a0336e9b25bd2f6a8c3cb82c8b6127c1c04fc173abc9bf03767a9ffe18c9241b301d6f71f79f3377bc990f25f099d7660880c097a9cf4bb1e4bd48f

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_862379018\hyph-kn.hyb

MD5 d986ac2e7c75cf3ef929a7a269ae0d5a
SHA1 de8bf2ee2b8a77102337c45e5fec924c6c02355b
SHA256 2b999d0a152f804601aa8f38ff0d3a6e5949977bf1daa76fa888acae21526287
SHA512 5475c82fd5074334bc5f0f89edab62e94bc5865da0432c6f830b50db3045afda12bb698659951f6d0f76c55a43e1add8d47ad7fd03597bbe92d8178ad4783c71

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_862379018\hyph-mul-ethi.hyb

MD5 b42317960e5da868a8120cb79a440abf
SHA1 5bc583fe2bcf8d9ef971c66a5f57821aad1458cc
SHA256 f2fac1bd069ffe5cd1112d94cc31137ed38a1b161093ecd74c9c1688428b688b
SHA512 c26c686f7a1ae785a6d5b5856670cf9b7bc48e4a388d2e2922b21fd6c0124357acfeb73b370ab617c5ed4b033d945fb3c7cc235a661baaa7fb976dd6edec66c0

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_862379018\hyph-nl.hyb

MD5 d3bb05944de3d0d7186e7e9383805e2c
SHA1 1b1ea734d900f8d766e7226fee09ee14fe606a7b
SHA256 5ebde398944b461cf940f0520c5a49c0882b6f36f9ac5cda0538c8c8b44fb7ca
SHA512 5fd9c6e5e4f060d1b37b7e80f162ab10c1efb24258a5bb26c89469004191ec5517e4cf4c1c7724c838c62b5358d3c95d515c1ee4a5b001c42c3325ce1d11a928

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_862379018\hyph-uk.hyb

MD5 0ec028755f0cd9ebba41fb7273de8baf
SHA1 a8a784454269a2769710fb3725730f06cdd7b242
SHA256 1c626abe40d43f6d56a01b5b40305d7c7d6481f616eac00a3f3aaaaca8388786
SHA512 024c611ebabb0a84b5a887d808e24884ccbb4550f222e651728451cddb9a941d7d9a39786ddfe4a57d049dc82780c6bcf376d3e98547ecc4808fc7ed32ed47a9

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_862379018\manifest.fingerprint

MD5 1d09a9a5e62b846125cd7b929cccbe44
SHA1 5271237c4d13f7735689a5acc52e48c491669aa3
SHA256 1703e4e777b285aba435e71256890a5fe92d24cb01e0eefd03baddca228eee2f
SHA512 cd2a2acc126ac6a7dcc81088047c894a427a44c5caa96003c1f3521beac3b46c117f0794e564838de14a18a3f65cb7988ba86b404e690ec77a57518247c03fbb

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_862379018\_metadata\verified_contents.json

MD5 117d173e82b282deca740475e35c8ecd
SHA1 912b12b993507ebd9af6bdc937559b4d4b58a0d8
SHA256 65491b21947d60c87c6358dcf69df9aca2b99e8f3b611bd3d559699bbc25000b
SHA512 e455c0bb68e9056c6242058fcba954bc1d5ea4a864e99be008b2745c51209b477bd7bdba57006be4a02a09bda49c0cdc17e8f870c81c7771864640950f5f9a93

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_862379018\hyph-und-ethi.hyb

MD5 4aa9b2c0c9ccde5140d01dc6502242bb
SHA1 d1759e8a62a42a72529adf9bc73820bf32f2a37b
SHA256 1de83cb787dfaf53fb7e6e8db3aae5008ad24ebdd28be02031306ea9e9f3e285
SHA512 1b456301d814810e857e8a0c426e703a802febb5c3dfd8d0e5c58aeefc6c2d6f55c95830024c243d2bfbb8322ef72e9ff959cdc7f92ae51bebe8b053d9cda1e5

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_862379018\hyph-tk.hyb

MD5 ed60185b6f455b6f8ed27eaeb73334a9
SHA1 11e53bda5e2a0acd000692ad8af45611b57277ad
SHA256 77fdaed29bd842aaa976ab7ef81b617a15c0a2d1ebd1161c1bf26b79a108b5cd
SHA512 3ef211a330efe9e34468c9c460dfcda1b8da80d113317a177205c76ffcb916ff25ffcb4485703fd01ee248d356a67e5bb18df8e5ea40b2aab3999121083b7e30

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_862379018\hyph-te.hyb

MD5 bf9df63b3c97de3bff99e24ee4bc5f2e
SHA1 774659cf1d58bcfc69900315281e99e038cd2a97
SHA256 516fa9654fa3aeaab480d40eaf6ad78fc039086bd8edc144be3d59525edcac29
SHA512 52f40a2c38cc62aa6b0e081c90b9dfcd6d3ed03a4a90e596e11ac85bfda96eaa74d465cd7168b803c0d59a53df878b0ea1ca657c5caf3de49c8758cbd527bee2

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_862379018\hyph-ta.hyb

MD5 ab2f6f9696fc7d699356244725e7c778
SHA1 2026841da77dd77715b521ec73bf819d1d098b60
SHA256 40fda94856a86f065de8baa6184ea63dcdb011ee4ca498a7c1fee44c99314c67
SHA512 88a4c2117102bdb60d482448c36dd79a8da1130a4636513c8ed56eb282da6c638d27eabc9799eab8bc1a7234a0aa6690c55408500608387912fe283f13bcc328

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_862379018\hyph-sv.hyb

MD5 892598dc59ce71e68ed337ed9ff3abc1
SHA1 c89af0d28b8b769150981539ec2318e34df29cce
SHA256 56642aa5a37625ff9d034761d16b034d4ba5be74090cbd825956bbce2775ecd1
SHA512 eb13a68ff5cdd0edd73ce4c109984b3e58763812c31755bd55c0a324048873f610e36d1c41b3f642a64f7fe0945ee872a02fde744d5821aab03a2288851d984d

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_862379018\hyph-sq.hyb

MD5 a22d0f39cd83f3a8e251f95c5b12dd31
SHA1 24915151b31525a0a9ea0ef7faf8ddb8b3faf11e
SHA256 bc29c9401ce952414cbaebc5c8ee1d27c1706c6f77807b5ff713e2124438b3ca
SHA512 ad319fc85aa612bedad8289a20fcf42d4336c4b3ed704ce74c6c0ed68e3e18d62c18549f8a5efe5bd481d8def514f2c6b083803485e04bd5919bc600501c0e00

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_862379018\hyph-sl.hyb

MD5 a21358dd4506643486f72f7d80d60a5b
SHA1 fb7ee02adc970f4d71c84d18777a59508fa1a46c
SHA256 ad746c68562603ac3b15e89da03c76e081c08e7d9c8d4c9f64763e53d696c77c
SHA512 7dc9e18050b3df4288aacaaffdb17668f0b5d8b5e103305070d2ef83dab2f5dbe3b071b05ca69340d86a53d47d4cf8197ecc1bdd086a320bf81f9df8c0d3ccb8

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_862379018\hyph-sk.hyb

MD5 cea295e8b4b99f95738727905a9184e2
SHA1 31db6c826fd7830bc76f0ac1b9d21c2ef67f8b1f
SHA256 138c5990961da21993653f54a413ddacb8921d6d70b892b7ca154d6e8ad2028c
SHA512 b20f651c74a070a4d26b58bd8462e553077b7333a2c854f7974a7e67bc442c3a6feba52c3a537fd9f1579d5de0126bbe1da4be99aabee79b7987b2edfdd8ed67

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_862379018\hyph-ru.hyb

MD5 4d132ab42e0c8abd3ba93d8b34bdbeb3
SHA1 f3ce82f2dbdead517d5faa4490e1975ef8fafa6e
SHA256 336ce2048ffd31b7bcaf435e53badfaf0579e405042d49adbc0823f6be5f9614
SHA512 eb8e27ab070db7407f1ede29751aab4a88f4182e878e956cc51d0ed9ef2c9afdec208f2f4700551374c5a7f69c176ed7d6cb771ac17c3eae77323a5709a85fcc

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_862379018\hyph-pt.hyb

MD5 564ff32ded64c6bfc693f2758a53d68e
SHA1 3965f963d36bee1598683e72c857a3bff196b295
SHA256 f6fbf1bcb260cc86256fc494f388f7b27d10865fbf8f61517dee25af4d58d6e8
SHA512 e9e574ba07703295aa8b7fd4603ef079816ea44394bd62750e08e523b9a7b408fd979552d90d04f825242ccada7ad66003fba76c9c8469541b5c6d2fb85c41e8

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_862379018\hyph-pa.hyb

MD5 0f27e5bccc1cd9ddf3eac020da27da57
SHA1 bd3c83300aad3e79287c1e806e864f7644240911
SHA256 470329d28faa484f945d78ffefb176dcb6f2032c753e25bc014106ad24b2c68a
SHA512 141da09a4a1a3b9e581751a1b2c70cbe981e1a915ea538a8015c7614d11be059cd3a03b4f2420f963e5657a4417b3cc5c3a22e0028132a21363219e27751ccfb

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_862379018\hyph-or.hyb

MD5 7e265a294303f69aa66c243f5f474463
SHA1 4d382ab4bed3dbe481710f0c651ca87b2394661d
SHA256 4e9cd302baffc4ea3e9652327ea24072ebf37b5c4fc0719292bdac10aaad665b
SHA512 d347d422249945c9a664be3c48e1ec07becaf03bd3525869f06c9aa328b4fe2884ac963cb97949d97e5ab41617b0fc6f2a2171f06007bf94cce88d55a15da922

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_862379018\hyph-mn-cyrl.hyb

MD5 07cda8332b62726883b29290ca35fc89
SHA1 2e3e1a7e4484225d8e25a59695e86eea9f516ec6
SHA256 0d2731f16aa2c90faec8e63260358cbccede403faf95e3af8c66bc2db0729ca0
SHA512 a55a5a7ad3e6b084bb15d360a732f344eeb59e0ecdb8a431dc9379653d3cd828131daf18dd91b6b45001aaeecbaa87e1afd6eab4a795373dca1c4e68c7e0cc85

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_862379018\hyph-ml.hyb

MD5 84a0a36ea2c5b3209a3cd40d1043230f
SHA1 a98436b640a8cfb9cffa26e89fee768dce6f0747
SHA256 90572db8f49b01ec6a102732cdf14fc3f07d363cbe0d261103e583043164e888
SHA512 845ab7b075d3ec490c477af3b1f6d28cdc83289d206d079730f69ffd32a0fadb04eb3c9539e4dee6dac080489aea9f3365a20810b4bbb229c2aea3558bcfa1f5

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_862379018\hyph-lv.hyb

MD5 05dfdb7f1ee5744573ccd62ae565b2c7
SHA1 754991bdb092e363b8d884246f4ca780cc9ab2f3
SHA256 65962ccb5055e4c693e5ac493d6affdc810ec168eb2942f5705b7f4e464f9993
SHA512 11675bc30f19161666f0d7b5ae001cd2682989465dd3f4973c455ba50eb1250e56fd1782d9589af2f8b3d6843a611d75d38e4ccc03a529a7b42cf403c482f2e8

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_862379018\hyph-lt.hyb

MD5 970c2671eac4fff6d840dc122e43b7c6
SHA1 d849f8b0950dea8c45e60296f6c8a7ae2e0f3f95
SHA256 6fe2da26a96834fb9aecbe586d40f728df0ef676a4f235450054e66841b9e2ca
SHA512 c6b799aaaa714650ca39f8728bef6989e7e801508366caf1b384f021ee443bf21b3f59d28c2d9123a1f59b4abd3a27522cba830e431940e6ef9dccb5a319d581

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_862379018\hyph-la.hyb

MD5 9aaa47272099a013a4389bc314b7d2ed
SHA1 20b5bf65fa2023e67ea0687f643b52eab3fc68e9
SHA256 fd4b6f36135cd3b932e350ec2017dfd89d2e36ac226f54e4c8f2e4bc6db0593d
SHA512 318b17b2e2b16ec73f231455d633c69fd44b32868c215053b3ccca54472e775d4589cbb4daad2fe37a40f79b6cde497f654654be009d485a84327e0f560fc843

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_862379018\hyph-ka.hyb

MD5 aa6c771083158380b2631f01e3f64f20
SHA1 1b41cd8e7585dcde57fc0b40502328845e524457
SHA256 2472271c7955c67e9fdb86d0cd3c5d88f5e598da4f44b6741284b2bbcb2e4d52
SHA512 f8cd93862ca2f76d769721bbf858955fc007bcf2e1892ae3e50846e28c6027208869f580479d3888610820ad5348a21a8709984aed844669fcaaa3f14199addc

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_862379018\hyph-it.hyb

MD5 a4d5ec24d4c5ee745cdcdc019018074f
SHA1 15dcd0305508afe357eee16a543f4ce547ed500c
SHA256 f9c027d7fd44b01cd5e1cdf802e20c63560673098af18bea0930ba9af334e0f7
SHA512 e9022473816f2ecf4b5b06bd6b28d75ec64fdff974a991aa522eb105e3aa8d23dda0a45e11040af4db32e1f2e8cfffc058bf29fea1403af5a724831c730719fe

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_862379018\hyph-hy.hyb

MD5 70ea4451c3a26fd7197a3d2188be4152
SHA1 e0c1390d94876bf2a3cbdecaabb0e335bd86355d
SHA256 9b34dfca85cb27546829f104f137757efb274934c1e9d4991f55ad564962a76a
SHA512 ac957947c51ea23a9b7ca482db08f0ca3332b8048025a96acb01a4486c1a87c3f3d08898e94cc8e0b20721c56ce708fb37e1bd81bee1fedba60a7f370d5ddaa4

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_862379018\hyph-hu.hyb

MD5 37b1f197e8dfbafdac4597edcf673e63
SHA1 e672c6870417c71acdcda6c16a7185d7a868eb68
SHA256 8b3a16268cc932b226c17ff405b3cfb6eb38a9511a2043d653dc03729efceac1
SHA512 69ee820439633b348bf8efdd3c498a30270753e53ff78d022bd1b295c6c95e0501955009f610a12fc55c786a563b0af40d2b69a7584b47662b943acbac2d3634

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_862379018\hyph-hr.hyb

MD5 1864e47e724bb7f9c052a2840eee21d9
SHA1 9749136107913d6570c0c46ae2b52e66d8284c38
SHA256 d5f066a5657f1d7c39d053956df204b7926f40d2fe4f69573af09d909066e26c
SHA512 2d6e76aed93652510f5864dde1e1923c67e7413e895abfa8fc7e8c9177e228e4d153afb7099b86697d1662ca3124ff2173f4aab2c978d52583a8e2dbc70c0842

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_862379018\hyph-gu.hyb

MD5 f6dc4e0fb974869d3d9457c582a38690
SHA1 e6708afa342639eb96cb97d1f541a421b2626d00
SHA256 af0edb67c2219b803c3eb6c1dee6f2d41a3fe00468a9da8be8ef5056d701abf3
SHA512 a778236fa8c5f28e747214d0ba0417aca1c9a95e4c013fbc21e6defe39d0421a2b27ccb27e6f248404a9f6b5cd1014574d0478078f36af2a0181872ac8173d72

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_862379018\hyph-gl.hyb

MD5 1b08fb098d29c30488b8fc3f19dcf8b9
SHA1 df6e03da66a7a5ae4927334808c8c20752733667
SHA256 89d98eff14e2cf1c2314efdf392339e62d7e786f100202a7377bf7b22095a0c5
SHA512 de1de90bd44d8977a4a69d6c64bc90f421f5e099396d06fc2466de6ee62a59f5a59ac1ba0ea96e69dfcf744f12165a8a9e9fda73afe5d38704a7b3b0488a369b

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_862379018\hyph-ga.hyb

MD5 768032a419e0ae3bd870d591e2173715
SHA1 58fd709a1dc40176fb72189c20567ac1950b9db7
SHA256 1e3043f395bfb2a4c43d0480ba2f168ed622881cc3482359ca6e99821e983be8
SHA512 4a4ca1f735b82f625002b0292f623179f2a6ce736f633cbfd6868e3db0709eb06eb462bd9da3ffa8365c3c38fdacba735ad32266cb3ec33d3e583ed073d0e3aa

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_862379018\hyph-eu.hyb

MD5 e90ea97070cfcfa795fbd807ac300d34
SHA1 8c83b4cd54d394aeff31b14a219f2a3562132908
SHA256 e2778a4fc7b8f064a32b6a44bc29f10e264d9d6214b8edb8ebd1f5f6d68e2eb2
SHA512 210dd857f7799f1a926c7aa73f26912ad60723e099acf1566bc39efd445a1b194be4dc557d5da6874e7d75a37115aead9389b8009eec1422764e6648fe4cf8f1

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_862379018\hyph-et.hyb

MD5 2ae42ab807286f6ec0ff1876d9536b0b
SHA1 cf3bbe7348eaf2cb3d93c5cc10964bb8d1ba07c1
SHA256 10079c66014dd2e6abfef5a018e6553fd5a036afb96bd2a235440a188f88b15e
SHA512 13c193571a7374bb169f6f0f06a9af7f8251cfcbf60825a85396c907d40f7837c8efd0a7bc8b6c4deed2bfca7b8508f132932d7860c2c9a4fb568d8ba2acaea9

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_862379018\hyph-en-gb.hyb

MD5 fa3dcb77293a058277cb148a0ff491fa
SHA1 3335315b13cd82075da2adbebe32759c01833e8d
SHA256 ae4b78009d18e849d87458677151ee3aad1608ad72ec050dfd2421d22e7d031f
SHA512 c83a8c4eb29c3171fefe983c3e342b6af1bc1add7288c75c5a782dc14f12d2af83043c2b43c9ab3e5db61c91de6d7cb473746517debcff7ac2c0f05bb8b0971c

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_862379018\hyph-el.hyb

MD5 746a59e9f9dda15c0f17c1b72921c85f
SHA1 eb7f671af76eac40787d9227d41453b5117889bf
SHA256 76ae3454fb0045adb83094832578aa4749ce4dc694c4edcf85b419c1e2d9bcd3
SHA512 8894b754377285e2f3071fa5bcd714f249f3dc85bf3690641c6576b070113c1e72caa61e7e2c97d35a7f79b08c2969bc4a2fe46bc4bffc4ed58069387dfa7834

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_862379018\hyph-de-ch-1901.hyb

MD5 c6773229845710633d3a4d6dd9800fc5
SHA1 1d4c2e5f3ddf5627164edb471e8a8177993449f4
SHA256 8223a912160354e05735522fdb339dc59b353ad5d1e4f4cfa94898dc348e748f
SHA512 ea69926520429cd934d52d84a7fcad6bc9bb654085d8d1de813e73f191ebd7b310e2e68b4bb43fecbd88cfd15ead7fe295405c01b7fdc225914b0477c08d4e01

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_862379018\hyph-de-1901.hyb

MD5 dd9d0a81d897f88f76c1f6d69fb7483e
SHA1 520bf6111f902196591ea358fa8ab4ae89ee0acc
SHA256 8c5fa4b29519d17593e923bc6a9a284df7a6d07fac42f897110b8fb2e0baeef5
SHA512 8c0a339d353cac1c66542bcfb7d41e7241a59a1886fe8a189aa155aafdf3bd23274f956d3d8a49be5b23cceafb516648a0e0b44f67e6f5ca60e216fb3f362ccc

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 48fac5405c5bf424a5e735e7324b7b19
SHA1 f011ec055b9d2d07ac5af84165391ff14d51f782
SHA256 0f524c7b175072e136c1842e6ef10084beab69b66171084712d589ecca489a05
SHA512 8ee3f1f76b03517d57f914243f25d4bc42a92bc5599cd89600c52786121a7aa47842cb4232b46c0f00b62dda6935aceb26fd6eddd26e32ca07e02fadbaaee6c2

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 0d0a3d0738fed31da4112a79b25267c2
SHA1 ece864fe52c20b2d03693fa871f7360b055eff40
SHA256 798eff5f2805744392b9669000e0f4c15ac6cb76ebcaf278415bb288a94f85e8
SHA512 0feb6aa2051281fe77c8481691aea6ab4835767d3679fc6e24ef8a12d33b2c27085791a89f97e95746c2b68ac0f1e5b1402bdb8b99fe5b76157a0ad5143d2026

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_2143859322\manifest.json

MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 e281e07ed4f61276402de28fbf8ae054
SHA1 f7b48a51d976c7c845f54294221afd3285a3ff39
SHA256 1d8d6d5548cc14bfa20a8ae3674c78abe509aaff19389b57a0557a9b6f379f6f
SHA512 78da6026bbeb63a312209377067a21adc4b89e2c78a1f0ad4bbb7f81b87911d853208fdd5da52a6c6cb67aa3f1bc74a1121a9e6c1a0048ac80226244a1f2ac47

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\Network Persistent State

MD5 e8f0450ffb9efa00234282cf3d5d5533
SHA1 3f337d62bed19bb0d033e2eacf20af0d8d8e4d4c
SHA256 a897aa96bf67c3a200a002da50f9bade732cfb3f42263cee192cb5f5665a1f28
SHA512 dd754a608fec700b3a2f1f13fedd42e67cd5d14087d738c25355ad62c7f12a42d5ccd860536f77f066246b0876c2611a8e7741a73685c64a2eaf34e7a59af47a

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\datareporting\glean\db\data.safe.tmp

MD5 670018f6ad1e336cea17b45bd8f273aa
SHA1 29c5912905c0e7a9c2537bce178076acbc2abdfa
SHA256 a35e88b1c73e3b593b031afcb8a4aabb29684ecd7bb516741b9df8ac45899693
SHA512 2d6d483eb7da61742f4ec81da9d0c79b072e86fb68abc17b662387dc63792a60af187d4ffabe212e2c3b0547f86056bcef3fba8f385d0d5ef4a57a65b9e8e02b

C:\Users\Admin\AppData\Local\Temp\remote-settings-startup-bundle-

MD5 033004c4b80cb0ad6422b68c1075f6f4
SHA1 ae13165c2a563e4844b2fdf74dc43c7ea14b0873
SHA256 96711d18de22c8f5c831aefd68749723f98ffc18f6728a7870c7bb995efbc167
SHA512 be450b61fb585becdf87d1655aeeacec5acf583d3a1eb08800ea10cbe8ed3326477613c2793b2119d19ea6e812d786f1c9af48fd9611ebaddf06e432ef1cd70b

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 ea735c181039d7dc085874105eb74662
SHA1 b14234705e0101e4e679daf040d317533853b6fb
SHA256 30e02c3fa557d1b8b103b5658407e5c74e394ef757ba1548812f7a83f939bd85
SHA512 80cc5fd77e7384ff0072a646092fca3abaca4b3dc65d5243201eeb639e3d7ed1f22f97bf1d8bdc9323247a4a352740623e6003a6c489107a33e4216a3375219a

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\personality-provider\recipe_attachment.json

MD5 be3d0f91b7957bbbf8a20859fd32d417
SHA1 fbc0380fe1928d6d0c8ab8b0a793a2bba0722d10
SHA256 fc07d42847eeaf69dcbf1b9a16eb48b141c11feb67aa40724be2aee83cb621b7
SHA512 8da24afcf587fbd4f945201702168e7cfc12434440200d00f09ddcd1d1d358a5e01065ac2a411fdf96a530e94db3697e3530578b392873cf874476b5e65d774a

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\personality-provider\nb_model_build_attachment_sports.json

MD5 ce4e75385300f9c03fdd52420e0f822f
SHA1 85c34648c253e4c88161d09dd1e25439b763628c
SHA256 44da98b03350e91e852fe59f0fc05d752fc867a5049ab0363da8bb7b7078ad14
SHA512 d119dc4706bbf3b6369fe72553cfacf1c9b2688e0188a7524b56d3e2ac85582a18bbee66d5594e0fb40767432646c23bf3e282090bd9b4c29f989a374aeae61f

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\personality-provider\nb_model_build_attachment_computers_and_electronics.json

MD5 6ccd943214682ac8c4ec08b7ec6dbcbd
SHA1 18417647f7c76581d79b537a70bf64f614f60fa2
SHA256 ab20b97406b0d9bf4f695e5ec7db4ebad5efb682311e74ca757d45b87ffc106b
SHA512 e57573d6f494df8aa7e8e6a20427a18f6868e19dc853b441b8506998158b23c7a4393b682c83b3513aae5075a21148dd8ca854a11dabcea6a0a0db8f2e6828b8

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\personality-provider\nb_model_build_attachment_science.json

MD5 7a8fd079bb1aeb4710a285ec909c62b9
SHA1 8429335e5866c7c21d752a11f57f76399e5634b6
SHA256 9606ce3988b2d2a4921b58ac454f54e53a9ea8f358326522a8b1dcc751b50b32
SHA512 8fc1546e509b5386c9e1088e0e3a1b81f288ef67f1989f3e83888057e23769907a2b184d624a4e4c44fcd5b88d719bd4cca94dfb33798804a721b8be022ec0c6

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\personality-provider\nb_model_build_attachment_jobs_and_education.json

MD5 2d69892acde24ad6383082243efa3d37
SHA1 d8edc1c15739e34232012bb255872991edb72bc7
SHA256 29080288b2130a67414ecb296a53ddd9f0a4771035e3c1b2112e0ce656a7481a
SHA512 da391152e1fbce1f03607b486c5dea9a298a438e58e440ebb7b871bd5c62d7339b540eed115b4001b9840de1ba3898c6504872ff9094ba4d6a47455051c3f1c5

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\personality-provider\nb_model_build_attachment_real_estate.json

MD5 9899942e9cd28bcb9bf5074800eae2d0
SHA1 15e5071e5ed58001011652befc224aed06ee068f
SHA256 efcf6b2d09e89b8c449ffbcdb5354beaa7178673862ebcdd6593561f2aa7d99a
SHA512 9f7a5fbe6d46c694e8bc9b50e7843e9747ea3229cf4b00b8e95f1a5467bd095d166cbd523b3d9315c62e9603d990b8e56a018ba4a11d30ad607f5281cc42b4cd

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\personality-provider\nb_model_build_attachment_shopping.json

MD5 97d4a0fd003e123df601b5fd205e97f8
SHA1 a802a515d04442b6bde60614e3d515d2983d4c00
SHA256 bfd7e68ddca6696c798412402965a0384df0c8c209931bbadabf88ccb45e3bb6
SHA512 111e8a96bc8e07be2d1480a820fc30797d861a48d80622425af00b009512aacb30a2df9052c53bfbf4ee0800b6e6f5b56daa93d33f30fecb52e2f3850dfa9130

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\personality-provider\nb_model_build_attachment_people_and_society.json

MD5 b1bd26cf5575ebb7ca511a05ea13fbd2
SHA1 e83d7f64b2884ea73357b4a15d25902517e51da8
SHA256 4990a5d17bea15617624c48a0c7c23d16e95f15e2ec9dd1d82ee949567bbaec0
SHA512 edcede39c17b494474859bc1a9bbf18c9f6abd3f46f832086db3bb1337b01d862452d639f89f9470ca302a6fcb84a1686853ebb4b08003cb248615f0834a1e02

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\personality-provider\nb_model_build_attachment_autos_and_vehicles.json

MD5 39b73a66581c5a481a64f4dedf5b4f5c
SHA1 90e4a0883bb3f050dba2fee218450390d46f35e2
SHA256 022f9495f8867fea275ece900cfa7664c68c25073db4748343452dbc0b9eda17
SHA512 cfb697958e020282455ab7fabc6c325447db84ead0100d28b417b6a0e2455c9793fa624c23cb9b92dfea25124f59dcd1d5c1f43bf1703a0ad469106b755a7cdd

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\personality-provider\nb_model_build_attachment_internet_and_telecom.json

MD5 36689de6804ca5af92224681ee9ea137
SHA1 729d590068e9c891939fc17921930630cd4938dd
SHA256 e646d43505c9c4e53dbaa474ef85d650a3f309ccf153d106f328d9b6aeb66d52
SHA512 1c4f4aa02a65a9bbdf83dc5321c24cbe49f57108881616b993e274f5705f0466be2dd3389055a725b79f3317c98bdf9f8d47f86d62ebd151e4c57cc4dca2487c

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\personality-provider\nb_model_build_attachment_pets_and_animals.json

MD5 5b26aca80818dd92509f6a9013c4c662
SHA1 31e322209ba7cc1abd55bbb72a3c15bc2e4a895f
SHA256 dd537bfb1497eb9457c0c8ecbd2846f325e13ddef3988fd293a29e68ab0b2671
SHA512 29038f9f3b9b12259fb42daa93cdefabb9fb32a10f0d20f384a72fe97214eff1864b7fa2674c37224b71309d7d9cea4e36abd24a45a0e65f0c61dc5ca161ec7c

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\personality-provider\nb_model_build_attachment_online_communities.json

MD5 37a74ab20e8447abd6ca918b6b39bb04
SHA1 b50986e6bb542f5eca8b805328be51eaa77e6c39
SHA256 11b6084552e2979b5bc0fd6ffdc61e445d49692c0ae8dffedc07792f8062d13f
SHA512 49c6b96655ba0b5d08425af6815f06237089ec06926f49de1f03bc11db9e579bd125f2b6f3eaf434a2ccf10b262c42af9c35ab27683e8e9f984d5b36ec8f59fd

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\personality-provider\nb_model_build_attachment_books_and_literature.json

MD5 df96946198f092c029fd6880e5e6c6ec
SHA1 9aee90b66b8f9656063f9476ff7b87d2d267dcda
SHA256 df23a5b6f583ec3b4dce2aca8ff53cbdfadfd58c4b7aeb2e397eade5ff75c996
SHA512 43a9fc190f4faadef37e01fa8ad320940553b287ed44a95321997a48312142f110b29c79eed7930477bfb29777a5a9913b42bf22ce6bb3e679dda5af54a125ea

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\personality-provider\nb_model_build_attachment_games.json

MD5 4182a69a05463f9c388527a7db4201de
SHA1 5a0044aed787086c0b79ff0f51368d78c36f76bc
SHA256 35e67835a5cf82144765dfb1095ebc84ac27d08812507ad0a2d562bf68e13e85
SHA512 40023c9f89e0357fae26c33a023609de96b2a0b439318ef944d3d5b335b0877509f90505d119154eaa81e1097ecfb5aa44dd8bb595497cdecfc3ee711a1fe1d5

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\personality-provider\nb_model_build_attachment_beauty_and_fitness.json

MD5 0ed0473b23b5a9e7d1116e8d4d5ca567
SHA1 4eb5e948ac28453c4b90607e223f9e7d901301c4
SHA256 eed46e8fe6ff20f89884b4fc68a81e8d521231440301a01bb89beec8ebad296b
SHA512 464508d7992edfa0dfb61b04cfc5909b7daacf094fc81745de4d03214b207224133e48750a710979445ee1a65bb791bf240a2b935aacaf3987e5c67ff2d8ba9c

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\personality-provider\nb_model_build_attachment_finance.json

MD5 e95c2d2fc654b87e77b0a8a37aaa7fcf
SHA1 b4b00c9554839cab6a50a7ed8cd43d21fdaf35dc
SHA256 384bf5fcc6928200c7ebb1f03f99bf74f6063e78d3cd044374448f879799318e
SHA512 9696998a8d0e3a85982016ff0a22bb8ae1790410f1f6198bb379c0a192579f24c75c25c7648b76b00d25a32ac204178acaccd744ee78846dfc62ebf70bf7b93a

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\personality-provider\nb_model_build_attachment_arts_and_entertainment.json

MD5 6c651609d367b10d1b25ef4c5f2b3318
SHA1 0abcc756ea415abda969cd1e854e7e8ebeb6f2d4
SHA256 960065cc44a09bef89206d28048d3c23719d2f5e9b38cfc718ca864c9e0e91e9
SHA512 3e084452eefe14e58faa9ef0d9fda2d21af2c2ab1071ae23cde60527df8df43f701668ca0aa9d86f56630b0ab0ca8367803c968347880d674ad8217fba5d8915

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\personality-provider\nb_model_build_attachment_law_and_government.json

MD5 80c49b0f2d195f702e5707ba632ae188
SHA1 e65161da245318d1f6fdc001e8b97b4fd0bc50e7
SHA256 257ee9a218a1b7f9c1a6c890f38920eb7e731808e3d9b9fc956f8346c29a3e63
SHA512 972e95de7fe330c61cd22111bd3785999d60e7c02140809122d696a1f1f76f2cd0d63d6d92f657cdec24366d66b681e24f2735a8aabb8bcecec43c74e23fb4f5

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\personality-provider\nb_model_build_attachment_health.json

MD5 11711337d2acc6c6a10e2fb79ac90187
SHA1 5583047c473c8045324519a4a432d06643de055d
SHA256 150f21c4f60856ab5e22891939d68d062542537b42a7ce1f8a8cec9300e7c565
SHA512 c2301ed72f623b22f05333c5ecc5ebf55d8a2d9593167cc453a66d8f42c05ff7c11e2709b6298912038a8ea6175f050bbc6d1fc4381f385f7ad7a952ad1e856b

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\personality-provider\nb_model_build_attachment_business_and_industrial.json

MD5 a92a0fffc831e6c20431b070a7d16d5a
SHA1 da5bbe65f10e5385cbe09db3630ae636413b4e39
SHA256 8410809ebac544389cf27a10e2cbd687b7a68753aa50a42f235ac3fc7b60ce2c
SHA512 31a8602e1972900268651cd074950d16ad989b1f15ff3ebbd8e21e0311a619eef4d7d15cdb029ea8b22cf3b8759fa95b3067b4faaadcb90456944dbc3c9806a9

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\personality-provider\nb_model_build_attachment_food_and_drink.json

MD5 70ba02dedd216430894d29940fc627c2
SHA1 f0c9aa816c6b0e171525a984fd844d3a8cabd505
SHA256 905357002f2eced8bba1be2285a9b83198f60d2f9bb1144b5c119994f2ec6e34
SHA512 3ae60d0bf3c45d28e340d97106790787be2cc80ba579d313b5414084664b86e89879391c99e94b6e33bdc5508ea42a9fd34f48ca9b1e7adfa7b6dd22c783c263

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\personality-provider\nb_model_build_attachment_reference.json

MD5 567eaa19be0963b28b000826e8dd6c77
SHA1 7e4524c36113bbbafee34e38367b919964649583
SHA256 3619daa64036d1f0197cdadf7660e390d4b6e8c1b328ed3b59f828a205a6ea49
SHA512 6766919b06ca209eaed86f99bee20c6dad9cc36520fc84e1c251a668bcfe0afcf720ea6c658268dc3bbaaf602bfdf61eb237c68e08d5252ea6e5d1d2a373b9fe

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\personality-provider\nb_model_build_attachment_home_and_garden.json

MD5 250acc54f92176775d6bdd8412432d9f
SHA1 a6ad9ad7519e5c299d4b4ba458742b1b4d64cb65
SHA256 19edd15ebce419b83469d2ab783c0c1377d72a186d1ff08857a82bca842eea54
SHA512 a52c81062f02c15701f13595f4476f0a07735034fcf177b1a65b001394a816020ee791fed5afae81d51de27630b34a85efa717fe80da733556fdda8739030f49

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\personality-provider\nb_model_build_attachment_blogging_resources_and_services.json

MD5 c82700fcfcd9b5117176362d25f3e6f6
SHA1 a7ad40b40c7e8e5e11878f4702952a4014c5d22a
SHA256 c9f2a779dba0bc886cc1255816bd776bdc2e8a6a8e0f9380495a92bb66862780
SHA512 d38e65ab55cee8fef538ad96448cd0c6b001563714fc7b37c69a424d0661ec6b7d04892cf4b76b13ddbc7d300c115e87e0134d47c3f38ef51617e5367647b217

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\personality-provider\nb_model_build_attachment_hobbies_and_leisure.json

MD5 bb45971231bd3501aba1cd07715e4c95
SHA1 ea5bfd43d60a3d30cda1a31a3a5eb8ea0afa142a
SHA256 47db7797297a2a81d28c551117e27144b58627dbac1b1d52672b630d220f025d
SHA512 74767b1badbd32cacd3f996b8172df9c43656b11fea99f5a51fff38c6c6e2120fae8bdd0dd885234a3f173334054f580164fdf8860c27cbcf5fb29c5bcdc060d

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\personality-provider\nb_model_build_attachment_travel.json

MD5 48139e5ba1c595568f59fe880d6e4e83
SHA1 5e9ea36b9bb109b1ecfc41356cd5c8c9398d4a78
SHA256 4336ac211a822b0a5c3ce5de0d4730665acc351ee1965ea8da1c72477e216dfa
SHA512 57e826f0e1d9b12d11b05d47e2f5ae4f5787537862f26e039918cb14faff4bc854298c0b7de3023e371756a331c0f3ee1aa7cebbbf94ec70cdfc29e00a900ed1

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 436b2217258a718c3ae8c13243ec801d
SHA1 4f1060367cbd4fd5d3f5e016d94f096db0570054
SHA256 c901e38f3424376b79be0ef362284e870b8b527ac5e5d1bd09253cbf5d985cb3
SHA512 133e405db639db49b7ac72da021a501c0f8ce7dabb3f8a87137e7494d714f7b0eb70773187a19ee05c05318bf30a9040374c611336272b804bc87bf38ca27d13

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\datareporting\glean\db\data.safe.tmp

MD5 627a330765113ae91276b81c2293e52f
SHA1 80b5b45342f1d0860fae706f5a3209b8bbc4ba4d
SHA256 7445a08102d1399665c62fe4c45a58c1f1aa746ef0507d92cae763822e2f9ea1
SHA512 cff68390cca222386b7667ff617540bf37188caef20028af7c629527517be08e1ad2016269dab60f1398d77ea11cb49d1c22eaafe172c3dada23caed54e2d897

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_34329359\manifest.json

MD5 a4edf901d950a9758ffe578ff1b03212
SHA1 cda83d7736a1c05a7d2cb0b6704653c27b4a4ca5
SHA256 aaca603fa9d65fefeaa198a93d03f2511de66b6398cc34dde6233eab492eebfd
SHA512 835d6a31e56d400ace235ee94e16bc1e24bf1477e7e3524180d12b312a58422ce1a579daa423881e50bc2b314e50f5587e6fd98ea68a1ffcf294a7f187cdbac8

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Subresource Filter\Unindexed Rules\10.34.0.80\LICENSE

MD5 aad9405766b20014ab3beb08b99536de
SHA1 486a379bdfeecdc99ed3f4617f35ae65babe9d47
SHA256 ed0f972d56566a96fb2f128a7b58091dfbf32dc365b975bc9318c9701677f44d
SHA512 bd9bf257306fdaff3f1e3e1fccb1f0d6a3181d436035124bd4953679d1af2cd5b4cc053b0e2ef17745ae44ae919cd8fd9663fbc0cd9ed36607e9b2472c206852

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Subresource Filter\Unindexed Rules\10.34.0.80\Filtering Rules

MD5 faf01ed2c0020f8fa512ff379d82c211
SHA1 233d104dfe718231837e33c5543085b6dba5cd8b
SHA256 192ca12bc520edee8b5a8844cc870cc4a669fb9c1449dad33a69fc5ce112c750
SHA512 8ee475bc419950f08933be92c390087b67a7914825dce81eef4786012bf641f86f447239bb8d08602a407627b3846f12c52f365eae2af32fe5d22d5ee7133c31

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_54020848\LICENSE

MD5 f6719687bed7403612eaed0b191eb4a9
SHA1 dd03919750e45507743bd089a659e8efcefa7af1
SHA256 afb514e4269594234b32c873ba2cd3cc8892e836861137b531a40a1232820c59
SHA512 dd14a7eae05d90f35a055a5098d09cd2233d784f6ac228b5927925241689bff828e573b7a90a5196bfdd7aaeecf00f5c94486ad9e3910cfb07475fcfbb7f0d56

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3096_54020848\manifest.json

MD5 578c9dbc62724b9d481ec9484a347b37
SHA1 a6f5a3884fd37b7f04f93147f9498c11ed5c2c2d
SHA256 005a2386e5da2e6a5975f1180fe9b325da57c61c0b4f1b853b8bcf66ec98f0a0
SHA512 2060eb35fb0015926915f603c8e1742b448a21c5a794f9ec2bebd04e170184c60a31cee0682f4fd48b65cff6ade70befd77ba0446cc42d6fe1de68d93b8ea640

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 3c859d74db6b1ecdee036173f1cdb43c
SHA1 890262e98dc23537507f0bf196c2fdf6bd26e344
SHA256 498bec5a53e7b05e6fdc47f2a520a23963e69dd4b0ed408afefd0d6af19448a0
SHA512 5667b85654bcdf38a360cf52a14d510cb26baa4e6b45879a7d7d599ff953442e9a5a4b3b12955ca6c2b8d0bd00fba4a74f315ea452cb068d856ba8f4fd90f81e

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 db458d9a2ccd99fa9ff32e18dabd7fd8
SHA1 81f34a4c564f883080f6e9861a3fc07bfec73ba7
SHA256 ab5c75bf2972af09122f79795883016134b8f3eb2c5dbeeb7e92269ec477b4b6
SHA512 33d8658fdf82fae82d103fdd570efa0e2b53d3fba0a18ef7a45c52dddd232e92d2f902e31139553b9a95c3579e4416a59530da729a5bd5a4b0a4d10994d2f358

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1488_798493313\adblock_snippet.js

MD5 f5c93c471485f4b9ab45260518c30267
SHA1 ee6e09fb23b6f3f402e409a2272521fdd7ad89ed
SHA256 9aa899e0bf660ee8f894b97c28f05db06cc486915953b7f3b2ff9902fa8da690
SHA512 e50a1baf20db9bc867e85ab72f9976430e87d8516ca552f9342a5c91822c9e1404e4f915042d48d841cca3fb16fd969bf0aa01195791ce29de63c45814fcdcda

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1488_798493313\Filtering Rules-AA

MD5 0c692f6db49c8f21392d3365bfc88be9
SHA1 9073d1a2d99e0d0df90d995d60fd096b30f6b585
SHA256 d36eb7f3da47d7cd92f7bbec4314cdd30b58197cd898b13f11729febbd3f75f2
SHA512 2f8e22ca83e9bd5a963dd2f9a00e1ed2faa9d5a3c07efa191ca4bf7c95f404cbabcbf1eeb8633a2270b8460319ce46791c063355368fc08d93442cc0e0250939

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1488_798493313\Part-DE

MD5 68a6f5d3e851f477b99c00e716b9640b
SHA1 1e805450597d71037995ff9bd63a18ad2c74d281
SHA256 cbab2692330b73e6dab4705e0ba5d9bc7829912b7c09eaf5c5f8e6c5e219e2dd
SHA512 b06888174d81a40ad200113186415a7daf207723f5d704160c1c74087192e9a9652bf6b69c58fa927a9e66af35e993f1941352e96403f673ee7e686d8eb4e06e

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1488_798493313\Part-ES

MD5 4bd0ec01b325a901ca95d03dcb3d0b78
SHA1 3fed6b3ba95cd4b39744a5e6ad7970d5bfe18ec7
SHA256 f47f8980472678dd2caf6c728411ea4a2611c2eed99938ccf4a158296c0a0830
SHA512 28d8f704e4ef7fd4b13938c7c05f50c0e3b92c2753245e363fbe07abb8bd6b96fbacf864f1390031e86d0592034e03e90582fb9910d80b46c6cc3b0282ba6d58

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1488_798493313\Part-FR

MD5 98df506badc34592073fef20e10b9202
SHA1 9c6084e2f72f8de086f34f749c6f478615a61072
SHA256 c875167cbb5484ecbb6974c6b2b70fa4b28e57c58588964a737605016077ab2e
SHA512 45cc8f5a08b75245840c22777e20702884c9d52a3dcb3a6c70a18b6213ea1df407db0f5d8b1bb63e5a99077b210cbe235e6955486268ded1cdc9a20595dbd633

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1488_798493313\Part-NL

MD5 307ce3a96ec04053472ffcf0e240fea4
SHA1 4c4ed7097641efd298f68b6bb5e4aa7c16d6754c
SHA256 9300c145e737397b404d877ba0e909ed687e8b7add82a6f3b9f3cb9931e0e25b
SHA512 3e98d66a43650289eafdd6c4c76e1da66eb042882f2979b8e774e0df81510bfa7678cf8b4755829c22c258e25136dfd405bd21e5c40973086247408848051955

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1488_798493313\Part-ZH

MD5 35488dda885a4de38b56edd487f1ed51
SHA1 3c85fa1afaf24064437abfd72530aa1e675d58c9
SHA256 04ee35c1660783cc17d89b80d5bb76c9c92a4e052d52b2e4cab00897d9c5655b
SHA512 0072570e9cbd6ed811bc22df5c664a152f1c3322f08b43ca9df6daceecb64614198f5600c964f1abd7890d3e811c57dba54bbed763c12d3e245bf7db5dd4d898

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1488_798493313\manifest.fingerprint

MD5 c88bd0dd55944376c6e59c9557479517
SHA1 b7c57488eedc02aa1d5003e3f2741ea5b2c10b54
SHA256 aaeb2ad14748b6fbb87a912e0d4e33ea87b8fa2fcab2af69270c81063aaa2c8d
SHA512 06b9ddcd0927d8839a67ee7944fb87347cdce2f4ef6928881863afac684f18842e8abedc26f5ac2678a99e81a0e1e371706f120284cb393d4ae805d5e6318ee3

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1488_798493313\Part-RU

MD5 5797422ea1700f6036c4bed4384877d9
SHA1 1201305e19faf6311a228b6baa2052ebefa9c4f2
SHA256 daa8547f1dbc8c994eed3725f3076aaf6c4e298b963fb712e53eb0fa2dc1e789
SHA512 f85858ad292ef9e5d4fb6ea9e67f731b4a5fe3b823c2f156ecd109650d9de577873797bfd6d01da37a2baa2e05add60d387821254dc31eab54f4e526895bc83d

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1488_798493313\Part-IT

MD5 cf12499d6fb872304778c2d047996675
SHA1 36e442007ec991986b4a8ab67bfe39abaa58117e
SHA256 39a9601eb6c69437ab63ff48bb96d63ae38846d99ef954491bcc803e7cfe6e6a
SHA512 ff914da7d35b91d16d411af54b2adcb3ecb140451dd6763f5c847f8e009bfc4440498a02068e7aa2976c06ef089525204dc5698d2247584378b0cd5bc7457c01

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 f309d233e1cac72eee6b1dd0b7755bd7
SHA1 7691ed82c72db2c30eaef26597809d7f3f00923c
SHA256 4134406e0956a4f7020546037af8f81ee5093afeef843e252f3b2a93711f5571
SHA512 2b2a2f22f7af71b566a2ba1df235fa46bf165d930ccf807cdce80dc4196d7b012c99fd357c8aff3fce784aec0b4378ecb840758a83985b839c25671a5fa9402c

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\bookmarkbackups\bookmarks-2025-07-04_10_QywS4CLhYr3Tkhpr_EzBRnywcNqYU-fiyJy6t9M057o=.jsonlz4

MD5 9ec987281faa2e15bc515bc01f116010
SHA1 48125f8926d375662d93704863cd818e892eb35d
SHA256 0c107303ce73b1f8a7869f61a14b58d894d335836df621263729ed168f4d2fa0
SHA512 72ee59a8b0ea0326b3fed4a62d475fd058c801a95d38a7b182fac23171e67e2c882aa5e74e5fe1212283fee81fe5c2f0cef2ebb7305a84870796f124050eb753

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 9187d525a359cf12738235492263f857
SHA1 fec10afd7868e6d19a09cbd01ebd39ad7cb03e3a
SHA256 18d7e8c33509552558f4300cdf7be7f4cacd757ea3d2452a6a2d50b2643db2d2
SHA512 549aa027c3c39b4c4ea8f2134020693db964c80d480b8ce49e302c5a1aea65a7e427b77864134f2c00bf4887415113396a2cadc3101df6122af9f94f97e8d5fd

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 0e5463cf55b031e673b3074c5e2a22b7
SHA1 d3f7651f593d56ff2778dda9d4749217d53f5ebd
SHA256 5d3d17d6217b36d9fb39867aa92302113645e262de82b3f42d757eb80f04da48
SHA512 a3f51b5ffb5637d85cfdeee5bd283c18bc77e7d2d8b03d8d752b4b7645dd01c54b6b44c02e2ba57f3b7b4e78ad1583385d021dc90842d6671dc035b147e8e015

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 eee383bd1a7300a44ece734451e479c4
SHA1 7c72e6067d3e0035e6dd66a0fdcea35aa70d0b87
SHA256 91cd08c009784897bd01580b6ca4eb332c9525a27402f75d0cbd8ba199e93973
SHA512 827aa4842878fcebd6dd0ebf61de0b5b3443d4fa8c4b0cb736fac522cd0e711e95fd403484941c48c2f8c1af23553d4f26d78cfb14e0be630821651b16d95093

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 064f17936dbfd71e8f308b99b4b849cb
SHA1 e45e6d491f80fa7f8f4274f7ccc3a52bcf87da8b
SHA256 69c94a7ffa63651c96ea63bf38087892c159160b59703637451c6881b959a8c2
SHA512 0528497ed91edd2d305af6959be08a25809cc730b87c02b6f3f02867088155648912ec1d9747c8ba6da769c41576a8cf33dbb022023d10f7ee95fb13f02fa050

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 dd0c64e0c17af2a69d0cd633d63b0cfb
SHA1 ebba7e9a552786db932dd05aef24f438c880fa84
SHA256 6915a1f2d3b8e6922a27ad00010fb9d69efb411045ccc429261a76705bd41bd9
SHA512 9d2cbf6024f67f37b967e07f4c92409c7cc4823d9dbe2cf143e71a91e6c1af847aa6986fd002cf062c167fcbe1efb1c1208b013d58834c73a0f370e6800ee356

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 5a84bcac15164c42714afd03824d1887
SHA1 252ca1e8d04837f7fc61d0f9e51b7f930c7b3a01
SHA256 5aedd01501d1a5462a0173f145f3e021a770a0d5b6c1284c67e6124a3e669091
SHA512 6907386c2a61e19996a7805fc545b8825ca8e320747807395b5f16d38c0223a4e62d4b341611b06120a1fb636536020e6465ecdea260d075b4885ee50d17048f

C:\ProgramData\Malwarebytes\MBAMService\config\UI_IrisSettings.json

MD5 5672e5ff52cac8c0374b6a61e26c2beb
SHA1 5bffb05eb3f1c4d78e65b1e688fc08913b36bf6a
SHA256 155e35c70c9cbda5ef568f0103bfc8a5a97fa8f0cbe284e4643ca98dca7e6d5a
SHA512 de121680a9ebe8828209ca2fc9ca4b42a73f884f05009ce0f8e111b423dadd1ced572cd641379974413b0d77e0bb63186f155b7073b54581c320311977f27eec

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 b77b25c0fcb00c89fffcf65fb01a5bdd
SHA1 db1b48b0655a3770ff7a76155d556bf2c0bed2ea
SHA256 da64f73286976f3478575ff2acaedefa482b1727d3714588db7f9803b9493bf5
SHA512 e0ef37cb4e46736b3e2b5fec0b710983436cb51fc06f5a256a58af72f1efd4401f42d1ea51cd47d837b97e53e005a82c9882254acc88f707b19b37bfcd67b46d

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 d9ddc5fc4f446a5561ba41623b0ef2e2
SHA1 93761ac0cce0dd376100f8537d4696cf4a47751a
SHA256 f6424e9ceae056ca8c3f48e7aa1374bac523d2227ed31bf37bdb9c640b16caad
SHA512 eac39fdb6e256c56ce3e8f194973796f2eef006ad08575150ad6765f05867016335ec80fe34bed59bd6541a62412b9893ef0c420e7a54f2acc6d11687d25c58e

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 d51e2a07f6241a494ef059863fc5a70b
SHA1 4b0542b2a894fa85a60b8687c9b3eaf5f09adc34
SHA256 cec7c9e4fc9d280f39fed9d2d8514eb84892a9ff607002d4a9ef92fcff976ea6
SHA512 43d4a4543e54cfe5bf40d610d6bfb34ffb38242e12558f03c2dfcecf046ac4cbb966ea7ec48b108b2aab316fb5f0b3688710fc2760ec7ea590e4b34a36494a4a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.1.60.0\edge_checkout_page_validator.js

MD5 03afb46c48ec22865708e6826a3a302b
SHA1 6566e24acf922c9d4034850bf1dac39786be0655
SHA256 03daef0d9039418880c9414c6cc56841b9d3facd790b2480e302c1803296b003
SHA512 6df8038a494df3412e2224b238da025d26ab477a02a1cd9ad809369047ac54fa745faf7bff4c209457fea59da64d23ff953b8213ed12cc1a2f4151a057df6c10

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1488_899069524\manifest.json

MD5 3c22ea3bca074127e886b3c3d4cead69
SHA1 e6442f0437b3375c06e33c3080a42692bd4262b4
SHA256 107c9b046abd5cd2c31fa6d6337bb91c1e42633c08d8eb84bbe3feb7bdcdd488
SHA512 6b2d04cf57c074e27798127ef7b2ae9b0dcb9a7e7ce5d3be63b67fbdb7d66a57ac2bd9975fd32e5fdb08f463638ec3801f475d41f40044dc8892abec687f598b

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 3d03a0235034c534d66880d28a629213
SHA1 6cd6b697b9c52c3779ec4e795f55a951a32ddb7e
SHA256 b252776cf97cf2e3e478b060834a345db938a38afff772290ef105307001c308
SHA512 8f51b757b1095c860b74a761b5f62f1904cfa0ae829dde26c62c5402921fd4b26f66b08150c74af979df192776de8b51a2d46f966a0300fa875b71af3b13056a

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 4ac4a2e3220a22e0c01183ec00b7ed32
SHA1 23fca7c29670a6696259e76e3d4e01f26dccbc35
SHA256 f8671ac61b4ac1c5293a6124b5f9e23eeac3119973da1af185aeb4310d0eb15f
SHA512 f015b5ddad54d9481f5eb868ec4bf97426ee527958d217deee54793064d0891fdb274eaa0f2e658965ed06ac5dd297808ab12ba81e0711885c3e280674eef20c

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 414ea0070a513ccdf73204459200e937
SHA1 9c64ec99250ecca23a8f40a47f18efc97763d51a
SHA256 568bd2a6da71f1f60d076c977a518831af7509546c2dec5faac8159ba677c1c2
SHA512 17bfa1fd64fc1bcf7d7437653dfea09e05b6a1b6fa94fef5c98afc5b1e93f57ab283a713f50976036659822fe42e9d49efd1ea945068b2fee4322eb2462c1428

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 02e0eddb6bf6cbf7de7d44b4b57bcab0
SHA1 668df6762fb793a36236ff957d824b8e73c4c4aa
SHA256 2e0d7c3cb7f9732f598dd90bb8c6a122cd229d4ea840ac309cbedb24b83a1485
SHA512 c642129f4cb4c1a854bbf1067cc216bbefce080ef0b7620976f7c1455ca90fb6f5d412f24be1ab16a37727d44a74320ca0f1dafc2fe0b29fa11320b15376b3e8

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 b1279e950ef4bc5bc52848f818c44c6c
SHA1 e75def9e32fb72d2e54d181b450a4b15eedab8b6
SHA256 768450bdd9fa72134e01df8f21766d7947c69c5bd58d0f95118e00c844bafdb8
SHA512 3529a65d367ee382da3633b9c53afb66b0ea2566990fb73c87239116656939e55bed77c23c58093db0f43b1dbd46611c9f65236392121b311e585d6a2bf3f305

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 50a0b978ef866dd4a4e1a0d454f56050
SHA1 e6210fe3e5e7c3a6db6d3dc234437d0e67157022
SHA256 d01646752b5eb0699d3375fc23bd13e089ed07a8ee8272dfa6f3bad1e9eb1591
SHA512 f880896ec51119066e264975f432509336909ce491f0723d01146874052c1c7d084523ed65cc2a28d0a548d6160f57469acd297a8fb41d7c7bfa89632586da16

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 4d6a55f9ddacf01abd7352ae76273342
SHA1 b44d543be4eef2955f5fa3af9dde95a731770821
SHA256 f0db6274ab79e977cf08a0734b096fc7989e488165f0288a8973baa2809fd6cb
SHA512 a91b3a070f53731a3c4df9433980ae4114e3ed107bb7f3d4becae997964ebc81eec5ee82b0ac47ba8621ab41702b82042a1ba2fdf1ffdd8bb67bcca207a052e5

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 585e1a55258cff7dce44f29e33026745
SHA1 69da2ef0b1891dca895f19fd92b439b915f4fea3
SHA256 1165c2c72995ac11c726ccec7e8b1297e0b079c00305dd3b5d39581346a7c3b4
SHA512 c8d985f6f0813112da119bd74b97ec4a30b2ae0a89e0d9da22f818746f770bcbcb3c5b7d6ec65395e2ce78f6c23dfdcfe79892b21b904915a7133280626cdb2f

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 522a6132ea97d3f35b67c616cd1ff407
SHA1 0d1354893a1f75b36196ae8d850a04eabeef7678
SHA256 b71a74be84ea0c6508905689b533dfbb68fc4b3adb792658fee01c7b1c8c22ae
SHA512 69a471cfff5394a3a7d9cc59501469f1a12bfd7f728fb107f13dd5ea794d557a79232708f15360b96fe6e450477239d96fd0574c3525c04fdfdf16941ec29370

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1488_1283939760\manifest.json

MD5 8c903f3779155e6957edda4dfa0e489f
SHA1 0ed0ce2564d97cbc4482f8db3a63155418789c05
SHA256 e7976e2fec4cd12f279ed1267bdb08ca6cde13eb1eb4d68c4aba1228802b1d06
SHA512 07f61040ceba2e502c25c44a837356f8aa5d5a98bb490e9002c5361b8304c20e0d355f23322b8210af67c8912174966e2dbd36c9a849b86e9cf31825d9ad8d73

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1488_1283939760\Tokenized-Card\tokenized-card.bundle.js.LICENSE.txt

MD5 8595bdd96ab7d24cc60eb749ce1b8b82
SHA1 3b612cc3d05e372c5ac91124f3756bbf099b378d
SHA256 363f376ab7893c808866a830fafbcd96ae6be93ec7a85fabf52246273cf56831
SHA512 555c0c384b6fcfc2311b47c0b07f8e34243de528cf1891e74546b6f4cda338d75c2e2392827372dc39e668ed4c2fd1a02112d8136d2364f9cab9ee4fa1bd87f5

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1488_1283939760\Notification\notification_fast.bundle.js.LICENSE.txt

MD5 7bf61e84e614585030a26b0b148f4d79
SHA1 c4ffbc5c6aa599e578d3f5524a59a99228eea400
SHA256 38ed54eb53300fdb6e997c39c9fc83a224a1fd9fa06a0b6d200aa12ea278c179
SHA512 ca5f2d3a4f200371927c265b9fb91b8bcd0fbad711559f796f77b695b9038638f763a040024ed185e67be3a7b58fab22a6f8114e73fdbd1cccdda6ef94ff88f3

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1488_1283939760\json\i18n-tokenized-card\fr-CA\strings.json

MD5 cd247582beb274ca64f720aa588ffbc0
SHA1 4aaeef0905e67b490d4a9508ed5d4a406263ed9c
SHA256 c67b555372582b07df86a6ce3329a854e349ba9525d7be0672517bab0ac14db5
SHA512 bf8fa4bd7c84038fae9eddb483ae4a31d847d5d47b408b3ea84d46d564f15dfc2bae6256eac4a852dd1c4ad8e58bc542e3df30396be05f30ed07e489ebe52895

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18357.18356.1\json\wallet\wallet-tokenization-config.json

MD5 ae3bd0f89f8a8cdeb1ea6eea1636cbdd
SHA1 1801bc211e260ba8f8099727ea820ecf636c684a
SHA256 0088d5ebd8360ad66bd7bcc80b9754939775d4118cb7605fc1f514c707f0e20d
SHA512 69aff97091813d9d400bb332426c36e6b133a4b571b521e8fb6ad1a2b8124a3c5da8f3a9c52b8840152cf7adbd2ac653102aa2210632aa64b129cf7704d5b4fa

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18357.18356.1\json\wallet\wallet-notification-config.json

MD5 4cdefd9eb040c2755db20aa8ea5ee8f7
SHA1 f649fcd1c12c26fb90906c4c2ec0a9127af275f4
SHA256 bb26ce6fe9416918e9f92fcc4a6fe8a641eceea54985356637991cf6d768f9fd
SHA512 7e23b91eab88c472eec664f7254c5513fc5de78e2e0151b0bcc86c3cd0bf2cb5d8bb0345d27afdd9f8fcb10be96feaa753f09e301fa92b8d76f4300600577209

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18357.18356.1\json\wallet\wallet-stable.json

MD5 6e57b65a604224b60edb31cbec433a72
SHA1 cafbe47c5e6dbfb189bec99b3fdf612dd8b1a824
SHA256 0cec355c59fd6dbc59b6044d4dc8f403a499b256e9defeec4b7b6d21c67feed2
SHA512 4d2d3ed510869ead82211ff2a8370636e18779331e80ca385746023ea76bdad49b7009848bd41af7c607460241aec54d0a0a903324d2fbcecef08e2fa95f0641

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18357.18356.1\json\wallet\wallet-checkout-eligible-sites.json

MD5 ed22bc3ded6df0109b9e594867473559
SHA1 ee39eb80dc23f7fd764199cbe4a153c4edc2e768
SHA256 2abefae3d72e7c4f5cdc94eb0ee552612d843a26faf4a7bd061c73839e19d7eb
SHA512 fb337c0a0107dc37a3067bcd6f60ffb8f63ee892a0ff729dcdf67c7a21fec95a742a274853e8947489108d7543c13b9479e02574f490bc217e8a182f08543aa3

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 d03a3934b58a378ff51ee0cede8d11ca
SHA1 35e5073e66e717d5749dd04028582fc28034c65f
SHA256 82f1cf7e43221c65737002fb517b57a54d94514c36a4053c7b270e241b2c1834
SHA512 df4173145049196252ec8959f97587cfe60496eb9e7ac0a44ef095ff0e90b32d652a64c0fb8c1cd21e825f5e2d33c7a36002a124d96ab1017a8c66c14518308d

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\bf8d8ca6-875e-4c20-9de6-98b2c8b8be3c.tmp

MD5 819631b1805df547714f5b08734efc72
SHA1 8bc9405d4ce423417c945ec3d5c593e58cbd1855
SHA256 6e284ae96676c2ab60ddbc6fb63ae82947c256e94536753022f70736ed9a285a
SHA512 a2d180ace81fad71d6a1605a363e4abe9beb7e414167e9a760cdae5c5b6520e65dfa10e8e96e1655d4f65e141630620feb72cdb029840c640981153c50b6b138

C:\ProgramData\Malwarebytes\MBAMService\config\UI_IrisSettings.json

MD5 e8239250024f27370689fa4e0eeae031
SHA1 e8538c173b1c276eb817027d59a839beb03b21a8
SHA256 ab27782094f307500f3299d586a3b82e5d8a2c142cb7e91002181cd54f364d51
SHA512 f4af028b0a7e1a7a1d67aa275ba0d0c6285dbd9685c7ea7e12d3e9f9e5b121b85177bb63263b45313d5a63a53c2417a081d3caf8ece3aa6f2599d320ca257fba

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 616f1fbea6b338ad941bbb7bf8cc69e4
SHA1 230c62e8ab33e882ef65c12a633a2c5cc6eb17ef
SHA256 577bd29d97f344012ea000178b39bdd978e974db712dafbbf71112abbd9d82e2
SHA512 5a4535d3ac0a78689ba394f30fdd67fb8cb21e5f78af0a8ce7f5e7787291fcd03572a9998af35fd2421cad99f36008ea19b9e7a9a8610b1c607eedfde3773fc3

C:\ProgramData\Malwarebytes\MBAMService\config\telemetry.json

MD5 b93cf6eecfadea474426ec58722d84e9
SHA1 536d7444dffd9bdcf1a362a32bee8b5c89f8f05f
SHA256 5b6b7aa549c3c17386b96f0edc7fe891d05ac43ee7fe54b860790fb6dabc728a
SHA512 d20b3f9e1f7eda9497fa58a21add745379b7277b6d29d6fbc7af4b2cfb5955a93a5a59fad2dbd7bceaf7f108433261cfb96fbf198621627da91aaa94287e6b35

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 72eea031605198318859aa417bdb5f57
SHA1 13b1ab63847a43f16976d485e4ab1ef7c69a2cb4
SHA256 0d7d03844a3fdbbca12760efb82a58ea57772df4ff58f2068c9064ca0bcc7eca
SHA512 ae2fc35d4763b54fa164f8ada00ae120e090e5b3141fa7326a8e279e35c0cae6b7b1915a1cf4a6bf323be44e850ef1ad6c7e73ac511695695cbf9513aa1a9641

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 4a0a5aa3370c2a0594180653e4374ec6
SHA1 a389ee177ef9dad003621af3406850ffb660dcd0
SHA256 a973ffaa0c1b28f8b8eaa433fa946fccd1c3691403c80b439916de8bc4a4e3a9
SHA512 62c77536451464782d81717510c19b20219e344ef9c3845e81f7dcc57e7a0e4f531ea0f2dd9f70ede34904eab6c973dd5d30466cc72f168522353177872a6081

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 a89b7f8fe9854702597be49e9568c329
SHA1 9fd8f2f45b9ec50ad0beaad82f0a06b721ff474a
SHA256 336fec05e3bd87ada3e82739ac40ed6bd89dc1b0888623cac955bd2299612f0a
SHA512 7dd92d3084733d8c61ef520aed1e63c9f401aa8070d9c488dd6323a297cfaaf54ac5db53f5213a70dc9858fb5685f1c4880fdcd8147fbd72316ed4824a7822a0

C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json

MD5 c2f49f7a2f5fc02e0b1aa26a6ffe1c3a
SHA1 f7cbcd8ac669bb4f97b177111a4370f925fb2bd5
SHA256 3c58f7ccdefd38143039503595a45d46458b2c36a6e2024d08c6eb99a50b12e7
SHA512 679ca7aaa412fb85d72df1b8a6bafe611d83caaf5f33d288fbe690e5cdd1af774a905ca7c235f5a02a509b630ea5cadbfdb40710c220e513cafb52835856362b

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 401052ffde9b575efa0e42eba4246d4c
SHA1 9ad2ea84b6c3bc3266ab522b66aa253a68feaf0a
SHA256 87ad42a07d007f24610bcd554b319efcfd473ef87ba31aeaad18d5226e814136
SHA512 494717d25265fb365f80e81218ec532eaa98bf63521ef0ea6ed835595cdf9ceb7b450529172470193a312f984666236e00473bb301ecc7331c5933d6c8decc2d

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 ffcf14c4d66072dd58fafb908d4c33bf
SHA1 73b2a3a887e47494a758e2d536d343e056eea055
SHA256 fceed5a8f4e72b240911c14d713b84c45ade7c629dbc37532a7b02e41266bbb6
SHA512 8f61426d6f499507c2b32c5ebeebc854eca24d5255754c26ee7bfb9b349b510465a9d73b0d8a057bcee6bb05228f4f7b93cbd140ea1fe509a825dd43b119e367

C:\ProgramData\Malwarebytes\MBAMService\config\UI_SecurityAdvisorSettings.json

MD5 37a614ad6d46e2820184c2e7205627ca
SHA1 3b122c1782b22b61e9bb22f185ab0ba5e0301418
SHA256 f7e3c2a9d949d093b9ddb11f5c026149e1be79385f69350d60f19b49f01fd223
SHA512 1f67758980d52eb37d1771ef7c4d4789bf12519767ee78dff3573c939e68507fa210abba1812750de8f9c59a35f58b419b676c888fae6f08d28efd3e65193218

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 a7cbe2cce7e1e20dfe3138abe050eb2d
SHA1 31a1e88395ed87be6ba4e89bb60baa562338b2cc
SHA256 3217dd505635db6d1f68d2985300725e03178a612f7ce4d86959608ae887f3a7
SHA512 1d00aae174bff7888c87936c8d71173477e923ac8ee576e717494b6c20173424b92f96815b0b34b6ab19f4e7c65811e72b1043a8edf06cbf0ba36fcb7dde38dd

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 246db06ce64a897b351908b6b2c707af
SHA1 f7bd89b404dc35a691387d3520e0e55dcccecbbf
SHA256 1672cde3ab563e5a485b3d4a07f8f452417f31ee172c4b13083d0ba8c5d21a2d
SHA512 d81b390d29c697948a000325092313a2d1eb4ac26f7b2a3d0282f3133f0f8b6891d3c70a93db033d035fc9e5042818ad39e9df1561f1fbff4e49c44b5e9ece06

C:\ProgramData\Malwarebytes\MBAMService\config\UI_WhatsNewSettings.json

MD5 d6b41bcff37bb2c1e6caedcc7365afe1
SHA1 599a12ffca85f07028b38ef91244cfed634fa1dd
SHA256 d1f0cc1d89c5a1f332cfdc15006495f3d9450e09dee3fce5dc0f6f4a89b369f9
SHA512 e1922083d93c959a6a9a3440dec60ec3e4d4c02eaa8dcc5559361c7d5d3d376af5e2966c55907a0a0b72310988d25d53b95a0519cbbb37d6150e2545f32172bc

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 7604a71f11fd05be7b9c3b2ddc1e46a9
SHA1 b57393b61a45ec1dfcabd1b493bcd4b70747500e
SHA256 4e104810120928a40c89c17493e8095fb04e6ea7d3f74d3813ee3c7e17aacb67
SHA512 ac5c48c49bd541cd859af15b048f9476d161ba4daee899ca2a1486a8451dc0383f5c71427c4011c54a0fea889fe181daf77d7aa7238097f17c1eba016b4f1bb3

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 2745e397279ab59b3bb3d69c900ba08b
SHA1 d5755825c687d89823465cd3287680a75f6a8a72
SHA256 f27032c62a7da78b9123f1a4982e63bfbaedee61954bc58648f505ddb2ea34af
SHA512 23fbf9b4bdac438c1a9f4891816a5031fd8be8b681ea7c37cfd5caca67d08f901b1b21a00c9c0e0e293463ef78c3529baef8353df0ae13eb350d874f68ca0193

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1488_1318292450\_metadata\verified_contents.json

MD5 e88d7cbb64f8ad6eb60e61c46a67840e
SHA1 32f5919ca1466ec636104c7545e8ba9a3b956fc3
SHA256 9b791c9f3350a7b4ef88f1837fcd7a1df7c51e0d0af13dffed00b5e9817c4cda
SHA512 19ab9478c7b9654612076d61af00072916cde832be5ce3d729664e3912d1e205a6abeaef1f835165f7979f2e08f0364f1cd1579de5f3180c24dedbd9558ce902

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1488_1318292450\_platform_specific\win_x64\widevinecdm.dll

MD5 7a9c7b4aa7c6c99330ee4496171de50e
SHA1 ca89ef9a6bc7d18823e4f021d9c6a9891ec0e407
SHA256 3ad250fcf3de7124fd9f5f018ddad2a70193eaf8be0a9d939eda5068b52942c9
SHA512 13d386af7e387d6fcfeb64681201a4ccc29454691ef3a345a5fc9947bc362685a1036351a322c4fb049ac0d266b8dc36807359dd722b486dd0907077c486f48c

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1488_1318292450\manifest.fingerprint

MD5 f43132ec8b72e7de0ccc50a0edd59b72
SHA1 1ab56d0dc1983bc5de5c678b9c194050a435808f
SHA256 51a6559a071e2cb9bd8d501d5ee8bc169cb240934a7fd442fe39b531755b4c4f
SHA512 f59c348a0991d9c6d1c4c643c787baf0a56246fc4e05f60a649d9ffa23e23455484e853bd577881048c1e1af79b79b88301e963b282d07643177884d38f88600

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1488_1318292450\_platform_specific\win_x64\widevinecdm.dll.sig

MD5 22f6cb93fcdffb269e3f9ac4d2638d21
SHA1 3323c9e919365cced3310d3d266189de3ce2fb8d
SHA256 be58f1486ac3d53576bb0e37da40114ba036530bde108ead07ae2ccf763bfacc
SHA512 015f3c222943d23bf3713bcdc6d8de0ea9f86372ccafd75708fd584517da2e6f05fc7d996e191aae7c7d39d9effd509fe7e2a688ce8f71c2dc6cb045a67de6ef

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 ce5a1f41775a78ed93de64bc4ab000b0
SHA1 9c68f235e863c6d0296ece9b02bd37ff0634b52b
SHA256 81dd5b29cb2f360ccb167b1b558f2e0c3246fd4baf9bbb0aa531f6418c54314e
SHA512 71e77cfbaabf3a0d4a0c34149398386bb8f319cb69e8b973fbefdf229ad8c9a131e709ecde84a6fccbbf3807f1f14dff45eeb232f3f8eda5845f18833a242d49

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 0aa3324cad6e64e88c2e51667bf21f95
SHA1 d0fbfec324aa6b6c0535c1bb3ae330afcc9ad9e8
SHA256 d9f2cf7d348c739256b5dd6dfeb247de59f13265cea4c2e22449913e18fb1d4a
SHA512 69941f89248983f43ba15a12d8e8e0c46f247f75676d6284bf08131f196f03e02a0df608c44d1d75cbf17fe322a0bf197e99580a47d13490460f3d20b954c1a0

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 43ed1ba7c49c0921d58fa59c1399a7a2
SHA1 9f3bd7be14906a5bf145caa39c41fdf411240602
SHA256 6de03d24c17cfb7e227c5f9ea1e9c80ac6a36c506b847b9f71b6ae4a8daa2899
SHA512 49bf5cc145ff878f0cf12c12a02fe6d820923b3967a0a84f8f7ee65780618fda7330add4cb2abfcfff29c556effc3e2e62a6581ba1073733516c3305f413c02e

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 14726ad8682bc59be54b76e43d1b5594
SHA1 922fd50b8f17e9b9126b518ca3773ea7651bdaa0
SHA256 402d20e9ee648d4f90d81bd657b62f976cba2c4fef0fee328d82ef5ed228c574
SHA512 2085e8b29bd59276fb784872ee74824eb16eb14c9679527dc61b57accb3df7bf54063458c23684500e76d2e370fd7c882bae0476812933c39a333ba27e9f1d69

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 1ea59e259a1e2950993d8f32f4c977cd
SHA1 9d7afc39f2a0ba8091e245e40ee140473974015e
SHA256 6069cf3864681ec35fcbf83135c7db13123fbab2a67c103e5dd0a271116c25a5
SHA512 90744b71058e390dc58339c9c94331d91b8f3f16ba760a0023ca855857fd7507c62a01c83e0e8e50102090df6f354ca45ae3951bf32b8b95614281a8e572e719

C:\ProgramData\Malwarebytes\MBAMService\config\UI_IrisSettings.json

MD5 39e062d48f63945245ac1a2be98ba524
SHA1 a37d2e0293f7b7b72e10ec3172a20226899a9996
SHA256 533f1f278615cd4e24cdb39a19ac1c203cb31660194ff840062aadbcb0694615
SHA512 0546b360c1f3c7537f13325945ef8c884883a01d184549f4532ebfb7195e63746b653d4962a6aec779c3628561bdf108b5869d278b93c46826991cb2c07e39cf

C:\ProgramData\Malwarebytes\MBAMService\config\UI_IrisSettings.json

MD5 9f29a4b6425d9169b1ec95d73f02b903
SHA1 456ff0bdfaa95b6abf8c2ff139f88fbb085b9363
SHA256 fb0e26d99d9e3c30d1f559d42e09916b6a92d4ce8d325e95c98185c9c0eaf7ff
SHA512 6a3ba51d6ad7d8c8887980bb4307b45a66d6a4e162fe47af642cb22cc8ccd0518a0e3507301d4f9b469fac76b3031f43a5fe3fa50f004ffea0d19840c115d9b2

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 df7ac194369c591f3ea5956f66cc5829
SHA1 a906f82a78e15d849afb81d1578b41a5c9884584
SHA256 46e3e9a809c7c9c74d37f660a1714ce1b6cb06173bb4a458ec2946acffa83ed3
SHA512 6cf6bf85bae3e90fede96b33b45a70eac49ba18bfe5f873ab6d2ed728b9d180e57a23d304af6e1a25ac7e85a8bf945a898af2c9ddc6a4e12d2beeb22ab60c843

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 5ecbf8d6ebb24ceb57c61077f780c582
SHA1 2eca7cf1cf1f5d1f3c2b1080205face8c95f41f3
SHA256 a410c332cf04e3e62ef0a6b4ca5267ecb38e0b5b425f471fb7cbc8d757cbecbc
SHA512 fa9f6ccfd91a970db965a57ff74fa6914831d335c58b7d16c37e10aea18d261c8ec6215dc45effdd96486771237becb806242a7bcce8bdb33dbd073802474bf8

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 8116ef95fa08e4ffe95bf94a9fdaf2f2
SHA1 b252a57f5252d7f031bb1436dffafe5f6c73a664
SHA256 8eee8d7c8e353da7877ec3832f8d483ff288062afed5a128442010a7b4873de1
SHA512 6d7f4488bda47476fd2b03a102c8ef1e719cc75b6a06819cc0e2e25ccc5484387535111083c4a3ce5d1c40aeab5fff6c317c38f4713447d95ccdd0e9b439d17d

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 fb3a97eea0f6fb7eed0bcad5d84506a0
SHA1 c24a7470f3289d1295cd690f538ba8014187624e
SHA256 614f3028ef5c9371323240e61d55782498afda43176235da6643573842c1cd83
SHA512 c2c84865388141d6feeaca945388a83e894d896a2d20d11cef76ce25ad11b128a7fcd5bec078ff64cb2f49526ae1b32eb2267623b5a8af40fb9a36ce3c215606

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 c69422ce81c178a7fbdcc3c63d4b69aa
SHA1 5cb28197e352edca4cdea77500558a10bc73b56f
SHA256 59401c46aa5189661134e69b6611d811a35f085b30216d2673f7514c24e1f09a
SHA512 48a15cf376131bcd26da211588b55103b86dc58d97f64821ec42eae2e8e3df86576cf077e77c15fbe48154932a5502b3e4625fb6b6fc9fa4f2ad05e8ceebcf4b

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 4a2cff21976b14e310a917caaf6cfe0d
SHA1 3ed0c4e4f502123da4d9438f6ab0ca73edadc2c3
SHA256 7e694b45e9f2968ff1ccce847bc87f34f253d2390d0a341f2d6ce9b01d874a36
SHA512 e2e1d769da8ccb84b563de6c46f10eb635fd1410e02a91dac572e896ceb6a4e156dad098c9b68c70a64f90ad111567d210f46438f81e8e6725b96142f226b078

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 e6da94c3b9a39fc0c2a4fe6bbeb1a14e
SHA1 1c2aa7492bad9d1c5b7e8d8f6c9640719d1a33eb
SHA256 b29aa26ae9b3ffa2fa8a9936450a7ba9e5baa71e25f97e14bf3ed75f891da73f
SHA512 e7f5eb1c6b2392f5978d607de63f499181a53fa157d9c0868d76281a5793043d3e2ee35ae986378d91a502bc4e97d989660a017c0257bba273608848fb776094

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 bd03f9b9d518651316d379347a013256
SHA1 962b7f46518d5cb65d84614557ba8bbc6435620e
SHA256 8421ba08204c08226f60d93f40af06e16be5c885e1548feba0b0457f42384160
SHA512 d5a3916659f2aeaf9dd68ab8beac6d1ad4de89753b40dd884f095557a073206981237c0ee05143d0c7545fc98bbfee2a9d910b7faecb2e351160ebbb1d0a0791

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 36ff4ccdef954f02da0276248cc88591
SHA1 d0ac681c2424408750ae0f4129fe396176ff80fa
SHA256 e50bc2b974bfe3cec22e21eb44d0e7fe6e8429aafff5fa4460f1ff922c77715a
SHA512 02b0bf6070c55fe417c366fd7cc10cc506c76b43545d747ae9762779b329da1a9225df3ed78dfdd3efb34ed58e17c618aea3790c146afac2ff0ace2cf8c56b8f

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 9e9dd369c1aeacc4ced65b52955f9a60
SHA1 85a7659a4a273d35c06ffeab80c4b915638cff43
SHA256 af813b58828c4135639fd604d8784e326516d45350e4e83008de8d17edb436db
SHA512 e77f8a18f353c3f81bc84f8d6be3aa993c8706972feb12e71ffb60cf754616ca472c11f922480e9a1375d01f159d996aef108ca3df251c08794fa965ebae0697

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 da1f0702d80b11b7adb85bbb80bb0904
SHA1 ac91b250f403027acf1560e1c0d8ca8faadeabe8
SHA256 5ff89cb2672c8badba05cc7044950f5a4c86f1218f9b7d3685c6a0b58a10df54
SHA512 40a6b19af8f7cf9104783632259938518a798d81cb63815084275709ae73a44cdee73e2ae9401fbcfb5c2df1543a35fe98a0f6dbb9688a86b7737722c4d64a94

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 895c6d3b8dd43755d36fa427faf70e0d
SHA1 0b4b9ca6afdc6ad7d65e3b0f6b236fcc48d8c11b
SHA256 ea92d734ec0e54018890c52acaa3a09a718793d0a88ee9d7e01b3f62a6845c9a
SHA512 a8da99c270ccf85684f0d0eb1e6582b8bc05b86e9536469879b275b63466c05b57ed609fbdc4923d7f1d4fdb9f776d12ec0f2934d2720b45fcfc471dfd15d78d

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 b99dc397b0b81a684f0323bc1ed2ec42
SHA1 e6e02f860da37dcd8d1651d92d961a852686f983
SHA256 cb99d474a7912c019991085185728473306aead45bcaa983cc4ba74a19997c11
SHA512 d4c01ba254222f5cd721d5371dbb3e8a2a05bf546cf7b7ec1a5a73e922a72c99065e3dafd9b02127c659258e12004643d0b8fa45b581076086f959d6cb608f35

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 8a0238e46b7917e26c4be2312dada04b
SHA1 25ba9409dd510bb5131540d83de295a5debc4724
SHA256 8f74c256d8c33b6fed3aa9260969330796834be21defd21ad90d10aa9c64ff0f
SHA512 7dcd635fb1a3c6a27f5f4cffe46aac3cf8659c4bfd36c2fb31bd181a73720dbadae6bb87f2301ab42b8582296289742421ebe07ddf3330f8062cbe537ca76be6

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 f4d76925a6fae2997e4afe9cc130cc74
SHA1 842604f8a907e489006e3c1ff3c1532a7abae05a
SHA256 38ba852d35ec28f70bbcf827c2c42880dfc1d6e6049f139691780764245badde
SHA512 e86e49b9f97b9ad2f93261b1478e1d7d572fdfff43b289a80d4111faabf1e7b1a8d0777972215edd8cf9051dea2340062f9ad2045ad9ce16b11c439a7eb4cfa8

C:\ProgramData\Malwarebytes\MBAMService\LOGS\mbae-default.log

MD5 6f5330dd1f446e073d999ea71b56bd43
SHA1 c13d81caf881cbdb2793e131e51ab20a643ea3c3
SHA256 2664c9401f8578f5c5f8495542dbfe0d2c3455c5c2b18fb141a9503682f4c454
SHA512 acde8c65abd434f6dee7b9f7228e8393add665edc36f6fbe8ce9b0f2b89bf32605f7f04e5440e123fa290f61bb51ae43917afdec3bd2a3eb48f4e04759d9b2e2

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 b806663e6f2b03628e968ce9634aef0c
SHA1 23175d16790d4157b683626550b61c8ecf211a0e
SHA256 5ab22ac4ec74566dd95ee42e37d3207e08d638980a0849d70ee15df59f9ecd04
SHA512 47ae3eee84dc502be61d969d905d58f34c5b92d03786dbdb5d2a6a93cfb1c5fc3232abfb700de29c893d373c4d24c189b5152ba7b1ac6bc962e446ff8b7da945

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 29963faf9e2255d914e3d251f6a5d827
SHA1 1ee13b55388bcbc3e33881c1fd592363757d74d9
SHA256 a0c59b17b96fd1fbf202680bfd0bb6fe1925ef9112b9d073359d0e17db40020e
SHA512 dd99795663dbcf7c2fef20b760391fc98ec8905bc1fb598f6468eaa72f8bee36e090be94c26b932b0a8602834e16be15f22bf885b1cc5c65896932a54c5c6ccb

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 bcc5fb65cff756471d861d283c754434
SHA1 fd7344c09f0fa9cf7bab709280b7f3b8c4e49a09
SHA256 ec94d7c907bc6eff3782b59ea4a186199be63c3edd91151a88ec5641d8f25f6d
SHA512 cb80f7344c63fb33fdc2eeef2b87cb1cf00caea2feffc5264989d12149456df2e926d3d26a933bb22e5d14543440f6c20ac6f593d6bde24b3a328daf12c619e1

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 03c698371e033a1066fa2ee818873003
SHA1 d8255500e5ff1fae5767eba19873675e55e5d96f
SHA256 096f7185c7f997ed566107b7f4c0b2a053675e963d4f8887abc82930f72e02c5
SHA512 a99ee3ee157814a83e5e861d120300fb03d264f3f5b2f6aaafbc29883774f5f1ef611c5a91d5817f92b394d75dbed368492bef786c071a1428d4b292b7256250

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 22ea781af184e3cd33827c5f4032d5f4
SHA1 eade02314d2853cbb06efab05f1697b15d56a373
SHA256 bf7dd269798c4f9d62e03f9f052acc2691076f5d09fd5d583ba22643329dcf6f
SHA512 32971397fcbd32085a61ce2dfe052a5f70dba4ac93c07761262aa5c1704bf13838fe4319b1e1ab5af18d104817c30c253a5efedbf467d2bb0cb1e1038a236008

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 7df2289ad81417bdfec3bda1d4502035
SHA1 4cf1de3b712e66a654e926c8939fd548226f7be1
SHA256 4666d7023d653c3fab944166d3a72e1152e89c97202bfdc4c413c5bac960320f
SHA512 73335ee4f326757af5bc134b5d7aee24d4cb1a393f6c340b2537a702557037e5e06ad86c0df41b3d21cfce8316cb4625525da2786c9505fa55d69f0f8e346843

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 9182d106077a501d89e36af26455f327
SHA1 297af5576737eb576070937837976c14ae2361a1
SHA256 ab9af010156bf91fbb82cf4b0d0924a9e3998b2e9043dd8ec55a9cfd97574c09
SHA512 eec1b67295da77725ee4c1d5b47defaa04d07a1c0f3d48fb3b95b2e76b28e2c34a52e1134eead9c973d0cf55b2f25c9136321412c55ffb07d669e3722ce1a983

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 b262c42105d4660201c92e81ce0da787
SHA1 c66a64e5b62d9e75c18108c7c13530b84b7cefd6
SHA256 7629dc6f0ebb7790e22eb299362c322080b41d576d4bc1f27989d80df2e14957
SHA512 60ae113f5207166a68d66fd52c615717cb18db2304636fb2f7882f7c0e8f0a986483bcf300773c57c19ab358cb00351406afe3ec39f5a056fc2c70fd3ce6d239

C:\ProgramData\Malwarebytes\MBAMService\updatrpkg\mbam-c.updatr.64bit.7z

MD5 2bc5ee3053eb19859f9543788b9114d2
SHA1 93ee4e9f3ded1065e1672ac0b3106e05156174ba
SHA256 18b347cccb83882f32068b3262074e0aa9b973c7f3ac4c74de7e261087afaed8
SHA512 a11bee2b68a4cf9fc1610c40cb6297987fea876218482a1b84302d73e8a75ad1893dbf1bc9bbb87fbabf4fe1d267d96ae2125b7d60bdc7d5b45aaeecf2b6f521

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 0e56d3fd33d4d7f7ead7619ed9f38e14
SHA1 923ccd5666c25e56df6fa804192e52b947ad9c9b
SHA256 8f1bce54602b2c0b0a20a98437ddf37ec25c21ff02901a115b0c2c3b288c6159
SHA512 b1d0e2ce39fa0ac82f398b5cea14ac30302b0461028fa37e8cfa744e71739089e287149b8efd591205a9fa88a275fdbf4a2f281568d4f21906a3e679862cec11

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 63f2d75d91f446380e10de4f0b73c135
SHA1 419544da2f01f50c9376b0b37d47498b144ada8c
SHA256 8f8ea020de520a04f1b7ab15c09994ae823bf236352d9811af2e646cc97a2f04
SHA512 11cfe6661a7224ba77458ac85f841a9ba9f0e6dd375bc44f64ce0e5a61f55614a31f0362485d445da85e796c8cb80af7524121862e6f38ef3fb6a40e50a2d64c

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 b4c6d2cbd51228f3e3f2e2876aac7967
SHA1 e1512ee9533e4801f12e6b381dcb9d59b5305bba
SHA256 b50fec53680f7a5f9ea649d3362e220012a2cb567f19aff9d808094ee44b3aee
SHA512 9c9dc4a3ce6d96ce57314cd42971366991dde80dd48d7df7d83d765ae3c77d4958b94ae2eafc4fb08f545f64f336720dfadd6f4b57ae8d02e4cc5290d388a0d5

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 36d52695100867d393fbe1597443c87e
SHA1 d3689039b0bd5fe92196012c7b436b5cf09badfa
SHA256 0f77cb68cb8bcb2680f370fc7719a883c9a18334d1f61b7cba9a20e2737af242
SHA512 4a07dc59fb05d6e4c367acbc41ba6176edfd197bf82dd7dc01c5ab7fa53d9be9dded87e2ab9c17a642205108198e00f0ac68fba9a8f6d99e0f9126254e803379

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 327357e0b9291d606cf27b54c264c12c
SHA1 dc212fc143af8de62a5956792316ddc05b12bbfa
SHA256 768f0c7c2b6f728acf732bde1a38b28470b3cfe43c000b74b23f8b138c258a32
SHA512 81b1cef25f211fc59c0f080ee22c3420ea16797c79c471b1b717d0e6f2c30409cbc48af4ac9881f60e8730ac3af60a89db09756b3858cd75ba0b0cdb70f5de84

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 acace3555530b7bdcc5903971e6a5d8f
SHA1 4ba4f2ab7587028843f3e52d49143878df126eb6
SHA256 9dfa1db3a92abd306cf031d51d927d41b55f3d21d84807cd3d25bdb0e70e876c
SHA512 392ffde39936fe07785a51558b3482097124bda1c2b2eb0191abfcbd71244af9b6ecfb5cbe8aedfb0b03463b651d62ab6fc2ffe6acafcd4c467e4770c6d13944

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 a962d2637d38e43bbaf3023e71515a25
SHA1 2ba4cfd941f1a8f84f2178729a86e4ad9e1f98d6
SHA256 4eec0f3c1aa3c6d516243b5ad71b327849a9a56fc29673515db995273c4bed51
SHA512 8c2088d6653e19c889b7d9f32c182e6d11fd973e2a70a09297d5d3b87ef1f9d7cce7624b52b0a5678e6dfc3d277eb332f0e80554070e124dee68f0236356f2c0

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 2e0dd05a969f6e2eaf199fbf3fa82172
SHA1 09ea1e8719033e4c7dfc215c0656f1bf56df9158
SHA256 78d7ccd09d7670ae3934fda4911f6b643fb61ca459b722278fed8e2beff7c188
SHA512 088728be4a761e13aab56c89f5741365ef5def1371d69052dc63ebb0f6b024c59d355c235cf164b58de01e413f9660ad44c6a5b893fecc93d37aaa810af78636

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 24631a23c6fc2d665385e31f4e09bd9c
SHA1 e5503c9d733a86658b153f3f576c220ef32d3918
SHA256 26fe31e44ff231068ef516a6f4867895f2ece4c3e2db7585fb0d82b93772ee70
SHA512 1059a3dbc672f8ba3b7426947844643a4e4ca91d584d35c40a772b88531ebd19231d146bc1cc08a1fe52fb3efc00850eb10101c62d2e7331f89a0a1828fafca0

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 67a8528f7eb02566d4164a074687c6ef
SHA1 81bc00d211a61e8c5a6ef8c53d7c4fe648d708e1
SHA256 3f48a6062c70c7dca4065adca487eb080e8380504a55ebefc3b9b9ccb5793b6c
SHA512 85fd5ba2876792a36dcdc60a8df7d3853c5c320da57bd2dd016a7225015f60eab7c1f777d46e15883a807792b76e2a050f595eae13af8a54499ce9f1b82697a7

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 e606bd13018afaf03e7d358bd54c09de
SHA1 c152e1100c9e203788d2e35a1c9b9b495934bd33
SHA256 1cf54292ade78afe16dce5b6612af5325c079430b1f40519b14b347a8fec1fb6
SHA512 2e336c4e6d127cd61d2e581555d76c137595c524bb80e8fce5949d34f565c7959fdd860284f33f908e1f74150038d90ba2d2daedcc6303df15fbb113a3f77e13

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 197d38ec7c62e7ec5c8d9370cc799579
SHA1 a7fb429394554a0b7b1bb4e342d4c5f7fc7c1bbc
SHA256 72b9612d0bd54a06aeacaccef409d9e72e97ae1c070e88fbf3567b02b038b40d
SHA512 16acfc8f564c421c7f5a71ecda50393c74c838acb207e144b3e9e3e6ad6cb19ea663c9c3ee7f52f055307918f0a6ea478dfebef17fef11c54c4d94e78a17f1de

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 3a2f844b9e9bf7c34f73f1d8b83beaf4
SHA1 8e338832cc0e498218ad9ebb43fc156a37905cc8
SHA256 cf7af2e2cadfb15a976e27a2df73579830b20e1e715724a81ea1fa37b11a7ab4
SHA512 2c74868df3d7b81ed6bea26efdc07f059701a55af8b796b07cfbaaedbf255f01cbc169fc121ad47be4b858df5ee93b5301a107d8241f166f471ed2e9eed7e78a

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 f3c90e54b0642b83852f4c5947986c44
SHA1 463dfa4869f0e71d541f07ade71e341bd9a78040
SHA256 fad5aceef66fa45b36dc35145b1ba4c307bec7b9dde8e157a2fd85a88ac3f94c
SHA512 4535da3ff604115701945d2b827d4642983f758f40000edc68b0429dede0d2bf30db2f0cc71747dad4de404ffdfdf733711dd9029c591d76263b42e2cb1094f7

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 cbbf87275824ae0f03cadf6873cee999
SHA1 530bdbfc7c51e6c364429cc92117d37f16019e37
SHA256 c7070d6398755e0fa355870bfa1437e94e86c9882430de521ed9f7193640b83d
SHA512 0045b1a1671c2b03c4ef7282e86fc524a549f77e03d55da844c488e87adb8d59627b68fdc9a1c05cd77a4b22ede889dfa3eda5ce3532665b2df34c4ed06761dc

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 4e2d451afff5f2c9ad21aa8d32fd9500
SHA1 7b183110124ded3424e2c1dba8990e8855604a14
SHA256 8d924affbec462838c551e234c6b5ccd79cc476a341bc7300bc56b914b47b975
SHA512 8c6e8591679955fac34e8c477f0851fa7ac6782cd66328ab428190d8ae042ad2274cb219e5bea468b5c1f249f1347ce781756ff8da5cb45b45b4f771f1c283df

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 9aa433bb53ae4d1e20cd30e1b2afb331
SHA1 fee92e89ade64d664109d8f0a686264bfe89e2dc
SHA256 846614acc35d4596c8b47bcf0e1d86226c73fd992a95d83b6e9d6722cb4e9834
SHA512 0294ababb802b610e403db7cbc9dc968a8e5aa574089ac8d4039ae115f86d9c29236b28120d812e5e7f15d5ed5e60e059692a3b0933ae298f97523f263cb5473

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 ac817b0f6e05ae7dc363780d655cacf7
SHA1 af9818e25720516fe53798620972856e985a3648
SHA256 2cf220b4b09d4b3cebb4f392547f0bbc15553cf5cd95e94e4fb5d2c0511389f3
SHA512 de21db8080ae06ccffe97f0b168a11e3a071886069a6151cdfe31b8ee9b63e6639cb1c4192ba2e0770c27dba2365e5c3413c68d19b22ad40ef1014a421260c5c

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 99dfe717f0c2bf3e8ecc5fa41faef703
SHA1 dc70a598cdd999dcb2e3dba0fbce05bd6793f00d
SHA256 67a85c2cae62524b2d26dec9b49f66d4c146fffdb67ec612182855fff396d316
SHA512 01f61659226f5a6799a572890840ff06f0a966a5c40154fb49c2b0f3df0a21b96bad402bcf5e2877545c11423bdeff088d32ac4f10ecd43c68301244a019c06c

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mzy2mnvd.default-release\datareporting\glean\db\data.safe.tmp

MD5 ea8f0a375bd7f5ab2dff22a8aceaa009
SHA1 8f8d1e783b52d64f1cb0a14ec88b7e36c95e1bd8
SHA256 28eebf71a72feaa7be2f0db38d33599dca251d23695db66d6804a31f3aaaaa67
SHA512 81c70d0f76aa3f3933f6f3baffff705dd9eae4b987099bd12309c224e3ab6923123c8af7bd63a0fd3ab65aefff1270d3a93cbb583a85c56de051683f7a4e4d51

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 9b33746a7cbb5681a2d7602310cb5de5
SHA1 a16c88be5b0d2a9b82ed549db7822eef936fc55f
SHA256 1b8830f510c909ddde4e729706d5e2e4751382d6e7743c981e75162467d40458
SHA512 010e347c4387db023d3c83da62eb132d5399b9dd1d25694dd3f13bb36d45f187919d92c7c0777de35880deeb6a38db2e5e72b1f1643578c379adcb9254f92602

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 1a48aaa80acc417e141dc36eb89670a2
SHA1 4ee1965dd34a2a1cb84b24d5ed39b28d92e1aec4
SHA256 3325c38c70555e323cb98d1fa5e9249b678e1720adfb00d2ce1d36b19e6ac138
SHA512 d72bebc19f39370670a0d16f681949b82a23b07fa94b003639ca1d93d8477878c4a07c9f9b56d998ef335534495dfcefec5e5c4ee7efc3471525731af765f418

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 990bfe97c795aea5931f87e2f1cb2a97
SHA1 fa687b8aead24ba9bd352dbe6cf51aad522ea806
SHA256 725556f0e1eaf8d45f66629e295d42de08ebf2efe2c2cba24a0908f9ebb9c919
SHA512 f7ab1fe7b0d86520539744ea893b904597a8e31b373a0dab18f1fb8a7971156279d043201853f61e503aca8c029886c09238c5aa8b3429062ceb046d2ea7db17

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 385bd9485355d72791889941122cdd91
SHA1 296dd0112807314fceefa640c4fb8e93ba904d79
SHA256 1431b84520d875ac447cedff8764df147a246bba94b28b6f8924475960df80da
SHA512 5981c38890a8d9a61b71d97a160219b2d47115e94400b50ca0d0047948de78bddca05db72bb5b0328771d256a496ac9028c39513fa109a4e05033076d9f12216

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 10d9d38856e0840b2d5893aa74c2abda
SHA1 ad95f6ec9a1015aeb3f251729086ffe453959018
SHA256 bcb564fb2c4f373a6044e3bf7390e303d2e0e76a3a127c35952425c8d422cde6
SHA512 e986cc352a43c0df98c231de98c0bd914dc280e63979023ab95827c48f584549397236b84a8f88ad93f5b0615deb5e376021bc7f733ef15e79dcf81e9018feb6

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 6aa7e8a5bd5e9b2bf194516430946cbe
SHA1 7cae26b6b81e83ff9e13bec03e00c246328e3896
SHA256 7dee4edc18c7199835053725771dde6df48a25f81c6c415b6150ece5d1d4b432
SHA512 eb23e8da0613cc3e644fcf5815590fa2c4ca730c68a08be2f461d2a8c9bb158b9f4243b589280e3d21a77eaac258d1d2b1432c623f4750b7e64bc7cd3a7983bd

C:\Users\Admin\AppData\Local\net.wearedevs\EBWebView\Default\Network\TransportSecurity

MD5 af3bd237c82b7cfc11a77c66bf2f5c90
SHA1 d56db1671c2c921e4cf3e369b90b9886655773b4
SHA256 08822bcdf3f5aafbd40e7675bd297ce6d6d035e656c9b4ddc7423b2fe7d348b8
SHA512 e98d08e3e1259792102b4856a6b35764f53560be136fa084a93403f48773806059768b6a35fad1a2d9e0c886b510488d3039e08ee412c59a7715498ed099b3bb