Analysis
-
max time kernel
142s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
19-09-2023 05:04
Static task
static1
Behavioral task
behavioral1
Sample
MBSetup.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
MBSetup.exe
Resource
win10v2004-20230915-en
General
-
Target
MBSetup.exe
-
Size
2.5MB
-
MD5
1e885823577394ea61ea89438ffe2954
-
SHA1
e53e96f7374790bdad8a614949b398b055c3a27b
-
SHA256
7c0b9bceed390f7f28135431c09ac51469ee8e2b8095fb36a37315d811d9ba9c
-
SHA512
73f600833dad0047b6444110d722dc95237b38bb486abc7fc8e4f59b69e2154c885fb46d65f488d5139a0b6e76ebde33ea72711c7f58436650ef992fb8995627
-
SSDEEP
49152:Lw3ye9SPQ1sjDAVj+JeRanStQyfvE0Z3R0nxiIq2ddAsuysSiSF:4yeoCVj+c6KtQRq2ADSiSF
Malware Config
Signatures
-
Downloads MZ/PE file
-
Drops file in Drivers directory 18 IoCs
Processes:
MBAMService.exeMBAMInstallerService.exeMBAMService.exeMBSetup.exedescription ioc process File created C:\Windows\system32\DRIVERS\SET981F.tmp MBAMService.exe File opened for modification C:\Windows\system32\DRIVERS\SETA8EC.tmp MBAMService.exe File opened for modification C:\Windows\system32\DRIVERS\SETA234.tmp MBAMService.exe File created C:\Windows\system32\drivers\mbae64.sys MBAMInstallerService.exe File opened for modification C:\Windows\system32\DRIVERS\SET981F.tmp MBAMService.exe File created C:\Windows\system32\DRIVERS\SET9E79.tmp MBAMService.exe File opened for modification C:\Windows\system32\DRIVERS\mwac.sys MBAMService.exe File created C:\Windows\system32\DRIVERS\MbamElam.sys MBAMService.exe File opened for modification C:\Windows\system32\DRIVERS\mbamswissarmy.sys MBAMService.exe File opened for modification C:\Windows\system32\DRIVERS\MbamChameleon.sys MBAMService.exe File created C:\Windows\system32\DRIVERS\SETA234.tmp MBAMService.exe File opened for modification C:\Windows\system32\DRIVERS\SETA35D.tmp MBAMService.exe File created C:\Windows\system32\DRIVERS\SETA35D.tmp MBAMService.exe File created C:\Windows\system32\DRIVERS\SETA8EC.tmp MBAMService.exe File opened for modification C:\Windows\system32\DRIVERS\farflt.sys MBAMService.exe File created C:\Windows\SysWOW64\drivers\mbamtestfile.dat MBSetup.exe File opened for modification C:\Windows\system32\DRIVERS\MbamElam.sys MBAMService.exe File opened for modification C:\Windows\system32\DRIVERS\SET9E79.tmp MBAMService.exe -
Modifies RDP port number used by Windows 1 TTPs
-
Sets service image path in registry 2 TTPs 2 IoCs
Processes:
MBAMService.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MBAMSwissArmy\ImagePath = "\\SystemRoot\\System32\\Drivers\\mbamswissarmy.sys" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MBAMChameleon\ImagePath = "\\SystemRoot\\System32\\Drivers\\MbamChameleon.sys" MBAMService.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
MBSetup.exeMBAMService.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate MBSetup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion MBAMService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate MBAMService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion MBSetup.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
MBAMService.exedescription ioc process File opened (read-only) \??\H: MBAMService.exe File opened (read-only) \??\L: MBAMService.exe File opened (read-only) \??\Q: MBAMService.exe File opened (read-only) \??\R: MBAMService.exe File opened (read-only) \??\W: MBAMService.exe File opened (read-only) \??\A: MBAMService.exe File opened (read-only) \??\B: MBAMService.exe File opened (read-only) \??\E: MBAMService.exe File opened (read-only) \??\X: MBAMService.exe File opened (read-only) \??\S: MBAMService.exe File opened (read-only) \??\V: MBAMService.exe File opened (read-only) \??\Z: MBAMService.exe File opened (read-only) \??\I: MBAMService.exe File opened (read-only) \??\K: MBAMService.exe File opened (read-only) \??\N: MBAMService.exe File opened (read-only) \??\Y: MBAMService.exe File opened (read-only) \??\J: MBAMService.exe File opened (read-only) \??\P: MBAMService.exe File opened (read-only) \??\T: MBAMService.exe File opened (read-only) \??\U: MBAMService.exe File opened (read-only) \??\G: MBAMService.exe File opened (read-only) \??\M: MBAMService.exe File opened (read-only) \??\O: MBAMService.exe -
Drops file in System32 directory 2 IoCs
Processes:
MBAMService.exeMBAMService.exedescription ioc process File opened for modification C:\Windows\System32\CatRoot2\dberr.txt MBAMService.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt MBAMService.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 64 IoCs
Processes:
MBAMInstallerService.exeMBAMService.exedescription ioc process File created C:\Program Files\Malwarebytes\Anti-Malware\vcruntime140.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtCharts\qmldir MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Base\ButtonStyle.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Base\images\button.png MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Base\ToggleButtonStyle.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Universal\PageIndicator.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\imageformats\qjpeg.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Base\images\check.png MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Base\images\progress-indeterminate.png MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\ApplicationWindow.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Imagine\Menu.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\MbamPt.exe MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\api-ms-win-core-libraryloader-l1-1-0.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Base\ToolBarStyle.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Material\ScrollIndicator.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\PageIndicator.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Dialogs\qml\DefaultWindowDecoration.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\Qt\labs\folderlistmodel\qmldir MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Private\FocusFrame.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Base\FocusFrameStyle.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\DelayButton.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Fusion\SwitchIndicator.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Dialogs\WidgetColorDialog.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\HorizontalHeaderView.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\Qt5Gui.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Private\ScrollViewHelper.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Fusion\ComboBox.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Imagine\Dial.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Imagine\GroupBox.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Imagine\Label.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\SwissarmyShim.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\platforms\qwindows.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\StackView.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Base\ProgressBarStyle.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Fusion\Popup.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\mbam.firefox.manifest.json MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Frame.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Fusion\SpinBox.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\PoliciesControllerImpl.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\Qt\labs\settings\qmlsettingsplugin.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Private\StackView.js MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Base\images\scrollbar-handle-transient.png MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\TabView.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Material\PageIndicator.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Material\ToolBar.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.tmf MBAMService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Material\ToolTip.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\SwitchDelegate.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\malwarebytes_assistant.exe MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\RTPControllerImpl.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\ScanControllerImpl.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQml\qmldir MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Base\CircularTickmarkLabelStyle.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Material\CursorDelegate.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\mbcut.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Base\PieMenuStyle.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Drawer.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Fusion\Button.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Material\Popup.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Fusion\DialogButtonBox.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Fusion\MenuBar.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\UpdateControllerImpl.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\arwlib.dll MBAMInstallerService.exe -
Drops file in Windows directory 1 IoCs
Processes:
MBAMService.exedescription ioc process File opened for modification C:\Windows\security\logs\scecomp.log MBAMService.exe -
Executes dropped EXE 3 IoCs
Processes:
MBAMInstallerService.exeMBAMService.exeMBAMService.exepid process 2848 MBAMInstallerService.exe 4984 MBAMService.exe 3212 MBAMService.exe -
Loads dropped DLL 31 IoCs
Processes:
MBAMInstallerService.exeMBAMService.exepid process 2848 MBAMInstallerService.exe 2848 MBAMInstallerService.exe 3212 MBAMService.exe 3212 MBAMService.exe 3212 MBAMService.exe 3212 MBAMService.exe 3212 MBAMService.exe 3212 MBAMService.exe 3212 MBAMService.exe 3212 MBAMService.exe 3212 MBAMService.exe 3212 MBAMService.exe 3212 MBAMService.exe 3212 MBAMService.exe 3212 MBAMService.exe 3212 MBAMService.exe 3212 MBAMService.exe 3212 MBAMService.exe 3212 MBAMService.exe 3212 MBAMService.exe 3212 MBAMService.exe 3212 MBAMService.exe 3212 MBAMService.exe 3212 MBAMService.exe 3212 MBAMService.exe 3212 MBAMService.exe 3212 MBAMService.exe 3212 MBAMService.exe 3212 MBAMService.exe 3212 MBAMService.exe 3212 MBAMService.exe -
Registers COM server for autorun 1 TTPs 64 IoCs
Processes:
MBAMService.exeMBAMService.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F1C46F8-E697-4175-B240-CDE682A4BA2D}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{17BE78EE-B40A-4B9E-835F-38EC62F9D479}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{376BE474-56D4-4177-BB4E-5610156F36C8}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9DAB0CA5-AE19-41AE-955C-41DD44C52697}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{F36AD0D0-B5F0-4C69-AF08-603D177FEF0E}\LOCALSERVER32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D5599B6B-FA0C-45B5-8309-853B003EA412}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F415899A-1576-4C8B-BC9F-4854781F8A20}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{278637DA-FDFB-45C7-8CD8-F2D8A9199AB0}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{278637DA-FDFB-45C7-8CD8-F2D8A9199AB0}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{580243BF-3CEE-4131-A599-C6FED66BEB1B}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E1AC7139-D1FF-4DE9-84A4-92E2B47F5D2A}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57CE581A-0CB6-4266-9CA0-19364C90A0B3}\InprocServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57CE581A-0CB6-4266-9CA0-19364C90A0B3}\InprocServer32\ThreadingModel = "Apartment" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{251AD013-20AD-4C3F-8FE2-F66A429B4819}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F1C46F8-E697-4175-B240-CDE682A4BA2D}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D372F21-E6DA-4B82-881A-79F6CA6B6AE1}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{130CD414-6BFD-4F6C-9362-A2264B222E76}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{376BE474-56D4-4177-BB4E-5610156F36C8}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E1AC7139-D1FF-4DE9-84A4-92E2B47F5D2A}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE8A9269-9E6E-4683-BCD3-41E9B16696DC}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D5599B6B-FA0C-45B5-8309-853B003EA412}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F36AD0D0-B5F0-4C69-AF08-603D177FEF0E}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D372F21-E6DA-4B82-881A-79F6CA6B6AE1}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{130CD414-6BFD-4F6C-9362-A2264B222E76}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9DAB0CA5-AE19-41AE-955C-41DD44C52697}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D372F21-E6DA-4B82-881A-79F6CA6B6AE1}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{251AD013-20AD-4C3F-8FE2-F66A429B4819}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F1C46F8-E697-4175-B240-CDE682A4BA2D}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE8A9269-9E6E-4683-BCD3-41E9B16696DC}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{03141A2A-5C3A-458E-ABEC-0812AD7FF497}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{376BE474-56D4-4177-BB4E-5610156F36C8}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{11D1E5E8-14E1-4B5B-AE1A-2678CB91E8E5}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E1AC7139-D1FF-4DE9-84A4-92E2B47F5D2A}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36A65E46-6CC1-4CA2-B51E-F4DD8C993DDC}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F6D29500-933C-447C-9D88-9D814AF73808}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DE03E614-112D-43E0-8E15-E7236CC32108}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{11D1E5E8-14E1-4B5B-AE1A-2678CB91E8E5}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{17BE78EE-B40A-4B9E-835F-38EC62F9D479}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{278637DA-FDFB-45C7-8CD8-F2D8A9199AB0}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{03141A2A-5C3A-458E-ABEC-0812AD7FF497}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D5599B6B-FA0C-45B5-8309-853B003EA412}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9DAB0CA5-AE19-41AE-955C-41DD44C52697}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F415899A-1576-4C8B-BC9F-4854781F8A20}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{03141A2A-5C3A-458E-ABEC-0812AD7FF497}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BF474111-9116-45C6-AF53-209E64F1BB53}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{251AD013-20AD-4C3F-8FE2-F66A429B4819}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{130CD414-6BFD-4F6C-9362-A2264B222E76}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36A65E46-6CC1-4CA2-B51E-F4DD8C993DDC}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{11D1E5E8-14E1-4B5B-AE1A-2678CB91E8E5}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BF474111-9116-45C6-AF53-209E64F1BB53}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{17BE78EE-B40A-4B9E-835F-38EC62F9D479}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F36AD0D0-B5F0-4C69-AF08-603D177FEF0E}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F36AD0D0-B5F0-4C69-AF08-603D177FEF0E}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BF474111-9116-45C6-AF53-209E64F1BB53}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36A65E46-6CC1-4CA2-B51E-F4DD8C993DDC}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57CE581A-0CB6-4266-9CA0-19364C90A0B3}\InprocServer32\ = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbshlext.dll" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{580243BF-3CEE-4131-A599-C6FED66BEB1B}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE8A9269-9E6E-4683-BCD3-41E9B16696DC}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F6D29500-933C-447C-9D88-9D814AF73808}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F415899A-1576-4C8B-BC9F-4854781F8A20}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{580243BF-3CEE-4131-A599-C6FED66BEB1B}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F6D29500-933C-447C-9D88-9D814AF73808}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DE03E614-112D-43E0-8E15-E7236CC32108}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DE03E614-112D-43E0-8E15-E7236CC32108}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
MBAMService.exedescription ioc process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MBAMService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MBAMService.exe -
Processes:
MBAMService.exeMBAMInstallerService.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION MBAMService.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\mbam.exe = "11000" MBAMService.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\mbamtray.exe = "11000" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION MBAMInstallerService.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\mbam.exe = "11000" MBAMInstallerService.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\mbamtray.exe = "11000" MBAMInstallerService.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
MBAMInstallerService.exeMBAMService.exedescription ioc process Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\16.0 MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Malwarebytes MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\15.0\Common MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\16.0\Common MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Malwarebytes MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\15.0\Common\Security MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates MBAMService.exe Set value (str) \REGISTRY\USER\S-1-5-19\SOFTWARE\Malwarebytes\FirstRun = "false" MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software MBAMInstallerService.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:\ MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\15.0 MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\15.0\Common MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\16.0\Common MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA MBAMInstallerService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MBAMService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MBAMService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MBAMService.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\16.0\Common\Security MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols MBAMInstallerService.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Malwarebytes\FirstRun = "false" MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\16.0\Common MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\16.0 MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs MBAMService.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0 MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Malwarebytes MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0\Common MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\Software MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\15.0\Common\Security MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: MBAMInstallerService.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Malwarebytes\FirstRun = "false" MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\MY MBAMService.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft MBAMInstallerService.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:\ MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\16.0\Common\Security MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0\Common\Security MBAMInstallerService.exe -
Modifies registry class 64 IoCs
Processes:
MBAMService.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2A0F9375-1809-45ED-AFE0-92852B971139}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2650A9C4-A53C-4BEF-B766-7405B4D5562B}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FC34538A-37CB-44B4-9264-533E9347BB40}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8640989C-20B4-41BE-BFE1-218EF5B076A6}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{08932AD2-C415-4DE8-821D-5AF7A5658483}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CFFF19F6-ECFE-446D-ACAD-8DC525DA2563}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{ECDAC35E-72BB-4856-97E1-226BA47C62C5}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3BD2053F-99D1-4C2B-8B45-635183A8F0BF}\ = "IMWACControllerV6" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{566DC5CA-A3C4-4959-AB92-37606E12AAFF}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EF7DFB76-BA49-4191-8B62-0AC3571C56D7}\TypeLib\ = "{783B187E-360F-419C-B6DA-592892764A01}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E32ABD9A-1CBD-44A5-8A62-55D347D3C4F0}\ = "ILicenseControllerV7" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E32ABD9A-1CBD-44A5-8A62-55D347D3C4F0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FC34538A-37CB-44B4-9264-533E9347BB40}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{10DAE713-FD88-4ADB-9406-04CB574D543C} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79D77750-02E0-4451-A7BB-524ACD93DD93}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{090D2E82-C71B-414E-AF6A-6681A92FF2B3}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{376BE474-56D4-4177-BB4E-5610156F36C8}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5709DEEB-F05E-4D5C-8DC4-3B0D924EE08F}\1.0\0 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{560EB17C-4365-4DFC-A855-F99B223F02AF}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CDA4F172-98EF-4DF6-89AB-852D1B0EC2D4} MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5BA2811A-EE5B-44DF-81CD-C75BB11A82D4}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{473BC184-760C-4255-A118-E8064C4EC595}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{783B187E-360F-419C-B6DA-592892764A01} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F77B440A-6CBC-4AFD-AA22-444552960E50}\TypeLib\ = "{5709DEEB-F05E-4D5C-8DC4-3B0D924EE08F}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{78E69E6F-EC12-4B84-8431-1D68572C7A61}\ProxyStubClsid32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B5186B66-AE3D-4EC4-B9F5-67EC478625BE} MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F36AD0D0-B5F0-4C69-AF08-603D177FEF0E} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{19E8B60E-50A1-4E29-9138-A13421D2BF7D}\TypeLib\ = "{49F6AC60-2104-42C6-8F71-B3916D5AA732}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{61DF8ACF-EC61-4D69-A543-20EA450E1A84}\TypeLib\ = "{59DBD1B8-A7BD-4322-998F-41B0D2516FA0}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BF474111-9116-45C6-AF53-209E64F1BB53}\VersionIndependentProgID\ = "MB.CloudController" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{72F290D5-789C-4D8A-9EBE-63ECEA150373}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2DFD7E94-47E6-483A-B4FD-DC586A52CE5D}\TypeLib\ = "{332AFEBA-9341-4CEC-8EA6-DB155A99DF63}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1917B432-C1CE-4A96-A08E-A270E00E5B23}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7995CBA9-83E0-4F28-A50B-DFDE85EBCCD1}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A0101B90-FD0B-40CF-90E4-33650F09A80F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD3CFEBD-3B8E-4651-BB7C-537D1F03E59C}\ProxyStubClsid32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B42C0E8E-5C9D-46B7-AAED-2294C6566DC0}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A34647B-D9A8-40D9-B563-F9461E98030E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{698A4513-65F0-46A3-9633-220A6E4D1D07}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{ADCD8BEB-8924-4876-AE14-2438FF14FA17}\ProxyStubClsid32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CFFF19F6-ECFE-446D-ACAD-8DC525DA2563} MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{738848E2-18E4-40F8-9C08-60BC0505E9E9}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0F2D6C4F-0B95-4A53-BA9D-55526737DC34} MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{62A3C5F3-503F-4205-A044-5EA683BEDABE}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{964AD404-A1EF-4EDA-B8FA-1D8003B29B10}\ = "IPoliciesControllerEventsV3" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{49207D05-5DFE-4F52-9286-1856A92A5BFE}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{04F8CDB5-1E26-491C-8602-D2ADE2D8E17A}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DD67766C-A28D-44F3-A5D0-962965510B2D}\ = "ICloudControllerV4" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{19184D37-6938-4F54-BAFD-3240F0FA75E6}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1917B432-C1CE-4A96-A08E-A270E00E5B23}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31A02CB9-6064-4A3B-BCB4-A329528D4648}\TypeLib\ = "{783B187E-360F-419C-B6DA-592892764A01}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4A0A45F1-CFB6-49A7-BBC4-8776F94857A8}\TypeLib\ = "{5709DEEB-F05E-4D5C-8DC4-3B0D924EE08F}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9F798C4B-4059-46F9-A0FE-F6B1664ADE96}\TypeLib\ = "{49F6AC60-2104-42C6-8F71-B3916D5AA732}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{698A4513-65F0-46A3-9633-220A6E4D1D07}\ = "_IAEControllerEventsV5" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A82D6A8-59F8-4B47-BBD0-8F5E5DBB3C7D} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{97EB7268-0D7B-43F6-9C11-337287F960DF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7E96FEF0-48F7-4ECB-B010-501044575477}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D10B0F61-43AA-40F4-9C6C-57D29CA8544E}\ = "IPoliciesControllerV6" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{783B187E-360F-419C-B6DA-592892764A01}\1.0\FLAGS MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{50538523-AA2F-40D3-9B58-DB51D5BD3D4A}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AC5390D0-3831-4D42-BD1D-8151A5A1742C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{08932AD2-C415-4DE8-821D-5AF7A5658483}\TypeLib\ = "{5709DEEB-F05E-4D5C-8DC4-3B0D924EE08F}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8CB653AC-F9CF-4277-BFB1-C0ED1C650F56}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2058A31F-5F59-4452-9204-03F588252FFC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe -
Processes:
MBAMInstallerService.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\5A8CEF45D7A69859767A8C8B4496B578CF474B1A MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0D44DD8C3C8C1A1A58756481E90F2E2AFFB3D26E\Blob = 0300000001000000140000000d44dd8c3c8c1a1a58756481e90f2e2affb3d26e2000000001000000ba010000308201b63082015ba0030201020213066c9fd5749736663f3b0b9ad9e89e7603f24a300a06082a8648ce3d0403023039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412033301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f7420434120333059301306072a8648ce3d020106082a8648ce3d030107034200042997a7c6417fc00d9be8011b56c6f252a5ba2db212e8d22ed7fac9c5d8aa6d1f73813b3b986b397c33a5c54e868e8017686245577d44581db337e56708eb66dea3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414abb6dbd7069e37ac3086079170c79cc419b178c0300a06082a8648ce3d0403020349003046022100e08592a317b78df92b06a593ac1a98686172fae1a1d0fb1c7860a64399c5b8c40221009c02eff1949cb396f9ebc62af8b62cfe3a901416d78c6324481cdf307dd5683b MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\2AD974A775F73CBDBBD8F5AC3A49255FA8FB1F8C MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\2AD974A775F73CBDBBD8F5AC3A49255FA8FB1F8C\Blob = 0300000001000000140000002ad974a775f73cbdbbd8f5ac3a49255fa8fb1f8c2000000001000000620400003082045e30820346a0030201020213077312380b9d6688a33b1ed9bf9ccda68e0e0f300d06092a864886f70d01010b05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412031301e170d3232303832333232323132385a170d3330303832333232323132385a303c310b3009060355040613025553310f300d060355040a1306416d617a6f6e311c301a06035504031313416d617a6f6e205253412032303438204d303130820122300d06092a864886f70d01010105000382010f003082010a0282010100eb712ca9cb1f8828923230af8a570f78b73725955587ac675c97d322c8daa214676b7cf067dae2032ab356125dc6b547f96708a7937a9592180fb4f9f910369a7f2f80b64fba134ec75d531ee0dd96330720d396bc12e4745042a1051373b54f9b4424fe2d7fedbc2285ec362133977506ce271882dce3d9c582078d5e26012626671fd93f13cf32ba6bad7864fcaaff0e023c07df9c0578728cfdea75b7032884dae86e078cd05085ef8154b2716eec6d62ef8f94c35ee9c4a4d091c02e249198caeeba258ed4f671b6fb5b6b38064837478d86dcf2ea06fb76377d9eff424e4d588293cfe271c278b17aab4b5b94378881e4d9af24aef872c565fb4bb451e70203010001a382015a3082015630120603551d130101ff040830060101ff020100300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030106082b06010505070302301d0603551d0e0416041481b80e638a891218e5fa3b3b50959fe6e5901385301f0603551d230418301680148418cc8534ecbc0c94942e08599cc7b2104e0a08307b06082b06010505070101046f306d302f06082b060105050730018623687474703a2f2f6f6373702e726f6f746361312e616d617a6f6e74727573742e636f6d303a06082b06010505073002862e687474703a2f2f6372742e726f6f746361312e616d617a6f6e74727573742e636f6d2f726f6f746361312e636572303f0603551d1f043830363034a032a030862e687474703a2f2f63726c2e726f6f746361312e616d617a6f6e74727573742e636f6d2f726f6f746361312e63726c30130603551d20040c300a3008060667810c010201300d06092a864886f70d01010b05000382010100ad00de0205232e063262b46bb19416e41140de2bfa59c135efe0aa8f2b41b9d1f38739001df23db5a7470c0606c691f3075702d4edbd17c1909abf4875a2074f30dd4a6a42b50d3d15c00ffe845bc63c99cc5752b1d86e12d59692934b94e507e88982086a7a34d49e64e13d876a92909a63a14bf88fb6ea34d305be20c2de06e28c9f738b9f4d3985cace19369d85c99ec9f8503fb67e88a1efca84068b50b40a5ca61c44f1fdc8614060f26125aa07f4c7c27375e40c0b428d04e55f4448995b7b898196a7889d4b0d62e804c4d7feb4e8b26dcaecc01cbc385b1ddf85ce5b7ae3494b6cb9a7ddf405b249ade1c5146bc2ccebcd7fd65869bac3207e7fb0b8 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8DA7F965EC5EFC37910F1C6E59FDC1CC6A6EDE16\Blob = 0300000001000000140000008da7f965ec5efc37910f1c6e59fdc1cc6a6ede162000000001000000450300003082034130820229a0030201020213066c9fcf99bf8c0a39e2f0788a43e696365bca300d06092a864886f70d01010b05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412031301e170d3135303532363030303030305a170d3338303131373030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f74204341203130820122300d06092a864886f70d01010105000382010f003082010a0282010100b2788071ca78d5e371af478050747d6ed8d78876f49968f7582160f97484012fac022d86d3a0437a4eb2a4d036ba01be8ddb48c80717364cf4ee8823c73eeb37f5b519f84968b0ded7b976381d619ea4fe8236a5e54a56e445e1f9fdb416fa74da9c9b35392ffab02050066c7ad080b2a6f9afec47198f503807dca2873958f8bad5a9f948673096ee94785e6f89a351c0308666a14566ba54eba3c391f948dcffd1e8302d7d2d747035d78824f79ec4596ebb738717f2324628b843fab71daacab4f29f240e2d4bf7715c5e69ffea9502cb388aae50386fdbfb2d621bc5c71e54e177e067c80f9c8723d63f40207f2080c4804c3e3b24268e04ae6c9ac8aa0d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604148418cc8534ecbc0c94942e08599cc7b2104e0a08300d06092a864886f70d01010b0500038201010098f2375a4190a11ac57651282036230eaee628bbaaf894ae48a4307f1bfc248d4bb4c8a197f6b6f17a70c85393cc0828e39825cf23a4f9de21d37c8509ad4e9a753ac20b6a897876444718656c8d418e3b7f9acbf4b5a750d7052c37e8034bade961a0026ef5f2f0c5b2ed5bb7dcfa945c779e13a57f52ad95f2f8933bde8b5c5bca5a525b60af14f74befa3fb9f40956d3154fc42d3c7461f23add90f48709ad9757871d1724334756e5759c2025c266029cf2319168e8843a5d4e4cb08fb231143e843297262a1a95d5e08d490aeb8d8ce14c2d055f286f6c49343776661c0b9e841d7977860036e4a72aea5d17dba109e866c1b8ab95933f8ebc490bef1b9 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0D44DD8C3C8C1A1A58756481E90F2E2AFFB3D26E MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\1C58A3A8518E8759BF075B76B750D4F2DF264FCD\Blob = 0300000001000000140000001c58a3a8518e8759bf075b76b750d4f2df264fcd2000000001000000c2040000308204be308203a6a003020102021006d8d904d5584346f68a2fa754227ec4300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3231303431343030303030305a170d3331303431333233353935395a304f310b300906035504061302555331153013060355040a130c446967694365727420496e633129302706035504031320446967694365727420544c53205253412053484132353620323032302043413130820122300d06092a864886f70d01010105000382010f003082010a0282010100c14bb3654770bcdd4f58dbec9cedc366e51f311354ad4a66461f2c0aec6407e52edcdcb90a20eddfe3c4d09e9aa97a1d8288e51156db1e9f58c251e72c340d2ed292e156cbf1795fb3bb87ca25037b9a52416610604f571349f0e8376783dfe7d34b674c2251a6df0e9910ed57517426e27dc7ca622e131b7f238825536fc13458008b84fff8bea75849227b96ada2889b15bca07cdfe951a8d5b0ed37e236b4824b62b5499aecc767d6e33ef5e3d6125e44f1bf71427d58840380b18101faf9ca32bbb48e278727c52b74d4a8d697dec364f9cace53a256bc78178e490329aefb494fa415b9cef25c19576d6b79a72ba2272013b5d03d40d321300793ea99f50203010001a38201823082017e30120603551d130101ff040830060101ff020100301d0603551d0e04160414b76ba2eaa8aa848c79eab4da0f98b2c59576b9f4301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030106082b06010505070302307606082b06010505070101046a3068302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304006082b060105050730028634687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274476c6f62616c526f6f7443412e63727430420603551d1f043b30393037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274476c6f62616c526f6f7443412e63726c303d0603551d2004363034300b06096086480186fd6c02013007060567810c01013008060667810c0102013008060667810c0102023008060667810c010203300d06092a864886f70d01010b050003820101008032ce5e0bdd6e5a0d0aafe1d684cbc08efa8570edda5db30cf72b7540fe850afaf33178b7704b1a8958ba80bdf36b1de97ecf0bba589c59d490d3fd6cfdd0986db771825bcf6d0b5a09d07bdec443d82aa4de9e41265fbb8f99cbddaee1a86f9f87fe74b71f1b20abb14fc6f5675d5d9b3ce9ff69f7616cd6d9f3fd36c6ab038876d24b2e7586e3fcd8557d26c21177df3e02b67cf3ab7b7a86366fb8f7d89371cf86df7330fa7babed2a59c842843b11171a52f3c90e147da25b7267ba71ed574766c5b8024a65345e8bd02a3c209c51994ce7529ef76b112b0d927e1de88aeb36164387ea2a63bf753febdec403bb0a3cf730efebaf4cfc8b3610733ef3a4 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa22000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\1C58A3A8518E8759BF075B76B750D4F2DF264FCD MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\5A8CEF45D7A69859767A8C8B4496B578CF474B1A\Blob = 0300000001000000140000005a8cef45d7a69859767a8c8b4496b578cf474b1a2000000001000000450500003082054130820329a0030201020213066c9fd29635869f0a0fe58678f85b26bb8a37300d06092a864886f70d01010c05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412032301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f74204341203230820222300d06092a864886f70d01010105000382020f003082020a0282020100ad969f2d9c4a4c4a81795199ec8acb6b605113bc4d6d06fcb0088ddd19106ac7260c35d8c06f2084e994b19b8503c35bdb4ae8c8f89076d95b4fe34ce806364dcc9aac3d0c902b92d4061960ac374479858182ad5a37e00dcc9da64c5276ea439db704d150f655e0d5d2a64985e937e9ca7eae5c954d489a3fae205a6d8895d934b8521a4390b0bf6c05b9b678b7ead0e43a3c125362ff4af27bbe3505a91234e3f36474622c3d00495a28fe3244bb87dd652702713bda4af71fdacdf72155904f0fecae82e19f6bd945d3bbf05f87ed3c2c3986da3fdeec7255eb79a3addbdd7cb0ba1ccefcde4f3576cf0ff8781f6a36514627615be99ecff0a2557d7c258a6f2fb4c5cf842e2bfd0d51106cfb5f1bbc1b7ec5ae3b98013192ff0b57f49ab2b957e9abef0d76d1f0eef4ce86a7e06ee9b469a1df69f633c6692e97139ea587b057108137c953b3bb7ff692d19cd018f4926eda834fa663994ca5fb5eef21647a205f6c648515cb37e9620c0b2a16dc012e32da3e4bf59e3af6174094ef9e910886fabe63a85a33eccb744395f96c695236c7296ffc55035c1ffb9fbd47ebe74947950b4e89220949e0f5611ef1bf2e8a726e8059ff573af97532a34e5feced2862d94d73f2cc811760edcdebdcdba7cac57e02bdf2540854fdb42d092c17544a98d154e1516708d2ed6e7e6f3fd22d81592966cb903995111e7427feddebaf0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414b00cf04c30f405580248fd33e552af4b84e36652300d06092a864886f70d01010c05000382020100aaa8808f0e78a3e0a2d4cde6f5987a3bea0003b0970e93bc5aa8f62c8c7287a9b1fc7f73fd637178a58759cf30e10d10b2135a6d82f56ae6809fa0050b68e4476bc76adfb6fd773272e518fa09f4a0932c5dd28c75857665900c0379b7312363ad788309866884cafff9cf269a9279e7cd4bc5e761a717cbf3a91293936ba7e82f5392c46058b0cc0251185b858d625963b6adb4de9afb26f70027c05d55377499c9507fe3592e44e32c25eeec4c3277b49f1ae94b5d20c5dafd1c8716c643e8d4bb269a45705ea90b3753e2467b27fde046f289b7cc42b6cb28266ed9a5c93ac8411360f7508c15aeb26d1a151a5778e6922ad96590823f6c02afae123a27963604d71da28063a99bf1e5bab47c14b04ec9b11f745f38f651ea9bfa2ca211d4a92d271a45b1afb24e710dc05846d66906cb53cbb3fe6b41cd417e7d4c0f7c72797a59cd5e4a0eac9ba99873797cb4f4ccb9b8070cb2745cb8c76f88a190a7f4aaf9bf673af41a15621eb79fbe3db129af67a112f25810195303301bb81a89f69cbd97038ea309f31d8b21f1b4dfe41cd19f650206ea5cd613b384efa2a55c8c7729a768c06bae40d2a8b4eacdf08d4b389c199a1b2854b88990efca75813e1ef26424c718af4eff479e07f63565a4d30a56fff517646cefa822254993b6df0017da587e5deec51bb0d1d15f2110c7f9f3ba020a2707c5f1d6c7d3e0fb09606c MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F6108407D6F8BB67980CC2E244C2EBAE1CEF63BE\Blob = 030000000100000014000000f6108407d6f8bb67980cc2e244c2ebae1cef63be2000000001000000f6010000308201f230820178a0030201020213066c9fd7c1bb104c2943e5717b7b2cc81ac10e300a06082a8648ce3d0403033039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412034301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f7420434120343076301006072a8648ce3d020106052b8104002203620004d2ab8a374fa3530dfec18a7b4ba87b464b63b062f62d1bdb087121d200e863bd9a27fbf0396e5dea3da5c981aaa35b2098455d16dbfde8106de39ce0e3bd5f8462f3706433a0cb242f70ba88a12aa075f881ae6206c481db396e29b01efa2e5ca3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414d3ecc73a656ecce1da769a56fb9cf3866d57e581300a06082a8648ce3d040303036800306502303a8b21f1bd7e11add0ef58962fd6eb9d7e908d2bcf6655c32ce328a9700a470ef0375912ff2d9994284e2a4f354d335a023100ea75004e3bc43a941291c958469d211372a7889c8ae44c4adb96d4ac8b6b6b49125333add7e4be24fcb50a76d4a5bc10 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8DA7F965EC5EFC37910F1C6E59FDC1CC6A6EDE16 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F6108407D6F8BB67980CC2E244C2EBAE1CEF63BE MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E\Blob = 030000000100000014000000b51c067cee2b0c3df855ab2d92f4fe39d4e70f0e2000000001000000e1030000308203dd308202c5a003020102020100300d06092a864886f70d01010b050030818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a30818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bdedc103fcf68ffc02b16f5b9f48d99d79e2a2b703615618c347b6d7ca3d352e8943f7a1699bde8a1afd13209cb44977322956fdb9ec8cdd22fa72dc276197eef65a84ec6e19b9892cdc845bd574fb6b5fc589a51052894655f4b8751ce67fe454ae4bf85572570219f8177159eb1e280774c59d48be6cb4f4a4b0f364377992c0ec465e7fe16d534c62afcd1f0b63bb3a9dfbfc7900986174cf26824063f3b2726a190d99cad40e75cc37fb8b89c159f1627f5fb35f6530f8a7b74d765a1e765e34c0e89656998ab3f07fa4cdbddc32317c91cfe05f11f86baa495cd19994d1a2e3635b0976b55662e14b741d96d426d4080459d0980e0ee6defcc3ec1f90f10203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147c0c321fa7d9307fc47d68a362a8a1ceab075b27300d06092a864886f70d01010b050003820101001159fa254f036f94993b9a1f828539d47605945ee128936d625d09c2a0a8d4b07538f1346a9de49f8a862651e62cd1c62d6e95204a9201ecb88a677b31e2672e8c9503262e439d4a31f60eb50cbbb7e2377f22ba00a30e7b52fb6bbb3bc4d379514ecd90f4670719c83c467a0d017dc558e76de68530179a24c410e004f7e0f27fd4aa0aff421d37ed94e5645912207738d3323e3881759673fa688fb1cbce1fc5ecfa9c7ecf7eb1f1072db6fcbfcaa4bfd097054abcea18280290bd5478092171d3d17d1dd916b0a9613dd00a0022fcc77bcb0964450b3b4081f77d7c32f598ca588e7d2aee90597364f936745e25a1f566052e7f3915a92afb508b8e8569f4 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2 MBAMInstallerService.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
MBSetup.exeMBAMInstallerService.exeMBAMService.exepid process 4508 MBSetup.exe 4508 MBSetup.exe 2848 MBAMInstallerService.exe 2848 MBAMInstallerService.exe 2848 MBAMInstallerService.exe 2848 MBAMInstallerService.exe 2848 MBAMInstallerService.exe 2848 MBAMInstallerService.exe 2848 MBAMInstallerService.exe 2848 MBAMInstallerService.exe 2848 MBAMInstallerService.exe 2848 MBAMInstallerService.exe 3212 MBAMService.exe 3212 MBAMService.exe -
Suspicious behavior: LoadsDriver 4 IoCs
Processes:
pid process 672 672 672 672 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
MBAMService.exeMBAMService.exedescription pid process Token: 33 4984 MBAMService.exe Token: SeIncBasePriorityPrivilege 4984 MBAMService.exe Token: 33 3212 MBAMService.exe Token: SeIncBasePriorityPrivilege 3212 MBAMService.exe Token: SeBackupPrivilege 3212 MBAMService.exe Token: SeRestorePrivilege 3212 MBAMService.exe Token: SeTakeOwnershipPrivilege 3212 MBAMService.exe Token: SeBackupPrivilege 3212 MBAMService.exe Token: SeRestorePrivilege 3212 MBAMService.exe Token: SeBackupPrivilege 3212 MBAMService.exe Token: SeRestorePrivilege 3212 MBAMService.exe Token: SeBackupPrivilege 3212 MBAMService.exe Token: SeRestorePrivilege 3212 MBAMService.exe Token: SeBackupPrivilege 3212 MBAMService.exe Token: SeRestorePrivilege 3212 MBAMService.exe Token: SeBackupPrivilege 3212 MBAMService.exe Token: SeRestorePrivilege 3212 MBAMService.exe Token: SeBackupPrivilege 3212 MBAMService.exe Token: SeRestorePrivilege 3212 MBAMService.exe Token: SeBackupPrivilege 3212 MBAMService.exe Token: SeRestorePrivilege 3212 MBAMService.exe Token: SeBackupPrivilege 3212 MBAMService.exe Token: SeRestorePrivilege 3212 MBAMService.exe Token: SeBackupPrivilege 3212 MBAMService.exe Token: SeRestorePrivilege 3212 MBAMService.exe Token: SeBackupPrivilege 3212 MBAMService.exe Token: SeRestorePrivilege 3212 MBAMService.exe Token: SeBackupPrivilege 3212 MBAMService.exe Token: SeRestorePrivilege 3212 MBAMService.exe Token: SeBackupPrivilege 3212 MBAMService.exe Token: SeRestorePrivilege 3212 MBAMService.exe Token: SeBackupPrivilege 3212 MBAMService.exe Token: SeRestorePrivilege 3212 MBAMService.exe Token: SeBackupPrivilege 3212 MBAMService.exe Token: SeRestorePrivilege 3212 MBAMService.exe Token: SeBackupPrivilege 3212 MBAMService.exe Token: SeRestorePrivilege 3212 MBAMService.exe Token: SeBackupPrivilege 3212 MBAMService.exe Token: SeRestorePrivilege 3212 MBAMService.exe Token: SeBackupPrivilege 3212 MBAMService.exe Token: SeRestorePrivilege 3212 MBAMService.exe Token: SeBackupPrivilege 3212 MBAMService.exe Token: SeRestorePrivilege 3212 MBAMService.exe Token: SeBackupPrivilege 3212 MBAMService.exe Token: SeRestorePrivilege 3212 MBAMService.exe Token: SeBackupPrivilege 3212 MBAMService.exe Token: SeRestorePrivilege 3212 MBAMService.exe Token: SeBackupPrivilege 3212 MBAMService.exe Token: SeRestorePrivilege 3212 MBAMService.exe Token: SeBackupPrivilege 3212 MBAMService.exe Token: SeRestorePrivilege 3212 MBAMService.exe Token: SeBackupPrivilege 3212 MBAMService.exe Token: SeRestorePrivilege 3212 MBAMService.exe Token: SeBackupPrivilege 3212 MBAMService.exe Token: SeRestorePrivilege 3212 MBAMService.exe Token: SeBackupPrivilege 3212 MBAMService.exe Token: SeRestorePrivilege 3212 MBAMService.exe Token: SeBackupPrivilege 3212 MBAMService.exe Token: SeRestorePrivilege 3212 MBAMService.exe Token: SeBackupPrivilege 3212 MBAMService.exe Token: SeRestorePrivilege 3212 MBAMService.exe Token: SeBackupPrivilege 3212 MBAMService.exe Token: SeRestorePrivilege 3212 MBAMService.exe Token: SeBackupPrivilege 3212 MBAMService.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
MBSetup.exepid process 4508 MBSetup.exe 4508 MBSetup.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
MBAMInstallerService.exedescription pid process target process PID 2848 wrote to memory of 4984 2848 MBAMInstallerService.exe MBAMService.exe PID 2848 wrote to memory of 4984 2848 MBAMInstallerService.exe MBAMService.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\MBSetup.exe"C:\Users\Admin\AppData\Local\Temp\MBSetup.exe"1⤵
- Drops file in Drivers directory
- Checks BIOS information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:4508
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"1⤵
- Drops file in Drivers directory
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe" /Service /Protected2⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Executes dropped EXE
- Registers COM server for autorun
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4984
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Checks BIOS information in registry
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3212 -
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵PID:4816
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-0.exeig.exe reseed2⤵PID:3576
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-1.exeig.exe reseed2⤵PID:5308
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-2.exeig.exe reseed2⤵PID:5356
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-3.exeig.exe reseed2⤵PID:5408
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-4.exeig.exe reseed2⤵PID:5432
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-5.exeig.exe reseed2⤵PID:5456
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-6.exeig.exe reseed2⤵PID:5480
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-7.exeig.exe reseed2⤵PID:5536
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-8.exeig.exe reseed2⤵PID:5572
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-9.exeig.exe reseed2⤵PID:5612
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-10.exeig.exe reseed2⤵PID:5676
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-11.exeig.exe reseed2⤵PID:5728
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-12.exeig.exe reseed2⤵PID:5760
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-13.exeig.exe reseed2⤵PID:5784
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-14.exeig.exe reseed2⤵PID:5812
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-15.exeig.exe reseed2⤵PID:5836
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-16.exeig.exe reseed2⤵PID:5876
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-17.exeig.exe reseed2⤵PID:5912
-
C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe"C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe"2⤵PID:5940
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-18.exeig.exe reseed2⤵PID:5948
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-19.exeig.exe reseed2⤵PID:5996
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-20.exeig.exe reseed2⤵PID:6056
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-21.exeig.exe reseed2⤵PID:6128
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-22.exeig.exe reseed2⤵PID:3668
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-23.exeig.exe reseed2⤵PID:4260
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-24.exeig.exe reseed2⤵PID:1724
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-25.exeig.exe reseed2⤵PID:764
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-26.exeig.exe reseed2⤵PID:1272
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-27.exeig.exe reseed2⤵PID:1672
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-28.exeig.exe reseed2⤵PID:1628
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Defense Evasion
Modify Registry
3Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\7z.dllFilesize
1.7MB
MD5461faf68ccc02b0223fd273b630f21fe
SHA1363b8beaa74f0f454c2d544ace9e71a84bc2b4cf
SHA256cb07f3f461e9c267831b1ab93af6dfda1bb51d72e42d73d00d26594f09326be1
SHA5124b671f48e45fdedf50c7f7bb6c8d82a3b98f7502006eb002aaf8ff31f25f9ff1257c7bcc12caf622e43d4ec665b19d978ae3e3762f76def0bc71485ebdb8426f
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\Actions.dllFilesize
5.0MB
MD51eff53d95ecaf6bbfffe80d866d8e1dd
SHA1d7ef7d7c77fd04b2c0eb8c16bb3cd08057f6742f
SHA2566dd748f7ca56125cbe158fa3612f08e7312ef58ad5375e6b7ab5532cc16ca0ac
SHA512c59b8e6f0b238a247e64b9c7bb42213dadac1dada63542830a6292361174c935c0c662b2d1aed3fb6100cc4993297b1eaf25e328f2b4613458c4ffca63b9f02d
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ActionsShim.dllFilesize
2.5MB
MD558149edf4990067b4c1ffe1c32a51a01
SHA180c0c8b8def45420159659d2eaad181eb0b05c40
SHA25667af73f9b49ce113d02d7f2824e45d48044273772c94e6e8c300cf86bf83cb55
SHA512fe69f4eccaa35b132b7dfc77fae50733398cfa5ab7377f502a50e1bb83be6b81fad26a0a24f6dfbc99dca6e118784f3452edc4a30c11ac161fc0db62b039cb4e
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\BrowserSDKDLL.dllFilesize
5.8MB
MD51ed53171d00f440f29a12f9beb84dac4
SHA14d9a1e3579b0999f1ab2fa818b588411e9ee920c
SHA256e659e687a872050f9e65d78992d16bd9b393cf3f8e8c94e0e15fb42b7065327e
SHA51217161cfc672d1b996b8af4ebac17f9a8a3807f38c9a23e2e5b4dadcd9a21c3a64faec9bf59147022a9df88b80f89300f1b537091289bd7a42806bd206a317e6e
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\BrowserSDKDLLShim.dllFilesize
2.5MB
MD52e8ad6f405eb7744908f635dc089438a
SHA1f2ca3f55ce4395dfe39a0ba099a39f8c30e263cb
SHA2564824ad6b30b42a9166bfd3db41f11e3cb67e7aab96058b7f946797d7dadba891
SHA5123eacea19caf3f04cddb35091102c5d627b82acc8c73be1bfa4d72932c78cba7821c99c616bbd8d422ce588b865700db560ba441f8a5da6a9629af844f6ad28c5
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\CleanControllerImpl.dllFilesize
6.9MB
MD573a08c403bf08e39bd560ffc74ae9b8f
SHA1888c6d11e6788875f8fca748b6f92a19b6126dc6
SHA25609d687c0164a9f108c4f9e107bfc0cb671ebe643ac9aae968cb8df0e5adda960
SHA5128b65c0549c319e9c42b30071b1342e8ba4239d9dc4a124e19abd2160339c03235f0ec534a997ec367f2b474797d33efa496e641c7a63904bf8e0af43a32f1535
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\CloudControllerImpl.dllFilesize
4.8MB
MD5a22f4dd3f75413faba618de10315540d
SHA1450a9abff68ffb922abaa0ba193ea4ffc983e92b
SHA25631d628b6c6c58d76dbd8071e155c9bfef575444d3ce7fa83c2a0c3a16e67e7ea
SHA512b34bec558e556dc8602717fc8b2601f18d02217551bcb1b3d7df7f9574f7ddf46a29dcfe043119f353e1e258fdc1e9a6db6d38ce8e5f3eda9fdb92216a31ccd6
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\LicenseControllerImpl.dllFilesize
4.4MB
MD549a840f316fe0e63dbbf8789eac84557
SHA1aa8eeb9f12b345f42eb04353201b53543cc7b952
SHA25656b3c7e59854dc2f7a33b88f42b98d164686cc92335cf5b77e8fd60cbb84c64c
SHA512ba1b9ce3910b94764f755f5ee2ae0ef6f2dee4cbea97dc261b0ebb7f510f8bcf40b6fecedd3115e35255268bddaea1eddea1952bdaff227eae2f50b40977bd71
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\MBAMCore.dllFilesize
6.4MB
MD5b2216df400c3ef59f9406831ba7956b5
SHA11e26588190fc8a608e773239d498ceb79a92fca3
SHA2561e429ee1da8a0fe6569673b7052c5f49c193aaa8f3152451f645539a431b792d
SHA5123aa3c9ed3bcaa0f2b7c4de36f7a83e35e8abf63c972c8e5377915bed41a803ae516cf8ef14e9c455043dd1ae46e4aec1820fa3572e65d0c87a99eac1d43d1f40
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\MBAMShim.dllFilesize
3.0MB
MD5f44b6c80c46c4cf3071b5f5b916e1271
SHA1839f2238ecbbfa80ebf9c1f77eafc78204b58761
SHA256732523df43358729d5e85cceb557d69016dcdd3e2238d903c33c5327c3131fae
SHA51299be164ae96bc4f93dc896d5df445ad1c2f023f10605a8c9857d7ebedfc5b070f50cd33b401d61003e601a06b8446e6c0b5dbddda4927a2e1352407d3b266942
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\PoliciesControllerImpl.dllFilesize
4.0MB
MD5efe6216931bca54ccf05a0bcb9f83fb9
SHA1007d0a3c4d850cd9b2886b24daf91c988d702bdd
SHA256eaf71519b965b9530e84be08bd3649fdb8feeeabb8dd2455be95755a336a44d6
SHA5127c59071b6ae8d0a2d6eedcb58f6a1337aa340275bf30baa121f515241aba822f6f7bbbc53b626f5f44c424af70aef3afc582a1a8a34d0b0adef115d0e8f684f4
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ScanControllerImpl.dllFilesize
5.7MB
MD51ff50d44fcb92f99dd7af478171e8b18
SHA1a4d3b41df2173d8363ef99d2cea92cff8ff60338
SHA256118841f1c274e8dfd94fc6a31f4f2c10df38a71d0fa96c1f3f6453339e20bf02
SHA512f7df13e47f88cf77797a153cab5aea17d03bd9a9aebd2fa64d49175d3fc820604ba7ce9d43081624dd660fca5bf42eda2ff1309c018bc4ff7e4fd982e14650b1
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\Swissarmy.dllFilesize
4.0MB
MD53486801ce1e8ffc1bbc6d4f097b0f369
SHA108f2a85cd07cf1c0d6f27f0d5e7179c2a5cb8600
SHA25626720d0b669898089a4ab5a6c53203918ec399d227331273ba11169bbe273678
SHA51281974a79bf4e4086549874ef778e7716713a0107ccce212e9564f3355a26670943845aaba744691d2b68224e06e2f9d9a263e29f4ca7e46e1bfdb507a24656d5
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\SwissarmyShim.dllFilesize
2.6MB
MD589a38afcfa758e3298609c6c51929593
SHA12df1ee30adc92bd995526e41fd9c823354de30b4
SHA2564795576483af0c136a71dcee87a0ffb54f0869cae6395ac2ff8312bf555e7161
SHA512cceaed0b9a7517aebd739a377c7bd8987b9ac357be2bf987dbae31d59f2121c5bb9a9bfa2c70a9a54ad65546ef23903176dd6328d93408cb5c991257d59e2717
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\TelemetryControllerImpl.dllFilesize
5.3MB
MD51692937ebb8172814cfd1b2d20dac8c6
SHA13ad3b0dce9958ce66d89c280645ae827d3b89f16
SHA256f1cee1b89fff12181d828623b3aba0f0b8c0aed4aab8b0c017ea4d4731c16e32
SHA512a36462731990635f57f80c070cb01a8c4fe6fa445aad63f077197d473d0d625e23bcadaf5bf92c9504919ee69d12239a7733febf27d6016aa20c03f631b7e3e8
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\UpdateControllerImpl.dllFilesize
4.4MB
MD57cf80cf9c1b9eced61792c17af5db7a8
SHA138ccd9e00badc2f3efc904e55a654be3c8f683bf
SHA2568c838fcd980d39c61a3e1b7dd93565a05041fbeea2ac3c759f10dbe82bf2a973
SHA512ca7c774b2dab671959f81056982b7e228e4c371a78afaa4e92dbebf2b519227e36e25ec60b4633383dd2d47dc9490ff9ac6740b80687cd8cd69a29a0e3d0ffcb
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeFilesize
1.8MB
MD514cd82fe89752e3723a9b42aaa68763a
SHA1ea407d8d7064581406eb1b14e0f01cee61afb252
SHA25660e6029bdf3a2d88772bd4ec3aea6b688505e7dfcb76ce371d6942e9de95ce04
SHA51216114ff38a2e2cc59a9bbf420304fda8e558022f385748a5f48c02f037cbe815221a1cb4f0ac1deeb408ebf66ee3e25c059b157c7cc5cb169dbac75a73694fdc
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\pkgvers.datFilesize
74B
MD54f61d81c221490a12e7d83f70e8659a8
SHA18ca504b5c3b03bacd84c7f9b4d376b15c0266327
SHA2561a9ddae2bce1b0aaa11b53c26613ecfdd8765d91102856fec2996a44f18370e5
SHA512a3ed3f7f9b85828a64ee895d2146d36976117524eef56ff8f80bee884160449844a6cfbc25cd51264613ab2c1dd1ade911daed572f0498c5e57fd576b0126ab5
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\sample.dllFilesize
528KB
MD5936021397e23fc913c55992ce9468913
SHA1d65af889a379f2982b1ebf29d83d2783b9aa0ded
SHA256ce7bdd309701942d97bd8cd3c2455a8d37d93b4d9ce4c14986703daf46fab7fb
SHA5124fb968bee32b5f2b5a5d1629ec2855dc0150ec6b753e83a457ec704350b1f219b5e1349a75ec41f94757d1ef2de9a020933f8e42566bf6123543b7709ecc3d74
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\version.datFilesize
47B
MD51b88e92ceab1b56dd4ca6f82ace32cb7
SHA17a88ef591641f2186a3d46b25fbe4a56223c243a
SHA2560dc096662f705de8bddebd7f1a6412efe213d06f476167a27fe441b2fda31e37
SHA5127ddff716f8edd2e23b66bef4b771e457776d24e43581d83638015565f1797afdc8f7a3e3ef013f986a38a229d1468d1ca556b1dd6740e996b6a9ffea1d11f1c8
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\Global.nmFilesize
336KB
MD5de2e430b3d52a488b4708f8ae8d7f6e9
SHA1bc363a4c751138517d74cbee1cb2c0d6f27fd1c7
SHA25640155bc90aef9ce87a9afed668713756ea65e39d40fe62dc5701161394ec4e1a
SHA5126ba166b7ceb990e92a799b33bdca68c7b0bf91055496f750c562d5ea345e8c77101df75f84dcd3976975c6ee960a8b8c87419463e40bf7d00c8578b16257fccc
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\Global.srFilesize
16.2MB
MD5d71078790223e7ba2751a2c8936629dd
SHA120dcdb964e46cddcfee865230009cdd6401d8ac4
SHA25627e867106e5d38e8823f388063ef76d64c18aac61023405a7f9383827893909c
SHA5128fb5723c96fdbaf4e6a9770c6646eefd490b95436884a998c0137ec924ee7723ab77e612ea8ccd02be2f11ca1650249dc7e9998b2d4b01941f099771ca2aee02
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\cfg.binFilesize
661B
MD58fd13803b1e5f14b4d241facc601a170
SHA17321eec794bc766d84d75bd0370a9f2e4d7abdf6
SHA256925d771b2643715b62ef720801dfa96047fff1ee70eabb244bed802234673717
SHA512f5b3514258487f8576fe32a795eefcffef049c7d002a6abdca17383bba838c7a218be23ec6803dcefed615f40afc2ba4b15bf65c9a74c4f6bb891d15d02bfc22
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\clean.mbdbFilesize
10KB
MD51d731bebc4e45b25b7f1172f8102e101
SHA14f3e09221e00e30502721fe0bf1041ff4287a18e
SHA256d46568f6978f0fdc6fc519c9a0f941e2a221abafe53e018eb4ebbf31764f9fcb
SHA512dc4e489043451817cf948961351a9f5ddbed4a14ee55cbfa8820d62b7c3c58bbcf4d1af302270033631f095a5e7aaf66c45e9d6f507b202a5cc87b5153979603
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\dbmanifest2.datFilesize
924B
MD5b2d399dddb7d7d32377298c562c0ef11
SHA19c5f2816b722987292e0920bd4dd1be4548c2ab6
SHA25675b35c9b51d978912b5fac4ae4e49f929dcb02b192a1b40bb2367801de303a6e
SHA512dff11a505708c8154c739a4b3cfafd68de00ef55fc9ca62f75973601453ba2291e15299285865dda5a0607efd5f36bdab1a9be95dec9392c536963c64a599448
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\dynconfig.datFilesize
39KB
MD510f23e7c8c791b91c86cd966d67b7bc7
SHA13f596093b2bc33f7a2554818f8e41adbbd101961
SHA256008254ca1f4d6415da89d01a4292911de6135b42833156720a841a22685765dc
SHA5122d1b21371ada038323be412945994d030ee8a9007db072484724616c8597c6998a560bc28886ebf89e2c8919fb70d76c98338d88832351823027491c98d48118
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\exclusions.txtFilesize
23KB
MD5aef4eca7ee01bb1a146751c4d0510d2d
SHA15cf2273da41147126e5e1eabd3182f19304eea25
SHA2569e87e4c9da3337c63b7f0e6ed0eb71696121c74e18a5da577215e18097715e2f
SHA512d31d21e37b0048050b19600f8904354cff3f3ec8291c5a7a54267e14af9fb88dfb6d11e74a037cc0369ade8a8fb9b753861f3b3fb2219563e8ec359f66c042db
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\mbdigsig2.datFilesize
514B
MD51afb5b585f1e63f7ebe7637a47ceec6e
SHA1b7759c9e0d3b6b5173da9bb94388966dc34030ea
SHA2568eb3bf3c0b3b2ec8591129f4e8e3a9ff67458f1fedc76041045ad8cfb8ec2b03
SHA5123f0c4c83684afabdaeb9cae63eda14dcba057cf59a4857cab35113a590ad798f4ddf88e8adc1c6bfa3f321aab7aca77ae856a2997ab106aa2939a52107b046b1
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\prot.mbdbFilesize
24B
MD5546d9e30eadad8b22f5b3ffa875144bf
SHA13b323ffef009bfe0662c2bd30bb06af6dfc68e4d
SHA2566089fbf0c0c1413f62e91dc9497bedc6d8a271e9dc761e20adc0dccf6f4a0c1f
SHA5123478f5dcf7af549dd6fe48ad714604200de84a90120b16a32233b6d44fa7240f5f4e5fe803f54b86bbdfd10fa1bfdd88fb85eb6a78e23e426933f98d0a2565ec
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\rdefs.mbdbFilesize
24B
MD52f7423ca7c6a0f1339980f3c8c7de9f8
SHA1102c77faa28885354cfe6725d987bc23bc7108ba
SHA256850a4ea37a0fd6f68bf95422d502b2d1257264eb90cc38c0a3b1b95aa375be55
SHA512e922ac8a7a2cde6d387f8698207cf5efbd45b646986a090e3549d97a7d552dd74179bd7ac20b7d246ca49d340c4c168982c65b4749df760857810b2358e7eb69
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\rules.mbdbFilesize
8.6MB
MD52d805cee52016ed4611e99c7b90d1216
SHA1896937902c172feb3330df9b71788cfa2763c1d2
SHA256b555b516dbd924530ad7383b91ab1c43814fe73b5ce379e216ba6cb88d79921e
SHA5122ccfd1c6aca1b761d958955d7adc94dd5eebb4b16552dd00d22b6a91a4777f383aa370d52de04be5ebc2b95c5abfd3af80606b9b33c8c21cd08f2b9f9434979d
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\scan.mbdbFilesize
1.0MB
MD5ff3fa22cba0d1a3b474c6c07743e97f0
SHA19d81f3250adb32282bfb807106034bb8e8796a68
SHA256108cf7b41eec0a29baca9c3b18f42d884c0a83e3c8fb1354514a3c7871d7f3b7
SHA512012849a67c809567f756f9e4a36c4a7b203cb9a3b98ffd43add3cbb93c2e1e85b5b0bb75739e2924398f9ee652053e6193d0199eba801dd2109c4e21522e3432
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\tids.mbdbFilesize
176KB
MD5fb5bfb4996226bc6680f010f08b59d36
SHA1339c22a7c1edd14dec64e69ab62f4ba6fbb53e34
SHA256266c2440e2dd98eca447ce454d9e6d82f960366ce04210b23e8369eae6d6b1e3
SHA5127958f8b00aad5aa7150551e5a4e98f76ecea5ee6a26233d194907b8b94b9fb70fca9ad2d837a9df2be6b075b028c0d3e9ca7a00a3edeeb146df11764a995eebb
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\wprot2.mbdbFilesize
44.6MB
MD5b7bd606a3a52d95dade066a4743fe5dd
SHA1df8a492eea61759c18d8a4d09f0a6c1104843fd1
SHA2560c0e5e2a7d231510dbe18507ee7cafe142fc8280d07bdc49bd2f1d24dc00ba01
SHA5125b801a0fadfa65114fad5a4dbd49c73ad58356682a2486e493c518bb915a46d787e330a6756456ebcdd09b45a531cfae726333df8619729855fc29c889d1fc32
-
C:\Program Files\Malwarebytes\Anti-Malware\7z.dllFilesize
1.7MB
MD5461faf68ccc02b0223fd273b630f21fe
SHA1363b8beaa74f0f454c2d544ace9e71a84bc2b4cf
SHA256cb07f3f461e9c267831b1ab93af6dfda1bb51d72e42d73d00d26594f09326be1
SHA5124b671f48e45fdedf50c7f7bb6c8d82a3b98f7502006eb002aaf8ff31f25f9ff1257c7bcc12caf622e43d4ec665b19d978ae3e3762f76def0bc71485ebdb8426f
-
C:\Program Files\Malwarebytes\Anti-Malware\Actions.dllFilesize
5.0MB
MD51eff53d95ecaf6bbfffe80d866d8e1dd
SHA1d7ef7d7c77fd04b2c0eb8c16bb3cd08057f6742f
SHA2566dd748f7ca56125cbe158fa3612f08e7312ef58ad5375e6b7ab5532cc16ca0ac
SHA512c59b8e6f0b238a247e64b9c7bb42213dadac1dada63542830a6292361174c935c0c662b2d1aed3fb6100cc4993297b1eaf25e328f2b4613458c4ffca63b9f02d
-
C:\Program Files\Malwarebytes\Anti-Malware\ActionsShim.dllFilesize
2.5MB
MD558149edf4990067b4c1ffe1c32a51a01
SHA180c0c8b8def45420159659d2eaad181eb0b05c40
SHA25667af73f9b49ce113d02d7f2824e45d48044273772c94e6e8c300cf86bf83cb55
SHA512fe69f4eccaa35b132b7dfc77fae50733398cfa5ab7377f502a50e1bb83be6b81fad26a0a24f6dfbc99dca6e118784f3452edc4a30c11ac161fc0db62b039cb4e
-
C:\Program Files\Malwarebytes\Anti-Malware\CleanControllerImpl.dllFilesize
6.9MB
MD573a08c403bf08e39bd560ffc74ae9b8f
SHA1888c6d11e6788875f8fca748b6f92a19b6126dc6
SHA25609d687c0164a9f108c4f9e107bfc0cb671ebe643ac9aae968cb8df0e5adda960
SHA5128b65c0549c319e9c42b30071b1342e8ba4239d9dc4a124e19abd2160339c03235f0ec534a997ec367f2b474797d33efa496e641c7a63904bf8e0af43a32f1535
-
C:\Program Files\Malwarebytes\Anti-Malware\CloudControllerImpl.dllFilesize
4.8MB
MD5a22f4dd3f75413faba618de10315540d
SHA1450a9abff68ffb922abaa0ba193ea4ffc983e92b
SHA25631d628b6c6c58d76dbd8071e155c9bfef575444d3ce7fa83c2a0c3a16e67e7ea
SHA512b34bec558e556dc8602717fc8b2601f18d02217551bcb1b3d7df7f9574f7ddf46a29dcfe043119f353e1e258fdc1e9a6db6d38ce8e5f3eda9fdb92216a31ccd6
-
C:\Program Files\Malwarebytes\Anti-Malware\LicenseControllerImpl.dllFilesize
4.4MB
MD549a840f316fe0e63dbbf8789eac84557
SHA1aa8eeb9f12b345f42eb04353201b53543cc7b952
SHA25656b3c7e59854dc2f7a33b88f42b98d164686cc92335cf5b77e8fd60cbb84c64c
SHA512ba1b9ce3910b94764f755f5ee2ae0ef6f2dee4cbea97dc261b0ebb7f510f8bcf40b6fecedd3115e35255268bddaea1eddea1952bdaff227eae2f50b40977bd71
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exeFilesize
8.7MB
MD58bef3a6b497bbcf342ecab2c77de8eca
SHA1539e60105055106614821e7e073f777d07805e68
SHA256273c0ccc5bca9382b62c8478f56a8f33e83a745dda8a9553b4a560171b3772dd
SHA5122cc83be7bb01ad1fcd49db5fc69b6a51e8c486f45da5f7ba0bf322134a8a3d0fa3402a7c05b0e866da27f7234f7574be7cb46dca559aa4e3899879d501b2d046
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exeFilesize
8.7MB
MD58bef3a6b497bbcf342ecab2c77de8eca
SHA1539e60105055106614821e7e073f777d07805e68
SHA256273c0ccc5bca9382b62c8478f56a8f33e83a745dda8a9553b4a560171b3772dd
SHA5122cc83be7bb01ad1fcd49db5fc69b6a51e8c486f45da5f7ba0bf322134a8a3d0fa3402a7c05b0e866da27f7234f7574be7cb46dca559aa4e3899879d501b2d046
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exeFilesize
8.9MB
MD52d5f7e54f0678f45e8d07b4ab1f32a2e
SHA18db3e26e974b1098f8c9a7c7be8a770394d243cb
SHA25643676ff9573b8d29fb3f46c0e4381009eba37dec0ecb053aaec424e60a4eef29
SHA512ef7009d8269a29e1ce5e542ef9305dbe702b9778b13ba483b0efea01b19b013c899d3528154047f4fa13b2393972b0c091d2eab02eea0b252fc80d152d1d608c
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exeFilesize
8.9MB
MD52d5f7e54f0678f45e8d07b4ab1f32a2e
SHA18db3e26e974b1098f8c9a7c7be8a770394d243cb
SHA25643676ff9573b8d29fb3f46c0e4381009eba37dec0ecb053aaec424e60a4eef29
SHA512ef7009d8269a29e1ce5e542ef9305dbe702b9778b13ba483b0efea01b19b013c899d3528154047f4fa13b2393972b0c091d2eab02eea0b252fc80d152d1d608c
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exeFilesize
8.9MB
MD52d5f7e54f0678f45e8d07b4ab1f32a2e
SHA18db3e26e974b1098f8c9a7c7be8a770394d243cb
SHA25643676ff9573b8d29fb3f46c0e4381009eba37dec0ecb053aaec424e60a4eef29
SHA512ef7009d8269a29e1ce5e542ef9305dbe702b9778b13ba483b0efea01b19b013c899d3528154047f4fa13b2393972b0c091d2eab02eea0b252fc80d152d1d608c
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMShim.dllFilesize
3.0MB
MD5f44b6c80c46c4cf3071b5f5b916e1271
SHA1839f2238ecbbfa80ebf9c1f77eafc78204b58761
SHA256732523df43358729d5e85cceb557d69016dcdd3e2238d903c33c5327c3131fae
SHA51299be164ae96bc4f93dc896d5df445ad1c2f023f10605a8c9857d7ebedfc5b070f50cd33b401d61003e601a06b8446e6c0b5dbddda4927a2e1352407d3b266942
-
C:\Program Files\Malwarebytes\Anti-Malware\MbamElam.catFilesize
10KB
MD560608328775d6acf03eaab38407e5b7c
SHA19f63644893517286753f63ad6d01bc8bfacf79b1
SHA2563ed5a1668713ef80c2b5599b599f1434ad6648999f335cf69757ea3183c70c59
SHA5129f65212121b8a5d1a0625c3baa14ef04a33b091d26f543324333e38dcdb903e02ccc4d009e22c2e85d2f61d954e0b994c2896e52f685003a6ef34758f8a650c7
-
C:\Program Files\Malwarebytes\Anti-Malware\MbamElam.infFilesize
2KB
MD5c481ad4dd1d91860335787aa61177932
SHA181633414c5bf5832a8584fb0740bc09596b9b66d
SHA256793626d240fd8eefc81b78a57c8dfe12ea247889b6f07918e9fd32a7411aa1c3
SHA512d292e028936412f07264837d4a321ecfa2f5754d4048c8bcf774a0e076e535b361c411301558609d64c71c1ce9b19e6041efa44d201237a7010c553751e1e830
-
C:\Program Files\Malwarebytes\Anti-Malware\MbamElam.sysFilesize
20KB
MD59e77c51e14fa9a323ee1635dc74ecc07
SHA1a78bde0bd73260ce7af9cdc441af9db54d1637c2
SHA256b5619d758ae6a65c1663f065e53e6b68a00511e7d7accb3e07ed94bfd0b1ede0
SHA512a12ccf92bead694f5d3cba7ff7e731a2f862198efc338efc7f33a882fe0eb7499fb3fb533538d0a823e80631a7ca162962fbdfd78e401e3255672910b7140186
-
C:\Program Files\Malwarebytes\Anti-Malware\PoliciesControllerImpl.dllFilesize
4.0MB
MD5efe6216931bca54ccf05a0bcb9f83fb9
SHA1007d0a3c4d850cd9b2886b24daf91c988d702bdd
SHA256eaf71519b965b9530e84be08bd3649fdb8feeeabb8dd2455be95755a336a44d6
SHA5127c59071b6ae8d0a2d6eedcb58f6a1337aa340275bf30baa121f515241aba822f6f7bbbc53b626f5f44c424af70aef3afc582a1a8a34d0b0adef115d0e8f684f4
-
C:\Program Files\Malwarebytes\Anti-Malware\ScanControllerImpl.dllFilesize
5.7MB
MD51ff50d44fcb92f99dd7af478171e8b18
SHA1a4d3b41df2173d8363ef99d2cea92cff8ff60338
SHA256118841f1c274e8dfd94fc6a31f4f2c10df38a71d0fa96c1f3f6453339e20bf02
SHA512f7df13e47f88cf77797a153cab5aea17d03bd9a9aebd2fa64d49175d3fc820604ba7ce9d43081624dd660fca5bf42eda2ff1309c018bc4ff7e4fd982e14650b1
-
C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.jsonFilesize
592B
MD55a609696be37b5b2e2a13a4678b66eb7
SHA169105cc113e27dfe554757da2b46e5fe3b4615f9
SHA25633312531b1b146c57c775fc181ea7b6da74111271319921c0d07fade2e11d69e
SHA512bd8dd0c14a140f280f68f8c5aeee6c200f7a64b311ed2402c8bb4d6b45143912c481065ac63668fd28fd1c472c6e6f4b6c74434a14dd5072235d6e749a595ff0
-
C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.jsonFilesize
592B
MD55a609696be37b5b2e2a13a4678b66eb7
SHA169105cc113e27dfe554757da2b46e5fe3b4615f9
SHA25633312531b1b146c57c775fc181ea7b6da74111271319921c0d07fade2e11d69e
SHA512bd8dd0c14a140f280f68f8c5aeee6c200f7a64b311ed2402c8bb4d6b45143912c481065ac63668fd28fd1c472c6e6f4b6c74434a14dd5072235d6e749a595ff0
-
C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.jsonFilesize
654B
MD56958cc9c6cd858287cdbb0a440ed5122
SHA1af9bd22b9e1b91d3b39112ff50b86e2098e97f95
SHA25662f25464c4d74b243198b4b6cbe0c9b6d55faafbab97efd1ed1293fd48508645
SHA512dc1129bc638f58e4c716d5ff9aefca41f21cf2b9d019aca21c61cf69c7c171c94abe07abb11d95c0d7baa68366167e0b8fe75d7c566c06fd7dadab401101a015
-
C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.json.bakFilesize
592B
MD55a609696be37b5b2e2a13a4678b66eb7
SHA169105cc113e27dfe554757da2b46e5fe3b4615f9
SHA25633312531b1b146c57c775fc181ea7b6da74111271319921c0d07fade2e11d69e
SHA512bd8dd0c14a140f280f68f8c5aeee6c200f7a64b311ed2402c8bb4d6b45143912c481065ac63668fd28fd1c472c6e6f4b6c74434a14dd5072235d6e749a595ff0
-
C:\Program Files\Malwarebytes\Anti-Malware\Swissarmy.dllFilesize
4.0MB
MD53486801ce1e8ffc1bbc6d4f097b0f369
SHA108f2a85cd07cf1c0d6f27f0d5e7179c2a5cb8600
SHA25626720d0b669898089a4ab5a6c53203918ec399d227331273ba11169bbe273678
SHA51281974a79bf4e4086549874ef778e7716713a0107ccce212e9564f3355a26670943845aaba744691d2b68224e06e2f9d9a263e29f4ca7e46e1bfdb507a24656d5
-
C:\Program Files\Malwarebytes\Anti-Malware\SwissarmyShim.dllFilesize
2.6MB
MD589a38afcfa758e3298609c6c51929593
SHA12df1ee30adc92bd995526e41fd9c823354de30b4
SHA2564795576483af0c136a71dcee87a0ffb54f0869cae6395ac2ff8312bf555e7161
SHA512cceaed0b9a7517aebd739a377c7bd8987b9ac357be2bf987dbae31d59f2121c5bb9a9bfa2c70a9a54ad65546ef23903176dd6328d93408cb5c991257d59e2717
-
C:\Program Files\Malwarebytes\Anti-Malware\TelemetryControllerImpl.dllFilesize
5.3MB
MD51692937ebb8172814cfd1b2d20dac8c6
SHA13ad3b0dce9958ce66d89c280645ae827d3b89f16
SHA256f1cee1b89fff12181d828623b3aba0f0b8c0aed4aab8b0c017ea4d4731c16e32
SHA512a36462731990635f57f80c070cb01a8c4fe6fa445aad63f077197d473d0d625e23bcadaf5bf92c9504919ee69d12239a7733febf27d6016aa20c03f631b7e3e8
-
C:\Program Files\Malwarebytes\Anti-Malware\UpdateControllerImpl.dllFilesize
4.4MB
MD57cf80cf9c1b9eced61792c17af5db7a8
SHA138ccd9e00badc2f3efc904e55a654be3c8f683bf
SHA2568c838fcd980d39c61a3e1b7dd93565a05041fbeea2ac3c759f10dbe82bf2a973
SHA512ca7c774b2dab671959f81056982b7e228e4c371a78afaa4e92dbebf2b519227e36e25ec60b4633383dd2d47dc9490ff9ac6740b80687cd8cd69a29a0e3d0ffcb
-
C:\Program Files\Malwarebytes\Anti-Malware\ctlrvers.datFilesize
8B
MD5744835d3f789503e0e56814f21c47f34
SHA1220c0f8e94d6002f754febdcd19c96e9b3fea3ef
SHA256fbfe76f223c948958377a707aa41126a449639e43b0de63ba787d2f8912bf5fb
SHA512748822599275931f5394fe2db05ca7e51f9220fc7f104ea372198a6370469b680ef273adef7e09bb04be458e80f440e8c57067cee7afb62ccdd1f54576354f01
-
C:\Program Files\Malwarebytes\Anti-Malware\mb4uns.exeFilesize
3.8MB
MD563d54fe94ae4e44835d726056fb83f43
SHA1f2284e079ae50d7a5362876d7c16192d6cecdfac
SHA2568f2c2bf8c3b33876fb028be01f8215c9cb07e59abb4d20f5cdb21f380fcea406
SHA51258f8f28c3e861e3aa235128a2b7d9f4e2faf5d87f510906b4e192a3ac5762aedb35b23141a53f4f01e2b5316c61b00e4cd46433eee5badd29f70f029eea52b09
-
C:\Program Files\Malwarebytes\Anti-Malware\mbam.exeFilesize
23.0MB
MD56365dc2ddbeb5842be33bdab30bf1421
SHA15f2767a411b9acf51b27dff68fff3a6598371a55
SHA256a6216185a12b14f73854b3443263726226614bf5b47283f9a3f3109308469d19
SHA512d6a8006784e19b49f2a4aa4342ca5ae14d844cc1ee7031fc466dc7498675ad625ac1e0556239322289a7a2bbb3d597f470336eed36313446ca574890a4506859
-
C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dllFilesize
2.7MB
MD5b7e5071b317550d93258f7e1e13e7b6f
SHA12d08d78a5c29cf724bc523530d1a9014642bbc60
SHA256467de01d7cee7ec54166b80658ff22f9feebdb1c24eaf1629cf40e4124508064
SHA5129c35293c95c1a9141740ac99315605964aa37c4a42d3a11cae9e5649ff1427a9480d3d5e7f763212cf13db3511c5ea3c84e68f95f0067fe6339a9d3fb7b27c54
-
C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dllFilesize
2.7MB
MD5b7e5071b317550d93258f7e1e13e7b6f
SHA12d08d78a5c29cf724bc523530d1a9014642bbc60
SHA256467de01d7cee7ec54166b80658ff22f9feebdb1c24eaf1629cf40e4124508064
SHA5129c35293c95c1a9141740ac99315605964aa37c4a42d3a11cae9e5649ff1427a9480d3d5e7f763212cf13db3511c5ea3c84e68f95f0067fe6339a9d3fb7b27c54
-
C:\Program Files\Malwarebytes\Anti-Malware\offreg.dllFilesize
114KB
MD516663d125398773a90d0a53333b7cf5e
SHA1f92928ae3c9292588547ceaca1cb1d372bfd7936
SHA25638e6811b47262101759aa51a631263d9e3eee5d211164318a751e078afec4cbc
SHA512091764b8ad80aa31eea0bbd91ee505ebdea2654bc8aeaa3081a061d0d37ab13d27dd203075fd0de10c6687591aa0e36139a38af846c4e34e6aa67ab81dc277df
-
C:\Program Files\Malwarebytes\Anti-Malware\offreg.dllFilesize
114KB
MD516663d125398773a90d0a53333b7cf5e
SHA1f92928ae3c9292588547ceaca1cb1d372bfd7936
SHA25638e6811b47262101759aa51a631263d9e3eee5d211164318a751e078afec4cbc
SHA512091764b8ad80aa31eea0bbd91ee505ebdea2654bc8aeaa3081a061d0d37ab13d27dd203075fd0de10c6687591aa0e36139a38af846c4e34e6aa67ab81dc277df
-
C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.sysFilesize
233KB
MD51dc6d344ee9b6b024ba23278891db9a5
SHA1519b792d11daa2bf9d127f69cdd603a236576e04
SHA256823e1c7321e177b006c1f3fd1ec8b99607a12d2c3c321f3a6cbbcf7030b6c240
SHA512fb96c4ede03c3aa729d2ea5a72c5f14029f6d69a79b6e0d5449e371bf3acdbbd1cb2079e8bbac3a3140a257c71018bc7a2a31a45ad5c8b65382e67cc3431ab6a
-
C:\Program Files\Malwarebytes\Anti-Malware\sdk\farflt.sysFilesize
195KB
MD5d738a028dcfb7d1cf97e9fb11e306db7
SHA177f4d6a79e1f2754a2e93095158d0edfb9a6a5eb
SHA2568f38d2a0a8e306de910bb621cab4276520aed84645de942538d0a9c792dd0074
SHA512c753a13767c8460823851a144a2a9162168a1099664ba601d0a929d539ee15d78123ffd86cb6225f0d7e6f52f40b2c444705da8bcc1292bb6c9757732b82ad94
-
C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.catFilesize
11KB
MD53be83dc1528c749dd2649ef1c5e5ee14
SHA15dac1b7fd1abd193c3f32dbe567d0448f8a3a2e7
SHA25609ee49b623f120d09e3ee825fb13633af9f915f6b6c33b9d6dae75fb93e4f98e
SHA51201bcc8aafe7fb618b9dae83ae477a31dfa07fd62c6c876037ed8ecaabce9fcd5b0cc27e5f938374031752f82021d1020158f6184645eb7624c7a730b8c92dd5c
-
C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.infFilesize
3KB
MD5e5bb98e4d7adf79cf7355aeb4a12d3c4
SHA1c2996909b98b95863d54c6a2f7843e5c05015596
SHA2561f2ec66c3947802dd97abead84d71bacebf84e4a2e871852cf5291958d45a189
SHA512f65ec684a21481c66f4571fec4f5cd17fb629fbc4b5fda88bfe00ada30573f3c74313311f5e8a164709824b8033a60fa2ae0f1643d0ee3ba8ae4fd558709aa7f
-
C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.sysFilesize
217KB
MD5e7431acb551d8271bd63387f05d2a8a3
SHA1baeec0e03df81dcb32bf0cdae0f0cc8aae237047
SHA2566f8e1892f8b94d56208d3b0947ae26ec1485b0aa02908ece75b38d04818fc905
SHA5128ef8f795309be7f9a2a9377a99e90620de2e377bdf631e3174cbe6f61489d0380dbf0e4a1dcef08026142628cb6ead37fcaabe25a39b8eb730e01fac89e21aca
-
C:\Program Files\Malwarebytes\Anti-Malware\sdk\mwac.sysFilesize
177KB
MD52152a9aba3407e2cfcaa84e4c20423a2
SHA1825e79fe98922ac978aee92e243aec0ab44ddd91
SHA256a7d456c7679717500c4a8968a9ea205107dd6e72c81ba1435777af2bd3bd95d3
SHA51232c1d5f1ba553848213353a2f39b9971c7ac6818390b1a00d6b23335be8f542665d4ed60202e7ca04a1976141881515833665782cdfa8f69fcb3ef0abfd4f37a
-
C:\Program Files\Malwarebytes\Anti-Malware\srvversion.datFilesize
9B
MD5b2ebbf312e51e94c1f2e1db0e1d94a66
SHA173cabdd280d671cb23dc8ee8eadfaec235d1390f
SHA2564805dab34c1460283a5a87e3b0d504ab758c10875b261ac1ffdf46d6d1062f1a
SHA5128e7c2de734eab1c690164da2d110b033db6330bfb6b3464d17c291c9058571817059debff01c716a2d3358a11f82efbe10236cd34e33316296c002de0c1c1a01
-
C:\Program Files\Malwarebytes\Anti-Malware\uipkgver.datFilesize
6B
MD574c6677020fc6b6c867aab117078bf5f
SHA18c46db37dc0b39eb963d4144539c8b591e122400
SHA256cdbb9bc874d71e154c71b68b1fe959913d286036dac11e226e5620c919ba9708
SHA5123f9db8d9bb25322f8d8e750750bf92dbe6ac63d686eced65cddfcd61178cf0e947118a491058414d4d2cbb4892e39815565669aee0dfdda23aece72d278292d0
-
C:\Program Files\Malwarebytes\Anti-Malware\version.datFilesize
47B
MD51b88e92ceab1b56dd4ca6f82ace32cb7
SHA17a88ef591641f2186a3d46b25fbe4a56223c243a
SHA2560dc096662f705de8bddebd7f1a6412efe213d06f476167a27fe441b2fda31e37
SHA5127ddff716f8edd2e23b66bef4b771e457776d24e43581d83638015565f1797afdc8f7a3e3ef013f986a38a229d1468d1ca556b1dd6740e996b6a9ffea1d11f1c8
-
C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.jsonFilesize
47KB
MD564de110267891bb2461c12475d90092a
SHA176ee9f5326e1af5d82afa84c22fa56410b1ec4b0
SHA256c39cc9ed442b513a8425922ccfe3e6269143e6dcfe51be1bade91da98e86e7fb
SHA512d9a5170a865f6599dbd0123eeaa9d8ee6be162bea29cb0aac36665a1a47196e2a5447ebf1273fa524c892f9d5b3dee592695db2ebede1064e3099ff4cc4d86ee
-
C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.jsonFilesize
64KB
MD572ad2453780d5e3e604a7b25c3a1b653
SHA10dbe88e7e0aaceaf2c5b90242fd606aec4087358
SHA2564ed1291a915d4ab584ed879e8e277af3adc75331dea3d89ff032270210e5dc7e
SHA512df2cb848a10049a6d745ac99ecb5a8c1f4c526ea92b7c9b4265cbc91e9f629ab1e566c9fac9780a4b78412934a27e674b9ed4e429d244eacfc6a555e210daa6c
-
C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.jsonFilesize
64KB
MD5d3ba44aae802c8332f91ef6a29bb9160
SHA121bd70f6a46e90633b882e2a4c0b1f8fd802e0e3
SHA256f67a401339ee150e2b4b5ae37781fcdee792db802e3b9243302c67e7ec632cd4
SHA512006dc19558e2a8b23c5de2fa1e5f9e1172acd9411e44182bd11139037fde0457a5103928992f2f20a9fed1a3e7debfb372b53e3aee8b444837d7fbe607266bac
-
C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.jsonFilesize
87KB
MD5b34443830134d117a22c038aef3a5e23
SHA177235789125540e074ec7e26e6961f5db265799c
SHA2569a5849ff1f3df137dc5fa3a1b0f84a0d595ea515190d600d75332c61f3cb9114
SHA51232b87005a631029b7f00b6151d910d18f3c900970029690234aeb4c0692d69cfacab59306ccf7c5021c822da6940888445d65fe0f3860e02e70c69002bd51de8
-
C:\ProgramData\Malwarebytes\MBAMService\config\ArwControllerConfig.jsonFilesize
607B
MD5e9e8913ea6c37764d1f4aa25d46635c8
SHA1feb00bb8432b175bacbfb5d55420729003ae0971
SHA256fa44f681e64b4a6cedc36e879aadab15b495429a2e4e14341a1be19e1052c021
SHA51202a14131354459ba39aa87164776e9fc721c25b6a67472a0761406da65fe5ceda85a554d000e2f156267dd6aba52f6df5a998ba14fb8de31df73a2ee1b041cf9
-
C:\ProgramData\Malwarebytes\MBAMService\config\ArwControllerConfig.jsonFilesize
608B
MD5cdacd63249df0db3b2cddeeed81cd741
SHA14857e069f5e7b0b3ec2bdeb81c22499dffd79e53
SHA256b8066afb0a8837a9edd4c42a3d51913cd2947c94f2e8c8aeff77a23f764b10a0
SHA512689699f88465ae920edf60319f3814e870f340b3185d242d19b4358290fe9cb46304fc315c257ee322cc36899f180f82fda476562a275752f5f49372b28e491c
-
C:\ProgramData\Malwarebytes\MBAMService\config\CleanControllerConfig.jsonFilesize
847B
MD5451ba87c01a02e64a7a2519011e9fe51
SHA17cf929221e579098b2da280ddc696027387a5183
SHA256c8dc577096e7e1500fb66ce37121efcd39027bfe68cfa94c1a11461646599cb7
SHA512945ee01b76e5fa848c8c2e4070c926ffd71401ec2eba834f36edbe9fe65e8f863d94187774abaec9f98ed114c413958177dd0b434dc3555faeaac54236368fad
-
C:\ProgramData\Malwarebytes\MBAMService\config\CloudConfig.jsonFilesize
791B
MD53af4deade766eab7f0f2167a41c35977
SHA1cec7d3a7577fdbc523675fdf9f54923bb75b30c1
SHA2567bcaa0a360aaead9554d65d93b46b87acf119dec3ed599ee632b2c3f814b5ff2
SHA51288fe935c1b1490da4b8588b4b095cc0cf1e1c20bd80cf3c5d578057210eda5192b886386f29380682ecfc5c0a6aef3ab70139ebb856afc72bd709c061b359920
-
C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.jsonFilesize
14KB
MD58433fd871764284c1b89c51e714d3a5d
SHA1b40fa0ae1a8d70c75b3c020b5bf093d366b6cc61
SHA2560d628223a2f71263ab6f97c1e24d9ca78df196fd9f93fbd7717d9e81abbe9025
SHA512fad4ccfbbbae7e45e549261d23519ece7397fdaba8bd2b8b3657f468506c6db1f7315e21e7c75f7e815d603007e50de51c50dedd950b773eef57db81cd0c1685
-
C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.jsonFilesize
14KB
MD5d06e0e4ce3dcdfbe59c222fc6c41d232
SHA1d83f3494d237cebfb68dc10503587b96aad480c6
SHA2560d685371773820d77aa3588eec00f28cd415e0b555779be7fd071ea0e2234ac7
SHA512e2c2ce93bfe515ecfaa5ed8319337f89b55f6e15afca4f1edc85719b96747dc471dc7378fb1b0daf248d7fdc101c1b7ff00c46850a3bbbdac3ee20b2e39ff0af
-
C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.jsonFilesize
14KB
MD586f9bd5de9d8288ac6556187831adb03
SHA159d3bb3eec459c76b9ec78a4ed127158573eb6b3
SHA2566abf08a7b06cd29e027d0e201f77b4566c7cd463454c177e8da549d8ab392cd7
SHA512e06143d20a71bdbf4ce30e5acad98ea5f1ef64fe474a6806977e81056a425706dfdca20b445a131f8bfbdf3a73afc574d675a9bb620eacc5598106d605a83e33
-
C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.jsonFilesize
14KB
MD589cc9001d26ab7a48af182ee4d6378e2
SHA1c195e2a82878e8c5985c67e722fe56bb8aa23f5a
SHA2564b6980f58d41a585bfe6b890510dc82fccde2ad6cba4d058294e7f759135b076
SHA51224c2f71c61d5c857b6eba0bfe71a642413265cef87c9fff00469582495d640fb5e2661b1b8feb7e06381a8b4f85a3ebd75e891ed5a253f06c56d9402b3d89543
-
C:\ProgramData\Malwarebytes\MBAMService\config\MwacControllerConfig.jsonFilesize
1KB
MD5b7ca4b0006bcf57231848807b28b3f95
SHA1e2e3710b460cb95dc6ef75ec74e2cb7823320e79
SHA25606a02a09426aaf910d621267f0a8473803f0f4d8cc34845af396ba19132c174b
SHA5129339f210f45d0ba7dc54f2c7c1b367d01d778be77368d3dc43f95e55cd21a13ce484daabe4ed9462e6dcac0ca1555538e9f0427b552b655f92ac1f18e37bbff0
-
C:\ProgramData\Malwarebytes\MBAMService\config\MwacControllerConfig.jsonFilesize
2KB
MD53601e9b0232dde557c67e9746a9c48f8
SHA12eaed5486481c2a3f25c292e3e54652ccc9b9d8d
SHA256d0770f647a3e7048eeac122d4cd2e346885c9f0c7529b7dd60624dcba9fb3b0c
SHA512bf7c264a748de2e379b51f204717543dd96c9aea18bfd0fc55a834645a3d0b95e7b6c7c38e21560d7b1f83ded26e86d76bc346c1af1b61e69b203adb1042d9e1
-
C:\ProgramData\Malwarebytes\MBAMService\config\PoliciesConfig.jsonFilesize
903B
MD5ed368591870d9ac696231b94656149ba
SHA1da89e03e066fd8ebde69402276bb50ac9f2696cc
SHA256b09a2d5323154ff1b27098b1f2780ea934dfd07703f5a9f6ccf2de7b5d36bb00
SHA512fb7f08111364faa2714d741b5516aea76a5bce057488f1df337d29b908dc40a5b58377efb5c633b8144cc2aacdcdf4f67cd244e0783e194b1144aac749bca6d9
-
C:\ProgramData\Malwarebytes\MBAMService\config\RtpConfig.jsonFilesize
1KB
MD55c81293d3e8b29719ddb118571cb23a2
SHA1ac0ec4406f93ae0a899756ccef8d4cb861a70354
SHA25644b06ae7644a480811b0d2e2ce382785ce0a9d02b73c166667dd3537334ace77
SHA512d5167d24c37e8937499e8d8a5be71bfffa2e5b8b45e93ae2c49968509e4030acae77839cdab3426f5dc5d99f26261128a670794561b9b03dd8caa8c7a505b899
-
C:\ProgramData\Malwarebytes\MBAMService\config\RtpConfig.jsonFilesize
1KB
MD538f4f969898b8739cca013431fbd212a
SHA1b3779368e6a273412845eed101f4bd5d2b9150a5
SHA256a74b1f834cf56d2c72d3d9c3aaa9e065de7e004c9a299ed5beed0278e80ad1f1
SHA512ff90a98fea507087a6f1d889efe47bb9e7d4aef797578dca774f2e5ebd75109021c6d729de503a8502602858d8b76d67aeb0e9faa74fa95f99ca3e6a5fc510ca
-
C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.jsonFilesize
4KB
MD53411c6377ed1f2162fedb367e8020202
SHA1b8cd8bd16b779248c35c47e1304ea34c53885d8f
SHA256e602d518e564fb9800602d2e373ce976f7247d698479e4151f22f6a88dc01d2c
SHA512277f448580affd24cd9a8a676806431255b04f0089f565b88fd09c83cb9901619a1cff354d3573066a74bf5a1b544f4a4cdbf79b5c6d888be7c982f31be48790
-
C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.jsonFilesize
7KB
MD57577c19d3a80a77e143518bd3e20c8da
SHA11351f1e6cfad95e70ff12955eb6ecef0212116eb
SHA25670c105ba39af2fb277cd17d9245693982c3552fde1a1d64788fbe8a9f77456e9
SHA5129ecef16d840bcc7851907ea7e0e6bde799471f03589e20d1f7f779cbe2d3952bee86dd5a896babf0ea4cfdee68581158c402d94763ba8f7676b7635e93f5ce3b
-
C:\ProgramData\Malwarebytes\MBAMService\config\SpConfigFile.jsonFilesize
10KB
MD5158772f276cbcc4a08ba9460f53e6b51
SHA1157233581d8524460182b9c8193f2d5ad88090b1
SHA256b8a285aec2b91536d732c7580972df7d28743dad9ded95a330ad28eb9b5a3c1d
SHA512317fd88c48ff9bc6e7ff85620e0f5ca106b91f90a8bbc513a1a3a785bf27ddac0f2891422e1e691c9944198d11e1cc7f2710d3713c6ff887f3b70d4d5deff19e
-
C:\ProgramData\Malwarebytes\MBAMService\config\SpConfigFile.jsonFilesize
10KB
MD58433af28547e994a0645cada273c482c
SHA11a7a9f47756a5842da02d623551af34713489542
SHA2567f274bfa4cedb4d6ceedfd7a5b50f1124034656c811ab2f3f1d2db0199432e6d
SHA512d511610048625cc2f743ccb78816adafaccd75aa8cd2543cd79a6483983e842906c9cf7e831d2330d10ce64194b7c6fdce81ce7dc34418f39fe83ff180f6c32e
-
C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.jsonFilesize
1KB
MD5eed086e8f42c2423265569c2798e43d5
SHA1f87d6f89a6843e6bbe139b9de7e2826bd2e10ee9
SHA256525b2dbe01784dc364ce73162a82870d3345e3d401a7956fb55582be4b1f8f31
SHA512afdeb4b967ae2d2c2ad337cd18097a2113d0dd09534676cd5643a09eca4cf2690988e658a78a4559b51e9bedf9b6c8a1d73681fdd900d0861e359abbfc5f20aa
-
C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.jsonFilesize
1KB
MD5d1518390b79d5b17cff862401589f533
SHA1a84dca1da2b7b6fb9ef7b1a29408a227b95b45df
SHA2567d304912db2a007bb2f0e325740272f89b3150f1b3d90aa0cc5b0c53fee1a3f8
SHA512ed6fea9131a97fd9479dac5ab9cb97ecba3c592ad01a1c76fee45a27959c9d21e7f57a7315c999f69bfd28cb03543502c3ec7f8eabdc34bb39ef88c6ac2eef8c
-
C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.jsonFilesize
1KB
MD50b3f6132243fa16bd8cf050dfdbc044d
SHA1379beff8bb67de203a93680aa739a74021f2dfd9
SHA256f486b936ed9389b7936066213fe55b999b2c2bb04f55f5da715865ab7d2354f2
SHA512feec11e522022547b1910d4371dd33a5366230ab99ed08fffc67611c83c7f33d9d3c2488334abdfe9ecb7752de02e08dc58dcb97a61b0249257b3ba264607a07
-
C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.jsonFilesize
1KB
MD5027cb1f1ae76292afb4fcadf156c384f
SHA1cbd2e4d544bdfdeef784d6cfd4637661b938d31d
SHA256117909ea7d5c9885947bf4393252a5a8995af41672fd685821ad1d351b3ba617
SHA512361eb5312337aee6e0a64385164bdd9082b1bc70531cfcaa8d7fe2fd232c86edaaa70d4757d22f9a87a7ba6fcb8d1f3d9ceaf7c77dc18a99987ec4c6e50a5272
-
C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.jsonFilesize
1KB
MD5760fc58947b99e7a5091e38d8bbe138e
SHA13248e7312765d200fda2ba74ac5bf7b3b87e498b
SHA2560899068497fa71515f792c2092e1f7388a354b27ccf6aac2a7ebd644f9e0f3ae
SHA512c81ea56dab47f939b9981fda669823dcdb7876f9aaf426baff8da9a85128d00791d9ca8397deb94674b6a658b8d1ae8818dbfd6aeea21e0a796f5c91c9b074fc
-
C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.jsonFilesize
1KB
MD5dbded6ed2cb6f8c8977bb61749ee0cc5
SHA120c988c8914855233b2f15b8deabd95b8d48c224
SHA256e26efbbc5e84369df1520f1571a8ace76b5d31ab1e760cfe2bfddf2f87adcade
SHA51208105bed2b257832334e47f4f948a57b8657bbfbcacb0ef150f79119de1c5279746c5316b442a141322160ef421e9beef0c1628f78e3018099b401de537a2f8d
-
C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.jsonFilesize
1KB
MD51c9b1ca92ddeff787e40ede6d2cc5d26
SHA12a56b72bed278b0e69d64beeb072fa505ff1f346
SHA256aa821208b9f266d39bab1518357365d1679579aed77337944532b0948620bd61
SHA512369683df278717dbb252fe78b21ac6a0d9671dd87cf04f3d6378d44926908c56f7639a0de3081fe3b3025a158dd31e41d2febe498974d06e40ced3e50d298ceb
-
C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.jsonFilesize
1KB
MD5a4d29ec80a202b253ff9130cc24fb260
SHA12321abc1a9aa540e9418b88e27c67f8338a6360d
SHA2569899a1c47fffb9c20bcf5765aa6fb71b6f408dde03322ee7ad74906d07e9a781
SHA51272c4cd29e73b90dbd844572cd47dc644067bf8abd52eaf21d9c7ff2b614b08f9ec6a56477ad24d000715c45da41672feb9fb320aa5c1a01a9dd404ced4edaaf2
-
C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.jsonFilesize
1KB
MD57dd7ca8f965e93fa10c5a5d0d7ee36a5
SHA1f471edd67fd3bb3d866e5aa1c83d6e12cf3c8190
SHA25603a147e1d948d5d17b626e0216b96778a6d31f816408d8d1fe4e9523583faa9c
SHA5126ff8452f7f18a1301a94c9ea86cd31ab7681a40d7f7f9f45e19f2e43e488b56b363a6bbe6f475537c27564e84a740b409fd978dde6c807ca32db30774dc3b0d5
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\Actions.dllFilesize
5.0MB
MD51eff53d95ecaf6bbfffe80d866d8e1dd
SHA1d7ef7d7c77fd04b2c0eb8c16bb3cd08057f6742f
SHA2566dd748f7ca56125cbe158fa3612f08e7312ef58ad5375e6b7ab5532cc16ca0ac
SHA512c59b8e6f0b238a247e64b9c7bb42213dadac1dada63542830a6292361174c935c0c662b2d1aed3fb6100cc4993297b1eaf25e328f2b4613458c4ffca63b9f02d
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\BrowserSDKDLL.dllFilesize
5.8MB
MD51ed53171d00f440f29a12f9beb84dac4
SHA14d9a1e3579b0999f1ab2fa818b588411e9ee920c
SHA256e659e687a872050f9e65d78992d16bd9b393cf3f8e8c94e0e15fb42b7065327e
SHA51217161cfc672d1b996b8af4ebac17f9a8a3807f38c9a23e2e5b4dadcd9a21c3a64faec9bf59147022a9df88b80f89300f1b537091289bd7a42806bd206a317e6e
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\Global.nmFilesize
336KB
MD5de2e430b3d52a488b4708f8ae8d7f6e9
SHA1bc363a4c751138517d74cbee1cb2c0d6f27fd1c7
SHA25640155bc90aef9ce87a9afed668713756ea65e39d40fe62dc5701161394ec4e1a
SHA5126ba166b7ceb990e92a799b33bdca68c7b0bf91055496f750c562d5ea345e8c77101df75f84dcd3976975c6ee960a8b8c87419463e40bf7d00c8578b16257fccc
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\Global.srFilesize
16.2MB
MD5d71078790223e7ba2751a2c8936629dd
SHA120dcdb964e46cddcfee865230009cdd6401d8ac4
SHA25627e867106e5d38e8823f388063ef76d64c18aac61023405a7f9383827893909c
SHA5128fb5723c96fdbaf4e6a9770c6646eefd490b95436884a998c0137ec924ee7723ab77e612ea8ccd02be2f11ca1650249dc7e9998b2d4b01941f099771ca2aee02
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\MBAMCore.dllFilesize
6.4MB
MD5b2216df400c3ef59f9406831ba7956b5
SHA11e26588190fc8a608e773239d498ceb79a92fca3
SHA2561e429ee1da8a0fe6569673b7052c5f49c193aaa8f3152451f645539a431b792d
SHA5123aa3c9ed3bcaa0f2b7c4de36f7a83e35e8abf63c972c8e5377915bed41a803ae516cf8ef14e9c455043dd1ae46e4aec1820fa3572e65d0c87a99eac1d43d1f40
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\cfg.binFilesize
661B
MD58fd13803b1e5f14b4d241facc601a170
SHA17321eec794bc766d84d75bd0370a9f2e4d7abdf6
SHA256925d771b2643715b62ef720801dfa96047fff1ee70eabb244bed802234673717
SHA512f5b3514258487f8576fe32a795eefcffef049c7d002a6abdca17383bba838c7a218be23ec6803dcefed615f40afc2ba4b15bf65c9a74c4f6bb891d15d02bfc22
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\clean.mbdbFilesize
10KB
MD51d731bebc4e45b25b7f1172f8102e101
SHA14f3e09221e00e30502721fe0bf1041ff4287a18e
SHA256d46568f6978f0fdc6fc519c9a0f941e2a221abafe53e018eb4ebbf31764f9fcb
SHA512dc4e489043451817cf948961351a9f5ddbed4a14ee55cbfa8820d62b7c3c58bbcf4d1af302270033631f095a5e7aaf66c45e9d6f507b202a5cc87b5153979603
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\dbmanifest2.datFilesize
924B
MD5b2d399dddb7d7d32377298c562c0ef11
SHA19c5f2816b722987292e0920bd4dd1be4548c2ab6
SHA25675b35c9b51d978912b5fac4ae4e49f929dcb02b192a1b40bb2367801de303a6e
SHA512dff11a505708c8154c739a4b3cfafd68de00ef55fc9ca62f75973601453ba2291e15299285865dda5a0607efd5f36bdab1a9be95dec9392c536963c64a599448
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\dynconfig.datFilesize
39KB
MD510f23e7c8c791b91c86cd966d67b7bc7
SHA13f596093b2bc33f7a2554818f8e41adbbd101961
SHA256008254ca1f4d6415da89d01a4292911de6135b42833156720a841a22685765dc
SHA5122d1b21371ada038323be412945994d030ee8a9007db072484724616c8597c6998a560bc28886ebf89e2c8919fb70d76c98338d88832351823027491c98d48118
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\exclusions.txtFilesize
23KB
MD5aef4eca7ee01bb1a146751c4d0510d2d
SHA15cf2273da41147126e5e1eabd3182f19304eea25
SHA2569e87e4c9da3337c63b7f0e6ed0eb71696121c74e18a5da577215e18097715e2f
SHA512d31d21e37b0048050b19600f8904354cff3f3ec8291c5a7a54267e14af9fb88dfb6d11e74a037cc0369ade8a8fb9b753861f3b3fb2219563e8ec359f66c042db
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\ig.exeFilesize
1.8MB
MD514cd82fe89752e3723a9b42aaa68763a
SHA1ea407d8d7064581406eb1b14e0f01cee61afb252
SHA25660e6029bdf3a2d88772bd4ec3aea6b688505e7dfcb76ce371d6942e9de95ce04
SHA51216114ff38a2e2cc59a9bbf420304fda8e558022f385748a5f48c02f037cbe815221a1cb4f0ac1deeb408ebf66ee3e25c059b157c7cc5cb169dbac75a73694fdc
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\mbdigsig2.datFilesize
514B
MD51afb5b585f1e63f7ebe7637a47ceec6e
SHA1b7759c9e0d3b6b5173da9bb94388966dc34030ea
SHA2568eb3bf3c0b3b2ec8591129f4e8e3a9ff67458f1fedc76041045ad8cfb8ec2b03
SHA5123f0c4c83684afabdaeb9cae63eda14dcba057cf59a4857cab35113a590ad798f4ddf88e8adc1c6bfa3f321aab7aca77ae856a2997ab106aa2939a52107b046b1
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\prot.mbdbFilesize
24B
MD5546d9e30eadad8b22f5b3ffa875144bf
SHA13b323ffef009bfe0662c2bd30bb06af6dfc68e4d
SHA2566089fbf0c0c1413f62e91dc9497bedc6d8a271e9dc761e20adc0dccf6f4a0c1f
SHA5123478f5dcf7af549dd6fe48ad714604200de84a90120b16a32233b6d44fa7240f5f4e5fe803f54b86bbdfd10fa1bfdd88fb85eb6a78e23e426933f98d0a2565ec
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\rdefs.mbdbFilesize
24B
MD52f7423ca7c6a0f1339980f3c8c7de9f8
SHA1102c77faa28885354cfe6725d987bc23bc7108ba
SHA256850a4ea37a0fd6f68bf95422d502b2d1257264eb90cc38c0a3b1b95aa375be55
SHA512e922ac8a7a2cde6d387f8698207cf5efbd45b646986a090e3549d97a7d552dd74179bd7ac20b7d246ca49d340c4c168982c65b4749df760857810b2358e7eb69
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\rules.mbdbFilesize
8.6MB
MD52d805cee52016ed4611e99c7b90d1216
SHA1896937902c172feb3330df9b71788cfa2763c1d2
SHA256b555b516dbd924530ad7383b91ab1c43814fe73b5ce379e216ba6cb88d79921e
SHA5122ccfd1c6aca1b761d958955d7adc94dd5eebb4b16552dd00d22b6a91a4777f383aa370d52de04be5ebc2b95c5abfd3af80606b9b33c8c21cd08f2b9f9434979d
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\sample.dllFilesize
528KB
MD5936021397e23fc913c55992ce9468913
SHA1d65af889a379f2982b1ebf29d83d2783b9aa0ded
SHA256ce7bdd309701942d97bd8cd3c2455a8d37d93b4d9ce4c14986703daf46fab7fb
SHA5124fb968bee32b5f2b5a5d1629ec2855dc0150ec6b753e83a457ec704350b1f219b5e1349a75ec41f94757d1ef2de9a020933f8e42566bf6123543b7709ecc3d74
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\scan.mbdbFilesize
1.0MB
MD5ff3fa22cba0d1a3b474c6c07743e97f0
SHA19d81f3250adb32282bfb807106034bb8e8796a68
SHA256108cf7b41eec0a29baca9c3b18f42d884c0a83e3c8fb1354514a3c7871d7f3b7
SHA512012849a67c809567f756f9e4a36c4a7b203cb9a3b98ffd43add3cbb93c2e1e85b5b0bb75739e2924398f9ee652053e6193d0199eba801dd2109c4e21522e3432
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\tids.mbdbFilesize
176KB
MD5fb5bfb4996226bc6680f010f08b59d36
SHA1339c22a7c1edd14dec64e69ab62f4ba6fbb53e34
SHA256266c2440e2dd98eca447ce454d9e6d82f960366ce04210b23e8369eae6d6b1e3
SHA5127958f8b00aad5aa7150551e5a4e98f76ecea5ee6a26233d194907b8b94b9fb70fca9ad2d837a9df2be6b075b028c0d3e9ca7a00a3edeeb146df11764a995eebb
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\wprot2.mbdbFilesize
44.6MB
MD5b7bd606a3a52d95dade066a4743fe5dd
SHA1df8a492eea61759c18d8a4d09f0a6c1104843fd1
SHA2560c0e5e2a7d231510dbe18507ee7cafe142fc8280d07bdc49bd2f1d24dc00ba01
SHA5125b801a0fadfa65114fad5a4dbd49c73ad58356682a2486e493c518bb915a46d787e330a6756456ebcdd09b45a531cfae726333df8619729855fc29c889d1fc32
-
C:\ProgramData\Malwarebytes\MBAMService\pkgvers.datFilesize
74B
MD54f61d81c221490a12e7d83f70e8659a8
SHA18ca504b5c3b03bacd84c7f9b4d376b15c0266327
SHA2561a9ddae2bce1b0aaa11b53c26613ecfdd8765d91102856fec2996a44f18370e5
SHA512a3ed3f7f9b85828a64ee895d2146d36976117524eef56ff8f80bee884160449844a6cfbc25cd51264613ab2c1dd1ade911daed572f0498c5e57fd576b0126ab5
-
C:\Windows\System32\CatRoot2\dberr.txtFilesize
146KB
MD579a2bafc16d4b4ae377d87ce0336251d
SHA1cf25813e5de175f170aca26db0c2fa7097a54020
SHA256d686d69e897ac9177501f6bef7c82abe170db2b0459c63a5c52ffa8356ed7235
SHA512bab35ef215b07bac5b3dbf2a2b966f28ad309f802915e4902fc88894f43e41fddb749d94839304afd3c1caf25a213369ea6e9b078cc8deeb083f6e63c90645af
-
C:\Windows\System32\catroot2\dberr.txtFilesize
146KB
MD5bc7ce58e558e6e2e1cc7e2e1480fea09
SHA124933722acfd00d29ddadb6bc9a9073d730cd676
SHA256ff476fd7eea17b52edf1ace5427918316fdf75e3272149d1a79182126958e05d
SHA512b629e45da9227d922c0e63612b8d718f60db5c71096f034f86cd00119462514ccc4a154af81a33dce5f494a31cbdd6f543c60f3b99161ccf274e9851585b43f0
-
C:\Windows\Temp\MBInstallTemp3d69554356aa11ee8e0e4e5ee4fa2397\7z.dllFilesize
1.6MB
MD5ab8f0c1a37c0df5c8924aab509db42c9
SHA153dba959124e6d740829bda2360e851bcb85cce8
SHA2566e223b275b84d948cc5ae1f161f0bfff2adb34de04634c84d7dbe9305a4998d5
SHA512ff8a26e8fd5a08c74e5ba93a564e0d3cd932754e7f06993a365bfad06670497889e69ec45bfba1378040b72f82d468e79682beba2439937bb29d2a41da940d4a
-
C:\Windows\Temp\MBInstallTemp3d69554356aa11ee8e0e4e5ee4fa2397\7z.dllFilesize
1.6MB
MD5ab8f0c1a37c0df5c8924aab509db42c9
SHA153dba959124e6d740829bda2360e851bcb85cce8
SHA2566e223b275b84d948cc5ae1f161f0bfff2adb34de04634c84d7dbe9305a4998d5
SHA512ff8a26e8fd5a08c74e5ba93a564e0d3cd932754e7f06993a365bfad06670497889e69ec45bfba1378040b72f82d468e79682beba2439937bb29d2a41da940d4a
-
C:\Windows\Temp\MBInstallTemp3d69554356aa11ee8e0e4e5ee4fa2397\ctlrpkg\mbae64.sysFilesize
154KB
MD595515708f41a7e283d6725506f56f6f2
SHA19afc20a19db3d2a75b6915d8d9af602c5218735e
SHA256321058a27d7462e55e39d253ad5d8b19a9acf754666400f82fe0542f33e733c6
SHA512d9230901adeecb13b1f92287abe9317cdac458348885b96ef6500960793a7586c76ae374df053be948a35b44abe934aa853975a6ccd3788f93909903cc718c08
-
C:\Windows\Temp\MBInstallTemp3d69554356aa11ee8e0e4e5ee4fa2397\servicepkg\MBAMService.exeFilesize
8.9MB
MD52d5f7e54f0678f45e8d07b4ab1f32a2e
SHA18db3e26e974b1098f8c9a7c7be8a770394d243cb
SHA25643676ff9573b8d29fb3f46c0e4381009eba37dec0ecb053aaec424e60a4eef29
SHA512ef7009d8269a29e1ce5e542ef9305dbe702b9778b13ba483b0efea01b19b013c899d3528154047f4fa13b2393972b0c091d2eab02eea0b252fc80d152d1d608c
-
C:\Windows\Temp\MBInstallTemp3d69554356aa11ee8e0e4e5ee4fa2397\servicepkg\mbamelam.catFilesize
10KB
MD560608328775d6acf03eaab38407e5b7c
SHA19f63644893517286753f63ad6d01bc8bfacf79b1
SHA2563ed5a1668713ef80c2b5599b599f1434ad6648999f335cf69757ea3183c70c59
SHA5129f65212121b8a5d1a0625c3baa14ef04a33b091d26f543324333e38dcdb903e02ccc4d009e22c2e85d2f61d954e0b994c2896e52f685003a6ef34758f8a650c7
-
C:\Windows\Temp\MBInstallTemp3d69554356aa11ee8e0e4e5ee4fa2397\servicepkg\mbamelam.infFilesize
2KB
MD5c481ad4dd1d91860335787aa61177932
SHA181633414c5bf5832a8584fb0740bc09596b9b66d
SHA256793626d240fd8eefc81b78a57c8dfe12ea247889b6f07918e9fd32a7411aa1c3
SHA512d292e028936412f07264837d4a321ecfa2f5754d4048c8bcf774a0e076e535b361c411301558609d64c71c1ce9b19e6041efa44d201237a7010c553751e1e830
-
C:\Windows\Temp\MBInstallTemp3d69554356aa11ee8e0e4e5ee4fa2397\servicepkg\mbamelam.sysFilesize
20KB
MD59e77c51e14fa9a323ee1635dc74ecc07
SHA1a78bde0bd73260ce7af9cdc441af9db54d1637c2
SHA256b5619d758ae6a65c1663f065e53e6b68a00511e7d7accb3e07ed94bfd0b1ede0
SHA512a12ccf92bead694f5d3cba7ff7e731a2f862198efc338efc7f33a882fe0eb7499fb3fb533538d0a823e80631a7ca162962fbdfd78e401e3255672910b7140186
-
C:\Windows\Temp\MBInstallTemp3d69554356aa11ee8e0e4e5ee4fa2397\servicepkg\mbshlext.dllFilesize
2.7MB
MD5b7e5071b317550d93258f7e1e13e7b6f
SHA12d08d78a5c29cf724bc523530d1a9014642bbc60
SHA256467de01d7cee7ec54166b80658ff22f9feebdb1c24eaf1629cf40e4124508064
SHA5129c35293c95c1a9141740ac99315605964aa37c4a42d3a11cae9e5649ff1427a9480d3d5e7f763212cf13db3511c5ea3c84e68f95f0067fe6339a9d3fb7b27c54
-
C:\Windows\Temp\MBInstallTemp3d69554356aa11ee8e0e4e5ee4fa2397\uipkg\QtQuick\Controls.2\HorizontalHeaderView.qmlFilesize
1KB
MD5d8c9674c0e9bddbd8aa59a9d343cf462
SHA1490aa022ac31ddce86d5b62f913b23fbb0de27c2
SHA2561ef333b5fb4d8075973f312ef787237240b9f49f3f9185fb21202883f900e7d7
SHA5120b86ec673133f6400c38b79f9ba4f7b37ce5afdab1a2e34acbf75019e2590cc26b26d323ddc1567c91375053c9c8593be0615389db8eb1a8d1eb084ad4200b82
-
C:\Windows\Temp\MBInstallTemp3d69554356aa11ee8e0e4e5ee4fa2397\uipkg\QtQuick\Controls.2\Imagine\VerticalHeaderView.qmlFilesize
1KB
MD5829769b2741d92df3c5d837eee64f297
SHA1f61c91436ca3420c4e9b94833839fd9c14024b69
SHA256489c02f8716e7a1de61834b3d8bbb61bce91ca4a33a6b62342b4c851d93e51e0
SHA5124061c271db37523b9dea9a9973226d91337e1809d4e7767e57ac938d35d77a302363ed92ab4be18c35ba589f528194ad71c93a8507449bf74dd035acf7cdb521
-
memory/3212-4308-0x00000257C92C0000-0x00000257C984C000-memory.dmpFilesize
5.5MB
-
memory/5940-4312-0x00007FF948CB0000-0x00007FF9490CE000-memory.dmpFilesize
4.1MB
-
memory/5940-4313-0x00007FF946010000-0x00007FF94657B000-memory.dmpFilesize
5.4MB
-
memory/5940-4315-0x000002869C3F0000-0x000002869C400000-memory.dmpFilesize
64KB
-
memory/5940-4328-0x000002869E9C0000-0x000002869EE00000-memory.dmpFilesize
4.2MB
-
memory/5940-4331-0x000002869EE00000-0x000002869F000000-memory.dmpFilesize
2.0MB