Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
191s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
10/10/2023, 22:58
Static task
static1
Behavioral task
behavioral1
Sample
Patch MB 4.6.x.xxx.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
Patch MB 4.6.x.xxx.exe
Resource
win10v2004-20230915-en
General
-
Target
Patch MB 4.6.x.xxx.exe
-
Size
65.2MB
-
MD5
769fa107cac437991936643163307790
-
SHA1
83404c577b7aadbd7fba7c15e3888ff6ac81fab5
-
SHA256
64831a005b4eccebf7893444b55dd515b4aa54f705cdebd74443340049ce00be
-
SHA512
ed8aadd712dd265f30acc2011c16bd0539bd8dfcb4cddb4182ae0c74ba32d490e9c784b41762d70d86961b98ea4300912e9402b9980f7f676c5240886829097f
-
SSDEEP
1572864:B98OHNqC7bUUm2KFqXGrY4DBMwd7MuRNc772oaoy4TJ1GmwNf:JHYC7bk2Ku4DBMw6uQHnweWdNf
Malware Config
Signatures
-
Drops file in Drivers directory 8 IoCs
description ioc Process File created C:\Windows\system32\DRIVERS\SETCBC8.tmp mbamservice.exe File opened for modification C:\Windows\system32\DRIVERS\mbamswissarmy.sys mbamservice.exe File opened for modification C:\Windows\system32\DRIVERS\SETD6D0.tmp mbamservice.exe File created C:\Windows\system32\DRIVERS\SETD6D0.tmp mbamservice.exe File opened for modification C:\Windows\System32\drivers\etc\hosts attrib.exe File opened for modification C:\Windows\System32\drivers\etc\hosts cmd.exe File created C:\Windows\system32\drivers\is-7BVT1.tmp rs.tmp File opened for modification C:\Windows\system32\DRIVERS\SETCBC8.tmp mbamservice.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MBAMSwissArmy\ImagePath = "\\SystemRoot\\System32\\Drivers\\mbamswissarmy.sys" mbamservice.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion mbamservice.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate mbamservice.exe -
Executes dropped EXE 8 IoCs
pid Process 2816 7z2201.exe 1796 7z.exe 1036 7z.exe 2260 rs.exe 2756 rs.tmp 2816 mbamservice.exe 2332 mbamservice.exe 2380 mbamtray.exe -
Loads dropped DLL 64 IoCs
pid Process 2816 7z2201.exe 1796 7z.exe 1036 7z.exe 2260 rs.exe 2756 rs.tmp 2756 rs.tmp 2756 rs.tmp 2756 rs.tmp 2756 rs.tmp 2756 rs.tmp 2332 mbamservice.exe 2332 mbamservice.exe 2332 mbamservice.exe 2332 mbamservice.exe 2332 mbamservice.exe 2332 mbamservice.exe 2332 mbamservice.exe 2332 mbamservice.exe 2332 mbamservice.exe 2332 mbamservice.exe 2332 mbamservice.exe 2332 mbamservice.exe 2332 mbamservice.exe 2332 mbamservice.exe 2332 mbamservice.exe 2332 mbamservice.exe 2332 mbamservice.exe 2332 mbamservice.exe 2332 mbamservice.exe 2332 mbamservice.exe 2332 mbamservice.exe 2332 mbamservice.exe 2332 mbamservice.exe 2332 mbamservice.exe 2332 mbamservice.exe 2332 mbamservice.exe 2332 mbamservice.exe 2332 mbamservice.exe 2332 mbamservice.exe 2332 mbamservice.exe 2332 mbamservice.exe 2380 mbamtray.exe 2380 mbamtray.exe 2380 mbamtray.exe 2380 mbamtray.exe 2380 mbamtray.exe 2380 mbamtray.exe 2380 mbamtray.exe 2380 mbamtray.exe 2380 mbamtray.exe 2380 mbamtray.exe 2380 mbamtray.exe 2380 mbamtray.exe 2380 mbamtray.exe 2380 mbamtray.exe 2380 mbamtray.exe 2380 mbamtray.exe 2380 mbamtray.exe 2380 mbamtray.exe 2380 mbamtray.exe 2380 mbamtray.exe 2380 mbamtray.exe 2380 mbamtray.exe 2380 mbamtray.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Registers COM server for autorun 1 TTPs 61 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BF474111-9116-45C6-AF53-209E64F1BB53}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe\"" mbamservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{130CD414-6BFD-4F6C-9362-A2264B222E76}\LocalServer32 mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{130CD414-6BFD-4F6C-9362-A2264B222E76}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe" mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE8A9269-9E6E-4683-BCD3-41E9B16696DC}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe\"" mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D5599B6B-FA0C-45B5-8309-853B003EA412}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe\"" mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F36AD0D0-B5F0-4C69-AF08-603D177FEF0E}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe" mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{17BE78EE-B40A-4B9E-835F-38EC62F9D479}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe\"" mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{03141A2A-5C3A-458E-ABEC-0812AD7FF497}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe\"" mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DE03E614-112D-43E0-8E15-E7236CC32108}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe" mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57CE581A-0CB6-4266-9CA0-19364C90A0B3}\InprocServer32\ThreadingModel = "Apartment" mbamservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{17BE78EE-B40A-4B9E-835F-38EC62F9D479}\LocalServer32 mbamservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F415899A-1576-4C8B-BC9F-4854781F8A20}\LocalServer32 mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F415899A-1576-4C8B-BC9F-4854781F8A20}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe" mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D372F21-E6DA-4B82-881A-79F6CA6B6AE1}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe" mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F6D29500-933C-447C-9D88-9D814AF73808}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe" mbamservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F36AD0D0-B5F0-4C69-AF08-603D177FEF0E}\LocalServer32 mbamservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DE03E614-112D-43E0-8E15-E7236CC32108}\LocalServer32 mbamservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36A65E46-6CC1-4CA2-B51E-F4DD8C993DDC}\LocalServer32 mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{580243BF-3CEE-4131-A599-C6FED66BEB1B}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe\"" mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E1AC7139-D1FF-4DE9-84A4-92E2B47F5D2A}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe\"" mbamservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BF474111-9116-45C6-AF53-209E64F1BB53}\LocalServer32 mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E1AC7139-D1FF-4DE9-84A4-92E2B47F5D2A}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe" mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{130CD414-6BFD-4F6C-9362-A2264B222E76}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe\"" mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D5599B6B-FA0C-45B5-8309-853B003EA412}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe" mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{251AD013-20AD-4C3F-8FE2-F66A429B4819}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe\"" mbamservice.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F36AD0D0-B5F0-4C69-AF08-603D177FEF0E}\LocalServer32 mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D372F21-E6DA-4B82-881A-79F6CA6B6AE1}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe\"" mbamservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{03141A2A-5C3A-458E-ABEC-0812AD7FF497}\LocalServer32 mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F36AD0D0-B5F0-4C69-AF08-603D177FEF0E}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe\"" mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F6D29500-933C-447C-9D88-9D814AF73808}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe\"" mbamservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57CE581A-0CB6-4266-9CA0-19364C90A0B3}\InprocServer32 mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{580243BF-3CEE-4131-A599-C6FED66BEB1B}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe" mbamservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E1AC7139-D1FF-4DE9-84A4-92E2B47F5D2A}\LocalServer32 mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE8A9269-9E6E-4683-BCD3-41E9B16696DC}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe" mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{17BE78EE-B40A-4B9E-835F-38EC62F9D479}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe" mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{03141A2A-5C3A-458E-ABEC-0812AD7FF497}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe" mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BF474111-9116-45C6-AF53-209E64F1BB53}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe" mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F1C46F8-E697-4175-B240-CDE682A4BA2D}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe" mbamservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D5599B6B-FA0C-45B5-8309-853B003EA412}\LocalServer32 mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36A65E46-6CC1-4CA2-B51E-F4DD8C993DDC}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe\"" mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57CE581A-0CB6-4266-9CA0-19364C90A0B3}\InprocServer32\ = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbshlext.dll" mbamservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{278637DA-FDFB-45C7-8CD8-F2D8A9199AB0}\LocalServer32 mbamservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F6D29500-933C-447C-9D88-9D814AF73808}\LocalServer32 mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DE03E614-112D-43E0-8E15-E7236CC32108}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe\"" mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{376BE474-56D4-4177-BB4E-5610156F36C8}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe\"" mbamservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{11D1E5E8-14E1-4B5B-AE1A-2678CB91E8E5}\LocalServer32 mbamservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{580243BF-3CEE-4131-A599-C6FED66BEB1B}\LocalServer32 mbamservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F1C46F8-E697-4175-B240-CDE682A4BA2D}\LocalServer32 mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36A65E46-6CC1-4CA2-B51E-F4DD8C993DDC}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe" mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{11D1E5E8-14E1-4B5B-AE1A-2678CB91E8E5}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe\"" mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F1C46F8-E697-4175-B240-CDE682A4BA2D}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe\"" mbamservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE8A9269-9E6E-4683-BCD3-41E9B16696DC}\LocalServer32 mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{376BE474-56D4-4177-BB4E-5610156F36C8}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe" mbamservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{251AD013-20AD-4C3F-8FE2-F66A429B4819}\LocalServer32 mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{251AD013-20AD-4C3F-8FE2-F66A429B4819}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe" mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{278637DA-FDFB-45C7-8CD8-F2D8A9199AB0}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe\"" mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{278637DA-FDFB-45C7-8CD8-F2D8A9199AB0}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe" mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{11D1E5E8-14E1-4B5B-AE1A-2678CB91E8E5}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe" mbamservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D372F21-E6DA-4B82-881A-79F6CA6B6AE1}\LocalServer32 mbamservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{376BE474-56D4-4177-BB4E-5610156F36C8}\LocalServer32 mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F415899A-1576-4C8B-BC9F-4854781F8A20}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe\"" mbamservice.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: mbamservice.exe File opened (read-only) \??\B: mbamservice.exe File opened (read-only) \??\O: mbamservice.exe File opened (read-only) \??\S: mbamservice.exe File opened (read-only) \??\V: mbamservice.exe File opened (read-only) \??\Y: mbamservice.exe File opened (read-only) \??\Z: mbamservice.exe File opened (read-only) \??\E: mbamservice.exe File opened (read-only) \??\K: mbamservice.exe File opened (read-only) \??\T: mbamservice.exe File opened (read-only) \??\W: mbamservice.exe File opened (read-only) \??\G: mbamservice.exe File opened (read-only) \??\L: mbamservice.exe File opened (read-only) \??\M: mbamservice.exe File opened (read-only) \??\Q: mbamservice.exe File opened (read-only) \??\U: mbamservice.exe File opened (read-only) \??\X: mbamservice.exe File opened (read-only) \??\H: mbamservice.exe File opened (read-only) \??\I: mbamservice.exe File opened (read-only) \??\J: mbamservice.exe File opened (read-only) \??\N: mbamservice.exe File opened (read-only) \??\P: mbamservice.exe File opened (read-only) \??\R: mbamservice.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\CatRoot2\dberr.txt mbamservice.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Malwarebytes\Anti-Malware\Languages\is-UN43C.tmp rs.tmp File opened for modification C:\Program Files (x86)\7-Zip\Lang\bg.txt 7z2201.exe File created C:\Program Files (x86)\7-Zip\Lang\pt-br.txt 7z2201.exe File opened for modification C:\Program Files (x86)\7-Zip\Lang\tr.txt 7z2201.exe File created C:\Program Files\Malwarebytes\Anti-Malware\is-8U4DG.tmp rs.tmp File created C:\Program Files\Malwarebytes\Anti-Malware\is-A48OC.tmp rs.tmp File created C:\Program Files (x86)\7-Zip\Lang\bn.txt 7z2201.exe File opened for modification C:\Program Files (x86)\7-Zip\Lang\es.txt 7z2201.exe File opened for modification C:\Program Files (x86)\7-Zip\Lang\fa.txt 7z2201.exe File created C:\Program Files (x86)\7-Zip\Lang\cy.txt 7z2201.exe File created C:\Program Files (x86)\7-Zip\Lang\ps.txt 7z2201.exe File opened for modification C:\Program Files (x86)\7-Zip\Uninstall.exe 7z2201.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Dialogs\is-3CEA0.tmp rs.tmp File created C:\Program Files\Malwarebytes\Anti-Malware\is-51MLU.tmp rs.tmp File opened for modification C:\Program Files (x86)\7-Zip\Lang\ru.txt 7z2201.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Dialogs\is-NBV4T.tmp rs.tmp File created C:\Program Files\Malwarebytes\Anti-Malware\Languages\is-7I8RQ.tmp rs.tmp File opened for modification C:\Program Files (x86)\7-Zip\readme.txt 7z2201.exe File opened for modification C:\Program Files (x86)\7-Zip\7zFM.exe 7z2201.exe File created C:\Program Files\Malwarebytes\Anti-Malware\is-H238P.tmp rs.tmp File created C:\Program Files\Malwarebytes\Anti-Malware\is-SGPE3.tmp rs.tmp File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\is-NLO6S.tmp rs.tmp File created C:\Program Files\Malwarebytes\Anti-Malware\Languages\is-UFG0Q.tmp rs.tmp File created C:\Program Files (x86)\7-Zip\Lang\mng.txt 7z2201.exe File created C:\Program Files\Malwarebytes\Anti-Malware\is-VFQU3.tmp rs.tmp File opened for modification C:\Program Files (x86)\7-Zip\Lang\ast.txt 7z2201.exe File created C:\Program Files (x86)\7-Zip\Lang\de.txt 7z2201.exe File created C:\Program Files\Malwarebytes\Anti-Malware\is-94HCQ.tmp rs.tmp File created C:\Program Files\Malwarebytes\Anti-Malware\Languages\is-1LHIB.tmp rs.tmp File created C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.json.bak rs.tmp File opened for modification C:\Program Files (x86)\7-Zip\Lang\en.ttt 7z2201.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Window.2\is-6AK00.tmp rs.tmp File created C:\Program Files\Malwarebytes\Anti-Malware\is-1HBDN.tmp rs.tmp File created C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.tmf mbamservice.exe File created C:\Program Files (x86)\7-Zip\Lang\ar.txt 7z2201.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Dialogs\is-9NHDE.tmp rs.tmp File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Dialogs\Private\is-P0931.tmp rs.tmp File opened for modification C:\Program Files (x86)\7-Zip\Lang\is.txt 7z2201.exe File opened for modification C:\Program Files (x86)\7-Zip\Lang\tg.txt 7z2201.exe File created C:\Program Files\Malwarebytes\Anti-Malware\is-JQP1F.tmp rs.tmp File created C:\Program Files\Malwarebytes\Anti-Malware\is-1TRQ0.tmp rs.tmp File created C:\Program Files (x86)\7-Zip\descript.ion 7z2201.exe File opened for modification C:\Program Files (x86)\7-Zip\History.txt 7z2201.exe File created C:\Program Files (x86)\7-Zip\Lang\co.txt 7z2201.exe File created C:\Program Files (x86)\7-Zip\Lang\he.txt 7z2201.exe File created C:\Program Files\Malwarebytes\Anti-Malware\imageformats\is-UOHRT.tmp rs.tmp File created C:\Program Files\Malwarebytes\Anti-Malware\is-SRRA3.tmp rs.tmp File created C:\Program Files (x86)\7-Zip\Lang\eu.txt 7z2201.exe File created C:\Program Files (x86)\7-Zip\Lang\pl.txt 7z2201.exe File created C:\Program Files (x86)\7-Zip\Lang\th.txt 7z2201.exe File created C:\Program Files\Malwarebytes\Anti-Malware\is-GROOQ.tmp rs.tmp File created C:\Program Files\Malwarebytes\Anti-Malware\is-96N2C.tmp rs.tmp File created C:\Program Files\Malwarebytes\Anti-Malware\is-1UL5L.tmp rs.tmp File created C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.inf mbamservice.exe File opened for modification C:\Program Files (x86)\7-Zip\7-zip.chm 7z2201.exe File opened for modification C:\Program Files (x86)\7-Zip\Lang\ne.txt 7z2201.exe File opened for modification C:\Program Files (x86)\7-Zip\Lang\uz.txt 7z2201.exe File created C:\Program Files\Malwarebytes\Anti-Malware\is-FMQ61.tmp rs.tmp File created C:\Program Files\Malwarebytes\Anti-Malware\is-79DH2.tmp rs.tmp File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Flat\is-UPESQ.tmp rs.tmp File opened for modification C:\Program Files (x86)\7-Zip\Lang\hu.txt 7z2201.exe File opened for modification C:\Program Files (x86)\7-Zip\Lang\ko.txt 7z2201.exe File created C:\Program Files (x86)\7-Zip\7-zip.dll 7z2201.exe File created C:\Program Files (x86)\7-Zip\7z.sfx 7z2201.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.app.log mbamservice.exe File opened for modification C:\Windows\security\logs\scecomp.log mbamservice.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 mbamservice.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz mbamservice.exe -
Delays execution with timeout.exe 18 IoCs
pid Process 1072 timeout.exe 2080 timeout.exe 2764 timeout.exe 3008 timeout.exe 2244 timeout.exe 2976 timeout.exe 2044 timeout.exe 2888 timeout.exe 2624 timeout.exe 2740 timeout.exe 2968 timeout.exe 2692 timeout.exe 1328 timeout.exe 1164 timeout.exe 2488 timeout.exe 2004 timeout.exe 2684 timeout.exe 2628 timeout.exe -
Enumerates processes with tasklist 1 TTPs 64 IoCs
pid Process 2968 tasklist.exe 2608 tasklist.exe 1488 tasklist.exe 1888 tasklist.exe 1720 tasklist.exe 324 tasklist.exe 1240 tasklist.exe 2236 tasklist.exe 372 tasklist.exe 2772 tasklist.exe 2360 tasklist.exe 2780 tasklist.exe 2608 tasklist.exe 2244 tasklist.exe 2716 tasklist.exe 1924 tasklist.exe 2848 tasklist.exe 2836 tasklist.exe 3036 tasklist.exe 2932 tasklist.exe 1476 tasklist.exe 2800 tasklist.exe 1660 tasklist.exe 2968 tasklist.exe 1668 tasklist.exe 1168 tasklist.exe 2916 tasklist.exe 2488 tasklist.exe 2052 tasklist.exe 2612 tasklist.exe 540 tasklist.exe 2828 tasklist.exe 1496 tasklist.exe 1980 tasklist.exe 2488 tasklist.exe 2888 tasklist.exe 3044 tasklist.exe 1148 tasklist.exe 1696 tasklist.exe 2552 tasklist.exe 1040 tasklist.exe 936 tasklist.exe 2160 tasklist.exe 1488 tasklist.exe 3012 tasklist.exe 2192 tasklist.exe 1172 tasklist.exe 1836 tasklist.exe 1976 tasklist.exe 1944 tasklist.exe 2020 tasklist.exe 440 tasklist.exe 2056 tasklist.exe 1736 tasklist.exe 952 tasklist.exe 2072 tasklist.exe 592 tasklist.exe 440 tasklist.exe 2016 tasklist.exe 1032 tasklist.exe 2860 tasklist.exe 1060 tasklist.exe 1224 tasklist.exe 1932 tasklist.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION rs.tmp Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION\mbamtray.exe = "11000" rs.tmp Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION\mbam.exe = "11000" rs.tmp -
Modifies data under HKEY_USERS 22 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-10112023023101975_Classes mbamservice.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" mbamservice.exe Key created \REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-10112023023103800 mbamservice.exe Key created \REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-10112023023103800_Classes mbamservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\MY mbamservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA mbamservice.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT mbamservice.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs mbamservice.exe Key created \REGISTRY\USER\S-1-5-19-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-10112023023101414 mbamservice.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates mbamservice.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates mbamservice.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 mbamservice.exe Key created \REGISTRY\USER\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-10112023023101133 mbamservice.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs mbamservice.exe Key created \REGISTRY\USER\S-1-5-20-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-10112023023101554 mbamservice.exe Key created \REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-10112023023101975 mbamservice.exe Key created \REGISTRY\USER\S-1-5-19-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-10112023023103598 mbamservice.exe Key created \REGISTRY\USER\S-1-5-20-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-10112023023103691 mbamservice.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs mbamservice.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs mbamservice.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" mbamservice.exe Key created \REGISTRY\USER\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-10112023023103535 mbamservice.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB30855D-36DF-41BD-9EEE-03BA7E8E70B7}\TypeLib mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0B14402F-4F35-443E-A34E-0F511098C644}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2F14F58B-B908-4644-830F-5ACF8542D27F}\TypeLib\Version = "1.0" mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0E2822AB-0447-4F28-AF4C-FFDB1E8595AE}\1.0\HELPDIR\ = "C:\\Program Files\\Malwarebytes\\Anti-Malware" mbamservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8C842243-BDAD-4A93-B282-93E3FCBC1CA4} mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{90A62FAD-6FA9-4454-8CEE-7EDF67437226}\TypeLib\ = "{5709DEEB-F05E-4D5C-8DC4-3B0D924EE08F}" mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{172ABF99-1426-47CA-895B-092E23728E8A}\ = "ICloudControllerEvents" mbamservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0B14402F-4F35-443E-A34E-0F511098C644}\ProxyStubClsid32 mbamservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{74630AE8-C170-4A8F-A90A-F42D63EFE1E8}\1.0 mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D2D1C2BC-3427-478E-A903-ADFBCF5711CD}\TypeLib\ = "{74630AE8-C170-4A8F-A90A-F42D63EFE1E8}" mbamservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{237E618C-D739-4C8A-9F72-5CD4EF91CBE5}\TypeLib mbamservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{09F245DA-55E7-451E-BDF3-4EE44637DFF1}\ProxyStubClsid32 mbamservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D372F21-E6DA-4B82-881A-79F6CA6B6AE1}\Programmable mbamservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D5599B6B-FA0C-45B5-8309-853B003EA412}\TypeLib mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB30855D-36DF-41BD-9EEE-03BA7E8E70B7}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" mbamservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7F95C137-46FC-42FB-A66A-F0482F3C749C}\ProxyStubClsid32 mbamservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{49F6AC60-2104-42C6-8F71-B3916D5AA732}\1.0\FLAGS mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6EC225D5-FD37-4F9B-B80F-09FAE36103AE}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" mbamservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C0CEAFA7-4F65-418C-8A61-92B2048115EE}\TypeLib mbamservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{332AFEBA-9341-4CEC-8EA6-DB155A99DF63}\1.0\0\win64 mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\MBAMShlExt\ = "{57CE581A-0CB6-4266-9CA0-19364C90A0B3}" mbamservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MB.ArwController.1\CLSID mbamservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MB.SPController.1 mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MB.TelemetryController.1\CLSID\ = "{DE03E614-112D-43E0-8E15-E7236CC32108}" mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MB.UpdateController.1\ = "UpdateController Class" mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8D488C7C-023D-4561-B377-DD9FB7124326}\ = "ICleanControllerV6" mbamservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3A7FB145-B72D-466E-A3AC-21599BBE9E8C}\ProxyStubClsid32 mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0E2822AB-0447-4F28-AF4C-FFDB1E8595AE}\1.0\FLAGS\ = "0" mbamservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MB.CloudController mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{332AFEBA-9341-4CEC-8EA6-DB155A99DF63}\1.0\0\win64\ = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe\\7" mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{893E5593-9490-4E90-9F1E-0B786EC41470}\TypeLib\ = "{2446F405-83F0-460F-B837-F04540BB330C}" mbamservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6CE18DD5-2BD7-4844-B9AD-DF6A995750A1}\TypeLib mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6CE18DD5-2BD7-4844-B9AD-DF6A995750A1}\TypeLib\Version = "1.0" mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5BA2811A-EE5B-44DF-81CD-C75BB11A82D4}\TypeLib\ = "{2446F405-83F0-460F-B837-F04540BB330C}" mbamservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{251AD013-20AD-4C3F-8FE2-F66A429B4819}\Version mbamservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DD3CFEBD-3B8E-4651-BB7C-537D1F03E59C} mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{014D0CF7-ACC9-4004-B999-7BDBAAD274B7}\ = "_IMWACControllerEventsV2" mbamservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CCEFCD43-B934-4168-AE51-6FE07D3D0624}\TypeLib mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{376BE474-56D4-4177-BB4E-5610156F36C8}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbamservice.exe" mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{71B13605-3569-4F4A-B971-08FF179A3A60}\ = "_IScannerEvents" mbamservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{81701AB9-0B9C-49FE-9C79-C3C4DCA91E7B}\ProxyStubClsid32 mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{90F4450A-B7B2-417C-8ABB-BBD1BDFBFC27}\TypeLib\ = "{332AFEBA-9341-4CEC-8EA6-DB155A99DF63}" mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E2870643-0645-41F9-BCCB-F5969386162C}\TypeLib\ = "{FFB94DF8-FC15-411C-B443-E937085E2AC1}" mbamservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7DD05E6E-FF07-4CD3-A7BA-200BEC812A5C} mbamservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C85F3EB8-B099-4598-89C3-E33BAC2CE53D}\ProxyStubClsid32 mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{CFFF19F6-ECFE-446D-ACAD-8DC525DA2563}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D8258E71-3A7A-4D9D-85BB-C7999F95B7E4}\TypeLib\Version = "1.0" mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{278637DA-FDFB-45C7-8CD8-F2D8A9199AB0}\ProgID\ = "MB.ArwController.1" mbamservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C7BCC13C-47B9-4DC0-8FC6-B2A489EF60EF}\TypeLib mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7E96FEF0-48F7-4ECB-B010-501044575477}\ = "_IRTPControllerEventsV3" mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E2870643-0645-41F9-BCCB-F5969386162C}\ = "_IRTPControllerEventsV4" mbamservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{893E5593-9490-4E90-9F1E-0B786EC41470} mbamservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{ECDAC35E-72BB-4856-97E1-226BA47C62C5}\TypeLib mbamservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00A73BC0-754E-44E1-B190-D59E187A5EA1} mbamservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00A73BC0-754E-44E1-B190-D59E187A5EA1} mbamservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A7FB145-B72D-466E-A3AC-21599BBE9E8C} mbamservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FC34538A-37CB-44B4-9264-533E9347BB40}\TypeLib mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MB.LogController\CurVer\ = "MB.LogController.1" mbamservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{04F8CDB5-1E26-491C-8602-D2ADE2D8E17A} mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A34647B-D9A8-40D9-B563-F9461E98030E}\ = "IUpdateControllerV8" mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8B05F69B-4F9B-4FD3-A491-16153F999E00}\ = "ISPControllerV2" mbamservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB30855D-36DF-41BD-9EEE-03BA7E8E70B7} mbamservice.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5091804-600E-4226-BF28-80ABFDF4AFAB}\TypeLib\Version = "1.0" mbamservice.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{115D004C-CC20-4945-BCC8-FE5043DD42D0}\TypeLib mbamservice.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2380 mbamtray.exe -
Suspicious behavior: CmdExeWriteProcessMemorySpam 3 IoCs
pid Process 2816 7z2201.exe 1796 7z.exe 1036 7z.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1040 powershell.exe 1984 powershell.exe 1984 powershell.exe 1984 powershell.exe 2332 mbamservice.exe 2332 mbamservice.exe 2332 mbamservice.exe 2332 mbamservice.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 468 Process not Found 468 Process not Found -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeRestorePrivilege 1796 7z.exe Token: 35 1796 7z.exe Token: SeSecurityPrivilege 1796 7z.exe Token: SeSecurityPrivilege 1796 7z.exe Token: SeRestorePrivilege 1036 7z.exe Token: 35 1036 7z.exe Token: SeSecurityPrivilege 1036 7z.exe Token: SeSecurityPrivilege 1036 7z.exe Token: SeDebugPrivilege 1040 powershell.exe Token: SeDebugPrivilege 1984 powershell.exe Token: 33 2816 mbamservice.exe Token: SeIncBasePriorityPrivilege 2816 mbamservice.exe Token: 33 2332 mbamservice.exe Token: SeIncBasePriorityPrivilege 2332 mbamservice.exe Token: SeDebugPrivilege 2072 tasklist.exe Token: SeDebugPrivilege 2684 tasklist.exe Token: SeDebugPrivilege 2532 tasklist.exe Token: SeDebugPrivilege 2596 tasklist.exe Token: SeDebugPrivilege 2500 tasklist.exe Token: SeDebugPrivilege 2252 tasklist.exe Token: SeDebugPrivilege 2952 tasklist.exe Token: SeDebugPrivilege 2988 tasklist.exe Token: SeDebugPrivilege 1676 tasklist.exe Token: SeDebugPrivilege 2408 tasklist.exe Token: SeDebugPrivilege 1596 tasklist.exe Token: SeDebugPrivilege 584 tasklist.exe Token: SeDebugPrivilege 2608 tasklist.exe Token: SeDebugPrivilege 776 tasklist.exe Token: SeDebugPrivilege 1504 tasklist.exe Token: SeDebugPrivilege 1224 tasklist.exe Token: SeDebugPrivilege 2340 tasklist.exe Token: SeDebugPrivilege 1776 tasklist.exe Token: SeDebugPrivilege 1736 tasklist.exe Token: SeDebugPrivilege 1980 tasklist.exe Token: SeDebugPrivilege 2016 tasklist.exe Token: SeDebugPrivilege 1796 tasklist.exe Token: SeDebugPrivilege 1932 tasklist.exe Token: SeDebugPrivilege 3044 tasklist.exe Token: SeDebugPrivilege 2400 tasklist.exe Token: SeDebugPrivilege 2488 tasklist.exe Token: SeRestorePrivilege 2332 mbamservice.exe Token: SeTakeOwnershipPrivilege 2332 mbamservice.exe Token: SeDebugPrivilege 2404 tasklist.exe Token: SeDebugPrivilege 2352 tasklist.exe Token: SeDebugPrivilege 1660 tasklist.exe Token: SeDebugPrivilege 2620 tasklist.exe Token: SeDebugPrivilege 2772 tasklist.exe Token: SeDebugPrivilege 2456 tasklist.exe Token: SeDebugPrivilege 2892 tasklist.exe Token: SeDebugPrivilege 2552 tasklist.exe Token: SeDebugPrivilege 2576 tasklist.exe Token: SeDebugPrivilege 1924 tasklist.exe Token: SeDebugPrivilege 2848 tasklist.exe Token: SeDebugPrivilege 2980 tasklist.exe Token: SeDebugPrivilege 1668 tasklist.exe Token: SeDebugPrivilege 1032 tasklist.exe Token: SeDebugPrivilege 372 tasklist.exe Token: SeDebugPrivilege 1488 tasklist.exe Token: SeDebugPrivilege 2836 tasklist.exe Token: SeDebugPrivilege 676 tasklist.exe Token: SeDebugPrivilege 780 tasklist.exe Token: SeDebugPrivilege 816 tasklist.exe Token: SeDebugPrivilege 1392 tasklist.exe Token: SeDebugPrivilege 876 tasklist.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2756 rs.tmp -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2380 mbamtray.exe 2380 mbamtray.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1404 wrote to memory of 2228 1404 Patch MB 4.6.x.xxx.exe 28 PID 1404 wrote to memory of 2228 1404 Patch MB 4.6.x.xxx.exe 28 PID 1404 wrote to memory of 2228 1404 Patch MB 4.6.x.xxx.exe 28 PID 2228 wrote to memory of 2816 2228 cmd.exe 30 PID 2228 wrote to memory of 2816 2228 cmd.exe 30 PID 2228 wrote to memory of 2816 2228 cmd.exe 30 PID 2228 wrote to memory of 2816 2228 cmd.exe 30 PID 2228 wrote to memory of 2816 2228 cmd.exe 30 PID 2228 wrote to memory of 2816 2228 cmd.exe 30 PID 2228 wrote to memory of 2816 2228 cmd.exe 30 PID 2228 wrote to memory of 1916 2228 cmd.exe 31 PID 2228 wrote to memory of 1916 2228 cmd.exe 31 PID 2228 wrote to memory of 1916 2228 cmd.exe 31 PID 2228 wrote to memory of 2372 2228 cmd.exe 33 PID 2228 wrote to memory of 2372 2228 cmd.exe 33 PID 2228 wrote to memory of 2372 2228 cmd.exe 33 PID 2372 wrote to memory of 1124 2372 cmd.exe 34 PID 2372 wrote to memory of 1124 2372 cmd.exe 34 PID 2372 wrote to memory of 1124 2372 cmd.exe 34 PID 2228 wrote to memory of 1496 2228 cmd.exe 35 PID 2228 wrote to memory of 1496 2228 cmd.exe 35 PID 2228 wrote to memory of 1496 2228 cmd.exe 35 PID 1496 wrote to memory of 1480 1496 cmd.exe 37 PID 1496 wrote to memory of 1480 1496 cmd.exe 37 PID 1496 wrote to memory of 1480 1496 cmd.exe 37 PID 2228 wrote to memory of 1900 2228 cmd.exe 38 PID 2228 wrote to memory of 1900 2228 cmd.exe 38 PID 2228 wrote to memory of 1900 2228 cmd.exe 38 PID 2228 wrote to memory of 1796 2228 cmd.exe 40 PID 2228 wrote to memory of 1796 2228 cmd.exe 40 PID 2228 wrote to memory of 1796 2228 cmd.exe 40 PID 2228 wrote to memory of 1796 2228 cmd.exe 40 PID 1900 wrote to memory of 1828 1900 cmd.exe 41 PID 1900 wrote to memory of 1828 1900 cmd.exe 41 PID 1900 wrote to memory of 1828 1900 cmd.exe 41 PID 1900 wrote to memory of 1376 1900 cmd.exe 42 PID 1900 wrote to memory of 1376 1900 cmd.exe 42 PID 1900 wrote to memory of 1376 1900 cmd.exe 42 PID 1900 wrote to memory of 1068 1900 cmd.exe 43 PID 1900 wrote to memory of 1068 1900 cmd.exe 43 PID 1900 wrote to memory of 1068 1900 cmd.exe 43 PID 1900 wrote to memory of 1372 1900 cmd.exe 44 PID 1900 wrote to memory of 1372 1900 cmd.exe 44 PID 1900 wrote to memory of 1372 1900 cmd.exe 44 PID 1900 wrote to memory of 1632 1900 cmd.exe 45 PID 1900 wrote to memory of 1632 1900 cmd.exe 45 PID 1900 wrote to memory of 1632 1900 cmd.exe 45 PID 1632 wrote to memory of 1168 1632 cmd.exe 46 PID 1632 wrote to memory of 1168 1632 cmd.exe 46 PID 1632 wrote to memory of 1168 1632 cmd.exe 46 PID 1632 wrote to memory of 1920 1632 cmd.exe 47 PID 1632 wrote to memory of 1920 1632 cmd.exe 47 PID 1632 wrote to memory of 1920 1632 cmd.exe 47 PID 1900 wrote to memory of 1072 1900 cmd.exe 48 PID 1900 wrote to memory of 1072 1900 cmd.exe 48 PID 1900 wrote to memory of 1072 1900 cmd.exe 48 PID 2228 wrote to memory of 1036 2228 cmd.exe 49 PID 2228 wrote to memory of 1036 2228 cmd.exe 49 PID 2228 wrote to memory of 1036 2228 cmd.exe 49 PID 2228 wrote to memory of 1036 2228 cmd.exe 49 PID 2228 wrote to memory of 1040 2228 cmd.exe 50 PID 2228 wrote to memory of 1040 2228 cmd.exe 50 PID 2228 wrote to memory of 1040 2228 cmd.exe 50 PID 1900 wrote to memory of 3008 1900 cmd.exe 51 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 1916 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Patch MB 4.6.x.xxx.exe"C:\Users\Admin\AppData\Local\Temp\Patch MB 4.6.x.xxx.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Windows\system32\cmd.execmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CA91CWUI.bat" "C:\Users\Admin\AppData\Local\Temp\Patch MB 4.6.x.xxx.exe""2⤵
- Drops file in Drivers directory
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\qbF76D059.A8\7z2201.exe"C:\Users\Admin\AppData\Local\Temp\qbF76D059.A8\7z2201.exe" /S3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:2816
-
-
C:\Windows\system32\attrib.exeattrib -r C:\Windows\System32\drivers\etc\hosts3⤵
- Drops file in Drivers directory
- Views/modifies file attributes
PID:1916
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c findstr "keystone" "C:\Windows\System32\drivers\etc\hosts"3⤵
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Windows\system32\findstr.exefindstr "keystone" "C:\Windows\System32\drivers\etc\hosts"4⤵PID:1124
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c findstr "holocron" "C:\Windows\System32\drivers\etc\hosts"3⤵
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Windows\system32\findstr.exefindstr "holocron" "C:\Windows\System32\drivers\etc\hosts"4⤵PID:1480
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\pb.cmd"3⤵
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Windows\system32\mode.commode con:cols=86 lines=364⤵PID:1828
-
-
C:\Windows\system32\chcp.comchcp 650014⤵PID:1376
-
-
C:\Windows\system32\mode.commode 70,44⤵PID:1068
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c copy/Z "C:\Users\Admin\AppData\Local\Temp\pb.cmd" nul4⤵PID:1372
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c echo prompt $H|cmd4⤵
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo prompt $H"5⤵PID:1168
-
-
C:\Windows\system32\cmd.execmd5⤵PID:1920
-
-
-
C:\Windows\system32\timeout.exetimeout.exe 54⤵
- Delays execution with timeout.exe
PID:1072
-
-
C:\Windows\system32\timeout.exetimeout.exe 54⤵
- Delays execution with timeout.exe
PID:3008
-
-
C:\Windows\system32\timeout.exetimeout.exe 54⤵
- Delays execution with timeout.exe
PID:2888
-
-
C:\Windows\system32\timeout.exetimeout.exe 54⤵
- Delays execution with timeout.exe
PID:1164
-
-
C:\Windows\system32\timeout.exetimeout.exe 54⤵
- Delays execution with timeout.exe
PID:2080
-
-
C:\Windows\system32\timeout.exetimeout.exe 54⤵
- Delays execution with timeout.exe
PID:2624
-
-
C:\Windows\system32\timeout.exetimeout.exe 54⤵
- Delays execution with timeout.exe
PID:2764
-
-
C:\Windows\system32\timeout.exetimeout.exe 54⤵
- Delays execution with timeout.exe
PID:2740
-
-
C:\Windows\system32\timeout.exetimeout.exe 54⤵
- Delays execution with timeout.exe
PID:2488
-
-
C:\Windows\system32\timeout.exetimeout.exe 54⤵
- Delays execution with timeout.exe
PID:2244
-
-
C:\Windows\system32\timeout.exetimeout.exe 54⤵
- Delays execution with timeout.exe
PID:2004
-
-
C:\Windows\system32\timeout.exetimeout.exe 54⤵
- Delays execution with timeout.exe
PID:2684
-
-
C:\Windows\system32\timeout.exetimeout.exe 54⤵
- Delays execution with timeout.exe
PID:2628
-
-
C:\Windows\system32\timeout.exetimeout.exe 54⤵
- Delays execution with timeout.exe
PID:2968 -
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Suspicious use of AdjustPrivilegeToken
PID:2252
-
-
-
C:\Windows\system32\timeout.exetimeout.exe 54⤵
- Delays execution with timeout.exe
PID:2976
-
-
C:\Windows\system32\timeout.exetimeout.exe 54⤵
- Delays execution with timeout.exe
PID:2692
-
-
C:\Windows\system32\timeout.exetimeout.exe 54⤵
- Delays execution with timeout.exe
PID:1328
-
-
C:\Windows\system32\timeout.exetimeout.exe 54⤵
- Delays execution with timeout.exe
PID:2044
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2764
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Suspicious use of AdjustPrivilegeToken
PID:2072
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1184
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Suspicious use of AdjustPrivilegeToken
PID:2684
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2520
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Suspicious use of AdjustPrivilegeToken
PID:2532
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2592
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Suspicious use of AdjustPrivilegeToken
PID:2596
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:864
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Suspicious use of AdjustPrivilegeToken
PID:2500
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2968
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2860
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Suspicious use of AdjustPrivilegeToken
PID:2952
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1648
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Suspicious use of AdjustPrivilegeToken
PID:2988
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:892
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Suspicious use of AdjustPrivilegeToken
PID:1676
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1732
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Suspicious use of AdjustPrivilegeToken
PID:2408
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1688
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Suspicious use of AdjustPrivilegeToken
PID:1596
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2580
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Suspicious use of AdjustPrivilegeToken
PID:584
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2824
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2608
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:688
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Suspicious use of AdjustPrivilegeToken
PID:776
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1348
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Suspicious use of AdjustPrivilegeToken
PID:1504
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:856
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1224
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2344
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2116
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Suspicious use of AdjustPrivilegeToken
PID:1776
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1912
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1736
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2416
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1980
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1060
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2016
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2916
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Suspicious use of AdjustPrivilegeToken
PID:1796
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2220
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1932
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2912
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:3044
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2996
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Suspicious use of AdjustPrivilegeToken
PID:2400
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2144
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2488
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2812
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Suspicious use of AdjustPrivilegeToken
PID:2404
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1696
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Suspicious use of AdjustPrivilegeToken
PID:2352
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2068
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Suspicious use of AdjustPrivilegeToken
PID:1660
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2188
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Suspicious use of AdjustPrivilegeToken
PID:2620
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2760
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2772
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2828
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Suspicious use of AdjustPrivilegeToken
PID:2456
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2528
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Suspicious use of AdjustPrivilegeToken
PID:2892
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2564
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Suspicious use of AdjustPrivilegeToken
PID:2552
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2964
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1220
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Suspicious use of AdjustPrivilegeToken
PID:1924
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2864
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2848
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1656
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Suspicious use of AdjustPrivilegeToken
PID:2980
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1968
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1668
-
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2844
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2184
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Suspicious use of AdjustPrivilegeToken
PID:1032
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1600
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Suspicious use of AdjustPrivilegeToken
PID:372
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1576
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1488
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2700
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2836
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:268
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Suspicious use of AdjustPrivilegeToken
PID:676
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:340
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1452
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Suspicious use of AdjustPrivilegeToken
PID:816
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1528
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Suspicious use of AdjustPrivilegeToken
PID:1392
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1740
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Suspicious use of AdjustPrivilegeToken
PID:876
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2364
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:2020
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3036
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1776
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2372
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:912
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1376
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:964
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:748
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1632
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1972
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:440
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1664
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:2932
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:916
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2300
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2912
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:2888
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2012
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1108
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:2488
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1616
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2404
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2352
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1696
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1660
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2068
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2640
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2620
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2040
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2004
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2496
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:2360
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2852
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2684
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2524
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2540
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3000
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2592
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2964
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2976
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1220
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:2968
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2864
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2432
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1656
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2160
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:280
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:540
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:528
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2036
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1688
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2192
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2580
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:2780
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2824
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:2608
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2992
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:532
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:340
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:1476
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1452
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:620
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2340
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2108
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2128
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1124
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2156
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2116
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1396
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1828
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1636
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1956
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1252
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:1168
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2152
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:2916
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:960
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1932
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3044
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:952
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2224
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1044
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1720
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2996
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:580
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2076
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3012
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2384
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1616
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2388
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2352
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:2800
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1660
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2560
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2640
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2760
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2040
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:2828
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2544
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2564
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2520
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2960
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1144
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1924
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2964
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2848
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1220
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1544
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2864
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2844
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1668
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2160
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1032
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:540
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:372
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2036
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1488
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2192
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2724
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:592
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:324
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:2716
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:776
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:688
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1148
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:616
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1224
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2692
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2248
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2108
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3036
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1776
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2156
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1068
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1632
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1168
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:596
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:896
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3044
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1004
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2996
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:1720
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2076
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:580
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2612
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:2244
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2800
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2352
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2560
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:1660
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2852
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2540
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2312
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:1924
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2428
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1652
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1544
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1968
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1092
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:2160
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:540
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:1032
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2408
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:2192
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2580
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:592
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2708
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2716
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2492
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:688
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1476
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1896
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1916
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:2056
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1480
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1748
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1912
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1836
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1052
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2920
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1796
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:1060
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1932
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2436
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2300
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2740
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3016
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:2236
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1040
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:1696
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1992
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:276
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1340
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:928
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:932
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2684
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2560
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:2552
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2524
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2596
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1944
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:2968
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2952
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:2860
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2508
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1936
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1676
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2864
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2036
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:1888
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:872
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:592
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1828
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1836
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1980
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:440
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1060
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1784
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2740
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2300
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2348
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2936
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2360
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2044
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:760
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2848
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1652
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2988
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:584
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:1488
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:688
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:1172
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2476
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:1496
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2156
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:1836
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2932
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1932
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2216
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:2612
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2676
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:1240
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2104
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:2072
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1944
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1288
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1364
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1596
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1640
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2724
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2108
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1396
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1480
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1392
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2200
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:596
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2144
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:2052
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2880
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2436
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2308
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2348
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2244
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:3012
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:276
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2772
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2500
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2552
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2432
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2528
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2680
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2104
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2508
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1220
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2184
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1884
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1288
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1944
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1628
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2408
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:780
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:676
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2708
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1488
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1752
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1452
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2640
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:3036
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2992
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:816
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2288
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2836
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:964
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2372
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1896
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:1148
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1636
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:440
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1980
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:1976
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1776
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2220
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2920
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:896
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2740
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2404
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:596
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2200
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:3068
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2052
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1108
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2800
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2068
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:1040
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1240
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:936
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2516
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1644
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2312
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1432
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2520
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2956
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:928
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1936
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2680
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1968
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2508
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:1092
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1884
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵PID:2184
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1652
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:1944
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:2700
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:372
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh4⤵PID:1504
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh5⤵
- Enumerates processes with tasklist
PID:324
-
-
-
-
C:\Program Files (x86)\7-Zip\7z.exe"C:\Program Files (x86)\7-Zip\7z.exe" x "C:\Users\Admin\AppData\Local\Temp\qbF76D059.A8\ck.7z" -o"C:\ProgramData" -pnghfvjdfnhmgfdfGDFGdfkjxhfsdg6ujdshjflksd -y3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of AdjustPrivilegeToken
PID:1796
-
-
C:\Program Files (x86)\7-Zip\7z.exe"C:\Program Files (x86)\7-Zip\7z.exe" x "C:\Users\Admin\AppData\Local\Temp\qbF76D059.A8\rs.7z" -o"C:\Users\Admin\AppData\Local\Temp" -pFHFiuhyt6gfhjdgdgfduh675rgkhidfgHFDSSyg6f5s7dg -y3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of AdjustPrivilegeToken
PID:1036
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell start-process -FilePath 'C:\Program Files\Malwarebytes\Anti-Malware\unins000.exe' -ArgumentList '/VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-' -NoNewWindow -Wait3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1040
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell start-process -FilePath 'C:\Users\Admin\AppData\Local\Temp\rs.exe' -ArgumentList '/VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-' -NoNewWindow -Wait3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\rs.exe"C:\Users\Admin\AppData\Local\Temp\rs.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\is-VRVGI.tmp\rs.tmp"C:\Users\Admin\AppData\Local\Temp\is-VRVGI.tmp\rs.tmp" /SL5="$70160,63820596,239616,C:\Users\Admin\AppData\Local\Temp\rs.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-5⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
PID:2756 -
C:\Windows\system32\certutil.exe"certutil.exe" -f -addStore root "C:\Users\Admin\AppData\Local\Temp\is-12HP9.tmp\BaltimoreCyberTrustRoot.crt"6⤵PID:876
-
-
C:\Windows\system32\certutil.exe"certutil.exe" -f -addStore root "C:\Users\Admin\AppData\Local\Temp\is-12HP9.tmp\DigiCertEVRoot.crt"6⤵PID:2020
-
-
C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe"C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe" /service6⤵
- Executes dropped EXE
- Registers COM server for autorun
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2816
-
-
-
-
-
-
C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe"C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe"1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2332 -
C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe"C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2380
-
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2340
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2576
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh1⤵
- Suspicious use of AdjustPrivilegeToken
PID:780
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh1⤵PID:2400
-
C:\Windows\system32\tasklist.exetasklist /fi "imagename eq mbamtray.exe" /fo csv /nh1⤵PID:2848
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD5a2cc0a771f7507d28d4ea0131695186a
SHA1e31043104a102b636374bef2a5f92c75ccc36fc1
SHA2562d9b0f8632c6df2ec2aa1e75d839a6d61128a7724b5509f939078f3a52005e92
SHA5128a1ec52dafe9c7c102ec88df8a95245956238246e1be89b46361ff6d4d69358b08c7fad8fc50d83f59ea6e887e543f53b51eca58d816c3b2d348e57b6a2f283d
-
Filesize
5.4MB
MD51aa36b41e437501f20ba879d9c23ed3c
SHA10f8ec29c321e0c96fb3bd3d8c51945ce70199490
SHA25686f81665b233c7bb75ea5b986edcb486ce92faf38d670d63632eb23875b32b40
SHA5122db53b44c47daabf74229755cfa9621cee8bb397042a8b8dc7e0748b366f42ff866a9e97562e5dea012f3d1741debbd5152debaadefa5060eb9f32a4bc1507f9
-
Filesize
3.4MB
MD5447926609e3228ff943c3cde0ed1692d
SHA1adbe95d3682677fa6583892124574d0f14ef1bc7
SHA256a50580cfb78676285130ca13fa052df96cd6d1bf639be78a9739a2db4fab2944
SHA512a1277c4c5da9f1801308db96365f413866ff250b38a338e8e93565f658bf2d3ea4dcd8f7820194b21eced4778b1694cdece85a51e2380548e5ace8a1a795726f
-
Filesize
3.6MB
MD5907cd3b4605457a0fcc4c884fbb85c80
SHA16aeeca92f5ccf58b86bb1d5b2d0babe0b4e432b1
SHA2562a12a8240f416ed00329b6ea3e2d01bf759d758b59c6e87ed22d1ebe71818a2d
SHA51287251b2ba3f7a2b4e07d9c89026a53707125ce11814131612abf231c6c34239b02e1567eccb8cefededce95cfa70e8501c5c6049f8aa967d7fde917ff13c0791
-
Filesize
2.4MB
MD569d87ada8d240550d7469e5ce7c75369
SHA1bb3422b1dc462922b6a24eee46629b89a590d327
SHA256b44957becd817bb9febcfc627627709916c82f366eecac6e71e630e5bffafc79
SHA512bb91fb0540a861155e5b3d28f109b4bb7f6b6f1d3138391bab382d0750c1968672c163c1cdab226fe3a819e36d6307ec2df94e3539918bec5b55c34214437a58
-
Filesize
4.0MB
MD555ef5563825fda3ab05cbee48bb5cc99
SHA1fcb57cb21714edfc7e59671e9b3a6d9842a988da
SHA2563417da91c99c3a4f99c268dd94ca61e59a76340102af54ff984cbf8f339e24d5
SHA51273891411be688711ee86b9759eeeb6c66799892f0dc9f668d8233aee95e6b397cf0434463308d6af77c4b592fe5b71dbdd7de031ce3d071657d29dff64c51ad1
-
Filesize
3.5MB
MD5235404716813d5b32d26fd17aed9112b
SHA1c77d3fde646cc07c274cbc2318fd884a6c8a4f36
SHA256ffff47710970e3bcd5e8c2a28867a2e2dc0c01278a531223e535efabea528781
SHA5126aecc1de3cb86d25b66e81badc7b6966d42fcc72925414594e550bb7e71d569835001fac2e5b6ee179307545bc395717c963110ca7c69f0bbd55b9132a11e5eb
-
Filesize
2.3MB
MD5439e2f41cc91de42214d5ca2ea69ecd1
SHA1538bbdb5d0b7e563dbe1b1938e676a64b829b9c0
SHA25694a820e238024dc5c65785b37141020078eed9b170be4389f085577637b538df
SHA5128b9ea8e345150a140e82ac53424bf4aa8c5d05879034b7057e453fa3840a4fb4e09998f43c67090084c72cbcd7499fa145141fbfe56599ef25ce62f84092bd04
-
Filesize
51B
MD5bf86796fe0fb92b34e5f1100d5eb3bb5
SHA1bc10ef8edff446a9aae29a70be7fdb380979f916
SHA2562fc07c3fc5e834495d3f76b3f4b6454c57e78eb928cdd343b863d8170f00ed67
SHA512ef0c5e7ad46e9dd5dbe3741595b5887b34b75eab30de27343b02e68f0430e8a8cc7c79791f3a0ac1871d362eef3bd34f9bd4ac54e77a95ad1d1f2e1c65a10cbe
-
Filesize
47B
MD5f87ee333fc7093fb0a7d0bf86acde081
SHA18e5634b4eaf7ad9201be8fb04fd3ed734d3c5a28
SHA256e5ef72fb7af61be42f9f833f5e532ff4128a26e73920832ca87c5f00164e74a7
SHA5128530fb2efaa8de0c7f2a102a44fd4a035fbe9a06040290820fe0480e8f9bea2295695cce253023b92ad8ac0f2fe9563a6a0cd10e423e1c2e1fa212146276533f
-
Filesize
6KB
MD55911ef94fd6b13ed00581e68c1888868
SHA18b37fd447f0086716482cd17a8266a13e4b04373
SHA256c39c8c860e7d7c27da3a2709fd1c72a196159c1f64efa32cbdab70a71f70b9e5
SHA512a7b5fc81362287e89360a726225e6ba5789ad7bab10d4051b58038f296affb15fed2a25e19073706daa9d7444c1ff7fc6d66116ab3f641de60bba4ff2ed77f9b
-
Filesize
698B
MD53f7e99cb253f3210546d94d80422b62f
SHA10ae028e55e6a636224fc100f9644e6671b9e9c78
SHA2563d34c7774585a4979194979c316c6f776cd59b8beee42e4d442f977ecf01ed51
SHA512a061e2250c48310b425e2dfaa882a400a4f4d41c72e8ebd6aa308177e19befa130daf5a91cb6222f1cc714a3d52fc886e921820b510812dd7ce8f7a8b54571aa
-
Filesize
25KB
MD57dfb5c0eaea1770ebfc2eefdc6c53984
SHA1cb9aa1c4ef2822804d0bc7a3c82a1c37d5d3e3e9
SHA25623f940ef5a24cd7dd402acbd2e1af30eca8bef3ab690954b6b42336230c4e2c6
SHA5123f8777ad4f5e4d8ca6653ec550779493249cc5139209334a928b1e4a9805550b0e63d4d2812c4d642e11749536a8526c068ca2b9bbb3aaa6cbbbf3ab310d3828
-
Filesize
19KB
MD5d414dd9460451d48b8855871aa637c32
SHA145f8609604413e9d73898213fbad3a642268c0bf
SHA256a3bc9af123557aa9bc32c144f67716fd0d29182c4417012dbbd633414e4fb022
SHA51283ed97236658fd44ac4a52a9e5540f9f13f4d4331c23df8a6da7e8f9c526b5002351382fb95db94291fb0a8548880b7fe8174a4952c4f9153ac5a6533c832658
-
Filesize
514B
MD5aa3afff21234e7e02bf403ec37afcfc2
SHA133bd8d15a594b7636e9f2700ba9cebb2724b8a13
SHA256bdaa821c1a821182f6487ac6071e84e8dd556e03a666a6020482857412f5c1eb
SHA51202ca76bc58391980ce771d28e365c265dbdaf601979c395cae03d4b5566798cf3e86d815eba0b9e894973dac8ce5de65f04dcf8120bb75e666123dfde0bbfd4c
-
Filesize
24B
MD5546d9e30eadad8b22f5b3ffa875144bf
SHA13b323ffef009bfe0662c2bd30bb06af6dfc68e4d
SHA2566089fbf0c0c1413f62e91dc9497bedc6d8a271e9dc761e20adc0dccf6f4a0c1f
SHA5123478f5dcf7af549dd6fe48ad714604200de84a90120b16a32233b6d44fa7240f5f4e5fe803f54b86bbdfd10fa1bfdd88fb85eb6a78e23e426933f98d0a2565ec
-
Filesize
24B
MD52f7423ca7c6a0f1339980f3c8c7de9f8
SHA1102c77faa28885354cfe6725d987bc23bc7108ba
SHA256850a4ea37a0fd6f68bf95422d502b2d1257264eb90cc38c0a3b1b95aa375be55
SHA512e922ac8a7a2cde6d387f8698207cf5efbd45b646986a090e3549d97a7d552dd74179bd7ac20b7d246ca49d340c4c168982c65b4749df760857810b2358e7eb69
-
Filesize
13.0MB
MD5972580b82977e6839c1d9d446aefae91
SHA1270299d2c7cebbc4aedfc0fb026464173a180338
SHA25615ebbb78babf27890e1f1a21f19aef17526228c6e3036afed3ab52cf08817635
SHA512d74ec32a12aa60ba99df74dd0c2739a5c14b3364828edd9d792581b9b6d33641921954de707406f065756f400a3ad289f8a0ad168308d7539fa7278b17a1b3f5
-
Filesize
1.7MB
MD5ae319980ed5faee5da8218090dcab76d
SHA1e3ad12b88d75fba177f998980d0bb7c5dc7316c5
SHA256eb2a5ee0a18ad657857a93c8081135b153c988a5c90c0fd26dce27485007733e
SHA512e04b4ae6f955e68b3e6fad1ef3335f7c07843fd4a86bc21b70fdd02e6cc651038db73ee2e9a72dcb9eae1e075bc7a62b812ca2e0ef914917c58f91f1b5922779
-
Filesize
210KB
MD5f6346928fe21142b74e53597202b8f22
SHA13ef1040f74dbc827482f36c93dddc25787bce771
SHA2568d0440bae63e17705df3afc9e6d6be05984a7507acc1e896fc101b2fb3d4217d
SHA512414496582536af734ceec8dadb3ad6551c8739aa9e37de33a5317a9e7554af2b2d1511af2525c44491f7404d20c673d311de998d2ac182ac2a7d5a19038bbaf9
-
Filesize
4.1MB
MD549354a2d3f5aa13590ca9a421a9c3838
SHA176603a2f89ca8f7346f8b7508a3f8fbefe768cc4
SHA2567303fc7c79cddf6ab2f96e23717e8bf352b8cbdf9d063aa62d3c1cf6fdfa09d0
SHA512efc11a7128bea910d0e17e2429612f5ca657b7fb953ce0439a0cb5e48e6e2a306e28945b29291e0066bd4b6787b89b05842b3d68aa225df9fd07bb48c959dfba
-
Filesize
1.2MB
MD5a65e53c974a4e61728ecb632339a0978
SHA127e6ec4f8e34b40f1e08503245700c182b918ce9
SHA256ca8ab5aeef734f24a3c58bf10b3f0152c2ea1329b02d2730448693df563b4c6a
SHA512b029962f08867496cd3fd5e9af4b0703dae918e938aee759aeffbb4184ea6d3e81e0878ba8957e80d30db5d7b6fc8598e68918a4d16b3d010f31a2e16417593e
-
Filesize
329KB
MD562d2156e3ca8387964f7aa13dd1ccd5b
SHA1a5067e046ed9ea5512c94d1d17c394d6cf89ccca
SHA25659cbfba941d3ac0238219daa11c93969489b40f1e8b38fabdb5805ac3dd72bfa
SHA512006f7c46021f339b6cbf9f0b80cffa74abb8d48e12986266d069738c4e6bdb799bfba4b8ee4565a01e90dbe679a96a2399d795a6ead6eacbb4818a155858bf60
-
Filesize
329KB
MD562d2156e3ca8387964f7aa13dd1ccd5b
SHA1a5067e046ed9ea5512c94d1d17c394d6cf89ccca
SHA25659cbfba941d3ac0238219daa11c93969489b40f1e8b38fabdb5805ac3dd72bfa
SHA512006f7c46021f339b6cbf9f0b80cffa74abb8d48e12986266d069738c4e6bdb799bfba4b8ee4565a01e90dbe679a96a2399d795a6ead6eacbb4818a155858bf60
-
Filesize
329KB
MD562d2156e3ca8387964f7aa13dd1ccd5b
SHA1a5067e046ed9ea5512c94d1d17c394d6cf89ccca
SHA25659cbfba941d3ac0238219daa11c93969489b40f1e8b38fabdb5805ac3dd72bfa
SHA512006f7c46021f339b6cbf9f0b80cffa74abb8d48e12986266d069738c4e6bdb799bfba4b8ee4565a01e90dbe679a96a2399d795a6ead6eacbb4818a155858bf60
-
Filesize
256KB
MD509a3995806569a7d3fdb05e54ea815ac
SHA1f6ea0bd03ef8d01fe92a63c750586b86ccdf7253
SHA2569e8a6672431aa5b805091c3e08f89417b7ba9ab931a031f3ff9641efccc6ed3f
SHA5120d76fe4b70225bbb2bcbf6734ae0a238a9b5b93eb53c6ed5feee30674c5dab79deb0b222100cf27bb8a1035832c3be153e900fe6a6703829a133126a57a76144
-
Filesize
6.4MB
MD5327cb21b41ce523e2faba8e17ab24404
SHA16dcf3b4a21433b7f365e16a89a131e17e1de4cef
SHA256638d1e4201f7e8e0f5aae7d880fda02874cbbee98eff48e9e1fd0291451a0ac9
SHA512f445f6020997ebbf513f9a470576a84d4b93823e2e143daa7408e7bac83276cb75f8e37c31046482a1aaf1380d6b27218be5b85b045ad6c3200baa7855e68028
-
Filesize
6.4MB
MD5327cb21b41ce523e2faba8e17ab24404
SHA16dcf3b4a21433b7f365e16a89a131e17e1de4cef
SHA256638d1e4201f7e8e0f5aae7d880fda02874cbbee98eff48e9e1fd0291451a0ac9
SHA512f445f6020997ebbf513f9a470576a84d4b93823e2e143daa7408e7bac83276cb75f8e37c31046482a1aaf1380d6b27218be5b85b045ad6c3200baa7855e68028
-
Filesize
607B
MD5abab69be6c890ed6f56df28be30c90cd
SHA15cbcab45923f37875b243ad0178820e6ea5b6aa4
SHA256d484e7287a25c0f8cf732053764d6fb353576959b866da4c82f46ca0c4e86654
SHA512cc36491c3275fa91fb8cf16022bdd3cd30106135a0c5f7531f984c6088ef66ec2dd63f5d14259d2a5788b3efa52860d8f0babdb5b6d6f30272a6bebc5e7f1d27
-
Filesize
607B
MD5abab69be6c890ed6f56df28be30c90cd
SHA15cbcab45923f37875b243ad0178820e6ea5b6aa4
SHA256d484e7287a25c0f8cf732053764d6fb353576959b866da4c82f46ca0c4e86654
SHA512cc36491c3275fa91fb8cf16022bdd3cd30106135a0c5f7531f984c6088ef66ec2dd63f5d14259d2a5788b3efa52860d8f0babdb5b6d6f30272a6bebc5e7f1d27
-
Filesize
607B
MD5abab69be6c890ed6f56df28be30c90cd
SHA15cbcab45923f37875b243ad0178820e6ea5b6aa4
SHA256d484e7287a25c0f8cf732053764d6fb353576959b866da4c82f46ca0c4e86654
SHA512cc36491c3275fa91fb8cf16022bdd3cd30106135a0c5f7531f984c6088ef66ec2dd63f5d14259d2a5788b3efa52860d8f0babdb5b6d6f30272a6bebc5e7f1d27
-
Filesize
8.4MB
MD50ef8c690deab2e93b2cff1aaa5302065
SHA1469b8673542ae6bdd6467d0a83123704ea6a0306
SHA2560dc6596eeda04c2f82bf232059aaf675d461d6302710a14fbf0b895ae44bac6e
SHA5123244b549381d7e9db957f1c06f2c2b81be0fdaf67e5c706f499d80819e016841e19cc55e252adef29e9b95007f8bd9ddb5bdae868bb98fac31e0ae5da1c87b6d
-
Filesize
6.4MB
MD5327cb21b41ce523e2faba8e17ab24404
SHA16dcf3b4a21433b7f365e16a89a131e17e1de4cef
SHA256638d1e4201f7e8e0f5aae7d880fda02874cbbee98eff48e9e1fd0291451a0ac9
SHA512f445f6020997ebbf513f9a470576a84d4b93823e2e143daa7408e7bac83276cb75f8e37c31046482a1aaf1380d6b27218be5b85b045ad6c3200baa7855e68028
-
Filesize
2.3MB
MD5439e2f41cc91de42214d5ca2ea69ecd1
SHA1538bbdb5d0b7e563dbe1b1938e676a64b829b9c0
SHA25694a820e238024dc5c65785b37141020078eed9b170be4389f085577637b538df
SHA5128b9ea8e345150a140e82ac53424bf4aa8c5d05879034b7057e453fa3840a4fb4e09998f43c67090084c72cbcd7499fa145141fbfe56599ef25ce62f84092bd04
-
Filesize
2KB
MD50ff3f3ba83e1dc78aa42e205e1a01867
SHA10a557f31af77bfccccd9530227d593efb4809fd2
SHA2569c5dad17bd0878115a88a4c94405fbd9048294462eea474f265ddddedc90771e
SHA51280543530d28722b926d3aeda4a0c61fc5bea1812e38a3a1b7b84a5a1803c078bc54c32eff23b96766fd5e27301818f105d86235cdddbaa0dc51ac347ed3d7dfd
-
Filesize
268KB
MD5303f8c619d472c98754b369e582f8e17
SHA171b32fb7b9faa4747be0c98a41fc88466e981b08
SHA2561d5ec9dd832ea97b5984939605897749c786094460cbd731ac2c44712b65cf0c
SHA51272241900cccbac3c19193f54649ff9bd89537a29df29d859f1358457ec9976c4b2a5ce8362b3438c7ad7feb8fb3c47cee00dbddb6e408259f8d45d7d9f30dda1
-
Filesize
219KB
MD5e271a915b084d17c4b18c26f8eb62ec9
SHA128638ae1c1cc5b04fb0f13d7b91c32847c2ae8bd
SHA2561d498436bb314813551704a3e46570cb3216224d6dae5473598df0cec3c5577b
SHA51266edec305631440f8f8ae3b75eae8c165b5d8c86e7cb3ebb947e6517c6fca45c005f6f7f77adec6f2bd2e7e9c55dfeaedfc2f10c7187a64904062b2d124ed8fd
-
Filesize
195KB
MD5af6d573ff797ace9f62cf693a18ce8af
SHA1c947458393289e420762f005bc8d8a7e8c905f3c
SHA2560c7c976d097788650cdd4440a421fc5f80e6a3ab33445e7e8ac49bd0d999fea0
SHA5125284ce3a008b4d5504dc17c96510aa0df416c08a9b57206982fc2b1b190535c52975827fded4fce7f09160deb8edf7417be665656145b085b4ecae7c503e950c
-
Filesize
103KB
MD5a75668ae39a80bcf4c12c0ebcc729ab8
SHA1b9b8f6a2265683e8d2940b787e94491e7cf96b1b
SHA256e2e1f6cc9e58679e99287bc6daaaed2ad6cb9f42a11db48b90b739505d5045a1
SHA512bf8f6c86a7d479eab3bf3aaae57ea8db478d5e785682a54541adbdaebe0176c66a7f770f3f82398333816c4b1635d0f769f99f97a2cc98c5b333ba7b07ade4ea
-
Filesize
3.0MB
MD5b55493d2b5f93a41c51811448ccd6975
SHA1584dc786acbb05e09062b98a7d976c9da17aa3a4
SHA2562cbba30b1ab1713a9320c18f9bb0c396f89fdba9ccb89f34dd9a12de2c81f405
SHA512e8f1aa0efa5c7fc3cfe6063c2600d70db1c7cb399b11f443c2575d054b531b856987ca19e9a4ba63161270046ac4dfe85e5675af0f49b722af0071629c0eb8d1
-
Filesize
1.3MB
MD584c6d2d33ed6f1aa356bca1d354448ab
SHA1e70b4058ed0389fb8482ee3cb2dc04334b6bb053
SHA256efe20d9f6b1427f69c61e3e128e576cf24a0b930903b1ff8fe7fdf3852d106c5
SHA51291e2fa7ae39523c5fb70d49ac3e33aacaa209827f95082b4c812b82c3a1733e1826f69b550d39c68b9ab6b0633bad9b02499bcd26971e971d7825af6eedf43fb
-
Filesize
41KB
MD5fe9d01538d5119a843ae91f18e66bf6c
SHA17b82cad7882cb8b84eac377958174cac0d96291f
SHA2563cd551d2d0be738f11f73d0085f65b3f06d326307d41c7625d057a6573468fa1
SHA512288880c88e9e2154d31d55d9397350c7ec5e0be79e995eebad3a3e7a7da3fa54b395870744b6a96fa2e9cfc248df6bd35562f1c24ac69c9d17357d8b751347e1
-
Filesize
53KB
MD50f66bb4682f847a05e4c1ab1cbd0a737
SHA1755844c12955f3b8f2b13b3d6f6ee10d0f5acb90
SHA256266794a9ff205487f3f22035bf9b1c70159fee47741c3d862cda47f1aa2e7fdb
SHA5128c47205ae8253cc41e07b60e990b05ea1543f50fc4abd4ad0058551d63f5863960799c14f2cc839eb9ab7f934a24d18aa5a5b783df864a158288c98f7b9316c6
-
Filesize
243B
MD5ca214577ce825f474bd0d94e86594f0e
SHA199a4b876f3404e7d64d4ae61843d6778fe4c500a
SHA2567cca5dfabd4a0f6aad7cf2bc61fa197f4d470c5580ea8746f59ce48ed8d6cd27
SHA51206973330769e4181992c6c3bf9e876c0876fae1fd5ee0a58ed338242de26d25a05fa5ce44d20e39db8d51f2b7e56c64fda130aa86875c9bce1759c6bef66f329
-
Filesize
10KB
MD578b5ed4cc99e7814ddd8b63e82a1b52d
SHA13bde4abf40b42b57fba413118eb165cc4884c448
SHA25692a08d2284ab0e404a179c3750b220974e28615fbd8eed398e074d61c5de057f
SHA5128a306e085143a1164552612368e6c321cc0ba94ca5edf1b26f97387114ef07bf69b8b7e5c7ecb92de1030003bf4154e05326bf88183d2eddabe74a1983ef84ba
-
Filesize
1KB
MD506f504a8c9e3dbbe6e413a3ee7facab3
SHA1548ad31134a5b45aa7188845b38f8a1fa4445830
SHA2561c70cffdfe08b4ec94f721723506b839dbf243db95a4ed4287986bb9d8423535
SHA512a9e50ac9a96c74e70f4d64867ec0ad1e4007bf6806e7f87af7ea475b7834b582f4210083b6fa51ef76f2d3b24689218961b22acd606f2f30e3467e4044174772
-
Filesize
645B
MD5d03619257e05b37a97f25e3448312475
SHA1ae7fc6fb9766aca88b796815490ac13bca5ae361
SHA25669bfd18f159be0de72500fa98033a61473e19c99b3f6ea5a7cbb0edf6cb62608
SHA512e2eedd5d439ea9833ec8602ec7a610f7b3e8f3b41a01b4347bd3ec3a559a3496f67642cecc04acf3f75ce87cdab6b982913753936ef140f285b15866a2b8c8f4
-
Filesize
645B
MD59f782aae58c64a19130ffea10cc2c232
SHA1915b770186e19329808f165741e6a6e41bf90e05
SHA256c9f5f3ad386b799326d6bacf50ff004f11d647c2e9799b2b1b795a95a730ae9c
SHA512a1c2b622d98f2eeb520b8730fc699b7eb137445a179ef7d4dbed44072fcd1e889419ca23ae74f084bbea04bbe9ee5f43db83b7921ec11fc9344a877e4bc09b45
-
Filesize
5KB
MD531410fd278f664219aa3c98722210909
SHA1586a0cc56863027aa0b7c5a7d6aa597256c0fc93
SHA256b113b7bdaa077dae1f7ccb2efa4206e33f895e0fd6af29230df9e9edb7dc8ab0
SHA512799800491a87861a21e1f2ccc7cb11d1d11b533817b4c6105b81874238e3dfa30f1f53535e0c8a9bf812ebe4614efeb414076d41d131dffb403a5ae6cb65d19e
-
Filesize
8KB
MD5322b5f6e4b66be1d7fe3fecab8d2e6bd
SHA1b82c86e44b4321c08076acfea5482ec6581c97aa
SHA2565310abdfcdd3ce2e4c827363ba87ad93ddd339c19df13545cd2043c03e5c3189
SHA512e5d653d71e8ab1e871d6b1c579e72e3c70040cdeffa1a82e3e851168d2fd1e7f741985c029a2674f02b74eeecb483b2883d793282342ee962c85850171e22f15
-
Filesize
1KB
MD502b73c7a3a28ebb6b83759996780e45a
SHA191562da05e88027b526bea7d57482a32fc87cb7c
SHA256633c58522613768536e6ff92ce7a3218403cc5b72fc857933e7e399801620df3
SHA5126ae0f1634f4811d011086e32cf60d08ee73f1672485fb33500bf9e1be4af3d88be085b5b50db3b0e38fa10910c7252f6fc07cc61a83f25bc423996aab2e542f1
-
Filesize
1KB
MD560e60f172c5eb0b2259be8f2c9bfd684
SHA1a944a25518ec3ac805a3edc9915ff5416ba70fed
SHA2565d16d70c0caa3fd971c39cbfa5741cbb21fb49be17d33ea9d0a5f74759c96d6b
SHA5123c0e8d4200fe29109188966036458c89224beb22f26a5b35e235dc6447bcfb814e7016b8a9c3d01f167594758cd1c97fa5638f40b5c35fb02ec0f37a028f6591
-
Filesize
1KB
MD5f1144d8121392a5f264ecd503a7b1813
SHA123b6e1eeb626795a2dcecc32e2b8706e72eb004a
SHA256514120d1460c1e66ce05886d5e83a1b49b52ee1885c6fd304ded8a456433370c
SHA512f7ca7e88a637eca157ecd3516bffd6564ddbabf5baee84f3f2b293584e983da40375561346ea06c7d8fc6d6001061adc0dbc24c4036a9003a7845e9e7b033c4f
-
Filesize
1KB
MD56862738932df3eaea2ed009d525a4c48
SHA171471bd035317c0ef06dad9fc010509b11571099
SHA25621fe9e60668d30361c2a4c284c59001f3fe2fd048f5dc96f7d9812153eac1b35
SHA512202d683de712cc8c47b81f0afba87135e7a571fe799c275c7d100095275ad82cf12012feb85927ce566919b3613988b2e3345fd89ce318034471985f9d22e3e7
-
Filesize
1KB
MD50e4c479a9cb5bdb5552ef797d488a64b
SHA1978efc02edab033831216b59c2d3fdbe34c535f7
SHA2565b79114a8d0d39ec063301e07ead92dfd241f0b2290d43ce78b07db3a7e3e5c0
SHA5125f0d89044a6e82544df9c5cfa02b3e5a6c154728bd8c257fda678609650462bd48e831a2410dc8ed46d0680216f891d44214db8c55bbbe31e112478c85d15c60
-
Filesize
338B
MD5df17ecbc78640dce98806089df24c285
SHA1d17ccaa0d36125090538b393e69e457998991e57
SHA256e7f2873502f1529fcfd0487c5edd52eaf87aaae3a0945c7b204266f151f48fb9
SHA5125ce9eafee27ed55432cc2697a2b34deb7422aa3405b7282eeb642bff47d7818c918465853bc5600ccc0d5609b3b78c097f8b3d9aa8775cb13ca12ba02bdd149f
-
Filesize
68KB
MD51250c076f0abb5150ed5fe344aa5c277
SHA14e3a74baa775dd7198e474c439004b709028a61a
SHA256a549b1b87a55f34fced5124fa8fe05fd818fe98d89cc3e0647c6c06c4bb127cf
SHA512c41989acfc2fd67391c3bb0bb9e5d264e0cf9e4d0ee0288caac16f6f930956eb92355dff3ae4c89eedd6bc2dbef64b6e9fb60226727ad3c5004982621a2fbabc
-
Filesize
61KB
MD5f3441b8572aae8801c04f3060b550443
SHA14ef0a35436125d6821831ef36c28ffaf196cda15
SHA2566720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA5125ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9
-
Filesize
163KB
MD59441737383d21192400eca82fda910ec
SHA1725e0d606a4fc9ba44aa8ffde65bed15e65367e4
SHA256bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5
SHA5127608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf
-
Filesize
1KB
MD5379a301592736712c9a60676c50cf19b
SHA1c103790503bf8c2ff3f119adee027ebb429b9d21
SHA256cc7400692bd90e1b5fc44e11c8dd7c788cbb462f52ea3f3decb579e4d51eb268
SHA512dec25a31f2930eb575a43e654c29f170c261c1c4516767c0e71cc172ad6ad115914fb58d9cd79f681ff3d7c6baa6b7c0d6de99de09d7582c9807ae436f15572f
-
Filesize
1KB
MD5d25e0f479b9601edf2c9c2dad7ba2706
SHA12f1d0001e47394f4c4deec9645c5f2df99f91a95
SHA25663ff360aafde5ff959fb9671ec27002f99cbfae4907b410046b6a1b0f51cba9e
SHA5123ba164dad3cadf1ea9f0c555695e4d39cba47612599f547d0d0d59014577995c0ddbff0ef6a5e436867454da02d500136b54c034c2223586271b26108b2cfb5e
-
Filesize
7KB
MD54f8b110e37a818130310f0c34ec90dc5
SHA13bef6199fa0ba4c7b98d9c6a6c5a29c52ef9f3b1
SHA256db72101e43020be81ff304f50cf593497d66073be946502c16bcd64e7b2adcc3
SHA512d998b6f09e8750f8f99491e2c2dcbb0cec4a65f8154d795ca070eb131a4f88a30116715b67d1904a0b774e77d0b3ffdb994d10de5688e47f1e2901b10202402b
-
Filesize
1.3MB
MD584c6d2d33ed6f1aa356bca1d354448ab
SHA1e70b4058ed0389fb8482ee3cb2dc04334b6bb053
SHA256efe20d9f6b1427f69c61e3e128e576cf24a0b930903b1ff8fe7fdf3852d106c5
SHA51291e2fa7ae39523c5fb70d49ac3e33aacaa209827f95082b4c812b82c3a1733e1826f69b550d39c68b9ab6b0633bad9b02499bcd26971e971d7825af6eedf43fb
-
Filesize
1.3MB
MD584c6d2d33ed6f1aa356bca1d354448ab
SHA1e70b4058ed0389fb8482ee3cb2dc04334b6bb053
SHA256efe20d9f6b1427f69c61e3e128e576cf24a0b930903b1ff8fe7fdf3852d106c5
SHA51291e2fa7ae39523c5fb70d49ac3e33aacaa209827f95082b4c812b82c3a1733e1826f69b550d39c68b9ab6b0633bad9b02499bcd26971e971d7825af6eedf43fb
-
Filesize
10KB
MD52b7e63e10972a243646d24bc3c399fe4
SHA113e3a7517487457721f44a4444c7b4221c11dfda
SHA25603be37f2a49ceb431e4dfc2063af4345fafb014d84f6d417e38ae622ad7e3ef7
SHA51241320a54ddf250770f0447da6938813ed45befb0098a3c49ce225a0469e61d33eb4e00b606c3bbf683c4bdcac4397e72ef18104ca1b757d24d531da9bd39c887
-
Filesize
1.2MB
MD5734e95cdbe04f53fe7c28eeaaaad7327
SHA1e49a4d750f83bc81d79f1c4c3f3648a817c7d3da
SHA2568c8fbcf80f0484b48a07bd20e512b103969992dbf81b6588832b08205e3a1b43
SHA51216b02001c35248f18095ba341b08523db327d7aa93a55bcee95aebb22235a71eae21a5a8d19019b10cac3e7764a59d78cf730110bae80acc2ff249bbc7861ad7
-
Filesize
1.2MB
MD5734e95cdbe04f53fe7c28eeaaaad7327
SHA1e49a4d750f83bc81d79f1c4c3f3648a817c7d3da
SHA2568c8fbcf80f0484b48a07bd20e512b103969992dbf81b6588832b08205e3a1b43
SHA51216b02001c35248f18095ba341b08523db327d7aa93a55bcee95aebb22235a71eae21a5a8d19019b10cac3e7764a59d78cf730110bae80acc2ff249bbc7861ad7
-
Filesize
3KB
MD5f7d105bc543ec2a1287a7ea80b88c7b9
SHA1b9dc5795e8c1f4e5caac1807d043a70251566861
SHA256b07af96d70e23bcd2ce87eb9b4951752ad2c34396e58a43d89671553243d835d
SHA5126e803d3ad0d04ec9fea69b33cda7d0ed4c3ba010c9ec52ad5b02aa2fd54f96ab3176ec3c9e205b4f02c5b09db5ccec102ea0c8435097beee85211f659496ac4a
-
Filesize
51B
MD5449247cf18c57cec44da5fb96db3d91f
SHA1cf297809e4d45be8bd504e25bbb9a055210f271e
SHA256ab6c905f3c6dcb36bbc09104c253b5ef1f7755d08691e3f7c85ecb8d96b18ebc
SHA512d13e459854cb7656d746bf4ae2b1c0d2a1559d1c11a99af7bf04b93bdfb2adceef3a7982ffedd5224b8f5a2dd5719ae73bb1b10aff5dfe69e0780895ff8f9aac
-
Filesize
10KB
MD52b7e63e10972a243646d24bc3c399fe4
SHA113e3a7517487457721f44a4444c7b4221c11dfda
SHA25603be37f2a49ceb431e4dfc2063af4345fafb014d84f6d417e38ae622ad7e3ef7
SHA51241320a54ddf250770f0447da6938813ed45befb0098a3c49ce225a0469e61d33eb4e00b606c3bbf683c4bdcac4397e72ef18104ca1b757d24d531da9bd39c887
-
Filesize
61.2MB
MD5d847826fbb082c31c95db5fb98f0b681
SHA19f08cf5b2541f642b23419bcd582405cfbd3d522
SHA25680f01b431ab44e3e12c4352b6995720782f9377648f432f20da30325b4d435e8
SHA5128b9ecea8861c2cefc44c1a749446c7be6a12241cf0a853ac9629d05765af000e5c11fd22636112174b785e90b5cb7043845d06f1379683c189057646b109ff16
-
Filesize
61.4MB
MD5fb815f174914d3d9d5cf27a24fd94dd6
SHA13cf5d9fe7346cd1eae4467eea591d0e95a9492d4
SHA2560dc3c0f89bfd3abdf7dcdf737eab0995b8e0fbd374ec6a5db3a4881b6f6b2d5f
SHA51274e6cae8dc24b70406b2951cb6c61718b162101f96cccb93e7d4b93cb90bcb8d65ede77232dac23a5942d2c9cecfcedf1b6a2ca9f304f93241117c56b565b7c8
-
Filesize
61.4MB
MD5fb815f174914d3d9d5cf27a24fd94dd6
SHA13cf5d9fe7346cd1eae4467eea591d0e95a9492d4
SHA2560dc3c0f89bfd3abdf7dcdf737eab0995b8e0fbd374ec6a5db3a4881b6f6b2d5f
SHA51274e6cae8dc24b70406b2951cb6c61718b162101f96cccb93e7d4b93cb90bcb8d65ede77232dac23a5942d2c9cecfcedf1b6a2ca9f304f93241117c56b565b7c8
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD56c5c19666c3df333a42bcb6b9b92ec7c
SHA14415a979d09b724b6a44b01588f23a1b5dc83d77
SHA256746e8723573a9435a8e5e76afb0adbea95478d838e4e7b3b4469a1df735ecd8a
SHA512778f72b7d227bfba9eca81ce48c608a3fbaeb551b65bede0e7f51001f3591534d7dc4b701adac0837a4fdec5df98b11f50cd145ce2860dbf7a29fe107e420085
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\JX9UITGU1OI56LC80XM7.temp
Filesize7KB
MD57ffa78d9dacfd9081a5d19937702a44d
SHA1a5d4cb35bdde1ced242ce2c92d825ca0c133289b
SHA256bf5ae552180d76fe56f1a431a2ff7d220fe698536ddbe64066f500f7d4750df4
SHA512e69453d7366ce99e630fa201f6829cc8fe769285a05f1592b24aa2a7c2ac07b6276b633c49935fa33fb9db456ad88145ea599b18ffb60a8f32efa47817a07f03
-
Filesize
194KB
MD5f0c02af70944a87a95df1345ba3953eb
SHA1dacec72048626d0eec22af3a32f8de05e09a5591
SHA2562740eb22dc5b3b7ab5eeb3bff150ea9b80f35e9fb644ed140aa5dfdda99b2446
SHA512aafa88a6451ca285b4dcfe665a943e6bf596679c1ebeddbce5acde200e56e03e2fb9fe6e0b09028b6bb7160140138a73bcb4234717dfb4d5c8a179d33da95f06
-
Filesize
1.2MB
MD5a65e53c974a4e61728ecb632339a0978
SHA127e6ec4f8e34b40f1e08503245700c182b918ce9
SHA256ca8ab5aeef734f24a3c58bf10b3f0152c2ea1329b02d2730448693df563b4c6a
SHA512b029962f08867496cd3fd5e9af4b0703dae918e938aee759aeffbb4184ea6d3e81e0878ba8957e80d30db5d7b6fc8598e68918a4d16b3d010f31a2e16417593e
-
Filesize
1.2MB
MD5a65e53c974a4e61728ecb632339a0978
SHA127e6ec4f8e34b40f1e08503245700c182b918ce9
SHA256ca8ab5aeef734f24a3c58bf10b3f0152c2ea1329b02d2730448693df563b4c6a
SHA512b029962f08867496cd3fd5e9af4b0703dae918e938aee759aeffbb4184ea6d3e81e0878ba8957e80d30db5d7b6fc8598e68918a4d16b3d010f31a2e16417593e
-
Filesize
574KB
MD5bbb2667d9b2fd922e52883a63e8cd948
SHA1d4238ac5e2eb3ec7236e5e098ee3b31d26efebee
SHA25669392e292a0e7195e0c96bbbfe989949d044b63dbce2e5324f1bb99aa2560e3f
SHA5122f801ae372ca3fc4cd858b6d1783977c8357e5616f45311ffff70b3eee20490f2c6e34a12139a6c0b9faaaf6e59985fabc1cae22510e6b632bae425a58793681
-
Filesize
1.6MB
MD5a2cc0a771f7507d28d4ea0131695186a
SHA1e31043104a102b636374bef2a5f92c75ccc36fc1
SHA2562d9b0f8632c6df2ec2aa1e75d839a6d61128a7724b5509f939078f3a52005e92
SHA5128a1ec52dafe9c7c102ec88df8a95245956238246e1be89b46361ff6d4d69358b08c7fad8fc50d83f59ea6e887e543f53b51eca58d816c3b2d348e57b6a2f283d
-
Filesize
3.4MB
MD5447926609e3228ff943c3cde0ed1692d
SHA1adbe95d3682677fa6583892124574d0f14ef1bc7
SHA256a50580cfb78676285130ca13fa052df96cd6d1bf639be78a9739a2db4fab2944
SHA512a1277c4c5da9f1801308db96365f413866ff250b38a338e8e93565f658bf2d3ea4dcd8f7820194b21eced4778b1694cdece85a51e2380548e5ace8a1a795726f
-
Filesize
3.6MB
MD5907cd3b4605457a0fcc4c884fbb85c80
SHA16aeeca92f5ccf58b86bb1d5b2d0babe0b4e432b1
SHA2562a12a8240f416ed00329b6ea3e2d01bf759d758b59c6e87ed22d1ebe71818a2d
SHA51287251b2ba3f7a2b4e07d9c89026a53707125ce11814131612abf231c6c34239b02e1567eccb8cefededce95cfa70e8501c5c6049f8aa967d7fde917ff13c0791
-
Filesize
6.4MB
MD5327cb21b41ce523e2faba8e17ab24404
SHA16dcf3b4a21433b7f365e16a89a131e17e1de4cef
SHA256638d1e4201f7e8e0f5aae7d880fda02874cbbee98eff48e9e1fd0291451a0ac9
SHA512f445f6020997ebbf513f9a470576a84d4b93823e2e143daa7408e7bac83276cb75f8e37c31046482a1aaf1380d6b27218be5b85b045ad6c3200baa7855e68028
-
Filesize
2.4MB
MD569d87ada8d240550d7469e5ce7c75369
SHA1bb3422b1dc462922b6a24eee46629b89a590d327
SHA256b44957becd817bb9febcfc627627709916c82f366eecac6e71e630e5bffafc79
SHA512bb91fb0540a861155e5b3d28f109b4bb7f6b6f1d3138391bab382d0750c1968672c163c1cdab226fe3a819e36d6307ec2df94e3539918bec5b55c34214437a58
-
Filesize
4.0MB
MD555ef5563825fda3ab05cbee48bb5cc99
SHA1fcb57cb21714edfc7e59671e9b3a6d9842a988da
SHA2563417da91c99c3a4f99c268dd94ca61e59a76340102af54ff984cbf8f339e24d5
SHA51273891411be688711ee86b9759eeeb6c66799892f0dc9f668d8233aee95e6b397cf0434463308d6af77c4b592fe5b71dbdd7de031ce3d071657d29dff64c51ad1
-
Filesize
3.5MB
MD5235404716813d5b32d26fd17aed9112b
SHA1c77d3fde646cc07c274cbc2318fd884a6c8a4f36
SHA256ffff47710970e3bcd5e8c2a28867a2e2dc0c01278a531223e535efabea528781
SHA5126aecc1de3cb86d25b66e81badc7b6966d42fcc72925414594e550bb7e71d569835001fac2e5b6ee179307545bc395717c963110ca7c69f0bbd55b9132a11e5eb
-
Filesize
2.3MB
MD5439e2f41cc91de42214d5ca2ea69ecd1
SHA1538bbdb5d0b7e563dbe1b1938e676a64b829b9c0
SHA25694a820e238024dc5c65785b37141020078eed9b170be4389f085577637b538df
SHA5128b9ea8e345150a140e82ac53424bf4aa8c5d05879034b7057e453fa3840a4fb4e09998f43c67090084c72cbcd7499fa145141fbfe56599ef25ce62f84092bd04
-
Filesize
1.3MB
MD584c6d2d33ed6f1aa356bca1d354448ab
SHA1e70b4058ed0389fb8482ee3cb2dc04334b6bb053
SHA256efe20d9f6b1427f69c61e3e128e576cf24a0b930903b1ff8fe7fdf3852d106c5
SHA51291e2fa7ae39523c5fb70d49ac3e33aacaa209827f95082b4c812b82c3a1733e1826f69b550d39c68b9ab6b0633bad9b02499bcd26971e971d7825af6eedf43fb
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
63KB
MD51c55ae5ef9980e3b1028447da6105c75
SHA1f85218e10e6aa23b2f5a3ed512895b437e41b45c
SHA2566afa2d104be6efe3d9a2ab96dbb75db31565dad64dd0b791e402ecc25529809f
SHA5121ec4d52f49747b29cfd83e1a75fc6ae4101add68ada0b9add5770c10be6dffb004bb47d0854d50871ed8d77acf67d4e0445e97f0548a95c182e83b94ddf2eb6b
-
Filesize
3.0MB
MD5b55493d2b5f93a41c51811448ccd6975
SHA1584dc786acbb05e09062b98a7d976c9da17aa3a4
SHA2562cbba30b1ab1713a9320c18f9bb0c396f89fdba9ccb89f34dd9a12de2c81f405
SHA512e8f1aa0efa5c7fc3cfe6063c2600d70db1c7cb399b11f443c2575d054b531b856987ca19e9a4ba63161270046ac4dfe85e5675af0f49b722af0071629c0eb8d1
-
Filesize
1.3MB
MD584c6d2d33ed6f1aa356bca1d354448ab
SHA1e70b4058ed0389fb8482ee3cb2dc04334b6bb053
SHA256efe20d9f6b1427f69c61e3e128e576cf24a0b930903b1ff8fe7fdf3852d106c5
SHA51291e2fa7ae39523c5fb70d49ac3e33aacaa209827f95082b4c812b82c3a1733e1826f69b550d39c68b9ab6b0633bad9b02499bcd26971e971d7825af6eedf43fb