Analysis
-
max time kernel
665s -
max time network
760s -
platform
windows10-1703_x64 -
resource
win10-20231020-en -
resource tags
arch:x64arch:x86image:win10-20231020-enlocale:en-usos:windows10-1703-x64system -
submitted
30-10-2023 17:39
Static task
static1
Behavioral task
behavioral1
Sample
MBSetup.exe
Resource
win10-20231020-en
Behavioral task
behavioral2
Sample
MBSetup.exe
Resource
win10v2004-20231023-en
General
-
Target
MBSetup.exe
-
Size
2.5MB
-
MD5
1e885823577394ea61ea89438ffe2954
-
SHA1
e53e96f7374790bdad8a614949b398b055c3a27b
-
SHA256
7c0b9bceed390f7f28135431c09ac51469ee8e2b8095fb36a37315d811d9ba9c
-
SHA512
73f600833dad0047b6444110d722dc95237b38bb486abc7fc8e4f59b69e2154c885fb46d65f488d5139a0b6e76ebde33ea72711c7f58436650ef992fb8995627
-
SSDEEP
49152:Lw3ye9SPQ1sjDAVj+JeRanStQyfvE0Z3R0nxiIq2ddAsuysSiSF:4yeoCVj+c6KtQRq2ADSiSF
Malware Config
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
MBSetup.exedescription pid process target process PID 3100 created 3132 3100 MBSetup.exe Explorer.EXE -
Downloads MZ/PE file
-
Drops file in Drivers directory 25 IoCs
Processes:
MBAMService.exeMBSetup.exeMBAMService.exeMBAMInstallerService.exedescription ioc process File opened for modification C:\Windows\system32\DRIVERS\SETAFF5.tmp MBAMService.exe File created C:\Windows\system32\DRIVERS\SET66D.tmp MBAMService.exe File opened for modification C:\Windows\system32\DRIVERS\SET1785.tmp MBAMService.exe File created C:\Windows\system32\DRIVERS\SET4E5.tmp MBAMService.exe File created C:\Windows\system32\DRIVERS\SET1785.tmp MBAMService.exe File created C:\Windows\SysWOW64\drivers\mbamtestfile.dat MBSetup.exe File opened for modification C:\Windows\system32\DRIVERS\SETB247.tmp MBAMService.exe File opened for modification C:\Windows\system32\DRIVERS\SETB873.tmp MBAMService.exe File opened for modification C:\Windows\system32\DRIVERS\MbamChameleon.sys MBAMService.exe File opened for modification C:\Windows\system32\DRIVERS\SET4E5.tmp MBAMService.exe File created C:\Windows\system32\DRIVERS\mbam.sys MBAMService.exe File opened for modification C:\Windows\system32\DRIVERS\mwac.sys MBAMService.exe File opened for modification C:\Windows\system32\DRIVERS\SET66D.tmp MBAMService.exe File opened for modification C:\Windows\system32\DRIVERS\farflt.sys MBAMService.exe File opened for modification C:\Windows\system32\DRIVERS\MbamElam.sys MBAMService.exe File opened for modification C:\Windows\system32\DRIVERS\mbamswissarmy.sys MBAMService.exe File opened for modification C:\Windows\system32\DRIVERS\SET2486.tmp MBAMService.exe File created C:\Windows\system32\DRIVERS\MbamElam.sys MBAMService.exe File created C:\Windows\system32\DRIVERS\SETB247.tmp MBAMService.exe File created C:\Windows\system32\DRIVERS\SETB873.tmp MBAMService.exe File created C:\Windows\system32\DRIVERS\SET2486.tmp MBAMService.exe File created C:\Windows\system32\drivers\mbae64.sys MBAMInstallerService.exe File created C:\Windows\system32\DRIVERS\SETAFF5.tmp MBAMService.exe File opened for modification C:\Windows\system32\DRIVERS\SET477.tmp MBAMService.exe File created C:\Windows\system32\DRIVERS\SET477.tmp MBAMService.exe -
Modifies RDP port number used by Windows 1 TTPs
-
Sets service image path in registry 2 TTPs 2 IoCs
Processes:
MBAMService.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MBAMSwissArmy\ImagePath = "\\SystemRoot\\System32\\Drivers\\mbamswissarmy.sys" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MBAMChameleon\ImagePath = "\\SystemRoot\\System32\\Drivers\\MbamChameleon.sys" MBAMService.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
MBAMService.exeMBSetup.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion MBAMService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate MBAMService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion MBSetup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate MBSetup.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
MBAMService.exeMBAMInstallerService.exedescription ioc process File opened (read-only) \??\K: MBAMService.exe File opened (read-only) \??\B: MBAMInstallerService.exe File opened (read-only) \??\H: MBAMService.exe File opened (read-only) \??\Y: MBAMService.exe File opened (read-only) \??\A: MBAMInstallerService.exe File opened (read-only) \??\N: MBAMInstallerService.exe File opened (read-only) \??\W: MBAMInstallerService.exe File opened (read-only) \??\A: MBAMService.exe File opened (read-only) \??\G: MBAMService.exe File opened (read-only) \??\I: MBAMService.exe File opened (read-only) \??\E: MBAMInstallerService.exe File opened (read-only) \??\I: MBAMInstallerService.exe File opened (read-only) \??\V: MBAMInstallerService.exe File opened (read-only) \??\E: MBAMService.exe File opened (read-only) \??\J: MBAMService.exe File opened (read-only) \??\O: MBAMService.exe File opened (read-only) \??\S: MBAMService.exe File opened (read-only) \??\T: MBAMService.exe File opened (read-only) \??\U: MBAMService.exe File opened (read-only) \??\L: MBAMInstallerService.exe File opened (read-only) \??\P: MBAMInstallerService.exe File opened (read-only) \??\X: MBAMInstallerService.exe File opened (read-only) \??\P: MBAMService.exe File opened (read-only) \??\Z: MBAMService.exe File opened (read-only) \??\G: MBAMInstallerService.exe File opened (read-only) \??\O: MBAMInstallerService.exe File opened (read-only) \??\Z: MBAMInstallerService.exe File opened (read-only) \??\L: MBAMService.exe File opened (read-only) \??\N: MBAMService.exe File opened (read-only) \??\Q: MBAMService.exe File opened (read-only) \??\V: MBAMService.exe File opened (read-only) \??\H: MBAMInstallerService.exe File opened (read-only) \??\M: MBAMInstallerService.exe File opened (read-only) \??\S: MBAMInstallerService.exe File opened (read-only) \??\R: MBAMService.exe File opened (read-only) \??\X: MBAMService.exe File opened (read-only) \??\U: MBAMInstallerService.exe File opened (read-only) \??\B: MBAMService.exe File opened (read-only) \??\M: MBAMService.exe File opened (read-only) \??\W: MBAMService.exe File opened (read-only) \??\J: MBAMInstallerService.exe File opened (read-only) \??\K: MBAMInstallerService.exe File opened (read-only) \??\Q: MBAMInstallerService.exe File opened (read-only) \??\R: MBAMInstallerService.exe File opened (read-only) \??\T: MBAMInstallerService.exe File opened (read-only) \??\Y: MBAMInstallerService.exe -
Drops file in System32 directory 12 IoCs
Processes:
MBAMService.exeMBAMService.exedescription ioc process File opened for modification C:\Windows\System32\CatRoot2\dberr.txt MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_6E4F36431D86962EFD432400DF65AC90 MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\38D10539991D1B84467F968981C3969D_C92678066E2B4B4986BC7641EEC08637 MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\117308CCCD9C93758827D7CC85BB135E MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\FA0E447C3E79584EC91182C66BBD2DB7 MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\117308CCCD9C93758827D7CC85BB135E MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FA0E447C3E79584EC91182C66BBD2DB7 MBAMService.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\572BF21E454637C9F000BE1AF9B1E1A9 MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\572BF21E454637C9F000BE1AF9B1E1A9 MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_6E4F36431D86962EFD432400DF65AC90 MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\38D10539991D1B84467F968981C3969D_C92678066E2B4B4986BC7641EEC08637 MBAMService.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 64 IoCs
Processes:
MBAMInstallerService.exeMBAMService.exedescription ioc process File created C:\Program Files\Malwarebytes\Anti-Malware\QtWinExtras\JumpListLink.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\BusyIndicator.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\CloudControllerImpl.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\api-ms-win-core-processenvironment-l1-1-0.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Base\CircularGaugeStyle.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\DelayButton.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Universal\GroupBox.qml MBAMInstallerService.exe File created C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\sdk\mbam.cat MBAMService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\languages\lang_en_US.qm MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtCharts\qmldir MBAMInstallerService.exe File created C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-30.exe MBAMService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\api-ms-win-core-profile-l1-1-0.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Desktop\BusyIndicatorStyle.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Imagine\TabBar.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\mbae64.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Material\Button.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\TabBar.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\vcruntime140.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\Qt\labs\folderlistmodel\qmldir MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Base\images\scrollbar-handle-horizontal.png MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Desktop\FocusFrameStyle.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\TextField.qml MBAMInstallerService.exe File created C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-24.exe MBAMService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\mbuns.exe MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\languages\lang_en_GB.qm MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\ItemDelegate.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Dialogs\qml\icons.ttf MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\SPControllerImpl.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Desktop\ComboBoxStyle.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Extras\TumblerColumn.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Base\CommonStyleHelper.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Desktop\GroupBoxStyle.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\ToolButton.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick.2\qtquick2plugin.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Private\FastGlow.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Base\images\tab.png MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\ActionGroup.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Material\SliderHandle.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Universal\RadioIndicator.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\languages\lang_nl.qm MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\version.dat MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Base\StatusIndicatorStyle.qml MBAMInstallerService.exe File created C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-20.exe MBAMService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Fusion\ScrollBar.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Material\Slider.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Fusion\Page.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Private\ModalPopupBehavior.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Base\images\editbox.png MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Base\SpinBoxStyle.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\api-ms-win-core-errorhandling-l1-1-0.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Base\images\scrollbar-handle-transient.png MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Material\Switch.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Menu.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Material\Tumbler.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Universal\Slider.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Window.2\plugins.qmltypes MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\mbae-api-na.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\api-ms-win-core-console-l1-1-0.dll MBAMInstallerService.exe File created C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-13.exe MBAMService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Desktop\qmldir MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\api-ms-win-core-memory-l1-1-0.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Imagine\Tumbler.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Extras\Private\CircularButtonStyleHelper.qml MBAMInstallerService.exe File created C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-5.exe MBAMService.exe -
Drops file in Windows directory 2 IoCs
Processes:
MBAMService.exeMBAMService.exedescription ioc process File created C:\Windows\ELAMBKUP\MbamElam.sys MBAMService.exe File opened for modification C:\Windows\security\logs\scecomp.log MBAMService.exe -
Executes dropped EXE 57 IoCs
Processes:
MBAMInstallerService.exeMBAMService.exeMBAMService.exembamtray.exembam.exeig-39.exeig-0.exeig-42.exeig-2.exeig-3.exeig-4.exeig-24.exeig-6.exeig-7.exeig-8.exeig-9.exeig-10.exeig-11.exeig-31.exeig-33.exeig-14.exeig-15.exeig-16.exeig-17.exeig-40.exeig-19.exeig-20.exeig-21.exeig-22.exeig-23.exeig-25.exeig-26.exeig-27.exeig-47.exeig-29.exeig-30.exeig-32.exeig-34.exeig-35.exeig-36.exeig-37.exeig-38.exeig-41.exeig-43.exeig-44.exeig-45.exeig-46.exeig-48.exeig-49.exeMBAMWsc.exepid process 5100 MBAMInstallerService.exe 4760 MBAMService.exe 1616 MBAMService.exe 4232 mbamtray.exe 2296 mbam.exe 2912 ig-39.exe 2156 ig-0.exe 1240 ig-42.exe 3056 ig-2.exe 3324 ig-3.exe 4788 ig-4.exe 4652 ig-24.exe 4500 ig-6.exe 3440 ig-7.exe 4180 ig-8.exe 2120 ig-9.exe 4220 ig-10.exe 3476 ig-11.exe 4904 ig-31.exe 2208 ig-33.exe 316 ig-14.exe 2624 ig-15.exe 5084 ig-16.exe 3428 ig-17.exe 4840 ig-40.exe 3120 ig-19.exe 3624 ig-20.exe 2976 ig-21.exe 4116 ig-22.exe 2696 ig-23.exe 4652 ig-24.exe 208 ig-25.exe 220 ig-26.exe 4320 ig-27.exe 5068 ig-47.exe 3052 ig-29.exe 2920 ig-30.exe 4904 ig-31.exe 2944 ig-32.exe 2208 ig-33.exe 4108 ig-34.exe 4292 ig-35.exe 3536 ig-36.exe 3828 ig-37.exe 2992 ig-38.exe 2912 ig-39.exe 4840 ig-40.exe 1584 ig-41.exe 1240 ig-42.exe 3104 ig-43.exe 4548 ig-44.exe 712 ig-45.exe 3340 ig-46.exe 5068 ig-47.exe 4280 ig-48.exe 1736 ig-49.exe 4084 MBAMWsc.exe -
Loads dropped DLL 64 IoCs
Processes:
MBAMInstallerService.exeMBAMService.exembamtray.exembam.exepid process 5100 MBAMInstallerService.exe 5100 MBAMInstallerService.exe 1616 MBAMService.exe 1616 MBAMService.exe 1616 MBAMService.exe 1616 MBAMService.exe 1616 MBAMService.exe 1616 MBAMService.exe 1616 MBAMService.exe 1616 MBAMService.exe 1616 MBAMService.exe 1616 MBAMService.exe 1616 MBAMService.exe 1616 MBAMService.exe 1616 MBAMService.exe 1616 MBAMService.exe 1616 MBAMService.exe 1616 MBAMService.exe 1616 MBAMService.exe 1616 MBAMService.exe 1616 MBAMService.exe 1616 MBAMService.exe 1616 MBAMService.exe 1616 MBAMService.exe 1616 MBAMService.exe 1616 MBAMService.exe 5100 MBAMInstallerService.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 2296 mbam.exe 2296 mbam.exe 2296 mbam.exe 2296 mbam.exe -
Registers COM server for autorun 1 TTPs 64 IoCs
Processes:
MBAMService.exeMBAMService.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{278637DA-FDFB-45C7-8CD8-F2D8A9199AB0}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D5599B6B-FA0C-45B5-8309-853B003EA412}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36A65E46-6CC1-4CA2-B51E-F4DD8C993DDC}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DE03E614-112D-43E0-8E15-E7236CC32108}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57CE581A-0CB6-4266-9CA0-19364C90A0B3}\InprocServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{278637DA-FDFB-45C7-8CD8-F2D8A9199AB0}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E1AC7139-D1FF-4DE9-84A4-92E2B47F5D2A}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE8A9269-9E6E-4683-BCD3-41E9B16696DC}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{376BE474-56D4-4177-BB4E-5610156F36C8}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{580243BF-3CEE-4131-A599-C6FED66BEB1B}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{03141A2A-5C3A-458E-ABEC-0812AD7FF497}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9DAB0CA5-AE19-41AE-955C-41DD44C52697}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57CE581A-0CB6-4266-9CA0-19364C90A0B3}\InprocServer32\ThreadingModel = "Apartment" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{11D1E5E8-14E1-4B5B-AE1A-2678CB91E8E5}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{11D1E5E8-14E1-4B5B-AE1A-2678CB91E8E5}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{17BE78EE-B40A-4B9E-835F-38EC62F9D479}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36A65E46-6CC1-4CA2-B51E-F4DD8C993DDC}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{580243BF-3CEE-4131-A599-C6FED66BEB1B}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F415899A-1576-4C8B-BC9F-4854781F8A20}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{580243BF-3CEE-4131-A599-C6FED66BEB1B}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{251AD013-20AD-4C3F-8FE2-F66A429B4819}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D5599B6B-FA0C-45B5-8309-853B003EA412}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BF474111-9116-45C6-AF53-209E64F1BB53}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{376BE474-56D4-4177-BB4E-5610156F36C8}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9DAB0CA5-AE19-41AE-955C-41DD44C52697}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57CE581A-0CB6-4266-9CA0-19364C90A0B3}\InprocServer32\ = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbshlext.dll" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F415899A-1576-4C8B-BC9F-4854781F8A20}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{11D1E5E8-14E1-4B5B-AE1A-2678CB91E8E5}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{376BE474-56D4-4177-BB4E-5610156F36C8}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9DAB0CA5-AE19-41AE-955C-41DD44C52697}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F36AD0D0-B5F0-4C69-AF08-603D177FEF0E}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D5599B6B-FA0C-45B5-8309-853B003EA412}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F6D29500-933C-447C-9D88-9D814AF73808}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F415899A-1576-4C8B-BC9F-4854781F8A20}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F1C46F8-E697-4175-B240-CDE682A4BA2D}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F6D29500-933C-447C-9D88-9D814AF73808}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE8A9269-9E6E-4683-BCD3-41E9B16696DC}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36A65E46-6CC1-4CA2-B51E-F4DD8C993DDC}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F6D29500-933C-447C-9D88-9D814AF73808}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DE03E614-112D-43E0-8E15-E7236CC32108}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F36AD0D0-B5F0-4C69-AF08-603D177FEF0E}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F1C46F8-E697-4175-B240-CDE682A4BA2D}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F1C46F8-E697-4175-B240-CDE682A4BA2D}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{130CD414-6BFD-4F6C-9362-A2264B222E76}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{278637DA-FDFB-45C7-8CD8-F2D8A9199AB0}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BF474111-9116-45C6-AF53-209E64F1BB53}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{03141A2A-5C3A-458E-ABEC-0812AD7FF497}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DE03E614-112D-43E0-8E15-E7236CC32108}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{03141A2A-5C3A-458E-ABEC-0812AD7FF497}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BF474111-9116-45C6-AF53-209E64F1BB53}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E1AC7139-D1FF-4DE9-84A4-92E2B47F5D2A}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE8A9269-9E6E-4683-BCD3-41E9B16696DC}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{17BE78EE-B40A-4B9E-835F-38EC62F9D479}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{251AD013-20AD-4C3F-8FE2-F66A429B4819}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{130CD414-6BFD-4F6C-9362-A2264B222E76}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F36AD0D0-B5F0-4C69-AF08-603D177FEF0E}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{251AD013-20AD-4C3F-8FE2-F66A429B4819}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D372F21-E6DA-4B82-881A-79F6CA6B6AE1}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D372F21-E6DA-4B82-881A-79F6CA6B6AE1}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D372F21-E6DA-4B82-881A-79F6CA6B6AE1}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F36AD0D0-B5F0-4C69-AF08-603D177FEF0E}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E1AC7139-D1FF-4DE9-84A4-92E2B47F5D2A}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{130CD414-6BFD-4F6C-9362-A2264B222E76}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{17BE78EE-B40A-4B9E-835F-38EC62F9D479}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
MBAMService.exedescription ioc process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MBAMService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MBAMService.exe -
Processes:
MBAMInstallerService.exeMBAMService.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION MBAMInstallerService.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\mbam.exe = "11000" MBAMInstallerService.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\mbamtray.exe = "11000" MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION MBAMService.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\mbam.exe = "11000" MBAMService.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\mbamtray.exe = "11000" MBAMService.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
MBAMInstallerService.exeMBAMService.exeMBAMWsc.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\16.0\Common\Security MBAMInstallerService.exe Set value (str) \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:\ MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs MBAMService.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\15.0\Common\Security MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs MBAMService.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\16.0 MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications MBAMInstallerService.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:\ MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA MBAMInstallerService.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:\ MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\16.0\Common MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\16.0\Common MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0\Common\Security MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs MBAMService.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Malwarebytes\FirstRun = "false" MBAMInstallerService.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:\ MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: MBAMInstallerService.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Malwarebytes\FirstRun = "false" MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0 MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\16.0 MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs MBAMService.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates MBAMService.exe Set value (str) \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:\ MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\15.0\Common MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates MBAMService.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\15.0 MBAMInstallerService.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:\ MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\16.0\Common\Security MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft MBAMInstallerService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs MBAMService.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C} {000214E6-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000964204b5590bda01 MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\Software MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications MBAMInstallerService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" MBAMWsc.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies MBAMInstallerService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs MBAMService.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs MBAMInstallerService.exe -
Modifies registry class 64 IoCs
Processes:
MBAMService.exeMBAMService.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6A3E14F0-01F5-492E-AA97-3D880941D814}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FFB94DF8-FC15-411C-B443-E937085E2AC1}\1.0\ = "RTPControllerCOMLib" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{226C1698-A075-4315-BB5D-9C164A96ACE7}\1.0\FLAGS MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BADF77CD-ECCE-4B36-88FF-6A2804FFE307} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8153C0A7-AC17-452A-9388-358F782478D4}\TypeLib\ = "{A82129F1-32E1-4D79-A39F-EBFEE53A70BF}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E2D56B7B-4B87-45A1-A6D3-5C77035141A6}\TypeLib\ = "{49F6AC60-2104-42C6-8F71-B3916D5AA732}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FC34538A-37CB-44B4-9264-533E9347BB40}\ = "IRTPControllerEventsV2" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C0D8223D-D594-4147-BAD8-1E2B54ED1990}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FD6673C7-8E52-46EE-80B8-58F3FB6AA036}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6655E528-3168-47A4-BF82-A71E9E6AB5F7}\TypeLib\ = "{5709DEEB-F05E-4D5C-8DC4-3B0D924EE08F}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8A574BA8-3535-41F9-AB73-FA93F8A7DC3B}\ = "IRTPControllerV5" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{557ADCF9-0496-46F6-A580-FF8EC1441050}\ = "IRTPControllerV9" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AFF1A83B-6C83-4342-8E68-1648DE06CB65}\1.0\FLAGS\ = "0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DC97FF29-5CE2-4897-8175-94672057E02D}\TypeLib\ = "{A23C190D-C714-42C7-BDBB-F4E1DE65AF27}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{993A5C11-A9B8-41E9-9088-C5182B1F279A}\TypeLib\ = "{226C1698-A075-4315-BB5D-9C164A96ACE7}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1E3F0FEC-3E40-4137-8C7D-090AFA9B6C5E}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{19E8B60E-50A1-4E29-9138-A13421D2BF7D}\TypeLib\Version = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E03FDF96-969E-4700-844D-7F754F1657EF} MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D2D1C2BC-3427-478E-A903-ADFBCF5711CD}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MB.SPController\CurVer\ = "MB.SPController.1" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4E0F1EE6-E7CA-4BEE-8C08-0959842DA615} MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{44ACF635-5275-4730-95E5-03E4D192D8C8}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{71AC94F2-D545-438F-9156-C231B7D94A56}\TypeLib\ = "{332AFEBA-9341-4CEC-8EA6-DB155A99DF63}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MB.ArwController.1 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CCEFCD43-B934-4168-AE51-6FE07D3D0624}\ = "_IPoliciesControllerEvents" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D372F21-E6DA-4B82-881A-79F6CA6B6AE1}\ = "PoliciesController Class" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{748A86D4-7EDF-41EF-A1EF-9582643B1C9F}\TypeLib\ = "{5709DEEB-F05E-4D5C-8DC4-3B0D924EE08F}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FB586AB4-56F2-4EFA-9756-EE9A399B44DE}\ = "_IMWACControllerEventsV8" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9704115C-F54E-4D64-8554-0CAF8BF33B1B}\ = "IMWACControllerV5" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6EC225D5-FD37-4F9B-B80F-09FAE36103AE}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C3249828-A4B2-4146-A323-EA5FD2F2FC75}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31BF2366-C6DB-49F1-96A5-8026B9DF4152}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D51C573D-B305-4980-8DFF-076C1878CCFB}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D5599B6B-FA0C-45B5-8309-853B003EA412}\ProgID\ = "MB.ScanController.1" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BFC6C7E6-8475-4F9B-AC56-AD22BECF91C4}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CE7ABFE9-8F8F-4EDD-86BD-9209FD072126}\TypeLib\ = "{5709DEEB-F05E-4D5C-8DC4-3B0D924EE08F}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4A9108FB-A377-47EC-96E3-3CB8B1FB7272}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F275D775-3A22-4C5A-B9AD-6FE8008304D0}\TypeLib\ = "{49F6AC60-2104-42C6-8F71-B3916D5AA732}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{278637DA-FDFB-45C7-8CD8-F2D8A9199AB0}\AppID = "{1F7896AD-8886-42CD-8ABD-7A1315A3A5F2}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FB586AB4-56F2-4EFA-9756-EE9A399B44DE}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8FF168C7-A609-4237-A076-E461334BF4EA}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{503084FD-0743-46C7-833F-D0057E8AC505} MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{50538523-AA2F-40D3-9B58-DB51D5BD3D4A}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F77B440A-6CBC-4AFD-AA22-444552960E50} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{553B1C62-BE94-4CE0-8041-EB3BC1329D20}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{309BE0D9-B4CA-4610-B250-26CC9CDE7186} MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8640989C-20B4-41BE-BFE1-218EF5B076A6}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MB.ScanController.1\CLSID MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6A66A096-E54B-4F72-8654-ED7715B07B43}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{96C7187E-6EC4-49BD-88C7-04A3A8A97CC5}\ = "IMWACControllerV9" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EDF63EDA-B622-44E2-8053-8877E33BB49A}\TypeLib\Version = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0AB5C774-8EB7-4C1B-9BBB-5AC3E2C291DD} MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{090D2E82-C71B-414E-AF6A-6681A92FF2B3} MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E8D2DC04-56F2-4F6F-8E11-8CB2BB337FCA}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4A0A45F1-CFB6-49A7-BBC4-8776F94857A8}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4E0987E3-3699-4C92-8E76-CAEDA00FA44C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{55E4B8FB-921C-4751-8B2D-AE33BD7D0B74}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B34A461-332D-479F-B8C4-7D168D650EBD}\TypeLib\Version = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4412646D-16F5-4F3C-8348-0744CDEBCCBF}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{239C7555-993F-4071-9081-D2AE0B590D63}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79D77750-02E0-4451-A7BB-524ACD93DD93}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8E1F91DE-30AF-469B-9A09-FCF176207F0F}\ = "IRTPControllerV8" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A9AE95CF-6463-415A-94AC-F895D0962D30}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B9442AA1-AEB8-4FB4-B998-BFBC37BA8A99}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe -
Processes:
MBAMInstallerService.exeMBAMService.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d0140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b4030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3490f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d578112861900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e MBAMService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8DA7F965EC5EFC37910F1C6E59FDC1CC6A6EDE16\Blob = 0300000001000000140000008da7f965ec5efc37910f1c6e59fdc1cc6a6ede162000000001000000450300003082034130820229a0030201020213066c9fcf99bf8c0a39e2f0788a43e696365bca300d06092a864886f70d01010b05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412031301e170d3135303532363030303030305a170d3338303131373030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f74204341203130820122300d06092a864886f70d01010105000382010f003082010a0282010100b2788071ca78d5e371af478050747d6ed8d78876f49968f7582160f97484012fac022d86d3a0437a4eb2a4d036ba01be8ddb48c80717364cf4ee8823c73eeb37f5b519f84968b0ded7b976381d619ea4fe8236a5e54a56e445e1f9fdb416fa74da9c9b35392ffab02050066c7ad080b2a6f9afec47198f503807dca2873958f8bad5a9f948673096ee94785e6f89a351c0308666a14566ba54eba3c391f948dcffd1e8302d7d2d747035d78824f79ec4596ebb738717f2324628b843fab71daacab4f29f240e2d4bf7715c5e69ffea9502cb388aae50386fdbfb2d621bc5c71e54e177e067c80f9c8723d63f40207f2080c4804c3e3b24268e04ae6c9ac8aa0d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604148418cc8534ecbc0c94942e08599cc7b2104e0a08300d06092a864886f70d01010b0500038201010098f2375a4190a11ac57651282036230eaee628bbaaf894ae48a4307f1bfc248d4bb4c8a197f6b6f17a70c85393cc0828e39825cf23a4f9de21d37c8509ad4e9a753ac20b6a897876444718656c8d418e3b7f9acbf4b5a750d7052c37e8034bade961a0026ef5f2f0c5b2ed5bb7dcfa945c779e13a57f52ad95f2f8933bde8b5c5bca5a525b60af14f74befa3fb9f40956d3154fc42d3c7461f23add90f48709ad9757871d1724334756e5759c2025c266029cf2319168e8843a5d4e4cb08fb231143e843297262a1a95d5e08d490aeb8d8ce14c2d055f286f6c49343776661c0b9e841d7977860036e4a72aea5d17dba109e866c1b8ab95933f8ebc490bef1b9 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F6108407D6F8BB67980CC2E244C2EBAE1CEF63BE MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2 MBAMService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E\Blob = 030000000100000014000000b51c067cee2b0c3df855ab2d92f4fe39d4e70f0e2000000001000000e1030000308203dd308202c5a003020102020100300d06092a864886f70d01010b050030818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a30818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bdedc103fcf68ffc02b16f5b9f48d99d79e2a2b703615618c347b6d7ca3d352e8943f7a1699bde8a1afd13209cb44977322956fdb9ec8cdd22fa72dc276197eef65a84ec6e19b9892cdc845bd574fb6b5fc589a51052894655f4b8751ce67fe454ae4bf85572570219f8177159eb1e280774c59d48be6cb4f4a4b0f364377992c0ec465e7fe16d534c62afcd1f0b63bb3a9dfbfc7900986174cf26824063f3b2726a190d99cad40e75cc37fb8b89c159f1627f5fb35f6530f8a7b74d765a1e765e34c0e89656998ab3f07fa4cdbddc32317c91cfe05f11f86baa495cd19994d1a2e3635b0976b55662e14b741d96d426d4080459d0980e0ee6defcc3ec1f90f10203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147c0c321fa7d9307fc47d68a362a8a1ceab075b27300d06092a864886f70d01010b050003820101001159fa254f036f94993b9a1f828539d47605945ee128936d625d09c2a0a8d4b07538f1346a9de49f8a862651e62cd1c62d6e95204a9201ecb88a677b31e2672e8c9503262e439d4a31f60eb50cbbb7e2377f22ba00a30e7b52fb6bbb3bc4d379514ecd90f4670719c83c467a0d017dc558e76de68530179a24c410e004f7e0f27fd4aa0aff421d37ed94e5645912207738d3323e3881759673fa688fb1cbce1fc5ecfa9c7ecf7eb1f1072db6fcbfcaa4bfd097054abcea18280290bd5478092171d3d17d1dd916b0a9613dd00a0022fcc77bcb0964450b3b4081f77d7c32f598ca588e7d2aee90597364f936745e25a1f566052e7f3915a92afb508b8e8569f4 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8DA7F965EC5EFC37910F1C6E59FDC1CC6A6EDE16 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\5A8CEF45D7A69859767A8C8B4496B578CF474B1A MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\5A8CEF45D7A69859767A8C8B4496B578CF474B1A\Blob = 0300000001000000140000005a8cef45d7a69859767a8c8b4496b578cf474b1a2000000001000000450500003082054130820329a0030201020213066c9fd29635869f0a0fe58678f85b26bb8a37300d06092a864886f70d01010c05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412032301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f74204341203230820222300d06092a864886f70d01010105000382020f003082020a0282020100ad969f2d9c4a4c4a81795199ec8acb6b605113bc4d6d06fcb0088ddd19106ac7260c35d8c06f2084e994b19b8503c35bdb4ae8c8f89076d95b4fe34ce806364dcc9aac3d0c902b92d4061960ac374479858182ad5a37e00dcc9da64c5276ea439db704d150f655e0d5d2a64985e937e9ca7eae5c954d489a3fae205a6d8895d934b8521a4390b0bf6c05b9b678b7ead0e43a3c125362ff4af27bbe3505a91234e3f36474622c3d00495a28fe3244bb87dd652702713bda4af71fdacdf72155904f0fecae82e19f6bd945d3bbf05f87ed3c2c3986da3fdeec7255eb79a3addbdd7cb0ba1ccefcde4f3576cf0ff8781f6a36514627615be99ecff0a2557d7c258a6f2fb4c5cf842e2bfd0d51106cfb5f1bbc1b7ec5ae3b98013192ff0b57f49ab2b957e9abef0d76d1f0eef4ce86a7e06ee9b469a1df69f633c6692e97139ea587b057108137c953b3bb7ff692d19cd018f4926eda834fa663994ca5fb5eef21647a205f6c648515cb37e9620c0b2a16dc012e32da3e4bf59e3af6174094ef9e910886fabe63a85a33eccb744395f96c695236c7296ffc55035c1ffb9fbd47ebe74947950b4e89220949e0f5611ef1bf2e8a726e8059ff573af97532a34e5feced2862d94d73f2cc811760edcdebdcdba7cac57e02bdf2540854fdb42d092c17544a98d154e1516708d2ed6e7e6f3fd22d81592966cb903995111e7427feddebaf0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414b00cf04c30f405580248fd33e552af4b84e36652300d06092a864886f70d01010c05000382020100aaa8808f0e78a3e0a2d4cde6f5987a3bea0003b0970e93bc5aa8f62c8c7287a9b1fc7f73fd637178a58759cf30e10d10b2135a6d82f56ae6809fa0050b68e4476bc76adfb6fd773272e518fa09f4a0932c5dd28c75857665900c0379b7312363ad788309866884cafff9cf269a9279e7cd4bc5e761a717cbf3a91293936ba7e82f5392c46058b0cc0251185b858d625963b6adb4de9afb26f70027c05d55377499c9507fe3592e44e32c25eeec4c3277b49f1ae94b5d20c5dafd1c8716c643e8d4bb269a45705ea90b3753e2467b27fde046f289b7cc42b6cb28266ed9a5c93ac8411360f7508c15aeb26d1a151a5778e6922ad96590823f6c02afae123a27963604d71da28063a99bf1e5bab47c14b04ec9b11f745f38f651ea9bfa2ca211d4a92d271a45b1afb24e710dc05846d66906cb53cbb3fe6b41cd417e7d4c0f7c72797a59cd5e4a0eac9ba99873797cb4f4ccb9b8070cb2745cb8c76f88a190a7f4aaf9bf673af41a15621eb79fbe3db129af67a112f25810195303301bb81a89f69cbd97038ea309f31d8b21f1b4dfe41cd19f650206ea5cd613b384efa2a55c8c7729a768c06bae40d2a8b4eacdf08d4b389c199a1b2854b88990efca75813e1ef26424c718af4eff479e07f63565a4d30a56fff517646cefa822254993b6df0017da587e5deec51bb0d1d15f2110c7f9f3ba020a2707c5f1d6c7d3e0fb09606c MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0D44DD8C3C8C1A1A58756481E90F2E2AFFB3D26E\Blob = 0300000001000000140000000d44dd8c3c8c1a1a58756481e90f2e2affb3d26e2000000001000000ba010000308201b63082015ba0030201020213066c9fd5749736663f3b0b9ad9e89e7603f24a300a06082a8648ce3d0403023039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412033301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f7420434120333059301306072a8648ce3d020106082a8648ce3d030107034200042997a7c6417fc00d9be8011b56c6f252a5ba2db212e8d22ed7fac9c5d8aa6d1f73813b3b986b397c33a5c54e868e8017686245577d44581db337e56708eb66dea3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414abb6dbd7069e37ac3086079170c79cc419b178c0300a06082a8648ce3d0403020349003046022100e08592a317b78df92b06a593ac1a98686172fae1a1d0fb1c7860a64399c5b8c40221009c02eff1949cb396f9ebc62af8b62cfe3a901416d78c6324481cdf307dd5683b MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\2AD974A775F73CBDBBD8F5AC3A49255FA8FB1F8C\Blob = 0300000001000000140000002ad974a775f73cbdbbd8f5ac3a49255fa8fb1f8c2000000001000000620400003082045e30820346a0030201020213077312380b9d6688a33b1ed9bf9ccda68e0e0f300d06092a864886f70d01010b05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412031301e170d3232303832333232323132385a170d3330303832333232323132385a303c310b3009060355040613025553310f300d060355040a1306416d617a6f6e311c301a06035504031313416d617a6f6e205253412032303438204d303130820122300d06092a864886f70d01010105000382010f003082010a0282010100eb712ca9cb1f8828923230af8a570f78b73725955587ac675c97d322c8daa214676b7cf067dae2032ab356125dc6b547f96708a7937a9592180fb4f9f910369a7f2f80b64fba134ec75d531ee0dd96330720d396bc12e4745042a1051373b54f9b4424fe2d7fedbc2285ec362133977506ce271882dce3d9c582078d5e26012626671fd93f13cf32ba6bad7864fcaaff0e023c07df9c0578728cfdea75b7032884dae86e078cd05085ef8154b2716eec6d62ef8f94c35ee9c4a4d091c02e249198caeeba258ed4f671b6fb5b6b38064837478d86dcf2ea06fb76377d9eff424e4d588293cfe271c278b17aab4b5b94378881e4d9af24aef872c565fb4bb451e70203010001a382015a3082015630120603551d130101ff040830060101ff020100300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030106082b06010505070302301d0603551d0e0416041481b80e638a891218e5fa3b3b50959fe6e5901385301f0603551d230418301680148418cc8534ecbc0c94942e08599cc7b2104e0a08307b06082b06010505070101046f306d302f06082b060105050730018623687474703a2f2f6f6373702e726f6f746361312e616d617a6f6e74727573742e636f6d303a06082b06010505073002862e687474703a2f2f6372742e726f6f746361312e616d617a6f6e74727573742e636f6d2f726f6f746361312e636572303f0603551d1f043830363034a032a030862e687474703a2f2f63726c2e726f6f746361312e616d617a6f6e74727573742e636f6d2f726f6f746361312e63726c30130603551d20040c300a3008060667810c010201300d06092a864886f70d01010b05000382010100ad00de0205232e063262b46bb19416e41140de2bfa59c135efe0aa8f2b41b9d1f38739001df23db5a7470c0606c691f3075702d4edbd17c1909abf4875a2074f30dd4a6a42b50d3d15c00ffe845bc63c99cc5752b1d86e12d59692934b94e507e88982086a7a34d49e64e13d876a92909a63a14bf88fb6ea34d305be20c2de06e28c9f738b9f4d3985cace19369d85c99ec9f8503fb67e88a1efca84068b50b40a5ca61c44f1fdc8614060f26125aa07f4c7c27375e40c0b428d04e55f4448995b7b898196a7889d4b0d62e804c4d7feb4e8b26dcaecc01cbc385b1ddf85ce5b7ae3494b6cb9a7ddf405b249ade1c5146bc2ccebcd7fd65869bac3207e7fb0b8 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 5c0000000100000004000000001000001900000001000000100000009f687581f7ef744ecfc12b9cee6238f10f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa2140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a2040000000100000010000000be954f16012122448ca8bc279602acf52000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 MBAMService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800001900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa20f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b4040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e MBAMService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa22000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0D44DD8C3C8C1A1A58756481E90F2E2AFFB3D26E MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F6108407D6F8BB67980CC2E244C2EBAE1CEF63BE\Blob = 030000000100000014000000f6108407d6f8bb67980cc2e244c2ebae1cef63be2000000001000000f6010000308201f230820178a0030201020213066c9fd7c1bb104c2943e5717b7b2cc81ac10e300a06082a8648ce3d0403033039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412034301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f7420434120343076301006072a8648ce3d020106052b8104002203620004d2ab8a374fa3530dfec18a7b4ba87b464b63b062f62d1bdb087121d200e863bd9a27fbf0396e5dea3da5c981aaa35b2098455d16dbfde8106de39ce0e3bd5f8462f3706433a0cb242f70ba88a12aa075f881ae6206c481db396e29b01efa2e5ca3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414d3ecc73a656ecce1da769a56fb9cf3866d57e581300a06082a8648ce3d040303036800306502303a8b21f1bd7e11add0ef58962fd6eb9d7e908d2bcf6655c32ce328a9700a470ef0375912ff2d9994284e2a4f354d335a023100ea75004e3bc43a941291c958469d211372a7889c8ae44c4adb96d4ac8b6b6b49125333add7e4be24fcb50a76d4a5bc10 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\1C58A3A8518E8759BF075B76B750D4F2DF264FCD MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\1C58A3A8518E8759BF075B76B750D4F2DF264FCD\Blob = 0300000001000000140000001c58a3a8518e8759bf075b76b750d4f2df264fcd2000000001000000c2040000308204be308203a6a003020102021006d8d904d5584346f68a2fa754227ec4300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3231303431343030303030305a170d3331303431333233353935395a304f310b300906035504061302555331153013060355040a130c446967694365727420496e633129302706035504031320446967694365727420544c53205253412053484132353620323032302043413130820122300d06092a864886f70d01010105000382010f003082010a0282010100c14bb3654770bcdd4f58dbec9cedc366e51f311354ad4a66461f2c0aec6407e52edcdcb90a20eddfe3c4d09e9aa97a1d8288e51156db1e9f58c251e72c340d2ed292e156cbf1795fb3bb87ca25037b9a52416610604f571349f0e8376783dfe7d34b674c2251a6df0e9910ed57517426e27dc7ca622e131b7f238825536fc13458008b84fff8bea75849227b96ada2889b15bca07cdfe951a8d5b0ed37e236b4824b62b5499aecc767d6e33ef5e3d6125e44f1bf71427d58840380b18101faf9ca32bbb48e278727c52b74d4a8d697dec364f9cace53a256bc78178e490329aefb494fa415b9cef25c19576d6b79a72ba2272013b5d03d40d321300793ea99f50203010001a38201823082017e30120603551d130101ff040830060101ff020100301d0603551d0e04160414b76ba2eaa8aa848c79eab4da0f98b2c59576b9f4301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030106082b06010505070302307606082b06010505070101046a3068302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304006082b060105050730028634687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274476c6f62616c526f6f7443412e63727430420603551d1f043b30393037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274476c6f62616c526f6f7443412e63726c303d0603551d2004363034300b06096086480186fd6c02013007060567810c01013008060667810c0102013008060667810c0102023008060667810c010203300d06092a864886f70d01010b050003820101008032ce5e0bdd6e5a0d0aafe1d684cbc08efa8570edda5db30cf72b7540fe850afaf33178b7704b1a8958ba80bdf36b1de97ecf0bba589c59d490d3fd6cfdd0986db771825bcf6d0b5a09d07bdec443d82aa4de9e41265fbb8f99cbddaee1a86f9f87fe74b71f1b20abb14fc6f5675d5d9b3ce9ff69f7616cd6d9f3fd36c6ab038876d24b2e7586e3fcd8557d26c21177df3e02b67cf3ab7b7a86366fb8f7d89371cf86df7330fa7babed2a59c842843b11171a52f3c90e147da25b7267ba71ed574766c5b8024a65345e8bd02a3c209c51994ce7529ef76b112b0d927e1de88aeb36164387ea2a63bf753febdec403bb0a3cf730efebaf4cfc8b3610733ef3a4 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\2AD974A775F73CBDBBD8F5AC3A49255FA8FB1F8C MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 040000000100000010000000be954f16012122448ca8bc279602acf5140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a2030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa20f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e1900000001000000100000009f687581f7ef744ecfc12b9cee6238f12000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 MBAMService.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
mbamtray.exembam.exepid process 4232 mbamtray.exe 2296 mbam.exe -
Suspicious behavior: EnumeratesProcesses 59 IoCs
Processes:
MBSetup.exeMBAMInstallerService.exeMBAMService.exembamtray.exembam.exepid process 3100 MBSetup.exe 3100 MBSetup.exe 5100 MBAMInstallerService.exe 5100 MBAMInstallerService.exe 5100 MBAMInstallerService.exe 5100 MBAMInstallerService.exe 5100 MBAMInstallerService.exe 5100 MBAMInstallerService.exe 5100 MBAMInstallerService.exe 5100 MBAMInstallerService.exe 5100 MBAMInstallerService.exe 5100 MBAMInstallerService.exe 1616 MBAMService.exe 1616 MBAMService.exe 1616 MBAMService.exe 1616 MBAMService.exe 1616 MBAMService.exe 1616 MBAMService.exe 1616 MBAMService.exe 1616 MBAMService.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 1616 MBAMService.exe 1616 MBAMService.exe 1616 MBAMService.exe 1616 MBAMService.exe 2296 mbam.exe 2296 mbam.exe 2296 mbam.exe 2296 mbam.exe 1616 MBAMService.exe 1616 MBAMService.exe 1616 MBAMService.exe 1616 MBAMService.exe 1616 MBAMService.exe 1616 MBAMService.exe 2296 mbam.exe 2296 mbam.exe 1616 MBAMService.exe 1616 MBAMService.exe 1616 MBAMService.exe 1616 MBAMService.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 1616 MBAMService.exe 1616 MBAMService.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 1616 MBAMService.exe 1616 MBAMService.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
mbam.exepid process 2296 mbam.exe -
Suspicious behavior: LoadsDriver 12 IoCs
Processes:
pid process 624 624 624 624 624 624 624 624 624 624 624 624 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
MBAMService.exeMBAMService.exedescription pid process Token: 33 4760 MBAMService.exe Token: SeIncBasePriorityPrivilege 4760 MBAMService.exe Token: 33 1616 MBAMService.exe Token: SeIncBasePriorityPrivilege 1616 MBAMService.exe Token: SeBackupPrivilege 1616 MBAMService.exe Token: SeRestorePrivilege 1616 MBAMService.exe Token: SeTakeOwnershipPrivilege 1616 MBAMService.exe Token: SeBackupPrivilege 1616 MBAMService.exe Token: SeRestorePrivilege 1616 MBAMService.exe Token: SeBackupPrivilege 1616 MBAMService.exe Token: SeRestorePrivilege 1616 MBAMService.exe Token: SeBackupPrivilege 1616 MBAMService.exe Token: SeRestorePrivilege 1616 MBAMService.exe Token: SeBackupPrivilege 1616 MBAMService.exe Token: SeRestorePrivilege 1616 MBAMService.exe Token: SeBackupPrivilege 1616 MBAMService.exe Token: SeRestorePrivilege 1616 MBAMService.exe Token: SeBackupPrivilege 1616 MBAMService.exe Token: SeRestorePrivilege 1616 MBAMService.exe Token: SeBackupPrivilege 1616 MBAMService.exe Token: SeRestorePrivilege 1616 MBAMService.exe Token: SeBackupPrivilege 1616 MBAMService.exe Token: SeRestorePrivilege 1616 MBAMService.exe Token: SeBackupPrivilege 1616 MBAMService.exe Token: SeRestorePrivilege 1616 MBAMService.exe Token: SeBackupPrivilege 1616 MBAMService.exe Token: SeRestorePrivilege 1616 MBAMService.exe Token: SeBackupPrivilege 1616 MBAMService.exe Token: SeRestorePrivilege 1616 MBAMService.exe Token: SeBackupPrivilege 1616 MBAMService.exe Token: SeRestorePrivilege 1616 MBAMService.exe Token: SeBackupPrivilege 1616 MBAMService.exe Token: SeRestorePrivilege 1616 MBAMService.exe Token: SeBackupPrivilege 1616 MBAMService.exe Token: SeRestorePrivilege 1616 MBAMService.exe Token: SeBackupPrivilege 1616 MBAMService.exe Token: SeRestorePrivilege 1616 MBAMService.exe Token: SeBackupPrivilege 1616 MBAMService.exe Token: SeRestorePrivilege 1616 MBAMService.exe Token: SeBackupPrivilege 1616 MBAMService.exe Token: SeRestorePrivilege 1616 MBAMService.exe Token: SeBackupPrivilege 1616 MBAMService.exe Token: SeRestorePrivilege 1616 MBAMService.exe Token: SeBackupPrivilege 1616 MBAMService.exe Token: SeRestorePrivilege 1616 MBAMService.exe Token: SeBackupPrivilege 1616 MBAMService.exe Token: SeRestorePrivilege 1616 MBAMService.exe Token: SeBackupPrivilege 1616 MBAMService.exe Token: SeRestorePrivilege 1616 MBAMService.exe Token: SeBackupPrivilege 1616 MBAMService.exe Token: SeRestorePrivilege 1616 MBAMService.exe Token: SeBackupPrivilege 1616 MBAMService.exe Token: SeRestorePrivilege 1616 MBAMService.exe Token: SeBackupPrivilege 1616 MBAMService.exe Token: SeRestorePrivilege 1616 MBAMService.exe Token: SeBackupPrivilege 1616 MBAMService.exe Token: SeRestorePrivilege 1616 MBAMService.exe Token: SeBackupPrivilege 1616 MBAMService.exe Token: SeRestorePrivilege 1616 MBAMService.exe Token: SeBackupPrivilege 1616 MBAMService.exe Token: SeRestorePrivilege 1616 MBAMService.exe Token: SeBackupPrivilege 1616 MBAMService.exe Token: SeRestorePrivilege 1616 MBAMService.exe Token: SeBackupPrivilege 1616 MBAMService.exe -
Suspicious use of FindShellTrayWindow 38 IoCs
Processes:
MBSetup.exembamtray.exembam.exepid process 3100 MBSetup.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 2296 mbam.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 2296 mbam.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe -
Suspicious use of SendNotifyMessage 34 IoCs
Processes:
mbamtray.exepid process 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe 4232 mbamtray.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
MBAMInstallerService.exeMBAMService.exeMBSetup.exedescription pid process target process PID 5100 wrote to memory of 4760 5100 MBAMInstallerService.exe MBAMService.exe PID 5100 wrote to memory of 4760 5100 MBAMInstallerService.exe MBAMService.exe PID 1616 wrote to memory of 4232 1616 MBAMService.exe mbamtray.exe PID 1616 wrote to memory of 4232 1616 MBAMService.exe mbamtray.exe PID 3100 wrote to memory of 2296 3100 MBSetup.exe mbam.exe PID 3100 wrote to memory of 2296 3100 MBSetup.exe mbam.exe PID 1616 wrote to memory of 2912 1616 MBAMService.exe ig-39.exe PID 1616 wrote to memory of 2912 1616 MBAMService.exe ig-39.exe PID 1616 wrote to memory of 2912 1616 MBAMService.exe ig-39.exe PID 1616 wrote to memory of 2156 1616 MBAMService.exe ig-0.exe PID 1616 wrote to memory of 2156 1616 MBAMService.exe ig-0.exe PID 1616 wrote to memory of 2156 1616 MBAMService.exe ig-0.exe PID 1616 wrote to memory of 1240 1616 MBAMService.exe ig-42.exe PID 1616 wrote to memory of 1240 1616 MBAMService.exe ig-42.exe PID 1616 wrote to memory of 1240 1616 MBAMService.exe ig-42.exe PID 1616 wrote to memory of 3056 1616 MBAMService.exe ig-2.exe PID 1616 wrote to memory of 3056 1616 MBAMService.exe ig-2.exe PID 1616 wrote to memory of 3056 1616 MBAMService.exe ig-2.exe PID 1616 wrote to memory of 3324 1616 MBAMService.exe ig-3.exe PID 1616 wrote to memory of 3324 1616 MBAMService.exe ig-3.exe PID 1616 wrote to memory of 3324 1616 MBAMService.exe ig-3.exe PID 1616 wrote to memory of 4788 1616 MBAMService.exe ig-4.exe PID 1616 wrote to memory of 4788 1616 MBAMService.exe ig-4.exe PID 1616 wrote to memory of 4788 1616 MBAMService.exe ig-4.exe PID 1616 wrote to memory of 4652 1616 MBAMService.exe ig-24.exe PID 1616 wrote to memory of 4652 1616 MBAMService.exe ig-24.exe PID 1616 wrote to memory of 4652 1616 MBAMService.exe ig-24.exe PID 1616 wrote to memory of 4500 1616 MBAMService.exe ig-6.exe PID 1616 wrote to memory of 4500 1616 MBAMService.exe ig-6.exe PID 1616 wrote to memory of 4500 1616 MBAMService.exe ig-6.exe PID 1616 wrote to memory of 3440 1616 MBAMService.exe ig-7.exe PID 1616 wrote to memory of 3440 1616 MBAMService.exe ig-7.exe PID 1616 wrote to memory of 3440 1616 MBAMService.exe ig-7.exe PID 1616 wrote to memory of 4180 1616 MBAMService.exe ig-8.exe PID 1616 wrote to memory of 4180 1616 MBAMService.exe ig-8.exe PID 1616 wrote to memory of 4180 1616 MBAMService.exe ig-8.exe PID 1616 wrote to memory of 2120 1616 MBAMService.exe ig-9.exe PID 1616 wrote to memory of 2120 1616 MBAMService.exe ig-9.exe PID 1616 wrote to memory of 2120 1616 MBAMService.exe ig-9.exe PID 1616 wrote to memory of 4220 1616 MBAMService.exe ig-10.exe PID 1616 wrote to memory of 4220 1616 MBAMService.exe ig-10.exe PID 1616 wrote to memory of 4220 1616 MBAMService.exe ig-10.exe PID 1616 wrote to memory of 3476 1616 MBAMService.exe ig-11.exe PID 1616 wrote to memory of 3476 1616 MBAMService.exe ig-11.exe PID 1616 wrote to memory of 3476 1616 MBAMService.exe ig-11.exe PID 1616 wrote to memory of 4904 1616 MBAMService.exe ig-31.exe PID 1616 wrote to memory of 4904 1616 MBAMService.exe ig-31.exe PID 1616 wrote to memory of 4904 1616 MBAMService.exe ig-31.exe PID 1616 wrote to memory of 2208 1616 MBAMService.exe ig-33.exe PID 1616 wrote to memory of 2208 1616 MBAMService.exe ig-33.exe PID 1616 wrote to memory of 2208 1616 MBAMService.exe ig-33.exe PID 1616 wrote to memory of 316 1616 MBAMService.exe ig-14.exe PID 1616 wrote to memory of 316 1616 MBAMService.exe ig-14.exe PID 1616 wrote to memory of 316 1616 MBAMService.exe ig-14.exe PID 1616 wrote to memory of 2624 1616 MBAMService.exe ig-15.exe PID 1616 wrote to memory of 2624 1616 MBAMService.exe ig-15.exe PID 1616 wrote to memory of 2624 1616 MBAMService.exe ig-15.exe PID 1616 wrote to memory of 5084 1616 MBAMService.exe ig-16.exe PID 1616 wrote to memory of 5084 1616 MBAMService.exe ig-16.exe PID 1616 wrote to memory of 5084 1616 MBAMService.exe ig-16.exe PID 1616 wrote to memory of 3428 1616 MBAMService.exe ig-17.exe PID 1616 wrote to memory of 3428 1616 MBAMService.exe ig-17.exe PID 1616 wrote to memory of 3428 1616 MBAMService.exe ig-17.exe PID 1616 wrote to memory of 4840 1616 MBAMService.exe ig-40.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3132
-
C:\Users\Admin\AppData\Local\Temp\MBSetup.exe"C:\Users\Admin\AppData\Local\Temp\MBSetup.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Checks BIOS information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe"C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:2296
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"1⤵
- Drops file in Drivers directory
- Enumerates connected drives
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe" /Service /Protected2⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Windows directory
- Executes dropped EXE
- Registers COM server for autorun
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4760
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Checks BIOS information in registry
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe"C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4232 -
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵PID:2912
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-0.exeig.exe reseed2⤵
- Executes dropped EXE
PID:2156 -
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-1.exeig.exe reseed2⤵PID:1240
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-2.exeig.exe reseed2⤵
- Executes dropped EXE
PID:3056 -
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-3.exeig.exe reseed2⤵
- Executes dropped EXE
PID:3324 -
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-4.exeig.exe reseed2⤵
- Executes dropped EXE
PID:4788 -
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-5.exeig.exe reseed2⤵PID:4652
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-6.exeig.exe reseed2⤵
- Executes dropped EXE
PID:4500 -
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-7.exeig.exe reseed2⤵
- Executes dropped EXE
PID:3440 -
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-8.exeig.exe reseed2⤵
- Executes dropped EXE
PID:4180 -
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-9.exeig.exe reseed2⤵
- Executes dropped EXE
PID:2120 -
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-10.exeig.exe reseed2⤵
- Executes dropped EXE
PID:4220 -
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-11.exeig.exe reseed2⤵
- Executes dropped EXE
PID:3476 -
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-12.exeig.exe reseed2⤵PID:4904
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-13.exeig.exe reseed2⤵PID:2208
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-14.exeig.exe reseed2⤵
- Executes dropped EXE
PID:316 -
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-15.exeig.exe reseed2⤵
- Executes dropped EXE
PID:2624 -
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-16.exeig.exe reseed2⤵
- Executes dropped EXE
PID:5084 -
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-17.exeig.exe reseed2⤵
- Executes dropped EXE
PID:3428 -
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-18.exeig.exe reseed2⤵PID:4840
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-19.exeig.exe reseed2⤵
- Executes dropped EXE
PID:3120 -
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-20.exeig.exe reseed2⤵
- Executes dropped EXE
PID:3624 -
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-21.exeig.exe reseed2⤵
- Executes dropped EXE
PID:2976 -
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-22.exeig.exe reseed2⤵
- Executes dropped EXE
PID:4116 -
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-23.exeig.exe reseed2⤵
- Executes dropped EXE
PID:2696 -
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-24.exeig.exe reseed2⤵
- Executes dropped EXE
PID:4652 -
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-25.exeig.exe reseed2⤵
- Executes dropped EXE
PID:208 -
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-26.exeig.exe reseed2⤵
- Executes dropped EXE
PID:220 -
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-27.exeig.exe reseed2⤵
- Executes dropped EXE
PID:4320 -
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-28.exeig.exe reseed2⤵PID:5068
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-29.exeig.exe reseed2⤵
- Executes dropped EXE
PID:3052 -
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-30.exeig.exe reseed2⤵
- Executes dropped EXE
PID:2920 -
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-31.exeig.exe reseed2⤵
- Executes dropped EXE
PID:4904 -
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-32.exeig.exe reseed2⤵
- Executes dropped EXE
PID:2944 -
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-33.exeig.exe reseed2⤵
- Executes dropped EXE
PID:2208 -
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-34.exeig.exe reseed2⤵
- Executes dropped EXE
PID:4108 -
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-35.exeig.exe reseed2⤵
- Executes dropped EXE
PID:4292 -
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-36.exeig.exe reseed2⤵
- Executes dropped EXE
PID:3536 -
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-37.exeig.exe reseed2⤵
- Executes dropped EXE
PID:3828 -
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-38.exeig.exe reseed2⤵
- Executes dropped EXE
PID:2992 -
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-39.exeig.exe reseed2⤵
- Executes dropped EXE
PID:2912 -
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-40.exeig.exe reseed2⤵
- Executes dropped EXE
PID:4840 -
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-41.exeig.exe reseed2⤵
- Executes dropped EXE
PID:1584 -
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-42.exeig.exe reseed2⤵
- Executes dropped EXE
PID:1240 -
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-43.exeig.exe reseed2⤵
- Executes dropped EXE
PID:3104 -
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-44.exeig.exe reseed2⤵
- Executes dropped EXE
PID:4548 -
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-45.exeig.exe reseed2⤵
- Executes dropped EXE
PID:712 -
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-46.exeig.exe reseed2⤵
- Executes dropped EXE
PID:3340 -
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-47.exeig.exe reseed2⤵
- Executes dropped EXE
PID:5068 -
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-48.exeig.exe reseed2⤵
- Executes dropped EXE
PID:4280 -
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-49.exeig.exe reseed2⤵
- Executes dropped EXE
PID:1736 -
C:\Program Files\Malwarebytes\Anti-Malware\MBAMWsc.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMWsc.exe" /wac 0 /status on true /updatesubstatus none /scansubstatus none /settingssubstatus none2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:4084 -
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵PID:3584
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-0.exeig.exe reseed2⤵PID:2840
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-1.exeig.exe reseed2⤵PID:3596
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-2.exeig.exe reseed2⤵PID:3192
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-3.exeig.exe reseed2⤵PID:4804
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-4.exeig.exe reseed2⤵PID:1648
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-5.exeig.exe reseed2⤵PID:2192
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-6.exeig.exe reseed2⤵PID:2736
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-7.exeig.exe reseed2⤵PID:4964
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-8.exeig.exe reseed2⤵PID:3392
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-9.exeig.exe reseed2⤵PID:4328
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-10.exeig.exe reseed2⤵PID:4036
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-11.exeig.exe reseed2⤵PID:1680
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-12.exeig.exe reseed2⤵PID:608
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-13.exeig.exe reseed2⤵PID:2268
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-14.exeig.exe reseed2⤵PID:988
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-15.exeig.exe reseed2⤵PID:4312
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-16.exeig.exe reseed2⤵PID:3144
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-17.exeig.exe reseed2⤵PID:3204
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-18.exeig.exe reseed2⤵PID:3828
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-19.exeig.exe reseed2⤵PID:4240
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-20.exeig.exe reseed2⤵PID:4576
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-21.exeig.exe reseed2⤵PID:3444
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-22.exeig.exe reseed2⤵PID:2256
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-23.exeig.exe reseed2⤵PID:3656
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-24.exeig.exe reseed2⤵PID:4588
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-25.exeig.exe reseed2⤵PID:4960
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-26.exeig.exe reseed2⤵PID:1584
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-27.exeig.exe reseed2⤵PID:4076
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-28.exeig.exe reseed2⤵PID:3780
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-29.exeig.exe reseed2⤵PID:2796
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-30.exeig.exe reseed2⤵PID:652
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-31.exeig.exe reseed2⤵PID:2164
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-32.exeig.exe reseed2⤵PID:4116
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-33.exeig.exe reseed2⤵PID:4052
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-34.exeig.exe reseed2⤵PID:4548
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-35.exeig.exe reseed2⤵PID:3208
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-36.exeig.exe reseed2⤵PID:3120
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-37.exeig.exe reseed2⤵PID:5092
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-38.exeig.exe reseed2⤵PID:3044
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-39.exeig.exe reseed2⤵PID:3464
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-40.exeig.exe reseed2⤵PID:2848
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-41.exeig.exe reseed2⤵PID:3316
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-42.exeig.exe reseed2⤵PID:2744
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-43.exeig.exe reseed2⤵PID:3456
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-44.exeig.exe reseed2⤵PID:3604
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-45.exeig.exe reseed2⤵PID:4476
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-46.exeig.exe reseed2⤵PID:3476
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-47.exeig.exe reseed2⤵PID:4220
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-48.exeig.exe reseed2⤵PID:3660
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-49.exeig.exe reseed2⤵PID:3764
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2f41⤵PID:2076
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\016ef11ec1d74245970d4e9d7fe77c2b /t 924 /p 22961⤵PID:1800
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Defense Evasion
Modify Registry
3Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\7z.dllFilesize
1.7MB
MD5461faf68ccc02b0223fd273b630f21fe
SHA1363b8beaa74f0f454c2d544ace9e71a84bc2b4cf
SHA256cb07f3f461e9c267831b1ab93af6dfda1bb51d72e42d73d00d26594f09326be1
SHA5124b671f48e45fdedf50c7f7bb6c8d82a3b98f7502006eb002aaf8ff31f25f9ff1257c7bcc12caf622e43d4ec665b19d978ae3e3762f76def0bc71485ebdb8426f
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\Actions.dllFilesize
5.0MB
MD51eff53d95ecaf6bbfffe80d866d8e1dd
SHA1d7ef7d7c77fd04b2c0eb8c16bb3cd08057f6742f
SHA2566dd748f7ca56125cbe158fa3612f08e7312ef58ad5375e6b7ab5532cc16ca0ac
SHA512c59b8e6f0b238a247e64b9c7bb42213dadac1dada63542830a6292361174c935c0c662b2d1aed3fb6100cc4993297b1eaf25e328f2b4613458c4ffca63b9f02d
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ActionsShim.dllFilesize
2.5MB
MD558149edf4990067b4c1ffe1c32a51a01
SHA180c0c8b8def45420159659d2eaad181eb0b05c40
SHA25667af73f9b49ce113d02d7f2824e45d48044273772c94e6e8c300cf86bf83cb55
SHA512fe69f4eccaa35b132b7dfc77fae50733398cfa5ab7377f502a50e1bb83be6b81fad26a0a24f6dfbc99dca6e118784f3452edc4a30c11ac161fc0db62b039cb4e
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\BrowserSDKDLL.dllFilesize
5.8MB
MD51ed53171d00f440f29a12f9beb84dac4
SHA14d9a1e3579b0999f1ab2fa818b588411e9ee920c
SHA256e659e687a872050f9e65d78992d16bd9b393cf3f8e8c94e0e15fb42b7065327e
SHA51217161cfc672d1b996b8af4ebac17f9a8a3807f38c9a23e2e5b4dadcd9a21c3a64faec9bf59147022a9df88b80f89300f1b537091289bd7a42806bd206a317e6e
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\BrowserSDKDLLShim.dllFilesize
2.5MB
MD52e8ad6f405eb7744908f635dc089438a
SHA1f2ca3f55ce4395dfe39a0ba099a39f8c30e263cb
SHA2564824ad6b30b42a9166bfd3db41f11e3cb67e7aab96058b7f946797d7dadba891
SHA5123eacea19caf3f04cddb35091102c5d627b82acc8c73be1bfa4d72932c78cba7821c99c616bbd8d422ce588b865700db560ba441f8a5da6a9629af844f6ad28c5
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\CleanControllerImpl.dllFilesize
6.9MB
MD573a08c403bf08e39bd560ffc74ae9b8f
SHA1888c6d11e6788875f8fca748b6f92a19b6126dc6
SHA25609d687c0164a9f108c4f9e107bfc0cb671ebe643ac9aae968cb8df0e5adda960
SHA5128b65c0549c319e9c42b30071b1342e8ba4239d9dc4a124e19abd2160339c03235f0ec534a997ec367f2b474797d33efa496e641c7a63904bf8e0af43a32f1535
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\CloudControllerImpl.dllFilesize
4.8MB
MD5d739c6bd5d5cae2ae961a0c2d40eb5b1
SHA116d0d40707bf55f04a0da70798b5368e612fd5e6
SHA25625472857a59a9067c1224b173b378448bb574f5365edbe4a1a46df8810007f9a
SHA5127d80a39f3a91e0faa87ae8143f43d2e8947eaedfd317a1ac1547dfa15b825cc5c200f8baebe127a0bc2379fe90c40f3ea25db09c06b521aad1c189ce24a53c7d
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\LicenseControllerImpl.dllFilesize
4.4MB
MD565e42cbe095830d9d93ecabb13392780
SHA1e60110e159cc4cc92d2606ae3ba3559c10170e5a
SHA256a773e1706bbb6e8cb522d0e1a3d29e496bcbe6a91e221c26bea98292b9316f7f
SHA5126b25cebb6433ec87831a3f0f67b96c7fc37a617158a18d9ac20bd375f46c97da8a41e4379da72808fdd7947705c6c09518c56152f96eebf2bcefb39ffa6202ed
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\MBAMCore.dllFilesize
6.4MB
MD59db84546ec6408e2eb7c8711df562ad5
SHA1b408a7f0c28b8ef20b1021f3211c7495b7fe9171
SHA256238162c0adab6a1611b428726c5d0b5830b553a9677bee986fc29522563e441e
SHA512a5fdf28b82a16bb512061ebc9cc128e9efdeb3bfcfe50a4c88c2256abe5c5b10f8d237d4ab7788e5eca3dccc9d20251c4ebe8a80856f7a3174d95b24d2c3c6ba
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\MBAMShim.dllFilesize
3.0MB
MD5f44b6c80c46c4cf3071b5f5b916e1271
SHA1839f2238ecbbfa80ebf9c1f77eafc78204b58761
SHA256732523df43358729d5e85cceb557d69016dcdd3e2238d903c33c5327c3131fae
SHA51299be164ae96bc4f93dc896d5df445ad1c2f023f10605a8c9857d7ebedfc5b070f50cd33b401d61003e601a06b8446e6c0b5dbddda4927a2e1352407d3b266942
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\PoliciesControllerImpl.dllFilesize
4.0MB
MD5efe6216931bca54ccf05a0bcb9f83fb9
SHA1007d0a3c4d850cd9b2886b24daf91c988d702bdd
SHA256eaf71519b965b9530e84be08bd3649fdb8feeeabb8dd2455be95755a336a44d6
SHA5127c59071b6ae8d0a2d6eedcb58f6a1337aa340275bf30baa121f515241aba822f6f7bbbc53b626f5f44c424af70aef3afc582a1a8a34d0b0adef115d0e8f684f4
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ScanControllerImpl.dllFilesize
5.7MB
MD5e80262b787eec69e8dd3d051a1d2840c
SHA1bbb88d699a7715d800db88679d6f7d52bf16673e
SHA256a07dbc4cc18dea7c29ea1e32c1511e846bd06ca86229b0499cbe20575937395f
SHA51216f8abc1cb48d8e7786a8add362987b0a464e0082c2bdce5ad42ed52cea1ad64cc117dc80127b5666f26d777701b1b81c178a87301be6394e8f17e5370f68789
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\Swissarmy.dllFilesize
4.0MB
MD53486801ce1e8ffc1bbc6d4f097b0f369
SHA108f2a85cd07cf1c0d6f27f0d5e7179c2a5cb8600
SHA25626720d0b669898089a4ab5a6c53203918ec399d227331273ba11169bbe273678
SHA51281974a79bf4e4086549874ef778e7716713a0107ccce212e9564f3355a26670943845aaba744691d2b68224e06e2f9d9a263e29f4ca7e46e1bfdb507a24656d5
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\SwissarmyShim.dllFilesize
2.6MB
MD589a38afcfa758e3298609c6c51929593
SHA12df1ee30adc92bd995526e41fd9c823354de30b4
SHA2564795576483af0c136a71dcee87a0ffb54f0869cae6395ac2ff8312bf555e7161
SHA512cceaed0b9a7517aebd739a377c7bd8987b9ac357be2bf987dbae31d59f2121c5bb9a9bfa2c70a9a54ad65546ef23903176dd6328d93408cb5c991257d59e2717
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\TelemetryControllerImpl.dllFilesize
5.3MB
MD51692937ebb8172814cfd1b2d20dac8c6
SHA13ad3b0dce9958ce66d89c280645ae827d3b89f16
SHA256f1cee1b89fff12181d828623b3aba0f0b8c0aed4aab8b0c017ea4d4731c16e32
SHA512a36462731990635f57f80c070cb01a8c4fe6fa445aad63f077197d473d0d625e23bcadaf5bf92c9504919ee69d12239a7733febf27d6016aa20c03f631b7e3e8
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\UpdateControllerImpl.dllFilesize
4.4MB
MD52114b71049bc4626a565fa7bef9ba37c
SHA1ca5567bd58897128a750be7db94357253321db0d
SHA256e981f1d6fdd820ad2781f0cbdc3b0715101de3257c1aab23af806f0a547dfb9e
SHA5129f97a9fdfd54072730aed98948f7b46c9667cadddc87bebb8d275b94708f11c24e618a0d169366f57b959db16e0b841e5539f5325611a4d19d3bd978a2c03427
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeFilesize
1.8MB
MD5d5805286cda5b56039dd2a2d936d4be0
SHA164ba00ec017bbb0d5c9ca4c4ce157808e76c8045
SHA256e6f775537b67e3dd2afcd8700a2a4b75632f14e5a276b1ccfe859996d8bc4850
SHA5124d7575e45eb8a554a38df752ba0653d96da6d52d570356f8803a94656f0777c473268efbcd9350f12ab901781f395e7b0212f8f8e099b6e4582ceb34ede3a5a3
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\pkgvers.datFilesize
74B
MD5a8340860b065dae8f93853f85bd57787
SHA151e240bcad31e46e8378d94c02847fe7981002f3
SHA256bd6c9fc63887a8687290c2e42aff7380b029b73c56f0fec51740b166380e2aa5
SHA512cc849320c2f19358caa5be539bd65e539db9a55c3e5e83917eb50809c3ec369bf3f6e693d49344338805eb9582008c194721b0183d9b12172a9eb14c72a33b0d
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\sample.dllFilesize
529KB
MD5ad6c596fba0e2968c57243a106f9ccc9
SHA12241116bbe1f33ff30cdf26ebc57af85136675f8
SHA2560ccb163eab06671bdc74fa03ec1208d66105960254cf1f9cad584300676c4eb3
SHA5128730556b3beef30296443aa1be1f538a12cbf34dbaa4cd722b269b24f639f599c51970959095b6a5a78bfa8e40cf5f85af64dd637391e5a24fa6dc9b1e6fcaf5
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\version.datFilesize
47B
MD5d0597d6fe6366d4fb3ee555505d4bbd4
SHA1f2dca158ab1e30152f09063d1244dc08659e8bf2
SHA256a7d3c859435cf7432e207b4cfcf76a471854767a6041c9156c76290aa0507933
SHA5124062eeb6bab639b1d9761215d106b5718913667f20c08894531380345ee49aa332768bc32b7bcfdae5b5ec8d5714351a5a50016de120608bc2d7987ab57a60c9
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\Global.nmFilesize
336KB
MD56d0b653db9f44ea422ff6da077347982
SHA18d90d4266dd3e67a7be513c9bb950a833d40e7de
SHA256d2bda209032b730d45979c43d77a4a9f3db0d6e7a240a463649da32148249925
SHA512888ee79697edb666f6aad3dd1a146ae42919b261b02fed85ab36f50a1a9a2054172c7bcb6aa9cc02530353d7d0c2b83ef268cbc705d9e8df21c50e8b7a362bb6
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\Global.srFilesize
16.0MB
MD58334313ee072e8475287c133b101beee
SHA10774e278ad5d87755c418c4cd7d4a75437b56f13
SHA256a43ebb16b7bb74292b3d7f2a5535080911c70d5020b4a2b718d60863322b8228
SHA512b401b65bba0e05fb6dd110056276a90e63b9b482aa63a4ef871acca91e2852419d3a3e4a0ffe30e09926e201a809c9d32183fe13582de8622b07d471aabc34ed
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\cfg.binFilesize
661B
MD58fd13803b1e5f14b4d241facc601a170
SHA17321eec794bc766d84d75bd0370a9f2e4d7abdf6
SHA256925d771b2643715b62ef720801dfa96047fff1ee70eabb244bed802234673717
SHA512f5b3514258487f8576fe32a795eefcffef049c7d002a6abdca17383bba838c7a218be23ec6803dcefed615f40afc2ba4b15bf65c9a74c4f6bb891d15d02bfc22
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\clean.mbdbFilesize
10KB
MD5adcb9fa4bc7e739b8b14e05131cacd30
SHA1d8bd8fab734284d00b5be94dbcd34ab313c2ac48
SHA256d3193a821a20e024d502a4a3f012d09c98a241ed8bb0168d659a9c1a1af1a535
SHA51270e6a26c88883374d9f4fd306cdb9d9daf1ac3bb5f0fe078d890984e01c0fe801a267b02304d4cb17dd31918e243847812fc909f26fcaa51fefe90626bf47361
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\dbmanifest2.datFilesize
924B
MD520250b3d83fd1358b13314feb60620f8
SHA1c824c9aa7c16e385e0c7423b5faa3da91f1344e2
SHA2567679669e6bf77e6111f5a196a9ecc5beae350fa9ca470f4c3809b45ac8fa2ee4
SHA5121a97a4502c8521849cd1d830ae8bc4ca5f6ec15049b77fc42393bcbce57b73a750df10e1ca3f0e1ea588268501bef81881364d63c24aac7b78231ea9e4c0e30b
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\dynconfig.datFilesize
39KB
MD510f23e7c8c791b91c86cd966d67b7bc7
SHA13f596093b2bc33f7a2554818f8e41adbbd101961
SHA256008254ca1f4d6415da89d01a4292911de6135b42833156720a841a22685765dc
SHA5122d1b21371ada038323be412945994d030ee8a9007db072484724616c8597c6998a560bc28886ebf89e2c8919fb70d76c98338d88832351823027491c98d48118
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\exclusions.txtFilesize
23KB
MD5aef4eca7ee01bb1a146751c4d0510d2d
SHA15cf2273da41147126e5e1eabd3182f19304eea25
SHA2569e87e4c9da3337c63b7f0e6ed0eb71696121c74e18a5da577215e18097715e2f
SHA512d31d21e37b0048050b19600f8904354cff3f3ec8291c5a7a54267e14af9fb88dfb6d11e74a037cc0369ade8a8fb9b753861f3b3fb2219563e8ec359f66c042db
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\mbdigsig2.datFilesize
514B
MD5aeeb9145095aee238fa345ce96d1f49c
SHA14df1b0f5decd16f2c0e36b98e92d461f2e97d30d
SHA256f8ab6808cb85caaeaeae58fbd2f1a9d2906a574631a73ea8ce2bc2c337f60e75
SHA51274502ea59b1c6a4d3f1df53d8aaff90520ad4956700cff3e2a0dcc744f4084216fc74bd217626b277155fd000abaabd30f4cc16c1285a415fe9e2ee1e46858a8
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\prot.mbdbFilesize
24B
MD5546d9e30eadad8b22f5b3ffa875144bf
SHA13b323ffef009bfe0662c2bd30bb06af6dfc68e4d
SHA2566089fbf0c0c1413f62e91dc9497bedc6d8a271e9dc761e20adc0dccf6f4a0c1f
SHA5123478f5dcf7af549dd6fe48ad714604200de84a90120b16a32233b6d44fa7240f5f4e5fe803f54b86bbdfd10fa1bfdd88fb85eb6a78e23e426933f98d0a2565ec
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\rdefs.mbdbFilesize
24B
MD52f7423ca7c6a0f1339980f3c8c7de9f8
SHA1102c77faa28885354cfe6725d987bc23bc7108ba
SHA256850a4ea37a0fd6f68bf95422d502b2d1257264eb90cc38c0a3b1b95aa375be55
SHA512e922ac8a7a2cde6d387f8698207cf5efbd45b646986a090e3549d97a7d552dd74179bd7ac20b7d246ca49d340c4c168982c65b4749df760857810b2358e7eb69
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\rules.mbdbFilesize
9.0MB
MD59a20739b3cca4b23e86755a564bd56e0
SHA1b38e885162039220923e9a4c160021a1549081f5
SHA2569173a8767615833cd9448eac4edf924f55fce4bdd511d8937cf63e26f4477c90
SHA51218baf591ccfccd6b06e26b8c3d7e050700eb17e048316ec34633a22a81a19ef9d225c8b006658b969462e45e810b9ab6ae10b2d83ad866d1398b256771fadde3
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\scan.mbdbFilesize
1018KB
MD5269ef223b7919ca972577657d3d33d85
SHA11a1eb8ca370beaee913715b1f4b6b8aa53fc4b2a
SHA2564447c30c097ce4276abadc515b94a6f4ad246884fbf64b7dd8ca45246679a6bc
SHA5126358d168e868151e7ef960e1cd9112eca25739bed0be81826ed29b132499ae31fa34d7eb679b40ea3b5a6f60da81735e770133dcfd6cfb0d0553b6c64b606ffb
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\tids.mbdbFilesize
177KB
MD5f0eb4779a5dade2efa5229c33abb4910
SHA141d2c8cdbd8e306a263fe419bb2c1c19514524e9
SHA2569c5242e6c567e641bb10412cd966b81819984ea643ba96222ee0b256b3f53955
SHA5126883622d693265b824d1cb65fe6d9a66d99bc8d167981fa4f0054c7513020361ec09b2c75f62a8afa85dcea175914a4c8f4872ec7040722dcaf7375886bdbd84
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\wprot2.mbdbFilesize
40.5MB
MD511ad702b34346889d5fd70a9f875faff
SHA14a6952107ba24777d90c06b5528f05f45705ce90
SHA2562dc77eb6a488751757a6779b003dee922526000b38ee1d1fb3fe3266079cceea
SHA5123088130d7d57a317a2a38d3a69876f53cd3bca34df3c8ef791bf10fa17156cf811a897fc8e68f3d1fcdcee6a85600668b1c0a0bbece59dbf7fb10f42d76d69bd
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exeFilesize
8.7MB
MD5e6d5df8df4c3c43a981e5f7cb7b35f65
SHA1b4233bf950fe74017f86662d04f8cb98241ba1b5
SHA2566ec0e1fa0ddf753eb37d521c8b4c87ea60ad6ab45398bd6736a55fd21cefd072
SHA51243ae5f61024d7137c3a7fda98343d438a451cb980512099ba3b07e9b4c73bbae12396fd3f71b6b00bf075fe4076c02472cd40febcb695f0d9c429c189a07e8f7
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exeFilesize
8.7MB
MD5e6d5df8df4c3c43a981e5f7cb7b35f65
SHA1b4233bf950fe74017f86662d04f8cb98241ba1b5
SHA2566ec0e1fa0ddf753eb37d521c8b4c87ea60ad6ab45398bd6736a55fd21cefd072
SHA51243ae5f61024d7137c3a7fda98343d438a451cb980512099ba3b07e9b4c73bbae12396fd3f71b6b00bf075fe4076c02472cd40febcb695f0d9c429c189a07e8f7
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exeFilesize
8.9MB
MD503948ad78f44b840ec2296a0fbb9f2fc
SHA1a4c04a502746af80894c13de707bd0282388e12e
SHA2568ffd82021f35885627bbf5a0a55a51963e7e37c5a5d636466e244fa64ad94d65
SHA51235b39c9f7da64a22d4bc8aed88b36bf3d69bb2d45d0ddb360fc909c943d61e067e77da5b54c64406fa7af883b9bd798100193fae2eb790fb304037a6df4d47ee
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exeFilesize
8.9MB
MD503948ad78f44b840ec2296a0fbb9f2fc
SHA1a4c04a502746af80894c13de707bd0282388e12e
SHA2568ffd82021f35885627bbf5a0a55a51963e7e37c5a5d636466e244fa64ad94d65
SHA51235b39c9f7da64a22d4bc8aed88b36bf3d69bb2d45d0ddb360fc909c943d61e067e77da5b54c64406fa7af883b9bd798100193fae2eb790fb304037a6df4d47ee
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exeFilesize
8.9MB
MD503948ad78f44b840ec2296a0fbb9f2fc
SHA1a4c04a502746af80894c13de707bd0282388e12e
SHA2568ffd82021f35885627bbf5a0a55a51963e7e37c5a5d636466e244fa64ad94d65
SHA51235b39c9f7da64a22d4bc8aed88b36bf3d69bb2d45d0ddb360fc909c943d61e067e77da5b54c64406fa7af883b9bd798100193fae2eb790fb304037a6df4d47ee
-
C:\Program Files\Malwarebytes\Anti-Malware\MbamElam.catFilesize
10KB
MD560608328775d6acf03eaab38407e5b7c
SHA19f63644893517286753f63ad6d01bc8bfacf79b1
SHA2563ed5a1668713ef80c2b5599b599f1434ad6648999f335cf69757ea3183c70c59
SHA5129f65212121b8a5d1a0625c3baa14ef04a33b091d26f543324333e38dcdb903e02ccc4d009e22c2e85d2f61d954e0b994c2896e52f685003a6ef34758f8a650c7
-
C:\Program Files\Malwarebytes\Anti-Malware\MbamElam.infFilesize
2KB
MD5c481ad4dd1d91860335787aa61177932
SHA181633414c5bf5832a8584fb0740bc09596b9b66d
SHA256793626d240fd8eefc81b78a57c8dfe12ea247889b6f07918e9fd32a7411aa1c3
SHA512d292e028936412f07264837d4a321ecfa2f5754d4048c8bcf774a0e076e535b361c411301558609d64c71c1ce9b19e6041efa44d201237a7010c553751e1e830
-
C:\Program Files\Malwarebytes\Anti-Malware\MbamElam.sysFilesize
20KB
MD59e77c51e14fa9a323ee1635dc74ecc07
SHA1a78bde0bd73260ce7af9cdc441af9db54d1637c2
SHA256b5619d758ae6a65c1663f065e53e6b68a00511e7d7accb3e07ed94bfd0b1ede0
SHA512a12ccf92bead694f5d3cba7ff7e731a2f862198efc338efc7f33a882fe0eb7499fb3fb533538d0a823e80631a7ca162962fbdfd78e401e3255672910b7140186
-
C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.jsonFilesize
592B
MD53d72f884d943a8a623825c63ac2d9e18
SHA158ec3b838d1df45ff039437bd5d63eb96492e43f
SHA256eacec10407f48f9738dc3c2b0ff90ebb3883cd2f5151ae881866699719bda59c
SHA512cc23eca67da50cfc316564d8c1bb88754ca632c182476b3f16bf1f603d486c4795fda7481663170d14d002150f51a12ec66b283031f18d413ae1b1e2d66cb16a
-
C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.jsonFilesize
592B
MD53d72f884d943a8a623825c63ac2d9e18
SHA158ec3b838d1df45ff039437bd5d63eb96492e43f
SHA256eacec10407f48f9738dc3c2b0ff90ebb3883cd2f5151ae881866699719bda59c
SHA512cc23eca67da50cfc316564d8c1bb88754ca632c182476b3f16bf1f603d486c4795fda7481663170d14d002150f51a12ec66b283031f18d413ae1b1e2d66cb16a
-
C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.jsonFilesize
654B
MD5c32849971315e8f06c396e7b69039861
SHA1b0ccf81bf51fe798ca1ad1b973b9b22a0da3c4a1
SHA256ec37aa0e5ec876756ee15582bb775fc536936f33f6dc4cc32546185f5e70b91c
SHA512636b6efb9b9cac62714aa80dd6f94d49fa55f483bbd44da8ee3f0e6f00a54c6cb750dfa38b1f6eb970d4fa1c27e0986610429dca0b8af4d8d989d7fa46c9b06a
-
C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.json.bakFilesize
592B
MD53d72f884d943a8a623825c63ac2d9e18
SHA158ec3b838d1df45ff039437bd5d63eb96492e43f
SHA256eacec10407f48f9738dc3c2b0ff90ebb3883cd2f5151ae881866699719bda59c
SHA512cc23eca67da50cfc316564d8c1bb88754ca632c182476b3f16bf1f603d486c4795fda7481663170d14d002150f51a12ec66b283031f18d413ae1b1e2d66cb16a
-
C:\Program Files\Malwarebytes\Anti-Malware\ctlrvers.datFilesize
8B
MD5fe95747e0a7a96907ce92259c56514ed
SHA100a126ec8d9687d4305be9da42f97806112d484f
SHA256ca85439b3b1aeff16afd8e94fec619198a0fe68f9214c5e68ae896be41e23ac1
SHA512baea4075e05b32b86866da722551bee9d13dae25a8854df5ff48ca64f9aac7e45dba0037320052de0d0d29845c77ee97b7d9bef14886dc2fe3983243e13e128e
-
C:\Program Files\Malwarebytes\Anti-Malware\mb4uns.exeFilesize
3.8MB
MD563d54fe94ae4e44835d726056fb83f43
SHA1f2284e079ae50d7a5362876d7c16192d6cecdfac
SHA2568f2c2bf8c3b33876fb028be01f8215c9cb07e59abb4d20f5cdb21f380fcea406
SHA51258f8f28c3e861e3aa235128a2b7d9f4e2faf5d87f510906b4e192a3ac5762aedb35b23141a53f4f01e2b5316c61b00e4cd46433eee5badd29f70f029eea52b09
-
C:\Program Files\Malwarebytes\Anti-Malware\mbam.exeFilesize
23.1MB
MD570d8e4d74252379d29704f0c6c5ba792
SHA12f15890a225c587efdea5789fa630a83802c4627
SHA256305980e0498f47d050eec96071af59dafe6e366d13887cf64a5b7d66bfe01eb1
SHA5120c801d9d2fac4305d00a1f8b51ff6a9697a9bc486cc9bb563c81946ff21b994db32e6be26180255c87dc624f9b6bd4ad9ba83df304baa986fd5bb4e83dd892f6
-
C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exeFilesize
8.8MB
MD5090e6cd78c20db3e7305aed4235b6df3
SHA1490f93ea7b08f0e613346430bb51d3cab1aff037
SHA2569923ccc092ac7e9bac3cf13ddff5302025f08bf86ef81697919d57da872e9f89
SHA512c065572c61d5672f34a876c8acf16c919296c5330b196b170783f70c551075bf6e4c89e9b711dd1423ae84638582eb6eff2f898daee5ed13e39d2bac44888b04
-
C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dllFilesize
2.7MB
MD5b7e5071b317550d93258f7e1e13e7b6f
SHA12d08d78a5c29cf724bc523530d1a9014642bbc60
SHA256467de01d7cee7ec54166b80658ff22f9feebdb1c24eaf1629cf40e4124508064
SHA5129c35293c95c1a9141740ac99315605964aa37c4a42d3a11cae9e5649ff1427a9480d3d5e7f763212cf13db3511c5ea3c84e68f95f0067fe6339a9d3fb7b27c54
-
C:\Program Files\Malwarebytes\Anti-Malware\offreg.dllFilesize
114KB
MD516663d125398773a90d0a53333b7cf5e
SHA1f92928ae3c9292588547ceaca1cb1d372bfd7936
SHA25638e6811b47262101759aa51a631263d9e3eee5d211164318a751e078afec4cbc
SHA512091764b8ad80aa31eea0bbd91ee505ebdea2654bc8aeaa3081a061d0d37ab13d27dd203075fd0de10c6687591aa0e36139a38af846c4e34e6aa67ab81dc277df
-
C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.catFilesize
10KB
MD583c630f8c1f291b522f2b83fdd2acdc4
SHA1a56949b27a80a6a205c0aa7945fcb879feadeb2d
SHA2566dabd76a6688902db5bd63342c1a88dfbd8fee71855ce556b5d26df7420fb20d
SHA512be56c4da3889f8600f2f7f73fc6ea6a3277195b8ddf626699c4eaeae9f399bbe6d86ce0d9b6fbb5963ac4bdac3acef8e7427f027d9c87aec5750527842d59e3e
-
C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.infFilesize
2KB
MD50ff3f3ba83e1dc78aa42e205e1a01867
SHA10a557f31af77bfccccd9530227d593efb4809fd2
SHA2569c5dad17bd0878115a88a4c94405fbd9048294462eea474f265ddddedc90771e
SHA51280543530d28722b926d3aeda4a0c61fc5bea1812e38a3a1b7b84a5a1803c078bc54c32eff23b96766fd5e27301818f105d86235cdddbaa0dc51ac347ed3d7dfd
-
C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.sysFilesize
233KB
MD51dc6d344ee9b6b024ba23278891db9a5
SHA1519b792d11daa2bf9d127f69cdd603a236576e04
SHA256823e1c7321e177b006c1f3fd1ec8b99607a12d2c3c321f3a6cbbcf7030b6c240
SHA512fb96c4ede03c3aa729d2ea5a72c5f14029f6d69a79b6e0d5449e371bf3acdbbd1cb2079e8bbac3a3140a257c71018bc7a2a31a45ad5c8b65382e67cc3431ab6a
-
C:\Program Files\Malwarebytes\Anti-Malware\sdk\farflt.catFilesize
10KB
MD543af9deb38e2dbd69c46b6befdbddd6e
SHA1eb7a9e4cdd74f0cc5a1ee07292a561123cab2545
SHA256ca94b3a3b8721870a0b96675649800bd751daadc0391cbf3143e2f7aae6dc676
SHA5129947529cab455151fc1ce09828ebf195de922b41a303c12f33baf5670729b533cadb28f360301f2a0ad14f3c7315ba90955a0bdcb7828ec1920b349fada2f518
-
C:\Program Files\Malwarebytes\Anti-Malware\sdk\farflt.infFilesize
2KB
MD5358bb9bf66f2e514310dc22e4e3a4dc5
SHA187bfc1398e6756273eee909a0dfb4ef18b38d17c
SHA256ff51780a5a854b2c18f71ae426cb066a13723ef6155e24f4910137c9e8dfdc17
SHA512301ec5ec5c0813951843011f2204924240235494999136ea30a557cbf58146fc6043a8866b344fa7deb927d7c83d44e2aaf45adca7d221aba5d36715b9a63e09
-
C:\Program Files\Malwarebytes\Anti-Malware\sdk\farflt.sysFilesize
195KB
MD5d738a028dcfb7d1cf97e9fb11e306db7
SHA177f4d6a79e1f2754a2e93095158d0edfb9a6a5eb
SHA2568f38d2a0a8e306de910bb621cab4276520aed84645de942538d0a9c792dd0074
SHA512c753a13767c8460823851a144a2a9162168a1099664ba601d0a929d539ee15d78123ffd86cb6225f0d7e6f52f40b2c444705da8bcc1292bb6c9757732b82ad94
-
C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.infFilesize
3KB
MD5e5bb98e4d7adf79cf7355aeb4a12d3c4
SHA1c2996909b98b95863d54c6a2f7843e5c05015596
SHA2561f2ec66c3947802dd97abead84d71bacebf84e4a2e871852cf5291958d45a189
SHA512f65ec684a21481c66f4571fec4f5cd17fb629fbc4b5fda88bfe00ada30573f3c74313311f5e8a164709824b8033a60fa2ae0f1643d0ee3ba8ae4fd558709aa7f
-
C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.sysFilesize
217KB
MD533931ca7d4bd04b8682fe2f996b3bf07
SHA114dcdffa4edf16c59dcd748406c8efb1ba3d2bd4
SHA2565fe3582d567cc48f3d29771d3bf77cad42fbb25327dcb6be6bb0227a1ce02007
SHA512ed60367c5e24d454c48c921ee668bc1006631f339e38273626d3cc0673e906906312faa1febc97c5f616a5f4295a6e03265392950651940ae15e5e7baa1e6f90
-
C:\Program Files\Malwarebytes\Anti-Malware\sdk\mwac.sysFilesize
183KB
MD5d55d969fbfcd436f0197cce40a7e92b8
SHA1a457b04fc6ea3f803c69ff586c2d27a8fc1e49ff
SHA2569ed1f75131407a995d7cc82816895164ca66e77dcb177a1cb703dd98542410b5
SHA5124f81712697fbfa95028bd661fc8f2252aa4749bf575d32e0fd5be889b4cb76e0e1b3baf39a750f7fd0059410cd1ae7c77a2b6dd9ae709995fd36a3fade8809b5
-
C:\Program Files\Malwarebytes\Anti-Malware\srvversion.datFilesize
9B
MD58660fa6b5695c6c3edc70ea86961cc9d
SHA100b9b0dc0eeb24a159a072302e8468efae6cdcc6
SHA256e026c8ddaf9bb706e740c3af69724fa54447fb12b55bfbc6a729131b76319de9
SHA51220e131e636bb097af073fc7376b877a88c4491706eeaf1969842d486cd9bd674ec1ed4d28113f4622e4a40bb1af66bf0fa4a21a9debe5cc9375cf0213f9c961b
-
C:\Program Files\Malwarebytes\Anti-Malware\uipkgver.datFilesize
6B
MD574c6677020fc6b6c867aab117078bf5f
SHA18c46db37dc0b39eb963d4144539c8b591e122400
SHA256cdbb9bc874d71e154c71b68b1fe959913d286036dac11e226e5620c919ba9708
SHA5123f9db8d9bb25322f8d8e750750bf92dbe6ac63d686eced65cddfcd61178cf0e947118a491058414d4d2cbb4892e39815565669aee0dfdda23aece72d278292d0
-
C:\Program Files\Malwarebytes\Anti-Malware\version.datFilesize
47B
MD5d0597d6fe6366d4fb3ee555505d4bbd4
SHA1f2dca158ab1e30152f09063d1244dc08659e8bf2
SHA256a7d3c859435cf7432e207b4cfcf76a471854767a6041c9156c76290aa0507933
SHA5124062eeb6bab639b1d9761215d106b5718913667f20c08894531380345ee49aa332768bc32b7bcfdae5b5ec8d5714351a5a50016de120608bc2d7987ab57a60c9
-
C:\ProgramData\Malwarebytes\MBAMService\ScanResults\ef991774-774c-11ee-9431-46f26d303063.jsonFilesize
8KB
MD5eb6fc497022f95ade46f24fc459872c7
SHA17c5d583810295a56685d66b1b89e83fb3ffc0320
SHA2566ac143f14f8ffb43241c4ced5c17183cab9779f33d7cf0805dae03ff18755ad2
SHA5120e47c5526d4a41d215d3fc55c7a9ec942d8e64d5e933db7942ed29cf8336347f03258160aa35295ef5c286fd090a0e53c92f7511df3ee85b3f19c85f864f68f6
-
C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.jsonFilesize
1KB
MD521c445a5464d2a01029e21c0c47b6fd5
SHA101744e3e17adebb87367d1a04cc80f36402a2a0f
SHA2568b972f9126b117054b754088c5b5451d068795b54fa47b6b4d288e6ff1ac9d27
SHA5124fabfd70d060ca22ba3a476910abbb6b9f9ffa13440db08e1b64311e83234bc17dabea972cbcd69c49b3c94385f0611d0cd97ceeb17f031c02fede65edf3c69a
-
C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.jsonFilesize
47KB
MD57c4a95c2adb500e2d74c787c5cb0af25
SHA1a9e45b058d560665b236f1ff0bc515c0bccb36f9
SHA2561e6b80d2489591a5a21e3cf055357208685c006cf75cd1765f24601d70d438f4
SHA512ad85a2e94df8b84885791746f0698afd7996572b5ef50246a89f9e2f0cd105843ba4aca5199e5658f9f7456fd2a0ff7d225f8e4db3d51fa9754c0a359d993ead
-
C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.jsonFilesize
64KB
MD52543c5de3bc3b7d1cb5e7676f3fb26a5
SHA134daee7b55eaa3decfab04368d17cb8eef3a05b8
SHA256dc684ef8a26bf1e85bd109c16f68c310f372a22f85597f685cb47c7ef82e09cc
SHA512dd2947eb2eda534309f4184248a593d4b6e965f5571c63c5b4bfeb1e1bf92e19b8a372af4e63c459babf56f67e807b62408c45d4fbc08cf76bc28df9ccbe9bfd
-
C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.jsonFilesize
64KB
MD569606855e22c92736c5a8f8fd040d112
SHA162b67871d09c7ada9f694eace49ab9cb8d572058
SHA2561bfc67e4b8946dfd4321cc8c08de505a7f1ab4b422a7e85d06698db04aa62c7d
SHA5123325426288f4d9c3d044dc46cd693ebd796d88f5242bf27a1c0ff0944b02a940f3106c079de54b58caa4278b77ab7a72f7aa66c22d84c7fe9dd13b4ff77c0ec7
-
C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.jsonFilesize
87KB
MD5574bd9f687767d3478d12b34626c4730
SHA161aa5d5ef491b9b8e72efb1ce99e4bfa3696f57d
SHA256908981775cdf51160f3d0451904ec2448a4d590bcab0f4fcfc52657899164ba2
SHA51224400ad7677e57d207503a1748ecd72509ba8e7070e085c5baa442b8fbfd9bc7ee75d3911c2f8313390010ef2efa72ff81bd7e6e12bccfa51a7db2f2a0363937
-
C:\ProgramData\Malwarebytes\MBAMService\config\ArwControllerConfig.jsonFilesize
607B
MD59b131d8837f124770f9e385ecf5f4c12
SHA13af19104e2585842e1f7007f4d1c7e78c9a2eff8
SHA25666a101d759b47e26077ac9d5ccfa31cfecb9ef4a3ba7c5c50f7d4e5d481c630c
SHA512c1678e32203d17c2d112ef823f712e90a14ffd3c09dcd1b5f74273637259cb94d3327c8422778a0c83f4b00f0cac5abebc4272b5970bcbb6fad42fe788b67dd9
-
C:\ProgramData\Malwarebytes\MBAMService\config\ArwControllerConfig.jsonFilesize
608B
MD51a98eeff44e35ba5d89ddf664bd53740
SHA1829028e8c05dc71611eda7c775364a7f88e9d61b
SHA256ad62604a243e31db87e2ee254366d6a1c26f0f0cde82912af8b8016d7fd9262c
SHA512196a677c549b94a4d60e06a184d47c6cfc7ce54b8332429683a1fab6e66851b7d411625d2f45f7da6e99f210fd980bf149788d9c21a040b3252f0bf284d0556f
-
C:\ProgramData\Malwarebytes\MBAMService\config\CleanControllerConfig.jsonFilesize
847B
MD549c1f659170c56b57aea8e0e72c7d522
SHA174c7f95e53f49e76b7e9d800750ca4dd0782b303
SHA2564343f7eacc720094493de506800e7525e2c6677e33314d87ca8ad478956ab6f4
SHA51204c593b31520702d75ded4f398d47b1d2e719ef483483bbb59be84a195f62ba67929d77fb8843a9e9a417849dafc716331c72d56e0fdb86c3eab1302e1b86327
-
C:\ProgramData\Malwarebytes\MBAMService\config\CleanControllerConfig.jsonFilesize
846B
MD5cfe3b01e0fd2d8bdf3e67a5b659cf56b
SHA1674bc979ac9b338bb3420304c158e327881b0aab
SHA256b2371ecf0d64e70d4fb78f941ea7dd353bf1bb8e588522e9252b28dad6a01500
SHA512c5776ea2a87986932a39db7e15a52b7b6673ce786bf33edb4a085ee47724b8bb7a490cead8cc50dfa30e27673c9f8dd0f3b65aef38c2d8605a379d57ab666864
-
C:\ProgramData\Malwarebytes\MBAMService\config\CloudConfig.jsonFilesize
825B
MD59fe261f445db9091289c79eaf6994438
SHA1bbec06305fae4cc43a93bc2676ffe386aabeabea
SHA256828bf39083db4edd497b8b87810ef7b11bdaa0b5598f2e6d4d6baa50d1991da3
SHA5124c82c03eedfe4ac490cb3c2229c5ba6f13e50ff5a108773e0a8a0c2cd28ac7fb9573e5bb142268562bfb42644339c39e77b5b2f9225752d0f76088c695f8984a
-
C:\ProgramData\Malwarebytes\MBAMService\config\CloudConfig.jsonFilesize
1KB
MD56e1b7415e7f6f905c75de07246702749
SHA17f0cb2f2eab772b5a0d0016712b92c80364b815b
SHA256509af87035eddfaea245bdc6b0c58c1d6ca3b3d033eab16f6533139285f5fa83
SHA51224c57f34f9eb0e272c09a965d9891770f2004d3c6f89443f850459b467e51711356c7476d1d5b9fdbe5a8144fdc514e3a88e55641f7d2f406190cd5ac15491f4
-
C:\ProgramData\Malwarebytes\MBAMService\config\IrisData.jsonFilesize
107B
MD5517044ac7d78b2018c648922035b4776
SHA1ee684dc0b9c452d55c30519fabeb848c55ac6838
SHA256c42b9a13a5cf6f2b0f979c5147382a585e98316e949c8f9030145d19320d498e
SHA512ef4a4719567972a50957236d03c31eaa7983b02849e7168628f03615c7004a782da7be24db2397a99f528656ae359baaf87f056eb49f0d7d48d1398413031b6e
-
C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.jsonFilesize
15KB
MD5d212e48db228e9aa56e24cec748d5b0f
SHA1c96dd952b57e3a5d159bef5bf53a1aa71e4a3d42
SHA256965737fdf28fcc08c21c656ab056a721ac32d85f86f4c3b79c70d074f49bfdaf
SHA5120da09ec7de1050f45491717a8df48132825f60af425a016bc643ed781062b1700b3178d727a833e11f74fbbfbdb1c16e683b958d915bdc877d3bd4af69ddb9d4
-
C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.jsonFilesize
15KB
MD551dcf66f4a00a3bedc120f8e94fdedbe
SHA16437e77e5a8b4fdcc690f24a5ee728c811c83977
SHA2560909907016438230592a2ac30eb1a99462068cd576ce980b2fb9b6f7798edccf
SHA5126056146a2580f0170dca6f3ed95c3ec843902b56a7388f97410cbf773bf7e4ab44bf5d59ab1f4bfc8084ca1b303ebf7f4a958ec1a383691026709febc6844446
-
C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.jsonFilesize
15KB
MD57835051bede2f2cc28dd4b99acb853dc
SHA14ac7387c18d3cd36c25fb48749ac7ce476d77928
SHA256e86794b3e154142af4240f09c2ade21343c357acdfab666faee191e069f21bef
SHA51234fd26b342ab92b8bfd6647700484ef85a727277c6943539978735b4f176826ccdc5be2202a38f1b3a973375d0f0ce46471a3e790af456f8cf6c761e73fee494
-
C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.jsonFilesize
15KB
MD5c357d80df4c95bb39f6473c88b29c312
SHA1ce147ffb8ef373fbc8760ef5b3ec0db60bbe1c62
SHA256fdfcb32dbc84135d1dfeb73a499b60a184648e338b52702e971f54aae7cc213a
SHA51266faac37206214831683d533ee4149fa77e0c91c4511093a74992dca5824742d215c8c59706fdcc59f45e01ac12eff6094b40a86c68210f89fc3c80475999cbe
-
C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.jsonFilesize
16KB
MD55f8ac607156f53150a12c1cde172ced5
SHA14d815906f469ffff5c4f87b9d2bb58bbba769e55
SHA2563459b7b8bd38c8d11bc91150b769e6f63b4f6b29809601aff091f5067a2b170d
SHA51222d32aa5d2feb179b70214ee3efd6ff003654bc2709d9e2bb3a5d3a5920fa001911108e286a8f6e601bfa43653f2fef44b84eda2b2e36faea3feaa363200d9aa
-
C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.jsonFilesize
16KB
MD5b6666a98e6b9b6be713c6c258dd05006
SHA1e4080c19ad47db3195efb5fcc1617539d18f92d4
SHA2568f4fc18dd19a3f814c725cec38c44f4579b845a525de0164f39416db39d0039f
SHA5121fd05997432e91c7d8ca673f1aba7f3a84f93976d451a2b6af4c32c2b7324946e2dd9f34b32adbe0d90c8e2db94f674c571651787dc36ec23ea9f894a2994f0b
-
C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.jsonFilesize
16KB
MD544f9aa25ebb4b452926512c150c35d09
SHA12d1511463707383d1b83fdb23a583dbee329fdc6
SHA2565a8e5f344601d32082b49c3641a18e3210605c772eb6a500c89763c14c7ad4a0
SHA512066e8987aa9bc0bc29422b032ca8425fd9dea89f3591fac98766977efdba02b05cf50e6df38e4725557187af26c0f4aaebfc02fff804b86dae3252188aa762f2
-
C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json.bakFilesize
16KB
MD5b7873a8698e9d0522fe39fc93b525679
SHA1d4f24e420b6ca63ab0a6450888b1ee7bd0949540
SHA256e9893342ee67504a1fd32360072791b68905fdbda5ef184c41f49ec8f8a6650e
SHA5121ebc334df1ceb7c7bda431931cfab82a8d7b4a44b30f604408f3380dab6bfa460d8a824c3851740a3990888de57dde323dc1f22a11ceee7ae4efb0731efbbc0e
-
C:\ProgramData\Malwarebytes\MBAMService\config\MbamClientConfig.jsonFilesize
1KB
MD5b914eb5ea2db69763b30a471906203d5
SHA18116116a15f00a1ef40a1ae78bc7e05d064daac1
SHA25621c3adafacae9a98ccece77a088b05349fdfdb8fff2081e1ccbdee2b518e1604
SHA51284e1ec5d3bee395401c6b0bec2e5121cd67c098c87fd700f0a104fa3e962460d9ed6ced34d7ff85603c7a775609fed39f45f93c345658f43b18e31151d39d69d
-
C:\ProgramData\Malwarebytes\MBAMService\config\MbamClientConfig.jsonFilesize
10KB
MD51896107502d31883ce0cddab94ac2a0b
SHA17604da8a2988f8e22750bdf431a33e89f01732c3
SHA256fc54ba797d210c679c885aec6f32032e7c045a76d83f8f2437b559e7e548e39c
SHA5121ca8e2ad6bb591589cd49ede3de7e384c5e86ef12387f8c5152d756dbe661677d1af57ae8d94df0ecb92517eea96c3dbaa15597b5fb62a2b33dfb19daf4bdb40
-
C:\ProgramData\Malwarebytes\MBAMService\config\MbamClientConfig.jsonFilesize
10KB
MD58a5051f9d51ab4e2398669f63901fa1d
SHA119d5903a656dcf34a7aa5c4f3b06a46578c79a24
SHA256b10354f9fc4a0eddeb88ee8462b69aeb5efd43f6ff8076729f2fa9787fa72405
SHA512a0fd7fed3fe3b360cda17b6e6abe9ec182184127dbde2fdb3e37da7a7fc93bbb24fe7abde4ff25ab03bc01621795ff90f2caf280ba718eadf79c30dad1aebb71
-
C:\ProgramData\Malwarebytes\MBAMService\config\MbamClientConfig.jsonFilesize
10KB
MD5e33ee06a960f54bbe9edd038f7b89f4c
SHA1c49be6e89881161e926562890bc0a88ac3fa0735
SHA256fb5479dd9bf9ed174c8818cee715ea1f1c7782c2d8fa16dcf1889b9ceeb571c3
SHA51242c95e0907912163d15bf59110025e0bb69bcde80db94792457f8e2b8267aeb92809136c77043362a6628ae82d7115d57e806f1f355645a56e36cdbd07984f4f
-
C:\ProgramData\Malwarebytes\MBAMService\config\MbamClientConfig.jsonFilesize
11KB
MD5622c6596916ca276a90dead424a5ebcb
SHA1040a2b9ed8273ce654af349b08e378b90ce4c91a
SHA256bfcece24b516945e8410ed5d29f2d0e4eb36dace65c4f3091b2d28ba9f11009a
SHA512985032f4dbe106674ffbebffdcd236a5291bb8a7088646cbf9eea8eab2244db3fbd5f92e4acb924a57581a287c6d484e6dda165d3eb3dc598b55b6f1c31c84d0
-
C:\ProgramData\Malwarebytes\MBAMService\config\MbamClientConfig.jsonFilesize
11KB
MD5622c6596916ca276a90dead424a5ebcb
SHA1040a2b9ed8273ce654af349b08e378b90ce4c91a
SHA256bfcece24b516945e8410ed5d29f2d0e4eb36dace65c4f3091b2d28ba9f11009a
SHA512985032f4dbe106674ffbebffdcd236a5291bb8a7088646cbf9eea8eab2244db3fbd5f92e4acb924a57581a287c6d484e6dda165d3eb3dc598b55b6f1c31c84d0
-
C:\ProgramData\Malwarebytes\MBAMService\config\MbamClientConfig.jsonFilesize
11KB
MD5cd90c8ee6f6f54715a25f246185d9c61
SHA1d5faa5e7e61eb0b3d2711e07d53f170b5f0e1c4d
SHA256550de6824b4e1ce5573ae3ce99ec645188a105a2f6909ea93a764a5d50bf25bc
SHA51242f1014d0859ee9fa5c2e506fae97a00991bfc14efb7f49c07d1d2045ce9930efb4d50e131ccc35edce47fcd942949b3ac9ea7415d05bdb5de1ca5ad7db57403
-
C:\ProgramData\Malwarebytes\MBAMService\config\MbamClientConfig.jsonFilesize
11KB
MD5700e388be4c9be6456fd2deb2308ebc5
SHA142d981b347936e9e5c99f2d69cc95b681d10f2e2
SHA256114b61a6ab75767862a152d94e826cbce218d363507d1c814e8ac0a0f30866d4
SHA512d3ed42db06cc22aba7f79e484f2b9d9f0e24d1e0b13dcded300cd6d0348756fd43aa1255cc93a9174ae3bd4c90b1e0adfd920ed45d810009c8415a479ba99cfe
-
C:\ProgramData\Malwarebytes\MBAMService\config\MbamClientConfig.jsonFilesize
11KB
MD501f628b97021b7ea8823a2b5d1da05cc
SHA111453f80d7908038003fc90540dd5ca7e7c2932a
SHA2565159b139639bfbed4d24bd6049219f6b2fc286b03a2fc21533a64bee971f87bf
SHA51253d26b2437c143943e28e899dccbb7c841cabb6a9c72c54dfbb310dd07eb3280c814aca4600e0cbba8850ff29f75e2ef1746feb04a1bc21924befe2e8d57ff87
-
C:\ProgramData\Malwarebytes\MBAMService\config\MbamClientConfig.jsonFilesize
11KB
MD58ead054e53fe3626e8488175de0916b3
SHA1769b2468ab1483ed2d9130eed378c7ec66ecab13
SHA2564c3147855ec8dce1c68583ab085ec8a5e64008d07a4f01ad4409ac9d30eb2372
SHA51242d5ba7e13e925576c8f10fa29e3af40a9c9c41c0f50ed001261d9ceba7a83209bef2e249076544c836411bab6309034576a4d9296238a10e1cd99195cf589c3
-
C:\ProgramData\Malwarebytes\MBAMService\config\MbamClientConfig.jsonFilesize
11KB
MD58aba71dbc9c2e9bdd5d73b3cbe0ea33d
SHA1a7dc03446177a7930e11a16b296e46da093b59a3
SHA256797080ea533d6375335578945f8cb5100785e3fc475d33c25ec2b0532cf810a3
SHA51272dd2d0a69c7f570b7dd1ca41ed0b0fd8d25ba595337b4ddd88877d5b813190edd6d88475d1d8d5ce7134c8709b3cce195bb38e6277ca83e491560e7d0cabf53
-
C:\ProgramData\Malwarebytes\MBAMService\config\MwacControllerConfig.jsonFilesize
1KB
MD5a8351af80d5f67be2ca5a8571c6f4240
SHA122bc9a4b2ed6643cf22ed94b162df4ed11c7ea42
SHA2565a910084d1b9f39b6423b1512785725ca0fdfb0a7e7330f6b2ff5d9e11647952
SHA512194ec72be78178bb798a4e7c2cf7f54326e6982ea83e031df700fc8aa20e8b689cd42459ac3e65594be993979a30964b6140edd96df4b00f0dd93cb7a5fac6b9
-
C:\ProgramData\Malwarebytes\MBAMService\config\MwacControllerConfig.jsonFilesize
2KB
MD55efd01be93fbce3a88aadf99e8b82cbe
SHA16b61fa6afea0b80c89c4f905f3fd640247217068
SHA256bb65867ed438f4600b7dc9b4cc7364da4c9f2663974a09df1dce462f4874b70c
SHA51244eb2b3c90fbba627a236779d180f790e7c08ab671721a5b9d81e65ca77a2ef32a52d8a8a1478872b012d3b606822517ea2f5224d297bced12a7c456d3088fda
-
C:\ProgramData\Malwarebytes\MBAMService\config\PoliciesConfig.jsonFilesize
903B
MD54839d78268ba4cf3d6645fc244fde071
SHA152ed176856102088645e5a3efd402904bbdb8f84
SHA256ab3793d1928c7ecb0482a7c6ea76239bcb518863fb230b96e0f0fb799e5cd841
SHA512c04c4906af553a80ba91e9580f95ee7f3c4a046c9bb2a3fcb2cf47ffdd3cea551b591c2407a276e1849b9874e08d7fbf4731b27d27a7a4617b83e300ead34d7e
-
C:\ProgramData\Malwarebytes\MBAMService\config\PoliciesConfig.jsonFilesize
900B
MD5359c9fdc9f3d5f8ebdc9c4262bb4e318
SHA11ef5437c6b14efe525b80357e0d7c04323107959
SHA2562603a58f27bc40ba403570ee0966f9739982eca80ee65a6ea6a9627fa300abad
SHA51204bf3980b0b3dfdbe225bb80d0aa847093ed553d7ee05b55793377dd5579b03d8388e7accb1ddec8c884218eb5cf0f3dc7e2e4f8aee6493de0944a0339793a1b
-
C:\ProgramData\Malwarebytes\MBAMService\config\RtpConfig.jsonFilesize
1KB
MD51279eaae362d4ed3752ec8e9e730e02e
SHA11ecd567cb24ee206a7b609f62114af3a8f7e7cdb
SHA25655d24e73f710dfa6ea482a1af8d5ae733d97a9d687cab97fac9258efc3454ed0
SHA512b8b335ed39b306c455e3022af2b8151306120c1fdc5f2aa76d3c5a9752fb2985a3f021df427e501f2cb3e5da98893e70c36f6b61c9f42346a52f22a48785572a
-
C:\ProgramData\Malwarebytes\MBAMService\config\RtpConfig.jsonFilesize
1KB
MD55e9257473a169e89c6b1016e928ead05
SHA173d5c8181fee1e6fdfb4b2275074f85352796a7f
SHA2563c6c134f2f4303fae90629933424b5c55e364acae5aa1e0c29499d879cbef940
SHA51269956241db6a9eed53a9dd288ad6f418e498d1a4ba9a5961f56aca54869852bff53f8ec91321a6294e06ed84e3db1e8a8aa8c73ff7650f7115164ea955c7aedb
-
C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.jsonFilesize
2KB
MD503b0a094edd369f14f03b3daa5515697
SHA183d73e191ec36cd3aeecfe308c21ca39cb380b0f
SHA256d57de1dd00c92dce7035bb092aaf09fe08a44596615db0b2a0501ee68a90e327
SHA512ea8f3b81bbcb6ee4a0919eecbfd531dd00ee88fe3ad84fa505c759d9d89bfa0bb5a96351dbb88be70259ab0e6183ed102b9a3bcc8b1d559b8d8381e1b888a66d
-
C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.jsonFilesize
4KB
MD5f341bb31e5c29d7cc473ae634e666a4b
SHA154430dde1cc061b8add01c7227768a43908dc5b5
SHA256fea1ffc257e3dea431df2c15ba0e28a30b00d62204866eed63095d7de4905c2f
SHA512e74d2d8fa8dea85bf2b2e21502898b0eb0ca36781f8bec1301211ac16726481b3d274fd754f4b8af9b00e3cd519853027c035d3b058ab43f851182c72523bc6c
-
C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.jsonFilesize
7KB
MD5788e1b215f4fc91e5e429e921ba05231
SHA1081c5507fcab5ba5376a0d0f4c44c921067a9208
SHA25638bbe2318004c1797bce38be1186a59f54a649271e7d681206d582d6ab0a8cb9
SHA512804c5c607b298c862da6ef16dc051950be72e6292dab49c613788f0f1b5e80332168bdb8101eed2d68b73ae6efe5122edb651aeba790b8a4ecfae03a42b36d1a
-
C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.jsonFilesize
4KB
MD57b9561ff848fab88aa87594012b052fb
SHA174263f1f5442dc3d5f19c216b5a7e634352481f3
SHA2560760fedf288dac5d7a2df8e9f4b19de6cf2dd0cc5d3af662d47daaa826e623f5
SHA51246f2e3897a378cecf43df546e06959d4346107b216a26306636eb777b1386b7ddf0b481222ea748730c62de0606bdd44e93f4f5b40858e411c917df91a1232fd
-
C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.jsonFilesize
4KB
MD5a92449763ebb9b74d996bb4df134ac3b
SHA168ca6e14071296173a270b362dacb23f4df14003
SHA2569d20208c3d9c5e494922a75016030349a9f8416634a6062bf2c084aecfd60482
SHA5122029237628b63a94ea9d47fd49b38da80c35c388a8d4a81d94a8b308716ab2a73610350e73865139c838df90e5000cf5373bad7a41b193b92c2814131e4d686f
-
C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.jsonFilesize
4KB
MD51c558290d12d00de94aba11cc5e8965c
SHA15a3d228036506b025750541edef44d94deaba0bb
SHA2561b73c9d161350a9025333610d20d528cc44dc6746f811535b4c62ecb64e2b4d9
SHA5124ab5c8eacc4f8a3e5f2b78597ea9cca1d32742b9cf575e12e8485071ecb20b0d4705d986344ad0c283e01d89498222479c8e5f505a3d3272d6ceec38b745b11d
-
C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.jsonFilesize
4KB
MD51eef6d5569229a6c887e1df308ac2455
SHA172e8a56c7670cebdaf0b96f58139b555aa8ee582
SHA256f1c2a0ec26cd9e0ba55a1d47441885d4d9a9c73f2742a7fb5dac5b8ac7b21674
SHA512a1953e15132a19c85f3762127a793c693af7d057e31177d950e87d154b5984dc9e471e1be34059d33fb19fc59de6c1d17ed444185b3ce88ce55ec11e660a5d00
-
C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.jsonFilesize
4KB
MD5d4aec580a02a570732a2a083b2e7f55b
SHA1b65aba491bd0bbd6b39b7dd73f945eed8e1e3151
SHA2563ce2254ee22680dc752c007f0797a58b9075ce5356257965a9704201620f0fcc
SHA512aeaac1d2f2ebdadbd4163c8d6f2f6c5054c1c6729bf9507bc199c68413da25e24aaa8bfdedbadd52eb4dea05f0554dd89c7e2860c9c47d80e9b48d30c122e264
-
C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.jsonFilesize
4KB
MD5f951a463a1a4f16733a3318aef468112
SHA121f2127fd4e1bd133712527a0cf400a411fa961a
SHA256a246d4ffcc1b7d974844c50b7f26d2e1f7f8c6ddfdedb5d668e79a2376fb716d
SHA5129cc40b85d17af764796ae2f7945219697a5612e7281c3c2853ba45888e7a43804e1f81948698e2d9a3bb97c7547dbfe1801cc2f7e5a034a17e9c9d73604d1493
-
C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.jsonFilesize
4KB
MD52247fb5cdaf061c86b381ca3c6cdecdc
SHA118330b8956b028385a4eacb341c7099f5576a7c7
SHA2565549f1f561c8d1ac6cf37c6412e25f379b747846dfceb4fafa289d02f8d04e9e
SHA5122186f6ef4cc08b27904b7786e520101c80845191a97c971e2dfd12a9d98cc627647fca8f58a961c14c8cc666392bb83981ea4493bdbf9a3cc30b9c4713897f99
-
C:\ProgramData\Malwarebytes\MBAMService\config\SpConfigFile.jsonFilesize
11KB
MD58fb2cd1eb7cd975625ecfd558a9b824d
SHA182fa27b3d81d47a5dceac6b8d37f0804333eb8a8
SHA256a8c55ef31d242aa7de4893b88e786f9338312de0a7695461f87e262d6357fe77
SHA512a745a98e4878e39397dacd93d44ca98b1343e09a664cf30b08a66c3f51eb005c7677538785b13c1aff2733416b3bceb2b94fff6fb8ec7fd577ddb845da016840
-
C:\ProgramData\Malwarebytes\MBAMService\config\SpConfigFile.jsonFilesize
11KB
MD51dcd7cfe5d45d9934e386d0d7a7ed120
SHA148eafb30ff3d289bcb204a13add6e020a3c0cc07
SHA256138a1914d356d299bf00fe337760882c13b3e27c0e78584c0df5c2b2f30309c8
SHA512d21b1cf12cd7cc849aabb3ac9f4b523a72ad24bf8a003ac2b453dd4262c6771614875f099a42b98d438afab1c7c939ea9937dd7850fcdaabab3ba118f088876d
-
C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.jsonFilesize
1KB
MD56ab20754e351d818ee9d44f29a74534b
SHA1aa4635cbb1ecbbe1238459dc16d1fd6e0c625e6c
SHA2560f5880d068b19bea5398734587be35b9bfa641a4822a6c74039d0113eda78fbc
SHA51200723e908210eb60aabd0becf15ae3b768c39b98fe7a723337d2119018b805355bcb948edf9ac46ef88a3e23b2fcd910db0292dd4b0a656be0b02b4f5ce023c3
-
C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.jsonFilesize
1KB
MD5e80b71c93675199f45d643121788f70b
SHA122542bb7abd56b9762e3bcfcae64558cb1628c57
SHA25630bfbccc16aca149d4a485fcc14a19f9f13fdf75e71357440755e56340ea2432
SHA5124927e0f4e38e2cac562fd7dd553b80d64ca5668f2498386e928753896bb2cdf5b2d488543d893e9c8428e644a4a96687e59a55fe4b447fe5228321f899b45e77
-
C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.jsonFilesize
1KB
MD554f4b620339716a555290929ef3affea
SHA108fdeb697926842ccb87f4040e4cb843b3630371
SHA256efe8a0c797f50f81a5ab7108778fd89d6eb5c7da5831065ab220519b2f9281ec
SHA512dcdbb925d4e6e436d5604cd61782dce2541084d73170b13798a491e7591d945cee71fe7e240fede134abb384b86caa97d521b274ef795b42dbe33fc652ca0e24
-
C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.jsonFilesize
1KB
MD5a4045295b3f947f8071a7d276ca20143
SHA199c34972da97b79e6a12f638a2a94936a7195e3b
SHA2567f9b7bce58fb03f6fb5e153123822e22ec46b726bdc0790cd233125454d55504
SHA51264ffb1b70f659594d5f2df3bb082c0b62af101c4dcefb0300f549230b41dfae620c89153b1911e00cd5f7af192ec70b4435ee4e8626065454ada5eb573850260
-
C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.jsonFilesize
1KB
MD5019afd19754ffb93a6385a03c0800366
SHA114ca2bd989d6c234b0bf0b9eb22fd353c982fcbb
SHA25697ddbd0e6b06a194a5ccd220ac3466477cc5f2bd15d34a3b1110a343092b24fb
SHA512938783fb7e115de48e9a5562019bbbe9c05c5d84d3810df6eb1b03771ce834a357be67fe924b251e7cfab64cd17653210b26b1c232868715c676c1f10bf0162d
-
C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.jsonFilesize
1KB
MD5fe1004b735bc88a234c3ad8a67cb0a8b
SHA179e5a95e292ad9c41dc5eb66bbf1679a5f5a4114
SHA256ce6ea2db5655b7060410ccc4557b76e1c48d4227b3428f119962da0178520fc5
SHA512237b83aa2db25c2e6b9ba053d6dcd82d5f1819a52db8d85ba9d6229a932ce137851a60eb379927cd2fa31fcc705af27f383113f0d5d6774e3f492e890363af87
-
C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.jsonFilesize
1KB
MD5fe1004b735bc88a234c3ad8a67cb0a8b
SHA179e5a95e292ad9c41dc5eb66bbf1679a5f5a4114
SHA256ce6ea2db5655b7060410ccc4557b76e1c48d4227b3428f119962da0178520fc5
SHA512237b83aa2db25c2e6b9ba053d6dcd82d5f1819a52db8d85ba9d6229a932ce137851a60eb379927cd2fa31fcc705af27f383113f0d5d6774e3f492e890363af87
-
C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.jsonFilesize
1KB
MD5ee33324699f133b8c1f7292f341c80f4
SHA160d4655b70e02ae22d65a964741d39771e837df2
SHA2565c31aa987c2fc65b8605b4b5e70214ac38243aa17b6ce0f99a618fd8623d1ed0
SHA5129cc8557ea815e6c71326d5a031f1a45f34e85a6ad99321cf12233b8c5d2eedeb620d2d9b9bcebf34a0d27c5cd6f22a98f9741ca7a2a824a9786cf9ae303776b3
-
C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.jsonFilesize
1KB
MD5fe78b311632a31d6881e665536c9215e
SHA1eb70d96c6c0dfce0177d62f512b8afd9bc0da15c
SHA2563a75d50b210edb31230e53b3dc49c8f15ed3f21a27b5cc386827a8a5c943c7c5
SHA512efa5617fa07e3496bf0b6bf51b4f265701365f8db8aa686cc57e058f22964aff2c5466b684ecbaa48932630288ef40b61c97876ab8295e1d9ab9ccb3e0148b74
-
C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.jsonFilesize
1KB
MD5e05dcb0590b8c9661b035e0f3a0074d6
SHA1ef3f09f5af152bdc17fa15a8489dbd1dcf5c877b
SHA2567c882dd0496680fe04cf21b1224624e7a36eff9c0b365b25a96d9044abaf8345
SHA512d19f4d3a3b652897b9875a328da28cecddd30d3933127a295448d0ecd8aaa1914c45fde0e763dd69b2d144558e5196b1883727335dc35d65044cbea32faf8133
-
C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.jsonFilesize
1KB
MD56b7d43e87683d8448290dd79966399bc
SHA1d8178033bc3037fde6cf165e6ecfa8adcdf749ba
SHA256fcd58dc2ef630fa0816b90e74d92b05ad1651c34d244bcb1d6296ee7e44041da
SHA5128bcb401621552074476a382f1b99f7e3da1d58915a29cf549ed10819d1b4abcf8bec6bbd7706998daef5d105b96fec3c678d76e5031b52bd57758feb05471e4c
-
C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.jsonFilesize
1KB
MD57f4cdb5e4102e2b37967c717e10d759c
SHA1723a37648d80114b47d85a2346dfeed23933cef9
SHA256264c364e1f188312ccfdd1685bc2bb9900d29fae4ed42629ab125f2b9630c0e0
SHA512a237300ac3eaa60b80876aea63470763a837476aa1e29e89f92a64c76b7f8166705a8af7d0c613b1e7311cb7732e73b3c5779b56b19fc8f7f37eaddb69d8c1e2
-
C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.jsonFilesize
1KB
MD5e3a0c33269856b5e95b24449ca60721e
SHA1057f698dcbe19db228e73c03f3cc7a737a1e79a1
SHA256d2b46b5b3b936e0c31e7bdd785b079722fa41c393e6ee664beea2b08e882763c
SHA512d5d0244c364bc4456e0212f587019e86c3c4bc16aff57a882728c8709e95dd8a6891a232a8e4743416ebd9e20a1680a51a61a77c8c5c952c12573e40f82deda9
-
C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.jsonFilesize
1KB
MD57c30eeac44476b2e4df033de10c1ab37
SHA11f48d826e8594c48c4ea65d37c802f2e3696324b
SHA256dd829f1000cad1df816f2c693443b26966ac2898ea497f2452e67ef6af0661a3
SHA51267f6c18744206118f43f151ce920a5576bd25ff34567b816f6eba045c9903ba2bdcfbf00bc57cb712e3eb6caf890843d856b5702b3c21a3bec141ecf264e0588
-
C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json.bakFilesize
1KB
MD53a5c7496dd005bc31517542405f7ae24
SHA1313c6a7c71cc152af63f194d74aed520cd969b3d
SHA256329c4617273768aa40f02b4561626df2af5d59cccbfb579096260a099f1e00d7
SHA512356e05056e8daa400f3d0a4c7d6059fbed333597a55505022e328a0864f186ea916613eb4abe35a37a29826ec118de8b9381ba607c6c646a676176861482513f
-
C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json.bakFilesize
1KB
MD5ceee7d3e9f6a84cb6b39648562707b44
SHA1288d12805c2d01696f5366e50bb197d70a0ff695
SHA256c17a1d03b9e04e22d26bd27a1eb781947380900458985419adfe38c6bc3c6797
SHA512d8d61602ac862d1229197adc26de980ec34f5ac29e1b5160fbf0efd23938cc1056360a0d700b3020717962dfcb9001168f530f9b7e17f10c63e0734d27c00050
-
C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json.bakFilesize
1KB
MD5a5c2f995292bf767bd3796d2c566791b
SHA1e2ef3758a930f1203466ac79b02d757d43901c31
SHA256d2fecfd83784034690aec2857e818ecc27d9ea78a418377e7f94c58863a3537f
SHA512fb442a1bce7ed250551aaee3b7143d840c8774f742771d2db1ed7eaaa4f204f75fbf689ed5ede11b55b748d980c8ac1ef42779ace395db286113963aba543f0b
-
C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json.bakFilesize
1KB
MD53e8c8e96c4e2d047910b57c835e7bf2f
SHA13645c7f074df3645a045c77cf7a958b786a641ee
SHA2563007884fedfcaf34a7a0945ccd612939b28580d6742720395c37e4c4e3ab4d28
SHA51258d6135b266decf8a2db9460220c2792969a1b03a00055ecc9db2ebd26c92c149ada22b0e8ec9741dc458b53724cfd1b8e0c81e91baab7e91bc4a3e961e4245e
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\Actions.dllFilesize
5.0MB
MD51eff53d95ecaf6bbfffe80d866d8e1dd
SHA1d7ef7d7c77fd04b2c0eb8c16bb3cd08057f6742f
SHA2566dd748f7ca56125cbe158fa3612f08e7312ef58ad5375e6b7ab5532cc16ca0ac
SHA512c59b8e6f0b238a247e64b9c7bb42213dadac1dada63542830a6292361174c935c0c662b2d1aed3fb6100cc4993297b1eaf25e328f2b4613458c4ffca63b9f02d
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\BrowserSDKDLL.dllFilesize
5.8MB
MD51ed53171d00f440f29a12f9beb84dac4
SHA14d9a1e3579b0999f1ab2fa818b588411e9ee920c
SHA256e659e687a872050f9e65d78992d16bd9b393cf3f8e8c94e0e15fb42b7065327e
SHA51217161cfc672d1b996b8af4ebac17f9a8a3807f38c9a23e2e5b4dadcd9a21c3a64faec9bf59147022a9df88b80f89300f1b537091289bd7a42806bd206a317e6e
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\Global.nmFilesize
336KB
MD56d0b653db9f44ea422ff6da077347982
SHA18d90d4266dd3e67a7be513c9bb950a833d40e7de
SHA256d2bda209032b730d45979c43d77a4a9f3db0d6e7a240a463649da32148249925
SHA512888ee79697edb666f6aad3dd1a146ae42919b261b02fed85ab36f50a1a9a2054172c7bcb6aa9cc02530353d7d0c2b83ef268cbc705d9e8df21c50e8b7a362bb6
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\Global.srFilesize
16.0MB
MD58334313ee072e8475287c133b101beee
SHA10774e278ad5d87755c418c4cd7d4a75437b56f13
SHA256a43ebb16b7bb74292b3d7f2a5535080911c70d5020b4a2b718d60863322b8228
SHA512b401b65bba0e05fb6dd110056276a90e63b9b482aa63a4ef871acca91e2852419d3a3e4a0ffe30e09926e201a809c9d32183fe13582de8622b07d471aabc34ed
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\MBAMCore.dllFilesize
6.4MB
MD59db84546ec6408e2eb7c8711df562ad5
SHA1b408a7f0c28b8ef20b1021f3211c7495b7fe9171
SHA256238162c0adab6a1611b428726c5d0b5830b553a9677bee986fc29522563e441e
SHA512a5fdf28b82a16bb512061ebc9cc128e9efdeb3bfcfe50a4c88c2256abe5c5b10f8d237d4ab7788e5eca3dccc9d20251c4ebe8a80856f7a3174d95b24d2c3c6ba
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\cfg.binFilesize
661B
MD58fd13803b1e5f14b4d241facc601a170
SHA17321eec794bc766d84d75bd0370a9f2e4d7abdf6
SHA256925d771b2643715b62ef720801dfa96047fff1ee70eabb244bed802234673717
SHA512f5b3514258487f8576fe32a795eefcffef049c7d002a6abdca17383bba838c7a218be23ec6803dcefed615f40afc2ba4b15bf65c9a74c4f6bb891d15d02bfc22
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\clean.mbdbFilesize
10KB
MD5adcb9fa4bc7e739b8b14e05131cacd30
SHA1d8bd8fab734284d00b5be94dbcd34ab313c2ac48
SHA256d3193a821a20e024d502a4a3f012d09c98a241ed8bb0168d659a9c1a1af1a535
SHA51270e6a26c88883374d9f4fd306cdb9d9daf1ac3bb5f0fe078d890984e01c0fe801a267b02304d4cb17dd31918e243847812fc909f26fcaa51fefe90626bf47361
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\dbmanifest2.datFilesize
924B
MD520250b3d83fd1358b13314feb60620f8
SHA1c824c9aa7c16e385e0c7423b5faa3da91f1344e2
SHA2567679669e6bf77e6111f5a196a9ecc5beae350fa9ca470f4c3809b45ac8fa2ee4
SHA5121a97a4502c8521849cd1d830ae8bc4ca5f6ec15049b77fc42393bcbce57b73a750df10e1ca3f0e1ea588268501bef81881364d63c24aac7b78231ea9e4c0e30b
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\dynconfig.datFilesize
39KB
MD510f23e7c8c791b91c86cd966d67b7bc7
SHA13f596093b2bc33f7a2554818f8e41adbbd101961
SHA256008254ca1f4d6415da89d01a4292911de6135b42833156720a841a22685765dc
SHA5122d1b21371ada038323be412945994d030ee8a9007db072484724616c8597c6998a560bc28886ebf89e2c8919fb70d76c98338d88832351823027491c98d48118
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\exclusions.txtFilesize
23KB
MD5aef4eca7ee01bb1a146751c4d0510d2d
SHA15cf2273da41147126e5e1eabd3182f19304eea25
SHA2569e87e4c9da3337c63b7f0e6ed0eb71696121c74e18a5da577215e18097715e2f
SHA512d31d21e37b0048050b19600f8904354cff3f3ec8291c5a7a54267e14af9fb88dfb6d11e74a037cc0369ade8a8fb9b753861f3b3fb2219563e8ec359f66c042db
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\ig.exeFilesize
1.8MB
MD5d5805286cda5b56039dd2a2d936d4be0
SHA164ba00ec017bbb0d5c9ca4c4ce157808e76c8045
SHA256e6f775537b67e3dd2afcd8700a2a4b75632f14e5a276b1ccfe859996d8bc4850
SHA5124d7575e45eb8a554a38df752ba0653d96da6d52d570356f8803a94656f0777c473268efbcd9350f12ab901781f395e7b0212f8f8e099b6e4582ceb34ede3a5a3
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\mbdigsig2.datFilesize
514B
MD5aeeb9145095aee238fa345ce96d1f49c
SHA14df1b0f5decd16f2c0e36b98e92d461f2e97d30d
SHA256f8ab6808cb85caaeaeae58fbd2f1a9d2906a574631a73ea8ce2bc2c337f60e75
SHA51274502ea59b1c6a4d3f1df53d8aaff90520ad4956700cff3e2a0dcc744f4084216fc74bd217626b277155fd000abaabd30f4cc16c1285a415fe9e2ee1e46858a8
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\prot.mbdbFilesize
24B
MD5546d9e30eadad8b22f5b3ffa875144bf
SHA13b323ffef009bfe0662c2bd30bb06af6dfc68e4d
SHA2566089fbf0c0c1413f62e91dc9497bedc6d8a271e9dc761e20adc0dccf6f4a0c1f
SHA5123478f5dcf7af549dd6fe48ad714604200de84a90120b16a32233b6d44fa7240f5f4e5fe803f54b86bbdfd10fa1bfdd88fb85eb6a78e23e426933f98d0a2565ec
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\rdefs.mbdbFilesize
24B
MD52f7423ca7c6a0f1339980f3c8c7de9f8
SHA1102c77faa28885354cfe6725d987bc23bc7108ba
SHA256850a4ea37a0fd6f68bf95422d502b2d1257264eb90cc38c0a3b1b95aa375be55
SHA512e922ac8a7a2cde6d387f8698207cf5efbd45b646986a090e3549d97a7d552dd74179bd7ac20b7d246ca49d340c4c168982c65b4749df760857810b2358e7eb69
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\rules.mbdbFilesize
9.0MB
MD59a20739b3cca4b23e86755a564bd56e0
SHA1b38e885162039220923e9a4c160021a1549081f5
SHA2569173a8767615833cd9448eac4edf924f55fce4bdd511d8937cf63e26f4477c90
SHA51218baf591ccfccd6b06e26b8c3d7e050700eb17e048316ec34633a22a81a19ef9d225c8b006658b969462e45e810b9ab6ae10b2d83ad866d1398b256771fadde3
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\sample.dllFilesize
529KB
MD5ad6c596fba0e2968c57243a106f9ccc9
SHA12241116bbe1f33ff30cdf26ebc57af85136675f8
SHA2560ccb163eab06671bdc74fa03ec1208d66105960254cf1f9cad584300676c4eb3
SHA5128730556b3beef30296443aa1be1f538a12cbf34dbaa4cd722b269b24f639f599c51970959095b6a5a78bfa8e40cf5f85af64dd637391e5a24fa6dc9b1e6fcaf5
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\scan.mbdbFilesize
1018KB
MD5269ef223b7919ca972577657d3d33d85
SHA11a1eb8ca370beaee913715b1f4b6b8aa53fc4b2a
SHA2564447c30c097ce4276abadc515b94a6f4ad246884fbf64b7dd8ca45246679a6bc
SHA5126358d168e868151e7ef960e1cd9112eca25739bed0be81826ed29b132499ae31fa34d7eb679b40ea3b5a6f60da81735e770133dcfd6cfb0d0553b6c64b606ffb
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\tids.mbdbFilesize
177KB
MD5f0eb4779a5dade2efa5229c33abb4910
SHA141d2c8cdbd8e306a263fe419bb2c1c19514524e9
SHA2569c5242e6c567e641bb10412cd966b81819984ea643ba96222ee0b256b3f53955
SHA5126883622d693265b824d1cb65fe6d9a66d99bc8d167981fa4f0054c7513020361ec09b2c75f62a8afa85dcea175914a4c8f4872ec7040722dcaf7375886bdbd84
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\version.datFilesize
26B
MD5e38a70b64088f78136ee2f8d2b79e160
SHA13260f5b0fff2b07f8090cd38599a3624cc129620
SHA2563149cbc00a7ec330288c316dfe55644c1f2506838d8b1130adbe63396f425c3d
SHA51253dad32f26b08e08f10c3e23d9c58d9ec8d093aed6f6c6ac043201956479ab1df61c64fa5ea3ec9dcc4761a5f96833e5e6a2f86b268adbe004e6157b68eb4de2
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\wprot2.mbdbFilesize
40.5MB
MD511ad702b34346889d5fd70a9f875faff
SHA14a6952107ba24777d90c06b5528f05f45705ce90
SHA2562dc77eb6a488751757a6779b003dee922526000b38ee1d1fb3fe3266079cceea
SHA5123088130d7d57a317a2a38d3a69876f53cd3bca34df3c8ef791bf10fa17156cf811a897fc8e68f3d1fcdcee6a85600668b1c0a0bbece59dbf7fb10f42d76d69bd
-
C:\ProgramData\Malwarebytes\MBAMService\pkgvers.datFilesize
74B
MD5a8340860b065dae8f93853f85bd57787
SHA151e240bcad31e46e8378d94c02847fe7981002f3
SHA256bd6c9fc63887a8687290c2e42aff7380b029b73c56f0fec51740b166380e2aa5
SHA512cc849320c2f19358caa5be539bd65e539db9a55c3e5e83917eb50809c3ec369bf3f6e693d49344338805eb9582008c194721b0183d9b12172a9eb14c72a33b0d
-
C:\Users\Admin\AppData\Local\Temp\mbam\qt-jl-icons\209e5464790.icoFilesize
4KB
MD591a74c169917bee7cb2c8ef9dc74ecbe
SHA18633b44ae58c4b201078114d925f551b36c549b0
SHA2561e5eaee00708bb44d5d053ee25da5b273ad855b7f49456268dcdebac5d5d5710
SHA512d5274c14e4f1aa99d5ead0cafa5f42fad074092944d6f48c3fb0cc6a311f958f97e23fdeba3c5639fae0751f692f9e5f85dd065baf2638291f2ba2a42c4afb72
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\a712c324879904b1.customDestinations-msFilesize
3KB
MD57ba6ea500a595240cf4293e913b71a10
SHA1d64faa8309203aa1ac5feec4591343662991a39c
SHA256ef9b9c35350053f1649af11fa921a68ee597411f2148964fbf833108b3671079
SHA5124b0449df2b9f7fff521fbacd739de28a60713758c72b16639efd5df75f84b33bc1f9977c6606a54cfca94602d4db402faca11640628869abdc939d2e14088694
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\a712c324879904b1.customDestinations-msFilesize
6KB
MD5ae2e00218a06d174c98b328696388fe8
SHA1a0eb824724d91288b814fade4d90523f0f1a9e3f
SHA25634280937f679dc627037f78aa742e57bfe13e52cb7fc20b2231f6c1309aa9f6d
SHA51281145906d69be7abae40366a0dd254769d71f64cca40c691994c1b6db89b428d818e2eb1338adc846d88bd8225d36caaad7672e4afbc087d478991e288be56df
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\a712c324879904b1.customDestinations-msFilesize
1KB
MD5d544108e94a5759c91d608265a4aa414
SHA15ee2df1d43bef50ac152832aa0b25adedbd49eec
SHA25690f401d891a32cbd76abfd4144dec07e2808da2015e1960ea80019caaf67d244
SHA512963b7755314c593f2fd23730c402114b795753c22d13ea0ee6a3eb68082e6b5b9e8c7f48ed27880b8f9898000e9a00791185b64867bce0a4fcbfe75fbeef83b2
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\a712c324879904b1.customDestinations-msFilesize
3KB
MD58dfa88af4cbeb761705931e5873a42b7
SHA19e70aa20c35ebdf52f60a6538eaa2c61b32e16a3
SHA256c3aad0f14c63abbbb03eb16d977138e3b235a0140e30dd050fcc5bc3b95713dc
SHA5120d9efb8766ae4a1285bcc463907e8f64d9977b868b3edeec4bba4f8200f5dcb6b88174d43bfe7db51b558d9a336918f7c8f4795d3fca18efb14de9f74c013cd7
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\a712c324879904b1.customDestinations-msFilesize
6KB
MD518c8106c930e8598242eb3c15b746ecd
SHA1a5fc0de1df4f2f4c81ab1465537daa10e757612e
SHA256f8c9984cfd9518e5565e718beabe10f8c48a2655b44123ab0433089dd49bc562
SHA512408374e77ec091826feb347fa6fa8eeeea88ed0dcc8220b10dd67484135a71f4009de9b23953bd1a9bb82465cf34d3bb4dac15afea682216ab780f648413b656
-
C:\Windows\System32\CatRoot2\dberr.txtFilesize
184KB
MD53b668f669e85166dbf2baf3af3e772f5
SHA12d89bc2e647abed1e79d3c80182a2b2b3f7d3f7f
SHA256a1359dc738af13fdc03a02ca3f5319ca18bd53a854bb14c4992b30847476af19
SHA512fdbfdecffff0898a4e83c89ce3dd0a49577589f9e05fa6f9720f2ca596799c65edd17963cd18b827cce30d07dd5e2fe31db7dd3bbbbba47a10916cdbcc068149
-
C:\Windows\System32\catroot2\dberr.txtFilesize
184KB
MD553d2a77099c9fe5f2b28b40457a52a21
SHA1c85350204b007b91ebe319d632b124cad8ce5f13
SHA256186f0324a97194c13ffcefb1a1e64e8612c4a3fc8eee2238c5181cac12f5b6a5
SHA512be94eca73038e6a4ccb0faeb5cec3896f929ae63c2b94134f186a3e993cfae46fe650d47e97a47cd33f1e4fa5666bcbb47922e1da30e70ffb68cd80b1cd4ebe5
-
C:\Windows\System32\drivers\mbam.sysFilesize
76KB
MD51e88c7a4bd3748f8958155cd285588a2
SHA1191956f5ca82a4b191b8d05bfa3d0d5abaf75e49
SHA256fbcdd69bbe5a49be001c9e236773b108657767e59ace47989968ab304344009e
SHA51236a873af86bc921adf15ad8b5c973a37a1639c2ac3bbff0dc412f32014927a7c5e73e30b3e28861e0b616c1774395a459ecc00a0c8063958d42753553f7062bb
-
C:\Windows\Temp\MBInstallTemp459ebbcd774c11eeab2646f26d303063\ctlrpkg\mbae64.sysFilesize
154KB
MD595515708f41a7e283d6725506f56f6f2
SHA19afc20a19db3d2a75b6915d8d9af602c5218735e
SHA256321058a27d7462e55e39d253ad5d8b19a9acf754666400f82fe0542f33e733c6
SHA512d9230901adeecb13b1f92287abe9317cdac458348885b96ef6500960793a7586c76ae374df053be948a35b44abe934aa853975a6ccd3788f93909903cc718c08
-
C:\Windows\Temp\MBInstallTemp459ebbcd774c11eeab2646f26d303063\servicepkg\MBAMService.exeFilesize
8.9MB
MD503948ad78f44b840ec2296a0fbb9f2fc
SHA1a4c04a502746af80894c13de707bd0282388e12e
SHA2568ffd82021f35885627bbf5a0a55a51963e7e37c5a5d636466e244fa64ad94d65
SHA51235b39c9f7da64a22d4bc8aed88b36bf3d69bb2d45d0ddb360fc909c943d61e067e77da5b54c64406fa7af883b9bd798100193fae2eb790fb304037a6df4d47ee
-
C:\Windows\Temp\MBInstallTemp459ebbcd774c11eeab2646f26d303063\servicepkg\mbamelam.catFilesize
10KB
MD560608328775d6acf03eaab38407e5b7c
SHA19f63644893517286753f63ad6d01bc8bfacf79b1
SHA2563ed5a1668713ef80c2b5599b599f1434ad6648999f335cf69757ea3183c70c59
SHA5129f65212121b8a5d1a0625c3baa14ef04a33b091d26f543324333e38dcdb903e02ccc4d009e22c2e85d2f61d954e0b994c2896e52f685003a6ef34758f8a650c7
-
C:\Windows\Temp\MBInstallTemp459ebbcd774c11eeab2646f26d303063\servicepkg\mbamelam.infFilesize
2KB
MD5c481ad4dd1d91860335787aa61177932
SHA181633414c5bf5832a8584fb0740bc09596b9b66d
SHA256793626d240fd8eefc81b78a57c8dfe12ea247889b6f07918e9fd32a7411aa1c3
SHA512d292e028936412f07264837d4a321ecfa2f5754d4048c8bcf774a0e076e535b361c411301558609d64c71c1ce9b19e6041efa44d201237a7010c553751e1e830
-
C:\Windows\Temp\MBInstallTemp459ebbcd774c11eeab2646f26d303063\servicepkg\mbamelam.sysFilesize
20KB
MD59e77c51e14fa9a323ee1635dc74ecc07
SHA1a78bde0bd73260ce7af9cdc441af9db54d1637c2
SHA256b5619d758ae6a65c1663f065e53e6b68a00511e7d7accb3e07ed94bfd0b1ede0
SHA512a12ccf92bead694f5d3cba7ff7e731a2f862198efc338efc7f33a882fe0eb7499fb3fb533538d0a823e80631a7ca162962fbdfd78e401e3255672910b7140186
-
C:\Windows\Temp\MBInstallTemp459ebbcd774c11eeab2646f26d303063\servicepkg\mbshlext.dllFilesize
2.7MB
MD5b7e5071b317550d93258f7e1e13e7b6f
SHA12d08d78a5c29cf724bc523530d1a9014642bbc60
SHA256467de01d7cee7ec54166b80658ff22f9feebdb1c24eaf1629cf40e4124508064
SHA5129c35293c95c1a9141740ac99315605964aa37c4a42d3a11cae9e5649ff1427a9480d3d5e7f763212cf13db3511c5ea3c84e68f95f0067fe6339a9d3fb7b27c54
-
C:\Windows\Temp\MBInstallTemp459ebbcd774c11eeab2646f26d303063\uipkg\QtQuick\Controls.2\HorizontalHeaderView.qmlFilesize
1KB
MD5d8c9674c0e9bddbd8aa59a9d343cf462
SHA1490aa022ac31ddce86d5b62f913b23fbb0de27c2
SHA2561ef333b5fb4d8075973f312ef787237240b9f49f3f9185fb21202883f900e7d7
SHA5120b86ec673133f6400c38b79f9ba4f7b37ce5afdab1a2e34acbf75019e2590cc26b26d323ddc1567c91375053c9c8593be0615389db8eb1a8d1eb084ad4200b82
-
C:\Windows\Temp\MBInstallTemp459ebbcd774c11eeab2646f26d303063\uipkg\QtQuick\Controls.2\Imagine\VerticalHeaderView.qmlFilesize
1KB
MD5829769b2741d92df3c5d837eee64f297
SHA1f61c91436ca3420c4e9b94833839fd9c14024b69
SHA256489c02f8716e7a1de61834b3d8bbb61bce91ca4a33a6b62342b4c851d93e51e0
SHA5124061c271db37523b9dea9a9973226d91337e1809d4e7767e57ac938d35d77a302363ed92ab4be18c35ba589f528194ad71c93a8507449bf74dd035acf7cdb521
-
\Program Files\Malwarebytes\Anti-Malware\7z.dllFilesize
1.7MB
MD5461faf68ccc02b0223fd273b630f21fe
SHA1363b8beaa74f0f454c2d544ace9e71a84bc2b4cf
SHA256cb07f3f461e9c267831b1ab93af6dfda1bb51d72e42d73d00d26594f09326be1
SHA5124b671f48e45fdedf50c7f7bb6c8d82a3b98f7502006eb002aaf8ff31f25f9ff1257c7bcc12caf622e43d4ec665b19d978ae3e3762f76def0bc71485ebdb8426f
-
\Program Files\Malwarebytes\Anti-Malware\Actions.dllFilesize
5.0MB
MD51eff53d95ecaf6bbfffe80d866d8e1dd
SHA1d7ef7d7c77fd04b2c0eb8c16bb3cd08057f6742f
SHA2566dd748f7ca56125cbe158fa3612f08e7312ef58ad5375e6b7ab5532cc16ca0ac
SHA512c59b8e6f0b238a247e64b9c7bb42213dadac1dada63542830a6292361174c935c0c662b2d1aed3fb6100cc4993297b1eaf25e328f2b4613458c4ffca63b9f02d
-
\Program Files\Malwarebytes\Anti-Malware\ActionsShim.dllFilesize
2.5MB
MD558149edf4990067b4c1ffe1c32a51a01
SHA180c0c8b8def45420159659d2eaad181eb0b05c40
SHA25667af73f9b49ce113d02d7f2824e45d48044273772c94e6e8c300cf86bf83cb55
SHA512fe69f4eccaa35b132b7dfc77fae50733398cfa5ab7377f502a50e1bb83be6b81fad26a0a24f6dfbc99dca6e118784f3452edc4a30c11ac161fc0db62b039cb4e
-
\Program Files\Malwarebytes\Anti-Malware\CleanControllerImpl.dllFilesize
6.9MB
MD573a08c403bf08e39bd560ffc74ae9b8f
SHA1888c6d11e6788875f8fca748b6f92a19b6126dc6
SHA25609d687c0164a9f108c4f9e107bfc0cb671ebe643ac9aae968cb8df0e5adda960
SHA5128b65c0549c319e9c42b30071b1342e8ba4239d9dc4a124e19abd2160339c03235f0ec534a997ec367f2b474797d33efa496e641c7a63904bf8e0af43a32f1535
-
\Program Files\Malwarebytes\Anti-Malware\CloudControllerImpl.dllFilesize
4.8MB
MD5d739c6bd5d5cae2ae961a0c2d40eb5b1
SHA116d0d40707bf55f04a0da70798b5368e612fd5e6
SHA25625472857a59a9067c1224b173b378448bb574f5365edbe4a1a46df8810007f9a
SHA5127d80a39f3a91e0faa87ae8143f43d2e8947eaedfd317a1ac1547dfa15b825cc5c200f8baebe127a0bc2379fe90c40f3ea25db09c06b521aad1c189ce24a53c7d
-
\Program Files\Malwarebytes\Anti-Malware\LicenseControllerImpl.dllFilesize
4.4MB
MD565e42cbe095830d9d93ecabb13392780
SHA1e60110e159cc4cc92d2606ae3ba3559c10170e5a
SHA256a773e1706bbb6e8cb522d0e1a3d29e496bcbe6a91e221c26bea98292b9316f7f
SHA5126b25cebb6433ec87831a3f0f67b96c7fc37a617158a18d9ac20bd375f46c97da8a41e4379da72808fdd7947705c6c09518c56152f96eebf2bcefb39ffa6202ed
-
\Program Files\Malwarebytes\Anti-Malware\MBAMShim.dllFilesize
3.0MB
MD5f44b6c80c46c4cf3071b5f5b916e1271
SHA1839f2238ecbbfa80ebf9c1f77eafc78204b58761
SHA256732523df43358729d5e85cceb557d69016dcdd3e2238d903c33c5327c3131fae
SHA51299be164ae96bc4f93dc896d5df445ad1c2f023f10605a8c9857d7ebedfc5b070f50cd33b401d61003e601a06b8446e6c0b5dbddda4927a2e1352407d3b266942
-
\Program Files\Malwarebytes\Anti-Malware\PoliciesControllerImpl.dllFilesize
4.0MB
MD5efe6216931bca54ccf05a0bcb9f83fb9
SHA1007d0a3c4d850cd9b2886b24daf91c988d702bdd
SHA256eaf71519b965b9530e84be08bd3649fdb8feeeabb8dd2455be95755a336a44d6
SHA5127c59071b6ae8d0a2d6eedcb58f6a1337aa340275bf30baa121f515241aba822f6f7bbbc53b626f5f44c424af70aef3afc582a1a8a34d0b0adef115d0e8f684f4
-
\Program Files\Malwarebytes\Anti-Malware\ScanControllerImpl.dllFilesize
5.7MB
MD5e80262b787eec69e8dd3d051a1d2840c
SHA1bbb88d699a7715d800db88679d6f7d52bf16673e
SHA256a07dbc4cc18dea7c29ea1e32c1511e846bd06ca86229b0499cbe20575937395f
SHA51216f8abc1cb48d8e7786a8add362987b0a464e0082c2bdce5ad42ed52cea1ad64cc117dc80127b5666f26d777701b1b81c178a87301be6394e8f17e5370f68789
-
\Program Files\Malwarebytes\Anti-Malware\Swissarmy.dllFilesize
4.0MB
MD53486801ce1e8ffc1bbc6d4f097b0f369
SHA108f2a85cd07cf1c0d6f27f0d5e7179c2a5cb8600
SHA25626720d0b669898089a4ab5a6c53203918ec399d227331273ba11169bbe273678
SHA51281974a79bf4e4086549874ef778e7716713a0107ccce212e9564f3355a26670943845aaba744691d2b68224e06e2f9d9a263e29f4ca7e46e1bfdb507a24656d5
-
\Program Files\Malwarebytes\Anti-Malware\SwissarmyShim.dllFilesize
2.6MB
MD589a38afcfa758e3298609c6c51929593
SHA12df1ee30adc92bd995526e41fd9c823354de30b4
SHA2564795576483af0c136a71dcee87a0ffb54f0869cae6395ac2ff8312bf555e7161
SHA512cceaed0b9a7517aebd739a377c7bd8987b9ac357be2bf987dbae31d59f2121c5bb9a9bfa2c70a9a54ad65546ef23903176dd6328d93408cb5c991257d59e2717
-
\Program Files\Malwarebytes\Anti-Malware\TelemetryControllerImpl.dllFilesize
5.3MB
MD51692937ebb8172814cfd1b2d20dac8c6
SHA13ad3b0dce9958ce66d89c280645ae827d3b89f16
SHA256f1cee1b89fff12181d828623b3aba0f0b8c0aed4aab8b0c017ea4d4731c16e32
SHA512a36462731990635f57f80c070cb01a8c4fe6fa445aad63f077197d473d0d625e23bcadaf5bf92c9504919ee69d12239a7733febf27d6016aa20c03f631b7e3e8
-
\Program Files\Malwarebytes\Anti-Malware\UpdateControllerImpl.dllFilesize
4.4MB
MD52114b71049bc4626a565fa7bef9ba37c
SHA1ca5567bd58897128a750be7db94357253321db0d
SHA256e981f1d6fdd820ad2781f0cbdc3b0715101de3257c1aab23af806f0a547dfb9e
SHA5129f97a9fdfd54072730aed98948f7b46c9667cadddc87bebb8d275b94708f11c24e618a0d169366f57b959db16e0b841e5539f5325611a4d19d3bd978a2c03427
-
\Program Files\Malwarebytes\Anti-Malware\mbshlext.dllFilesize
2.7MB
MD5b7e5071b317550d93258f7e1e13e7b6f
SHA12d08d78a5c29cf724bc523530d1a9014642bbc60
SHA256467de01d7cee7ec54166b80658ff22f9feebdb1c24eaf1629cf40e4124508064
SHA5129c35293c95c1a9141740ac99315605964aa37c4a42d3a11cae9e5649ff1427a9480d3d5e7f763212cf13db3511c5ea3c84e68f95f0067fe6339a9d3fb7b27c54
-
\Program Files\Malwarebytes\Anti-Malware\offreg.dllFilesize
114KB
MD516663d125398773a90d0a53333b7cf5e
SHA1f92928ae3c9292588547ceaca1cb1d372bfd7936
SHA25638e6811b47262101759aa51a631263d9e3eee5d211164318a751e078afec4cbc
SHA512091764b8ad80aa31eea0bbd91ee505ebdea2654bc8aeaa3081a061d0d37ab13d27dd203075fd0de10c6687591aa0e36139a38af846c4e34e6aa67ab81dc277df
-
\Windows\Temp\MBInstallTemp459ebbcd774c11eeab2646f26d303063\7z.dllFilesize
1.6MB
MD5ab8f0c1a37c0df5c8924aab509db42c9
SHA153dba959124e6d740829bda2360e851bcb85cce8
SHA2566e223b275b84d948cc5ae1f161f0bfff2adb34de04634c84d7dbe9305a4998d5
SHA512ff8a26e8fd5a08c74e5ba93a564e0d3cd932754e7f06993a365bfad06670497889e69ec45bfba1378040b72f82d468e79682beba2439937bb29d2a41da940d4a
-
\Windows\Temp\MBInstallTemp459ebbcd774c11eeab2646f26d303063\7z.dllFilesize
1.6MB
MD5ab8f0c1a37c0df5c8924aab509db42c9
SHA153dba959124e6d740829bda2360e851bcb85cce8
SHA2566e223b275b84d948cc5ae1f161f0bfff2adb34de04634c84d7dbe9305a4998d5
SHA512ff8a26e8fd5a08c74e5ba93a564e0d3cd932754e7f06993a365bfad06670497889e69ec45bfba1378040b72f82d468e79682beba2439937bb29d2a41da940d4a
-
memory/2296-4709-0x00000209EA750000-0x00000209EA751000-memory.dmpFilesize
4KB
-
memory/2296-4730-0x00000209EA760000-0x00000209EA761000-memory.dmpFilesize
4KB
-
memory/2296-4733-0x00000209EA7B0000-0x00000209EA7B1000-memory.dmpFilesize
4KB
-
memory/2296-4732-0x00000209EA760000-0x00000209EA761000-memory.dmpFilesize
4KB
-
memory/2296-4731-0x00000209EA7A0000-0x00000209EA7A1000-memory.dmpFilesize
4KB
-
memory/2296-4734-0x00000209EA760000-0x00000209EA761000-memory.dmpFilesize
4KB
-
memory/2296-4735-0x00000209EA7B0000-0x00000209EA7B1000-memory.dmpFilesize
4KB
-
memory/2296-4729-0x00000209EA7B0000-0x00000209EA7B1000-memory.dmpFilesize
4KB
-
memory/2296-4728-0x00000209EA7B0000-0x00000209EA7B1000-memory.dmpFilesize
4KB
-
memory/2296-4726-0x00000209EA760000-0x00000209EA761000-memory.dmpFilesize
4KB
-
memory/2296-4725-0x00000209EA760000-0x00000209EA761000-memory.dmpFilesize
4KB
-
memory/2296-4724-0x00000209EA7A0000-0x00000209EA7A1000-memory.dmpFilesize
4KB
-
memory/2296-4723-0x00000209EA7A0000-0x00000209EA7A1000-memory.dmpFilesize
4KB
-
memory/2296-4722-0x00000209EA780000-0x00000209EA782000-memory.dmpFilesize
8KB
-
memory/2296-4721-0x00000209EA7A0000-0x00000209EA7A1000-memory.dmpFilesize
4KB
-
memory/2296-4720-0x00000209EA790000-0x00000209EA791000-memory.dmpFilesize
4KB
-
memory/2296-4719-0x00000209EA7A0000-0x00000209EA7A1000-memory.dmpFilesize
4KB
-
memory/2296-4717-0x00000209EA790000-0x00000209EA791000-memory.dmpFilesize
4KB
-
memory/2296-4715-0x00000209EA780000-0x00000209EA782000-memory.dmpFilesize
8KB
-
memory/2296-4714-0x00000209EA760000-0x00000209EA761000-memory.dmpFilesize
4KB
-
memory/2296-4713-0x00000209EA770000-0x00000209EA772000-memory.dmpFilesize
8KB
-
memory/2296-4711-0x00000209EA760000-0x00000209EA761000-memory.dmpFilesize
4KB
-
memory/2296-4712-0x00000209EA750000-0x00000209EA751000-memory.dmpFilesize
4KB
-
memory/2296-4710-0x00000209EA750000-0x00000209EA751000-memory.dmpFilesize
4KB
-
memory/2296-4708-0x00000209EA770000-0x00000209EA772000-memory.dmpFilesize
8KB
-
memory/2296-4707-0x00000209EA780000-0x00000209EA782000-memory.dmpFilesize
8KB
-
memory/2296-4705-0x00000209EA770000-0x00000209EA772000-memory.dmpFilesize
8KB
-
memory/2296-4704-0x00000209EA770000-0x00000209EA772000-memory.dmpFilesize
8KB
-
memory/2296-4703-0x00000209EA770000-0x00000209EA772000-memory.dmpFilesize
8KB
-
memory/2296-4702-0x00000209EA760000-0x00000209EA761000-memory.dmpFilesize
4KB
-
memory/2296-4699-0x00000209EA750000-0x00000209EA751000-memory.dmpFilesize
4KB
-
memory/2296-4700-0x00000209EA750000-0x00000209EA751000-memory.dmpFilesize
4KB
-
memory/2296-4697-0x00000209EA4F0000-0x00000209EA4F1000-memory.dmpFilesize
4KB
-
memory/2296-4698-0x00000209EA4F0000-0x00000209EA4F1000-memory.dmpFilesize
4KB
-
memory/2296-4696-0x00000209EA4F0000-0x00000209EA4F1000-memory.dmpFilesize
4KB
-
memory/2296-4695-0x00000209EA4F0000-0x00000209EA4F1000-memory.dmpFilesize
4KB
-
memory/2296-4694-0x00000209EA4F0000-0x00000209EA4F1000-memory.dmpFilesize
4KB
-
memory/2296-4692-0x00000209EA750000-0x00000209EA751000-memory.dmpFilesize
4KB
-
memory/2296-4691-0x00000209EA750000-0x00000209EA751000-memory.dmpFilesize
4KB
-
memory/2296-4690-0x00000209EA750000-0x00000209EA751000-memory.dmpFilesize
4KB
-
memory/2296-4689-0x00000209EA750000-0x00000209EA751000-memory.dmpFilesize
4KB
-
memory/2296-4688-0x00000209EA750000-0x00000209EA751000-memory.dmpFilesize
4KB
-
memory/2296-4687-0x00000209EA750000-0x00000209EA751000-memory.dmpFilesize
4KB
-
memory/2296-4686-0x00000209EA750000-0x00000209EA751000-memory.dmpFilesize
4KB
-
memory/2296-4685-0x00000209EA750000-0x00000209EA751000-memory.dmpFilesize
4KB
-
memory/2296-4292-0x00000209E33B0000-0x00000209E33C0000-memory.dmpFilesize
64KB
-
memory/2296-4222-0x00000209E33B0000-0x00000209E33C0000-memory.dmpFilesize
64KB
-
memory/2296-4219-0x00007FF7F7960000-0x00007FF7F901A000-memory.dmpFilesize
22.7MB
-
memory/2296-4221-0x00007FFE37E50000-0x00007FFE383BB000-memory.dmpFilesize
5.4MB
-
memory/2296-4220-0x00007FFE3B270000-0x00007FFE3B68E000-memory.dmpFilesize
4.1MB
-
memory/4232-4115-0x0000026D5F7A0000-0x0000026D5F9A0000-memory.dmpFilesize
2.0MB
-
memory/4232-4113-0x0000026D5F360000-0x0000026D5F7A0000-memory.dmpFilesize
4.2MB
-
memory/4232-4112-0x0000026D5E6E0000-0x0000026D5E6F0000-memory.dmpFilesize
64KB
-
memory/4232-4110-0x00007FFE3B270000-0x00007FFE3B68E000-memory.dmpFilesize
4.1MB
-
memory/4232-4111-0x00007FFE37E50000-0x00007FFE383BB000-memory.dmpFilesize
5.4MB