Analysis
-
max time kernel
146s -
max time network
152s -
platform
windows10-1703_x64 -
resource
win10-20231023-en -
resource tags
arch:x64arch:x86image:win10-20231023-enlocale:en-usos:windows10-1703-x64system -
submitted
30-10-2023 18:02
Static task
static1
Behavioral task
behavioral1
Sample
MBSetup.exe
Resource
win10-20231023-en
Behavioral task
behavioral2
Sample
MBSetup.exe
Resource
win10v2004-20231023-en
Errors
General
-
Target
MBSetup.exe
-
Size
2.5MB
-
MD5
1e885823577394ea61ea89438ffe2954
-
SHA1
e53e96f7374790bdad8a614949b398b055c3a27b
-
SHA256
7c0b9bceed390f7f28135431c09ac51469ee8e2b8095fb36a37315d811d9ba9c
-
SHA512
73f600833dad0047b6444110d722dc95237b38bb486abc7fc8e4f59b69e2154c885fb46d65f488d5139a0b6e76ebde33ea72711c7f58436650ef992fb8995627
-
SSDEEP
49152:Lw3ye9SPQ1sjDAVj+JeRanStQyfvE0Z3R0nxiIq2ddAsuysSiSF:4yeoCVj+c6KtQRq2ADSiSF
Malware Config
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
MBSetup.exedescription pid process target process PID 4672 created 3332 4672 MBSetup.exe Explorer.EXE -
Downloads MZ/PE file
-
Drops file in Drivers directory 23 IoCs
Processes:
MBAMService.exeMBAMInstallerService.exeMBSetup.exeMBAMService.exedescription ioc process File opened for modification C:\Windows\system32\DRIVERS\SETDB49.tmp MBAMService.exe File created C:\Windows\system32\DRIVERS\SETDB49.tmp MBAMService.exe File created C:\Windows\system32\drivers\mbae64.sys MBAMInstallerService.exe File opened for modification C:\Windows\system32\DRIVERS\SETC242.tmp MBAMService.exe File created C:\Windows\system32\DRIVERS\SETC242.tmp MBAMService.exe File created C:\Windows\system32\DRIVERS\SETBC83.tmp MBAMService.exe File opened for modification C:\Windows\system32\DRIVERS\mwac.sys MBAMService.exe File opened for modification C:\Windows\system32\DRIVERS\SETBC83.tmp MBAMService.exe File opened for modification C:\Windows\system32\DRIVERS\SETBD7E.tmp MBAMService.exe File created C:\Windows\SysWOW64\drivers\mbamtestfile.dat MBSetup.exe File created C:\Windows\system32\DRIVERS\MbamElam.sys MBAMService.exe File opened for modification C:\Windows\system32\DRIVERS\MbamElam.sys MBAMService.exe File created C:\Windows\system32\DRIVERS\SETBC08.tmp MBAMService.exe File opened for modification C:\Windows\system32\DRIVERS\SETBBF5.tmp MBAMService.exe File opened for modification C:\Windows\system32\DRIVERS\mbamswissarmy.sys MBAMService.exe File opened for modification C:\Windows\system32\DRIVERS\MbamChameleon.sys MBAMService.exe File created C:\Windows\system32\DRIVERS\SETBD7E.tmp MBAMService.exe File opened for modification C:\Windows\system32\DRIVERS\farflt.sys MBAMService.exe File created C:\Windows\system32\DRIVERS\SETCE29.tmp MBAMService.exe File opened for modification C:\Windows\system32\DRIVERS\SETBC08.tmp MBAMService.exe File created C:\Windows\system32\DRIVERS\SETBBF5.tmp MBAMService.exe File opened for modification C:\Windows\system32\DRIVERS\SETCE29.tmp MBAMService.exe File created C:\Windows\system32\DRIVERS\mbam.sys MBAMService.exe -
Modifies RDP port number used by Windows 1 TTPs
-
Sets service image path in registry 2 TTPs 2 IoCs
Processes:
MBAMService.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MBAMSwissArmy\ImagePath = "\\SystemRoot\\System32\\Drivers\\mbamswissarmy.sys" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MBAMChameleon\ImagePath = "\\SystemRoot\\System32\\Drivers\\MbamChameleon.sys" MBAMService.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
MBSetup.exeMBAMService.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion MBSetup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate MBSetup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion MBAMService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate MBAMService.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
MBAMInstallerService.exeMBAMService.exedescription ioc process File opened (read-only) \??\O: MBAMInstallerService.exe File opened (read-only) \??\Q: MBAMInstallerService.exe File opened (read-only) \??\J: MBAMService.exe File opened (read-only) \??\K: MBAMInstallerService.exe File opened (read-only) \??\N: MBAMInstallerService.exe File opened (read-only) \??\X: MBAMService.exe File opened (read-only) \??\E: MBAMInstallerService.exe File opened (read-only) \??\I: MBAMInstallerService.exe File opened (read-only) \??\S: MBAMInstallerService.exe File opened (read-only) \??\W: MBAMInstallerService.exe File opened (read-only) \??\I: MBAMService.exe File opened (read-only) \??\K: MBAMService.exe File opened (read-only) \??\N: MBAMService.exe File opened (read-only) \??\Y: MBAMInstallerService.exe File opened (read-only) \??\M: MBAMInstallerService.exe File opened (read-only) \??\P: MBAMInstallerService.exe File opened (read-only) \??\R: MBAMInstallerService.exe File opened (read-only) \??\Z: MBAMInstallerService.exe File opened (read-only) \??\E: MBAMService.exe File opened (read-only) \??\W: MBAMService.exe File opened (read-only) \??\J: MBAMInstallerService.exe File opened (read-only) \??\Y: MBAMService.exe File opened (read-only) \??\B: MBAMInstallerService.exe File opened (read-only) \??\L: MBAMService.exe File opened (read-only) \??\O: MBAMService.exe File opened (read-only) \??\V: MBAMService.exe File opened (read-only) \??\X: MBAMInstallerService.exe File opened (read-only) \??\H: MBAMService.exe File opened (read-only) \??\S: MBAMService.exe File opened (read-only) \??\U: MBAMService.exe File opened (read-only) \??\G: MBAMInstallerService.exe File opened (read-only) \??\H: MBAMInstallerService.exe File opened (read-only) \??\T: MBAMInstallerService.exe File opened (read-only) \??\U: MBAMInstallerService.exe File opened (read-only) \??\P: MBAMService.exe File opened (read-only) \??\Z: MBAMService.exe File opened (read-only) \??\A: MBAMInstallerService.exe File opened (read-only) \??\Q: MBAMService.exe File opened (read-only) \??\L: MBAMInstallerService.exe File opened (read-only) \??\A: MBAMService.exe File opened (read-only) \??\B: MBAMService.exe File opened (read-only) \??\M: MBAMService.exe File opened (read-only) \??\V: MBAMInstallerService.exe File opened (read-only) \??\G: MBAMService.exe File opened (read-only) \??\R: MBAMService.exe File opened (read-only) \??\T: MBAMService.exe -
Drops file in System32 directory 12 IoCs
Processes:
MBAMService.exeMBAMService.exedescription ioc process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\572BF21E454637C9F000BE1AF9B1E1A9 MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\572BF21E454637C9F000BE1AF9B1E1A9 MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\38D10539991D1B84467F968981C3969D_C92678066E2B4B4986BC7641EEC08637 MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\117308CCCD9C93758827D7CC85BB135E MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\117308CCCD9C93758827D7CC85BB135E MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\FA0E447C3E79584EC91182C66BBD2DB7 MBAMService.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt MBAMService.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\38D10539991D1B84467F968981C3969D_C92678066E2B4B4986BC7641EEC08637 MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FA0E447C3E79584EC91182C66BBD2DB7 MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_6E4F36431D86962EFD432400DF65AC90 MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_6E4F36431D86962EFD432400DF65AC90 MBAMService.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 64 IoCs
Processes:
MBAMInstallerService.exeMBAMService.exedescription ioc process File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Base\images\spinner_medium.png MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Fusion\ToolButton.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\languages\lang_ru.qm MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Private\ScrollViewHelper.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Desktop\SpinBoxStyle.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Desktop\ToolButtonStyle.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\BusyIndicator.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Imagine\GroupBox.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Material\StackView.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\api-ms-win-core-file-l1-2-0.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Private\Style.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Imagine\HorizontalHeaderView.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Imagine\SwipeDelegate.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.cat MBAMService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\MenuBar.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Fusion\TabButton.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Base\ButtonStyle.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Material\ToolSeparator.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\sample.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\d3dcompiler_47.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\StatusBar.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick.2\plugins.qmltypes MBAMInstallerService.exe File created C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-2.exe MBAMService.exe File created C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-5.exe MBAMService.exe File created C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-9.exe MBAMService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\Actions.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\api-ms-win-crt-multibyte-l1-1-0.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Fusion\ButtonPanel.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Material\RadioDelegate.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Dialogs\qml\icons.ttf MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\api-ms-win-crt-stdio-l1-1-0.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\SpinBox.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Dialogs\images\critical.png MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Private\TextInputWithHandles.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Imagine\ToolButton.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Fusion\SwipeDelegate.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Fusion\TextArea.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Imagine\qmldir MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Imagine\RoundButton.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Dialogs\images\sunken_frame.png MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Extras\qmldir MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\api-ms-win-crt-time-l1-1-0.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\ToolButton.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtWebEngineProcess.exe MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Desktop\FocusFrameStyle.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\SpinBox.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Universal\RadioIndicator.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\languages\lang_da.qm MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\api-ms-win-crt-math-l1-1-0.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Private\ToolMenuButton.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\CheckBox.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Imagine\Page.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Material\SwitchIndicator.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\mbae.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\api-ms-win-core-rtlsupport-l1-1-0.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Private\TextSingleton.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\DelayButton.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Imagine\Drawer.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\SecurityProductInformation.ini MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\api-ms-win-core-libraryloader-l1-1-0.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\api-ms-win-core-namedpipe-l1-1-0.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\api-ms-win-core-datetime-l1-1-0.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Universal\TextField.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Button.qml MBAMInstallerService.exe -
Drops file in Windows directory 2 IoCs
Processes:
MBAMService.exeMBAMService.exedescription ioc process File created C:\Windows\ELAMBKUP\MbamElam.sys MBAMService.exe File opened for modification C:\Windows\security\logs\scecomp.log MBAMService.exe -
Executes dropped EXE 25 IoCs
Processes:
MBAMInstallerService.exeMBAMService.exeMBAMService.exembamtray.exembam.exeig.exeig-0.exeig-1.exeig-2.exeig-3.exeig-4.exeig-5.exeig-6.exeig-7.exeig-8.exeig-9.exeig-10.exeig-11.exeig-12.exeig-13.exeig-14.exeig-15.exeig-16.exeig-17.exeMBAMWsc.exepid process 5036 MBAMInstallerService.exe 2768 MBAMService.exe 792 MBAMService.exe 3516 mbamtray.exe 5448 mbam.exe 5796 ig.exe 5820 ig-0.exe 5884 ig-1.exe 5520 ig-2.exe 704 ig-3.exe 4384 ig-4.exe 380 ig-5.exe 4940 ig-6.exe 3956 ig-7.exe 6068 ig-8.exe 6128 ig-9.exe 2508 ig-10.exe 4680 ig-11.exe 3640 ig-12.exe 3452 ig-13.exe 828 ig-14.exe 2336 ig-15.exe 656 ig-16.exe 1860 ig-17.exe 5384 MBAMWsc.exe -
Loads dropped DLL 64 IoCs
Processes:
MBAMInstallerService.exeMBAMService.exembamtray.exembam.exepid process 5036 MBAMInstallerService.exe 5036 MBAMInstallerService.exe 792 MBAMService.exe 792 MBAMService.exe 792 MBAMService.exe 792 MBAMService.exe 792 MBAMService.exe 792 MBAMService.exe 792 MBAMService.exe 792 MBAMService.exe 792 MBAMService.exe 792 MBAMService.exe 792 MBAMService.exe 792 MBAMService.exe 792 MBAMService.exe 792 MBAMService.exe 792 MBAMService.exe 792 MBAMService.exe 792 MBAMService.exe 792 MBAMService.exe 792 MBAMService.exe 792 MBAMService.exe 792 MBAMService.exe 792 MBAMService.exe 792 MBAMService.exe 792 MBAMService.exe 5036 MBAMInstallerService.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 5448 mbam.exe 5448 mbam.exe 5448 mbam.exe 5448 mbam.exe -
Registers COM server for autorun 1 TTPs 64 IoCs
Processes:
MBAMService.exeMBAMService.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{278637DA-FDFB-45C7-8CD8-F2D8A9199AB0}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{11D1E5E8-14E1-4B5B-AE1A-2678CB91E8E5}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BF474111-9116-45C6-AF53-209E64F1BB53}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D372F21-E6DA-4B82-881A-79F6CA6B6AE1}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E1AC7139-D1FF-4DE9-84A4-92E2B47F5D2A}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D5599B6B-FA0C-45B5-8309-853B003EA412}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F6D29500-933C-447C-9D88-9D814AF73808}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{580243BF-3CEE-4131-A599-C6FED66BEB1B}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{580243BF-3CEE-4131-A599-C6FED66BEB1B}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{251AD013-20AD-4C3F-8FE2-F66A429B4819}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{03141A2A-5C3A-458E-ABEC-0812AD7FF497}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{278637DA-FDFB-45C7-8CD8-F2D8A9199AB0}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F36AD0D0-B5F0-4C69-AF08-603D177FEF0E}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BF474111-9116-45C6-AF53-209E64F1BB53}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E1AC7139-D1FF-4DE9-84A4-92E2B47F5D2A}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F415899A-1576-4C8B-BC9F-4854781F8A20}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D372F21-E6DA-4B82-881A-79F6CA6B6AE1}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DE03E614-112D-43E0-8E15-E7236CC32108}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{17BE78EE-B40A-4B9E-835F-38EC62F9D479}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DE03E614-112D-43E0-8E15-E7236CC32108}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57CE581A-0CB6-4266-9CA0-19364C90A0B3}\InprocServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F415899A-1576-4C8B-BC9F-4854781F8A20}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{11D1E5E8-14E1-4B5B-AE1A-2678CB91E8E5}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{130CD414-6BFD-4F6C-9362-A2264B222E76}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE8A9269-9E6E-4683-BCD3-41E9B16696DC}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{17BE78EE-B40A-4B9E-835F-38EC62F9D479}\LocalServer32 MBAMService.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{F36AD0D0-B5F0-4C69-AF08-603D177FEF0E}\LOCALSERVER32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F36AD0D0-B5F0-4C69-AF08-603D177FEF0E}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{251AD013-20AD-4C3F-8FE2-F66A429B4819}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{376BE474-56D4-4177-BB4E-5610156F36C8}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9DAB0CA5-AE19-41AE-955C-41DD44C52697}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9DAB0CA5-AE19-41AE-955C-41DD44C52697}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F415899A-1576-4C8B-BC9F-4854781F8A20}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F1C46F8-E697-4175-B240-CDE682A4BA2D}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D372F21-E6DA-4B82-881A-79F6CA6B6AE1}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE8A9269-9E6E-4683-BCD3-41E9B16696DC}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F6D29500-933C-447C-9D88-9D814AF73808}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57CE581A-0CB6-4266-9CA0-19364C90A0B3}\InprocServer32\ = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbshlext.dll" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{580243BF-3CEE-4131-A599-C6FED66BEB1B}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E1AC7139-D1FF-4DE9-84A4-92E2B47F5D2A}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D5599B6B-FA0C-45B5-8309-853B003EA412}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36A65E46-6CC1-4CA2-B51E-F4DD8C993DDC}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9DAB0CA5-AE19-41AE-955C-41DD44C52697}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BF474111-9116-45C6-AF53-209E64F1BB53}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F1C46F8-E697-4175-B240-CDE682A4BA2D}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{130CD414-6BFD-4F6C-9362-A2264B222E76}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{376BE474-56D4-4177-BB4E-5610156F36C8}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F36AD0D0-B5F0-4C69-AF08-603D177FEF0E}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F1C46F8-E697-4175-B240-CDE682A4BA2D}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{17BE78EE-B40A-4B9E-835F-38EC62F9D479}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DE03E614-112D-43E0-8E15-E7236CC32108}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{11D1E5E8-14E1-4B5B-AE1A-2678CB91E8E5}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{130CD414-6BFD-4F6C-9362-A2264B222E76}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{03141A2A-5C3A-458E-ABEC-0812AD7FF497}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36A65E46-6CC1-4CA2-B51E-F4DD8C993DDC}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57CE581A-0CB6-4266-9CA0-19364C90A0B3}\InprocServer32\ThreadingModel = "Apartment" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{251AD013-20AD-4C3F-8FE2-F66A429B4819}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE8A9269-9E6E-4683-BCD3-41E9B16696DC}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{03141A2A-5C3A-458E-ABEC-0812AD7FF497}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F6D29500-933C-447C-9D88-9D814AF73808}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{376BE474-56D4-4177-BB4E-5610156F36C8}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{278637DA-FDFB-45C7-8CD8-F2D8A9199AB0}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D5599B6B-FA0C-45B5-8309-853B003EA412}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36A65E46-6CC1-4CA2-B51E-F4DD8C993DDC}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
MBAMService.exedescription ioc process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MBAMService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MBAMService.exe -
Processes:
MBAMInstallerService.exeMBAMService.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION MBAMInstallerService.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\mbam.exe = "11000" MBAMInstallerService.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\mbamtray.exe = "11000" MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION MBAMService.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\mbam.exe = "11000" MBAMService.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\mbamtray.exe = "11000" MBAMService.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
LogonUI.exeMBAMInstallerService.exeMBAMService.exeMBAMWsc.exedescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs MBAMService.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates MBAMService.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\15.0 MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing MBAMService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Malwarebytes MBAMInstallerService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MBAMWsc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols MBAMInstallerService.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:\ MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0\Common\Security MBAMInstallerService.exe Set value (str) \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:\ MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\16.0 MBAMInstallerService.exe Set value (str) \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:\ MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Malwarebytes MBAMInstallerService.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:\ MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\16.0\Common\Security MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\16.0\Common\Security MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols MBAMInstallerService.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:\ MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates MBAMService.exe Key created \REGISTRY\USER\S-1-5-19\Software MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office MBAMInstallerService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" MBAMWsc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates MBAMService.exe Set value (str) \REGISTRY\USER\S-1-5-19\Software\Malwarebytes\FirstRun = "false" MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot MBAMService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache MBAMService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs MBAMService.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\Software MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications MBAMInstallerService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates MBAMService.exe -
Modifies registry class 64 IoCs
Processes:
MBAMService.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{61964EBA-D9C0-4834-B01C-A6133F432BB1}\TypeLib\Version = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{46AEAC9A-C091-4B63-926C-37CFBD9D244F}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B1D8E799-D5A2-45B4-9524-067144A201E4}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{83D0C30B-ECF4-40C5-80EC-21BB47F898A9} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{08927360-710B-483B-BEEC-17E51FF84AF9}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A9AE95CF-6463-415A-94AC-F895D0962D30}\ProxyStubClsid32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EAD7766B-F8F3-4944-AFE6-5D667E535709}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5709DEEB-F05E-4D5C-8DC4-3B0D924EE08F}\1.0\HELPDIR MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{10DAE713-FD88-4ADB-9406-04CB574D543C}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{55D0C28B-2BF3-4230-B48D-DB2C2D7BF6F8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C2E404A3-4E3F-4094-AE06-5E38D39B79AE}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B42C0E8E-5C9D-46B7-AAED-2294C6566DC0}\TypeLib\ = "{74630AE8-C170-4A8F-A90A-F42D63EFE1E8}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B59F38D8-23CF-4D7F-BAE8-939738B3001B}\TypeLib\ = "{2446F405-83F0-460F-B837-F04540BB330C}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CCEFCD43-B934-4168-AE51-6FE07D3D0624}\ = "_IPoliciesControllerEvents" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DE03E614-112D-43E0-8E15-E7236CC32108}\ProgID MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{993A5C11-A9B8-41E9-9088-C5182B1F279A}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D57ACF19-30E3-4B7E-BCDD-6EEB8E57AF27}\TypeLib\ = "{332AFEBA-9341-4CEC-8EA6-DB155A99DF63}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{46AEAC9A-C091-4B63-926C-37CFBD9D244F}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C367B540-CEF4-4271-8395-0C28F0FDADDA}\TypeLib\ = "{0E2822AB-0447-4F28-AF4C-FFDB1E8595AE}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E2D56B7B-4B87-45A1-A6D3-5C77035141A6}\TypeLib\ = "{49F6AC60-2104-42C6-8F71-B3916D5AA732}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E96FEF0-48F7-4ECB-B010-501044575477}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A9AE95CF-6463-415A-94AC-F895D0962D30}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1861D707-8D71-497D-8145-62D5CBF4222F}\TypeLib\ = "{5709DEEB-F05E-4D5C-8DC4-3B0D924EE08F}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DD67766C-A28D-44F3-A5D0-962965510B2D}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F12E228B-821D-4093-B2E0-7F3E169A925A}\TypeLib\ = "{A82129F1-32E1-4D79-A39F-EBFEE53A70BF}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{96C7187E-6EC4-49BD-88C7-04A3A8A97CC5}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{19E8B60E-50A1-4E29-9138-A13421D2BF7D}\TypeLib\ = "{49F6AC60-2104-42C6-8F71-B3916D5AA732}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31A02CB9-6064-4A3B-BCB4-A329528D4648}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FB81F893-5D01-4DFD-98E1-3A6CB9C3E63E}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6724C143-DE69-4A93-80ED-19B75DD2AA99}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A82129F1-32E1-4D79-A39F-EBFEE53A70BF}\1.0\HELPDIR\ = "C:\\Program Files\\Malwarebytes\\Anti-Malware" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{63A6AB57-4679-4529-B78D-143547B22799}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{09F245DA-55E7-451E-BDF3-4EE44637DFF1}\ProxyStubClsid32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{76AD4430-9C5C-4FC2-A15F-4E16ACD735AC}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3BD2053F-99D1-4C2B-8B45-635183A8F0BF}\TypeLib\Version = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2DEBAD4E-3BAF-44F0-9150-BCCCC3801CF9} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MB.TelemetryController\CurVer\ = "MB.TelemetryController.1" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6655E528-3168-47A4-BF82-A71E9E6AB5F7}\TypeLib\Version = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8FEFED84-854E-4029-A986-1D7774D4CF7D}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D81C2A20-D03D-40D4-A371-A499633A2AD3}\ = "_ICleanControllerEventsV3" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{562B1FA7-13DE-40A1-8839-AB2C5FA3129C}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BF153224-DA64-41F1-AA87-321B345870FA}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AFC6D7FD-62B9-4016-9674-53BAC603E9FC} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E90361FE-F6B5-43E8-99F7-1BD40500981F}\TypeLib\ = "{49F6AC60-2104-42C6-8F71-B3916D5AA732}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F6D29500-933C-447C-9D88-9D814AF73808}\ = "ExploitRecord Class" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BAFDF38F-72A8-4791-AACC-72EB8E09E460}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4E0F1EE6-E7CA-4BEE-8C08-0959842DA615}\TypeLib\ = "{783B187E-360F-419C-B6DA-592892764A01}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BADF77CD-ECCE-4B36-88FF-6A2804FFE307}\ProxyStubClsid32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD67766C-A28D-44F3-A5D0-962965510B2D}\ProxyStubClsid32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C9669A3D-81E8-46F6-A51E-815A0863D612} MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1917B432-C1CE-4A96-A08E-A270E00E5B23}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{964AD404-A1EF-4EDA-B8FA-1D8003B29B10}\ProxyStubClsid32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{346CF9BC-3AD5-43BA-B348-EFB88F75360F}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{25321640-5EF1-4095-A0DA-30DE19699441}\ = "ICleanControllerV11" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D88AC9B4-2BC3-4215-9547-4F05743AE67B}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7AEBAD20-B80A-427D-B7D5-D2983291132E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B32065E5-189E-4C5F-AA59-32A158BAF5B7}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F5BCAC7E-75E7-4971-B3F3-B197A510F495}\1.0\0\win64 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{66328184-6592-46BE-B950-4FDA4417DF2E}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D2D1C2BC-3427-478E-A903-ADFBCF5711CD}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5F128CCB-D86F-4998-803A-7CD58474FE2C}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{ADA09B8D-A536-4429-8331-49808442D24B}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FC60FEE4-E373-4962-B548-BA2E06119D54}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{503084FD-0743-46C7-833F-D0057E8AC505}\TypeLib MBAMService.exe -
Processes:
MBAMService.exeMBAMInstallerService.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 040000000100000010000000be954f16012122448ca8bc279602acf5140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a2030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa20f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e1900000001000000100000009f687581f7ef744ecfc12b9cee6238f12000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 MBAMService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800001900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa20f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b4040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\1C58A3A8518E8759BF075B76B750D4F2DF264FCD MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\5A8CEF45D7A69859767A8C8B4496B578CF474B1A\Blob = 0300000001000000140000005a8cef45d7a69859767a8c8b4496b578cf474b1a2000000001000000450500003082054130820329a0030201020213066c9fd29635869f0a0fe58678f85b26bb8a37300d06092a864886f70d01010c05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412032301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f74204341203230820222300d06092a864886f70d01010105000382020f003082020a0282020100ad969f2d9c4a4c4a81795199ec8acb6b605113bc4d6d06fcb0088ddd19106ac7260c35d8c06f2084e994b19b8503c35bdb4ae8c8f89076d95b4fe34ce806364dcc9aac3d0c902b92d4061960ac374479858182ad5a37e00dcc9da64c5276ea439db704d150f655e0d5d2a64985e937e9ca7eae5c954d489a3fae205a6d8895d934b8521a4390b0bf6c05b9b678b7ead0e43a3c125362ff4af27bbe3505a91234e3f36474622c3d00495a28fe3244bb87dd652702713bda4af71fdacdf72155904f0fecae82e19f6bd945d3bbf05f87ed3c2c3986da3fdeec7255eb79a3addbdd7cb0ba1ccefcde4f3576cf0ff8781f6a36514627615be99ecff0a2557d7c258a6f2fb4c5cf842e2bfd0d51106cfb5f1bbc1b7ec5ae3b98013192ff0b57f49ab2b957e9abef0d76d1f0eef4ce86a7e06ee9b469a1df69f633c6692e97139ea587b057108137c953b3bb7ff692d19cd018f4926eda834fa663994ca5fb5eef21647a205f6c648515cb37e9620c0b2a16dc012e32da3e4bf59e3af6174094ef9e910886fabe63a85a33eccb744395f96c695236c7296ffc55035c1ffb9fbd47ebe74947950b4e89220949e0f5611ef1bf2e8a726e8059ff573af97532a34e5feced2862d94d73f2cc811760edcdebdcdba7cac57e02bdf2540854fdb42d092c17544a98d154e1516708d2ed6e7e6f3fd22d81592966cb903995111e7427feddebaf0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414b00cf04c30f405580248fd33e552af4b84e36652300d06092a864886f70d01010c05000382020100aaa8808f0e78a3e0a2d4cde6f5987a3bea0003b0970e93bc5aa8f62c8c7287a9b1fc7f73fd637178a58759cf30e10d10b2135a6d82f56ae6809fa0050b68e4476bc76adfb6fd773272e518fa09f4a0932c5dd28c75857665900c0379b7312363ad788309866884cafff9cf269a9279e7cd4bc5e761a717cbf3a91293936ba7e82f5392c46058b0cc0251185b858d625963b6adb4de9afb26f70027c05d55377499c9507fe3592e44e32c25eeec4c3277b49f1ae94b5d20c5dafd1c8716c643e8d4bb269a45705ea90b3753e2467b27fde046f289b7cc42b6cb28266ed9a5c93ac8411360f7508c15aeb26d1a151a5778e6922ad96590823f6c02afae123a27963604d71da28063a99bf1e5bab47c14b04ec9b11f745f38f651ea9bfa2ca211d4a92d271a45b1afb24e710dc05846d66906cb53cbb3fe6b41cd417e7d4c0f7c72797a59cd5e4a0eac9ba99873797cb4f4ccb9b8070cb2745cb8c76f88a190a7f4aaf9bf673af41a15621eb79fbe3db129af67a112f25810195303301bb81a89f69cbd97038ea309f31d8b21f1b4dfe41cd19f650206ea5cd613b384efa2a55c8c7729a768c06bae40d2a8b4eacdf08d4b389c199a1b2854b88990efca75813e1ef26424c718af4eff479e07f63565a4d30a56fff517646cefa822254993b6df0017da587e5deec51bb0d1d15f2110c7f9f3ba020a2707c5f1d6c7d3e0fb09606c MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\2AD974A775F73CBDBBD8F5AC3A49255FA8FB1F8C\Blob = 0300000001000000140000002ad974a775f73cbdbbd8f5ac3a49255fa8fb1f8c2000000001000000620400003082045e30820346a0030201020213077312380b9d6688a33b1ed9bf9ccda68e0e0f300d06092a864886f70d01010b05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412031301e170d3232303832333232323132385a170d3330303832333232323132385a303c310b3009060355040613025553310f300d060355040a1306416d617a6f6e311c301a06035504031313416d617a6f6e205253412032303438204d303130820122300d06092a864886f70d01010105000382010f003082010a0282010100eb712ca9cb1f8828923230af8a570f78b73725955587ac675c97d322c8daa214676b7cf067dae2032ab356125dc6b547f96708a7937a9592180fb4f9f910369a7f2f80b64fba134ec75d531ee0dd96330720d396bc12e4745042a1051373b54f9b4424fe2d7fedbc2285ec362133977506ce271882dce3d9c582078d5e26012626671fd93f13cf32ba6bad7864fcaaff0e023c07df9c0578728cfdea75b7032884dae86e078cd05085ef8154b2716eec6d62ef8f94c35ee9c4a4d091c02e249198caeeba258ed4f671b6fb5b6b38064837478d86dcf2ea06fb76377d9eff424e4d588293cfe271c278b17aab4b5b94378881e4d9af24aef872c565fb4bb451e70203010001a382015a3082015630120603551d130101ff040830060101ff020100300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030106082b06010505070302301d0603551d0e0416041481b80e638a891218e5fa3b3b50959fe6e5901385301f0603551d230418301680148418cc8534ecbc0c94942e08599cc7b2104e0a08307b06082b06010505070101046f306d302f06082b060105050730018623687474703a2f2f6f6373702e726f6f746361312e616d617a6f6e74727573742e636f6d303a06082b06010505073002862e687474703a2f2f6372742e726f6f746361312e616d617a6f6e74727573742e636f6d2f726f6f746361312e636572303f0603551d1f043830363034a032a030862e687474703a2f2f63726c2e726f6f746361312e616d617a6f6e74727573742e636f6d2f726f6f746361312e63726c30130603551d20040c300a3008060667810c010201300d06092a864886f70d01010b05000382010100ad00de0205232e063262b46bb19416e41140de2bfa59c135efe0aa8f2b41b9d1f38739001df23db5a7470c0606c691f3075702d4edbd17c1909abf4875a2074f30dd4a6a42b50d3d15c00ffe845bc63c99cc5752b1d86e12d59692934b94e507e88982086a7a34d49e64e13d876a92909a63a14bf88fb6ea34d305be20c2de06e28c9f738b9f4d3985cace19369d85c99ec9f8503fb67e88a1efca84068b50b40a5ca61c44f1fdc8614060f26125aa07f4c7c27375e40c0b428d04e55f4448995b7b898196a7889d4b0d62e804c4d7feb4e8b26dcaecc01cbc385b1ddf85ce5b7ae3494b6cb9a7ddf405b249ade1c5146bc2ccebcd7fd65869bac3207e7fb0b8 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E\Blob = 030000000100000014000000b51c067cee2b0c3df855ab2d92f4fe39d4e70f0e2000000001000000e1030000308203dd308202c5a003020102020100300d06092a864886f70d01010b050030818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a30818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bdedc103fcf68ffc02b16f5b9f48d99d79e2a2b703615618c347b6d7ca3d352e8943f7a1699bde8a1afd13209cb44977322956fdb9ec8cdd22fa72dc276197eef65a84ec6e19b9892cdc845bd574fb6b5fc589a51052894655f4b8751ce67fe454ae4bf85572570219f8177159eb1e280774c59d48be6cb4f4a4b0f364377992c0ec465e7fe16d534c62afcd1f0b63bb3a9dfbfc7900986174cf26824063f3b2726a190d99cad40e75cc37fb8b89c159f1627f5fb35f6530f8a7b74d765a1e765e34c0e89656998ab3f07fa4cdbddc32317c91cfe05f11f86baa495cd19994d1a2e3635b0976b55662e14b741d96d426d4080459d0980e0ee6defcc3ec1f90f10203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147c0c321fa7d9307fc47d68a362a8a1ceab075b27300d06092a864886f70d01010b050003820101001159fa254f036f94993b9a1f828539d47605945ee128936d625d09c2a0a8d4b07538f1346a9de49f8a862651e62cd1c62d6e95204a9201ecb88a677b31e2672e8c9503262e439d4a31f60eb50cbbb7e2377f22ba00a30e7b52fb6bbb3bc4d379514ecd90f4670719c83c467a0d017dc558e76de68530179a24c410e004f7e0f27fd4aa0aff421d37ed94e5645912207738d3323e3881759673fa688fb1cbce1fc5ecfa9c7ecf7eb1f1072db6fcbfcaa4bfd097054abcea18280290bd5478092171d3d17d1dd916b0a9613dd00a0022fcc77bcb0964450b3b4081f77d7c32f598ca588e7d2aee90597364f936745e25a1f566052e7f3915a92afb508b8e8569f4 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8DA7F965EC5EFC37910F1C6E59FDC1CC6A6EDE16 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0D44DD8C3C8C1A1A58756481E90F2E2AFFB3D26E MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F6108407D6F8BB67980CC2E244C2EBAE1CEF63BE\Blob = 030000000100000014000000f6108407d6f8bb67980cc2e244c2ebae1cef63be2000000001000000f6010000308201f230820178a0030201020213066c9fd7c1bb104c2943e5717b7b2cc81ac10e300a06082a8648ce3d0403033039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412034301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f7420434120343076301006072a8648ce3d020106052b8104002203620004d2ab8a374fa3530dfec18a7b4ba87b464b63b062f62d1bdb087121d200e863bd9a27fbf0396e5dea3da5c981aaa35b2098455d16dbfde8106de39ce0e3bd5f8462f3706433a0cb242f70ba88a12aa075f881ae6206c481db396e29b01efa2e5ca3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414d3ecc73a656ecce1da769a56fb9cf3866d57e581300a06082a8648ce3d040303036800306502303a8b21f1bd7e11add0ef58962fd6eb9d7e908d2bcf6655c32ce328a9700a470ef0375912ff2d9994284e2a4f354d335a023100ea75004e3bc43a941291c958469d211372a7889c8ae44c4adb96d4ac8b6b6b49125333add7e4be24fcb50a76d4a5bc10 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\2AD974A775F73CBDBBD8F5AC3A49255FA8FB1F8C MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2 MBAMService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 5c0000000100000004000000001000001900000001000000100000009f687581f7ef744ecfc12b9cee6238f10f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa2140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a2040000000100000010000000be954f16012122448ca8bc279602acf52000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d0140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b4030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3490f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d578112861900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e MBAMService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8DA7F965EC5EFC37910F1C6E59FDC1CC6A6EDE16\Blob = 0300000001000000140000008da7f965ec5efc37910f1c6e59fdc1cc6a6ede162000000001000000450300003082034130820229a0030201020213066c9fcf99bf8c0a39e2f0788a43e696365bca300d06092a864886f70d01010b05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412031301e170d3135303532363030303030305a170d3338303131373030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f74204341203130820122300d06092a864886f70d01010105000382010f003082010a0282010100b2788071ca78d5e371af478050747d6ed8d78876f49968f7582160f97484012fac022d86d3a0437a4eb2a4d036ba01be8ddb48c80717364cf4ee8823c73eeb37f5b519f84968b0ded7b976381d619ea4fe8236a5e54a56e445e1f9fdb416fa74da9c9b35392ffab02050066c7ad080b2a6f9afec47198f503807dca2873958f8bad5a9f948673096ee94785e6f89a351c0308666a14566ba54eba3c391f948dcffd1e8302d7d2d747035d78824f79ec4596ebb738717f2324628b843fab71daacab4f29f240e2d4bf7715c5e69ffea9502cb388aae50386fdbfb2d621bc5c71e54e177e067c80f9c8723d63f40207f2080c4804c3e3b24268e04ae6c9ac8aa0d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604148418cc8534ecbc0c94942e08599cc7b2104e0a08300d06092a864886f70d01010b0500038201010098f2375a4190a11ac57651282036230eaee628bbaaf894ae48a4307f1bfc248d4bb4c8a197f6b6f17a70c85393cc0828e39825cf23a4f9de21d37c8509ad4e9a753ac20b6a897876444718656c8d418e3b7f9acbf4b5a750d7052c37e8034bade961a0026ef5f2f0c5b2ed5bb7dcfa945c779e13a57f52ad95f2f8933bde8b5c5bca5a525b60af14f74befa3fb9f40956d3154fc42d3c7461f23add90f48709ad9757871d1724334756e5759c2025c266029cf2319168e8843a5d4e4cb08fb231143e843297262a1a95d5e08d490aeb8d8ce14c2d055f286f6c49343776661c0b9e841d7977860036e4a72aea5d17dba109e866c1b8ab95933f8ebc490bef1b9 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\5A8CEF45D7A69859767A8C8B4496B578CF474B1A MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0D44DD8C3C8C1A1A58756481E90F2E2AFFB3D26E\Blob = 0300000001000000140000000d44dd8c3c8c1a1a58756481e90f2e2affb3d26e2000000001000000ba010000308201b63082015ba0030201020213066c9fd5749736663f3b0b9ad9e89e7603f24a300a06082a8648ce3d0403023039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412033301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f7420434120333059301306072a8648ce3d020106082a8648ce3d030107034200042997a7c6417fc00d9be8011b56c6f252a5ba2db212e8d22ed7fac9c5d8aa6d1f73813b3b986b397c33a5c54e868e8017686245577d44581db337e56708eb66dea3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414abb6dbd7069e37ac3086079170c79cc419b178c0300a06082a8648ce3d0403020349003046022100e08592a317b78df92b06a593ac1a98686172fae1a1d0fb1c7860a64399c5b8c40221009c02eff1949cb396f9ebc62af8b62cfe3a901416d78c6324481cdf307dd5683b MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F6108407D6F8BB67980CC2E244C2EBAE1CEF63BE MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\1C58A3A8518E8759BF075B76B750D4F2DF264FCD\Blob = 0300000001000000140000001c58a3a8518e8759bf075b76b750d4f2df264fcd2000000001000000c2040000308204be308203a6a003020102021006d8d904d5584346f68a2fa754227ec4300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3231303431343030303030305a170d3331303431333233353935395a304f310b300906035504061302555331153013060355040a130c446967694365727420496e633129302706035504031320446967694365727420544c53205253412053484132353620323032302043413130820122300d06092a864886f70d01010105000382010f003082010a0282010100c14bb3654770bcdd4f58dbec9cedc366e51f311354ad4a66461f2c0aec6407e52edcdcb90a20eddfe3c4d09e9aa97a1d8288e51156db1e9f58c251e72c340d2ed292e156cbf1795fb3bb87ca25037b9a52416610604f571349f0e8376783dfe7d34b674c2251a6df0e9910ed57517426e27dc7ca622e131b7f238825536fc13458008b84fff8bea75849227b96ada2889b15bca07cdfe951a8d5b0ed37e236b4824b62b5499aecc767d6e33ef5e3d6125e44f1bf71427d58840380b18101faf9ca32bbb48e278727c52b74d4a8d697dec364f9cace53a256bc78178e490329aefb494fa415b9cef25c19576d6b79a72ba2272013b5d03d40d321300793ea99f50203010001a38201823082017e30120603551d130101ff040830060101ff020100301d0603551d0e04160414b76ba2eaa8aa848c79eab4da0f98b2c59576b9f4301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030106082b06010505070302307606082b06010505070101046a3068302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304006082b060105050730028634687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274476c6f62616c526f6f7443412e63727430420603551d1f043b30393037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274476c6f62616c526f6f7443412e63726c303d0603551d2004363034300b06096086480186fd6c02013007060567810c01013008060667810c0102013008060667810c0102023008060667810c010203300d06092a864886f70d01010b050003820101008032ce5e0bdd6e5a0d0aafe1d684cbc08efa8570edda5db30cf72b7540fe850afaf33178b7704b1a8958ba80bdf36b1de97ecf0bba589c59d490d3fd6cfdd0986db771825bcf6d0b5a09d07bdec443d82aa4de9e41265fbb8f99cbddaee1a86f9f87fe74b71f1b20abb14fc6f5675d5d9b3ce9ff69f7616cd6d9f3fd36c6ab038876d24b2e7586e3fcd8557d26c21177df3e02b67cf3ab7b7a86366fb8f7d89371cf86df7330fa7babed2a59c842843b11171a52f3c90e147da25b7267ba71ed574766c5b8024a65345e8bd02a3c209c51994ce7529ef76b112b0d927e1de88aeb36164387ea2a63bf753febdec403bb0a3cf730efebaf4cfc8b3610733ef3a4 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 MBAMService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa22000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 MBAMInstallerService.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
mbamtray.exembam.exepid process 3516 mbamtray.exe 5448 mbam.exe -
Suspicious behavior: EnumeratesProcesses 42 IoCs
Processes:
MBSetup.exeMBAMInstallerService.exeMBAMService.exembamtray.exembam.exepid process 4672 MBSetup.exe 4672 MBSetup.exe 5036 MBAMInstallerService.exe 5036 MBAMInstallerService.exe 5036 MBAMInstallerService.exe 5036 MBAMInstallerService.exe 5036 MBAMInstallerService.exe 5036 MBAMInstallerService.exe 5036 MBAMInstallerService.exe 5036 MBAMInstallerService.exe 5036 MBAMInstallerService.exe 5036 MBAMInstallerService.exe 792 MBAMService.exe 792 MBAMService.exe 792 MBAMService.exe 792 MBAMService.exe 792 MBAMService.exe 792 MBAMService.exe 792 MBAMService.exe 792 MBAMService.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 792 MBAMService.exe 792 MBAMService.exe 792 MBAMService.exe 792 MBAMService.exe 5448 mbam.exe 5448 mbam.exe 5448 mbam.exe 5448 mbam.exe 792 MBAMService.exe 792 MBAMService.exe 792 MBAMService.exe 792 MBAMService.exe 3516 mbamtray.exe 3516 mbamtray.exe 792 MBAMService.exe 792 MBAMService.exe 3516 mbamtray.exe 3516 mbamtray.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
mbam.exepid process 5448 mbam.exe -
Suspicious behavior: LoadsDriver 10 IoCs
Processes:
pid process 632 632 632 632 632 632 632 632 632 632 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
MBAMService.exeMBAMService.exedescription pid process Token: 33 2768 MBAMService.exe Token: SeIncBasePriorityPrivilege 2768 MBAMService.exe Token: 33 792 MBAMService.exe Token: SeIncBasePriorityPrivilege 792 MBAMService.exe Token: SeBackupPrivilege 792 MBAMService.exe Token: SeRestorePrivilege 792 MBAMService.exe Token: SeTakeOwnershipPrivilege 792 MBAMService.exe Token: SeBackupPrivilege 792 MBAMService.exe Token: SeRestorePrivilege 792 MBAMService.exe Token: SeBackupPrivilege 792 MBAMService.exe Token: SeRestorePrivilege 792 MBAMService.exe Token: SeBackupPrivilege 792 MBAMService.exe Token: SeRestorePrivilege 792 MBAMService.exe Token: SeBackupPrivilege 792 MBAMService.exe Token: SeRestorePrivilege 792 MBAMService.exe Token: SeBackupPrivilege 792 MBAMService.exe Token: SeRestorePrivilege 792 MBAMService.exe Token: SeBackupPrivilege 792 MBAMService.exe Token: SeRestorePrivilege 792 MBAMService.exe Token: SeBackupPrivilege 792 MBAMService.exe Token: SeRestorePrivilege 792 MBAMService.exe Token: SeBackupPrivilege 792 MBAMService.exe Token: SeRestorePrivilege 792 MBAMService.exe Token: SeBackupPrivilege 792 MBAMService.exe Token: SeRestorePrivilege 792 MBAMService.exe Token: SeBackupPrivilege 792 MBAMService.exe Token: SeRestorePrivilege 792 MBAMService.exe Token: SeBackupPrivilege 792 MBAMService.exe Token: SeRestorePrivilege 792 MBAMService.exe Token: SeBackupPrivilege 792 MBAMService.exe Token: SeRestorePrivilege 792 MBAMService.exe Token: SeBackupPrivilege 792 MBAMService.exe Token: SeRestorePrivilege 792 MBAMService.exe Token: SeBackupPrivilege 792 MBAMService.exe Token: SeRestorePrivilege 792 MBAMService.exe Token: SeBackupPrivilege 792 MBAMService.exe Token: SeRestorePrivilege 792 MBAMService.exe Token: SeBackupPrivilege 792 MBAMService.exe Token: SeRestorePrivilege 792 MBAMService.exe Token: SeBackupPrivilege 792 MBAMService.exe Token: SeRestorePrivilege 792 MBAMService.exe Token: SeBackupPrivilege 792 MBAMService.exe Token: SeRestorePrivilege 792 MBAMService.exe Token: SeBackupPrivilege 792 MBAMService.exe Token: SeRestorePrivilege 792 MBAMService.exe Token: SeBackupPrivilege 792 MBAMService.exe Token: SeRestorePrivilege 792 MBAMService.exe Token: SeBackupPrivilege 792 MBAMService.exe Token: SeRestorePrivilege 792 MBAMService.exe Token: SeBackupPrivilege 792 MBAMService.exe Token: SeRestorePrivilege 792 MBAMService.exe Token: SeBackupPrivilege 792 MBAMService.exe Token: SeRestorePrivilege 792 MBAMService.exe Token: SeBackupPrivilege 792 MBAMService.exe Token: SeRestorePrivilege 792 MBAMService.exe Token: SeBackupPrivilege 792 MBAMService.exe Token: SeRestorePrivilege 792 MBAMService.exe Token: SeBackupPrivilege 792 MBAMService.exe Token: SeRestorePrivilege 792 MBAMService.exe Token: SeBackupPrivilege 792 MBAMService.exe Token: SeRestorePrivilege 792 MBAMService.exe Token: SeBackupPrivilege 792 MBAMService.exe Token: SeRestorePrivilege 792 MBAMService.exe Token: SeBackupPrivilege 792 MBAMService.exe -
Suspicious use of FindShellTrayWindow 36 IoCs
Processes:
MBSetup.exembamtray.exembam.exepid process 4672 MBSetup.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 5448 mbam.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe -
Suspicious use of SendNotifyMessage 29 IoCs
Processes:
mbamtray.exepid process 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe 3516 mbamtray.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
LogonUI.exepid process 5040 LogonUI.exe -
Suspicious use of WriteProcessMemory 63 IoCs
Processes:
MBAMInstallerService.exeMBAMService.exeMBSetup.exedescription pid process target process PID 5036 wrote to memory of 2768 5036 MBAMInstallerService.exe MBAMService.exe PID 5036 wrote to memory of 2768 5036 MBAMInstallerService.exe MBAMService.exe PID 792 wrote to memory of 3516 792 MBAMService.exe mbamtray.exe PID 792 wrote to memory of 3516 792 MBAMService.exe mbamtray.exe PID 4672 wrote to memory of 5448 4672 MBSetup.exe mbam.exe PID 4672 wrote to memory of 5448 4672 MBSetup.exe mbam.exe PID 792 wrote to memory of 5796 792 MBAMService.exe ig.exe PID 792 wrote to memory of 5796 792 MBAMService.exe ig.exe PID 792 wrote to memory of 5796 792 MBAMService.exe ig.exe PID 792 wrote to memory of 5820 792 MBAMService.exe ig-0.exe PID 792 wrote to memory of 5820 792 MBAMService.exe ig-0.exe PID 792 wrote to memory of 5820 792 MBAMService.exe ig-0.exe PID 792 wrote to memory of 5884 792 MBAMService.exe ig-1.exe PID 792 wrote to memory of 5884 792 MBAMService.exe ig-1.exe PID 792 wrote to memory of 5884 792 MBAMService.exe ig-1.exe PID 792 wrote to memory of 5520 792 MBAMService.exe ig-2.exe PID 792 wrote to memory of 5520 792 MBAMService.exe ig-2.exe PID 792 wrote to memory of 5520 792 MBAMService.exe ig-2.exe PID 792 wrote to memory of 704 792 MBAMService.exe ig-3.exe PID 792 wrote to memory of 704 792 MBAMService.exe ig-3.exe PID 792 wrote to memory of 704 792 MBAMService.exe ig-3.exe PID 792 wrote to memory of 4384 792 MBAMService.exe ig-4.exe PID 792 wrote to memory of 4384 792 MBAMService.exe ig-4.exe PID 792 wrote to memory of 4384 792 MBAMService.exe ig-4.exe PID 792 wrote to memory of 380 792 MBAMService.exe ig-5.exe PID 792 wrote to memory of 380 792 MBAMService.exe ig-5.exe PID 792 wrote to memory of 380 792 MBAMService.exe ig-5.exe PID 792 wrote to memory of 4940 792 MBAMService.exe ig-6.exe PID 792 wrote to memory of 4940 792 MBAMService.exe ig-6.exe PID 792 wrote to memory of 4940 792 MBAMService.exe ig-6.exe PID 792 wrote to memory of 3956 792 MBAMService.exe ig-7.exe PID 792 wrote to memory of 3956 792 MBAMService.exe ig-7.exe PID 792 wrote to memory of 3956 792 MBAMService.exe ig-7.exe PID 792 wrote to memory of 6068 792 MBAMService.exe ig-8.exe PID 792 wrote to memory of 6068 792 MBAMService.exe ig-8.exe PID 792 wrote to memory of 6068 792 MBAMService.exe ig-8.exe PID 792 wrote to memory of 6128 792 MBAMService.exe ig-9.exe PID 792 wrote to memory of 6128 792 MBAMService.exe ig-9.exe PID 792 wrote to memory of 6128 792 MBAMService.exe ig-9.exe PID 792 wrote to memory of 2508 792 MBAMService.exe ig-10.exe PID 792 wrote to memory of 2508 792 MBAMService.exe ig-10.exe PID 792 wrote to memory of 2508 792 MBAMService.exe ig-10.exe PID 792 wrote to memory of 4680 792 MBAMService.exe ig-11.exe PID 792 wrote to memory of 4680 792 MBAMService.exe ig-11.exe PID 792 wrote to memory of 4680 792 MBAMService.exe ig-11.exe PID 792 wrote to memory of 3640 792 MBAMService.exe ig-12.exe PID 792 wrote to memory of 3640 792 MBAMService.exe ig-12.exe PID 792 wrote to memory of 3640 792 MBAMService.exe ig-12.exe PID 792 wrote to memory of 3452 792 MBAMService.exe ig-13.exe PID 792 wrote to memory of 3452 792 MBAMService.exe ig-13.exe PID 792 wrote to memory of 3452 792 MBAMService.exe ig-13.exe PID 792 wrote to memory of 828 792 MBAMService.exe ig-14.exe PID 792 wrote to memory of 828 792 MBAMService.exe ig-14.exe PID 792 wrote to memory of 828 792 MBAMService.exe ig-14.exe PID 792 wrote to memory of 2336 792 MBAMService.exe ig-15.exe PID 792 wrote to memory of 2336 792 MBAMService.exe ig-15.exe PID 792 wrote to memory of 2336 792 MBAMService.exe ig-15.exe PID 792 wrote to memory of 656 792 MBAMService.exe ig-16.exe PID 792 wrote to memory of 656 792 MBAMService.exe ig-16.exe PID 792 wrote to memory of 656 792 MBAMService.exe ig-16.exe PID 792 wrote to memory of 1860 792 MBAMService.exe ig-17.exe PID 792 wrote to memory of 1860 792 MBAMService.exe ig-17.exe PID 792 wrote to memory of 1860 792 MBAMService.exe ig-17.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3332
-
C:\Users\Admin\AppData\Local\Temp\MBSetup.exe"C:\Users\Admin\AppData\Local\Temp\MBSetup.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Checks BIOS information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe"C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:5448
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"1⤵
- Drops file in Drivers directory
- Enumerates connected drives
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe" /Service /Protected2⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Windows directory
- Executes dropped EXE
- Registers COM server for autorun
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2768
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Checks BIOS information in registry
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:792 -
C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe"C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3516 -
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:5796 -
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-0.exeig.exe reseed2⤵
- Executes dropped EXE
PID:5820 -
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-1.exeig.exe reseed2⤵
- Executes dropped EXE
PID:5884 -
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-2.exeig.exe reseed2⤵
- Executes dropped EXE
PID:5520 -
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-3.exeig.exe reseed2⤵
- Executes dropped EXE
PID:704 -
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-4.exeig.exe reseed2⤵
- Executes dropped EXE
PID:4384 -
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-5.exeig.exe reseed2⤵
- Executes dropped EXE
PID:380 -
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-6.exeig.exe reseed2⤵
- Executes dropped EXE
PID:4940 -
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-7.exeig.exe reseed2⤵
- Executes dropped EXE
PID:3956 -
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-8.exeig.exe reseed2⤵
- Executes dropped EXE
PID:6068 -
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-9.exeig.exe reseed2⤵
- Executes dropped EXE
PID:6128 -
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-10.exeig.exe reseed2⤵
- Executes dropped EXE
PID:2508 -
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-11.exeig.exe reseed2⤵
- Executes dropped EXE
PID:4680 -
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-12.exeig.exe reseed2⤵
- Executes dropped EXE
PID:3640 -
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-13.exeig.exe reseed2⤵
- Executes dropped EXE
PID:3452 -
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-14.exeig.exe reseed2⤵
- Executes dropped EXE
PID:828 -
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-15.exeig.exe reseed2⤵
- Executes dropped EXE
PID:2336 -
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-16.exeig.exe reseed2⤵
- Executes dropped EXE
PID:656 -
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-17.exeig.exe reseed2⤵
- Executes dropped EXE
PID:1860 -
C:\Program Files\Malwarebytes\Anti-Malware\MBAMWsc.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMWsc.exe" /wac 0 /status off true /updatesubstatus none /scansubstatus recommended /settingssubstatus none2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:5384
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2ec1⤵PID:5908
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x0 /state0:0xa3af0055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5040
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Defense Evasion
Modify Registry
3Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\7z.dllFilesize
1.7MB
MD5461faf68ccc02b0223fd273b630f21fe
SHA1363b8beaa74f0f454c2d544ace9e71a84bc2b4cf
SHA256cb07f3f461e9c267831b1ab93af6dfda1bb51d72e42d73d00d26594f09326be1
SHA5124b671f48e45fdedf50c7f7bb6c8d82a3b98f7502006eb002aaf8ff31f25f9ff1257c7bcc12caf622e43d4ec665b19d978ae3e3762f76def0bc71485ebdb8426f
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\Actions.dllFilesize
5.0MB
MD51eff53d95ecaf6bbfffe80d866d8e1dd
SHA1d7ef7d7c77fd04b2c0eb8c16bb3cd08057f6742f
SHA2566dd748f7ca56125cbe158fa3612f08e7312ef58ad5375e6b7ab5532cc16ca0ac
SHA512c59b8e6f0b238a247e64b9c7bb42213dadac1dada63542830a6292361174c935c0c662b2d1aed3fb6100cc4993297b1eaf25e328f2b4613458c4ffca63b9f02d
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ActionsShim.dllFilesize
2.5MB
MD558149edf4990067b4c1ffe1c32a51a01
SHA180c0c8b8def45420159659d2eaad181eb0b05c40
SHA25667af73f9b49ce113d02d7f2824e45d48044273772c94e6e8c300cf86bf83cb55
SHA512fe69f4eccaa35b132b7dfc77fae50733398cfa5ab7377f502a50e1bb83be6b81fad26a0a24f6dfbc99dca6e118784f3452edc4a30c11ac161fc0db62b039cb4e
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\BrowserSDKDLL.dllFilesize
5.8MB
MD51ed53171d00f440f29a12f9beb84dac4
SHA14d9a1e3579b0999f1ab2fa818b588411e9ee920c
SHA256e659e687a872050f9e65d78992d16bd9b393cf3f8e8c94e0e15fb42b7065327e
SHA51217161cfc672d1b996b8af4ebac17f9a8a3807f38c9a23e2e5b4dadcd9a21c3a64faec9bf59147022a9df88b80f89300f1b537091289bd7a42806bd206a317e6e
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\BrowserSDKDLLShim.dllFilesize
2.5MB
MD52e8ad6f405eb7744908f635dc089438a
SHA1f2ca3f55ce4395dfe39a0ba099a39f8c30e263cb
SHA2564824ad6b30b42a9166bfd3db41f11e3cb67e7aab96058b7f946797d7dadba891
SHA5123eacea19caf3f04cddb35091102c5d627b82acc8c73be1bfa4d72932c78cba7821c99c616bbd8d422ce588b865700db560ba441f8a5da6a9629af844f6ad28c5
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\CleanControllerImpl.dllFilesize
6.9MB
MD573a08c403bf08e39bd560ffc74ae9b8f
SHA1888c6d11e6788875f8fca748b6f92a19b6126dc6
SHA25609d687c0164a9f108c4f9e107bfc0cb671ebe643ac9aae968cb8df0e5adda960
SHA5128b65c0549c319e9c42b30071b1342e8ba4239d9dc4a124e19abd2160339c03235f0ec534a997ec367f2b474797d33efa496e641c7a63904bf8e0af43a32f1535
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\CloudControllerImpl.dllFilesize
4.8MB
MD5d739c6bd5d5cae2ae961a0c2d40eb5b1
SHA116d0d40707bf55f04a0da70798b5368e612fd5e6
SHA25625472857a59a9067c1224b173b378448bb574f5365edbe4a1a46df8810007f9a
SHA5127d80a39f3a91e0faa87ae8143f43d2e8947eaedfd317a1ac1547dfa15b825cc5c200f8baebe127a0bc2379fe90c40f3ea25db09c06b521aad1c189ce24a53c7d
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\LicenseControllerImpl.dllFilesize
4.4MB
MD565e42cbe095830d9d93ecabb13392780
SHA1e60110e159cc4cc92d2606ae3ba3559c10170e5a
SHA256a773e1706bbb6e8cb522d0e1a3d29e496bcbe6a91e221c26bea98292b9316f7f
SHA5126b25cebb6433ec87831a3f0f67b96c7fc37a617158a18d9ac20bd375f46c97da8a41e4379da72808fdd7947705c6c09518c56152f96eebf2bcefb39ffa6202ed
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\MBAMCore.dllFilesize
6.4MB
MD59db84546ec6408e2eb7c8711df562ad5
SHA1b408a7f0c28b8ef20b1021f3211c7495b7fe9171
SHA256238162c0adab6a1611b428726c5d0b5830b553a9677bee986fc29522563e441e
SHA512a5fdf28b82a16bb512061ebc9cc128e9efdeb3bfcfe50a4c88c2256abe5c5b10f8d237d4ab7788e5eca3dccc9d20251c4ebe8a80856f7a3174d95b24d2c3c6ba
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\MBAMShim.dllFilesize
3.0MB
MD5f44b6c80c46c4cf3071b5f5b916e1271
SHA1839f2238ecbbfa80ebf9c1f77eafc78204b58761
SHA256732523df43358729d5e85cceb557d69016dcdd3e2238d903c33c5327c3131fae
SHA51299be164ae96bc4f93dc896d5df445ad1c2f023f10605a8c9857d7ebedfc5b070f50cd33b401d61003e601a06b8446e6c0b5dbddda4927a2e1352407d3b266942
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\PoliciesControllerImpl.dllFilesize
4.0MB
MD5efe6216931bca54ccf05a0bcb9f83fb9
SHA1007d0a3c4d850cd9b2886b24daf91c988d702bdd
SHA256eaf71519b965b9530e84be08bd3649fdb8feeeabb8dd2455be95755a336a44d6
SHA5127c59071b6ae8d0a2d6eedcb58f6a1337aa340275bf30baa121f515241aba822f6f7bbbc53b626f5f44c424af70aef3afc582a1a8a34d0b0adef115d0e8f684f4
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ScanControllerImpl.dllFilesize
5.7MB
MD5e80262b787eec69e8dd3d051a1d2840c
SHA1bbb88d699a7715d800db88679d6f7d52bf16673e
SHA256a07dbc4cc18dea7c29ea1e32c1511e846bd06ca86229b0499cbe20575937395f
SHA51216f8abc1cb48d8e7786a8add362987b0a464e0082c2bdce5ad42ed52cea1ad64cc117dc80127b5666f26d777701b1b81c178a87301be6394e8f17e5370f68789
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\Swissarmy.dllFilesize
4.0MB
MD53486801ce1e8ffc1bbc6d4f097b0f369
SHA108f2a85cd07cf1c0d6f27f0d5e7179c2a5cb8600
SHA25626720d0b669898089a4ab5a6c53203918ec399d227331273ba11169bbe273678
SHA51281974a79bf4e4086549874ef778e7716713a0107ccce212e9564f3355a26670943845aaba744691d2b68224e06e2f9d9a263e29f4ca7e46e1bfdb507a24656d5
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\SwissarmyShim.dllFilesize
2.6MB
MD589a38afcfa758e3298609c6c51929593
SHA12df1ee30adc92bd995526e41fd9c823354de30b4
SHA2564795576483af0c136a71dcee87a0ffb54f0869cae6395ac2ff8312bf555e7161
SHA512cceaed0b9a7517aebd739a377c7bd8987b9ac357be2bf987dbae31d59f2121c5bb9a9bfa2c70a9a54ad65546ef23903176dd6328d93408cb5c991257d59e2717
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\TelemetryControllerImpl.dllFilesize
5.3MB
MD51692937ebb8172814cfd1b2d20dac8c6
SHA13ad3b0dce9958ce66d89c280645ae827d3b89f16
SHA256f1cee1b89fff12181d828623b3aba0f0b8c0aed4aab8b0c017ea4d4731c16e32
SHA512a36462731990635f57f80c070cb01a8c4fe6fa445aad63f077197d473d0d625e23bcadaf5bf92c9504919ee69d12239a7733febf27d6016aa20c03f631b7e3e8
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\UpdateControllerImpl.dllFilesize
4.4MB
MD52114b71049bc4626a565fa7bef9ba37c
SHA1ca5567bd58897128a750be7db94357253321db0d
SHA256e981f1d6fdd820ad2781f0cbdc3b0715101de3257c1aab23af806f0a547dfb9e
SHA5129f97a9fdfd54072730aed98948f7b46c9667cadddc87bebb8d275b94708f11c24e618a0d169366f57b959db16e0b841e5539f5325611a4d19d3bd978a2c03427
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeFilesize
1.8MB
MD5d5805286cda5b56039dd2a2d936d4be0
SHA164ba00ec017bbb0d5c9ca4c4ce157808e76c8045
SHA256e6f775537b67e3dd2afcd8700a2a4b75632f14e5a276b1ccfe859996d8bc4850
SHA5124d7575e45eb8a554a38df752ba0653d96da6d52d570356f8803a94656f0777c473268efbcd9350f12ab901781f395e7b0212f8f8e099b6e4582ceb34ede3a5a3
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\pkgvers.datFilesize
74B
MD5a8340860b065dae8f93853f85bd57787
SHA151e240bcad31e46e8378d94c02847fe7981002f3
SHA256bd6c9fc63887a8687290c2e42aff7380b029b73c56f0fec51740b166380e2aa5
SHA512cc849320c2f19358caa5be539bd65e539db9a55c3e5e83917eb50809c3ec369bf3f6e693d49344338805eb9582008c194721b0183d9b12172a9eb14c72a33b0d
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\sample.dllFilesize
529KB
MD5ad6c596fba0e2968c57243a106f9ccc9
SHA12241116bbe1f33ff30cdf26ebc57af85136675f8
SHA2560ccb163eab06671bdc74fa03ec1208d66105960254cf1f9cad584300676c4eb3
SHA5128730556b3beef30296443aa1be1f538a12cbf34dbaa4cd722b269b24f639f599c51970959095b6a5a78bfa8e40cf5f85af64dd637391e5a24fa6dc9b1e6fcaf5
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\version.datFilesize
47B
MD5d0597d6fe6366d4fb3ee555505d4bbd4
SHA1f2dca158ab1e30152f09063d1244dc08659e8bf2
SHA256a7d3c859435cf7432e207b4cfcf76a471854767a6041c9156c76290aa0507933
SHA5124062eeb6bab639b1d9761215d106b5718913667f20c08894531380345ee49aa332768bc32b7bcfdae5b5ec8d5714351a5a50016de120608bc2d7987ab57a60c9
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\Global.nmFilesize
336KB
MD56d0b653db9f44ea422ff6da077347982
SHA18d90d4266dd3e67a7be513c9bb950a833d40e7de
SHA256d2bda209032b730d45979c43d77a4a9f3db0d6e7a240a463649da32148249925
SHA512888ee79697edb666f6aad3dd1a146ae42919b261b02fed85ab36f50a1a9a2054172c7bcb6aa9cc02530353d7d0c2b83ef268cbc705d9e8df21c50e8b7a362bb6
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\Global.srFilesize
16.0MB
MD58334313ee072e8475287c133b101beee
SHA10774e278ad5d87755c418c4cd7d4a75437b56f13
SHA256a43ebb16b7bb74292b3d7f2a5535080911c70d5020b4a2b718d60863322b8228
SHA512b401b65bba0e05fb6dd110056276a90e63b9b482aa63a4ef871acca91e2852419d3a3e4a0ffe30e09926e201a809c9d32183fe13582de8622b07d471aabc34ed
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\cfg.binFilesize
661B
MD58fd13803b1e5f14b4d241facc601a170
SHA17321eec794bc766d84d75bd0370a9f2e4d7abdf6
SHA256925d771b2643715b62ef720801dfa96047fff1ee70eabb244bed802234673717
SHA512f5b3514258487f8576fe32a795eefcffef049c7d002a6abdca17383bba838c7a218be23ec6803dcefed615f40afc2ba4b15bf65c9a74c4f6bb891d15d02bfc22
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\clean.mbdbFilesize
10KB
MD5adcb9fa4bc7e739b8b14e05131cacd30
SHA1d8bd8fab734284d00b5be94dbcd34ab313c2ac48
SHA256d3193a821a20e024d502a4a3f012d09c98a241ed8bb0168d659a9c1a1af1a535
SHA51270e6a26c88883374d9f4fd306cdb9d9daf1ac3bb5f0fe078d890984e01c0fe801a267b02304d4cb17dd31918e243847812fc909f26fcaa51fefe90626bf47361
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\dbmanifest2.datFilesize
924B
MD520250b3d83fd1358b13314feb60620f8
SHA1c824c9aa7c16e385e0c7423b5faa3da91f1344e2
SHA2567679669e6bf77e6111f5a196a9ecc5beae350fa9ca470f4c3809b45ac8fa2ee4
SHA5121a97a4502c8521849cd1d830ae8bc4ca5f6ec15049b77fc42393bcbce57b73a750df10e1ca3f0e1ea588268501bef81881364d63c24aac7b78231ea9e4c0e30b
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\dynconfig.datFilesize
39KB
MD510f23e7c8c791b91c86cd966d67b7bc7
SHA13f596093b2bc33f7a2554818f8e41adbbd101961
SHA256008254ca1f4d6415da89d01a4292911de6135b42833156720a841a22685765dc
SHA5122d1b21371ada038323be412945994d030ee8a9007db072484724616c8597c6998a560bc28886ebf89e2c8919fb70d76c98338d88832351823027491c98d48118
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\exclusions.txtFilesize
23KB
MD5aef4eca7ee01bb1a146751c4d0510d2d
SHA15cf2273da41147126e5e1eabd3182f19304eea25
SHA2569e87e4c9da3337c63b7f0e6ed0eb71696121c74e18a5da577215e18097715e2f
SHA512d31d21e37b0048050b19600f8904354cff3f3ec8291c5a7a54267e14af9fb88dfb6d11e74a037cc0369ade8a8fb9b753861f3b3fb2219563e8ec359f66c042db
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\mbdigsig2.datFilesize
514B
MD5aeeb9145095aee238fa345ce96d1f49c
SHA14df1b0f5decd16f2c0e36b98e92d461f2e97d30d
SHA256f8ab6808cb85caaeaeae58fbd2f1a9d2906a574631a73ea8ce2bc2c337f60e75
SHA51274502ea59b1c6a4d3f1df53d8aaff90520ad4956700cff3e2a0dcc744f4084216fc74bd217626b277155fd000abaabd30f4cc16c1285a415fe9e2ee1e46858a8
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\prot.mbdbFilesize
24B
MD5546d9e30eadad8b22f5b3ffa875144bf
SHA13b323ffef009bfe0662c2bd30bb06af6dfc68e4d
SHA2566089fbf0c0c1413f62e91dc9497bedc6d8a271e9dc761e20adc0dccf6f4a0c1f
SHA5123478f5dcf7af549dd6fe48ad714604200de84a90120b16a32233b6d44fa7240f5f4e5fe803f54b86bbdfd10fa1bfdd88fb85eb6a78e23e426933f98d0a2565ec
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\rdefs.mbdbFilesize
24B
MD52f7423ca7c6a0f1339980f3c8c7de9f8
SHA1102c77faa28885354cfe6725d987bc23bc7108ba
SHA256850a4ea37a0fd6f68bf95422d502b2d1257264eb90cc38c0a3b1b95aa375be55
SHA512e922ac8a7a2cde6d387f8698207cf5efbd45b646986a090e3549d97a7d552dd74179bd7ac20b7d246ca49d340c4c168982c65b4749df760857810b2358e7eb69
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\rules.mbdbFilesize
9.0MB
MD59a20739b3cca4b23e86755a564bd56e0
SHA1b38e885162039220923e9a4c160021a1549081f5
SHA2569173a8767615833cd9448eac4edf924f55fce4bdd511d8937cf63e26f4477c90
SHA51218baf591ccfccd6b06e26b8c3d7e050700eb17e048316ec34633a22a81a19ef9d225c8b006658b969462e45e810b9ab6ae10b2d83ad866d1398b256771fadde3
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\scan.mbdbFilesize
1018KB
MD5269ef223b7919ca972577657d3d33d85
SHA11a1eb8ca370beaee913715b1f4b6b8aa53fc4b2a
SHA2564447c30c097ce4276abadc515b94a6f4ad246884fbf64b7dd8ca45246679a6bc
SHA5126358d168e868151e7ef960e1cd9112eca25739bed0be81826ed29b132499ae31fa34d7eb679b40ea3b5a6f60da81735e770133dcfd6cfb0d0553b6c64b606ffb
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\tids.mbdbFilesize
177KB
MD5f0eb4779a5dade2efa5229c33abb4910
SHA141d2c8cdbd8e306a263fe419bb2c1c19514524e9
SHA2569c5242e6c567e641bb10412cd966b81819984ea643ba96222ee0b256b3f53955
SHA5126883622d693265b824d1cb65fe6d9a66d99bc8d167981fa4f0054c7513020361ec09b2c75f62a8afa85dcea175914a4c8f4872ec7040722dcaf7375886bdbd84
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\wprot2.mbdbFilesize
40.5MB
MD511ad702b34346889d5fd70a9f875faff
SHA14a6952107ba24777d90c06b5528f05f45705ce90
SHA2562dc77eb6a488751757a6779b003dee922526000b38ee1d1fb3fe3266079cceea
SHA5123088130d7d57a317a2a38d3a69876f53cd3bca34df3c8ef791bf10fa17156cf811a897fc8e68f3d1fcdcee6a85600668b1c0a0bbece59dbf7fb10f42d76d69bd
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exeFilesize
8.7MB
MD5e6d5df8df4c3c43a981e5f7cb7b35f65
SHA1b4233bf950fe74017f86662d04f8cb98241ba1b5
SHA2566ec0e1fa0ddf753eb37d521c8b4c87ea60ad6ab45398bd6736a55fd21cefd072
SHA51243ae5f61024d7137c3a7fda98343d438a451cb980512099ba3b07e9b4c73bbae12396fd3f71b6b00bf075fe4076c02472cd40febcb695f0d9c429c189a07e8f7
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exeFilesize
8.7MB
MD5e6d5df8df4c3c43a981e5f7cb7b35f65
SHA1b4233bf950fe74017f86662d04f8cb98241ba1b5
SHA2566ec0e1fa0ddf753eb37d521c8b4c87ea60ad6ab45398bd6736a55fd21cefd072
SHA51243ae5f61024d7137c3a7fda98343d438a451cb980512099ba3b07e9b4c73bbae12396fd3f71b6b00bf075fe4076c02472cd40febcb695f0d9c429c189a07e8f7
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exeFilesize
8.9MB
MD503948ad78f44b840ec2296a0fbb9f2fc
SHA1a4c04a502746af80894c13de707bd0282388e12e
SHA2568ffd82021f35885627bbf5a0a55a51963e7e37c5a5d636466e244fa64ad94d65
SHA51235b39c9f7da64a22d4bc8aed88b36bf3d69bb2d45d0ddb360fc909c943d61e067e77da5b54c64406fa7af883b9bd798100193fae2eb790fb304037a6df4d47ee
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exeFilesize
8.9MB
MD503948ad78f44b840ec2296a0fbb9f2fc
SHA1a4c04a502746af80894c13de707bd0282388e12e
SHA2568ffd82021f35885627bbf5a0a55a51963e7e37c5a5d636466e244fa64ad94d65
SHA51235b39c9f7da64a22d4bc8aed88b36bf3d69bb2d45d0ddb360fc909c943d61e067e77da5b54c64406fa7af883b9bd798100193fae2eb790fb304037a6df4d47ee
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exeFilesize
8.9MB
MD503948ad78f44b840ec2296a0fbb9f2fc
SHA1a4c04a502746af80894c13de707bd0282388e12e
SHA2568ffd82021f35885627bbf5a0a55a51963e7e37c5a5d636466e244fa64ad94d65
SHA51235b39c9f7da64a22d4bc8aed88b36bf3d69bb2d45d0ddb360fc909c943d61e067e77da5b54c64406fa7af883b9bd798100193fae2eb790fb304037a6df4d47ee
-
C:\Program Files\Malwarebytes\Anti-Malware\MbamElam.catFilesize
10KB
MD560608328775d6acf03eaab38407e5b7c
SHA19f63644893517286753f63ad6d01bc8bfacf79b1
SHA2563ed5a1668713ef80c2b5599b599f1434ad6648999f335cf69757ea3183c70c59
SHA5129f65212121b8a5d1a0625c3baa14ef04a33b091d26f543324333e38dcdb903e02ccc4d009e22c2e85d2f61d954e0b994c2896e52f685003a6ef34758f8a650c7
-
C:\Program Files\Malwarebytes\Anti-Malware\MbamElam.infFilesize
2KB
MD5c481ad4dd1d91860335787aa61177932
SHA181633414c5bf5832a8584fb0740bc09596b9b66d
SHA256793626d240fd8eefc81b78a57c8dfe12ea247889b6f07918e9fd32a7411aa1c3
SHA512d292e028936412f07264837d4a321ecfa2f5754d4048c8bcf774a0e076e535b361c411301558609d64c71c1ce9b19e6041efa44d201237a7010c553751e1e830
-
C:\Program Files\Malwarebytes\Anti-Malware\MbamElam.sysFilesize
20KB
MD59e77c51e14fa9a323ee1635dc74ecc07
SHA1a78bde0bd73260ce7af9cdc441af9db54d1637c2
SHA256b5619d758ae6a65c1663f065e53e6b68a00511e7d7accb3e07ed94bfd0b1ede0
SHA512a12ccf92bead694f5d3cba7ff7e731a2f862198efc338efc7f33a882fe0eb7499fb3fb533538d0a823e80631a7ca162962fbdfd78e401e3255672910b7140186
-
C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.jsonFilesize
592B
MD5367688cd53f73242ad5e62d09eb7885d
SHA1ed124df9263f87765038b6deb956eb8f4d1a80bd
SHA25668cacf0a90272f352a23adb63128e0d919a044e0876e158f086e43f7d0e776c7
SHA5129e83db13f32d77f553a6e5419f802d7880bc474b2eda17475d093d3a6844b8cef35c6fae66041a6b5614e53b70eb28e2a363fd6844d39862b5b95f963f034c29
-
C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.jsonFilesize
592B
MD5367688cd53f73242ad5e62d09eb7885d
SHA1ed124df9263f87765038b6deb956eb8f4d1a80bd
SHA25668cacf0a90272f352a23adb63128e0d919a044e0876e158f086e43f7d0e776c7
SHA5129e83db13f32d77f553a6e5419f802d7880bc474b2eda17475d093d3a6844b8cef35c6fae66041a6b5614e53b70eb28e2a363fd6844d39862b5b95f963f034c29
-
C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.jsonFilesize
654B
MD58bf5edadf5c5db74b6bd82b06d057add
SHA1f237543462e2f43706a701d77cefe240cbcaa261
SHA256d3e0d734ea09217f47c19edce5a76fb505274e3bdc40c7ca291bd79d8383a0ab
SHA512f51be79fdba7de430ee50738daf6bf87caba328d43e08bb5c8b6f198a2f05c21021048b2e534d52be9086df2abee83e27108d5cfae2774ffcdafef8294bef72f
-
C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.json.bakFilesize
592B
MD5367688cd53f73242ad5e62d09eb7885d
SHA1ed124df9263f87765038b6deb956eb8f4d1a80bd
SHA25668cacf0a90272f352a23adb63128e0d919a044e0876e158f086e43f7d0e776c7
SHA5129e83db13f32d77f553a6e5419f802d7880bc474b2eda17475d093d3a6844b8cef35c6fae66041a6b5614e53b70eb28e2a363fd6844d39862b5b95f963f034c29
-
C:\Program Files\Malwarebytes\Anti-Malware\ctlrvers.datFilesize
8B
MD5fe95747e0a7a96907ce92259c56514ed
SHA100a126ec8d9687d4305be9da42f97806112d484f
SHA256ca85439b3b1aeff16afd8e94fec619198a0fe68f9214c5e68ae896be41e23ac1
SHA512baea4075e05b32b86866da722551bee9d13dae25a8854df5ff48ca64f9aac7e45dba0037320052de0d0d29845c77ee97b7d9bef14886dc2fe3983243e13e128e
-
C:\Program Files\Malwarebytes\Anti-Malware\mb4uns.exeFilesize
3.8MB
MD563d54fe94ae4e44835d726056fb83f43
SHA1f2284e079ae50d7a5362876d7c16192d6cecdfac
SHA2568f2c2bf8c3b33876fb028be01f8215c9cb07e59abb4d20f5cdb21f380fcea406
SHA51258f8f28c3e861e3aa235128a2b7d9f4e2faf5d87f510906b4e192a3ac5762aedb35b23141a53f4f01e2b5316c61b00e4cd46433eee5badd29f70f029eea52b09
-
C:\Program Files\Malwarebytes\Anti-Malware\mbam.exeFilesize
23.1MB
MD570d8e4d74252379d29704f0c6c5ba792
SHA12f15890a225c587efdea5789fa630a83802c4627
SHA256305980e0498f47d050eec96071af59dafe6e366d13887cf64a5b7d66bfe01eb1
SHA5120c801d9d2fac4305d00a1f8b51ff6a9697a9bc486cc9bb563c81946ff21b994db32e6be26180255c87dc624f9b6bd4ad9ba83df304baa986fd5bb4e83dd892f6
-
C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exeFilesize
8.8MB
MD5090e6cd78c20db3e7305aed4235b6df3
SHA1490f93ea7b08f0e613346430bb51d3cab1aff037
SHA2569923ccc092ac7e9bac3cf13ddff5302025f08bf86ef81697919d57da872e9f89
SHA512c065572c61d5672f34a876c8acf16c919296c5330b196b170783f70c551075bf6e4c89e9b711dd1423ae84638582eb6eff2f898daee5ed13e39d2bac44888b04
-
C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dllFilesize
2.7MB
MD5b7e5071b317550d93258f7e1e13e7b6f
SHA12d08d78a5c29cf724bc523530d1a9014642bbc60
SHA256467de01d7cee7ec54166b80658ff22f9feebdb1c24eaf1629cf40e4124508064
SHA5129c35293c95c1a9141740ac99315605964aa37c4a42d3a11cae9e5649ff1427a9480d3d5e7f763212cf13db3511c5ea3c84e68f95f0067fe6339a9d3fb7b27c54
-
C:\Program Files\Malwarebytes\Anti-Malware\offreg.dllFilesize
114KB
MD516663d125398773a90d0a53333b7cf5e
SHA1f92928ae3c9292588547ceaca1cb1d372bfd7936
SHA25638e6811b47262101759aa51a631263d9e3eee5d211164318a751e078afec4cbc
SHA512091764b8ad80aa31eea0bbd91ee505ebdea2654bc8aeaa3081a061d0d37ab13d27dd203075fd0de10c6687591aa0e36139a38af846c4e34e6aa67ab81dc277df
-
C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.sysFilesize
233KB
MD51dc6d344ee9b6b024ba23278891db9a5
SHA1519b792d11daa2bf9d127f69cdd603a236576e04
SHA256823e1c7321e177b006c1f3fd1ec8b99607a12d2c3c321f3a6cbbcf7030b6c240
SHA512fb96c4ede03c3aa729d2ea5a72c5f14029f6d69a79b6e0d5449e371bf3acdbbd1cb2079e8bbac3a3140a257c71018bc7a2a31a45ad5c8b65382e67cc3431ab6a
-
C:\Program Files\Malwarebytes\Anti-Malware\sdk\farflt.catFilesize
10KB
MD543af9deb38e2dbd69c46b6befdbddd6e
SHA1eb7a9e4cdd74f0cc5a1ee07292a561123cab2545
SHA256ca94b3a3b8721870a0b96675649800bd751daadc0391cbf3143e2f7aae6dc676
SHA5129947529cab455151fc1ce09828ebf195de922b41a303c12f33baf5670729b533cadb28f360301f2a0ad14f3c7315ba90955a0bdcb7828ec1920b349fada2f518
-
C:\Program Files\Malwarebytes\Anti-Malware\sdk\farflt.infFilesize
2KB
MD5358bb9bf66f2e514310dc22e4e3a4dc5
SHA187bfc1398e6756273eee909a0dfb4ef18b38d17c
SHA256ff51780a5a854b2c18f71ae426cb066a13723ef6155e24f4910137c9e8dfdc17
SHA512301ec5ec5c0813951843011f2204924240235494999136ea30a557cbf58146fc6043a8866b344fa7deb927d7c83d44e2aaf45adca7d221aba5d36715b9a63e09
-
C:\Program Files\Malwarebytes\Anti-Malware\sdk\farflt.sysFilesize
195KB
MD5d738a028dcfb7d1cf97e9fb11e306db7
SHA177f4d6a79e1f2754a2e93095158d0edfb9a6a5eb
SHA2568f38d2a0a8e306de910bb621cab4276520aed84645de942538d0a9c792dd0074
SHA512c753a13767c8460823851a144a2a9162168a1099664ba601d0a929d539ee15d78123ffd86cb6225f0d7e6f52f40b2c444705da8bcc1292bb6c9757732b82ad94
-
C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.infFilesize
3KB
MD5e5bb98e4d7adf79cf7355aeb4a12d3c4
SHA1c2996909b98b95863d54c6a2f7843e5c05015596
SHA2561f2ec66c3947802dd97abead84d71bacebf84e4a2e871852cf5291958d45a189
SHA512f65ec684a21481c66f4571fec4f5cd17fb629fbc4b5fda88bfe00ada30573f3c74313311f5e8a164709824b8033a60fa2ae0f1643d0ee3ba8ae4fd558709aa7f
-
C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.sysFilesize
217KB
MD533931ca7d4bd04b8682fe2f996b3bf07
SHA114dcdffa4edf16c59dcd748406c8efb1ba3d2bd4
SHA2565fe3582d567cc48f3d29771d3bf77cad42fbb25327dcb6be6bb0227a1ce02007
SHA512ed60367c5e24d454c48c921ee668bc1006631f339e38273626d3cc0673e906906312faa1febc97c5f616a5f4295a6e03265392950651940ae15e5e7baa1e6f90
-
C:\Program Files\Malwarebytes\Anti-Malware\sdk\mwac.sysFilesize
183KB
MD5d55d969fbfcd436f0197cce40a7e92b8
SHA1a457b04fc6ea3f803c69ff586c2d27a8fc1e49ff
SHA2569ed1f75131407a995d7cc82816895164ca66e77dcb177a1cb703dd98542410b5
SHA5124f81712697fbfa95028bd661fc8f2252aa4749bf575d32e0fd5be889b4cb76e0e1b3baf39a750f7fd0059410cd1ae7c77a2b6dd9ae709995fd36a3fade8809b5
-
C:\Program Files\Malwarebytes\Anti-Malware\srvversion.datFilesize
9B
MD58660fa6b5695c6c3edc70ea86961cc9d
SHA100b9b0dc0eeb24a159a072302e8468efae6cdcc6
SHA256e026c8ddaf9bb706e740c3af69724fa54447fb12b55bfbc6a729131b76319de9
SHA51220e131e636bb097af073fc7376b877a88c4491706eeaf1969842d486cd9bd674ec1ed4d28113f4622e4a40bb1af66bf0fa4a21a9debe5cc9375cf0213f9c961b
-
C:\Program Files\Malwarebytes\Anti-Malware\uipkgver.datFilesize
6B
MD574c6677020fc6b6c867aab117078bf5f
SHA18c46db37dc0b39eb963d4144539c8b591e122400
SHA256cdbb9bc874d71e154c71b68b1fe959913d286036dac11e226e5620c919ba9708
SHA5123f9db8d9bb25322f8d8e750750bf92dbe6ac63d686eced65cddfcd61178cf0e947118a491058414d4d2cbb4892e39815565669aee0dfdda23aece72d278292d0
-
C:\Program Files\Malwarebytes\Anti-Malware\version.datFilesize
47B
MD5d0597d6fe6366d4fb3ee555505d4bbd4
SHA1f2dca158ab1e30152f09063d1244dc08659e8bf2
SHA256a7d3c859435cf7432e207b4cfcf76a471854767a6041c9156c76290aa0507933
SHA5124062eeb6bab639b1d9761215d106b5718913667f20c08894531380345ee49aa332768bc32b7bcfdae5b5ec8d5714351a5a50016de120608bc2d7987ab57a60c9
-
C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.jsonFilesize
1KB
MD50250c98e4cd20b9501d8afd2a3203e6a
SHA165d3d5b16d87ec52a9b2229570c5a60b980b8378
SHA256bd9c7487e812f71fb4a3052ae44b291b0a920acf52821689b5d0fd6cb207b054
SHA5126c43d05ffb63b3fd60518181e520119d254b2de145fb637769d38595379af73d85a43351e28c52902f515414a6c7b27b617742412e34b345b193cef8b7632754
-
C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.jsonFilesize
47KB
MD503744fac99313ba449d6585a0d22ece0
SHA12f5f9251feb80925fd5a6b9232ba5fd9e236adfc
SHA256f03035e839e117526b629e0f27b71940f7c0495e360b8370c4f33c633fc28e4f
SHA512770209f5f6885225c99cdd386d83568b1f7b7c5e9ca3523d5ca550dd803767c0a559bed7d99bb7f652766649625e5e9d3ef7b0bf941645652f56fa1468a33807
-
C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.jsonFilesize
64KB
MD52cd1d5906ac6ed969ce9caf775cc1ce8
SHA146819661b33ccaa0793626e2a08261f86c9fcb30
SHA256cbce479de47e8e666e0567729cc649c9d70d2ac938ecc747a6b2808c63a9f16a
SHA5123c36c133a921a3323cbcb44a3135e362b8cef3bfaccb6cdea2d9a9360cd5b231040367bacc7f34b9da98b846df182b4ac7d9751ca6c7bec229e4cce50fe4d3f1
-
C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.jsonFilesize
64KB
MD5beac59358abddd3fdd1971a46e24f6d8
SHA1efb7495e98b300238137372efcc2ebe419f3d45a
SHA2562bf825fc06a524fdf6be5cce5eda7bd1800d37db58d958726f87aa745e1c32a7
SHA51232724ac9f371fef217105d830935c8ad549a285277c3b084cf8c49e5e7328516f0375cdb6418e4889ad51cf0e506ea9967afd2fd1403db13fbb0eaddd9992375
-
C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.jsonFilesize
87KB
MD5f1cd6a7f323189288728b2243741a3b8
SHA12d0114a0ded4195fe37cff7b89ad44b576969e6d
SHA2563cb0aaf4456ed8e84095523f0c3b443f06aef8274712eafaed5ca492f0686175
SHA51259e11253fdfc13342bd87d6beb6ba2a1885179b733d89183c2ec19dc6bad68e1b0f05607830d77829c1b21494b54c650016423125a481d391de31f6ec2383685
-
C:\ProgramData\Malwarebytes\MBAMService\config\ArwControllerConfig.jsonFilesize
607B
MD5e6a4cb298caa817ba0f662e72abff271
SHA1a704b19a344ab62e9ab2971c6f1cf3564766c16a
SHA256f0a60844cff9bf0b610e75a29efeb33254154ba0fc957649fc86dbfb61fcac2f
SHA512853f5a867ac1f42924166f51aafe60dc0af724c5445acf3fe6648af5841100c3e37048e41acfdcd2ce04317ce4bf9dd3579da2cf903e224bb662e71a3334c8ba
-
C:\ProgramData\Malwarebytes\MBAMService\config\ArwControllerConfig.jsonFilesize
608B
MD510c05d19d1ecde763f65cd63e79a9d09
SHA1a2ea4eebafff58dff3a49d455c45bea30900b8bc
SHA2560cbe469c1fb5bfaea878befe6f67b3610bea091a281bab095a5cbe0c1d9bcd62
SHA5126fec39c42f8a26f79e18d3c88f17c721655806f2ef8080248201399606a4a2565811cdfcbdac7117b5ee714d0da158cfe9e46c4d018e8b33d25c9287864343a9
-
C:\ProgramData\Malwarebytes\MBAMService\config\CleanControllerConfig.jsonFilesize
847B
MD5725db8757c6448e2e725bd22ed6b90fe
SHA15253c0d17019bd0e347c26d5aa961ca54c018a42
SHA2565f2e687ca8cf9d53ce9e267a75c144d677d4873c1593af2023dae3e11c4ca7a0
SHA512f3c05689984165990a7db1f29655e5d44e875fc2bbff4e459ff60a30860bdd0987a9a3ff34d0829e1e647d3b381e9528667029db56efc6d65d6452478bb36027
-
C:\ProgramData\Malwarebytes\MBAMService\config\CleanControllerConfig.jsonFilesize
846B
MD5c53e21e48f0c8e2a07dc555b4acdb99a
SHA1bbce5c1bf12c6da3e0a63b46f092de811eb3d322
SHA256259975b1cdd822aac6cedc4b69d22632f77e6a3dcf9e76e894bf538beb0830b8
SHA512f7c64c5074eefc283d5354145f15b6ffe6af1d2d2c1b6c404d6075d10bbba80b6925037331674cd1ad5f72140131f8d96e8af6590e3e6d4f9aab00edef91d8fe
-
C:\ProgramData\Malwarebytes\MBAMService\config\CloudConfig.jsonFilesize
825B
MD510ce840c0be841681fafcf1a507d2713
SHA18a33e9e3bee28c093c0498cb185bf18625d58ca8
SHA256df9493c018a6be1409e7914e2691b1d51c6a92cc6912f5d8c9d718f8cf611b6d
SHA51247a477fafe835311633656e37676222ca8de52e6c2ec94581fe3308db23be9a6d942204781fe408a57a0c974b86e4adfce0139a12a5b741249e7bc6ac2f0fea5
-
C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.jsonFilesize
15KB
MD5798ea36831d58bf7dce777748d8e7c6e
SHA12d89e3442eb9367ed109f8d4860e6f4cf37e362b
SHA256d8a5a56a0c4a8bf1f70005ca66138a0adfb8d5428f88a3133b7e38d528519fa4
SHA512252fbd2d75e6b6fb4cd6755f4086e4682aa3917d75c9e738145301af697cc16adcab574a93a1404689c8531b965dd0a9d4a750bd0b7c5280f76d10e3b12e2699
-
C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.jsonFilesize
15KB
MD5a655b7f6b022e72e1ee09ab5d7f845e9
SHA1ff32a709d26394630ac77423c056e0ec0f4fc265
SHA256076f9553245577e15b35492cf4845ab327880e017898af07993e180f63989237
SHA51265975be1364d8b4c5799312f2c3cb8ae725e42a22279e8938446a61506fbd1fdd28b428ade7688076827b540bbcdd6a1e88b0f332f70dfbbe7b95abba5cf7599
-
C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.jsonFilesize
15KB
MD5166cde20dc5fc460d34e9a9ace47a718
SHA1a57a54e8e39ea5501f6a05ab46e4a1c8a2391240
SHA256b9612c7446cfead6f8ecc1e06e5c7f173501492fe3c2127060e1f8ae0fe9b8bb
SHA51264881fcd94c7663922fc3f786270c4050fc7fac10d8fc84f2b39887fa24b95bebb0bae68ea1d9c645265b595f4e240ef3690da9f915dc5cb9e06cda8df93c232
-
C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.jsonFilesize
16KB
MD5f2ccc61e91eee88bb54ea4dc89a80253
SHA1fce677d79730daa87d260b3c9c25285bc40743e8
SHA25680c69601ae733ecfa5b22d30e74a13fbba34535a44788592f8fd4ef763c0a0a9
SHA51219f1d04dcd6cf0bf574514a1bf08eeee21cea44d32d8dbe0f3087840e040dae74a32fc0c3047ff0a824736ec417a62e248cc6255f3382569b5b4725170d665ec
-
C:\ProgramData\Malwarebytes\MBAMService\config\MbamClientConfig.jsonFilesize
1KB
MD57c29d365347cc1da4bdedfb57e45baa4
SHA18262f8573d56e02a59a2fda4b7f3645bb171856d
SHA2562db02cd23ad0e53d5294fcfb07f203868400ee69505ecd901f50654d827c8b07
SHA51260446ea2d66cc0b108ba8d1015ac277e8112bc469421e767bab5fe3e20696d522eba9a421e614f40444f754ab074b74c3ff0133e007fb37e79aba121c715c5ec
-
C:\ProgramData\Malwarebytes\MBAMService\config\MbamClientConfig.jsonFilesize
10KB
MD5fdd687eda8892be9cc3139883987eb6e
SHA11ea6731a6a7230d376702fc016349424773dadf4
SHA2567db0781e8c91b7d3cbdfd5b4b8ee6e27d107e38206ff923be7d8b541d676f332
SHA51246759759f62b1d9f13da598bd4e88c5e86bcdf49f86b76bb6721cd5f62487112fc827ded37525bca53f859878dcf45f70c793af9edb42c5e7c8efdba9d4728a7
-
C:\ProgramData\Malwarebytes\MBAMService\config\MbamClientConfig.jsonFilesize
10KB
MD5e40293c6a77d104a04a8023898cce0b4
SHA143ac0262110171021f748d0167dd3878862735a5
SHA256e35c4e7f45db4fcfc496e2e3d3667d5b0ab3d659ca01ee40f6ef786482677f84
SHA5123fa796dec9509494871a1e0c430a74485be11df0bab2ec7f5c9b82597992ebe8a20313ef25ea3837d459950bbb3990d160efba6e356054398f37360c0b26bbf0
-
C:\ProgramData\Malwarebytes\MBAMService\config\MbamClientConfig.jsonFilesize
10KB
MD5de8b6489d111126ca2808474bdd327d0
SHA1967a4a277132b19a7e644addd1f85e47d5be6130
SHA2567b9ca5023e1ffe8393db4d8957a17863085e00110833020ffe90ed035517e03e
SHA5128bc8ec346935b9f0950767c866be630cbd9597a3a69684a7db6a7d7611ffb604b2ecf7e4eabb82f97be06fb4e455b97c73b0254b796b1d7bfc11fd4bdd8cfc06
-
C:\ProgramData\Malwarebytes\MBAMService\config\MbamClientConfig.jsonFilesize
10KB
MD524e2e844b3b717c0bfcfce1b78da8432
SHA1db911032fde97afbe5aece02119ba53b078bdb26
SHA256604915db4897ed9753ac71064ca07f818cb5844089b80c8727e92a3fe07bfd82
SHA51212b4d601e6072dccc6f5718e40682109eef86fc2532b23b263b68a4d235fdeeeacfafb86bcd6d51d82cf4df7f28b9eca63e424e2ff8ca515a4741756bbf7d64a
-
C:\ProgramData\Malwarebytes\MBAMService\config\MwacControllerConfig.jsonFilesize
1KB
MD5c8231601960b4af518fcf2c00a50abae
SHA1ca68066ffebaec57b2de16aeec0747c12052a868
SHA256203875fa13e4f1a609aaf6a2b1e7949145b04832f8891c97d66cdf8a6d204c44
SHA5121268f5cbd10a7e3f59a84d147d4406955df05642de293d38b32df07b5adba2ccfb8814614fca91271871e9a8dc9c695a4b98af5fe99f24093bf6d9b025a13ef6
-
C:\ProgramData\Malwarebytes\MBAMService\config\MwacControllerConfig.jsonFilesize
2KB
MD5fe187531c62e264117c31b403a7868ff
SHA13ab1bd2cfd7d6a0d02a3687b61e8337846c663ef
SHA256036871d9ebf46aa65e69f347d2883ae1309859da6b557d52b0a4e3198cbe062b
SHA51262f4b962d6a053f4f7868cdeede5fe8aa98318e35262d3537cd52fbcf5d77de52788c4835bca656875af066b7b637607876fdcca8c1f37fce3437f2414e3e9f5
-
C:\ProgramData\Malwarebytes\MBAMService\config\PoliciesConfig.jsonFilesize
903B
MD5af3a6224a8224f324f6fb046f14ba3c1
SHA109a6dbf5fc2f7334a9f8896296fcd6725b1cbdfe
SHA2561d8b19f32770226beda2763d349f4b65cb891490c11808627fafc1546c327c57
SHA5128a8e66a14faac9ffcd5d261585a66842e9194b310285ee0eedd0d17c7ab753ca008adca499e92add3e7a42669b4fc781e3ae36e9821595ddc8e72c63039bb5aa
-
C:\ProgramData\Malwarebytes\MBAMService\config\RtpConfig.jsonFilesize
1KB
MD5dce3575277317c5807000cd416710582
SHA120fe234c0c845c5d4163a56e93456fb8685ee231
SHA2566f5685756894c3a5771a8a3de1490c8b4a08bdd9579bd3a98d967b4322320f1f
SHA51221c2ab37c7ef125ab08df6a7908e481f4f6006dfa573c9cb5a8bece9374fb94a944bc2b93ba2aaa049062fb1994604f9d3fc8ada813c6aacdbfcfb0aabf73dcd
-
C:\ProgramData\Malwarebytes\MBAMService\config\RtpConfig.jsonFilesize
1KB
MD551faf63a1834e245fa76837ed537ebfc
SHA12d0eda70f6e6fe4b63e8d41f956c4efcfc6b6f91
SHA256a2b662892a9a4fc94eb3e96c083f1127d213bd5077b240e6308d820166b36884
SHA51219d5aa82b895fe348fdd0cdb264b78c30e0caa3ea0e5066684c9367a22aa8b5f4f2e40fd7261d2414637c86eda00298ab5cd29de65d618a88b8d08bf009cc49c
-
C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.jsonFilesize
2KB
MD59c7f7ab94e194ed6aa1e837e543ed183
SHA137f0254018412584beb04017e4e73e7970548992
SHA256d6758a9da587df3e111efb6db178c97854690c1500ad0eee70a17a6a1352cc55
SHA512c0e8df74828c4676bab4a563429221a77c30242fa049eefbd6dad56f971c8cda2f1be4e259ddac89857fba90a62d6945e2019c22a854969a1b9cad47b7c60a22
-
C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.jsonFilesize
7KB
MD5c356a232b5581667e9ae6e7b952ab07e
SHA112b29e127913046950d999bbe2090db6e9e3616f
SHA2566c66bb57a34cca2b2881d8f8a6142a2549659e86052ee453fbb2ca64fe532807
SHA512a90fc9695631960995c6e3d58658f3a08d84a5b9db306716536b95c6950081f1f60b4ad8a18e2fd9a532dad4dde6aa623b1247100c82267e3924152c78ba314b
-
C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json.bakFilesize
4KB
MD592bfce5e3a2003520537c6607c936f28
SHA14be37de0c8d0a6fe9cab031905a150818f3a83ce
SHA256670f88af45442130a588b0bdbbf8333f581ec5943b3c73f091a7a38fee49d604
SHA512cd5040161ab3a3cdb041c7183779ea4dcb355a5663f30f66a1a233da0f14ddf100218bca575a73e4d067fa7dd28a530c28c9b7396a2f1a02b31b2ee9350eb7be
-
C:\ProgramData\Malwarebytes\MBAMService\config\SpConfigFile.jsonFilesize
11KB
MD59b89cc5fc18734f06851fec59c7eb654
SHA1310682296cdbd5702b30dc7cc003f483b8c00ba8
SHA2565332ceee3ebeae226e8a532452c10f8d06e2ed9464ee5f1d79c9713eb2233fe8
SHA5124736d6790ee25ef8521f33c7bd4fa9914548c5b4d3eb1f3b3ea06bf043b85adbef2859d55de60535e3902af05bdd58fcc11ecd4e7230bc3246489a2628fd257e
-
C:\ProgramData\Malwarebytes\MBAMService\config\SpConfigFile.jsonFilesize
11KB
MD533f311e733a89ff8446760f9f786a7cf
SHA1c9f1b7be65570f3c829cdea633a2de853fc2b45c
SHA256d255c8102f6a74b764d596d9e569176c5408458a522d179eb8f34ed85105520e
SHA512f10a3f5e1a7812dddfafef3238f9c68bbe5d8796782f4bd257625f036ca398aa100b12d03a2394222b64c74e8730fcbc8b99724212bdd6805428870a2faa734f
-
C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.jsonFilesize
1KB
MD580720d74130803d970a5cc75b25c8583
SHA151a16e3d9e6f49d43c96b573e3d92de66b69b4d0
SHA25650cf90962cbaab441e5505768500c0b95ac558f2fb2a3f7c2307ec281d293211
SHA512bc0a34826e569ac9b45b62d3a7ccc64ae185a499a0b8949e038164e0967ca1f8b382128aa33a42cc9360e22c77e52e5ba1c8abeaf4d0f06f77021e49a06924d1
-
C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.jsonFilesize
1KB
MD5cb5a1294dc6eafb8bd3e67513db3ddea
SHA1704ce460b7ad8b3fceba9f383b9e5bbcb76e8599
SHA2565c3b66d4eb03cfae2fa2424ba748eb013d369b1481907bfaf35ed6bdc91d57d4
SHA512323b328ddd6da1585e8d80569b0d9ca656ae719cc62c88547942420000f7e3e50e4be67f947138a27f33585ecc36fa0fc6414ebb93bad379e0342479612e8cdf
-
C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.jsonFilesize
1KB
MD5df66218c7dc9e710c2117ca02a22da2c
SHA1e2122da92980a92ea3399972501cc8472781fe5d
SHA2568f76a948520bd811ed7578de5d9276db55e0c497bfc3fc0404a4d478f2a2778b
SHA512c2a5fb7c3305cffd51968fd216d8a1d507b58d10c41765cc5f277833c4d41dd56feaa7b9031db6033ed290525f7b627783f03104b969d003fe9b8f56f8c509f0
-
C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.jsonFilesize
1KB
MD5a6b0ac60d19a962cf8762da5efeedd9f
SHA1d3602069987cfa3fa4f2de6a654a759938795e46
SHA256eb3f9679e96218ce7af14c758d7d6b3295ffe40d677fc73f28163ea70d5e008e
SHA512778af8cc086a24ed4c6d113153c8c58b09eb591f99556fe6c5b6567b2776ed421f4ccd870f8f4f89c33979f93e6fdb7b0bb24ca1922d1cd8766df5440d383470
-
C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.jsonFilesize
1KB
MD55af1fdcafc393ef89cdb26dcb654830d
SHA1561a0d9dc972e708f4a611a3cea241095d4e2190
SHA256bff7b72ba8f54396edf2e50b13a908e8514453b53f8122883177ae4907275034
SHA512f46b0e5cd2fc6703f79577f21ecb10f7c9d9d90cf57174ac9ca8890ebaf4aca697bfc59348dc502a66a93120a82278863cc803a3d89c09c26d174e02e6209484
-
C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.jsonFilesize
1KB
MD58d3b819e81ed17182ce546184412b22c
SHA11f6633746acd292c439cf3daea77cc9f7aea6ab8
SHA256b172aa58017945baae14db6b6a483b0c8de7995f485f82580fe91f96b7e57309
SHA51240642c60ec80b2f06d7815bdd6095701280fa62f5fd6915efc100684ea248c3ccce41acdbc335c46625e10759f181ecc01fb37ede2ab575d801f80e50ee234c6
-
C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.jsonFilesize
1KB
MD5dcb1d5bbaa888f0eeee026534a0d4094
SHA12eaabb1aa79380344fb83b3271644f21e27083ab
SHA256b8cd1c3ad584413b2ed729cdc84ca912018995802d8929a5e125cca362e76e2a
SHA51246a58cf44480a8c8c18904003128e361569abcc3dccc9e68f68b2c4e5d38a8724aa9436e07c44ae59119973cb727e0f7bc803279adf6af69d77ad1aca15d0184
-
C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json.bakFilesize
1KB
MD5de641ddd04e095d60de97b1088ab02c3
SHA175e3ed430a8a1889b361d60410611435bdf3c39d
SHA2564cbb1a84ce77de7390ac914c942e8c1b8e254a60feba4cad1cac67eccadd58ea
SHA512e16b760daa1e2014a641d3410f733ff64eb78d7c66b0fc012cc1b04e3485c00013fff28ac8aec50181e8feb7c232b69e0a5dfad11d9f68add0353f1c38b6c905
-
C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.jsonFilesize
1KB
MD51c30a3356c52a3a982a83c2a9d86c953
SHA1e1a4862cb3f9addfe820c46407148a531ceeaa7b
SHA2560b1bb1117732bfc186ee40d35a3a503940165d07b5d5804586921bc4108d9bb5
SHA512de29b4f3ff92750ba4b7529b015f157933e30f3ecfcd4b60e0c971a2c784efd5a2c01fa3e63d9b448542da4ad7b827b1decac8df1fb68bb07abffc01464ca08e
-
C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.jsonFilesize
1KB
MD5bf843164a790e9b14199153a17ea2eb1
SHA1cfb86ab0f0942b3097258347f7712f27e9d0dbb4
SHA256f2afb0e89066b34ffd09aff40f5845e97cb6b502f24af135219d94cb8c10dcd4
SHA51297ec7dbbc62a1b1e1caa7f5ff7f58f3035de66fda5ec6ed4e2c6095e07b28d98e06136bee60103366129a27d2c6ba4ddef9f618556e94b012a0ea2e0e54b91d0
-
C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.jsonFilesize
1KB
MD5b31c01f089168206ada9a2d9c398afc3
SHA1279d484f6551eb3fad91f430fe21a9dc89143217
SHA25651c47d53c76f63455d5b1f9d6feb01bc54fafd24d410d8dcf50c85400a638bf1
SHA5129b17294c8da2820a2adf83a9cdf9f2c84b9be44a8f0d87750d9fd68209984b394f48abc948aab2394cfc7a5f52c65df82bc61453e21a5c37bcf40e4428c0ad8d
-
C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.jsonFilesize
1KB
MD55e111e74576ac01906e06d557c5ad383
SHA1499302217a5fd3f1ccb66b22f6ec58d2d014f8c4
SHA25634fc4932ff425e4764a5f3d08212bbf5cdec5b6f42199a7e6f92fda3b0bd744a
SHA512cdf1090a574567efaa9d67b5a0eae4cfad49fb51cda588d0cb2c0a7a6b2a61355d8afcb056782efcd9541507e4f1cda8d6eb6248ff43826548868744944657eb
-
C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.jsonFilesize
1KB
MD561e91c1462750471497757fe56e0b176
SHA166b5bac574fdee30e89e59a3446ade3aa9fda0c3
SHA256df24a68931158ca810fd765c1bc22903f2ddc9509dc297002943551dfb9f17da
SHA512896080bd987ada42547c56b5ebfe61ca85c6bcd584a226265df2d28083ce6cfa61adda3440bcd69565a40ad6af813e4386a1655118956ee1fc6e74cfc0dd634f
-
C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json.bakFilesize
1KB
MD5dc5172d88f4d0d49b011dd0190a4f0bf
SHA1a6d73d38cb735b73cb76a6bcceafb554cb2dd359
SHA25674ab02da3dbf7da883f13b310bf006e259ab0a6a040bc841bffd4d64fd8c9317
SHA512f225be220c071347b1b2963e416d8960f9575e8d6f490e4d4702e47128aa5274b7688a702f139753fd2d141e41ab48307c8521aeaac48c70ebd9299b32efcbb6
-
C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json.bakFilesize
1KB
MD58fc0174c0ac6bdd73b4d6dcac761b340
SHA1a45a79e556c9a5db44cd3923aae5415f446da816
SHA256c9955ae3fa061bb97070c64a8ac4e3eeec3b7dc2cf878422d2819e85680caf6c
SHA5127027d7b99105727707b36b12e6fff9b482826b408cf3ee5f6500fe35019bf87f9b8081dac346a66e3d0fcd28d21dd04b51b8200005b09c23d628ab10e0d0c18a
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\Actions.dllFilesize
5.0MB
MD51eff53d95ecaf6bbfffe80d866d8e1dd
SHA1d7ef7d7c77fd04b2c0eb8c16bb3cd08057f6742f
SHA2566dd748f7ca56125cbe158fa3612f08e7312ef58ad5375e6b7ab5532cc16ca0ac
SHA512c59b8e6f0b238a247e64b9c7bb42213dadac1dada63542830a6292361174c935c0c662b2d1aed3fb6100cc4993297b1eaf25e328f2b4613458c4ffca63b9f02d
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\BrowserSDKDLL.dllFilesize
5.8MB
MD51ed53171d00f440f29a12f9beb84dac4
SHA14d9a1e3579b0999f1ab2fa818b588411e9ee920c
SHA256e659e687a872050f9e65d78992d16bd9b393cf3f8e8c94e0e15fb42b7065327e
SHA51217161cfc672d1b996b8af4ebac17f9a8a3807f38c9a23e2e5b4dadcd9a21c3a64faec9bf59147022a9df88b80f89300f1b537091289bd7a42806bd206a317e6e
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\Global.nmFilesize
336KB
MD56d0b653db9f44ea422ff6da077347982
SHA18d90d4266dd3e67a7be513c9bb950a833d40e7de
SHA256d2bda209032b730d45979c43d77a4a9f3db0d6e7a240a463649da32148249925
SHA512888ee79697edb666f6aad3dd1a146ae42919b261b02fed85ab36f50a1a9a2054172c7bcb6aa9cc02530353d7d0c2b83ef268cbc705d9e8df21c50e8b7a362bb6
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\Global.srFilesize
16.0MB
MD58334313ee072e8475287c133b101beee
SHA10774e278ad5d87755c418c4cd7d4a75437b56f13
SHA256a43ebb16b7bb74292b3d7f2a5535080911c70d5020b4a2b718d60863322b8228
SHA512b401b65bba0e05fb6dd110056276a90e63b9b482aa63a4ef871acca91e2852419d3a3e4a0ffe30e09926e201a809c9d32183fe13582de8622b07d471aabc34ed
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\MBAMCore.dllFilesize
6.4MB
MD59db84546ec6408e2eb7c8711df562ad5
SHA1b408a7f0c28b8ef20b1021f3211c7495b7fe9171
SHA256238162c0adab6a1611b428726c5d0b5830b553a9677bee986fc29522563e441e
SHA512a5fdf28b82a16bb512061ebc9cc128e9efdeb3bfcfe50a4c88c2256abe5c5b10f8d237d4ab7788e5eca3dccc9d20251c4ebe8a80856f7a3174d95b24d2c3c6ba
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\cfg.binFilesize
661B
MD58fd13803b1e5f14b4d241facc601a170
SHA17321eec794bc766d84d75bd0370a9f2e4d7abdf6
SHA256925d771b2643715b62ef720801dfa96047fff1ee70eabb244bed802234673717
SHA512f5b3514258487f8576fe32a795eefcffef049c7d002a6abdca17383bba838c7a218be23ec6803dcefed615f40afc2ba4b15bf65c9a74c4f6bb891d15d02bfc22
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\clean.mbdbFilesize
10KB
MD5adcb9fa4bc7e739b8b14e05131cacd30
SHA1d8bd8fab734284d00b5be94dbcd34ab313c2ac48
SHA256d3193a821a20e024d502a4a3f012d09c98a241ed8bb0168d659a9c1a1af1a535
SHA51270e6a26c88883374d9f4fd306cdb9d9daf1ac3bb5f0fe078d890984e01c0fe801a267b02304d4cb17dd31918e243847812fc909f26fcaa51fefe90626bf47361
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\dbmanifest2.datFilesize
924B
MD520250b3d83fd1358b13314feb60620f8
SHA1c824c9aa7c16e385e0c7423b5faa3da91f1344e2
SHA2567679669e6bf77e6111f5a196a9ecc5beae350fa9ca470f4c3809b45ac8fa2ee4
SHA5121a97a4502c8521849cd1d830ae8bc4ca5f6ec15049b77fc42393bcbce57b73a750df10e1ca3f0e1ea588268501bef81881364d63c24aac7b78231ea9e4c0e30b
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\dynconfig.datFilesize
39KB
MD510f23e7c8c791b91c86cd966d67b7bc7
SHA13f596093b2bc33f7a2554818f8e41adbbd101961
SHA256008254ca1f4d6415da89d01a4292911de6135b42833156720a841a22685765dc
SHA5122d1b21371ada038323be412945994d030ee8a9007db072484724616c8597c6998a560bc28886ebf89e2c8919fb70d76c98338d88832351823027491c98d48118
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\exclusions.txtFilesize
23KB
MD5aef4eca7ee01bb1a146751c4d0510d2d
SHA15cf2273da41147126e5e1eabd3182f19304eea25
SHA2569e87e4c9da3337c63b7f0e6ed0eb71696121c74e18a5da577215e18097715e2f
SHA512d31d21e37b0048050b19600f8904354cff3f3ec8291c5a7a54267e14af9fb88dfb6d11e74a037cc0369ade8a8fb9b753861f3b3fb2219563e8ec359f66c042db
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\ig.exeFilesize
1.8MB
MD5d5805286cda5b56039dd2a2d936d4be0
SHA164ba00ec017bbb0d5c9ca4c4ce157808e76c8045
SHA256e6f775537b67e3dd2afcd8700a2a4b75632f14e5a276b1ccfe859996d8bc4850
SHA5124d7575e45eb8a554a38df752ba0653d96da6d52d570356f8803a94656f0777c473268efbcd9350f12ab901781f395e7b0212f8f8e099b6e4582ceb34ede3a5a3
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\mbdigsig2.datFilesize
514B
MD5aeeb9145095aee238fa345ce96d1f49c
SHA14df1b0f5decd16f2c0e36b98e92d461f2e97d30d
SHA256f8ab6808cb85caaeaeae58fbd2f1a9d2906a574631a73ea8ce2bc2c337f60e75
SHA51274502ea59b1c6a4d3f1df53d8aaff90520ad4956700cff3e2a0dcc744f4084216fc74bd217626b277155fd000abaabd30f4cc16c1285a415fe9e2ee1e46858a8
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\prot.mbdbFilesize
24B
MD5546d9e30eadad8b22f5b3ffa875144bf
SHA13b323ffef009bfe0662c2bd30bb06af6dfc68e4d
SHA2566089fbf0c0c1413f62e91dc9497bedc6d8a271e9dc761e20adc0dccf6f4a0c1f
SHA5123478f5dcf7af549dd6fe48ad714604200de84a90120b16a32233b6d44fa7240f5f4e5fe803f54b86bbdfd10fa1bfdd88fb85eb6a78e23e426933f98d0a2565ec
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\rdefs.mbdbFilesize
24B
MD52f7423ca7c6a0f1339980f3c8c7de9f8
SHA1102c77faa28885354cfe6725d987bc23bc7108ba
SHA256850a4ea37a0fd6f68bf95422d502b2d1257264eb90cc38c0a3b1b95aa375be55
SHA512e922ac8a7a2cde6d387f8698207cf5efbd45b646986a090e3549d97a7d552dd74179bd7ac20b7d246ca49d340c4c168982c65b4749df760857810b2358e7eb69
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\rules.mbdbFilesize
9.0MB
MD59a20739b3cca4b23e86755a564bd56e0
SHA1b38e885162039220923e9a4c160021a1549081f5
SHA2569173a8767615833cd9448eac4edf924f55fce4bdd511d8937cf63e26f4477c90
SHA51218baf591ccfccd6b06e26b8c3d7e050700eb17e048316ec34633a22a81a19ef9d225c8b006658b969462e45e810b9ab6ae10b2d83ad866d1398b256771fadde3
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\sample.dllFilesize
529KB
MD5ad6c596fba0e2968c57243a106f9ccc9
SHA12241116bbe1f33ff30cdf26ebc57af85136675f8
SHA2560ccb163eab06671bdc74fa03ec1208d66105960254cf1f9cad584300676c4eb3
SHA5128730556b3beef30296443aa1be1f538a12cbf34dbaa4cd722b269b24f639f599c51970959095b6a5a78bfa8e40cf5f85af64dd637391e5a24fa6dc9b1e6fcaf5
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\scan.mbdbFilesize
1018KB
MD5269ef223b7919ca972577657d3d33d85
SHA11a1eb8ca370beaee913715b1f4b6b8aa53fc4b2a
SHA2564447c30c097ce4276abadc515b94a6f4ad246884fbf64b7dd8ca45246679a6bc
SHA5126358d168e868151e7ef960e1cd9112eca25739bed0be81826ed29b132499ae31fa34d7eb679b40ea3b5a6f60da81735e770133dcfd6cfb0d0553b6c64b606ffb
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\tids.mbdbFilesize
177KB
MD5f0eb4779a5dade2efa5229c33abb4910
SHA141d2c8cdbd8e306a263fe419bb2c1c19514524e9
SHA2569c5242e6c567e641bb10412cd966b81819984ea643ba96222ee0b256b3f53955
SHA5126883622d693265b824d1cb65fe6d9a66d99bc8d167981fa4f0054c7513020361ec09b2c75f62a8afa85dcea175914a4c8f4872ec7040722dcaf7375886bdbd84
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\wprot2.mbdbFilesize
40.5MB
MD511ad702b34346889d5fd70a9f875faff
SHA14a6952107ba24777d90c06b5528f05f45705ce90
SHA2562dc77eb6a488751757a6779b003dee922526000b38ee1d1fb3fe3266079cceea
SHA5123088130d7d57a317a2a38d3a69876f53cd3bca34df3c8ef791bf10fa17156cf811a897fc8e68f3d1fcdcee6a85600668b1c0a0bbece59dbf7fb10f42d76d69bd
-
C:\ProgramData\Malwarebytes\MBAMService\pkgvers.datFilesize
74B
MD5a8340860b065dae8f93853f85bd57787
SHA151e240bcad31e46e8378d94c02847fe7981002f3
SHA256bd6c9fc63887a8687290c2e42aff7380b029b73c56f0fec51740b166380e2aa5
SHA512cc849320c2f19358caa5be539bd65e539db9a55c3e5e83917eb50809c3ec369bf3f6e693d49344338805eb9582008c194721b0183d9b12172a9eb14c72a33b0d
-
C:\Users\Admin\AppData\Local\Temp\mbam\qt-jl-icons\21812d1e0b0.icoFilesize
4KB
MD591a74c169917bee7cb2c8ef9dc74ecbe
SHA18633b44ae58c4b201078114d925f551b36c549b0
SHA2561e5eaee00708bb44d5d053ee25da5b273ad855b7f49456268dcdebac5d5d5710
SHA512d5274c14e4f1aa99d5ead0cafa5f42fad074092944d6f48c3fb0cc6a311f958f97e23fdeba3c5639fae0751f692f9e5f85dd065baf2638291f2ba2a42c4afb72
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\a712c324879904b1.customDestinations-msFilesize
3KB
MD5b09a740762f49d6cfaf3ef7db6368879
SHA15c9b3cbb6bc85beb903f6c1bf2db40073cb56aff
SHA2563c6a439550ec7a7bb3a62d47978e0ac9be6636b932bca5c7480cf8ec103312db
SHA512dec1775a13b356a8974ccd70ed1f9c61a4472347cb120456f09e365907a3d76c20e99ae2390d0bb491c02308cb4d6999617fcc716c05e78f34e626339a6ee591
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\a712c324879904b1.customDestinations-msFilesize
6KB
MD5ec57f8cffb77ae1e455e384fb83ee0ab
SHA1aa717c405450ca6f6e0c829d76aa0dcdef7dc92e
SHA256312f15f5f2e30eb9c8b4c5e115fd537909face08576be596fe689ebb897f53b0
SHA512db512a496832aebb7f90d110a0e1627d2506dfc6f60d3861abd83e9537c96434d4adf692fa483f2d04b42ec6dce8b832e34b08be402ec7870cf4d1b1d4865d9c
-
C:\Windows\System32\CatRoot2\dberr.txtFilesize
187KB
MD5f191cad9dc52b86fe2803c3f0883f8dd
SHA11c0b46f3972d4a6500ddd16292ce15defa6ad489
SHA25649445d05bea7222781a7dbec7051c95ac6234869c8adcc6c9666bec2933be174
SHA5128d02006370d553d79133e95fdde067c412888ad30426b6c1f6a8253febf95a1a6763c4a2a6e78a2deaea0e949ccfa7ba4d6e4a04e162f4475a35c222f893cdd6
-
C:\Windows\System32\catroot2\dberr.txtFilesize
188KB
MD5d9690ee259efa97956a07fdcfed2aa37
SHA1ee494a72f115e8c3f4f9e6644c0cd9854b5de123
SHA25693387816e3bd228d60098eab9d844ab67a31e07684c406deb82e2981f64643c8
SHA51273e429ad3c20da3841629beb7f6aa1e6fe941ef5bf38826541057adc7e8faed8b2f45f7f889f4ffc9d97292539c34e23831a2be0a0a041b71565a4e9348633a0
-
C:\Windows\Temp\MBInstallTemp8d9a2552774e11eeae1dd6ecf92ef593\ctlrpkg\mbae64.sysFilesize
154KB
MD595515708f41a7e283d6725506f56f6f2
SHA19afc20a19db3d2a75b6915d8d9af602c5218735e
SHA256321058a27d7462e55e39d253ad5d8b19a9acf754666400f82fe0542f33e733c6
SHA512d9230901adeecb13b1f92287abe9317cdac458348885b96ef6500960793a7586c76ae374df053be948a35b44abe934aa853975a6ccd3788f93909903cc718c08
-
C:\Windows\Temp\MBInstallTemp8d9a2552774e11eeae1dd6ecf92ef593\servicepkg\MBAMService.exeFilesize
8.9MB
MD503948ad78f44b840ec2296a0fbb9f2fc
SHA1a4c04a502746af80894c13de707bd0282388e12e
SHA2568ffd82021f35885627bbf5a0a55a51963e7e37c5a5d636466e244fa64ad94d65
SHA51235b39c9f7da64a22d4bc8aed88b36bf3d69bb2d45d0ddb360fc909c943d61e067e77da5b54c64406fa7af883b9bd798100193fae2eb790fb304037a6df4d47ee
-
C:\Windows\Temp\MBInstallTemp8d9a2552774e11eeae1dd6ecf92ef593\servicepkg\mbamelam.catFilesize
10KB
MD560608328775d6acf03eaab38407e5b7c
SHA19f63644893517286753f63ad6d01bc8bfacf79b1
SHA2563ed5a1668713ef80c2b5599b599f1434ad6648999f335cf69757ea3183c70c59
SHA5129f65212121b8a5d1a0625c3baa14ef04a33b091d26f543324333e38dcdb903e02ccc4d009e22c2e85d2f61d954e0b994c2896e52f685003a6ef34758f8a650c7
-
C:\Windows\Temp\MBInstallTemp8d9a2552774e11eeae1dd6ecf92ef593\servicepkg\mbamelam.infFilesize
2KB
MD5c481ad4dd1d91860335787aa61177932
SHA181633414c5bf5832a8584fb0740bc09596b9b66d
SHA256793626d240fd8eefc81b78a57c8dfe12ea247889b6f07918e9fd32a7411aa1c3
SHA512d292e028936412f07264837d4a321ecfa2f5754d4048c8bcf774a0e076e535b361c411301558609d64c71c1ce9b19e6041efa44d201237a7010c553751e1e830
-
C:\Windows\Temp\MBInstallTemp8d9a2552774e11eeae1dd6ecf92ef593\servicepkg\mbamelam.sysFilesize
20KB
MD59e77c51e14fa9a323ee1635dc74ecc07
SHA1a78bde0bd73260ce7af9cdc441af9db54d1637c2
SHA256b5619d758ae6a65c1663f065e53e6b68a00511e7d7accb3e07ed94bfd0b1ede0
SHA512a12ccf92bead694f5d3cba7ff7e731a2f862198efc338efc7f33a882fe0eb7499fb3fb533538d0a823e80631a7ca162962fbdfd78e401e3255672910b7140186
-
C:\Windows\Temp\MBInstallTemp8d9a2552774e11eeae1dd6ecf92ef593\servicepkg\mbshlext.dllFilesize
2.7MB
MD5b7e5071b317550d93258f7e1e13e7b6f
SHA12d08d78a5c29cf724bc523530d1a9014642bbc60
SHA256467de01d7cee7ec54166b80658ff22f9feebdb1c24eaf1629cf40e4124508064
SHA5129c35293c95c1a9141740ac99315605964aa37c4a42d3a11cae9e5649ff1427a9480d3d5e7f763212cf13db3511c5ea3c84e68f95f0067fe6339a9d3fb7b27c54
-
C:\Windows\Temp\MBInstallTemp8d9a2552774e11eeae1dd6ecf92ef593\uipkg\QtQuick\Controls.2\HorizontalHeaderView.qmlFilesize
1KB
MD5d8c9674c0e9bddbd8aa59a9d343cf462
SHA1490aa022ac31ddce86d5b62f913b23fbb0de27c2
SHA2561ef333b5fb4d8075973f312ef787237240b9f49f3f9185fb21202883f900e7d7
SHA5120b86ec673133f6400c38b79f9ba4f7b37ce5afdab1a2e34acbf75019e2590cc26b26d323ddc1567c91375053c9c8593be0615389db8eb1a8d1eb084ad4200b82
-
C:\Windows\Temp\MBInstallTemp8d9a2552774e11eeae1dd6ecf92ef593\uipkg\QtQuick\Controls.2\Imagine\VerticalHeaderView.qmlFilesize
1KB
MD5829769b2741d92df3c5d837eee64f297
SHA1f61c91436ca3420c4e9b94833839fd9c14024b69
SHA256489c02f8716e7a1de61834b3d8bbb61bce91ca4a33a6b62342b4c851d93e51e0
SHA5124061c271db37523b9dea9a9973226d91337e1809d4e7767e57ac938d35d77a302363ed92ab4be18c35ba589f528194ad71c93a8507449bf74dd035acf7cdb521
-
\Program Files\Malwarebytes\Anti-Malware\7z.dllFilesize
1.7MB
MD5461faf68ccc02b0223fd273b630f21fe
SHA1363b8beaa74f0f454c2d544ace9e71a84bc2b4cf
SHA256cb07f3f461e9c267831b1ab93af6dfda1bb51d72e42d73d00d26594f09326be1
SHA5124b671f48e45fdedf50c7f7bb6c8d82a3b98f7502006eb002aaf8ff31f25f9ff1257c7bcc12caf622e43d4ec665b19d978ae3e3762f76def0bc71485ebdb8426f
-
\Program Files\Malwarebytes\Anti-Malware\Actions.dllFilesize
5.0MB
MD51eff53d95ecaf6bbfffe80d866d8e1dd
SHA1d7ef7d7c77fd04b2c0eb8c16bb3cd08057f6742f
SHA2566dd748f7ca56125cbe158fa3612f08e7312ef58ad5375e6b7ab5532cc16ca0ac
SHA512c59b8e6f0b238a247e64b9c7bb42213dadac1dada63542830a6292361174c935c0c662b2d1aed3fb6100cc4993297b1eaf25e328f2b4613458c4ffca63b9f02d
-
\Program Files\Malwarebytes\Anti-Malware\ActionsShim.dllFilesize
2.5MB
MD558149edf4990067b4c1ffe1c32a51a01
SHA180c0c8b8def45420159659d2eaad181eb0b05c40
SHA25667af73f9b49ce113d02d7f2824e45d48044273772c94e6e8c300cf86bf83cb55
SHA512fe69f4eccaa35b132b7dfc77fae50733398cfa5ab7377f502a50e1bb83be6b81fad26a0a24f6dfbc99dca6e118784f3452edc4a30c11ac161fc0db62b039cb4e
-
\Program Files\Malwarebytes\Anti-Malware\CleanControllerImpl.dllFilesize
6.9MB
MD573a08c403bf08e39bd560ffc74ae9b8f
SHA1888c6d11e6788875f8fca748b6f92a19b6126dc6
SHA25609d687c0164a9f108c4f9e107bfc0cb671ebe643ac9aae968cb8df0e5adda960
SHA5128b65c0549c319e9c42b30071b1342e8ba4239d9dc4a124e19abd2160339c03235f0ec534a997ec367f2b474797d33efa496e641c7a63904bf8e0af43a32f1535
-
\Program Files\Malwarebytes\Anti-Malware\CloudControllerImpl.dllFilesize
4.8MB
MD5d739c6bd5d5cae2ae961a0c2d40eb5b1
SHA116d0d40707bf55f04a0da70798b5368e612fd5e6
SHA25625472857a59a9067c1224b173b378448bb574f5365edbe4a1a46df8810007f9a
SHA5127d80a39f3a91e0faa87ae8143f43d2e8947eaedfd317a1ac1547dfa15b825cc5c200f8baebe127a0bc2379fe90c40f3ea25db09c06b521aad1c189ce24a53c7d
-
\Program Files\Malwarebytes\Anti-Malware\LicenseControllerImpl.dllFilesize
4.4MB
MD565e42cbe095830d9d93ecabb13392780
SHA1e60110e159cc4cc92d2606ae3ba3559c10170e5a
SHA256a773e1706bbb6e8cb522d0e1a3d29e496bcbe6a91e221c26bea98292b9316f7f
SHA5126b25cebb6433ec87831a3f0f67b96c7fc37a617158a18d9ac20bd375f46c97da8a41e4379da72808fdd7947705c6c09518c56152f96eebf2bcefb39ffa6202ed
-
\Program Files\Malwarebytes\Anti-Malware\MBAMShim.dllFilesize
3.0MB
MD5f44b6c80c46c4cf3071b5f5b916e1271
SHA1839f2238ecbbfa80ebf9c1f77eafc78204b58761
SHA256732523df43358729d5e85cceb557d69016dcdd3e2238d903c33c5327c3131fae
SHA51299be164ae96bc4f93dc896d5df445ad1c2f023f10605a8c9857d7ebedfc5b070f50cd33b401d61003e601a06b8446e6c0b5dbddda4927a2e1352407d3b266942
-
\Program Files\Malwarebytes\Anti-Malware\PoliciesControllerImpl.dllFilesize
4.0MB
MD5efe6216931bca54ccf05a0bcb9f83fb9
SHA1007d0a3c4d850cd9b2886b24daf91c988d702bdd
SHA256eaf71519b965b9530e84be08bd3649fdb8feeeabb8dd2455be95755a336a44d6
SHA5127c59071b6ae8d0a2d6eedcb58f6a1337aa340275bf30baa121f515241aba822f6f7bbbc53b626f5f44c424af70aef3afc582a1a8a34d0b0adef115d0e8f684f4
-
\Program Files\Malwarebytes\Anti-Malware\ScanControllerImpl.dllFilesize
5.7MB
MD5e80262b787eec69e8dd3d051a1d2840c
SHA1bbb88d699a7715d800db88679d6f7d52bf16673e
SHA256a07dbc4cc18dea7c29ea1e32c1511e846bd06ca86229b0499cbe20575937395f
SHA51216f8abc1cb48d8e7786a8add362987b0a464e0082c2bdce5ad42ed52cea1ad64cc117dc80127b5666f26d777701b1b81c178a87301be6394e8f17e5370f68789
-
\Program Files\Malwarebytes\Anti-Malware\Swissarmy.dllFilesize
4.0MB
MD53486801ce1e8ffc1bbc6d4f097b0f369
SHA108f2a85cd07cf1c0d6f27f0d5e7179c2a5cb8600
SHA25626720d0b669898089a4ab5a6c53203918ec399d227331273ba11169bbe273678
SHA51281974a79bf4e4086549874ef778e7716713a0107ccce212e9564f3355a26670943845aaba744691d2b68224e06e2f9d9a263e29f4ca7e46e1bfdb507a24656d5
-
\Program Files\Malwarebytes\Anti-Malware\SwissarmyShim.dllFilesize
2.6MB
MD589a38afcfa758e3298609c6c51929593
SHA12df1ee30adc92bd995526e41fd9c823354de30b4
SHA2564795576483af0c136a71dcee87a0ffb54f0869cae6395ac2ff8312bf555e7161
SHA512cceaed0b9a7517aebd739a377c7bd8987b9ac357be2bf987dbae31d59f2121c5bb9a9bfa2c70a9a54ad65546ef23903176dd6328d93408cb5c991257d59e2717
-
\Program Files\Malwarebytes\Anti-Malware\TelemetryControllerImpl.dllFilesize
5.3MB
MD51692937ebb8172814cfd1b2d20dac8c6
SHA13ad3b0dce9958ce66d89c280645ae827d3b89f16
SHA256f1cee1b89fff12181d828623b3aba0f0b8c0aed4aab8b0c017ea4d4731c16e32
SHA512a36462731990635f57f80c070cb01a8c4fe6fa445aad63f077197d473d0d625e23bcadaf5bf92c9504919ee69d12239a7733febf27d6016aa20c03f631b7e3e8
-
\Program Files\Malwarebytes\Anti-Malware\UpdateControllerImpl.dllFilesize
4.4MB
MD52114b71049bc4626a565fa7bef9ba37c
SHA1ca5567bd58897128a750be7db94357253321db0d
SHA256e981f1d6fdd820ad2781f0cbdc3b0715101de3257c1aab23af806f0a547dfb9e
SHA5129f97a9fdfd54072730aed98948f7b46c9667cadddc87bebb8d275b94708f11c24e618a0d169366f57b959db16e0b841e5539f5325611a4d19d3bd978a2c03427
-
\Program Files\Malwarebytes\Anti-Malware\mbshlext.dllFilesize
2.7MB
MD5b7e5071b317550d93258f7e1e13e7b6f
SHA12d08d78a5c29cf724bc523530d1a9014642bbc60
SHA256467de01d7cee7ec54166b80658ff22f9feebdb1c24eaf1629cf40e4124508064
SHA5129c35293c95c1a9141740ac99315605964aa37c4a42d3a11cae9e5649ff1427a9480d3d5e7f763212cf13db3511c5ea3c84e68f95f0067fe6339a9d3fb7b27c54
-
\Program Files\Malwarebytes\Anti-Malware\offreg.dllFilesize
114KB
MD516663d125398773a90d0a53333b7cf5e
SHA1f92928ae3c9292588547ceaca1cb1d372bfd7936
SHA25638e6811b47262101759aa51a631263d9e3eee5d211164318a751e078afec4cbc
SHA512091764b8ad80aa31eea0bbd91ee505ebdea2654bc8aeaa3081a061d0d37ab13d27dd203075fd0de10c6687591aa0e36139a38af846c4e34e6aa67ab81dc277df
-
\Windows\Temp\MBInstallTemp8d9a2552774e11eeae1dd6ecf92ef593\7z.dllFilesize
1.6MB
MD5ab8f0c1a37c0df5c8924aab509db42c9
SHA153dba959124e6d740829bda2360e851bcb85cce8
SHA2566e223b275b84d948cc5ae1f161f0bfff2adb34de04634c84d7dbe9305a4998d5
SHA512ff8a26e8fd5a08c74e5ba93a564e0d3cd932754e7f06993a365bfad06670497889e69ec45bfba1378040b72f82d468e79682beba2439937bb29d2a41da940d4a
-
\Windows\Temp\MBInstallTemp8d9a2552774e11eeae1dd6ecf92ef593\7z.dllFilesize
1.6MB
MD5ab8f0c1a37c0df5c8924aab509db42c9
SHA153dba959124e6d740829bda2360e851bcb85cce8
SHA2566e223b275b84d948cc5ae1f161f0bfff2adb34de04634c84d7dbe9305a4998d5
SHA512ff8a26e8fd5a08c74e5ba93a564e0d3cd932754e7f06993a365bfad06670497889e69ec45bfba1378040b72f82d468e79682beba2439937bb29d2a41da940d4a
-
memory/3516-4078-0x0000020B62900000-0x0000020B62B00000-memory.dmpFilesize
2.0MB
-
memory/3516-4076-0x0000020B624C0000-0x0000020B62900000-memory.dmpFilesize
4.2MB
-
memory/3516-4075-0x0000020B61CC0000-0x0000020B61CD0000-memory.dmpFilesize
64KB
-
memory/3516-4073-0x00007FFC34EE0000-0x00007FFC352FE000-memory.dmpFilesize
4.1MB
-
memory/3516-4074-0x00007FFC34970000-0x00007FFC34EDB000-memory.dmpFilesize
5.4MB
-
memory/5448-4648-0x0000021818A40000-0x0000021818A41000-memory.dmpFilesize
4KB
-
memory/5448-4662-0x0000021818A60000-0x0000021818A62000-memory.dmpFilesize
8KB
-
memory/5448-4663-0x0000021818A60000-0x0000021818A62000-memory.dmpFilesize
8KB
-
memory/5448-4665-0x0000021818A70000-0x0000021818A72000-memory.dmpFilesize
8KB
-
memory/5448-4666-0x0000021818A60000-0x0000021818A62000-memory.dmpFilesize
8KB
-
memory/5448-4667-0x0000021818A40000-0x0000021818A41000-memory.dmpFilesize
4KB
-
memory/5448-4668-0x0000021818A40000-0x0000021818A41000-memory.dmpFilesize
4KB
-
memory/5448-4669-0x0000021817FE0000-0x0000021817FE1000-memory.dmpFilesize
4KB
-
memory/5448-4670-0x0000021818A40000-0x0000021818A41000-memory.dmpFilesize
4KB
-
memory/5448-4671-0x0000021818A60000-0x0000021818A62000-memory.dmpFilesize
8KB
-
memory/5448-4672-0x0000021817FE0000-0x0000021817FE1000-memory.dmpFilesize
4KB
-
memory/5448-4673-0x0000021818A70000-0x0000021818A72000-memory.dmpFilesize
8KB
-
memory/5448-4675-0x0000021818A80000-0x0000021818A81000-memory.dmpFilesize
4KB
-
memory/5448-4677-0x0000021818A90000-0x0000021818A91000-memory.dmpFilesize
4KB
-
memory/5448-4678-0x0000021818A80000-0x0000021818A81000-memory.dmpFilesize
4KB
-
memory/5448-4679-0x0000021818A90000-0x0000021818A91000-memory.dmpFilesize
4KB
-
memory/5448-4680-0x0000021818A70000-0x0000021818A72000-memory.dmpFilesize
8KB
-
memory/5448-4681-0x0000021818A90000-0x0000021818A91000-memory.dmpFilesize
4KB
-
memory/5448-4683-0x0000021817FE0000-0x0000021817FE1000-memory.dmpFilesize
4KB
-
memory/5448-4682-0x0000021818A90000-0x0000021818A91000-memory.dmpFilesize
4KB
-
memory/5448-4684-0x0000021817FE0000-0x0000021817FE1000-memory.dmpFilesize
4KB
-
memory/5448-4687-0x0000021818AA0000-0x0000021818AA1000-memory.dmpFilesize
4KB
-
memory/5448-4686-0x0000021818AA0000-0x0000021818AA1000-memory.dmpFilesize
4KB
-
memory/5448-4688-0x0000021817FE0000-0x0000021817FE1000-memory.dmpFilesize
4KB
-
memory/5448-4690-0x0000021817FE0000-0x0000021817FE1000-memory.dmpFilesize
4KB
-
memory/5448-4689-0x0000021818A90000-0x0000021818A91000-memory.dmpFilesize
4KB
-
memory/5448-4691-0x0000021818AA0000-0x0000021818AA1000-memory.dmpFilesize
4KB
-
memory/5448-4693-0x0000021818AA0000-0x0000021818AA1000-memory.dmpFilesize
4KB
-
memory/5448-4692-0x0000021817FE0000-0x0000021817FE1000-memory.dmpFilesize
4KB
-
memory/5448-4661-0x0000021818A60000-0x0000021818A62000-memory.dmpFilesize
8KB
-
memory/5448-4660-0x0000021817FE0000-0x0000021817FE1000-memory.dmpFilesize
4KB
-
memory/5448-4657-0x0000021818A40000-0x0000021818A41000-memory.dmpFilesize
4KB
-
memory/5448-4658-0x0000021818A40000-0x0000021818A41000-memory.dmpFilesize
4KB
-
memory/5448-4655-0x0000021817FD0000-0x0000021817FD1000-memory.dmpFilesize
4KB
-
memory/5448-4656-0x0000021817FD0000-0x0000021817FD1000-memory.dmpFilesize
4KB
-
memory/5448-4654-0x0000021817FD0000-0x0000021817FD1000-memory.dmpFilesize
4KB
-
memory/5448-4653-0x0000021817FD0000-0x0000021817FD1000-memory.dmpFilesize
4KB
-
memory/5448-4652-0x0000021817FD0000-0x0000021817FD1000-memory.dmpFilesize
4KB
-
memory/5448-4650-0x0000021818A40000-0x0000021818A41000-memory.dmpFilesize
4KB
-
memory/5448-4649-0x0000021818A40000-0x0000021818A41000-memory.dmpFilesize
4KB
-
memory/5448-4647-0x0000021818A40000-0x0000021818A41000-memory.dmpFilesize
4KB
-
memory/5448-4646-0x0000021818A40000-0x0000021818A41000-memory.dmpFilesize
4KB
-
memory/5448-4645-0x0000021818A40000-0x0000021818A41000-memory.dmpFilesize
4KB
-
memory/5448-4643-0x0000021818A40000-0x0000021818A41000-memory.dmpFilesize
4KB
-
memory/5448-4644-0x0000021818A40000-0x0000021818A41000-memory.dmpFilesize
4KB
-
memory/5448-5118-0x0000021812A50000-0x0000021812A60000-memory.dmpFilesize
64KB
-
memory/5448-4255-0x0000021812A50000-0x0000021812A60000-memory.dmpFilesize
64KB
-
memory/5448-4185-0x0000021812A50000-0x0000021812A60000-memory.dmpFilesize
64KB
-
memory/5448-4180-0x00007FF7E4300000-0x00007FF7E59BA000-memory.dmpFilesize
22.7MB
-
memory/5448-4182-0x00007FFC34970000-0x00007FFC34EDB000-memory.dmpFilesize
5.4MB
-
memory/5448-4181-0x00007FFC34EE0000-0x00007FFC352FE000-memory.dmpFilesize
4.1MB