Analysis
-
max time kernel
510s -
max time network
516s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
30-10-2023 18:02
Static task
static1
Behavioral task
behavioral1
Sample
MBSetup.exe
Resource
win10-20231023-en
Behavioral task
behavioral2
Sample
MBSetup.exe
Resource
win10v2004-20231023-en
Errors
General
-
Target
MBSetup.exe
-
Size
2.5MB
-
MD5
1e885823577394ea61ea89438ffe2954
-
SHA1
e53e96f7374790bdad8a614949b398b055c3a27b
-
SHA256
7c0b9bceed390f7f28135431c09ac51469ee8e2b8095fb36a37315d811d9ba9c
-
SHA512
73f600833dad0047b6444110d722dc95237b38bb486abc7fc8e4f59b69e2154c885fb46d65f488d5139a0b6e76ebde33ea72711c7f58436650ef992fb8995627
-
SSDEEP
49152:Lw3ye9SPQ1sjDAVj+JeRanStQyfvE0Z3R0nxiIq2ddAsuysSiSF:4yeoCVj+c6KtQRq2ADSiSF
Malware Config
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
MBSetup.exedescription pid process target process PID 1648 created 3284 1648 MBSetup.exe Explorer.EXE -
Downloads MZ/PE file
-
Drops file in Drivers directory 12 IoCs
Processes:
MBAMService.exeMBAMService.exeMBAMInstallerService.exeMBSetup.exedescription ioc process File opened for modification C:\Windows\system32\DRIVERS\MbamElam.sys MBAMService.exe File created C:\Windows\system32\DRIVERS\SET11DD.tmp MBAMService.exe File opened for modification C:\Windows\system32\DRIVERS\MbamChameleon.sys MBAMService.exe File created C:\Windows\system32\drivers\mbae64.sys MBAMInstallerService.exe File created C:\Windows\system32\DRIVERS\MbamElam.sys MBAMService.exe File created C:\Windows\system32\DRIVERS\SET9FC.tmp MBAMService.exe File opened for modification C:\Windows\system32\DRIVERS\mbamswissarmy.sys MBAMService.exe File opened for modification C:\Windows\system32\DRIVERS\SETD19.tmp MBAMService.exe File created C:\Windows\system32\DRIVERS\SETD19.tmp MBAMService.exe File opened for modification C:\Windows\system32\DRIVERS\SET11DD.tmp MBAMService.exe File created C:\Windows\SysWOW64\drivers\mbamtestfile.dat MBSetup.exe File opened for modification C:\Windows\system32\DRIVERS\SET9FC.tmp MBAMService.exe -
Modifies RDP port number used by Windows 1 TTPs
-
Sets service image path in registry 2 TTPs 2 IoCs
Processes:
MBAMService.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MBAMSwissArmy\ImagePath = "\\SystemRoot\\System32\\Drivers\\mbamswissarmy.sys" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MBAMChameleon\ImagePath = "\\SystemRoot\\System32\\Drivers\\MbamChameleon.sys" MBAMService.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
MBSetup.exeMBAMService.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate MBSetup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion MBAMService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate MBAMService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion MBSetup.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
MBAMService.exeMBAMInstallerService.exedescription ioc process File opened (read-only) \??\M: MBAMService.exe File opened (read-only) \??\Q: MBAMService.exe File opened (read-only) \??\V: MBAMService.exe File opened (read-only) \??\H: MBAMInstallerService.exe File opened (read-only) \??\R: MBAMInstallerService.exe File opened (read-only) \??\B: MBAMService.exe File opened (read-only) \??\S: MBAMService.exe File opened (read-only) \??\E: MBAMInstallerService.exe File opened (read-only) \??\J: MBAMInstallerService.exe File opened (read-only) \??\U: MBAMInstallerService.exe File opened (read-only) \??\O: MBAMService.exe File opened (read-only) \??\P: MBAMService.exe File opened (read-only) \??\Z: MBAMService.exe File opened (read-only) \??\G: MBAMInstallerService.exe File opened (read-only) \??\L: MBAMInstallerService.exe File opened (read-only) \??\M: MBAMInstallerService.exe File opened (read-only) \??\O: MBAMInstallerService.exe File opened (read-only) \??\S: MBAMInstallerService.exe File opened (read-only) \??\V: MBAMInstallerService.exe File opened (read-only) \??\N: MBAMService.exe File opened (read-only) \??\R: MBAMService.exe File opened (read-only) \??\P: MBAMInstallerService.exe File opened (read-only) \??\X: MBAMInstallerService.exe File opened (read-only) \??\A: MBAMService.exe File opened (read-only) \??\J: MBAMService.exe File opened (read-only) \??\L: MBAMService.exe File opened (read-only) \??\Y: MBAMService.exe File opened (read-only) \??\A: MBAMInstallerService.exe File opened (read-only) \??\B: MBAMInstallerService.exe File opened (read-only) \??\K: MBAMInstallerService.exe File opened (read-only) \??\G: MBAMService.exe File opened (read-only) \??\I: MBAMService.exe File opened (read-only) \??\N: MBAMInstallerService.exe File opened (read-only) \??\K: MBAMService.exe File opened (read-only) \??\X: MBAMService.exe File opened (read-only) \??\I: MBAMInstallerService.exe File opened (read-only) \??\W: MBAMInstallerService.exe File opened (read-only) \??\Y: MBAMInstallerService.exe File opened (read-only) \??\Z: MBAMInstallerService.exe File opened (read-only) \??\E: MBAMService.exe File opened (read-only) \??\H: MBAMService.exe File opened (read-only) \??\T: MBAMService.exe File opened (read-only) \??\U: MBAMService.exe File opened (read-only) \??\W: MBAMService.exe File opened (read-only) \??\Q: MBAMInstallerService.exe File opened (read-only) \??\T: MBAMInstallerService.exe -
Drops file in System32 directory 2 IoCs
Processes:
MBAMService.exeMBAMService.exedescription ioc process File opened for modification C:\Windows\System32\CatRoot2\dberr.txt MBAMService.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt MBAMService.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 64 IoCs
Processes:
MBAMInstallerService.exeMBSetup.exedescription ioc process File created C:\Program Files\Malwarebytes\Anti-Malware\api-ms-win-crt-environment-l1-1-0.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\api-ms-win-crt-filesystem-l1-1-0.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtWinExtras\JumpListLink.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtCharts\qmldir MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\SplitView.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Dialog.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\MwacLib.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\StackViewDelegate.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Material\CheckDelegate.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\ScrollView.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\abdc47ce-7033-417b-be32-ca7048da0c13 MBSetup.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Base\HandleStyleHelper.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Base\TreeViewStyle.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\TreeView.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Imagine\SwitchDelegate.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Material\plugins.qmltypes MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Material\SwitchDelegate.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Templates.2\plugins.qmltypes MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\languages\lang_nl.qm MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\XmlListModel\plugins.qmltypes MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\Qt5WebEngineCore.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\resources\qtwebengine_resources.pak MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\mbamsisdk.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\RoundButton.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Universal\Dialog.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\RTPControllerImpl.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\ProgressBar.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\qmldir MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Material\SpinBox.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\msvcp140.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\imageformats\qjpeg.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Private\EditMenu.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Base\BasicTableViewStyle.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Flat\plugins.qmltypes MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Imagine\Label.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Imagine\qtquickcontrols2imaginestyleplugin.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Material\StackView.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\languages\lang_hr.qm MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Extras\qmldir MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\pkgvers.dat MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Universal\RadioIndicator.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\api-ms-win-core-datetime-l1-1-0.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Base\images\scrollbar-handle-horizontal.png MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Fusion\TextField.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Imagine\Button.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\sentrynativesdk.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\Qt5WinExtras.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Imagine\DelayButton.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Imagine\Page.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Material\ScrollBar.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\MenuBarItem.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Page.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Universal\VerticalHeaderView.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\LicenseControllerImpl.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Base\images\knob.png MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Private\ScrollBar.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\languages\lang_pt_BR.qm MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\Qt5Qml.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\imageformats\qsvg.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Private\StackViewSlideDelegate.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Base\images\[email protected] MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Base\images\spinner_medium.png MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Material\Frame.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\6708818b774f11ee83b5cabe9d8e8911 MBAMInstallerService.exe -
Drops file in Windows directory 1 IoCs
Processes:
MBAMService.exedescription ioc process File opened for modification C:\Windows\security\logs\scecomp.log MBAMService.exe -
Executes dropped EXE 5 IoCs
Processes:
MBAMInstallerService.exeMBAMService.exeMBAMService.exembamtray.exembam.exepid process 4156 MBAMInstallerService.exe 3992 MBAMService.exe 4388 MBAMService.exe 4088 mbamtray.exe 1376 mbam.exe -
Loads dropped DLL 64 IoCs
Processes:
MBAMInstallerService.exeMBAMService.exembamtray.exembam.exepid process 4156 MBAMInstallerService.exe 4156 MBAMInstallerService.exe 4388 MBAMService.exe 4388 MBAMService.exe 4388 MBAMService.exe 4388 MBAMService.exe 4388 MBAMService.exe 4388 MBAMService.exe 4388 MBAMService.exe 4388 MBAMService.exe 4388 MBAMService.exe 4388 MBAMService.exe 4388 MBAMService.exe 4388 MBAMService.exe 4388 MBAMService.exe 4388 MBAMService.exe 4388 MBAMService.exe 4388 MBAMService.exe 4388 MBAMService.exe 4388 MBAMService.exe 4388 MBAMService.exe 4388 MBAMService.exe 4388 MBAMService.exe 4388 MBAMService.exe 4388 MBAMService.exe 4388 MBAMService.exe 4156 MBAMInstallerService.exe 4088 mbamtray.exe 4088 mbamtray.exe 4088 mbamtray.exe 4088 mbamtray.exe 4088 mbamtray.exe 4088 mbamtray.exe 4088 mbamtray.exe 4088 mbamtray.exe 4088 mbamtray.exe 4088 mbamtray.exe 4088 mbamtray.exe 4088 mbamtray.exe 4088 mbamtray.exe 4088 mbamtray.exe 4088 mbamtray.exe 4088 mbamtray.exe 4088 mbamtray.exe 4088 mbamtray.exe 4088 mbamtray.exe 4088 mbamtray.exe 1376 mbam.exe 1376 mbam.exe 1376 mbam.exe 1376 mbam.exe 1376 mbam.exe 1376 mbam.exe 1376 mbam.exe 1376 mbam.exe 1376 mbam.exe 1376 mbam.exe 1376 mbam.exe 1376 mbam.exe 1376 mbam.exe 1376 mbam.exe 1376 mbam.exe 1376 mbam.exe 1376 mbam.exe -
Registers COM server for autorun 1 TTPs 64 IoCs
Processes:
MBAMService.exeMBAMService.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E1AC7139-D1FF-4DE9-84A4-92E2B47F5D2A}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE8A9269-9E6E-4683-BCD3-41E9B16696DC}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D5599B6B-FA0C-45B5-8309-853B003EA412}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9DAB0CA5-AE19-41AE-955C-41DD44C52697}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F36AD0D0-B5F0-4C69-AF08-603D177FEF0E}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{278637DA-FDFB-45C7-8CD8-F2D8A9199AB0}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D372F21-E6DA-4B82-881A-79F6CA6B6AE1}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E1AC7139-D1FF-4DE9-84A4-92E2B47F5D2A}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{580243BF-3CEE-4131-A599-C6FED66BEB1B}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE8A9269-9E6E-4683-BCD3-41E9B16696DC}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{17BE78EE-B40A-4B9E-835F-38EC62F9D479}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F6D29500-933C-447C-9D88-9D814AF73808}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F6D29500-933C-447C-9D88-9D814AF73808}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F6D29500-933C-447C-9D88-9D814AF73808}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{376BE474-56D4-4177-BB4E-5610156F36C8}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9DAB0CA5-AE19-41AE-955C-41DD44C52697}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{278637DA-FDFB-45C7-8CD8-F2D8A9199AB0}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{11D1E5E8-14E1-4B5B-AE1A-2678CB91E8E5}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BF474111-9116-45C6-AF53-209E64F1BB53}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{251AD013-20AD-4C3F-8FE2-F66A429B4819}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D372F21-E6DA-4B82-881A-79F6CA6B6AE1}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36A65E46-6CC1-4CA2-B51E-F4DD8C993DDC}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F415899A-1576-4C8B-BC9F-4854781F8A20}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{278637DA-FDFB-45C7-8CD8-F2D8A9199AB0}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{580243BF-3CEE-4131-A599-C6FED66BEB1B}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{130CD414-6BFD-4F6C-9362-A2264B222E76}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{03141A2A-5C3A-458E-ABEC-0812AD7FF497}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57CE581A-0CB6-4266-9CA0-19364C90A0B3}\InprocServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{251AD013-20AD-4C3F-8FE2-F66A429B4819}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{03141A2A-5C3A-458E-ABEC-0812AD7FF497}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{F36AD0D0-B5F0-4C69-AF08-603D177FEF0E}\LOCALSERVER32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{11D1E5E8-14E1-4B5B-AE1A-2678CB91E8E5}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F1C46F8-E697-4175-B240-CDE682A4BA2D}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{130CD414-6BFD-4F6C-9362-A2264B222E76}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DE03E614-112D-43E0-8E15-E7236CC32108}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57CE581A-0CB6-4266-9CA0-19364C90A0B3}\InprocServer32\ThreadingModel = "Apartment" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F415899A-1576-4C8B-BC9F-4854781F8A20}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{580243BF-3CEE-4131-A599-C6FED66BEB1B}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{03141A2A-5C3A-458E-ABEC-0812AD7FF497}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36A65E46-6CC1-4CA2-B51E-F4DD8C993DDC}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DE03E614-112D-43E0-8E15-E7236CC32108}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9DAB0CA5-AE19-41AE-955C-41DD44C52697}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57CE581A-0CB6-4266-9CA0-19364C90A0B3}\InprocServer32\ = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbshlext.dll" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F415899A-1576-4C8B-BC9F-4854781F8A20}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F1C46F8-E697-4175-B240-CDE682A4BA2D}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{11D1E5E8-14E1-4B5B-AE1A-2678CB91E8E5}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BF474111-9116-45C6-AF53-209E64F1BB53}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F36AD0D0-B5F0-4C69-AF08-603D177FEF0E}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F1C46F8-E697-4175-B240-CDE682A4BA2D}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E1AC7139-D1FF-4DE9-84A4-92E2B47F5D2A}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{17BE78EE-B40A-4B9E-835F-38EC62F9D479}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F36AD0D0-B5F0-4C69-AF08-603D177FEF0E}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BF474111-9116-45C6-AF53-209E64F1BB53}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D372F21-E6DA-4B82-881A-79F6CA6B6AE1}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{130CD414-6BFD-4F6C-9362-A2264B222E76}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE8A9269-9E6E-4683-BCD3-41E9B16696DC}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D5599B6B-FA0C-45B5-8309-853B003EA412}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D5599B6B-FA0C-45B5-8309-853B003EA412}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DE03E614-112D-43E0-8E15-E7236CC32108}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{376BE474-56D4-4177-BB4E-5610156F36C8}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{376BE474-56D4-4177-BB4E-5610156F36C8}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{251AD013-20AD-4C3F-8FE2-F66A429B4819}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{17BE78EE-B40A-4B9E-835F-38EC62F9D479}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36A65E46-6CC1-4CA2-B51E-F4DD8C993DDC}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
MBAMService.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MBAMService.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MBAMService.exe -
Processes:
MBAMInstallerService.exeMBAMService.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\mbamtray.exe = "11000" MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION MBAMService.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\mbam.exe = "11000" MBAMService.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\mbamtray.exe = "11000" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION MBAMInstallerService.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\mbam.exe = "11000" MBAMInstallerService.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
LogonUI.exeMBAMInstallerService.exeMBAMService.exedescription ioc process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\16.0\Common\Security MBAMInstallerService.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Malwarebytes\FirstRun = "false" MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates MBAMService.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Malwarebytes\FirstRun = "false" MBAMInstallerService.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:\ MBAMInstallerService.exe Set value (str) \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:\ MBAMInstallerService.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:\ MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols MBAMInstallerService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MBAMService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\15.0\Common MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\Software MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\15.0\Common MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: MBAMInstallerService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" MBAMService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Malwarebytes MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\Software MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\15.0 MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\16.0\Common MBAMInstallerService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\15.0 MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols MBAMInstallerService.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\16.0\Common\Security MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies MBAMInstallerService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0 MBAMInstallerService.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:\ MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\15.0\Common\Security MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\16.0\Common MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\16.0\Common\Security MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0\Common MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\15.0\Common\Security MBAMInstallerService.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:\ MBAMInstallerService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MBAMService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe -
Modifies registry class 64 IoCs
Processes:
MBAMService.exeMBAMService.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{17BE78EE-B40A-4B9E-835F-38EC62F9D479}\Version\ = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FC60FEE4-E373-4962-B548-BA2E06119D54}\ProxyStubClsid32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E298372C-5B10-42B4-B44C-7B85EA0722A3}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FC34538A-37CB-44B4-9264-533E9347BB40}\ = "IRTPControllerEventsV2" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B42C0E8E-5C9D-46B7-AAED-2294C6566DC0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MB.SPController\ = "SPController Class" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3968399C-D098-40AF-9700-734B46FF03C9} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E149FEF9-F1DC-4894-8A8E-AA53F6807EFD}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E298372C-5B10-42B4-B44C-7B85EA0722A3}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{59E42E77-5F19-4602-A559-3FFA9EE51202}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DAD5232C-6E05-4458-9709-0B4DCB22EA09}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{18C5830A-FF78-4172-9DFB-E4016D1C1F31} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{557ADCF9-0496-46F6-A580-FF8EC1441050}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MB.PoliciesController.1\CLSID\ = "{9D372F21-E6DA-4B82-881A-79F6CA6B6AE1}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{59E42E77-5F19-4602-A559-3FFA9EE51202} MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6C1047E9-9ADC-4F8A-8594-036375F53103}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{63A6AB57-4679-4529-B78D-143547B22799}\TypeLib\ = "{A82129F1-32E1-4D79-A39F-EBFEE53A70BF}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9F798C4B-4059-46F9-A0FE-F6B1664ADE96}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1917B432-C1CE-4A96-A08E-A270E00E5B23}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{90A62FAD-6FA9-4454-8CEE-7EDF67437226}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8FEFED84-854E-4029-A986-1D7774D4CF7D}\TypeLib\ = "{5709DEEB-F05E-4D5C-8DC4-3B0D924EE08F}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4E0987E3-3699-4C92-8E76-CAEDA00FA44C}\ = "ITelemetryController" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{993A5C11-A9B8-41E9-9088-C5182B1F279A}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E32ABD9A-1CBD-44A5-8A62-55D347D3C4F0}\TypeLib\Version = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D4AC5360-A581-42A7-8DD6-D63A5C3AA7F1}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{557ADCF9-0496-46F6-A580-FF8EC1441050}\ = "IRTPControllerV9" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{278637DA-FDFB-45C7-8CD8-F2D8A9199AB0}\Version\ = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B1BDE8B0-F598-4334-9991-ECC7442EEAA6}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FA484BC6-E101-4A87-AAF3-B468B3F2C6BB}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B1D8E799-D5A2-45B4-9524-067144A201E4} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{560EB17C-4365-4DFC-A855-F99B223F02AF}\ = "IScannerEventsV3" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C85F3EB8-B099-4598-89C3-E33BAC2CE53D}\TypeLib\ = "{5709DEEB-F05E-4D5C-8DC4-3B0D924EE08F}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B9F73DD6-F2A4-40F8-9109-67F6BB8D3704}\TypeLib\Version = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD3CFEBD-3B8E-4651-BB7C-537D1F03E59C}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B42C0E8E-5C9D-46B7-AAED-2294C6566DC0}\TypeLib\ = "{74630AE8-C170-4A8F-A90A-F42D63EFE1E8}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C7BCC13C-47B9-4DC0-8FC6-B2A489EF60EF}\TypeLib\ = "{5709DEEB-F05E-4D5C-8DC4-3B0D924EE08F}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{503084FD-0743-46C7-833F-D0057E8AC505}\ProxyStubClsid32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0F2D6C4F-0B95-4A53-BA9D-55526737DC34}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{473BC184-760C-4255-A118-E8064C4EC595} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MB.LogController.1\ = "LogController Class" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3F656FD9-2597-4587-8F05-781C11710867}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8153C0A7-AC17-452A-9388-358F782478D4}\TypeLib\ = "{A82129F1-32E1-4D79-A39F-EBFEE53A70BF}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{993A5C11-A9B8-41E9-9088-C5182B1F279A}\ = "ITelemetryControllerV3" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{346CF9BC-3AD5-43BA-B348-EFB88F75360F}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FC34538A-37CB-44B4-9264-533E9347BB40}\TypeLib\ = "{FFB94DF8-FC15-411C-B443-E937085E2AC1}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2846D47E-9B85-4836-B883-6A7B493E2D6A}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{46AEAC9A-C091-4B63-926C-37CFBD9D244F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4E0987E3-3699-4C92-8E76-CAEDA00FA44C}\TypeLib\ = "{226C1698-A075-4315-BB5D-9C164A96ACE7}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B9F73DD6-F2A4-40F8-9109-67F6BB8D3704}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5BA2811A-EE5B-44DF-81CD-C75BB11A82D4}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EEC295FA-EC51-4055-BC47-022FC0FC122F}\1.0\HELPDIR MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AFF1A83B-6C83-4342-8E68-1648DE06CB65}\1.0\0 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MB.AEController MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B32065E5-189E-4C5F-AA59-32A158BAF5B7} MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F81B1882-A388-42E5-9351-05C858E52DDC} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{960F2BB5-E954-45C5-97DF-A770D9D8C24B}\TypeLib\Version = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{735BE2C0-5A9B-457A-A0A9-4B27FCED2817} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{55D0C28B-2BF3-4230-B48D-DB2C2D7BF6F8}\ = "ICleanControllerEventsV3" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B5186B66-AE3D-4EC4-B9F5-67EC478625BE}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E4EA13DC-F9D2-4DB9-A19F-2B462FFC81F3}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{580243BF-3CEE-4131-A599-C6FED66BEB1B}\TypeLib\ = "{332AFEBA-9341-4CEC-8EA6-DB155A99DF63}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D7A05281-DB9E-4E02-9680-E4D83CDAA6AB}\TypeLib\ = "{A82129F1-32E1-4D79-A39F-EBFEE53A70BF}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1E3F0FEC-3E40-4137-8C7D-090AFA9B6C5E}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B860FC17-5606-4F3A-8AE5-E1C139D8BDE3} MBAMService.exe -
Processes:
MBAMInstallerService.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E\Blob = 030000000100000014000000b51c067cee2b0c3df855ab2d92f4fe39d4e70f0e2000000001000000e1030000308203dd308202c5a003020102020100300d06092a864886f70d01010b050030818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a30818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bdedc103fcf68ffc02b16f5b9f48d99d79e2a2b703615618c347b6d7ca3d352e8943f7a1699bde8a1afd13209cb44977322956fdb9ec8cdd22fa72dc276197eef65a84ec6e19b9892cdc845bd574fb6b5fc589a51052894655f4b8751ce67fe454ae4bf85572570219f8177159eb1e280774c59d48be6cb4f4a4b0f364377992c0ec465e7fe16d534c62afcd1f0b63bb3a9dfbfc7900986174cf26824063f3b2726a190d99cad40e75cc37fb8b89c159f1627f5fb35f6530f8a7b74d765a1e765e34c0e89656998ab3f07fa4cdbddc32317c91cfe05f11f86baa495cd19994d1a2e3635b0976b55662e14b741d96d426d4080459d0980e0ee6defcc3ec1f90f10203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147c0c321fa7d9307fc47d68a362a8a1ceab075b27300d06092a864886f70d01010b050003820101001159fa254f036f94993b9a1f828539d47605945ee128936d625d09c2a0a8d4b07538f1346a9de49f8a862651e62cd1c62d6e95204a9201ecb88a677b31e2672e8c9503262e439d4a31f60eb50cbbb7e2377f22ba00a30e7b52fb6bbb3bc4d379514ecd90f4670719c83c467a0d017dc558e76de68530179a24c410e004f7e0f27fd4aa0aff421d37ed94e5645912207738d3323e3881759673fa688fb1cbce1fc5ecfa9c7ecf7eb1f1072db6fcbfcaa4bfd097054abcea18280290bd5478092171d3d17d1dd916b0a9613dd00a0022fcc77bcb0964450b3b4081f77d7c32f598ca588e7d2aee90597364f936745e25a1f566052e7f3915a92afb508b8e8569f4 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8DA7F965EC5EFC37910F1C6E59FDC1CC6A6EDE16\Blob = 0300000001000000140000008da7f965ec5efc37910f1c6e59fdc1cc6a6ede162000000001000000450300003082034130820229a0030201020213066c9fcf99bf8c0a39e2f0788a43e696365bca300d06092a864886f70d01010b05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412031301e170d3135303532363030303030305a170d3338303131373030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f74204341203130820122300d06092a864886f70d01010105000382010f003082010a0282010100b2788071ca78d5e371af478050747d6ed8d78876f49968f7582160f97484012fac022d86d3a0437a4eb2a4d036ba01be8ddb48c80717364cf4ee8823c73eeb37f5b519f84968b0ded7b976381d619ea4fe8236a5e54a56e445e1f9fdb416fa74da9c9b35392ffab02050066c7ad080b2a6f9afec47198f503807dca2873958f8bad5a9f948673096ee94785e6f89a351c0308666a14566ba54eba3c391f948dcffd1e8302d7d2d747035d78824f79ec4596ebb738717f2324628b843fab71daacab4f29f240e2d4bf7715c5e69ffea9502cb388aae50386fdbfb2d621bc5c71e54e177e067c80f9c8723d63f40207f2080c4804c3e3b24268e04ae6c9ac8aa0d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604148418cc8534ecbc0c94942e08599cc7b2104e0a08300d06092a864886f70d01010b0500038201010098f2375a4190a11ac57651282036230eaee628bbaaf894ae48a4307f1bfc248d4bb4c8a197f6b6f17a70c85393cc0828e39825cf23a4f9de21d37c8509ad4e9a753ac20b6a897876444718656c8d418e3b7f9acbf4b5a750d7052c37e8034bade961a0026ef5f2f0c5b2ed5bb7dcfa945c779e13a57f52ad95f2f8933bde8b5c5bca5a525b60af14f74befa3fb9f40956d3154fc42d3c7461f23add90f48709ad9757871d1724334756e5759c2025c266029cf2319168e8843a5d4e4cb08fb231143e843297262a1a95d5e08d490aeb8d8ce14c2d055f286f6c49343776661c0b9e841d7977860036e4a72aea5d17dba109e866c1b8ab95933f8ebc490bef1b9 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\1C58A3A8518E8759BF075B76B750D4F2DF264FCD MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\1C58A3A8518E8759BF075B76B750D4F2DF264FCD\Blob = 0300000001000000140000001c58a3a8518e8759bf075b76b750d4f2df264fcd2000000001000000c2040000308204be308203a6a003020102021006d8d904d5584346f68a2fa754227ec4300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3231303431343030303030305a170d3331303431333233353935395a304f310b300906035504061302555331153013060355040a130c446967694365727420496e633129302706035504031320446967694365727420544c53205253412053484132353620323032302043413130820122300d06092a864886f70d01010105000382010f003082010a0282010100c14bb3654770bcdd4f58dbec9cedc366e51f311354ad4a66461f2c0aec6407e52edcdcb90a20eddfe3c4d09e9aa97a1d8288e51156db1e9f58c251e72c340d2ed292e156cbf1795fb3bb87ca25037b9a52416610604f571349f0e8376783dfe7d34b674c2251a6df0e9910ed57517426e27dc7ca622e131b7f238825536fc13458008b84fff8bea75849227b96ada2889b15bca07cdfe951a8d5b0ed37e236b4824b62b5499aecc767d6e33ef5e3d6125e44f1bf71427d58840380b18101faf9ca32bbb48e278727c52b74d4a8d697dec364f9cace53a256bc78178e490329aefb494fa415b9cef25c19576d6b79a72ba2272013b5d03d40d321300793ea99f50203010001a38201823082017e30120603551d130101ff040830060101ff020100301d0603551d0e04160414b76ba2eaa8aa848c79eab4da0f98b2c59576b9f4301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030106082b06010505070302307606082b06010505070101046a3068302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304006082b060105050730028634687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274476c6f62616c526f6f7443412e63727430420603551d1f043b30393037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274476c6f62616c526f6f7443412e63726c303d0603551d2004363034300b06096086480186fd6c02013007060567810c01013008060667810c0102013008060667810c0102023008060667810c010203300d06092a864886f70d01010b050003820101008032ce5e0bdd6e5a0d0aafe1d684cbc08efa8570edda5db30cf72b7540fe850afaf33178b7704b1a8958ba80bdf36b1de97ecf0bba589c59d490d3fd6cfdd0986db771825bcf6d0b5a09d07bdec443d82aa4de9e41265fbb8f99cbddaee1a86f9f87fe74b71f1b20abb14fc6f5675d5d9b3ce9ff69f7616cd6d9f3fd36c6ab038876d24b2e7586e3fcd8557d26c21177df3e02b67cf3ab7b7a86366fb8f7d89371cf86df7330fa7babed2a59c842843b11171a52f3c90e147da25b7267ba71ed574766c5b8024a65345e8bd02a3c209c51994ce7529ef76b112b0d927e1de88aeb36164387ea2a63bf753febdec403bb0a3cf730efebaf4cfc8b3610733ef3a4 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\2AD974A775F73CBDBBD8F5AC3A49255FA8FB1F8C MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\5A8CEF45D7A69859767A8C8B4496B578CF474B1A MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\5A8CEF45D7A69859767A8C8B4496B578CF474B1A\Blob = 0300000001000000140000005a8cef45d7a69859767a8c8b4496b578cf474b1a2000000001000000450500003082054130820329a0030201020213066c9fd29635869f0a0fe58678f85b26bb8a37300d06092a864886f70d01010c05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412032301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f74204341203230820222300d06092a864886f70d01010105000382020f003082020a0282020100ad969f2d9c4a4c4a81795199ec8acb6b605113bc4d6d06fcb0088ddd19106ac7260c35d8c06f2084e994b19b8503c35bdb4ae8c8f89076d95b4fe34ce806364dcc9aac3d0c902b92d4061960ac374479858182ad5a37e00dcc9da64c5276ea439db704d150f655e0d5d2a64985e937e9ca7eae5c954d489a3fae205a6d8895d934b8521a4390b0bf6c05b9b678b7ead0e43a3c125362ff4af27bbe3505a91234e3f36474622c3d00495a28fe3244bb87dd652702713bda4af71fdacdf72155904f0fecae82e19f6bd945d3bbf05f87ed3c2c3986da3fdeec7255eb79a3addbdd7cb0ba1ccefcde4f3576cf0ff8781f6a36514627615be99ecff0a2557d7c258a6f2fb4c5cf842e2bfd0d51106cfb5f1bbc1b7ec5ae3b98013192ff0b57f49ab2b957e9abef0d76d1f0eef4ce86a7e06ee9b469a1df69f633c6692e97139ea587b057108137c953b3bb7ff692d19cd018f4926eda834fa663994ca5fb5eef21647a205f6c648515cb37e9620c0b2a16dc012e32da3e4bf59e3af6174094ef9e910886fabe63a85a33eccb744395f96c695236c7296ffc55035c1ffb9fbd47ebe74947950b4e89220949e0f5611ef1bf2e8a726e8059ff573af97532a34e5feced2862d94d73f2cc811760edcdebdcdba7cac57e02bdf2540854fdb42d092c17544a98d154e1516708d2ed6e7e6f3fd22d81592966cb903995111e7427feddebaf0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414b00cf04c30f405580248fd33e552af4b84e36652300d06092a864886f70d01010c05000382020100aaa8808f0e78a3e0a2d4cde6f5987a3bea0003b0970e93bc5aa8f62c8c7287a9b1fc7f73fd637178a58759cf30e10d10b2135a6d82f56ae6809fa0050b68e4476bc76adfb6fd773272e518fa09f4a0932c5dd28c75857665900c0379b7312363ad788309866884cafff9cf269a9279e7cd4bc5e761a717cbf3a91293936ba7e82f5392c46058b0cc0251185b858d625963b6adb4de9afb26f70027c05d55377499c9507fe3592e44e32c25eeec4c3277b49f1ae94b5d20c5dafd1c8716c643e8d4bb269a45705ea90b3753e2467b27fde046f289b7cc42b6cb28266ed9a5c93ac8411360f7508c15aeb26d1a151a5778e6922ad96590823f6c02afae123a27963604d71da28063a99bf1e5bab47c14b04ec9b11f745f38f651ea9bfa2ca211d4a92d271a45b1afb24e710dc05846d66906cb53cbb3fe6b41cd417e7d4c0f7c72797a59cd5e4a0eac9ba99873797cb4f4ccb9b8070cb2745cb8c76f88a190a7f4aaf9bf673af41a15621eb79fbe3db129af67a112f25810195303301bb81a89f69cbd97038ea309f31d8b21f1b4dfe41cd19f650206ea5cd613b384efa2a55c8c7729a768c06bae40d2a8b4eacdf08d4b389c199a1b2854b88990efca75813e1ef26424c718af4eff479e07f63565a4d30a56fff517646cefa822254993b6df0017da587e5deec51bb0d1d15f2110c7f9f3ba020a2707c5f1d6c7d3e0fb09606c MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0D44DD8C3C8C1A1A58756481E90F2E2AFFB3D26E\Blob = 0300000001000000140000000d44dd8c3c8c1a1a58756481e90f2e2affb3d26e2000000001000000ba010000308201b63082015ba0030201020213066c9fd5749736663f3b0b9ad9e89e7603f24a300a06082a8648ce3d0403023039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412033301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f7420434120333059301306072a8648ce3d020106082a8648ce3d030107034200042997a7c6417fc00d9be8011b56c6f252a5ba2db212e8d22ed7fac9c5d8aa6d1f73813b3b986b397c33a5c54e868e8017686245577d44581db337e56708eb66dea3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414abb6dbd7069e37ac3086079170c79cc419b178c0300a06082a8648ce3d0403020349003046022100e08592a317b78df92b06a593ac1a98686172fae1a1d0fb1c7860a64399c5b8c40221009c02eff1949cb396f9ebc62af8b62cfe3a901416d78c6324481cdf307dd5683b MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F6108407D6F8BB67980CC2E244C2EBAE1CEF63BE MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\2AD974A775F73CBDBBD8F5AC3A49255FA8FB1F8C\Blob = 0300000001000000140000002ad974a775f73cbdbbd8f5ac3a49255fa8fb1f8c2000000001000000620400003082045e30820346a0030201020213077312380b9d6688a33b1ed9bf9ccda68e0e0f300d06092a864886f70d01010b05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412031301e170d3232303832333232323132385a170d3330303832333232323132385a303c310b3009060355040613025553310f300d060355040a1306416d617a6f6e311c301a06035504031313416d617a6f6e205253412032303438204d303130820122300d06092a864886f70d01010105000382010f003082010a0282010100eb712ca9cb1f8828923230af8a570f78b73725955587ac675c97d322c8daa214676b7cf067dae2032ab356125dc6b547f96708a7937a9592180fb4f9f910369a7f2f80b64fba134ec75d531ee0dd96330720d396bc12e4745042a1051373b54f9b4424fe2d7fedbc2285ec362133977506ce271882dce3d9c582078d5e26012626671fd93f13cf32ba6bad7864fcaaff0e023c07df9c0578728cfdea75b7032884dae86e078cd05085ef8154b2716eec6d62ef8f94c35ee9c4a4d091c02e249198caeeba258ed4f671b6fb5b6b38064837478d86dcf2ea06fb76377d9eff424e4d588293cfe271c278b17aab4b5b94378881e4d9af24aef872c565fb4bb451e70203010001a382015a3082015630120603551d130101ff040830060101ff020100300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030106082b06010505070302301d0603551d0e0416041481b80e638a891218e5fa3b3b50959fe6e5901385301f0603551d230418301680148418cc8534ecbc0c94942e08599cc7b2104e0a08307b06082b06010505070101046f306d302f06082b060105050730018623687474703a2f2f6f6373702e726f6f746361312e616d617a6f6e74727573742e636f6d303a06082b06010505073002862e687474703a2f2f6372742e726f6f746361312e616d617a6f6e74727573742e636f6d2f726f6f746361312e636572303f0603551d1f043830363034a032a030862e687474703a2f2f63726c2e726f6f746361312e616d617a6f6e74727573742e636f6d2f726f6f746361312e63726c30130603551d20040c300a3008060667810c010201300d06092a864886f70d01010b05000382010100ad00de0205232e063262b46bb19416e41140de2bfa59c135efe0aa8f2b41b9d1f38739001df23db5a7470c0606c691f3075702d4edbd17c1909abf4875a2074f30dd4a6a42b50d3d15c00ffe845bc63c99cc5752b1d86e12d59692934b94e507e88982086a7a34d49e64e13d876a92909a63a14bf88fb6ea34d305be20c2de06e28c9f738b9f4d3985cace19369d85c99ec9f8503fb67e88a1efca84068b50b40a5ca61c44f1fdc8614060f26125aa07f4c7c27375e40c0b428d04e55f4448995b7b898196a7889d4b0d62e804c4d7feb4e8b26dcaecc01cbc385b1ddf85ce5b7ae3494b6cb9a7ddf405b249ade1c5146bc2ccebcd7fd65869bac3207e7fb0b8 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8DA7F965EC5EFC37910F1C6E59FDC1CC6A6EDE16 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa22000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0D44DD8C3C8C1A1A58756481E90F2E2AFFB3D26E MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F6108407D6F8BB67980CC2E244C2EBAE1CEF63BE\Blob = 030000000100000014000000f6108407d6f8bb67980cc2e244c2ebae1cef63be2000000001000000f6010000308201f230820178a0030201020213066c9fd7c1bb104c2943e5717b7b2cc81ac10e300a06082a8648ce3d0403033039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412034301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f7420434120343076301006072a8648ce3d020106052b8104002203620004d2ab8a374fa3530dfec18a7b4ba87b464b63b062f62d1bdb087121d200e863bd9a27fbf0396e5dea3da5c981aaa35b2098455d16dbfde8106de39ce0e3bd5f8462f3706433a0cb242f70ba88a12aa075f881ae6206c481db396e29b01efa2e5ca3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414d3ecc73a656ecce1da769a56fb9cf3866d57e581300a06082a8648ce3d040303036800306502303a8b21f1bd7e11add0ef58962fd6eb9d7e908d2bcf6655c32ce328a9700a470ef0375912ff2d9994284e2a4f354d335a023100ea75004e3bc43a941291c958469d211372a7889c8ae44c4adb96d4ac8b6b6b49125333add7e4be24fcb50a76d4a5bc10 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2 MBAMInstallerService.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
mbamtray.exembam.exepid process 4088 mbamtray.exe 1376 mbam.exe -
Suspicious behavior: EnumeratesProcesses 32 IoCs
Processes:
MBSetup.exeMBAMInstallerService.exeMBAMService.exembam.exembamtray.exepid process 1648 MBSetup.exe 1648 MBSetup.exe 4156 MBAMInstallerService.exe 4156 MBAMInstallerService.exe 4156 MBAMInstallerService.exe 4156 MBAMInstallerService.exe 4156 MBAMInstallerService.exe 4156 MBAMInstallerService.exe 4156 MBAMInstallerService.exe 4156 MBAMInstallerService.exe 4156 MBAMInstallerService.exe 4156 MBAMInstallerService.exe 4388 MBAMService.exe 4388 MBAMService.exe 4388 MBAMService.exe 4388 MBAMService.exe 4388 MBAMService.exe 4388 MBAMService.exe 4388 MBAMService.exe 4388 MBAMService.exe 1376 mbam.exe 1376 mbam.exe 4088 mbamtray.exe 4088 mbamtray.exe 4088 mbamtray.exe 4088 mbamtray.exe 1376 mbam.exe 1376 mbam.exe 4388 MBAMService.exe 4388 MBAMService.exe 4388 MBAMService.exe 4388 MBAMService.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
mbam.exepid process 1376 mbam.exe -
Suspicious behavior: LoadsDriver 4 IoCs
Processes:
pid process 672 672 672 672 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
MBAMService.exeMBAMService.exedescription pid process Token: 33 3992 MBAMService.exe Token: SeIncBasePriorityPrivilege 3992 MBAMService.exe Token: 33 4388 MBAMService.exe Token: SeIncBasePriorityPrivilege 4388 MBAMService.exe Token: SeBackupPrivilege 4388 MBAMService.exe Token: SeRestorePrivilege 4388 MBAMService.exe Token: SeTakeOwnershipPrivilege 4388 MBAMService.exe Token: SeBackupPrivilege 4388 MBAMService.exe Token: SeRestorePrivilege 4388 MBAMService.exe Token: SeBackupPrivilege 4388 MBAMService.exe Token: SeRestorePrivilege 4388 MBAMService.exe Token: SeBackupPrivilege 4388 MBAMService.exe Token: SeRestorePrivilege 4388 MBAMService.exe Token: SeBackupPrivilege 4388 MBAMService.exe Token: SeRestorePrivilege 4388 MBAMService.exe Token: SeBackupPrivilege 4388 MBAMService.exe Token: SeRestorePrivilege 4388 MBAMService.exe Token: SeBackupPrivilege 4388 MBAMService.exe Token: SeRestorePrivilege 4388 MBAMService.exe Token: SeBackupPrivilege 4388 MBAMService.exe Token: SeRestorePrivilege 4388 MBAMService.exe Token: SeBackupPrivilege 4388 MBAMService.exe Token: SeRestorePrivilege 4388 MBAMService.exe Token: SeBackupPrivilege 4388 MBAMService.exe Token: SeRestorePrivilege 4388 MBAMService.exe Token: SeBackupPrivilege 4388 MBAMService.exe Token: SeRestorePrivilege 4388 MBAMService.exe Token: SeBackupPrivilege 4388 MBAMService.exe Token: SeRestorePrivilege 4388 MBAMService.exe Token: SeBackupPrivilege 4388 MBAMService.exe Token: SeRestorePrivilege 4388 MBAMService.exe Token: SeBackupPrivilege 4388 MBAMService.exe Token: SeRestorePrivilege 4388 MBAMService.exe Token: SeBackupPrivilege 4388 MBAMService.exe Token: SeRestorePrivilege 4388 MBAMService.exe Token: SeBackupPrivilege 4388 MBAMService.exe Token: SeRestorePrivilege 4388 MBAMService.exe Token: SeBackupPrivilege 4388 MBAMService.exe Token: SeRestorePrivilege 4388 MBAMService.exe Token: SeBackupPrivilege 4388 MBAMService.exe Token: SeRestorePrivilege 4388 MBAMService.exe Token: SeBackupPrivilege 4388 MBAMService.exe Token: SeRestorePrivilege 4388 MBAMService.exe Token: SeBackupPrivilege 4388 MBAMService.exe Token: SeRestorePrivilege 4388 MBAMService.exe Token: SeBackupPrivilege 4388 MBAMService.exe Token: SeRestorePrivilege 4388 MBAMService.exe Token: SeBackupPrivilege 4388 MBAMService.exe Token: SeRestorePrivilege 4388 MBAMService.exe Token: SeBackupPrivilege 4388 MBAMService.exe Token: SeRestorePrivilege 4388 MBAMService.exe Token: SeBackupPrivilege 4388 MBAMService.exe Token: SeRestorePrivilege 4388 MBAMService.exe Token: SeBackupPrivilege 4388 MBAMService.exe Token: SeRestorePrivilege 4388 MBAMService.exe Token: SeBackupPrivilege 4388 MBAMService.exe Token: SeRestorePrivilege 4388 MBAMService.exe Token: SeBackupPrivilege 4388 MBAMService.exe Token: SeRestorePrivilege 4388 MBAMService.exe Token: SeBackupPrivilege 4388 MBAMService.exe Token: SeRestorePrivilege 4388 MBAMService.exe Token: SeBackupPrivilege 4388 MBAMService.exe Token: SeRestorePrivilege 4388 MBAMService.exe Token: SeBackupPrivilege 4388 MBAMService.exe -
Suspicious use of FindShellTrayWindow 10 IoCs
Processes:
MBSetup.exembamtray.exepid process 1648 MBSetup.exe 4088 mbamtray.exe 4088 mbamtray.exe 4088 mbamtray.exe 4088 mbamtray.exe 4088 mbamtray.exe 4088 mbamtray.exe 4088 mbamtray.exe 4088 mbamtray.exe 4088 mbamtray.exe -
Suspicious use of SendNotifyMessage 8 IoCs
Processes:
mbamtray.exepid process 4088 mbamtray.exe 4088 mbamtray.exe 4088 mbamtray.exe 4088 mbamtray.exe 4088 mbamtray.exe 4088 mbamtray.exe 4088 mbamtray.exe 4088 mbamtray.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
LogonUI.exepid process 2756 LogonUI.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
MBAMInstallerService.exeMBAMService.exeMBSetup.exedescription pid process target process PID 4156 wrote to memory of 3992 4156 MBAMInstallerService.exe MBAMService.exe PID 4156 wrote to memory of 3992 4156 MBAMInstallerService.exe MBAMService.exe PID 4388 wrote to memory of 4088 4388 MBAMService.exe mbamtray.exe PID 4388 wrote to memory of 4088 4388 MBAMService.exe mbamtray.exe PID 1648 wrote to memory of 1376 1648 MBSetup.exe mbam.exe PID 1648 wrote to memory of 1376 1648 MBSetup.exe mbam.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3284
-
C:\Users\Admin\AppData\Local\Temp\MBSetup.exe"C:\Users\Admin\AppData\Local\Temp\MBSetup.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Checks BIOS information in registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe"C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:1376
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"1⤵
- Drops file in Drivers directory
- Enumerates connected drives
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe" /Service /Protected2⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Executes dropped EXE
- Registers COM server for autorun
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3992
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Checks BIOS information in registry
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe"C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4088
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4a4 0x2c41⤵PID:3772
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3967055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2756
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Defense Evasion
Modify Registry
3Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\7z.dllFilesize
1.7MB
MD5461faf68ccc02b0223fd273b630f21fe
SHA1363b8beaa74f0f454c2d544ace9e71a84bc2b4cf
SHA256cb07f3f461e9c267831b1ab93af6dfda1bb51d72e42d73d00d26594f09326be1
SHA5124b671f48e45fdedf50c7f7bb6c8d82a3b98f7502006eb002aaf8ff31f25f9ff1257c7bcc12caf622e43d4ec665b19d978ae3e3762f76def0bc71485ebdb8426f
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\Actions.dllFilesize
5.0MB
MD51eff53d95ecaf6bbfffe80d866d8e1dd
SHA1d7ef7d7c77fd04b2c0eb8c16bb3cd08057f6742f
SHA2566dd748f7ca56125cbe158fa3612f08e7312ef58ad5375e6b7ab5532cc16ca0ac
SHA512c59b8e6f0b238a247e64b9c7bb42213dadac1dada63542830a6292361174c935c0c662b2d1aed3fb6100cc4993297b1eaf25e328f2b4613458c4ffca63b9f02d
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ActionsShim.dllFilesize
2.5MB
MD558149edf4990067b4c1ffe1c32a51a01
SHA180c0c8b8def45420159659d2eaad181eb0b05c40
SHA25667af73f9b49ce113d02d7f2824e45d48044273772c94e6e8c300cf86bf83cb55
SHA512fe69f4eccaa35b132b7dfc77fae50733398cfa5ab7377f502a50e1bb83be6b81fad26a0a24f6dfbc99dca6e118784f3452edc4a30c11ac161fc0db62b039cb4e
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\BrowserSDKDLL.dllFilesize
5.8MB
MD51ed53171d00f440f29a12f9beb84dac4
SHA14d9a1e3579b0999f1ab2fa818b588411e9ee920c
SHA256e659e687a872050f9e65d78992d16bd9b393cf3f8e8c94e0e15fb42b7065327e
SHA51217161cfc672d1b996b8af4ebac17f9a8a3807f38c9a23e2e5b4dadcd9a21c3a64faec9bf59147022a9df88b80f89300f1b537091289bd7a42806bd206a317e6e
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\BrowserSDKDLLShim.dllFilesize
2.5MB
MD52e8ad6f405eb7744908f635dc089438a
SHA1f2ca3f55ce4395dfe39a0ba099a39f8c30e263cb
SHA2564824ad6b30b42a9166bfd3db41f11e3cb67e7aab96058b7f946797d7dadba891
SHA5123eacea19caf3f04cddb35091102c5d627b82acc8c73be1bfa4d72932c78cba7821c99c616bbd8d422ce588b865700db560ba441f8a5da6a9629af844f6ad28c5
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\CleanControllerImpl.dllFilesize
6.9MB
MD573a08c403bf08e39bd560ffc74ae9b8f
SHA1888c6d11e6788875f8fca748b6f92a19b6126dc6
SHA25609d687c0164a9f108c4f9e107bfc0cb671ebe643ac9aae968cb8df0e5adda960
SHA5128b65c0549c319e9c42b30071b1342e8ba4239d9dc4a124e19abd2160339c03235f0ec534a997ec367f2b474797d33efa496e641c7a63904bf8e0af43a32f1535
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\CloudControllerImpl.dllFilesize
4.8MB
MD5d739c6bd5d5cae2ae961a0c2d40eb5b1
SHA116d0d40707bf55f04a0da70798b5368e612fd5e6
SHA25625472857a59a9067c1224b173b378448bb574f5365edbe4a1a46df8810007f9a
SHA5127d80a39f3a91e0faa87ae8143f43d2e8947eaedfd317a1ac1547dfa15b825cc5c200f8baebe127a0bc2379fe90c40f3ea25db09c06b521aad1c189ce24a53c7d
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\LicenseControllerImpl.dllFilesize
4.4MB
MD565e42cbe095830d9d93ecabb13392780
SHA1e60110e159cc4cc92d2606ae3ba3559c10170e5a
SHA256a773e1706bbb6e8cb522d0e1a3d29e496bcbe6a91e221c26bea98292b9316f7f
SHA5126b25cebb6433ec87831a3f0f67b96c7fc37a617158a18d9ac20bd375f46c97da8a41e4379da72808fdd7947705c6c09518c56152f96eebf2bcefb39ffa6202ed
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\MBAMCore.dllFilesize
6.4MB
MD59db84546ec6408e2eb7c8711df562ad5
SHA1b408a7f0c28b8ef20b1021f3211c7495b7fe9171
SHA256238162c0adab6a1611b428726c5d0b5830b553a9677bee986fc29522563e441e
SHA512a5fdf28b82a16bb512061ebc9cc128e9efdeb3bfcfe50a4c88c2256abe5c5b10f8d237d4ab7788e5eca3dccc9d20251c4ebe8a80856f7a3174d95b24d2c3c6ba
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\MBAMShim.dllFilesize
3.0MB
MD5f44b6c80c46c4cf3071b5f5b916e1271
SHA1839f2238ecbbfa80ebf9c1f77eafc78204b58761
SHA256732523df43358729d5e85cceb557d69016dcdd3e2238d903c33c5327c3131fae
SHA51299be164ae96bc4f93dc896d5df445ad1c2f023f10605a8c9857d7ebedfc5b070f50cd33b401d61003e601a06b8446e6c0b5dbddda4927a2e1352407d3b266942
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\PoliciesControllerImpl.dllFilesize
4.0MB
MD5efe6216931bca54ccf05a0bcb9f83fb9
SHA1007d0a3c4d850cd9b2886b24daf91c988d702bdd
SHA256eaf71519b965b9530e84be08bd3649fdb8feeeabb8dd2455be95755a336a44d6
SHA5127c59071b6ae8d0a2d6eedcb58f6a1337aa340275bf30baa121f515241aba822f6f7bbbc53b626f5f44c424af70aef3afc582a1a8a34d0b0adef115d0e8f684f4
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ScanControllerImpl.dllFilesize
5.7MB
MD5e80262b787eec69e8dd3d051a1d2840c
SHA1bbb88d699a7715d800db88679d6f7d52bf16673e
SHA256a07dbc4cc18dea7c29ea1e32c1511e846bd06ca86229b0499cbe20575937395f
SHA51216f8abc1cb48d8e7786a8add362987b0a464e0082c2bdce5ad42ed52cea1ad64cc117dc80127b5666f26d777701b1b81c178a87301be6394e8f17e5370f68789
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\Swissarmy.dllFilesize
4.0MB
MD53486801ce1e8ffc1bbc6d4f097b0f369
SHA108f2a85cd07cf1c0d6f27f0d5e7179c2a5cb8600
SHA25626720d0b669898089a4ab5a6c53203918ec399d227331273ba11169bbe273678
SHA51281974a79bf4e4086549874ef778e7716713a0107ccce212e9564f3355a26670943845aaba744691d2b68224e06e2f9d9a263e29f4ca7e46e1bfdb507a24656d5
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\SwissarmyShim.dllFilesize
2.6MB
MD589a38afcfa758e3298609c6c51929593
SHA12df1ee30adc92bd995526e41fd9c823354de30b4
SHA2564795576483af0c136a71dcee87a0ffb54f0869cae6395ac2ff8312bf555e7161
SHA512cceaed0b9a7517aebd739a377c7bd8987b9ac357be2bf987dbae31d59f2121c5bb9a9bfa2c70a9a54ad65546ef23903176dd6328d93408cb5c991257d59e2717
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\TelemetryControllerImpl.dllFilesize
5.3MB
MD51692937ebb8172814cfd1b2d20dac8c6
SHA13ad3b0dce9958ce66d89c280645ae827d3b89f16
SHA256f1cee1b89fff12181d828623b3aba0f0b8c0aed4aab8b0c017ea4d4731c16e32
SHA512a36462731990635f57f80c070cb01a8c4fe6fa445aad63f077197d473d0d625e23bcadaf5bf92c9504919ee69d12239a7733febf27d6016aa20c03f631b7e3e8
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\UpdateControllerImpl.dllFilesize
4.4MB
MD52114b71049bc4626a565fa7bef9ba37c
SHA1ca5567bd58897128a750be7db94357253321db0d
SHA256e981f1d6fdd820ad2781f0cbdc3b0715101de3257c1aab23af806f0a547dfb9e
SHA5129f97a9fdfd54072730aed98948f7b46c9667cadddc87bebb8d275b94708f11c24e618a0d169366f57b959db16e0b841e5539f5325611a4d19d3bd978a2c03427
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeFilesize
1.8MB
MD5d5805286cda5b56039dd2a2d936d4be0
SHA164ba00ec017bbb0d5c9ca4c4ce157808e76c8045
SHA256e6f775537b67e3dd2afcd8700a2a4b75632f14e5a276b1ccfe859996d8bc4850
SHA5124d7575e45eb8a554a38df752ba0653d96da6d52d570356f8803a94656f0777c473268efbcd9350f12ab901781f395e7b0212f8f8e099b6e4582ceb34ede3a5a3
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\pkgvers.datFilesize
74B
MD5a8340860b065dae8f93853f85bd57787
SHA151e240bcad31e46e8378d94c02847fe7981002f3
SHA256bd6c9fc63887a8687290c2e42aff7380b029b73c56f0fec51740b166380e2aa5
SHA512cc849320c2f19358caa5be539bd65e539db9a55c3e5e83917eb50809c3ec369bf3f6e693d49344338805eb9582008c194721b0183d9b12172a9eb14c72a33b0d
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\sample.dllFilesize
529KB
MD5ad6c596fba0e2968c57243a106f9ccc9
SHA12241116bbe1f33ff30cdf26ebc57af85136675f8
SHA2560ccb163eab06671bdc74fa03ec1208d66105960254cf1f9cad584300676c4eb3
SHA5128730556b3beef30296443aa1be1f538a12cbf34dbaa4cd722b269b24f639f599c51970959095b6a5a78bfa8e40cf5f85af64dd637391e5a24fa6dc9b1e6fcaf5
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\version.datFilesize
47B
MD5d0597d6fe6366d4fb3ee555505d4bbd4
SHA1f2dca158ab1e30152f09063d1244dc08659e8bf2
SHA256a7d3c859435cf7432e207b4cfcf76a471854767a6041c9156c76290aa0507933
SHA5124062eeb6bab639b1d9761215d106b5718913667f20c08894531380345ee49aa332768bc32b7bcfdae5b5ec8d5714351a5a50016de120608bc2d7987ab57a60c9
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\Global.nmFilesize
336KB
MD56d0b653db9f44ea422ff6da077347982
SHA18d90d4266dd3e67a7be513c9bb950a833d40e7de
SHA256d2bda209032b730d45979c43d77a4a9f3db0d6e7a240a463649da32148249925
SHA512888ee79697edb666f6aad3dd1a146ae42919b261b02fed85ab36f50a1a9a2054172c7bcb6aa9cc02530353d7d0c2b83ef268cbc705d9e8df21c50e8b7a362bb6
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\Global.srFilesize
16.0MB
MD58334313ee072e8475287c133b101beee
SHA10774e278ad5d87755c418c4cd7d4a75437b56f13
SHA256a43ebb16b7bb74292b3d7f2a5535080911c70d5020b4a2b718d60863322b8228
SHA512b401b65bba0e05fb6dd110056276a90e63b9b482aa63a4ef871acca91e2852419d3a3e4a0ffe30e09926e201a809c9d32183fe13582de8622b07d471aabc34ed
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\cfg.binFilesize
661B
MD58fd13803b1e5f14b4d241facc601a170
SHA17321eec794bc766d84d75bd0370a9f2e4d7abdf6
SHA256925d771b2643715b62ef720801dfa96047fff1ee70eabb244bed802234673717
SHA512f5b3514258487f8576fe32a795eefcffef049c7d002a6abdca17383bba838c7a218be23ec6803dcefed615f40afc2ba4b15bf65c9a74c4f6bb891d15d02bfc22
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\clean.mbdbFilesize
10KB
MD5adcb9fa4bc7e739b8b14e05131cacd30
SHA1d8bd8fab734284d00b5be94dbcd34ab313c2ac48
SHA256d3193a821a20e024d502a4a3f012d09c98a241ed8bb0168d659a9c1a1af1a535
SHA51270e6a26c88883374d9f4fd306cdb9d9daf1ac3bb5f0fe078d890984e01c0fe801a267b02304d4cb17dd31918e243847812fc909f26fcaa51fefe90626bf47361
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\dbmanifest2.datFilesize
924B
MD520250b3d83fd1358b13314feb60620f8
SHA1c824c9aa7c16e385e0c7423b5faa3da91f1344e2
SHA2567679669e6bf77e6111f5a196a9ecc5beae350fa9ca470f4c3809b45ac8fa2ee4
SHA5121a97a4502c8521849cd1d830ae8bc4ca5f6ec15049b77fc42393bcbce57b73a750df10e1ca3f0e1ea588268501bef81881364d63c24aac7b78231ea9e4c0e30b
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\dynconfig.datFilesize
39KB
MD510f23e7c8c791b91c86cd966d67b7bc7
SHA13f596093b2bc33f7a2554818f8e41adbbd101961
SHA256008254ca1f4d6415da89d01a4292911de6135b42833156720a841a22685765dc
SHA5122d1b21371ada038323be412945994d030ee8a9007db072484724616c8597c6998a560bc28886ebf89e2c8919fb70d76c98338d88832351823027491c98d48118
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\exclusions.txtFilesize
23KB
MD5aef4eca7ee01bb1a146751c4d0510d2d
SHA15cf2273da41147126e5e1eabd3182f19304eea25
SHA2569e87e4c9da3337c63b7f0e6ed0eb71696121c74e18a5da577215e18097715e2f
SHA512d31d21e37b0048050b19600f8904354cff3f3ec8291c5a7a54267e14af9fb88dfb6d11e74a037cc0369ade8a8fb9b753861f3b3fb2219563e8ec359f66c042db
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\mbdigsig2.datFilesize
514B
MD5aeeb9145095aee238fa345ce96d1f49c
SHA14df1b0f5decd16f2c0e36b98e92d461f2e97d30d
SHA256f8ab6808cb85caaeaeae58fbd2f1a9d2906a574631a73ea8ce2bc2c337f60e75
SHA51274502ea59b1c6a4d3f1df53d8aaff90520ad4956700cff3e2a0dcc744f4084216fc74bd217626b277155fd000abaabd30f4cc16c1285a415fe9e2ee1e46858a8
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\prot.mbdbFilesize
24B
MD5546d9e30eadad8b22f5b3ffa875144bf
SHA13b323ffef009bfe0662c2bd30bb06af6dfc68e4d
SHA2566089fbf0c0c1413f62e91dc9497bedc6d8a271e9dc761e20adc0dccf6f4a0c1f
SHA5123478f5dcf7af549dd6fe48ad714604200de84a90120b16a32233b6d44fa7240f5f4e5fe803f54b86bbdfd10fa1bfdd88fb85eb6a78e23e426933f98d0a2565ec
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\rdefs.mbdbFilesize
24B
MD52f7423ca7c6a0f1339980f3c8c7de9f8
SHA1102c77faa28885354cfe6725d987bc23bc7108ba
SHA256850a4ea37a0fd6f68bf95422d502b2d1257264eb90cc38c0a3b1b95aa375be55
SHA512e922ac8a7a2cde6d387f8698207cf5efbd45b646986a090e3549d97a7d552dd74179bd7ac20b7d246ca49d340c4c168982c65b4749df760857810b2358e7eb69
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\rules.mbdbFilesize
9.0MB
MD59a20739b3cca4b23e86755a564bd56e0
SHA1b38e885162039220923e9a4c160021a1549081f5
SHA2569173a8767615833cd9448eac4edf924f55fce4bdd511d8937cf63e26f4477c90
SHA51218baf591ccfccd6b06e26b8c3d7e050700eb17e048316ec34633a22a81a19ef9d225c8b006658b969462e45e810b9ab6ae10b2d83ad866d1398b256771fadde3
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\scan.mbdbFilesize
1018KB
MD5269ef223b7919ca972577657d3d33d85
SHA11a1eb8ca370beaee913715b1f4b6b8aa53fc4b2a
SHA2564447c30c097ce4276abadc515b94a6f4ad246884fbf64b7dd8ca45246679a6bc
SHA5126358d168e868151e7ef960e1cd9112eca25739bed0be81826ed29b132499ae31fa34d7eb679b40ea3b5a6f60da81735e770133dcfd6cfb0d0553b6c64b606ffb
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\tids.mbdbFilesize
177KB
MD5f0eb4779a5dade2efa5229c33abb4910
SHA141d2c8cdbd8e306a263fe419bb2c1c19514524e9
SHA2569c5242e6c567e641bb10412cd966b81819984ea643ba96222ee0b256b3f53955
SHA5126883622d693265b824d1cb65fe6d9a66d99bc8d167981fa4f0054c7513020361ec09b2c75f62a8afa85dcea175914a4c8f4872ec7040722dcaf7375886bdbd84
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\wprot2.mbdbFilesize
40.5MB
MD511ad702b34346889d5fd70a9f875faff
SHA14a6952107ba24777d90c06b5528f05f45705ce90
SHA2562dc77eb6a488751757a6779b003dee922526000b38ee1d1fb3fe3266079cceea
SHA5123088130d7d57a317a2a38d3a69876f53cd3bca34df3c8ef791bf10fa17156cf811a897fc8e68f3d1fcdcee6a85600668b1c0a0bbece59dbf7fb10f42d76d69bd
-
C:\Program Files\Malwarebytes\Anti-Malware\7z.dllFilesize
1.7MB
MD5461faf68ccc02b0223fd273b630f21fe
SHA1363b8beaa74f0f454c2d544ace9e71a84bc2b4cf
SHA256cb07f3f461e9c267831b1ab93af6dfda1bb51d72e42d73d00d26594f09326be1
SHA5124b671f48e45fdedf50c7f7bb6c8d82a3b98f7502006eb002aaf8ff31f25f9ff1257c7bcc12caf622e43d4ec665b19d978ae3e3762f76def0bc71485ebdb8426f
-
C:\Program Files\Malwarebytes\Anti-Malware\Actions.dllFilesize
5.0MB
MD51eff53d95ecaf6bbfffe80d866d8e1dd
SHA1d7ef7d7c77fd04b2c0eb8c16bb3cd08057f6742f
SHA2566dd748f7ca56125cbe158fa3612f08e7312ef58ad5375e6b7ab5532cc16ca0ac
SHA512c59b8e6f0b238a247e64b9c7bb42213dadac1dada63542830a6292361174c935c0c662b2d1aed3fb6100cc4993297b1eaf25e328f2b4613458c4ffca63b9f02d
-
C:\Program Files\Malwarebytes\Anti-Malware\ActionsShim.dllFilesize
2.5MB
MD558149edf4990067b4c1ffe1c32a51a01
SHA180c0c8b8def45420159659d2eaad181eb0b05c40
SHA25667af73f9b49ce113d02d7f2824e45d48044273772c94e6e8c300cf86bf83cb55
SHA512fe69f4eccaa35b132b7dfc77fae50733398cfa5ab7377f502a50e1bb83be6b81fad26a0a24f6dfbc99dca6e118784f3452edc4a30c11ac161fc0db62b039cb4e
-
C:\Program Files\Malwarebytes\Anti-Malware\CleanControllerImpl.dllFilesize
6.9MB
MD573a08c403bf08e39bd560ffc74ae9b8f
SHA1888c6d11e6788875f8fca748b6f92a19b6126dc6
SHA25609d687c0164a9f108c4f9e107bfc0cb671ebe643ac9aae968cb8df0e5adda960
SHA5128b65c0549c319e9c42b30071b1342e8ba4239d9dc4a124e19abd2160339c03235f0ec534a997ec367f2b474797d33efa496e641c7a63904bf8e0af43a32f1535
-
C:\Program Files\Malwarebytes\Anti-Malware\CloudControllerImpl.dllFilesize
4.8MB
MD5d739c6bd5d5cae2ae961a0c2d40eb5b1
SHA116d0d40707bf55f04a0da70798b5368e612fd5e6
SHA25625472857a59a9067c1224b173b378448bb574f5365edbe4a1a46df8810007f9a
SHA5127d80a39f3a91e0faa87ae8143f43d2e8947eaedfd317a1ac1547dfa15b825cc5c200f8baebe127a0bc2379fe90c40f3ea25db09c06b521aad1c189ce24a53c7d
-
C:\Program Files\Malwarebytes\Anti-Malware\LicenseControllerImpl.dllFilesize
4.4MB
MD565e42cbe095830d9d93ecabb13392780
SHA1e60110e159cc4cc92d2606ae3ba3559c10170e5a
SHA256a773e1706bbb6e8cb522d0e1a3d29e496bcbe6a91e221c26bea98292b9316f7f
SHA5126b25cebb6433ec87831a3f0f67b96c7fc37a617158a18d9ac20bd375f46c97da8a41e4379da72808fdd7947705c6c09518c56152f96eebf2bcefb39ffa6202ed
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exeFilesize
8.7MB
MD5e6d5df8df4c3c43a981e5f7cb7b35f65
SHA1b4233bf950fe74017f86662d04f8cb98241ba1b5
SHA2566ec0e1fa0ddf753eb37d521c8b4c87ea60ad6ab45398bd6736a55fd21cefd072
SHA51243ae5f61024d7137c3a7fda98343d438a451cb980512099ba3b07e9b4c73bbae12396fd3f71b6b00bf075fe4076c02472cd40febcb695f0d9c429c189a07e8f7
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exeFilesize
8.7MB
MD5e6d5df8df4c3c43a981e5f7cb7b35f65
SHA1b4233bf950fe74017f86662d04f8cb98241ba1b5
SHA2566ec0e1fa0ddf753eb37d521c8b4c87ea60ad6ab45398bd6736a55fd21cefd072
SHA51243ae5f61024d7137c3a7fda98343d438a451cb980512099ba3b07e9b4c73bbae12396fd3f71b6b00bf075fe4076c02472cd40febcb695f0d9c429c189a07e8f7
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exeFilesize
8.9MB
MD503948ad78f44b840ec2296a0fbb9f2fc
SHA1a4c04a502746af80894c13de707bd0282388e12e
SHA2568ffd82021f35885627bbf5a0a55a51963e7e37c5a5d636466e244fa64ad94d65
SHA51235b39c9f7da64a22d4bc8aed88b36bf3d69bb2d45d0ddb360fc909c943d61e067e77da5b54c64406fa7af883b9bd798100193fae2eb790fb304037a6df4d47ee
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exeFilesize
8.9MB
MD503948ad78f44b840ec2296a0fbb9f2fc
SHA1a4c04a502746af80894c13de707bd0282388e12e
SHA2568ffd82021f35885627bbf5a0a55a51963e7e37c5a5d636466e244fa64ad94d65
SHA51235b39c9f7da64a22d4bc8aed88b36bf3d69bb2d45d0ddb360fc909c943d61e067e77da5b54c64406fa7af883b9bd798100193fae2eb790fb304037a6df4d47ee
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exeFilesize
8.9MB
MD503948ad78f44b840ec2296a0fbb9f2fc
SHA1a4c04a502746af80894c13de707bd0282388e12e
SHA2568ffd82021f35885627bbf5a0a55a51963e7e37c5a5d636466e244fa64ad94d65
SHA51235b39c9f7da64a22d4bc8aed88b36bf3d69bb2d45d0ddb360fc909c943d61e067e77da5b54c64406fa7af883b9bd798100193fae2eb790fb304037a6df4d47ee
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMShim.dllFilesize
3.0MB
MD5f44b6c80c46c4cf3071b5f5b916e1271
SHA1839f2238ecbbfa80ebf9c1f77eafc78204b58761
SHA256732523df43358729d5e85cceb557d69016dcdd3e2238d903c33c5327c3131fae
SHA51299be164ae96bc4f93dc896d5df445ad1c2f023f10605a8c9857d7ebedfc5b070f50cd33b401d61003e601a06b8446e6c0b5dbddda4927a2e1352407d3b266942
-
C:\Program Files\Malwarebytes\Anti-Malware\MbamElam.catFilesize
10KB
MD560608328775d6acf03eaab38407e5b7c
SHA19f63644893517286753f63ad6d01bc8bfacf79b1
SHA2563ed5a1668713ef80c2b5599b599f1434ad6648999f335cf69757ea3183c70c59
SHA5129f65212121b8a5d1a0625c3baa14ef04a33b091d26f543324333e38dcdb903e02ccc4d009e22c2e85d2f61d954e0b994c2896e52f685003a6ef34758f8a650c7
-
C:\Program Files\Malwarebytes\Anti-Malware\MbamElam.infFilesize
2KB
MD5c481ad4dd1d91860335787aa61177932
SHA181633414c5bf5832a8584fb0740bc09596b9b66d
SHA256793626d240fd8eefc81b78a57c8dfe12ea247889b6f07918e9fd32a7411aa1c3
SHA512d292e028936412f07264837d4a321ecfa2f5754d4048c8bcf774a0e076e535b361c411301558609d64c71c1ce9b19e6041efa44d201237a7010c553751e1e830
-
C:\Program Files\Malwarebytes\Anti-Malware\MbamElam.sysFilesize
20KB
MD59e77c51e14fa9a323ee1635dc74ecc07
SHA1a78bde0bd73260ce7af9cdc441af9db54d1637c2
SHA256b5619d758ae6a65c1663f065e53e6b68a00511e7d7accb3e07ed94bfd0b1ede0
SHA512a12ccf92bead694f5d3cba7ff7e731a2f862198efc338efc7f33a882fe0eb7499fb3fb533538d0a823e80631a7ca162962fbdfd78e401e3255672910b7140186
-
C:\Program Files\Malwarebytes\Anti-Malware\PoliciesControllerImpl.dllFilesize
4.0MB
MD5efe6216931bca54ccf05a0bcb9f83fb9
SHA1007d0a3c4d850cd9b2886b24daf91c988d702bdd
SHA256eaf71519b965b9530e84be08bd3649fdb8feeeabb8dd2455be95755a336a44d6
SHA5127c59071b6ae8d0a2d6eedcb58f6a1337aa340275bf30baa121f515241aba822f6f7bbbc53b626f5f44c424af70aef3afc582a1a8a34d0b0adef115d0e8f684f4
-
C:\Program Files\Malwarebytes\Anti-Malware\ScanControllerImpl.dllFilesize
5.7MB
MD5e80262b787eec69e8dd3d051a1d2840c
SHA1bbb88d699a7715d800db88679d6f7d52bf16673e
SHA256a07dbc4cc18dea7c29ea1e32c1511e846bd06ca86229b0499cbe20575937395f
SHA51216f8abc1cb48d8e7786a8add362987b0a464e0082c2bdce5ad42ed52cea1ad64cc117dc80127b5666f26d777701b1b81c178a87301be6394e8f17e5370f68789
-
C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.jsonFilesize
592B
MD5df2e22de3329054ff1b0f699e90f9aee
SHA1be4039389c41c89ae406fb124e2b250b35e765ff
SHA2561b599185ce304c939d82837c452de9ba943ff84903432837a555f4ca9c8be6b4
SHA5125ea74858e3aca90ab7a9a56c379b02b3870ab03874c3f3917900eb722b5654debfa07c3f9e3ec3147f26bf5b77f74ce9e2b99ddd7b1bb26e37f3014b6736c542
-
C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.jsonFilesize
592B
MD5df2e22de3329054ff1b0f699e90f9aee
SHA1be4039389c41c89ae406fb124e2b250b35e765ff
SHA2561b599185ce304c939d82837c452de9ba943ff84903432837a555f4ca9c8be6b4
SHA5125ea74858e3aca90ab7a9a56c379b02b3870ab03874c3f3917900eb722b5654debfa07c3f9e3ec3147f26bf5b77f74ce9e2b99ddd7b1bb26e37f3014b6736c542
-
C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.jsonFilesize
654B
MD5610876118c65c293ce302914e98b3e8a
SHA1029b123f7c1cc88425da23d96c7412c205a5f3d5
SHA2567707ad05dce07478466ac051173762041f88f8607523796d899258d9c0c5243f
SHA51278e7c5c485329fa13e9c2ec2c585a53c5a39dc33dca65e20fd235a896fb120cd2c50734a14d4c71d2919568532522edf7282105ad1d3e06d7d834d4e4a6b8c12
-
C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.json.bakFilesize
592B
MD5df2e22de3329054ff1b0f699e90f9aee
SHA1be4039389c41c89ae406fb124e2b250b35e765ff
SHA2561b599185ce304c939d82837c452de9ba943ff84903432837a555f4ca9c8be6b4
SHA5125ea74858e3aca90ab7a9a56c379b02b3870ab03874c3f3917900eb722b5654debfa07c3f9e3ec3147f26bf5b77f74ce9e2b99ddd7b1bb26e37f3014b6736c542
-
C:\Program Files\Malwarebytes\Anti-Malware\Swissarmy.dllFilesize
4.0MB
MD53486801ce1e8ffc1bbc6d4f097b0f369
SHA108f2a85cd07cf1c0d6f27f0d5e7179c2a5cb8600
SHA25626720d0b669898089a4ab5a6c53203918ec399d227331273ba11169bbe273678
SHA51281974a79bf4e4086549874ef778e7716713a0107ccce212e9564f3355a26670943845aaba744691d2b68224e06e2f9d9a263e29f4ca7e46e1bfdb507a24656d5
-
C:\Program Files\Malwarebytes\Anti-Malware\SwissarmyShim.dllFilesize
2.6MB
MD589a38afcfa758e3298609c6c51929593
SHA12df1ee30adc92bd995526e41fd9c823354de30b4
SHA2564795576483af0c136a71dcee87a0ffb54f0869cae6395ac2ff8312bf555e7161
SHA512cceaed0b9a7517aebd739a377c7bd8987b9ac357be2bf987dbae31d59f2121c5bb9a9bfa2c70a9a54ad65546ef23903176dd6328d93408cb5c991257d59e2717
-
C:\Program Files\Malwarebytes\Anti-Malware\TelemetryControllerImpl.dllFilesize
5.3MB
MD51692937ebb8172814cfd1b2d20dac8c6
SHA13ad3b0dce9958ce66d89c280645ae827d3b89f16
SHA256f1cee1b89fff12181d828623b3aba0f0b8c0aed4aab8b0c017ea4d4731c16e32
SHA512a36462731990635f57f80c070cb01a8c4fe6fa445aad63f077197d473d0d625e23bcadaf5bf92c9504919ee69d12239a7733febf27d6016aa20c03f631b7e3e8
-
C:\Program Files\Malwarebytes\Anti-Malware\UpdateControllerImpl.dllFilesize
4.4MB
MD52114b71049bc4626a565fa7bef9ba37c
SHA1ca5567bd58897128a750be7db94357253321db0d
SHA256e981f1d6fdd820ad2781f0cbdc3b0715101de3257c1aab23af806f0a547dfb9e
SHA5129f97a9fdfd54072730aed98948f7b46c9667cadddc87bebb8d275b94708f11c24e618a0d169366f57b959db16e0b841e5539f5325611a4d19d3bd978a2c03427
-
C:\Program Files\Malwarebytes\Anti-Malware\ctlrvers.datFilesize
8B
MD5fe95747e0a7a96907ce92259c56514ed
SHA100a126ec8d9687d4305be9da42f97806112d484f
SHA256ca85439b3b1aeff16afd8e94fec619198a0fe68f9214c5e68ae896be41e23ac1
SHA512baea4075e05b32b86866da722551bee9d13dae25a8854df5ff48ca64f9aac7e45dba0037320052de0d0d29845c77ee97b7d9bef14886dc2fe3983243e13e128e
-
C:\Program Files\Malwarebytes\Anti-Malware\mb4uns.exeFilesize
3.8MB
MD563d54fe94ae4e44835d726056fb83f43
SHA1f2284e079ae50d7a5362876d7c16192d6cecdfac
SHA2568f2c2bf8c3b33876fb028be01f8215c9cb07e59abb4d20f5cdb21f380fcea406
SHA51258f8f28c3e861e3aa235128a2b7d9f4e2faf5d87f510906b4e192a3ac5762aedb35b23141a53f4f01e2b5316c61b00e4cd46433eee5badd29f70f029eea52b09
-
C:\Program Files\Malwarebytes\Anti-Malware\mbam.exeFilesize
23.1MB
MD570d8e4d74252379d29704f0c6c5ba792
SHA12f15890a225c587efdea5789fa630a83802c4627
SHA256305980e0498f47d050eec96071af59dafe6e366d13887cf64a5b7d66bfe01eb1
SHA5120c801d9d2fac4305d00a1f8b51ff6a9697a9bc486cc9bb563c81946ff21b994db32e6be26180255c87dc624f9b6bd4ad9ba83df304baa986fd5bb4e83dd892f6
-
C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exeFilesize
8.8MB
MD5090e6cd78c20db3e7305aed4235b6df3
SHA1490f93ea7b08f0e613346430bb51d3cab1aff037
SHA2569923ccc092ac7e9bac3cf13ddff5302025f08bf86ef81697919d57da872e9f89
SHA512c065572c61d5672f34a876c8acf16c919296c5330b196b170783f70c551075bf6e4c89e9b711dd1423ae84638582eb6eff2f898daee5ed13e39d2bac44888b04
-
C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dllFilesize
2.7MB
MD5b7e5071b317550d93258f7e1e13e7b6f
SHA12d08d78a5c29cf724bc523530d1a9014642bbc60
SHA256467de01d7cee7ec54166b80658ff22f9feebdb1c24eaf1629cf40e4124508064
SHA5129c35293c95c1a9141740ac99315605964aa37c4a42d3a11cae9e5649ff1427a9480d3d5e7f763212cf13db3511c5ea3c84e68f95f0067fe6339a9d3fb7b27c54
-
C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dllFilesize
2.7MB
MD5b7e5071b317550d93258f7e1e13e7b6f
SHA12d08d78a5c29cf724bc523530d1a9014642bbc60
SHA256467de01d7cee7ec54166b80658ff22f9feebdb1c24eaf1629cf40e4124508064
SHA5129c35293c95c1a9141740ac99315605964aa37c4a42d3a11cae9e5649ff1427a9480d3d5e7f763212cf13db3511c5ea3c84e68f95f0067fe6339a9d3fb7b27c54
-
C:\Program Files\Malwarebytes\Anti-Malware\offreg.dllFilesize
114KB
MD516663d125398773a90d0a53333b7cf5e
SHA1f92928ae3c9292588547ceaca1cb1d372bfd7936
SHA25638e6811b47262101759aa51a631263d9e3eee5d211164318a751e078afec4cbc
SHA512091764b8ad80aa31eea0bbd91ee505ebdea2654bc8aeaa3081a061d0d37ab13d27dd203075fd0de10c6687591aa0e36139a38af846c4e34e6aa67ab81dc277df
-
C:\Program Files\Malwarebytes\Anti-Malware\offreg.dllFilesize
114KB
MD516663d125398773a90d0a53333b7cf5e
SHA1f92928ae3c9292588547ceaca1cb1d372bfd7936
SHA25638e6811b47262101759aa51a631263d9e3eee5d211164318a751e078afec4cbc
SHA512091764b8ad80aa31eea0bbd91ee505ebdea2654bc8aeaa3081a061d0d37ab13d27dd203075fd0de10c6687591aa0e36139a38af846c4e34e6aa67ab81dc277df
-
C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.catFilesize
10KB
MD583c630f8c1f291b522f2b83fdd2acdc4
SHA1a56949b27a80a6a205c0aa7945fcb879feadeb2d
SHA2566dabd76a6688902db5bd63342c1a88dfbd8fee71855ce556b5d26df7420fb20d
SHA512be56c4da3889f8600f2f7f73fc6ea6a3277195b8ddf626699c4eaeae9f399bbe6d86ce0d9b6fbb5963ac4bdac3acef8e7427f027d9c87aec5750527842d59e3e
-
C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.infFilesize
2KB
MD50ff3f3ba83e1dc78aa42e205e1a01867
SHA10a557f31af77bfccccd9530227d593efb4809fd2
SHA2569c5dad17bd0878115a88a4c94405fbd9048294462eea474f265ddddedc90771e
SHA51280543530d28722b926d3aeda4a0c61fc5bea1812e38a3a1b7b84a5a1803c078bc54c32eff23b96766fd5e27301818f105d86235cdddbaa0dc51ac347ed3d7dfd
-
C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.sysFilesize
233KB
MD51dc6d344ee9b6b024ba23278891db9a5
SHA1519b792d11daa2bf9d127f69cdd603a236576e04
SHA256823e1c7321e177b006c1f3fd1ec8b99607a12d2c3c321f3a6cbbcf7030b6c240
SHA512fb96c4ede03c3aa729d2ea5a72c5f14029f6d69a79b6e0d5449e371bf3acdbbd1cb2079e8bbac3a3140a257c71018bc7a2a31a45ad5c8b65382e67cc3431ab6a
-
C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.sysFilesize
217KB
MD533931ca7d4bd04b8682fe2f996b3bf07
SHA114dcdffa4edf16c59dcd748406c8efb1ba3d2bd4
SHA2565fe3582d567cc48f3d29771d3bf77cad42fbb25327dcb6be6bb0227a1ce02007
SHA512ed60367c5e24d454c48c921ee668bc1006631f339e38273626d3cc0673e906906312faa1febc97c5f616a5f4295a6e03265392950651940ae15e5e7baa1e6f90
-
C:\Program Files\Malwarebytes\Anti-Malware\srvversion.datFilesize
9B
MD58660fa6b5695c6c3edc70ea86961cc9d
SHA100b9b0dc0eeb24a159a072302e8468efae6cdcc6
SHA256e026c8ddaf9bb706e740c3af69724fa54447fb12b55bfbc6a729131b76319de9
SHA51220e131e636bb097af073fc7376b877a88c4491706eeaf1969842d486cd9bd674ec1ed4d28113f4622e4a40bb1af66bf0fa4a21a9debe5cc9375cf0213f9c961b
-
C:\Program Files\Malwarebytes\Anti-Malware\uipkgver.datFilesize
6B
MD574c6677020fc6b6c867aab117078bf5f
SHA18c46db37dc0b39eb963d4144539c8b591e122400
SHA256cdbb9bc874d71e154c71b68b1fe959913d286036dac11e226e5620c919ba9708
SHA5123f9db8d9bb25322f8d8e750750bf92dbe6ac63d686eced65cddfcd61178cf0e947118a491058414d4d2cbb4892e39815565669aee0dfdda23aece72d278292d0
-
C:\Program Files\Malwarebytes\Anti-Malware\version.datFilesize
47B
MD5d0597d6fe6366d4fb3ee555505d4bbd4
SHA1f2dca158ab1e30152f09063d1244dc08659e8bf2
SHA256a7d3c859435cf7432e207b4cfcf76a471854767a6041c9156c76290aa0507933
SHA5124062eeb6bab639b1d9761215d106b5718913667f20c08894531380345ee49aa332768bc32b7bcfdae5b5ec8d5714351a5a50016de120608bc2d7987ab57a60c9
-
C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.jsonFilesize
1KB
MD5e3ebd1e73f37975746ce9c386db908dd
SHA139c1c8475faafd494f4b1ba212f8a3423e55ba81
SHA2567aeb111bddf21965b1ee7bf8221d6565fff1be0e902de816ee660d885afc2639
SHA5128d90bc7b0f0975586285e3e144124c9a78fe0ffe3c7e97f06bbd7d788baa4fd243eea1c657f2d059f4527d1f8898d5dadd4e6e943e3b7968a8a5a5a49a839f09
-
C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.jsonFilesize
47KB
MD5bbe8ff35c906216479f41be7bca62210
SHA12434a947019dfac1539cd3a0cc7ac9abfc32298c
SHA25679a94e678afa12b3668a98a71ec218b79866936db28c73cab2c2c4502dc8348b
SHA5129dd7aea97d1d412c449cd956125d7bab52b20cea9c300cae3f0577adb82aca525ac0da50ec2d8c35402c6d6503b3a19090766dde132d4b131c19ca55bb7d5471
-
C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.jsonFilesize
64KB
MD55c8cd7c39a4a8cc233d33211a3802a4e
SHA18d5f96a812e6f8ccbbc2c4982f1cd296de391983
SHA2561c93e658baf1a014bc91f8a018a6bb0919d6591215175dca0c4ab2d36e627559
SHA51244f34e0df816a361a7048df886e1193dbbb1b0bf6d8a6877a1964f6963990a231058f998bd6c3043ac4f4535ea70fcccfeeb09a7e4cb41968d6a7709dc6c4776
-
C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.jsonFilesize
64KB
MD5b15c117c373f09a0a001d7e9a0c58fe0
SHA11c65640063c168a115814964a4d70cb801b6856c
SHA256f9ee51c4a621f1bb76f9421291e937d397faaac3067b52d30d26843013b56865
SHA5128aa88046d376b7ab9228cfe09b1332455f51cde5c454760fbf3c83a6e6e4500698c566e053740460da68bbf69fdd3c8c17195b3671739820e6a4f5e87c6db960
-
C:\ProgramData\Malwarebytes\MBAMService\config\ArwControllerConfig.jsonFilesize
607B
MD574016087301575279bf915aaf041da8c
SHA1ae001f240a6adf163bc8ee6b9d311298259e467d
SHA256317bce54adaec52fa88f25b40aa5b896ebb42e0da6dfde0a5cf046dd379a47fd
SHA5126f9b3198d88c0b32035d2352b834f74f6f94eab5d51278d535812092fab16e8c9828f2b73a355723acad71eafe103d1a0af3f5321b62406a4fd1718beb40bd76
-
C:\ProgramData\Malwarebytes\MBAMService\config\CleanControllerConfig.jsonFilesize
847B
MD58db3569e0b00e329602c2500a899cd85
SHA1e0958171c46651c40132eadd7617e43aaf874d13
SHA256bf6d03e417e8937451316c7c856031dcce9c44911311b74fa9a13e705878ef4c
SHA512316eac3f83749712567767220d9e3158eaa064d64359d91ee3b7907a4c34b13ede894ebc4b3a301332945b1bcd365fb35d5019e48856c997ee72f408c2f2857f
-
C:\ProgramData\Malwarebytes\MBAMService\config\CleanControllerConfig.jsonFilesize
846B
MD5c644e655d010cb518834db1030af1b22
SHA1bd6337641a998bc5227a509bb58e4f518a58e1e8
SHA2568900424efad5ea4a790bcd315e942dbe04ba09a3b569fb57b96b57cf6c71ace6
SHA512a32c61a206cd9718fd4b75d1094e4acc12e8a63475cfde3008460c0df79d471303bb2a0c3ce0d4af873b646c57e1bfe665e79d5023d02101363db9d171bb295c
-
C:\ProgramData\Malwarebytes\MBAMService\config\CloudConfig.jsonFilesize
825B
MD57ed901f857470621acc6d1810495e0ac
SHA140ee193a3732caaa3cc3d35b2f48087dc26399fe
SHA256407cd5f9d9a33bec8f8fc0f7b1badbc0808583f10c2d49d6bfed2b8c5cc10f26
SHA512c3957b1fea99c3a25a8b322acac7d59974dbd31aa93470795f56077e36b2d1b6c5163c539bab388b9ba43317ccff6249c3eb122f94c33d98771d2bd848a16bf3
-
C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.jsonFilesize
15KB
MD5abcfb84f317e6868a899973db0f54186
SHA1df5b8ac998846c5566bce27eb84caeab1772f54e
SHA25681eaebe71ab6310a28c110388832a6292cbced678720af26249d27230a0f68f9
SHA512cba9f6b1e934a2ee9bab42ac70b66f4a1392b5d844c18e17d287ea6bf826791130adf0891aef5b2b13d99c7415b6a9dafac2fdd7a2d6f5e12d802b5a175b1be8
-
C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.jsonFilesize
15KB
MD5e693c81923b5d615ececcd5eeb589d31
SHA130dfa1e4544b3090ddddc4f39f7dced967dfbbbe
SHA256aa989f2bd4caec96dc4f2804695d22603a8922ecd398f3ac6eabf53d0917ba42
SHA5126bab658f5da7d490138eb8eba7fe6f7e8307e65a362996b0eff4e2259e578fea6c7cf301d4566411c493b0b565bd764339dc020832031c3a0f44ac4c18b18171
-
C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.jsonFilesize
15KB
MD5e2372f9fa3b7c8ea4370a3926f7d1c26
SHA12232a97958d0811387ca701f11df9df0c960ef62
SHA2565b2140d0a53bfcc8043374ce73b8ddd06cbda59adb09445d1d4bed6b36bcf885
SHA512602e76363e2d800e37b6cb8447fcfdc38b512d58bdcc9907b859793165810c9fb83c47c4def3cda89860eefe8e2f9f3c6d22352608ad9fb92232207f46e4f0ac
-
C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.jsonFilesize
15KB
MD51cff2cd178d1c896e9be36ffd000bc1d
SHA16a8a5261dd6defc7270222f51bc0a4ea2db6585c
SHA2562a1636afe67d9eac9ed2b4d0edb3ca3cbfa7530674bdc26fd6a0e02f9778981c
SHA512fc54a7840f651d27b428571333ba4fc168d871cbe9fe4b533631aaa7f2bc56fee011e1a9e2e28c84dd729e836a72e22504527c233f6fb024cd25a266308c0413
-
C:\ProgramData\Malwarebytes\MBAMService\config\MbamClientConfig.jsonFilesize
1KB
MD55d144e8dba7ce832a622a36204860e2d
SHA1e00e3758827df2f6fc8eeff6ef74870af3ac2f57
SHA256b8dcbc0ddea9c5b189eaa6c1634738b39a467520df7cdeb869fbb59f774beea2
SHA5122e8bda111f7960bd1a9c837cd4236d134cd750c5e19b7bfc65a238f476dcb3ab2ba8418461a05b13fe950ff7587f41753a45bc47481e15a23aa460e91af8ff62
-
C:\ProgramData\Malwarebytes\MBAMService\config\MbamClientConfig.jsonFilesize
1KB
MD5a6606c7a902755b53ed4e764b57edff4
SHA15df4e5d95394c621c6b405a2ef29b7cbefc0086b
SHA256ea070c97480b16bc60507264f1893861c0e21649de870cd25947a44c74b172be
SHA512b4ebfa5b36ad63adfa1ac3244a3a466a9a03d31d6e62cef48de3ad0b1c4034c86b120ff1f3b3cd7bf0c045e2a30451a871fb18a65c0cfe054c512690f01aed6d
-
C:\ProgramData\Malwarebytes\MBAMService\config\MbamClientConfig.jsonFilesize
10KB
MD50e50c5469560630abb506c4e51296388
SHA12f760a5c1ae6fe6ea3c2aa247e951112780b0562
SHA25683f107434d30c83f45fe78a82eafe489b8011b5427bb6227fdad6e62822bc297
SHA5127b464fe147349a27d23f24b6a5d8f719c74e8e4d781a6e74e071d8aa5531b58f710c1178d11bc96672d299190835bf988205e8c7b1a2eb1bd3a21a97f8373a5f
-
C:\ProgramData\Malwarebytes\MBAMService\config\MwacControllerConfig.jsonFilesize
1KB
MD59944086a5d3a8cdeddd26fa52e4284e8
SHA1adda41e05113ef207080299ebfe823e36b5b454d
SHA256a730c876e1b1d9ffc1e79f136256241fd9b5aa5af47e406700473898a951c44a
SHA5121da9b4d0a2250d4af08ada044852130d4be4da4876b3a7c4e4ffe5419acc3838b490adf7878c05346278033ed53d8bc52451cfb9d09bcfc35449f71d0cf27b07
-
C:\ProgramData\Malwarebytes\MBAMService\config\MwacControllerConfig.json.bakFilesize
2KB
MD536543912457e1361d58a8547330ced21
SHA10f6788906ad32da6d3bdeabddee5b5023e014073
SHA256f613038033f7bc151466e9ee816521893a0144ad57a46ff5be188eac46655624
SHA51284d5e8c36ad438c5d7c60e187fcfb871ee10a612cf036443d0d708f394a4887384859acd575d8baa4fd2ce708236adc40fe9dd7ba89565d507327d1ee5fc0fb7
-
C:\ProgramData\Malwarebytes\MBAMService\config\PoliciesConfig.jsonFilesize
903B
MD5124c82d97aefbfcf7daaa5308c660f2b
SHA1c91811a0c3168f439749cbbea4799ef082597b4d
SHA256617d2bffbf23e3e0a1ca2df5115e2579d1af70e199b073976c033a951218b8c6
SHA5129d58e4c4cbe8c1ae224ae0b030e17d8cf875185463939ba01e38f8a2a468cd665a4a3d6ed82894e1d3377a6681156b9c17022763e9ea0f3edb9e2ad1c0852976
-
C:\ProgramData\Malwarebytes\MBAMService\config\RtpConfig.jsonFilesize
1KB
MD5a470f4032bb8796f4c361e456ae47c70
SHA17d2165ac66e02329c2639ec489da4246933371ed
SHA2564aedca400c4bce80da1494af4371cd8827da1e99d2fce29086ac004a8345c96a
SHA51207d0aa457197c61478eb0ad19a52a3d2f383850d04fcdbd22f14abb39faf7a1b19b241fab0eb5c8db4c13cb0d051b1a08dfaa321d953b09a2d7b96521c15fa10
-
C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.jsonFilesize
2KB
MD567bf96bfba37cf7524e9d1f68dd3cc18
SHA1859746f070477f9fc3f2b0f871c772f46fd68ddb
SHA256504546d767d7da3de8decebad7b59ce6035a8d7f7fb079e516357bc197ba8ad6
SHA512b8382791caa77b4cf9ad47df10bb7fc3698bec53a293623d5054ead7cb45d55e4ff0eb00ce484c9ca2a59897103973a5ddb8820dc355e43a2b952d8590a4b626
-
C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.jsonFilesize
4KB
MD510664427f77b53c44a504aab845425d6
SHA153b6dcc9e1b935cc1c7b2d2916d091d749916604
SHA256a7f29890728c3cf41bd6f58bece79ef71852692d8684586d3e33c9251299d8d6
SHA512984cd3a312da09b70a2001916774c6ae84723d6486b4ba133980c2af957bb19e977aff96a5467cd20643a376d5d47025457a7ea22615e653d7047927fd1ef90b
-
C:\ProgramData\Malwarebytes\MBAMService\config\SpConfigFile.jsonFilesize
11KB
MD58ad716c69df02f4cb49318fc1d585cf1
SHA1b99a6b00a5013b1f1f613f3218463d08a59132e5
SHA25666d20f3e09c48782a862795ae66150ca90b010b6885901c6c0d713454647ba61
SHA51292a9a2b7ea77926fddbd662e010e46815bbb7c052f8ac131972bdef36fa2542b8be5836d0e617a856933d9e20223c0b6a795762509856e214dc71ff8ba3e66a3
-
C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.jsonFilesize
1KB
MD56aad7881deb37c66302fc9c3bc714342
SHA1ce7f4243f32650333372761e3dcb14aba96edd92
SHA25669df339d39d05bb5573499314bc3eb10f77ddb848f9fccfa29aba00f0d9ee752
SHA5126ce23a70d7ba2befdd9e15050a4f3ac2bc28a682d1ee56757c783b8afb39ab2ae02460186e0a419f938cbf581a2a65cee77394f2033e509d6002e213bd4ce9e5
-
C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.jsonFilesize
1KB
MD50416ee87ee733a31f1a82e599136c198
SHA16362d6354246ebad6d1b5ac2aa9fff5a7660973b
SHA256a020df0fb8d6d7159edf9a304b8c470c13696d710181b573abe488eb33966d81
SHA5127f5f486ae4ba7350a4797bca538d3c788f94bf15b53caf9aa89696c3a35337cb09da1265bbe446846e1b446b2c12b0cdc8859f25b473aafe8964a8e9e423634c
-
C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.jsonFilesize
1KB
MD5cf3f23a071f2a5673ba318ee2b20720f
SHA13b1c4773fc1dd2f65caf04a56e4346fc6cc0398c
SHA256c906cfbd58a60f67ee18070a4a95bb3e08a3f648e39e6582561ccc11ce26ca1b
SHA5128ff120a4b35dc909a44ca2af27ca9ba9662c537354430ba37c17c8dea028f392157df6a62df3872a908966ffa7b26fe0233bd8ac9c24ccdad8936053a1f352c7
-
C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.jsonFilesize
1KB
MD5d0e91a8051fa9081f0b96637c4209ca6
SHA1e625861c7669d12c2d06216a39e73cd6ca05c559
SHA2562a88fb1870d83d5374db9f37942e57c4f21244a35abec6a884d1209543440904
SHA512ece20fe6a4b7f240017d45f7dccec2852959d53e5dcd1c79b1904ea7bcec9430132ebef04b60e4e4c8bd2c3cbc5d3ff1798bffe6f3b44c1e24d48fdb60ddba4e
-
C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.jsonFilesize
1KB
MD5fe053c8c13dfb6df3df5952243dd926f
SHA1a25c39d751e7133b84e203a20f18f156a0d4db3c
SHA2561f324fb16152e5f286f599be55a159d77dba82aeb6f1541b90973c2cbcd5d38f
SHA512d97a9f9075645b33417274d6c37ae24d8a0ef4072f2dced5f623950b54008ba9f992d8a9d0369ae4df4e0425d5cd8256260458f04767da8269c76003a7808dbb
-
C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.jsonFilesize
1KB
MD5003d47615df1aeb5d8f99eed42576e1b
SHA1f2b219a316801061fc935cefb0ac879a5397449c
SHA256467eb722ec5bbd92730bd9b5ce03f7818acb7064a2b6b790d48fd31418d77e64
SHA512bea1df4f8b70e8ba232408e50ab5316327aa1d232c6ee6ed1adc078c8cb464ea92ced7c9d9a5189f528bd97ed2eb950db0f6a8169e70ed7fdcea9851d0677111
-
C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.jsonFilesize
1KB
MD572bfe20f18580e0c862e286af71eb079
SHA19b0e444816ed8109052895ea1ba8fc116f0d690a
SHA256c6f7f15bfd836c2a98363ba92c61e38953a5aea77b56972c6a3decafe4fb3db3
SHA5127fb33df87b5d267346887cbaaad57327cdc5f76673e0e11969fdbe8b5cbacd57d564acf8a8f89d5519477b4c93618e3de2c432e2e93537f1a458dc6b62a6b4a9
-
C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.jsonFilesize
1KB
MD5813602aee506eedb09902e6d4162581f
SHA167fb964e4a6fb12c44570886fca1f3e79401129a
SHA25665a8397e625df6fdbf2d6112c01567a6739e507784dd52dfd336b081cf5146bc
SHA51229b798bdff9a83f9125f1d6f611956424e6fbc54c05f3ef0df8bfe20f09f21628c6f506ed18094ebc6beb5ecc18aad1fbb1f3d28a3188b9ea8d12941984b5500
-
C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.jsonFilesize
1KB
MD5009ec34abffb94a7e3ecbd4c5dc4111d
SHA1a5ff215f15e5685d4672a9ff5071c987327d11e7
SHA256d791dede7a1979b09446e1ab49f3087ed56edc54253f1ee2f443d8cf8afa4c8b
SHA512711273e1c8587cfa0068091800caaa3c0befc221b03d7a2378d53bf6cfa76522160f9c6c71c8dc3c551498fe23966fa293795d411573df90078d6833b0f2d61d
-
C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json.bakFilesize
1KB
MD5ece932ef79a4eb2b452f53efa0e6031d
SHA10dd4bb19647432d7c88f2f4a05ebcfaa94069212
SHA256a5480bbd223325a9477c4b0b08b4dd6dad1c0063001e2a15f323787e7d5b06c3
SHA5127798127f771579fc4447900f612ba96ba1193c316afda867aa9fcdf87204d2d617899260865cfc033809b2d7b3ed8af1b61fbf55d1e2fd6467da374c8ab1e76c
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\Actions.dllFilesize
5.0MB
MD51eff53d95ecaf6bbfffe80d866d8e1dd
SHA1d7ef7d7c77fd04b2c0eb8c16bb3cd08057f6742f
SHA2566dd748f7ca56125cbe158fa3612f08e7312ef58ad5375e6b7ab5532cc16ca0ac
SHA512c59b8e6f0b238a247e64b9c7bb42213dadac1dada63542830a6292361174c935c0c662b2d1aed3fb6100cc4993297b1eaf25e328f2b4613458c4ffca63b9f02d
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\BrowserSDKDLL.dllFilesize
5.8MB
MD51ed53171d00f440f29a12f9beb84dac4
SHA14d9a1e3579b0999f1ab2fa818b588411e9ee920c
SHA256e659e687a872050f9e65d78992d16bd9b393cf3f8e8c94e0e15fb42b7065327e
SHA51217161cfc672d1b996b8af4ebac17f9a8a3807f38c9a23e2e5b4dadcd9a21c3a64faec9bf59147022a9df88b80f89300f1b537091289bd7a42806bd206a317e6e
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\Global.nmFilesize
336KB
MD56d0b653db9f44ea422ff6da077347982
SHA18d90d4266dd3e67a7be513c9bb950a833d40e7de
SHA256d2bda209032b730d45979c43d77a4a9f3db0d6e7a240a463649da32148249925
SHA512888ee79697edb666f6aad3dd1a146ae42919b261b02fed85ab36f50a1a9a2054172c7bcb6aa9cc02530353d7d0c2b83ef268cbc705d9e8df21c50e8b7a362bb6
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\Global.srFilesize
16.0MB
MD58334313ee072e8475287c133b101beee
SHA10774e278ad5d87755c418c4cd7d4a75437b56f13
SHA256a43ebb16b7bb74292b3d7f2a5535080911c70d5020b4a2b718d60863322b8228
SHA512b401b65bba0e05fb6dd110056276a90e63b9b482aa63a4ef871acca91e2852419d3a3e4a0ffe30e09926e201a809c9d32183fe13582de8622b07d471aabc34ed
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\MBAMCore.dllFilesize
6.4MB
MD59db84546ec6408e2eb7c8711df562ad5
SHA1b408a7f0c28b8ef20b1021f3211c7495b7fe9171
SHA256238162c0adab6a1611b428726c5d0b5830b553a9677bee986fc29522563e441e
SHA512a5fdf28b82a16bb512061ebc9cc128e9efdeb3bfcfe50a4c88c2256abe5c5b10f8d237d4ab7788e5eca3dccc9d20251c4ebe8a80856f7a3174d95b24d2c3c6ba
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\cfg.binFilesize
661B
MD58fd13803b1e5f14b4d241facc601a170
SHA17321eec794bc766d84d75bd0370a9f2e4d7abdf6
SHA256925d771b2643715b62ef720801dfa96047fff1ee70eabb244bed802234673717
SHA512f5b3514258487f8576fe32a795eefcffef049c7d002a6abdca17383bba838c7a218be23ec6803dcefed615f40afc2ba4b15bf65c9a74c4f6bb891d15d02bfc22
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\clean.mbdbFilesize
10KB
MD5adcb9fa4bc7e739b8b14e05131cacd30
SHA1d8bd8fab734284d00b5be94dbcd34ab313c2ac48
SHA256d3193a821a20e024d502a4a3f012d09c98a241ed8bb0168d659a9c1a1af1a535
SHA51270e6a26c88883374d9f4fd306cdb9d9daf1ac3bb5f0fe078d890984e01c0fe801a267b02304d4cb17dd31918e243847812fc909f26fcaa51fefe90626bf47361
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\dbmanifest2.datFilesize
924B
MD520250b3d83fd1358b13314feb60620f8
SHA1c824c9aa7c16e385e0c7423b5faa3da91f1344e2
SHA2567679669e6bf77e6111f5a196a9ecc5beae350fa9ca470f4c3809b45ac8fa2ee4
SHA5121a97a4502c8521849cd1d830ae8bc4ca5f6ec15049b77fc42393bcbce57b73a750df10e1ca3f0e1ea588268501bef81881364d63c24aac7b78231ea9e4c0e30b
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\dynconfig.datFilesize
39KB
MD510f23e7c8c791b91c86cd966d67b7bc7
SHA13f596093b2bc33f7a2554818f8e41adbbd101961
SHA256008254ca1f4d6415da89d01a4292911de6135b42833156720a841a22685765dc
SHA5122d1b21371ada038323be412945994d030ee8a9007db072484724616c8597c6998a560bc28886ebf89e2c8919fb70d76c98338d88832351823027491c98d48118
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\exclusions.txtFilesize
23KB
MD5aef4eca7ee01bb1a146751c4d0510d2d
SHA15cf2273da41147126e5e1eabd3182f19304eea25
SHA2569e87e4c9da3337c63b7f0e6ed0eb71696121c74e18a5da577215e18097715e2f
SHA512d31d21e37b0048050b19600f8904354cff3f3ec8291c5a7a54267e14af9fb88dfb6d11e74a037cc0369ade8a8fb9b753861f3b3fb2219563e8ec359f66c042db
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\ig.exeFilesize
1.8MB
MD5d5805286cda5b56039dd2a2d936d4be0
SHA164ba00ec017bbb0d5c9ca4c4ce157808e76c8045
SHA256e6f775537b67e3dd2afcd8700a2a4b75632f14e5a276b1ccfe859996d8bc4850
SHA5124d7575e45eb8a554a38df752ba0653d96da6d52d570356f8803a94656f0777c473268efbcd9350f12ab901781f395e7b0212f8f8e099b6e4582ceb34ede3a5a3
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\mbdigsig2.datFilesize
514B
MD5aeeb9145095aee238fa345ce96d1f49c
SHA14df1b0f5decd16f2c0e36b98e92d461f2e97d30d
SHA256f8ab6808cb85caaeaeae58fbd2f1a9d2906a574631a73ea8ce2bc2c337f60e75
SHA51274502ea59b1c6a4d3f1df53d8aaff90520ad4956700cff3e2a0dcc744f4084216fc74bd217626b277155fd000abaabd30f4cc16c1285a415fe9e2ee1e46858a8
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\prot.mbdbFilesize
24B
MD5546d9e30eadad8b22f5b3ffa875144bf
SHA13b323ffef009bfe0662c2bd30bb06af6dfc68e4d
SHA2566089fbf0c0c1413f62e91dc9497bedc6d8a271e9dc761e20adc0dccf6f4a0c1f
SHA5123478f5dcf7af549dd6fe48ad714604200de84a90120b16a32233b6d44fa7240f5f4e5fe803f54b86bbdfd10fa1bfdd88fb85eb6a78e23e426933f98d0a2565ec
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\rdefs.mbdbFilesize
24B
MD52f7423ca7c6a0f1339980f3c8c7de9f8
SHA1102c77faa28885354cfe6725d987bc23bc7108ba
SHA256850a4ea37a0fd6f68bf95422d502b2d1257264eb90cc38c0a3b1b95aa375be55
SHA512e922ac8a7a2cde6d387f8698207cf5efbd45b646986a090e3549d97a7d552dd74179bd7ac20b7d246ca49d340c4c168982c65b4749df760857810b2358e7eb69
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\rules.mbdbFilesize
9.0MB
MD59a20739b3cca4b23e86755a564bd56e0
SHA1b38e885162039220923e9a4c160021a1549081f5
SHA2569173a8767615833cd9448eac4edf924f55fce4bdd511d8937cf63e26f4477c90
SHA51218baf591ccfccd6b06e26b8c3d7e050700eb17e048316ec34633a22a81a19ef9d225c8b006658b969462e45e810b9ab6ae10b2d83ad866d1398b256771fadde3
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\sample.dllFilesize
529KB
MD5ad6c596fba0e2968c57243a106f9ccc9
SHA12241116bbe1f33ff30cdf26ebc57af85136675f8
SHA2560ccb163eab06671bdc74fa03ec1208d66105960254cf1f9cad584300676c4eb3
SHA5128730556b3beef30296443aa1be1f538a12cbf34dbaa4cd722b269b24f639f599c51970959095b6a5a78bfa8e40cf5f85af64dd637391e5a24fa6dc9b1e6fcaf5
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\scan.mbdbFilesize
1018KB
MD5269ef223b7919ca972577657d3d33d85
SHA11a1eb8ca370beaee913715b1f4b6b8aa53fc4b2a
SHA2564447c30c097ce4276abadc515b94a6f4ad246884fbf64b7dd8ca45246679a6bc
SHA5126358d168e868151e7ef960e1cd9112eca25739bed0be81826ed29b132499ae31fa34d7eb679b40ea3b5a6f60da81735e770133dcfd6cfb0d0553b6c64b606ffb
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\tids.mbdbFilesize
177KB
MD5f0eb4779a5dade2efa5229c33abb4910
SHA141d2c8cdbd8e306a263fe419bb2c1c19514524e9
SHA2569c5242e6c567e641bb10412cd966b81819984ea643ba96222ee0b256b3f53955
SHA5126883622d693265b824d1cb65fe6d9a66d99bc8d167981fa4f0054c7513020361ec09b2c75f62a8afa85dcea175914a4c8f4872ec7040722dcaf7375886bdbd84
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\wprot2.mbdbFilesize
40.5MB
MD511ad702b34346889d5fd70a9f875faff
SHA14a6952107ba24777d90c06b5528f05f45705ce90
SHA2562dc77eb6a488751757a6779b003dee922526000b38ee1d1fb3fe3266079cceea
SHA5123088130d7d57a317a2a38d3a69876f53cd3bca34df3c8ef791bf10fa17156cf811a897fc8e68f3d1fcdcee6a85600668b1c0a0bbece59dbf7fb10f42d76d69bd
-
C:\ProgramData\Malwarebytes\MBAMService\pkgvers.datFilesize
74B
MD5a8340860b065dae8f93853f85bd57787
SHA151e240bcad31e46e8378d94c02847fe7981002f3
SHA256bd6c9fc63887a8687290c2e42aff7380b029b73c56f0fec51740b166380e2aa5
SHA512cc849320c2f19358caa5be539bd65e539db9a55c3e5e83917eb50809c3ec369bf3f6e693d49344338805eb9582008c194721b0183d9b12172a9eb14c72a33b0d
-
C:\Windows\System32\CatRoot2\dberr.txtFilesize
151KB
MD5e002f575e27ec9d447c4b422b543b44b
SHA1037a36af717809d7b65f9555ccac63a247403973
SHA256515d803ef22c93f4515e178bb343d0e4e7b3847523fdbd22c495c45182d1e3cc
SHA512f798299de463c72942a37cee0374ade84d35568b838108b59b3d87aa223f043fd8cce4fac060e1a8665f8979ad482e517169c264e16223a13cc6b7924dc78cd4
-
C:\Windows\Temp\MBInstallTemp6708818c774f11eebfa2cabe9d8e8911\7z.dllFilesize
1.6MB
MD5ab8f0c1a37c0df5c8924aab509db42c9
SHA153dba959124e6d740829bda2360e851bcb85cce8
SHA2566e223b275b84d948cc5ae1f161f0bfff2adb34de04634c84d7dbe9305a4998d5
SHA512ff8a26e8fd5a08c74e5ba93a564e0d3cd932754e7f06993a365bfad06670497889e69ec45bfba1378040b72f82d468e79682beba2439937bb29d2a41da940d4a
-
C:\Windows\Temp\MBInstallTemp6708818c774f11eebfa2cabe9d8e8911\7z.dllFilesize
1.6MB
MD5ab8f0c1a37c0df5c8924aab509db42c9
SHA153dba959124e6d740829bda2360e851bcb85cce8
SHA2566e223b275b84d948cc5ae1f161f0bfff2adb34de04634c84d7dbe9305a4998d5
SHA512ff8a26e8fd5a08c74e5ba93a564e0d3cd932754e7f06993a365bfad06670497889e69ec45bfba1378040b72f82d468e79682beba2439937bb29d2a41da940d4a
-
C:\Windows\Temp\MBInstallTemp6708818c774f11eebfa2cabe9d8e8911\ctlrpkg\mbae64.sysFilesize
154KB
MD595515708f41a7e283d6725506f56f6f2
SHA19afc20a19db3d2a75b6915d8d9af602c5218735e
SHA256321058a27d7462e55e39d253ad5d8b19a9acf754666400f82fe0542f33e733c6
SHA512d9230901adeecb13b1f92287abe9317cdac458348885b96ef6500960793a7586c76ae374df053be948a35b44abe934aa853975a6ccd3788f93909903cc718c08
-
C:\Windows\Temp\MBInstallTemp6708818c774f11eebfa2cabe9d8e8911\servicepkg\MBAMService.exeFilesize
8.9MB
MD503948ad78f44b840ec2296a0fbb9f2fc
SHA1a4c04a502746af80894c13de707bd0282388e12e
SHA2568ffd82021f35885627bbf5a0a55a51963e7e37c5a5d636466e244fa64ad94d65
SHA51235b39c9f7da64a22d4bc8aed88b36bf3d69bb2d45d0ddb360fc909c943d61e067e77da5b54c64406fa7af883b9bd798100193fae2eb790fb304037a6df4d47ee
-
C:\Windows\Temp\MBInstallTemp6708818c774f11eebfa2cabe9d8e8911\servicepkg\mbamelam.catFilesize
10KB
MD560608328775d6acf03eaab38407e5b7c
SHA19f63644893517286753f63ad6d01bc8bfacf79b1
SHA2563ed5a1668713ef80c2b5599b599f1434ad6648999f335cf69757ea3183c70c59
SHA5129f65212121b8a5d1a0625c3baa14ef04a33b091d26f543324333e38dcdb903e02ccc4d009e22c2e85d2f61d954e0b994c2896e52f685003a6ef34758f8a650c7
-
C:\Windows\Temp\MBInstallTemp6708818c774f11eebfa2cabe9d8e8911\servicepkg\mbamelam.infFilesize
2KB
MD5c481ad4dd1d91860335787aa61177932
SHA181633414c5bf5832a8584fb0740bc09596b9b66d
SHA256793626d240fd8eefc81b78a57c8dfe12ea247889b6f07918e9fd32a7411aa1c3
SHA512d292e028936412f07264837d4a321ecfa2f5754d4048c8bcf774a0e076e535b361c411301558609d64c71c1ce9b19e6041efa44d201237a7010c553751e1e830
-
C:\Windows\Temp\MBInstallTemp6708818c774f11eebfa2cabe9d8e8911\servicepkg\mbamelam.sysFilesize
20KB
MD59e77c51e14fa9a323ee1635dc74ecc07
SHA1a78bde0bd73260ce7af9cdc441af9db54d1637c2
SHA256b5619d758ae6a65c1663f065e53e6b68a00511e7d7accb3e07ed94bfd0b1ede0
SHA512a12ccf92bead694f5d3cba7ff7e731a2f862198efc338efc7f33a882fe0eb7499fb3fb533538d0a823e80631a7ca162962fbdfd78e401e3255672910b7140186
-
C:\Windows\Temp\MBInstallTemp6708818c774f11eebfa2cabe9d8e8911\servicepkg\mbshlext.dllFilesize
2.7MB
MD5b7e5071b317550d93258f7e1e13e7b6f
SHA12d08d78a5c29cf724bc523530d1a9014642bbc60
SHA256467de01d7cee7ec54166b80658ff22f9feebdb1c24eaf1629cf40e4124508064
SHA5129c35293c95c1a9141740ac99315605964aa37c4a42d3a11cae9e5649ff1427a9480d3d5e7f763212cf13db3511c5ea3c84e68f95f0067fe6339a9d3fb7b27c54
-
C:\Windows\Temp\MBInstallTemp6708818c774f11eebfa2cabe9d8e8911\uipkg\QtQuick\Controls.2\HorizontalHeaderView.qmlFilesize
1KB
MD5d8c9674c0e9bddbd8aa59a9d343cf462
SHA1490aa022ac31ddce86d5b62f913b23fbb0de27c2
SHA2561ef333b5fb4d8075973f312ef787237240b9f49f3f9185fb21202883f900e7d7
SHA5120b86ec673133f6400c38b79f9ba4f7b37ce5afdab1a2e34acbf75019e2590cc26b26d323ddc1567c91375053c9c8593be0615389db8eb1a8d1eb084ad4200b82
-
C:\Windows\Temp\MBInstallTemp6708818c774f11eebfa2cabe9d8e8911\uipkg\QtQuick\Controls.2\Imagine\VerticalHeaderView.qmlFilesize
1KB
MD5829769b2741d92df3c5d837eee64f297
SHA1f61c91436ca3420c4e9b94833839fd9c14024b69
SHA256489c02f8716e7a1de61834b3d8bbb61bce91ca4a33a6b62342b4c851d93e51e0
SHA5124061c271db37523b9dea9a9973226d91337e1809d4e7767e57ac938d35d77a302363ed92ab4be18c35ba589f528194ad71c93a8507449bf74dd035acf7cdb521
-
memory/1376-4118-0x00007FF9C38D0000-0x00007FF9C3E3B000-memory.dmpFilesize
5.4MB
-
memory/1376-4119-0x00007FF9C34B0000-0x00007FF9C38CE000-memory.dmpFilesize
4.1MB
-
memory/1376-4120-0x00007FF6E4C30000-0x00007FF6E62EA000-memory.dmpFilesize
22.7MB
-
memory/1376-4122-0x0000023EABEA0000-0x0000023EABEB0000-memory.dmpFilesize
64KB
-
memory/1376-4268-0x0000023EABEA0000-0x0000023EABEB0000-memory.dmpFilesize
64KB
-
memory/1376-4678-0x0000023EABEA0000-0x0000023EABEB0000-memory.dmpFilesize
64KB
-
memory/4088-4115-0x0000021DFA520000-0x0000021DFA720000-memory.dmpFilesize
2.0MB
-
memory/4088-4113-0x0000021DFA0E0000-0x0000021DFA520000-memory.dmpFilesize
4.2MB
-
memory/4088-4112-0x0000021DF7A90000-0x0000021DF7AA0000-memory.dmpFilesize
64KB
-
memory/4088-4111-0x00007FF9C38D0000-0x00007FF9C3E3B000-memory.dmpFilesize
5.4MB
-
memory/4088-4110-0x00007FF9C34B0000-0x00007FF9C38CE000-memory.dmpFilesize
4.1MB