Analysis
-
max time kernel
134s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system -
submitted
28-11-2023 10:45
Static task
static1
Behavioral task
behavioral1
Sample
MBSetup.exe
Resource
win10v2004-20231127-en
Errors
General
-
Target
MBSetup.exe
-
Size
2.5MB
-
MD5
1e885823577394ea61ea89438ffe2954
-
SHA1
e53e96f7374790bdad8a614949b398b055c3a27b
-
SHA256
7c0b9bceed390f7f28135431c09ac51469ee8e2b8095fb36a37315d811d9ba9c
-
SHA512
73f600833dad0047b6444110d722dc95237b38bb486abc7fc8e4f59b69e2154c885fb46d65f488d5139a0b6e76ebde33ea72711c7f58436650ef992fb8995627
-
SSDEEP
49152:Lw3ye9SPQ1sjDAVj+JeRanStQyfvE0Z3R0nxiIq2ddAsuysSiSF:4yeoCVj+c6KtQRq2ADSiSF
Malware Config
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
MBSetup.exedescription pid process target process PID 4504 created 3260 4504 MBSetup.exe Explorer.EXE -
Downloads MZ/PE file
-
Drops file in Drivers directory 12 IoCs
Processes:
MBAMService.exeMBAMInstallerService.exeMBAMService.exeMBSetup.exedescription ioc process File created C:\Windows\system32\DRIVERS\SETBCF3.tmp MBAMService.exe File opened for modification C:\Windows\system32\DRIVERS\SETC272.tmp MBAMService.exe File created C:\Windows\system32\DRIVERS\SETC272.tmp MBAMService.exe File created C:\Windows\system32\drivers\mbae64.sys MBAMInstallerService.exe File opened for modification C:\Windows\system32\DRIVERS\SETBA04.tmp MBAMService.exe File opened for modification C:\Windows\system32\DRIVERS\MbamElam.sys MBAMService.exe File created C:\Windows\system32\DRIVERS\SETBA04.tmp MBAMService.exe File opened for modification C:\Windows\system32\DRIVERS\mbamswissarmy.sys MBAMService.exe File opened for modification C:\Windows\system32\DRIVERS\SETBCF3.tmp MBAMService.exe File opened for modification C:\Windows\system32\DRIVERS\MbamChameleon.sys MBAMService.exe File created C:\Windows\SysWOW64\drivers\mbamtestfile.dat MBSetup.exe File created C:\Windows\system32\DRIVERS\MbamElam.sys MBAMService.exe -
Modifies RDP port number used by Windows 1 TTPs
-
Sets service image path in registry 2 TTPs 2 IoCs
Processes:
MBAMService.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MBAMChameleon\ImagePath = "\\SystemRoot\\System32\\Drivers\\MbamChameleon.sys" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MBAMSwissArmy\ImagePath = "\\SystemRoot\\System32\\Drivers\\mbamswissarmy.sys" MBAMService.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
MBSetup.exeMBAMService.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion MBSetup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate MBSetup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion MBAMService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate MBAMService.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
MBAMInstallerService.exeMBAMService.exedescription ioc process File opened (read-only) \??\X: MBAMInstallerService.exe File opened (read-only) \??\A: MBAMService.exe File opened (read-only) \??\I: MBAMService.exe File opened (read-only) \??\H: MBAMInstallerService.exe File opened (read-only) \??\J: MBAMInstallerService.exe File opened (read-only) \??\R: MBAMInstallerService.exe File opened (read-only) \??\L: MBAMService.exe File opened (read-only) \??\N: MBAMService.exe File opened (read-only) \??\N: MBAMInstallerService.exe File opened (read-only) \??\Q: MBAMInstallerService.exe File opened (read-only) \??\G: MBAMInstallerService.exe File opened (read-only) \??\T: MBAMInstallerService.exe File opened (read-only) \??\Y: MBAMInstallerService.exe File opened (read-only) \??\H: MBAMService.exe File opened (read-only) \??\Q: MBAMService.exe File opened (read-only) \??\R: MBAMService.exe File opened (read-only) \??\Y: MBAMService.exe File opened (read-only) \??\A: MBAMInstallerService.exe File opened (read-only) \??\O: MBAMInstallerService.exe File opened (read-only) \??\V: MBAMInstallerService.exe File opened (read-only) \??\M: MBAMService.exe File opened (read-only) \??\O: MBAMService.exe File opened (read-only) \??\V: MBAMService.exe File opened (read-only) \??\E: MBAMInstallerService.exe File opened (read-only) \??\K: MBAMInstallerService.exe File opened (read-only) \??\W: MBAMService.exe File opened (read-only) \??\X: MBAMService.exe File opened (read-only) \??\U: MBAMInstallerService.exe File opened (read-only) \??\E: MBAMService.exe File opened (read-only) \??\J: MBAMService.exe File opened (read-only) \??\K: MBAMService.exe File opened (read-only) \??\T: MBAMService.exe File opened (read-only) \??\U: MBAMService.exe File opened (read-only) \??\P: MBAMInstallerService.exe File opened (read-only) \??\P: MBAMService.exe File opened (read-only) \??\S: MBAMService.exe File opened (read-only) \??\Z: MBAMService.exe File opened (read-only) \??\B: MBAMInstallerService.exe File opened (read-only) \??\M: MBAMInstallerService.exe File opened (read-only) \??\G: MBAMService.exe File opened (read-only) \??\S: MBAMInstallerService.exe File opened (read-only) \??\B: MBAMService.exe File opened (read-only) \??\I: MBAMInstallerService.exe File opened (read-only) \??\L: MBAMInstallerService.exe File opened (read-only) \??\W: MBAMInstallerService.exe File opened (read-only) \??\Z: MBAMInstallerService.exe -
Drops file in System32 directory 2 IoCs
Processes:
MBAMService.exeMBAMService.exedescription ioc process File opened for modification C:\Windows\System32\CatRoot2\dberr.txt MBAMService.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt MBAMService.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 64 IoCs
Processes:
MBAMInstallerService.exeMBAMService.exeMBSetup.exedescription ioc process File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Base\images\arrow-down.png MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Fusion\RadioDelegate.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Fusion\SwitchDelegate.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Universal\SpinBox.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQml\Models.2\qmldir MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\StatusBar.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Drawer.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Universal\Dialog.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\api-ms-win-core-debug-l1-1-0.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Base\HandleStyleHelper.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Material\TabBar.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Universal\DialogButtonBox.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Dialogs\WidgetFileDialog.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Private\EditMenu_base.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\TableViewColumn.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\Qt\labs\folderlistmodel\plugins.qmltypes MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Material\SwipeView.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\mbae64.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Fusion\SwitchIndicator.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Material\ItemDelegate.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\ToolTip.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.cat MBAMService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\MWACControllerImpl.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Base\StatusIndicatorStyle.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Imagine\ScrollIndicator.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Material\MenuBar.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Base\ToolBarStyle.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Desktop\TableViewStyle.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Desktop\SpinBoxStyle.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Menu.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\BusyIndicator.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Private\BasicButton.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Fusion\TabBar.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Imagine\ApplicationWindow.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Material\StackView.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Universal\ToolButton.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\PrivateWidgets\widgetsplugin.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Base\images\spinner_large.png MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Fusion\ScrollIndicator.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Imagine\Label.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Imagine\Popup.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Extras\Private\Handle.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\msvcp140_1.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\sentrynativesdk.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\api-ms-win-crt-utility-l1-1-0.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\Qt\labs\settings\plugins.qmltypes MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\qmldir MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Fusion\RadioButton.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Imagine\Tumbler.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Universal\BusyIndicator.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Dialogs\qml\DefaultWindowDecoration.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\MBAMCrashHandler.exe MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\api-ms-win-core-file-l1-2-0.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Fusion\Page.qml MBAMInstallerService.exe File opened for modification C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.json MBAMService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\plugins.qmltypes MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Private\ToolMenuButton.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtWinExtras\JumpListDestination.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Private\ContentItem.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Private\style.js MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Universal\plugins.qmltypes MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Window.2\windowplugin.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe MBSetup.exe File created C:\Program Files\Malwarebytes\Anti-Malware\languages\lang_de.qm MBAMInstallerService.exe -
Drops file in Windows directory 1 IoCs
Processes:
MBAMService.exedescription ioc process File opened for modification C:\Windows\security\logs\scecomp.log MBAMService.exe -
Executes dropped EXE 5 IoCs
Processes:
MBAMInstallerService.exeMBAMService.exeMBAMService.exembamtray.exembam.exepid process 3476 MBAMInstallerService.exe 4912 MBAMService.exe 3640 MBAMService.exe 5824 mbamtray.exe 4572 mbam.exe -
Loads dropped DLL 64 IoCs
Processes:
MBAMInstallerService.exeMBAMService.exembamtray.exembam.exepid process 3476 MBAMInstallerService.exe 3476 MBAMInstallerService.exe 3640 MBAMService.exe 3640 MBAMService.exe 3640 MBAMService.exe 3640 MBAMService.exe 3640 MBAMService.exe 3640 MBAMService.exe 3640 MBAMService.exe 3640 MBAMService.exe 3640 MBAMService.exe 3640 MBAMService.exe 3640 MBAMService.exe 3640 MBAMService.exe 3640 MBAMService.exe 3640 MBAMService.exe 3640 MBAMService.exe 3640 MBAMService.exe 3640 MBAMService.exe 3640 MBAMService.exe 3640 MBAMService.exe 3640 MBAMService.exe 3640 MBAMService.exe 3640 MBAMService.exe 3640 MBAMService.exe 3640 MBAMService.exe 3640 MBAMService.exe 3476 MBAMInstallerService.exe 5824 mbamtray.exe 5824 mbamtray.exe 5824 mbamtray.exe 5824 mbamtray.exe 5824 mbamtray.exe 5824 mbamtray.exe 5824 mbamtray.exe 5824 mbamtray.exe 5824 mbamtray.exe 5824 mbamtray.exe 5824 mbamtray.exe 5824 mbamtray.exe 5824 mbamtray.exe 5824 mbamtray.exe 5824 mbamtray.exe 5824 mbamtray.exe 5824 mbamtray.exe 5824 mbamtray.exe 5824 mbamtray.exe 5824 mbamtray.exe 5824 mbamtray.exe 5824 mbamtray.exe 5824 mbamtray.exe 5824 mbamtray.exe 5824 mbamtray.exe 5824 mbamtray.exe 5824 mbamtray.exe 5824 mbamtray.exe 5824 mbamtray.exe 5824 mbamtray.exe 5824 mbamtray.exe 5824 mbamtray.exe 5824 mbamtray.exe 4572 mbam.exe 4572 mbam.exe 4572 mbam.exe -
Registers COM server for autorun 1 TTPs 64 IoCs
Processes:
MBAMService.exeMBAMService.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE8A9269-9E6E-4683-BCD3-41E9B16696DC}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F415899A-1576-4C8B-BC9F-4854781F8A20}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{130CD414-6BFD-4F6C-9362-A2264B222E76}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{580243BF-3CEE-4131-A599-C6FED66BEB1B}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{580243BF-3CEE-4131-A599-C6FED66BEB1B}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE8A9269-9E6E-4683-BCD3-41E9B16696DC}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{03141A2A-5C3A-458E-ABEC-0812AD7FF497}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9DAB0CA5-AE19-41AE-955C-41DD44C52697}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57CE581A-0CB6-4266-9CA0-19364C90A0B3}\InprocServer32\ThreadingModel = "Apartment" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F36AD0D0-B5F0-4C69-AF08-603D177FEF0E}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{11D1E5E8-14E1-4B5B-AE1A-2678CB91E8E5}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{130CD414-6BFD-4F6C-9362-A2264B222E76}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE8A9269-9E6E-4683-BCD3-41E9B16696DC}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{17BE78EE-B40A-4B9E-835F-38EC62F9D479}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{11D1E5E8-14E1-4B5B-AE1A-2678CB91E8E5}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BF474111-9116-45C6-AF53-209E64F1BB53}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DE03E614-112D-43E0-8E15-E7236CC32108}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9DAB0CA5-AE19-41AE-955C-41DD44C52697}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F1C46F8-E697-4175-B240-CDE682A4BA2D}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D372F21-E6DA-4B82-881A-79F6CA6B6AE1}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D372F21-E6DA-4B82-881A-79F6CA6B6AE1}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{130CD414-6BFD-4F6C-9362-A2264B222E76}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{03141A2A-5C3A-458E-ABEC-0812AD7FF497}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57CE581A-0CB6-4266-9CA0-19364C90A0B3}\InprocServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{580243BF-3CEE-4131-A599-C6FED66BEB1B}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D5599B6B-FA0C-45B5-8309-853B003EA412}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D5599B6B-FA0C-45B5-8309-853B003EA412}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F6D29500-933C-447C-9D88-9D814AF73808}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{278637DA-FDFB-45C7-8CD8-F2D8A9199AB0}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{278637DA-FDFB-45C7-8CD8-F2D8A9199AB0}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36A65E46-6CC1-4CA2-B51E-F4DD8C993DDC}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DE03E614-112D-43E0-8E15-E7236CC32108}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{251AD013-20AD-4C3F-8FE2-F66A429B4819}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36A65E46-6CC1-4CA2-B51E-F4DD8C993DDC}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BF474111-9116-45C6-AF53-209E64F1BB53}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F1C46F8-E697-4175-B240-CDE682A4BA2D}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9DAB0CA5-AE19-41AE-955C-41DD44C52697}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F36AD0D0-B5F0-4C69-AF08-603D177FEF0E}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{376BE474-56D4-4177-BB4E-5610156F36C8}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{251AD013-20AD-4C3F-8FE2-F66A429B4819}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F6D29500-933C-447C-9D88-9D814AF73808}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{278637DA-FDFB-45C7-8CD8-F2D8A9199AB0}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{11D1E5E8-14E1-4B5B-AE1A-2678CB91E8E5}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36A65E46-6CC1-4CA2-B51E-F4DD8C993DDC}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F6D29500-933C-447C-9D88-9D814AF73808}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DE03E614-112D-43E0-8E15-E7236CC32108}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E1AC7139-D1FF-4DE9-84A4-92E2B47F5D2A}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{17BE78EE-B40A-4B9E-835F-38EC62F9D479}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{376BE474-56D4-4177-BB4E-5610156F36C8}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F36AD0D0-B5F0-4C69-AF08-603D177FEF0E}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F415899A-1576-4C8B-BC9F-4854781F8A20}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E1AC7139-D1FF-4DE9-84A4-92E2B47F5D2A}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D372F21-E6DA-4B82-881A-79F6CA6B6AE1}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E1AC7139-D1FF-4DE9-84A4-92E2B47F5D2A}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{17BE78EE-B40A-4B9E-835F-38EC62F9D479}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D5599B6B-FA0C-45B5-8309-853B003EA412}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F415899A-1576-4C8B-BC9F-4854781F8A20}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{251AD013-20AD-4C3F-8FE2-F66A429B4819}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{03141A2A-5C3A-458E-ABEC-0812AD7FF497}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F36AD0D0-B5F0-4C69-AF08-603D177FEF0E}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F1C46F8-E697-4175-B240-CDE682A4BA2D}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57CE581A-0CB6-4266-9CA0-19364C90A0B3}\InprocServer32\ = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbshlext.dll" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BF474111-9116-45C6-AF53-209E64F1BB53}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{376BE474-56D4-4177-BB4E-5610156F36C8}\LocalServer32 MBAMService.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
MBAMService.exedescription ioc process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MBAMService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MBAMService.exe -
Processes:
MBAMService.exeMBAMInstallerService.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION MBAMService.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\mbam.exe = "11000" MBAMService.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\mbamtray.exe = "11000" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION MBAMInstallerService.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\mbam.exe = "11000" MBAMInstallerService.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\mbamtray.exe = "11000" MBAMInstallerService.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
MBAMInstallerService.exeMBAMService.exeLogonUI.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0\Common\Security MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\15.0\Common\Security MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\16.0 MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs MBAMInstallerService.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Malwarebytes\FirstRun = "false" MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Malwarebytes MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\Software MBAMInstallerService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\16.0\Common MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\15.0\Common MBAMInstallerService.exe Set value (str) \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:\ MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs MBAMService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\15.0 MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\16.0 MBAMInstallerService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Key created \REGISTRY\USER\S-1-5-19\Software MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: MBAMInstallerService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" MBAMService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\16.0\Common\Security MBAMInstallerService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\15.0\Common MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\15.0\Common\Security MBAMInstallerService.exe Set value (str) \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:\ MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\16.0 MBAMInstallerService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Malwarebytes\FirstRun = "false" MBAMInstallerService.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:\ MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications MBAMInstallerService.exe Set value (str) \REGISTRY\USER\S-1-5-19\SOFTWARE\Malwarebytes\FirstRun = "false" MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: MBAMInstallerService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "108" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Malwarebytes MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\15.0 MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0\Common MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\16.0\Common\Security MBAMInstallerService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates MBAMService.exe -
Modifies registry class 64 IoCs
Processes:
MBAMService.exeMBAMService.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BF153224-DA64-41F1-AA87-321B345870FA}\TypeLib\ = "{A82129F1-32E1-4D79-A39F-EBFEE53A70BF}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DAD5232C-6E05-4458-9709-0B4DCB22EA09}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{72F290D5-789C-4D8A-9EBE-63ECEA150373}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6357A98F-CE03-4C67-9410-00907FB21BC7}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{566DC5CA-A3C4-4959-AB92-37606E12AAFF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CE7ABFE9-8F8F-4EDD-86BD-9209FD072126}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E41AC038-1688-417F-BE23-52D898B93903}\ = "ITelemetryControllerV7" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E7DAEEB9-30B6-4AC4-BB74-7763C950D8EC}\ProxyStubClsid32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{014D0CF7-ACC9-4004-B999-7BDBAAD274B7}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDCB7916-7DE8-44C8-BAF6-F1BBB3268456}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0C4652FC-FA35-4394-A133-F68409776465}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8D488C7C-023D-4561-B377-DD9FB7124326}\ = "ICleanControllerV6" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B471ACFB-E67A-4BE9-A328-F6A906DDDEAA}\TypeLib\ = "{5709DEEB-F05E-4D5C-8DC4-3B0D924EE08F}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{08932AD2-C415-4DE8-821D-5AF7A5658483}\TypeLib\ = "{5709DEEB-F05E-4D5C-8DC4-3B0D924EE08F}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B32065E5-189E-4C5F-AA59-32A158BAF5B7}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3DCF0F42-EF8F-4450-BA68-42B61F594B2F}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{97EB7268-0D7B-43F6-9C11-337287F960DF}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{376BE474-56D4-4177-BB4E-5610156F36C8}\VersionIndependentProgID\ = "MB.UpdateController" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{36BABBB6-6184-44EC-8109-76CBF522C9EF}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1E3F0FEC-3E40-4137-8C7D-090AFA9B6C5E}\TypeLib\ = "{226C1698-A075-4315-BB5D-9C164A96ACE7}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1C510D99-F27D-457F-9469-CFC179DBE0C7}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CFFF19F6-ECFE-446D-ACAD-8DC525DA2563}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2A153977-1A37-4EF7-9226-9E128FA51AE1}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{96C7187E-6EC4-49BD-88C7-04A3A8A97CC5}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E2870643-0645-41F9-BCCB-F5969386162C}\ = "_IRTPControllerEventsV4" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{620A01DD-16D2-4A83-B02C-E29BE38B3029}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B32065E5-189E-4C5F-AA59-32A158BAF5B7}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{68E3012A-E3EC-4D66-9132-4E412F487165}\TypeLib\ = "{5709DEEB-F05E-4D5C-8DC4-3B0D924EE08F}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D7A05281-DB9E-4E02-9680-E4D83CDAA6AB}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{332AFEBA-9341-4CEC-8EA6-DB155A99DF63}\1.0\HELPDIR MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F22E03D6-F159-40A0-9476-16F3377B58C9} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{19B9825A-26E8-468B-BD9F-3034509098F0}\ = "IMWACControllerEventsV11" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAB53395-8218-47FF-91B7-144994C0AD83}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{36F3C7D7-BCB1-4359-AB71-0CB816FE3D38}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{376BE474-56D4-4177-BB4E-5610156F36C8}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B44D50B8-E459-4078-9249-3763459B2676}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{08927360-710B-483B-BEEC-17E51FF84AF9}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{893E5593-9490-4E90-9F1E-0B786EC41470}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0C30B7D9-82A1-4068-8A5B-F4C7D5EF75A3}\ = "IScanControllerEventsV14" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{115D004C-CC20-4945-BCC8-FE5043DD42D0} MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3B42C782-9650-4EFF-9618-91118DF96061}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FC60FEE4-E373-4962-B548-BA2E06119D54}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D57ACF19-30E3-4B7E-BCDD-6EEB8E57AF27}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{55E4B8FB-921C-4751-8B2D-AE33BD7D0B74} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57CE581A-0CB6-4266-9CA0-19364C90A0B3}\InprocServer32\ = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbshlext.dll" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{90A62FAD-6FA9-4454-8CEE-7EDF67437226}\TypeLib\Version = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F128CCB-D86F-4998-803A-7CD58474FE2C} MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A0101B90-FD0B-40CF-90E4-33650F09A80F}\ProxyStubClsid32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{49F6AC60-2104-42C6-8F71-B3916D5AA732}\1.0 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{49F6AC60-2104-42C6-8F71-B3916D5AA732}\1.0\ = "MWACControllerCOMLib" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1C510D99-F27D-457F-9469-CFC179DBE0C7}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C9669A3D-81E8-46F6-A51E-815A0863D612}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{964AD404-A1EF-4EDA-B8FA-1D8003B29B10}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4E0F1EE6-E7CA-4BEE-8C08-0959842DA615}\TypeLib\ = "{783B187E-360F-419C-B6DA-592892764A01}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{90F4450A-B7B2-417C-8ABB-BBD1BDFBFC27}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAB53395-8218-47FF-91B7-144994C0AD83}\ = "IAEController" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{71B13605-3569-4F4A-B971-08FF179A3A60}\ = "_IScannerEvents" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F275D775-3A22-4C5A-B9AD-6FE8008304D0}\TypeLib\Version = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{83D0C30B-ECF4-40C5-80EC-21BB47F898A9}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{08927360-710B-483B-BEEC-17E51FF84AF9}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DB82CDC6-F12A-4156-8DBF-EC7465B9C0B9}\ProxyStubClsid32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B9442AA1-AEB8-4FB4-B998-BFBC37BA8A99}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0E64B3CF-7D56-4F76-8B9F-A6CD0D3393AE}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B471ACFB-E67A-4BE9-A328-F6A906DDDEAA} MBAMService.exe -
Processes:
MBAMInstallerService.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\2AD974A775F73CBDBBD8F5AC3A49255FA8FB1F8C\Blob = 0300000001000000140000002ad974a775f73cbdbbd8f5ac3a49255fa8fb1f8c2000000001000000620400003082045e30820346a0030201020213077312380b9d6688a33b1ed9bf9ccda68e0e0f300d06092a864886f70d01010b05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412031301e170d3232303832333232323132385a170d3330303832333232323132385a303c310b3009060355040613025553310f300d060355040a1306416d617a6f6e311c301a06035504031313416d617a6f6e205253412032303438204d303130820122300d06092a864886f70d01010105000382010f003082010a0282010100eb712ca9cb1f8828923230af8a570f78b73725955587ac675c97d322c8daa214676b7cf067dae2032ab356125dc6b547f96708a7937a9592180fb4f9f910369a7f2f80b64fba134ec75d531ee0dd96330720d396bc12e4745042a1051373b54f9b4424fe2d7fedbc2285ec362133977506ce271882dce3d9c582078d5e26012626671fd93f13cf32ba6bad7864fcaaff0e023c07df9c0578728cfdea75b7032884dae86e078cd05085ef8154b2716eec6d62ef8f94c35ee9c4a4d091c02e249198caeeba258ed4f671b6fb5b6b38064837478d86dcf2ea06fb76377d9eff424e4d588293cfe271c278b17aab4b5b94378881e4d9af24aef872c565fb4bb451e70203010001a382015a3082015630120603551d130101ff040830060101ff020100300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030106082b06010505070302301d0603551d0e0416041481b80e638a891218e5fa3b3b50959fe6e5901385301f0603551d230418301680148418cc8534ecbc0c94942e08599cc7b2104e0a08307b06082b06010505070101046f306d302f06082b060105050730018623687474703a2f2f6f6373702e726f6f746361312e616d617a6f6e74727573742e636f6d303a06082b06010505073002862e687474703a2f2f6372742e726f6f746361312e616d617a6f6e74727573742e636f6d2f726f6f746361312e636572303f0603551d1f043830363034a032a030862e687474703a2f2f63726c2e726f6f746361312e616d617a6f6e74727573742e636f6d2f726f6f746361312e63726c30130603551d20040c300a3008060667810c010201300d06092a864886f70d01010b05000382010100ad00de0205232e063262b46bb19416e41140de2bfa59c135efe0aa8f2b41b9d1f38739001df23db5a7470c0606c691f3075702d4edbd17c1909abf4875a2074f30dd4a6a42b50d3d15c00ffe845bc63c99cc5752b1d86e12d59692934b94e507e88982086a7a34d49e64e13d876a92909a63a14bf88fb6ea34d305be20c2de06e28c9f738b9f4d3985cace19369d85c99ec9f8503fb67e88a1efca84068b50b40a5ca61c44f1fdc8614060f26125aa07f4c7c27375e40c0b428d04e55f4448995b7b898196a7889d4b0d62e804c4d7feb4e8b26dcaecc01cbc385b1ddf85ce5b7ae3494b6cb9a7ddf405b249ade1c5146bc2ccebcd7fd65869bac3207e7fb0b8 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8DA7F965EC5EFC37910F1C6E59FDC1CC6A6EDE16 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\5A8CEF45D7A69859767A8C8B4496B578CF474B1A MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0D44DD8C3C8C1A1A58756481E90F2E2AFFB3D26E\Blob = 0300000001000000140000000d44dd8c3c8c1a1a58756481e90f2e2affb3d26e2000000001000000ba010000308201b63082015ba0030201020213066c9fd5749736663f3b0b9ad9e89e7603f24a300a06082a8648ce3d0403023039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412033301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f7420434120333059301306072a8648ce3d020106082a8648ce3d030107034200042997a7c6417fc00d9be8011b56c6f252a5ba2db212e8d22ed7fac9c5d8aa6d1f73813b3b986b397c33a5c54e868e8017686245577d44581db337e56708eb66dea3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414abb6dbd7069e37ac3086079170c79cc419b178c0300a06082a8648ce3d0403020349003046022100e08592a317b78df92b06a593ac1a98686172fae1a1d0fb1c7860a64399c5b8c40221009c02eff1949cb396f9ebc62af8b62cfe3a901416d78c6324481cdf307dd5683b MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\1C58A3A8518E8759BF075B76B750D4F2DF264FCD\Blob = 0300000001000000140000001c58a3a8518e8759bf075b76b750d4f2df264fcd2000000001000000c2040000308204be308203a6a003020102021006d8d904d5584346f68a2fa754227ec4300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3231303431343030303030305a170d3331303431333233353935395a304f310b300906035504061302555331153013060355040a130c446967694365727420496e633129302706035504031320446967694365727420544c53205253412053484132353620323032302043413130820122300d06092a864886f70d01010105000382010f003082010a0282010100c14bb3654770bcdd4f58dbec9cedc366e51f311354ad4a66461f2c0aec6407e52edcdcb90a20eddfe3c4d09e9aa97a1d8288e51156db1e9f58c251e72c340d2ed292e156cbf1795fb3bb87ca25037b9a52416610604f571349f0e8376783dfe7d34b674c2251a6df0e9910ed57517426e27dc7ca622e131b7f238825536fc13458008b84fff8bea75849227b96ada2889b15bca07cdfe951a8d5b0ed37e236b4824b62b5499aecc767d6e33ef5e3d6125e44f1bf71427d58840380b18101faf9ca32bbb48e278727c52b74d4a8d697dec364f9cace53a256bc78178e490329aefb494fa415b9cef25c19576d6b79a72ba2272013b5d03d40d321300793ea99f50203010001a38201823082017e30120603551d130101ff040830060101ff020100301d0603551d0e04160414b76ba2eaa8aa848c79eab4da0f98b2c59576b9f4301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030106082b06010505070302307606082b06010505070101046a3068302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304006082b060105050730028634687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274476c6f62616c526f6f7443412e63727430420603551d1f043b30393037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274476c6f62616c526f6f7443412e63726c303d0603551d2004363034300b06096086480186fd6c02013007060567810c01013008060667810c0102013008060667810c0102023008060667810c010203300d06092a864886f70d01010b050003820101008032ce5e0bdd6e5a0d0aafe1d684cbc08efa8570edda5db30cf72b7540fe850afaf33178b7704b1a8958ba80bdf36b1de97ecf0bba589c59d490d3fd6cfdd0986db771825bcf6d0b5a09d07bdec443d82aa4de9e41265fbb8f99cbddaee1a86f9f87fe74b71f1b20abb14fc6f5675d5d9b3ce9ff69f7616cd6d9f3fd36c6ab038876d24b2e7586e3fcd8557d26c21177df3e02b67cf3ab7b7a86366fb8f7d89371cf86df7330fa7babed2a59c842843b11171a52f3c90e147da25b7267ba71ed574766c5b8024a65345e8bd02a3c209c51994ce7529ef76b112b0d927e1de88aeb36164387ea2a63bf753febdec403bb0a3cf730efebaf4cfc8b3610733ef3a4 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8DA7F965EC5EFC37910F1C6E59FDC1CC6A6EDE16\Blob = 0300000001000000140000008da7f965ec5efc37910f1c6e59fdc1cc6a6ede162000000001000000450300003082034130820229a0030201020213066c9fcf99bf8c0a39e2f0788a43e696365bca300d06092a864886f70d01010b05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412031301e170d3135303532363030303030305a170d3338303131373030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f74204341203130820122300d06092a864886f70d01010105000382010f003082010a0282010100b2788071ca78d5e371af478050747d6ed8d78876f49968f7582160f97484012fac022d86d3a0437a4eb2a4d036ba01be8ddb48c80717364cf4ee8823c73eeb37f5b519f84968b0ded7b976381d619ea4fe8236a5e54a56e445e1f9fdb416fa74da9c9b35392ffab02050066c7ad080b2a6f9afec47198f503807dca2873958f8bad5a9f948673096ee94785e6f89a351c0308666a14566ba54eba3c391f948dcffd1e8302d7d2d747035d78824f79ec4596ebb738717f2324628b843fab71daacab4f29f240e2d4bf7715c5e69ffea9502cb388aae50386fdbfb2d621bc5c71e54e177e067c80f9c8723d63f40207f2080c4804c3e3b24268e04ae6c9ac8aa0d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604148418cc8534ecbc0c94942e08599cc7b2104e0a08300d06092a864886f70d01010b0500038201010098f2375a4190a11ac57651282036230eaee628bbaaf894ae48a4307f1bfc248d4bb4c8a197f6b6f17a70c85393cc0828e39825cf23a4f9de21d37c8509ad4e9a753ac20b6a897876444718656c8d418e3b7f9acbf4b5a750d7052c37e8034bade961a0026ef5f2f0c5b2ed5bb7dcfa945c779e13a57f52ad95f2f8933bde8b5c5bca5a525b60af14f74befa3fb9f40956d3154fc42d3c7461f23add90f48709ad9757871d1724334756e5759c2025c266029cf2319168e8843a5d4e4cb08fb231143e843297262a1a95d5e08d490aeb8d8ce14c2d055f286f6c49343776661c0b9e841d7977860036e4a72aea5d17dba109e866c1b8ab95933f8ebc490bef1b9 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F6108407D6F8BB67980CC2E244C2EBAE1CEF63BE MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0D44DD8C3C8C1A1A58756481E90F2E2AFFB3D26E MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\2AD974A775F73CBDBBD8F5AC3A49255FA8FB1F8C MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F6108407D6F8BB67980CC2E244C2EBAE1CEF63BE\Blob = 030000000100000014000000f6108407d6f8bb67980cc2e244c2ebae1cef63be2000000001000000f6010000308201f230820178a0030201020213066c9fd7c1bb104c2943e5717b7b2cc81ac10e300a06082a8648ce3d0403033039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412034301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f7420434120343076301006072a8648ce3d020106052b8104002203620004d2ab8a374fa3530dfec18a7b4ba87b464b63b062f62d1bdb087121d200e863bd9a27fbf0396e5dea3da5c981aaa35b2098455d16dbfde8106de39ce0e3bd5f8462f3706433a0cb242f70ba88a12aa075f881ae6206c481db396e29b01efa2e5ca3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414d3ecc73a656ecce1da769a56fb9cf3866d57e581300a06082a8648ce3d040303036800306502303a8b21f1bd7e11add0ef58962fd6eb9d7e908d2bcf6655c32ce328a9700a470ef0375912ff2d9994284e2a4f354d335a023100ea75004e3bc43a941291c958469d211372a7889c8ae44c4adb96d4ac8b6b6b49125333add7e4be24fcb50a76d4a5bc10 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\1C58A3A8518E8759BF075B76B750D4F2DF264FCD MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E\Blob = 030000000100000014000000b51c067cee2b0c3df855ab2d92f4fe39d4e70f0e2000000001000000e1030000308203dd308202c5a003020102020100300d06092a864886f70d01010b050030818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a30818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bdedc103fcf68ffc02b16f5b9f48d99d79e2a2b703615618c347b6d7ca3d352e8943f7a1699bde8a1afd13209cb44977322956fdb9ec8cdd22fa72dc276197eef65a84ec6e19b9892cdc845bd574fb6b5fc589a51052894655f4b8751ce67fe454ae4bf85572570219f8177159eb1e280774c59d48be6cb4f4a4b0f364377992c0ec465e7fe16d534c62afcd1f0b63bb3a9dfbfc7900986174cf26824063f3b2726a190d99cad40e75cc37fb8b89c159f1627f5fb35f6530f8a7b74d765a1e765e34c0e89656998ab3f07fa4cdbddc32317c91cfe05f11f86baa495cd19994d1a2e3635b0976b55662e14b741d96d426d4080459d0980e0ee6defcc3ec1f90f10203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147c0c321fa7d9307fc47d68a362a8a1ceab075b27300d06092a864886f70d01010b050003820101001159fa254f036f94993b9a1f828539d47605945ee128936d625d09c2a0a8d4b07538f1346a9de49f8a862651e62cd1c62d6e95204a9201ecb88a677b31e2672e8c9503262e439d4a31f60eb50cbbb7e2377f22ba00a30e7b52fb6bbb3bc4d379514ecd90f4670719c83c467a0d017dc558e76de68530179a24c410e004f7e0f27fd4aa0aff421d37ed94e5645912207738d3323e3881759673fa688fb1cbce1fc5ecfa9c7ecf7eb1f1072db6fcbfcaa4bfd097054abcea18280290bd5478092171d3d17d1dd916b0a9613dd00a0022fcc77bcb0964450b3b4081f77d7c32f598ca588e7d2aee90597364f936745e25a1f566052e7f3915a92afb508b8e8569f4 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa22000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\5A8CEF45D7A69859767A8C8B4496B578CF474B1A\Blob = 0300000001000000140000005a8cef45d7a69859767a8c8b4496b578cf474b1a2000000001000000450500003082054130820329a0030201020213066c9fd29635869f0a0fe58678f85b26bb8a37300d06092a864886f70d01010c05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412032301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f74204341203230820222300d06092a864886f70d01010105000382020f003082020a0282020100ad969f2d9c4a4c4a81795199ec8acb6b605113bc4d6d06fcb0088ddd19106ac7260c35d8c06f2084e994b19b8503c35bdb4ae8c8f89076d95b4fe34ce806364dcc9aac3d0c902b92d4061960ac374479858182ad5a37e00dcc9da64c5276ea439db704d150f655e0d5d2a64985e937e9ca7eae5c954d489a3fae205a6d8895d934b8521a4390b0bf6c05b9b678b7ead0e43a3c125362ff4af27bbe3505a91234e3f36474622c3d00495a28fe3244bb87dd652702713bda4af71fdacdf72155904f0fecae82e19f6bd945d3bbf05f87ed3c2c3986da3fdeec7255eb79a3addbdd7cb0ba1ccefcde4f3576cf0ff8781f6a36514627615be99ecff0a2557d7c258a6f2fb4c5cf842e2bfd0d51106cfb5f1bbc1b7ec5ae3b98013192ff0b57f49ab2b957e9abef0d76d1f0eef4ce86a7e06ee9b469a1df69f633c6692e97139ea587b057108137c953b3bb7ff692d19cd018f4926eda834fa663994ca5fb5eef21647a205f6c648515cb37e9620c0b2a16dc012e32da3e4bf59e3af6174094ef9e910886fabe63a85a33eccb744395f96c695236c7296ffc55035c1ffb9fbd47ebe74947950b4e89220949e0f5611ef1bf2e8a726e8059ff573af97532a34e5feced2862d94d73f2cc811760edcdebdcdba7cac57e02bdf2540854fdb42d092c17544a98d154e1516708d2ed6e7e6f3fd22d81592966cb903995111e7427feddebaf0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414b00cf04c30f405580248fd33e552af4b84e36652300d06092a864886f70d01010c05000382020100aaa8808f0e78a3e0a2d4cde6f5987a3bea0003b0970e93bc5aa8f62c8c7287a9b1fc7f73fd637178a58759cf30e10d10b2135a6d82f56ae6809fa0050b68e4476bc76adfb6fd773272e518fa09f4a0932c5dd28c75857665900c0379b7312363ad788309866884cafff9cf269a9279e7cd4bc5e761a717cbf3a91293936ba7e82f5392c46058b0cc0251185b858d625963b6adb4de9afb26f70027c05d55377499c9507fe3592e44e32c25eeec4c3277b49f1ae94b5d20c5dafd1c8716c643e8d4bb269a45705ea90b3753e2467b27fde046f289b7cc42b6cb28266ed9a5c93ac8411360f7508c15aeb26d1a151a5778e6922ad96590823f6c02afae123a27963604d71da28063a99bf1e5bab47c14b04ec9b11f745f38f651ea9bfa2ca211d4a92d271a45b1afb24e710dc05846d66906cb53cbb3fe6b41cd417e7d4c0f7c72797a59cd5e4a0eac9ba99873797cb4f4ccb9b8070cb2745cb8c76f88a190a7f4aaf9bf673af41a15621eb79fbe3db129af67a112f25810195303301bb81a89f69cbd97038ea309f31d8b21f1b4dfe41cd19f650206ea5cd613b384efa2a55c8c7729a768c06bae40d2a8b4eacdf08d4b389c199a1b2854b88990efca75813e1ef26424c718af4eff479e07f63565a4d30a56fff517646cefa822254993b6df0017da587e5deec51bb0d1d15f2110c7f9f3ba020a2707c5f1d6c7d3e0fb09606c MBAMInstallerService.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
mbamtray.exembam.exepid process 5824 mbamtray.exe 4572 mbam.exe -
Suspicious behavior: EnumeratesProcesses 32 IoCs
Processes:
MBSetup.exeMBAMInstallerService.exeMBAMService.exembamtray.exembam.exepid process 4504 MBSetup.exe 4504 MBSetup.exe 3476 MBAMInstallerService.exe 3476 MBAMInstallerService.exe 3476 MBAMInstallerService.exe 3476 MBAMInstallerService.exe 3476 MBAMInstallerService.exe 3476 MBAMInstallerService.exe 3476 MBAMInstallerService.exe 3476 MBAMInstallerService.exe 3476 MBAMInstallerService.exe 3476 MBAMInstallerService.exe 3640 MBAMService.exe 3640 MBAMService.exe 3640 MBAMService.exe 3640 MBAMService.exe 3640 MBAMService.exe 3640 MBAMService.exe 3640 MBAMService.exe 3640 MBAMService.exe 5824 mbamtray.exe 5824 mbamtray.exe 5824 mbamtray.exe 5824 mbamtray.exe 3640 MBAMService.exe 3640 MBAMService.exe 4572 mbam.exe 4572 mbam.exe 4572 mbam.exe 4572 mbam.exe 3640 MBAMService.exe 3640 MBAMService.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
mbam.exepid process 4572 mbam.exe -
Suspicious behavior: LoadsDriver 4 IoCs
Processes:
pid process 660 660 660 660 -
Suspicious use of AdjustPrivilegeToken 17 IoCs
Processes:
MBAMService.exeMBAMService.exeMBAMInstallerService.exeAUDIODG.EXEmbam.exedescription pid process Token: 33 4912 MBAMService.exe Token: SeIncBasePriorityPrivilege 4912 MBAMService.exe Token: 33 3640 MBAMService.exe Token: SeIncBasePriorityPrivilege 3640 MBAMService.exe Token: SeBackupPrivilege 3640 MBAMService.exe Token: SeRestorePrivilege 3640 MBAMService.exe Token: SeTakeOwnershipPrivilege 3640 MBAMService.exe Token: SeBackupPrivilege 3640 MBAMService.exe Token: SeRestorePrivilege 3640 MBAMService.exe Token: SeTakeOwnershipPrivilege 3640 MBAMService.exe Token: SeSecurityPrivilege 3640 MBAMService.exe Token: SeTcbPrivilege 3640 MBAMService.exe Token: SeSecurityPrivilege 3476 MBAMInstallerService.exe Token: SeTcbPrivilege 3640 MBAMService.exe Token: 33 2500 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2500 AUDIODG.EXE Token: SeShutdownPrivilege 4572 mbam.exe -
Suspicious use of FindShellTrayWindow 10 IoCs
Processes:
MBSetup.exembamtray.exepid process 4504 MBSetup.exe 5824 mbamtray.exe 5824 mbamtray.exe 5824 mbamtray.exe 5824 mbamtray.exe 5824 mbamtray.exe 5824 mbamtray.exe 5824 mbamtray.exe 5824 mbamtray.exe 5824 mbamtray.exe -
Suspicious use of SendNotifyMessage 8 IoCs
Processes:
mbamtray.exepid process 5824 mbamtray.exe 5824 mbamtray.exe 5824 mbamtray.exe 5824 mbamtray.exe 5824 mbamtray.exe 5824 mbamtray.exe 5824 mbamtray.exe 5824 mbamtray.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
LogonUI.exepid process 4224 LogonUI.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
MBAMInstallerService.exeMBAMService.exeMBSetup.exedescription pid process target process PID 3476 wrote to memory of 4912 3476 MBAMInstallerService.exe MBAMService.exe PID 3476 wrote to memory of 4912 3476 MBAMInstallerService.exe MBAMService.exe PID 3640 wrote to memory of 5824 3640 MBAMService.exe mbamtray.exe PID 3640 wrote to memory of 5824 3640 MBAMService.exe mbamtray.exe PID 4504 wrote to memory of 4572 4504 MBSetup.exe mbam.exe PID 4504 wrote to memory of 4572 4504 MBSetup.exe mbam.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3260
-
C:\Users\Admin\AppData\Local\Temp\MBSetup.exe"C:\Users\Admin\AppData\Local\Temp\MBSetup.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Checks BIOS information in registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe"C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4572
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"1⤵
- Drops file in Drivers directory
- Enumerates connected drives
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe" /Service /Protected2⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Executes dropped EXE
- Registers COM server for autorun
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4912
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Checks BIOS information in registry
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe"C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5824
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x308 0x2d41⤵
- Suspicious use of AdjustPrivilegeToken
PID:2500
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa39a9055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4224
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Defense Evasion
Modify Registry
3Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\7z.dllFilesize
1.7MB
MD5461faf68ccc02b0223fd273b630f21fe
SHA1363b8beaa74f0f454c2d544ace9e71a84bc2b4cf
SHA256cb07f3f461e9c267831b1ab93af6dfda1bb51d72e42d73d00d26594f09326be1
SHA5124b671f48e45fdedf50c7f7bb6c8d82a3b98f7502006eb002aaf8ff31f25f9ff1257c7bcc12caf622e43d4ec665b19d978ae3e3762f76def0bc71485ebdb8426f
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\Actions.dllFilesize
5.0MB
MD51eff53d95ecaf6bbfffe80d866d8e1dd
SHA1d7ef7d7c77fd04b2c0eb8c16bb3cd08057f6742f
SHA2566dd748f7ca56125cbe158fa3612f08e7312ef58ad5375e6b7ab5532cc16ca0ac
SHA512c59b8e6f0b238a247e64b9c7bb42213dadac1dada63542830a6292361174c935c0c662b2d1aed3fb6100cc4993297b1eaf25e328f2b4613458c4ffca63b9f02d
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ActionsShim.dllFilesize
2.5MB
MD558149edf4990067b4c1ffe1c32a51a01
SHA180c0c8b8def45420159659d2eaad181eb0b05c40
SHA25667af73f9b49ce113d02d7f2824e45d48044273772c94e6e8c300cf86bf83cb55
SHA512fe69f4eccaa35b132b7dfc77fae50733398cfa5ab7377f502a50e1bb83be6b81fad26a0a24f6dfbc99dca6e118784f3452edc4a30c11ac161fc0db62b039cb4e
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\BrowserSDKDLL.dllFilesize
5.8MB
MD51ed53171d00f440f29a12f9beb84dac4
SHA14d9a1e3579b0999f1ab2fa818b588411e9ee920c
SHA256e659e687a872050f9e65d78992d16bd9b393cf3f8e8c94e0e15fb42b7065327e
SHA51217161cfc672d1b996b8af4ebac17f9a8a3807f38c9a23e2e5b4dadcd9a21c3a64faec9bf59147022a9df88b80f89300f1b537091289bd7a42806bd206a317e6e
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\BrowserSDKDLLShim.dllFilesize
2.5MB
MD52e8ad6f405eb7744908f635dc089438a
SHA1f2ca3f55ce4395dfe39a0ba099a39f8c30e263cb
SHA2564824ad6b30b42a9166bfd3db41f11e3cb67e7aab96058b7f946797d7dadba891
SHA5123eacea19caf3f04cddb35091102c5d627b82acc8c73be1bfa4d72932c78cba7821c99c616bbd8d422ce588b865700db560ba441f8a5da6a9629af844f6ad28c5
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\CleanControllerImpl.dllFilesize
6.9MB
MD591153bf872114d85ee3144833ab5a2d4
SHA1935769a4c62a117907c295d85efeaf36412244e8
SHA256c4ab4bbbca3a557aa716986fdaca0ec7cf60577a4047009217ad22363bec8c09
SHA512abb79fddd10cf984d642e1451f0ad4a1d735cb02d5dc57fd2e4f23523e6f77fe02bb1ff732f59cfc52a09490816c5ab4a5cc631c7754e49f6167a0ec1e572510
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\CloudControllerImpl.dllFilesize
4.8MB
MD5d739c6bd5d5cae2ae961a0c2d40eb5b1
SHA116d0d40707bf55f04a0da70798b5368e612fd5e6
SHA25625472857a59a9067c1224b173b378448bb574f5365edbe4a1a46df8810007f9a
SHA5127d80a39f3a91e0faa87ae8143f43d2e8947eaedfd317a1ac1547dfa15b825cc5c200f8baebe127a0bc2379fe90c40f3ea25db09c06b521aad1c189ce24a53c7d
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\LicenseControllerImpl.dllFilesize
4.4MB
MD565e42cbe095830d9d93ecabb13392780
SHA1e60110e159cc4cc92d2606ae3ba3559c10170e5a
SHA256a773e1706bbb6e8cb522d0e1a3d29e496bcbe6a91e221c26bea98292b9316f7f
SHA5126b25cebb6433ec87831a3f0f67b96c7fc37a617158a18d9ac20bd375f46c97da8a41e4379da72808fdd7947705c6c09518c56152f96eebf2bcefb39ffa6202ed
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\MBAMCore.dllFilesize
6.6MB
MD5f5326e215357788237b4c4e78248010b
SHA13fb03c85f0180dc60a9756b50b44e4a59f056be3
SHA2560d0525e66bae8605c0afa6b877ceee4c9b75be15c5c47ba8961041b3bdb848de
SHA51293f456a22d30fde2e5330573f6aa24b7b3ebc633fbb7171b135e4030c127b17c5e3cb2c9a56f62355070c9a6fde564144fe56e1674f5f0d905691e77854789ef
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\MBAMShim.dllFilesize
3.0MB
MD5f44b6c80c46c4cf3071b5f5b916e1271
SHA1839f2238ecbbfa80ebf9c1f77eafc78204b58761
SHA256732523df43358729d5e85cceb557d69016dcdd3e2238d903c33c5327c3131fae
SHA51299be164ae96bc4f93dc896d5df445ad1c2f023f10605a8c9857d7ebedfc5b070f50cd33b401d61003e601a06b8446e6c0b5dbddda4927a2e1352407d3b266942
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\PoliciesControllerImpl.dllFilesize
4.0MB
MD5a343e23fb8bd09e65225b654af948a88
SHA1a61b1685127aa909cad84babfefaa26a382fe12b
SHA25692b73eb638f5d7dc78a93a63145fa7e2e6397a220aff59cbace9f44a427982c0
SHA512312967286d9534dd37105bf329f2d39c4563f6c09868370c3fde582c07cfda90c2a19b1a759c2eac178aa4a7029383836c0d8805aab41ea55deb31ebff5083c2
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ScanControllerImpl.dllFilesize
5.7MB
MD5325cb58e19d485e479945837d7f8c1f8
SHA16102985f07a589eb81badf9aeb66670e7469cc4b
SHA256faded97793f72b925053fad2efcfff9c0e1aea5cded6b1838652a1f86fe4bc5a
SHA5126bbc6129c197d7dbb2b1a8152b2339f54fddeb9fee3a55099d148172ec0b7c9d1102d5315fe885e8264d8b39bae1864d2a825a9ac78bdcc671d6eae8e9de1228
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\Swissarmy.dllFilesize
4.0MB
MD5ae8affa9f5cbf51211132b0146bada81
SHA1912f5d4879047dd2c84e40689dd87fbebeff94aa
SHA25616b70ec44567e4b20216c3906fc40e26671078ee58c50f3fe1b1be8d3b521316
SHA5120b512a695430f433cfc488098ee1e965dcac2b1e0f80d3597858d32fcf6565c2e12135fb7ad2ea266e17c26a802192f47b603413740eccc478000db94aef5397
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\SwissarmyShim.dllFilesize
2.6MB
MD5cff3e356609f66039d7c732b2e7a3c2f
SHA1149741b831d7ec985e12ecb177040e98e6282f36
SHA2562a4a95dff26010278a6d5174dde2ae23269905534be788e3d2fce7baa53f35c3
SHA512dc9c4c78c7c43cb3b87a2bbaa7a19e9b57b3ca8df94dfa1a7657ae18a12fccd8b4cc8a9ae1aeb8457272c226e09f251ffd4922af78346e000727457693b5dd73
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\TelemetryControllerImpl.dllFilesize
5.3MB
MD5c656aeb7dfd645746d1077fcfa3fe5ec
SHA134cb10804d31cd808376a91a7b7a650ae9c34a43
SHA256f08752a9ef44bdd09d1c3bec0a30db3364c501d1742782da9312b08ce88ab5b6
SHA512689fd6b87e71ac229d2829f32112f23fb05198b46322ad60e252a2127796f90ab11d2c9aab4fc160cbc404533c0ff9a3b97bcadcc1f91ec5af977413a3280121
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\UpdateControllerImpl.dllFilesize
4.4MB
MD51fb6a6c92affd0b5e5609f8c978abfb9
SHA1413ac37b4aa6268d1b65b559cc264bc95a204dfc
SHA256ec25b45819d48001ffb178f38292acde49369289335802a59eb6d9071a018936
SHA512885cf1f3d8b2e795db288291f2e6256b38fe8f3b79a276a59f013dd9d1200c1ecfcf537d9f889a488713d6b35753332c22b553ea8f1156f5a6379e23b2633dcb
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeFilesize
1.8MB
MD58b8dce48722a187976860c198d8f4d65
SHA1f9346d6f05b8f232552d26eaba71aa482e324f57
SHA25666035f0d7b5b3dac02e855e764f2a561480edaa4fc7e83cbc3c34c082b391969
SHA5123771dd731c0ff921d06daec013908fe64a10c8a526f517d359b0f3921c6626fd9af371d46751258134c698c3d1c001977d8b27f400c996344c78a5a530b199f8
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\pkgvers.datFilesize
74B
MD5bcfd48040bec0ab6073e01b0bb1f826f
SHA19e960186973d3fa711fe8e98fdd63d0f3e8e6e56
SHA256286e437a93b20e6f532a91598d427b80a57f9f970a41d124113d3b0299a54de1
SHA512bf41f576a18e1b9d0d732944c5b20ce64f82d555027ae1b60fb39418415bce3c330a5909e2cb9e92f064786bc9aa487e83728b99b7db33a36eac33c96a11887a
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\sample.dllFilesize
528KB
MD50d964850f272eb25013c951e9d76c028
SHA1e581fb83527b84c4e55912a9f88107e9ddadfe6c
SHA2562974f71ff7763c6d4844dd67d139d137a85062fe8e8c111e75e7614ac8091b4e
SHA512a7c0e6252091240e33af64ff47208ed4a7c8e5be113fa4f36497280a0523c41e1096112a5fcf5290d61e36d414f970e9aff07a3a5b0ff586028dc4fd6b881f9c
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\version.datFilesize
47B
MD52a261a75d170897631341c8834ebcf9d
SHA1c51a85ee96400ac4ddebb1f399bed78b7665dc9e
SHA256ec519136bc3df913181c787753c21ebd11273eddb103873779bd0c21041c2b09
SHA512aedc8697a8541190dba12417ea8c68a9f2531acb22a6ebf378b7949accadc94ba69f98cac855cae7665f907c532fea4ff4829cb47b708ad140cf8a3315e99aae
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\Global.nmFilesize
336KB
MD56527a87749c06942b6852aec88474e3c
SHA1d188de296d877cececb023006d9c093199cd9353
SHA256563ea800778b85b6d8201e68d7ae63e59ae401ec6d27285435ae7f7d3166782b
SHA5126f33c9b07bcb94531b261697af40e957a81d4493b85e113591c8bcb8b53bf1c9b35ec2847fae9a6c0d5420048a2f550fe17cf0ffb5a6291f58936dfe4bd9ecc9
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\Global.srFilesize
20.8MB
MD59c511b9324b2b9d5af51ab2b4f36cdfe
SHA1aa242a62cf5de6902ca29419464d73ebff50f242
SHA256131f11589ed05cc31673e1ac6cc6c860a66a0a4b2fe3ebb08f1aeee0ec60e5db
SHA51282d9afeb847bf9695ecf47ffdb49a43e647a116a55e76a509edcce67566d8ad0d762e2de9845ec17566d51f2219c540cfddc8bd24427538aaa583ef7dc0d64c7
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\cfg.binFilesize
1KB
MD542dc081efeaeed00967fd339278d6c97
SHA16969f00e1bcb5423395fccc12584e46cabcda9db
SHA256dbaf53794113e4172f5c78d4b1ffdc0a2f1d7a35e5d8e8893f0c2b5d1a3f4bb9
SHA5127ca9cbbb9e9820d6fffe13709d42b90df1fe58060c7a8342c4d3ccb72fe063b3cfcae1797d4bfa897fcd4955bdb5e0fdd585a84c0f7b7479966df27c0245bd0c
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\clean.mbdbFilesize
10KB
MD5942cf3b533c8a655cd9d65898e929def
SHA124aad2f3d7fb519eac85128175821cb6f2a3bfc8
SHA256a0dcb255872375b505fd833d48086e580005b26ac835117e90e0fbe71bbe0b94
SHA512bd5c6dd05ea0c9f793c2903b5407fe039786da5e4a744a2eb1b3f952b93190c6ad587241ce8e1242dbf6c4717f1e5043bd81b3a612522aaf77f7593db7eda1e5
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\dbmanifest2.datFilesize
924B
MD56d3a651a4e631406a7efd5aae72948ef
SHA17dfe3b01820d3c2265aa69570e6092e0b09b1f8c
SHA256d086782bd9d6a75615062b0dcf3e21b3c530c6835acf80635696be96cc6f28ca
SHA512514c23a88e2fc47ff48750f8c7ff258c481ceb6479c6b37c537ebf5999e94baf03565ddaa1c5d5c6c5ca59008f666ce0131d7ad0a8ed3394732f10ecfc4d409d
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\dynconfig.datFilesize
39KB
MD510f23e7c8c791b91c86cd966d67b7bc7
SHA13f596093b2bc33f7a2554818f8e41adbbd101961
SHA256008254ca1f4d6415da89d01a4292911de6135b42833156720a841a22685765dc
SHA5122d1b21371ada038323be412945994d030ee8a9007db072484724616c8597c6998a560bc28886ebf89e2c8919fb70d76c98338d88832351823027491c98d48118
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\exclusions.txtFilesize
23KB
MD5aef4eca7ee01bb1a146751c4d0510d2d
SHA15cf2273da41147126e5e1eabd3182f19304eea25
SHA2569e87e4c9da3337c63b7f0e6ed0eb71696121c74e18a5da577215e18097715e2f
SHA512d31d21e37b0048050b19600f8904354cff3f3ec8291c5a7a54267e14af9fb88dfb6d11e74a037cc0369ade8a8fb9b753861f3b3fb2219563e8ec359f66c042db
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\mbdigsig2.datFilesize
514B
MD504aff86c893b68fe28949a9f25fc2aca
SHA10993f31a19467a84e8d4d8c16a955e5050f9fe9c
SHA256f2a70cb52c9a4e9120cc139556b713191356f3efb0853b31916e53074ecc028f
SHA512ab743f64c8a073a5f74b0474a320a5b502baaf9b5b6d3264768259c6dab59ca6f5322bb2fad5976a803e4ff7f33a2237c8d9f51ffb04ee6c0403b6317b7d5b11
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\prot.mbdbFilesize
24B
MD5546d9e30eadad8b22f5b3ffa875144bf
SHA13b323ffef009bfe0662c2bd30bb06af6dfc68e4d
SHA2566089fbf0c0c1413f62e91dc9497bedc6d8a271e9dc761e20adc0dccf6f4a0c1f
SHA5123478f5dcf7af549dd6fe48ad714604200de84a90120b16a32233b6d44fa7240f5f4e5fe803f54b86bbdfd10fa1bfdd88fb85eb6a78e23e426933f98d0a2565ec
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\rdefs.mbdbFilesize
24B
MD52f7423ca7c6a0f1339980f3c8c7de9f8
SHA1102c77faa28885354cfe6725d987bc23bc7108ba
SHA256850a4ea37a0fd6f68bf95422d502b2d1257264eb90cc38c0a3b1b95aa375be55
SHA512e922ac8a7a2cde6d387f8698207cf5efbd45b646986a090e3549d97a7d552dd74179bd7ac20b7d246ca49d340c4c168982c65b4749df760857810b2358e7eb69
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\rules.mbdbFilesize
9.1MB
MD501a727786ef6ca871c88126516257a3a
SHA1f113766911a3a255c04fd62f4b31b1eaccfff74d
SHA2561f6c5730e2f226044bbdddd32c25c021a33c075cf2c97107454f293fd3aa56c9
SHA512e465883bb65b3799e60f09df48f9a327994a3ddbf03e67dfee35ccdb4ec7ce1aaa3291d969f0c1247d815d433c68679e26f4870ad08a29e07326e07f8262d2ab
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\scan.mbdbFilesize
1009KB
MD564cce9df252a423b80e78d6e63ea8823
SHA1e223b7716e569faaef458acffe6bcd5806435f20
SHA25636b51ce7970a6dbae2549e3a1585aa9037b0683dc5ea9c3deebb7daed8884c59
SHA512d57772fde98914b1c9ffabc5e0df91b008b9ce397bf6b4adb93bffb581b38d3fea7fd2ebd43dda79119504228c07089f444b548aa077bef7c14ec415df2a0bc8
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\tids.mbdbFilesize
176KB
MD543afd4322f580202374dc9e921da9bec
SHA16c3038cf9476c161c09ac543248a2565b639ba8a
SHA256ca516fd91a4e615c25740fd4d1fb5e0e1aa09f3f7a4419f36609d21cba019246
SHA512f80d8b5ab40d1661615469952e7b410fa7c2a7f2c2f6eadd9c8ac1c3c6167abf1ddd220874e08ee90e8563a46c74667982bd39a288868eafc286858e4cac7cfb
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\wprot2.mbdbFilesize
41.9MB
MD5a4d210e94b3dda28e7f908dfee36507d
SHA1f2a3986a3f2208b1f5289429b7649f2e3c169a99
SHA25650d9cb97d6728cf2c55933b0d0e8da7b3e954e444fa1610b72f8d307ed7aba4a
SHA5120a616ecea55ce4be001b516826341eb6a0b8f1123f0bb0ba5ef93396e6d27d587e5cfbdbbff20099bb63c73d07f0241f8ad17c8b3ef97fa2af5f2d24f43c84d1
-
C:\Program Files\Malwarebytes\Anti-Malware\7z.dllFilesize
1.7MB
MD5461faf68ccc02b0223fd273b630f21fe
SHA1363b8beaa74f0f454c2d544ace9e71a84bc2b4cf
SHA256cb07f3f461e9c267831b1ab93af6dfda1bb51d72e42d73d00d26594f09326be1
SHA5124b671f48e45fdedf50c7f7bb6c8d82a3b98f7502006eb002aaf8ff31f25f9ff1257c7bcc12caf622e43d4ec665b19d978ae3e3762f76def0bc71485ebdb8426f
-
C:\Program Files\Malwarebytes\Anti-Malware\Actions.dllFilesize
5.0MB
MD51eff53d95ecaf6bbfffe80d866d8e1dd
SHA1d7ef7d7c77fd04b2c0eb8c16bb3cd08057f6742f
SHA2566dd748f7ca56125cbe158fa3612f08e7312ef58ad5375e6b7ab5532cc16ca0ac
SHA512c59b8e6f0b238a247e64b9c7bb42213dadac1dada63542830a6292361174c935c0c662b2d1aed3fb6100cc4993297b1eaf25e328f2b4613458c4ffca63b9f02d
-
C:\Program Files\Malwarebytes\Anti-Malware\ActionsShim.dllFilesize
2.5MB
MD558149edf4990067b4c1ffe1c32a51a01
SHA180c0c8b8def45420159659d2eaad181eb0b05c40
SHA25667af73f9b49ce113d02d7f2824e45d48044273772c94e6e8c300cf86bf83cb55
SHA512fe69f4eccaa35b132b7dfc77fae50733398cfa5ab7377f502a50e1bb83be6b81fad26a0a24f6dfbc99dca6e118784f3452edc4a30c11ac161fc0db62b039cb4e
-
C:\Program Files\Malwarebytes\Anti-Malware\CleanControllerImpl.dllFilesize
6.9MB
MD591153bf872114d85ee3144833ab5a2d4
SHA1935769a4c62a117907c295d85efeaf36412244e8
SHA256c4ab4bbbca3a557aa716986fdaca0ec7cf60577a4047009217ad22363bec8c09
SHA512abb79fddd10cf984d642e1451f0ad4a1d735cb02d5dc57fd2e4f23523e6f77fe02bb1ff732f59cfc52a09490816c5ab4a5cc631c7754e49f6167a0ec1e572510
-
C:\Program Files\Malwarebytes\Anti-Malware\CloudControllerImpl.dllFilesize
4.8MB
MD5d739c6bd5d5cae2ae961a0c2d40eb5b1
SHA116d0d40707bf55f04a0da70798b5368e612fd5e6
SHA25625472857a59a9067c1224b173b378448bb574f5365edbe4a1a46df8810007f9a
SHA5127d80a39f3a91e0faa87ae8143f43d2e8947eaedfd317a1ac1547dfa15b825cc5c200f8baebe127a0bc2379fe90c40f3ea25db09c06b521aad1c189ce24a53c7d
-
C:\Program Files\Malwarebytes\Anti-Malware\LicenseControllerImpl.dllFilesize
4.4MB
MD565e42cbe095830d9d93ecabb13392780
SHA1e60110e159cc4cc92d2606ae3ba3559c10170e5a
SHA256a773e1706bbb6e8cb522d0e1a3d29e496bcbe6a91e221c26bea98292b9316f7f
SHA5126b25cebb6433ec87831a3f0f67b96c7fc37a617158a18d9ac20bd375f46c97da8a41e4379da72808fdd7947705c6c09518c56152f96eebf2bcefb39ffa6202ed
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exeFilesize
8.7MB
MD5002c3dd691e6a0fd189f2f279a6e0a68
SHA11d39aacd4aa517b0fde8c46c4f9834e5008c9514
SHA2566ffec3855993062006d638af9d6b22cdfc89724f18085dd77e6e9635b14eb155
SHA51231fac4a1bb1b57b4ef968881cf74119c94cf7794ba74447d568b6877cca6f5b10f973843077d84ca94ff2569e9813d086964867854637d1e151ab115309c6d06
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exeFilesize
8.7MB
MD5002c3dd691e6a0fd189f2f279a6e0a68
SHA11d39aacd4aa517b0fde8c46c4f9834e5008c9514
SHA2566ffec3855993062006d638af9d6b22cdfc89724f18085dd77e6e9635b14eb155
SHA51231fac4a1bb1b57b4ef968881cf74119c94cf7794ba74447d568b6877cca6f5b10f973843077d84ca94ff2569e9813d086964867854637d1e151ab115309c6d06
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exeFilesize
8.9MB
MD5e4472f208d356ea4f562294ad8b82d93
SHA1b34bbadc349e722ef8b211f9205a610fed1f4a32
SHA256822957744702afdd6a571616da66f6c97a693d3a9e4b0c008f7f1614649a04d7
SHA512012c99ca3eb23f49ae916d2d7d62ff428b34ba0340cb6d9c3f80f292e115437f58b3a6bfcffb862f6e1caffa2a12b69bb3e7a56445ccf132cc48a6556290fc9d
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exeFilesize
8.9MB
MD5e4472f208d356ea4f562294ad8b82d93
SHA1b34bbadc349e722ef8b211f9205a610fed1f4a32
SHA256822957744702afdd6a571616da66f6c97a693d3a9e4b0c008f7f1614649a04d7
SHA512012c99ca3eb23f49ae916d2d7d62ff428b34ba0340cb6d9c3f80f292e115437f58b3a6bfcffb862f6e1caffa2a12b69bb3e7a56445ccf132cc48a6556290fc9d
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exeFilesize
8.9MB
MD5e4472f208d356ea4f562294ad8b82d93
SHA1b34bbadc349e722ef8b211f9205a610fed1f4a32
SHA256822957744702afdd6a571616da66f6c97a693d3a9e4b0c008f7f1614649a04d7
SHA512012c99ca3eb23f49ae916d2d7d62ff428b34ba0340cb6d9c3f80f292e115437f58b3a6bfcffb862f6e1caffa2a12b69bb3e7a56445ccf132cc48a6556290fc9d
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMShim.dllFilesize
3.0MB
MD5f44b6c80c46c4cf3071b5f5b916e1271
SHA1839f2238ecbbfa80ebf9c1f77eafc78204b58761
SHA256732523df43358729d5e85cceb557d69016dcdd3e2238d903c33c5327c3131fae
SHA51299be164ae96bc4f93dc896d5df445ad1c2f023f10605a8c9857d7ebedfc5b070f50cd33b401d61003e601a06b8446e6c0b5dbddda4927a2e1352407d3b266942
-
C:\Program Files\Malwarebytes\Anti-Malware\MbamElam.catFilesize
10KB
MD560608328775d6acf03eaab38407e5b7c
SHA19f63644893517286753f63ad6d01bc8bfacf79b1
SHA2563ed5a1668713ef80c2b5599b599f1434ad6648999f335cf69757ea3183c70c59
SHA5129f65212121b8a5d1a0625c3baa14ef04a33b091d26f543324333e38dcdb903e02ccc4d009e22c2e85d2f61d954e0b994c2896e52f685003a6ef34758f8a650c7
-
C:\Program Files\Malwarebytes\Anti-Malware\MbamElam.infFilesize
2KB
MD5c481ad4dd1d91860335787aa61177932
SHA181633414c5bf5832a8584fb0740bc09596b9b66d
SHA256793626d240fd8eefc81b78a57c8dfe12ea247889b6f07918e9fd32a7411aa1c3
SHA512d292e028936412f07264837d4a321ecfa2f5754d4048c8bcf774a0e076e535b361c411301558609d64c71c1ce9b19e6041efa44d201237a7010c553751e1e830
-
C:\Program Files\Malwarebytes\Anti-Malware\MbamElam.sysFilesize
20KB
MD59e77c51e14fa9a323ee1635dc74ecc07
SHA1a78bde0bd73260ce7af9cdc441af9db54d1637c2
SHA256b5619d758ae6a65c1663f065e53e6b68a00511e7d7accb3e07ed94bfd0b1ede0
SHA512a12ccf92bead694f5d3cba7ff7e731a2f862198efc338efc7f33a882fe0eb7499fb3fb533538d0a823e80631a7ca162962fbdfd78e401e3255672910b7140186
-
C:\Program Files\Malwarebytes\Anti-Malware\PoliciesControllerImpl.dllFilesize
4.0MB
MD5a343e23fb8bd09e65225b654af948a88
SHA1a61b1685127aa909cad84babfefaa26a382fe12b
SHA25692b73eb638f5d7dc78a93a63145fa7e2e6397a220aff59cbace9f44a427982c0
SHA512312967286d9534dd37105bf329f2d39c4563f6c09868370c3fde582c07cfda90c2a19b1a759c2eac178aa4a7029383836c0d8805aab41ea55deb31ebff5083c2
-
C:\Program Files\Malwarebytes\Anti-Malware\ScanControllerImpl.dllFilesize
5.7MB
MD5325cb58e19d485e479945837d7f8c1f8
SHA16102985f07a589eb81badf9aeb66670e7469cc4b
SHA256faded97793f72b925053fad2efcfff9c0e1aea5cded6b1838652a1f86fe4bc5a
SHA5126bbc6129c197d7dbb2b1a8152b2339f54fddeb9fee3a55099d148172ec0b7c9d1102d5315fe885e8264d8b39bae1864d2a825a9ac78bdcc671d6eae8e9de1228
-
C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.jsonFilesize
592B
MD5f11571823152e53b8c7b813f43dbebc1
SHA1fa4d70e438c909b042c67f2e3c902f323d4187e4
SHA256aa99e0fb35b60077d01edfac2ad7cbb90036ccc1dcb8dbc8d9a0e2684ad9e04f
SHA5122bf2b44ea85b922cbf00f448f3ce2146ec76a518b72c8c27a7e3c967d7d617a8ef3d1a6451c6816bd10d6f84685b8d5086d916991c914635bb67083f95da3f0a
-
C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.jsonFilesize
592B
MD5f11571823152e53b8c7b813f43dbebc1
SHA1fa4d70e438c909b042c67f2e3c902f323d4187e4
SHA256aa99e0fb35b60077d01edfac2ad7cbb90036ccc1dcb8dbc8d9a0e2684ad9e04f
SHA5122bf2b44ea85b922cbf00f448f3ce2146ec76a518b72c8c27a7e3c967d7d617a8ef3d1a6451c6816bd10d6f84685b8d5086d916991c914635bb67083f95da3f0a
-
C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.jsonFilesize
654B
MD51754f8e576c15fb16200e22c37be1a2f
SHA18f3917cd428af307a9b18cb6be0e878ba2c5e3a3
SHA2566fa60108d34ba7556fa49aa427dc201693bbf8caeb342c9dbacdb62a8518d3dd
SHA512b39cba8d930273705a53359fbaead8f2e10ba8ec27c645a44005dfe2dd1887738e16599a6ab0fa5704be2cbcce506f62adf3555e542cef0c7c4fbabda7143619
-
C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.json.bakFilesize
592B
MD5f11571823152e53b8c7b813f43dbebc1
SHA1fa4d70e438c909b042c67f2e3c902f323d4187e4
SHA256aa99e0fb35b60077d01edfac2ad7cbb90036ccc1dcb8dbc8d9a0e2684ad9e04f
SHA5122bf2b44ea85b922cbf00f448f3ce2146ec76a518b72c8c27a7e3c967d7d617a8ef3d1a6451c6816bd10d6f84685b8d5086d916991c914635bb67083f95da3f0a
-
C:\Program Files\Malwarebytes\Anti-Malware\Swissarmy.dllFilesize
4.0MB
MD5ae8affa9f5cbf51211132b0146bada81
SHA1912f5d4879047dd2c84e40689dd87fbebeff94aa
SHA25616b70ec44567e4b20216c3906fc40e26671078ee58c50f3fe1b1be8d3b521316
SHA5120b512a695430f433cfc488098ee1e965dcac2b1e0f80d3597858d32fcf6565c2e12135fb7ad2ea266e17c26a802192f47b603413740eccc478000db94aef5397
-
C:\Program Files\Malwarebytes\Anti-Malware\SwissarmyShim.dllFilesize
2.6MB
MD5cff3e356609f66039d7c732b2e7a3c2f
SHA1149741b831d7ec985e12ecb177040e98e6282f36
SHA2562a4a95dff26010278a6d5174dde2ae23269905534be788e3d2fce7baa53f35c3
SHA512dc9c4c78c7c43cb3b87a2bbaa7a19e9b57b3ca8df94dfa1a7657ae18a12fccd8b4cc8a9ae1aeb8457272c226e09f251ffd4922af78346e000727457693b5dd73
-
C:\Program Files\Malwarebytes\Anti-Malware\TelemetryControllerImpl.dllFilesize
5.3MB
MD5c656aeb7dfd645746d1077fcfa3fe5ec
SHA134cb10804d31cd808376a91a7b7a650ae9c34a43
SHA256f08752a9ef44bdd09d1c3bec0a30db3364c501d1742782da9312b08ce88ab5b6
SHA512689fd6b87e71ac229d2829f32112f23fb05198b46322ad60e252a2127796f90ab11d2c9aab4fc160cbc404533c0ff9a3b97bcadcc1f91ec5af977413a3280121
-
C:\Program Files\Malwarebytes\Anti-Malware\UpdateControllerImpl.dllFilesize
4.4MB
MD51fb6a6c92affd0b5e5609f8c978abfb9
SHA1413ac37b4aa6268d1b65b559cc264bc95a204dfc
SHA256ec25b45819d48001ffb178f38292acde49369289335802a59eb6d9071a018936
SHA512885cf1f3d8b2e795db288291f2e6256b38fe8f3b79a276a59f013dd9d1200c1ecfcf537d9f889a488713d6b35753332c22b553ea8f1156f5a6379e23b2633dcb
-
C:\Program Files\Malwarebytes\Anti-Malware\ctlrvers.datFilesize
8B
MD58e160946d937c3d05c20d4b6956165ed
SHA1d864c75c7df3ae41e1b9278fe2fc8df3e0ccb4f2
SHA256002087a846ca9cc24db51eab7dca9d0e2708bb3ff595046ef6a5b881ea0a7517
SHA512279cc6bd2b1200e147fb12162e31657535687ea0f937eaa0c579550f6a41874d272eff758c34726b330b5fada205e5501393bda39ed2aa37f0acadfdb3341532
-
C:\Program Files\Malwarebytes\Anti-Malware\mb4uns.exeFilesize
3.8MB
MD51c1ed125b4ba65d7499504b2c77a8b27
SHA14754ee30ac153247c8a0e5a264aa48c0f4c20ece
SHA2560113b48553f2a67726a4eaf0fff5b5eda2853aadbae32be7a99629b8a6700196
SHA512a51d3dc077b91b14e5c38083fc1186d5b5504cdbb5439942c39fc4d054aa05ad9bd1d913b7f8bae8d35971ee5f92e1f483cb39b6722a91a0976f96f79e39b512
-
C:\Program Files\Malwarebytes\Anti-Malware\mbam.exeFilesize
22.9MB
MD5b5aee6d83c6e863c1d6297f12046b08a
SHA173d29b270cbfd3c460fab0d928d20e9d04a4ef55
SHA2568ea3e38765219ce853925d3e3a9d9dff9c651ea88cd14f86ce3e82caa56bba8c
SHA51286075d0f152fccf329f34084aaac48be8e36f5dcee0bbb2be025dadc3ab5b9dfdf91f229e0490ba0f6bdea06b8c3e87ae6d5a7d31af02be13f349038171790dd
-
C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exeFilesize
8.8MB
MD589a9601cef4288dc9f6cd0a655794e7d
SHA195663d19c77776ffc06935dbe8afa0f1fa50183b
SHA256f196563e7dfca811272278881c31ec809eb7dd39f6d7032bbea0766da953e386
SHA512dec0102a881499ecccfbe9c224cb3544217b7b48ddb7a5109a9387dead18b1359e63865a8ff406a000205dc742effb220a97e403f5c31cdb0340a9111cc9c882
-
C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dllFilesize
2.7MB
MD5b7e5071b317550d93258f7e1e13e7b6f
SHA12d08d78a5c29cf724bc523530d1a9014642bbc60
SHA256467de01d7cee7ec54166b80658ff22f9feebdb1c24eaf1629cf40e4124508064
SHA5129c35293c95c1a9141740ac99315605964aa37c4a42d3a11cae9e5649ff1427a9480d3d5e7f763212cf13db3511c5ea3c84e68f95f0067fe6339a9d3fb7b27c54
-
C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dllFilesize
2.7MB
MD5b7e5071b317550d93258f7e1e13e7b6f
SHA12d08d78a5c29cf724bc523530d1a9014642bbc60
SHA256467de01d7cee7ec54166b80658ff22f9feebdb1c24eaf1629cf40e4124508064
SHA5129c35293c95c1a9141740ac99315605964aa37c4a42d3a11cae9e5649ff1427a9480d3d5e7f763212cf13db3511c5ea3c84e68f95f0067fe6339a9d3fb7b27c54
-
C:\Program Files\Malwarebytes\Anti-Malware\offreg.dllFilesize
114KB
MD516663d125398773a90d0a53333b7cf5e
SHA1f92928ae3c9292588547ceaca1cb1d372bfd7936
SHA25638e6811b47262101759aa51a631263d9e3eee5d211164318a751e078afec4cbc
SHA512091764b8ad80aa31eea0bbd91ee505ebdea2654bc8aeaa3081a061d0d37ab13d27dd203075fd0de10c6687591aa0e36139a38af846c4e34e6aa67ab81dc277df
-
C:\Program Files\Malwarebytes\Anti-Malware\offreg.dllFilesize
114KB
MD516663d125398773a90d0a53333b7cf5e
SHA1f92928ae3c9292588547ceaca1cb1d372bfd7936
SHA25638e6811b47262101759aa51a631263d9e3eee5d211164318a751e078afec4cbc
SHA512091764b8ad80aa31eea0bbd91ee505ebdea2654bc8aeaa3081a061d0d37ab13d27dd203075fd0de10c6687591aa0e36139a38af846c4e34e6aa67ab81dc277df
-
C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.catFilesize
10KB
MD51f539a950d77a19b0b44a320ce6641eb
SHA1cf1732f69c54ef296a934a497a91cdcc88ad81bc
SHA2563e3ca6e7d8ce0530fba6aa3971a6386d9cd20cb0811a99351cb0f8cb3f3ba635
SHA512ea423f461e665cbcb7ed934bf20b5243f60f2c7713f950e90e097f943ae8a0633867d1334c5fc742aefdd5928f3f41e14747075552bce474cc454902fb908455
-
C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.infFilesize
2KB
MD50ff3f3ba83e1dc78aa42e205e1a01867
SHA10a557f31af77bfccccd9530227d593efb4809fd2
SHA2569c5dad17bd0878115a88a4c94405fbd9048294462eea474f265ddddedc90771e
SHA51280543530d28722b926d3aeda4a0c61fc5bea1812e38a3a1b7b84a5a1803c078bc54c32eff23b96766fd5e27301818f105d86235cdddbaa0dc51ac347ed3d7dfd
-
C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.sysFilesize
233KB
MD5764310ada7e8b6c20d4e0020c8bf8105
SHA1fcf840985419355c7508e394b5fe8e112d9c6a08
SHA256bf29f76c794067a4f04f794c2b3eab9b6f1a9943c0500cbfd94f619dbde68a38
SHA512451b452207429f1ed84bd23008d1a8a5e98f757e47b0f8f21463eb9cfe93d4e10e8fd4a5e0b794b90925967c1cd133525fce30c00e5629ba61dcb948a5db5b4e
-
C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.sysFilesize
217KB
MD58daa2afcce65641472b57b91f2c1389a
SHA1fc664a927c04b30ed9af629d4c100da41b30f503
SHA256c303ad973ff82f7f9d256b3762dec7064c916c35aa57e7af50cf2248278ac1ff
SHA512ce28db6214a60d0479c537e19cb748ec0468c35552e0e3d13c86240e3d5a57d1dd93d7522adda27f9073fa8908e450c72905601710ab9789e1cb628206c5d7b9
-
C:\Program Files\Malwarebytes\Anti-Malware\srvversion.datFilesize
9B
MD58422d5b676e9b2f9500c2c8abc05dd68
SHA15050fe433fdd3722c0cf9c3b610476c4677de6b3
SHA2562abebd6c118af131c7c4ad0becfa2c983039aafe078f4857ada054645ac8c245
SHA5122572439ac0fd204954bb03e62eac8b5ff8d4feb4ac4db5d46875b65367b76f3d64fcbf0d19a621d58af5884afb7e4851ee9f2d99595dfbbaa6ee94d5383eb728
-
C:\Program Files\Malwarebytes\Anti-Malware\uipkgver.datFilesize
6B
MD574c6677020fc6b6c867aab117078bf5f
SHA18c46db37dc0b39eb963d4144539c8b591e122400
SHA256cdbb9bc874d71e154c71b68b1fe959913d286036dac11e226e5620c919ba9708
SHA5123f9db8d9bb25322f8d8e750750bf92dbe6ac63d686eced65cddfcd61178cf0e947118a491058414d4d2cbb4892e39815565669aee0dfdda23aece72d278292d0
-
C:\Program Files\Malwarebytes\Anti-Malware\version.datFilesize
47B
MD52a261a75d170897631341c8834ebcf9d
SHA1c51a85ee96400ac4ddebb1f399bed78b7665dc9e
SHA256ec519136bc3df913181c787753c21ebd11273eddb103873779bd0c21041c2b09
SHA512aedc8697a8541190dba12417ea8c68a9f2531acb22a6ebf378b7949accadc94ba69f98cac855cae7665f907c532fea4ff4829cb47b708ad140cf8a3315e99aae
-
C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.jsonFilesize
47KB
MD580a8195631a9d1dbbfb53e8460674449
SHA173561cc90fc5b885171a18057fedda10f478256c
SHA256f0f2a4b0b78c94660fcd2ada1e5248e3f4fabc7e9c3575f15a9b95d42314f164
SHA5123a7d43a901ce16d384bab790a8e1819d1a7bf3228cf2df9ef5fc3e2146784c03bf6b7f736094ebe0be42e9b00872ea70f44d605bcab96a4132e301f46f2e5044
-
C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.jsonFilesize
66KB
MD52f50204a5eb0b045c8bf85f9cfb24e35
SHA161b314ec4d870f0514ac40b4837ff997280207c7
SHA256be1b38dc24e9281aac716e66261e5ea695829a39c21e5ca15deedcab47462759
SHA5129888825a4523062cb25654e184072b2623b354684dae1a64ebfe9b9f7147bc5586c5789ab7eff0cff53fe8b52f40f1f81da434b13f0904f012ce9364de7cb0c2
-
C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.jsonFilesize
66KB
MD50e6d1c61a2e46cd8230b814962bd509f
SHA1a7a72f3c140916ca7156a3906bf68ee68611e221
SHA256cc4a4388041ce702486caa3a96dcb8a3cf24f2e5d20c5f5df21350a35f4f3bcd
SHA5129af76bdfc8cd99a39707fd43515ca4a3a9ce03f7466a3deb4d960325757c8bcdffe782ab3802d148ac69c076a6e6fba727719927c5cec94ed9f8d249edb4bf14
-
C:\ProgramData\Malwarebytes\MBAMService\config\ArwControllerConfig.jsonFilesize
607B
MD536524ff9af615edd23ee9b0bfc958a16
SHA1f2d360e8a88c0dd7777c6e3dd9184e5ee1f92f12
SHA2567f296d3cbb337bbdce4edd5d562445312c2b89ff97dce8d14e53c2bcee12df49
SHA5121e8b51f158e2c1f855b74f2be933165b7f37d93a50b71ded4ff927fa0a3be2c48f40a72b627c3e209862732eaca9ee892bcb984bf51d6b58812d177937e82040
-
C:\ProgramData\Malwarebytes\MBAMService\config\CleanControllerConfig.jsonFilesize
847B
MD5ee4d3cc9c615feef2bb39da2637a856e
SHA1494d745d05c76fdc03ab8725e0d9fb21c206e427
SHA2561ba557c38bf37d3b2d6e1cf6616cd975f29e09d7f82737a26b313090b3411bd5
SHA5128789d38e98d8486aeef6a3467bdd4f13c0fe4daa1f71bfa075219441cb2c11a4f0ca397e9ec83c9ea1f7604633634328573c91d1bdcfb430cb7365694e7e8a4f
-
C:\ProgramData\Malwarebytes\MBAMService\config\CleanControllerConfig.jsonFilesize
846B
MD5122dba2e94993ea20a0a0ee27ca4ee4b
SHA1f4b0d37f2e2478267ff730a61d2cd72f007618f8
SHA2560d483b296c1a38ee370f0523acd25468da2b72666291cbd6bf1e2e41e69ae6a7
SHA512d4c996dad8abef67aed932a9acf7a74877d8c326275ea259fd3fa823a5808c4e6e9a57d59cbc68a0247bef3f648c920e36a4a03241ac82e5eb31ce640b5adc8a
-
C:\ProgramData\Malwarebytes\MBAMService\config\CloudConfig.jsonFilesize
825B
MD5aff82e646673e8154b41e39100e70df3
SHA180b9e737ccc905172a0745ff92c46f809df3a537
SHA25666f6541c1fca675231fee9b35b826f7262f035c872871f32482c331145a7ac7d
SHA5127a483b91ce456720a1e523accf8f2c0db33e554c3ec4622c5c8f0439b177c29dbc17b875a38bdf2fc1c73c15e998d52fd1e4b413fa9f7f00d2b3adce73b6d43e
-
C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.jsonFilesize
15KB
MD5ebb36d57c69f8b1d7d5f20081744bd2e
SHA120415ea723bd0014b212d9ad5c2b9dd29a7ff18d
SHA256dafd6a8f0219757a7e8a2d7246751104dbdc6adada338cb2d2a11dad6c891789
SHA51243aea7bbcd4ef3e7ac0d274cc7da02bbdf56c3652a4bcd15675ffd5729357702251cfb0ce050b02884ae4602a090feae7fd363091c49a2b5da4958e7f373fbee
-
C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.jsonFilesize
15KB
MD5cc3905bd93bd98c3fc7f2a13a7f74b41
SHA1ed7ee3ded5b631c43543a8b275919a956089c8a5
SHA2565112fea52835c4625da806e28f6187770c5103350c10a000a2cd21d53348e469
SHA512aad79a947a5fd469e3b91a642f51bf8eeabe8d1b120698cdcc86d193819013944769f7a95b9e42889a2d51ef54b76b1af44bc9ac190ec1355f4ab272cff1fde7
-
C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.jsonFilesize
15KB
MD59f0f18cdc48975a1e71fa1e0e2ff1c0c
SHA1d185cac86d67a8c361dbeb378ae83b55f782f3a2
SHA25690673ae1b2823c9811eaac4928d9d6eaa2f7ea66797f9d0aa8ca8b96ea931bed
SHA512c3ec55e21d84174d363d4e13ad54ee633c8fe701f3c1e7f3ce8f12f415bc3c6993d0ed5ea3aa0c5409c521e50a044b98f3354644a45b913b1a85b594e4c04b92
-
C:\ProgramData\Malwarebytes\MBAMService\config\MbamClientConfig.jsonFilesize
1KB
MD54c4fd3915c4c2f823c5fd657b0d109be
SHA18385624f35e4674bfe456eb09facde7a42bd9dac
SHA256be951d0b5675a8269574b7e952bf6a3e1078157e405d7780e639e6f41ae397c8
SHA512d56c922fb6e731b86ed002797aa78d003f00884a93a8efe90525c013e6d9ec3f350306eb478fa69d8f91db239ec4e962370313acb8ace1392f0d42704bd6064b
-
C:\ProgramData\Malwarebytes\MBAMService\config\MbamClientConfig.jsonFilesize
11KB
MD58200ab8ff4660f41e2e50ad83312fe0a
SHA13efe8a76befcd0df8caa5fb8a4dd24440b459ab3
SHA256663b3e08d2e59c7d8e65574cd272c44db203d09584e740400a8abb6cf9946d36
SHA512e55665c802b6722f34701a08afc80aead10c5dedb89a9b5376dcf791b76d71e3ad6db7dcf2067717419ba16a45689d66e6ead659155ff06e22e3e30712f58357
-
C:\ProgramData\Malwarebytes\MBAMService\config\MbamClientConfig.jsonFilesize
11KB
MD541a46456d9e07db2b51daf3724a1eda1
SHA1704517a108cdabd7a7994d87977de4888b37e1ef
SHA256e679f95e831ffa21bbeba130d18dfef7a3076545e8bfa5f03eadb2a8ad990d71
SHA512f349164c8fd4dbcbbfcebb24268d4205be91ed89a4189b4035bde064f391596295f88907e1faa173fd58a9a9f100e051916546191a8f942dc03070c8eda2ed62
-
C:\ProgramData\Malwarebytes\MBAMService\config\MwacControllerConfig.jsonFilesize
1KB
MD504b8a197e2384d6d0ce8d92dcadab8f5
SHA1af8ddb56b01ff3c80bdd09472f51695408603bde
SHA256aba035b846471b4d878388f80a8146330e60d1835b1d2f22811eb2253a5b9312
SHA512b65c755b7417e218d1b1882892ccfc9424d797723fe6052382310f5d4f06fda06688cca1f6432554ea1643e62ecb901428e23049776b9cfce242ff85493487b9
-
C:\ProgramData\Malwarebytes\MBAMService\config\MwacControllerConfig.jsonFilesize
2KB
MD55b6e16c8de514e476b44d0f65282ae89
SHA1462699b51a8f3f1544235e02b6e0c74899578f00
SHA2561cc8234a29b07bd60f4f06415c16ff25454ed1262ea58108bbba01e31c46b7eb
SHA512739fbbb7a44b042095b47f1f22846a8870756ab4356f55a06e4fc1ca5960ba0ad3ede4c9e0a0869d7113ba67bcb4b7a4dc7e7eef99158641fb3bc8bb002615de
-
C:\ProgramData\Malwarebytes\MBAMService\config\PoliciesConfig.jsonFilesize
903B
MD531c90ed51e883f162e69f9be2aa6cc50
SHA137e3c4e6e8f7626b06d2011b13cc547885d85349
SHA2563df023837d8b9ab06c2cf879870c25062211229d2beb69f458868e52976636e5
SHA512e5b2219e2e437a6f1f75b68e6cb3cf56ebb9b781ead68887d58ea06559cd8a2346bc6b26d521406283ec10e7782f8c5807164ef19cadfb8c99ffb240f6132c0f
-
C:\ProgramData\Malwarebytes\MBAMService\config\RtpConfig.jsonFilesize
1KB
MD515124ecc6ff08b737e2977fb737cd5eb
SHA1c0cfbbdefc0adda68f8476031c7c2442adcf7ea9
SHA25650f33b8fcd1071092a0b4d437cc8af179ff55ed541a48d9893ecd1b0ec6af005
SHA512eb9a3914ac9332bbf2779fd92e8aa3a1512a1c218a086afb93700e4ef5053c452ef1037046560cf7a0babba4726d01a19a4950153ceca39ee5e703df3f0394af
-
C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.jsonFilesize
2KB
MD5d59763a6f088ae555e7b8e6fa08424f3
SHA1c4b21b373c7f4f475d2853e7519668c98600603a
SHA256b8c6d43480da91491275ab71dda0a02d27949e8eafdd75ba0df6457a563e32e2
SHA512e5fc79d522be09ea4d128a0ec9598c89dcee37327ab912183331cc32acc5dfa888cb236e48f51ef82b5feda6e6f2a2603a86b688646927987b9525aaa4b57fee
-
C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.jsonFilesize
4KB
MD5d3b9b5e7e2c5e573b5c42f5b11cbfd67
SHA1b7ee79242e1291f49880dd161810be630fdd3c72
SHA256273fad0c4592c2b2e7120d3b9e078e0176e9bb1cce4adeb465cd543093fee12e
SHA51256b66efc609541caecb51f78e6d266296be94c427051493f48d99ef15256febd90b8785c334ee784da53bd272e0d75af1df905b404118e2e1c1a571402af7e2a
-
C:\ProgramData\Malwarebytes\MBAMService\config\SpConfigFile.jsonFilesize
11KB
MD5e585c0470c9fb4879f8a7a0f86474f37
SHA102018814430aef21a81b0a0b240b2908901cd5dd
SHA2568c590ecbd422bd6b2d0ca043d0ec6c3e5aa80131b41f13c90e1ba793799fe360
SHA51251d4e96f6a7573a206482b995f98a30be448fa6d9838188487fbb4176f869663bbd9c4d3ad499845ff2969e092fff4d5890c12882b918d17dd73dbef6935d97d
-
C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.jsonFilesize
1KB
MD544444e7c729b648ce35371888a810eb7
SHA15f2c363bd2f8972c51b4925205d2de24c4cf65ff
SHA2568fb2e3299e7933097035887b3fe9ba7da0cd417ab38998d44897f81baadeb7ef
SHA5120401bb48a6376736967945d5a3856d4162427268bc7b2431144ae061ef7f70d53dff3efb5930ce9a17d02949cf5ffe235307ed1dd248bd4459063b2d03b9c2df
-
C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.jsonFilesize
1KB
MD544444e7c729b648ce35371888a810eb7
SHA15f2c363bd2f8972c51b4925205d2de24c4cf65ff
SHA2568fb2e3299e7933097035887b3fe9ba7da0cd417ab38998d44897f81baadeb7ef
SHA5120401bb48a6376736967945d5a3856d4162427268bc7b2431144ae061ef7f70d53dff3efb5930ce9a17d02949cf5ffe235307ed1dd248bd4459063b2d03b9c2df
-
C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.jsonFilesize
1KB
MD5b066ee8a7dd22790e64ced4d01f36178
SHA1e160779ba82db3f976b4cca331b28ad6e884035b
SHA256e695d893a9805d13fd39d21f0660ce28a200f30a020540035cac00dab9bb172d
SHA512cec6e26fa297e2b68d93011b24d01e2d0256fcd6ab31497b687f3b3dd218bb4a68a60786414b032adf21162f012e73da28070c3268ed8c7645d0a8afd172067f
-
C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.jsonFilesize
1KB
MD536fb932e0fad1d64c41cd617f5bc32c2
SHA11d4619f7eee706f3b6e39bbf56c2c16e893ebc52
SHA2568e935edcf49d8dabc628c8e0842d2f025cb1493e170afeb58cb44e5bb1f0d23e
SHA51209f1cbd71acc50d504a57c194005e86a16dcd75f84510a1167ced231c20400e401267a6f94582da7402bf5e42c35d21494da2996a0c6663ff19940d9cc627ad8
-
C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.jsonFilesize
1KB
MD5093493bc2e4863fe6b764cd7cceb4f06
SHA1585bd43ca8a29e77bbd56b7543d025213e801270
SHA256040e15060d228fd095d96524bff29ef8be27947aa4407d4e8591236af5cea192
SHA5129c7403d6b1a071efc46500c738ed40a9e21784b4b86b42eb605314c680437bf6f66d8fd5e9e39fd494e32d7ee150e360e5af8667f396c48b79043a4a834fa257
-
C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.jsonFilesize
1KB
MD514f828320afbb247ad80f38a006f7adb
SHA1425b3e497a2d7562b566571e9c90115ee0015972
SHA256903957fc85a494e318658e60be3d0c82ef7ebc8d028b57a197b7f1551dc31319
SHA51216c7621877ba2fc87caf80f3a0c56835f2797c87be7e50f5fcf2f2f849876900f95b7afe0e93a3514a60e5c154403a1674473cf0ef1f3f0933092653df025355
-
C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.jsonFilesize
1KB
MD55d4cf17fff7232d6e96d656b51dbbdc5
SHA1907e2a5bf06929d36443f8a8d163a7fc84cce5e0
SHA256bccc49121b8cc73a912c99243c2f762f473f9c4c428caace45cc1ac614456073
SHA5125c38416d64932c5a3fbd18f5c2f0d7bd2ab86858ea3bdd5361dde3a368162bebe59e33f822e6ab3564c80c4e43a86ebbb5dae1545418c774ddc59848bc75d80f
-
C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.jsonFilesize
1KB
MD56470f6ac638d2e5cfa8f3b112dde16db
SHA177231dbc9ae82d29038d77d5aaad88054b357149
SHA2561b623bc3ee705e135ca37cf3e33f7b06580571a433ed6194342f6a6091bcf5c6
SHA512758a86b0bee5fa3c541604b235d0ea9c1cc0d49a191a6c45d4056ca63212d576d7f603726c64077d1e1bb02e8d45b701d904a7ddf38e553348bc0753e2a46061
-
C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json.bakFilesize
1KB
MD520a9ca41bd3c98b3ca45d850d277abd7
SHA13ad1fc98cb04855e89213fe11264c6eb8cecd04f
SHA256ae4d6df34fced352c4f41dcfc1ebcb3e1d9d36e05e426d4aaeb17aa6f46ca435
SHA51276d9c2aecfd26b277ff288b0562a39fd0c9609537bd1db3e25be67541ec182979ccbdc73407ffc0ac04b36284b5e4d53b3b2ab0d3814798244607369b169c80f
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\Actions.dllFilesize
5.0MB
MD51eff53d95ecaf6bbfffe80d866d8e1dd
SHA1d7ef7d7c77fd04b2c0eb8c16bb3cd08057f6742f
SHA2566dd748f7ca56125cbe158fa3612f08e7312ef58ad5375e6b7ab5532cc16ca0ac
SHA512c59b8e6f0b238a247e64b9c7bb42213dadac1dada63542830a6292361174c935c0c662b2d1aed3fb6100cc4993297b1eaf25e328f2b4613458c4ffca63b9f02d
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\BrowserSDKDLL.dllFilesize
5.8MB
MD51ed53171d00f440f29a12f9beb84dac4
SHA14d9a1e3579b0999f1ab2fa818b588411e9ee920c
SHA256e659e687a872050f9e65d78992d16bd9b393cf3f8e8c94e0e15fb42b7065327e
SHA51217161cfc672d1b996b8af4ebac17f9a8a3807f38c9a23e2e5b4dadcd9a21c3a64faec9bf59147022a9df88b80f89300f1b537091289bd7a42806bd206a317e6e
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\Global.nmFilesize
336KB
MD56527a87749c06942b6852aec88474e3c
SHA1d188de296d877cececb023006d9c093199cd9353
SHA256563ea800778b85b6d8201e68d7ae63e59ae401ec6d27285435ae7f7d3166782b
SHA5126f33c9b07bcb94531b261697af40e957a81d4493b85e113591c8bcb8b53bf1c9b35ec2847fae9a6c0d5420048a2f550fe17cf0ffb5a6291f58936dfe4bd9ecc9
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\Global.srFilesize
20.8MB
MD59c511b9324b2b9d5af51ab2b4f36cdfe
SHA1aa242a62cf5de6902ca29419464d73ebff50f242
SHA256131f11589ed05cc31673e1ac6cc6c860a66a0a4b2fe3ebb08f1aeee0ec60e5db
SHA51282d9afeb847bf9695ecf47ffdb49a43e647a116a55e76a509edcce67566d8ad0d762e2de9845ec17566d51f2219c540cfddc8bd24427538aaa583ef7dc0d64c7
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\MBAMCore.dllFilesize
6.6MB
MD5f5326e215357788237b4c4e78248010b
SHA13fb03c85f0180dc60a9756b50b44e4a59f056be3
SHA2560d0525e66bae8605c0afa6b877ceee4c9b75be15c5c47ba8961041b3bdb848de
SHA51293f456a22d30fde2e5330573f6aa24b7b3ebc633fbb7171b135e4030c127b17c5e3cb2c9a56f62355070c9a6fde564144fe56e1674f5f0d905691e77854789ef
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\cfg.binFilesize
1KB
MD542dc081efeaeed00967fd339278d6c97
SHA16969f00e1bcb5423395fccc12584e46cabcda9db
SHA256dbaf53794113e4172f5c78d4b1ffdc0a2f1d7a35e5d8e8893f0c2b5d1a3f4bb9
SHA5127ca9cbbb9e9820d6fffe13709d42b90df1fe58060c7a8342c4d3ccb72fe063b3cfcae1797d4bfa897fcd4955bdb5e0fdd585a84c0f7b7479966df27c0245bd0c
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\clean.mbdbFilesize
10KB
MD5942cf3b533c8a655cd9d65898e929def
SHA124aad2f3d7fb519eac85128175821cb6f2a3bfc8
SHA256a0dcb255872375b505fd833d48086e580005b26ac835117e90e0fbe71bbe0b94
SHA512bd5c6dd05ea0c9f793c2903b5407fe039786da5e4a744a2eb1b3f952b93190c6ad587241ce8e1242dbf6c4717f1e5043bd81b3a612522aaf77f7593db7eda1e5
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\dbmanifest2.datFilesize
924B
MD56d3a651a4e631406a7efd5aae72948ef
SHA17dfe3b01820d3c2265aa69570e6092e0b09b1f8c
SHA256d086782bd9d6a75615062b0dcf3e21b3c530c6835acf80635696be96cc6f28ca
SHA512514c23a88e2fc47ff48750f8c7ff258c481ceb6479c6b37c537ebf5999e94baf03565ddaa1c5d5c6c5ca59008f666ce0131d7ad0a8ed3394732f10ecfc4d409d
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\dynconfig.datFilesize
39KB
MD510f23e7c8c791b91c86cd966d67b7bc7
SHA13f596093b2bc33f7a2554818f8e41adbbd101961
SHA256008254ca1f4d6415da89d01a4292911de6135b42833156720a841a22685765dc
SHA5122d1b21371ada038323be412945994d030ee8a9007db072484724616c8597c6998a560bc28886ebf89e2c8919fb70d76c98338d88832351823027491c98d48118
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\exclusions.txtFilesize
23KB
MD5aef4eca7ee01bb1a146751c4d0510d2d
SHA15cf2273da41147126e5e1eabd3182f19304eea25
SHA2569e87e4c9da3337c63b7f0e6ed0eb71696121c74e18a5da577215e18097715e2f
SHA512d31d21e37b0048050b19600f8904354cff3f3ec8291c5a7a54267e14af9fb88dfb6d11e74a037cc0369ade8a8fb9b753861f3b3fb2219563e8ec359f66c042db
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\ig.exeFilesize
1.8MB
MD58b8dce48722a187976860c198d8f4d65
SHA1f9346d6f05b8f232552d26eaba71aa482e324f57
SHA25666035f0d7b5b3dac02e855e764f2a561480edaa4fc7e83cbc3c34c082b391969
SHA5123771dd731c0ff921d06daec013908fe64a10c8a526f517d359b0f3921c6626fd9af371d46751258134c698c3d1c001977d8b27f400c996344c78a5a530b199f8
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\mbdigsig2.datFilesize
514B
MD504aff86c893b68fe28949a9f25fc2aca
SHA10993f31a19467a84e8d4d8c16a955e5050f9fe9c
SHA256f2a70cb52c9a4e9120cc139556b713191356f3efb0853b31916e53074ecc028f
SHA512ab743f64c8a073a5f74b0474a320a5b502baaf9b5b6d3264768259c6dab59ca6f5322bb2fad5976a803e4ff7f33a2237c8d9f51ffb04ee6c0403b6317b7d5b11
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\prot.mbdbFilesize
24B
MD5546d9e30eadad8b22f5b3ffa875144bf
SHA13b323ffef009bfe0662c2bd30bb06af6dfc68e4d
SHA2566089fbf0c0c1413f62e91dc9497bedc6d8a271e9dc761e20adc0dccf6f4a0c1f
SHA5123478f5dcf7af549dd6fe48ad714604200de84a90120b16a32233b6d44fa7240f5f4e5fe803f54b86bbdfd10fa1bfdd88fb85eb6a78e23e426933f98d0a2565ec
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\rdefs.mbdbFilesize
24B
MD52f7423ca7c6a0f1339980f3c8c7de9f8
SHA1102c77faa28885354cfe6725d987bc23bc7108ba
SHA256850a4ea37a0fd6f68bf95422d502b2d1257264eb90cc38c0a3b1b95aa375be55
SHA512e922ac8a7a2cde6d387f8698207cf5efbd45b646986a090e3549d97a7d552dd74179bd7ac20b7d246ca49d340c4c168982c65b4749df760857810b2358e7eb69
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\rules.mbdbFilesize
9.1MB
MD501a727786ef6ca871c88126516257a3a
SHA1f113766911a3a255c04fd62f4b31b1eaccfff74d
SHA2561f6c5730e2f226044bbdddd32c25c021a33c075cf2c97107454f293fd3aa56c9
SHA512e465883bb65b3799e60f09df48f9a327994a3ddbf03e67dfee35ccdb4ec7ce1aaa3291d969f0c1247d815d433c68679e26f4870ad08a29e07326e07f8262d2ab
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\sample.dllFilesize
528KB
MD50d964850f272eb25013c951e9d76c028
SHA1e581fb83527b84c4e55912a9f88107e9ddadfe6c
SHA2562974f71ff7763c6d4844dd67d139d137a85062fe8e8c111e75e7614ac8091b4e
SHA512a7c0e6252091240e33af64ff47208ed4a7c8e5be113fa4f36497280a0523c41e1096112a5fcf5290d61e36d414f970e9aff07a3a5b0ff586028dc4fd6b881f9c
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\scan.mbdbFilesize
1009KB
MD564cce9df252a423b80e78d6e63ea8823
SHA1e223b7716e569faaef458acffe6bcd5806435f20
SHA25636b51ce7970a6dbae2549e3a1585aa9037b0683dc5ea9c3deebb7daed8884c59
SHA512d57772fde98914b1c9ffabc5e0df91b008b9ce397bf6b4adb93bffb581b38d3fea7fd2ebd43dda79119504228c07089f444b548aa077bef7c14ec415df2a0bc8
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\tids.mbdbFilesize
176KB
MD543afd4322f580202374dc9e921da9bec
SHA16c3038cf9476c161c09ac543248a2565b639ba8a
SHA256ca516fd91a4e615c25740fd4d1fb5e0e1aa09f3f7a4419f36609d21cba019246
SHA512f80d8b5ab40d1661615469952e7b410fa7c2a7f2c2f6eadd9c8ac1c3c6167abf1ddd220874e08ee90e8563a46c74667982bd39a288868eafc286858e4cac7cfb
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\wprot2.mbdbFilesize
41.9MB
MD5a4d210e94b3dda28e7f908dfee36507d
SHA1f2a3986a3f2208b1f5289429b7649f2e3c169a99
SHA25650d9cb97d6728cf2c55933b0d0e8da7b3e954e444fa1610b72f8d307ed7aba4a
SHA5120a616ecea55ce4be001b516826341eb6a0b8f1123f0bb0ba5ef93396e6d27d587e5cfbdbbff20099bb63c73d07f0241f8ad17c8b3ef97fa2af5f2d24f43c84d1
-
C:\ProgramData\Malwarebytes\MBAMService\pkgvers.datFilesize
74B
MD5bcfd48040bec0ab6073e01b0bb1f826f
SHA19e960186973d3fa711fe8e98fdd63d0f3e8e6e56
SHA256286e437a93b20e6f532a91598d427b80a57f9f970a41d124113d3b0299a54de1
SHA512bf41f576a18e1b9d0d732944c5b20ce64f82d555027ae1b60fb39418415bce3c330a5909e2cb9e92f064786bc9aa487e83728b99b7db33a36eac33c96a11887a
-
C:\Windows\System32\CatRoot2\dberr.txtFilesize
148KB
MD5b676a663e25a7ac8b9edd92541d4f6ae
SHA1fed20df93eb79697aeaa1d907af4a891c0f80a60
SHA256d2fc5af507dc6345a629f24aa7bfce71b384412460097c8ee132c39c236890db
SHA512cb629bbddc0a32cf0240d1387341b0213c9681b70da29d8c5f7721f7a71f0befb6b7d982812f6ac92a000d6c1b829c0c41e7c5f122dccd8a593bab2221e508ca
-
C:\Windows\Temp\MBInstallTemp5f0777ad8ddb11eeb4e8e2ac2ac9537b\7z.dllFilesize
1.6MB
MD5ab8f0c1a37c0df5c8924aab509db42c9
SHA153dba959124e6d740829bda2360e851bcb85cce8
SHA2566e223b275b84d948cc5ae1f161f0bfff2adb34de04634c84d7dbe9305a4998d5
SHA512ff8a26e8fd5a08c74e5ba93a564e0d3cd932754e7f06993a365bfad06670497889e69ec45bfba1378040b72f82d468e79682beba2439937bb29d2a41da940d4a
-
C:\Windows\Temp\MBInstallTemp5f0777ad8ddb11eeb4e8e2ac2ac9537b\7z.dllFilesize
1.6MB
MD5ab8f0c1a37c0df5c8924aab509db42c9
SHA153dba959124e6d740829bda2360e851bcb85cce8
SHA2566e223b275b84d948cc5ae1f161f0bfff2adb34de04634c84d7dbe9305a4998d5
SHA512ff8a26e8fd5a08c74e5ba93a564e0d3cd932754e7f06993a365bfad06670497889e69ec45bfba1378040b72f82d468e79682beba2439937bb29d2a41da940d4a
-
C:\Windows\Temp\MBInstallTemp5f0777ad8ddb11eeb4e8e2ac2ac9537b\ctlrpkg\mbae64.sysFilesize
154KB
MD595515708f41a7e283d6725506f56f6f2
SHA19afc20a19db3d2a75b6915d8d9af602c5218735e
SHA256321058a27d7462e55e39d253ad5d8b19a9acf754666400f82fe0542f33e733c6
SHA512d9230901adeecb13b1f92287abe9317cdac458348885b96ef6500960793a7586c76ae374df053be948a35b44abe934aa853975a6ccd3788f93909903cc718c08
-
C:\Windows\Temp\MBInstallTemp5f0777ad8ddb11eeb4e8e2ac2ac9537b\servicepkg\MBAMService.exeFilesize
8.9MB
MD5e4472f208d356ea4f562294ad8b82d93
SHA1b34bbadc349e722ef8b211f9205a610fed1f4a32
SHA256822957744702afdd6a571616da66f6c97a693d3a9e4b0c008f7f1614649a04d7
SHA512012c99ca3eb23f49ae916d2d7d62ff428b34ba0340cb6d9c3f80f292e115437f58b3a6bfcffb862f6e1caffa2a12b69bb3e7a56445ccf132cc48a6556290fc9d
-
C:\Windows\Temp\MBInstallTemp5f0777ad8ddb11eeb4e8e2ac2ac9537b\servicepkg\mbamelam.catFilesize
10KB
MD560608328775d6acf03eaab38407e5b7c
SHA19f63644893517286753f63ad6d01bc8bfacf79b1
SHA2563ed5a1668713ef80c2b5599b599f1434ad6648999f335cf69757ea3183c70c59
SHA5129f65212121b8a5d1a0625c3baa14ef04a33b091d26f543324333e38dcdb903e02ccc4d009e22c2e85d2f61d954e0b994c2896e52f685003a6ef34758f8a650c7
-
C:\Windows\Temp\MBInstallTemp5f0777ad8ddb11eeb4e8e2ac2ac9537b\servicepkg\mbamelam.infFilesize
2KB
MD5c481ad4dd1d91860335787aa61177932
SHA181633414c5bf5832a8584fb0740bc09596b9b66d
SHA256793626d240fd8eefc81b78a57c8dfe12ea247889b6f07918e9fd32a7411aa1c3
SHA512d292e028936412f07264837d4a321ecfa2f5754d4048c8bcf774a0e076e535b361c411301558609d64c71c1ce9b19e6041efa44d201237a7010c553751e1e830
-
C:\Windows\Temp\MBInstallTemp5f0777ad8ddb11eeb4e8e2ac2ac9537b\servicepkg\mbamelam.sysFilesize
20KB
MD59e77c51e14fa9a323ee1635dc74ecc07
SHA1a78bde0bd73260ce7af9cdc441af9db54d1637c2
SHA256b5619d758ae6a65c1663f065e53e6b68a00511e7d7accb3e07ed94bfd0b1ede0
SHA512a12ccf92bead694f5d3cba7ff7e731a2f862198efc338efc7f33a882fe0eb7499fb3fb533538d0a823e80631a7ca162962fbdfd78e401e3255672910b7140186
-
C:\Windows\Temp\MBInstallTemp5f0777ad8ddb11eeb4e8e2ac2ac9537b\servicepkg\mbshlext.dllFilesize
2.7MB
MD5b7e5071b317550d93258f7e1e13e7b6f
SHA12d08d78a5c29cf724bc523530d1a9014642bbc60
SHA256467de01d7cee7ec54166b80658ff22f9feebdb1c24eaf1629cf40e4124508064
SHA5129c35293c95c1a9141740ac99315605964aa37c4a42d3a11cae9e5649ff1427a9480d3d5e7f763212cf13db3511c5ea3c84e68f95f0067fe6339a9d3fb7b27c54
-
C:\Windows\Temp\MBInstallTemp5f0777ad8ddb11eeb4e8e2ac2ac9537b\uipkg\QtQuick\Controls.2\HorizontalHeaderView.qmlFilesize
1KB
MD5d8c9674c0e9bddbd8aa59a9d343cf462
SHA1490aa022ac31ddce86d5b62f913b23fbb0de27c2
SHA2561ef333b5fb4d8075973f312ef787237240b9f49f3f9185fb21202883f900e7d7
SHA5120b86ec673133f6400c38b79f9ba4f7b37ce5afdab1a2e34acbf75019e2590cc26b26d323ddc1567c91375053c9c8593be0615389db8eb1a8d1eb084ad4200b82
-
C:\Windows\Temp\MBInstallTemp5f0777ad8ddb11eeb4e8e2ac2ac9537b\uipkg\QtQuick\Controls.2\Imagine\VerticalHeaderView.qmlFilesize
1KB
MD5829769b2741d92df3c5d837eee64f297
SHA1f61c91436ca3420c4e9b94833839fd9c14024b69
SHA256489c02f8716e7a1de61834b3d8bbb61bce91ca4a33a6b62342b4c851d93e51e0
SHA5124061c271db37523b9dea9a9973226d91337e1809d4e7767e57ac938d35d77a302363ed92ab4be18c35ba589f528194ad71c93a8507449bf74dd035acf7cdb521
-
memory/3640-4114-0x0000022B4F400000-0x0000022B4F846000-memory.dmpFilesize
4.3MB
-
memory/3640-3283-0x0000022B4F400000-0x0000022B4F846000-memory.dmpFilesize
4.3MB
-
memory/3640-4235-0x0000022B4F400000-0x0000022B4F846000-memory.dmpFilesize
4.3MB
-
memory/3640-4216-0x0000022B4F400000-0x0000022B4F846000-memory.dmpFilesize
4.3MB
-
memory/4572-4219-0x00007FFA25B60000-0x00007FFA25F7E000-memory.dmpFilesize
4.1MB
-
memory/4572-4220-0x00007FFA255F0000-0x00007FFA25B5B000-memory.dmpFilesize
5.4MB
-
memory/4572-4218-0x00007FF777900000-0x00007FF778FC4000-memory.dmpFilesize
22.8MB
-
memory/4572-4221-0x000001F7EB0D0000-0x000001F7EB0E0000-memory.dmpFilesize
64KB
-
memory/4572-4692-0x000001F7EB0D0000-0x000001F7EB0E0000-memory.dmpFilesize
64KB
-
memory/5824-4112-0x00007FFA25B60000-0x00007FFA25F7E000-memory.dmpFilesize
4.1MB
-
memory/5824-4113-0x00007FFA255F0000-0x00007FFA25B5B000-memory.dmpFilesize
5.4MB
-
memory/5824-4118-0x0000019E8D490000-0x0000019E8D690000-memory.dmpFilesize
2.0MB
-
memory/5824-4116-0x0000019E8D050000-0x0000019E8D490000-memory.dmpFilesize
4.2MB
-
memory/5824-4115-0x0000019E8ABC0000-0x0000019E8ABD0000-memory.dmpFilesize
64KB