Analysis
-
max time kernel
287s -
max time network
292s -
platform
windows10-1703_x64 -
resource
win10-20231023-es -
resource tags
arch:x64arch:x86image:win10-20231023-eslocale:es-esos:windows10-1703-x64systemwindows -
submitted
04-12-2023 09:17
Static task
static1
Behavioral task
behavioral1
Sample
MBSetup.exe
Resource
win10-20231023-es
Errors
General
-
Target
MBSetup.exe
-
Size
2.5MB
-
MD5
1e885823577394ea61ea89438ffe2954
-
SHA1
e53e96f7374790bdad8a614949b398b055c3a27b
-
SHA256
7c0b9bceed390f7f28135431c09ac51469ee8e2b8095fb36a37315d811d9ba9c
-
SHA512
73f600833dad0047b6444110d722dc95237b38bb486abc7fc8e4f59b69e2154c885fb46d65f488d5139a0b6e76ebde33ea72711c7f58436650ef992fb8995627
-
SSDEEP
49152:Lw3ye9SPQ1sjDAVj+JeRanStQyfvE0Z3R0nxiIq2ddAsuysSiSF:4yeoCVj+c6KtQRq2ADSiSF
Malware Config
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
MBSetup.exedescription pid process target process PID 4620 created 3288 4620 MBSetup.exe Explorer.EXE -
Downloads MZ/PE file
-
Drops file in Drivers directory 12 IoCs
Processes:
MBAMService.exeMBSetup.exeMBAMService.exeMBAMInstallerService.exedescription ioc process File opened for modification C:\Windows\system32\DRIVERS\SET3186.tmp MBAMService.exe File created C:\Windows\system32\DRIVERS\SET3186.tmp MBAMService.exe File opened for modification C:\Windows\system32\DRIVERS\mbamswissarmy.sys MBAMService.exe File created C:\Windows\SysWOW64\drivers\mbamtestfile.dat MBSetup.exe File created C:\Windows\system32\DRIVERS\MbamElam.sys MBAMService.exe File opened for modification C:\Windows\system32\DRIVERS\MbamElam.sys MBAMService.exe File opened for modification C:\Windows\system32\DRIVERS\SET3C84.tmp MBAMService.exe File created C:\Windows\system32\DRIVERS\SET3C84.tmp MBAMService.exe File opened for modification C:\Windows\system32\DRIVERS\MbamChameleon.sys MBAMService.exe File created C:\Windows\system32\drivers\mbae64.sys MBAMInstallerService.exe File opened for modification C:\Windows\system32\DRIVERS\SET35EC.tmp MBAMService.exe File created C:\Windows\system32\DRIVERS\SET35EC.tmp MBAMService.exe -
Modifies RDP port number used by Windows 1 TTPs
-
Sets service image path in registry 2 TTPs 2 IoCs
Processes:
MBAMService.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MBAMSwissArmy\ImagePath = "\\SystemRoot\\System32\\Drivers\\mbamswissarmy.sys" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MBAMChameleon\ImagePath = "\\SystemRoot\\System32\\Drivers\\MbamChameleon.sys" MBAMService.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
MBSetup.exeMBAMService.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion MBSetup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate MBSetup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion MBAMService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate MBAMService.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
MBAMService.exeMBAMInstallerService.exedescription ioc process File opened (read-only) \??\W: MBAMService.exe File opened (read-only) \??\Y: MBAMService.exe File opened (read-only) \??\G: MBAMService.exe File opened (read-only) \??\I: MBAMService.exe File opened (read-only) \??\K: MBAMService.exe File opened (read-only) \??\M: MBAMService.exe File opened (read-only) \??\R: MBAMService.exe File opened (read-only) \??\T: MBAMService.exe File opened (read-only) \??\Z: MBAMService.exe File opened (read-only) \??\B: MBAMInstallerService.exe File opened (read-only) \??\N: MBAMInstallerService.exe File opened (read-only) \??\R: MBAMInstallerService.exe File opened (read-only) \??\W: MBAMInstallerService.exe File opened (read-only) \??\Z: MBAMInstallerService.exe File opened (read-only) \??\J: MBAMService.exe File opened (read-only) \??\N: MBAMService.exe File opened (read-only) \??\Q: MBAMService.exe File opened (read-only) \??\X: MBAMService.exe File opened (read-only) \??\A: MBAMInstallerService.exe File opened (read-only) \??\Q: MBAMInstallerService.exe File opened (read-only) \??\K: MBAMInstallerService.exe File opened (read-only) \??\P: MBAMInstallerService.exe File opened (read-only) \??\V: MBAMInstallerService.exe File opened (read-only) \??\X: MBAMInstallerService.exe File opened (read-only) \??\A: MBAMService.exe File opened (read-only) \??\H: MBAMService.exe File opened (read-only) \??\O: MBAMService.exe File opened (read-only) \??\P: MBAMService.exe File opened (read-only) \??\T: MBAMInstallerService.exe File opened (read-only) \??\U: MBAMInstallerService.exe File opened (read-only) \??\E: MBAMService.exe File opened (read-only) \??\L: MBAMService.exe File opened (read-only) \??\Y: MBAMInstallerService.exe File opened (read-only) \??\B: MBAMService.exe File opened (read-only) \??\E: MBAMInstallerService.exe File opened (read-only) \??\G: MBAMInstallerService.exe File opened (read-only) \??\J: MBAMInstallerService.exe File opened (read-only) \??\M: MBAMInstallerService.exe File opened (read-only) \??\S: MBAMInstallerService.exe File opened (read-only) \??\S: MBAMService.exe File opened (read-only) \??\H: MBAMInstallerService.exe File opened (read-only) \??\L: MBAMInstallerService.exe File opened (read-only) \??\O: MBAMInstallerService.exe File opened (read-only) \??\U: MBAMService.exe File opened (read-only) \??\V: MBAMService.exe File opened (read-only) \??\I: MBAMInstallerService.exe -
Drops file in System32 directory 2 IoCs
Processes:
MBAMService.exeMBAMService.exedescription ioc process File opened for modification C:\Windows\System32\CatRoot2\dberr.txt MBAMService.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt MBAMService.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 64 IoCs
Processes:
MBAMInstallerService.exeMBSetup.exedescription ioc process File created C:\Program Files\Malwarebytes\Anti-Malware\MBAMShim.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Base\images\leftanglearrow.png MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Dialogs\DefaultFileDialog.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Dialogs\WidgetFontDialog.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Window.2\plugins.qmltypes MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\SelfProtectionSdk.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Flat\qtquickextrasflatplugin.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Imagine\Switch.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\TableView.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Fusion\PageIndicator.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Fusion\VerticalHeaderView.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\MenuBarItem.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\LicenseControllerImpl.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Base\CircularTickmarkLabelStyle.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Base\images\rightanglearrow.png MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Dial.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Fusion\Slider.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Material\Drawer.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Material\ScrollBar.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\ToolTip.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\api-ms-win-crt-utility-l1-1-0.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Private\ContentItem.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Desktop\TreeViewStyle.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Universal\Menu.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\msvcp140_1.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Desktop\SliderStyle.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Universal\GroupBox.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Universal\RangeSlider.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Fusion\Switch.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Imagine\plugins.qmltypes MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\Qt5WebEngineWidgets.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\languages\lang_hr.qm MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Base\BasicTableViewStyle.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Base\DelayButtonStyle.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Fusion\qmldir MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Dialogs\WidgetColorDialog.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\PrivateWidgets\qmldir MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\pkgvers.dat MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\mbae-api-na.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Private\SourceProxy.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\TextArea.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Button.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Fusion\MenuBar.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Fusion\plugins.qmltypes MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Fusion\SpinBox.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Tumbler.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\TrayPlugin.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\7z.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\api-ms-win-core-synch-l1-1-0.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\Qt5WebEngineCore.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Fusion\ScrollIndicator.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Material\Label.qml MBAMInstallerService.exe File created C:\Program Files (x86)\mbamtestfile.dat MBSetup.exe File created C:\Program Files\Malwarebytes\Anti-Malware\api-ms-win-core-synch-l1-2-0.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Base\images\tab_selected.png MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Fusion\MenuBarItem.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Fusion\ToolButton.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Imagine\TabBar.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Material\Dial.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Extras\qtquickextrasplugin.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\Qt5Quick.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\api-ms-win-crt-convert-l1-1-0.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Base\GroupBoxStyle.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\resources\qtwebengine_devtools_resources.pak MBAMInstallerService.exe -
Drops file in Windows directory 2 IoCs
Processes:
MBAMService.exeMBAMService.exedescription ioc process File created C:\Windows\ELAMBKUP\MbamElam.sys MBAMService.exe File opened for modification C:\Windows\security\logs\scecomp.log MBAMService.exe -
Executes dropped EXE 6 IoCs
Processes:
MBAMInstallerService.exeMBAMService.exeMBAMService.exembamtray.exembam.exembupdatrV5.exepid process 4788 MBAMInstallerService.exe 4880 MBAMService.exe 4388 MBAMService.exe 5388 mbamtray.exe 2796 mbam.exe 1372 mbupdatrV5.exe -
Loads dropped DLL 64 IoCs
Processes:
MBAMInstallerService.exeMBAMService.exeExplorer.EXEmbamtray.exembam.exepid process 4788 MBAMInstallerService.exe 4788 MBAMInstallerService.exe 4388 MBAMService.exe 4388 MBAMService.exe 4388 MBAMService.exe 4388 MBAMService.exe 4388 MBAMService.exe 4388 MBAMService.exe 4388 MBAMService.exe 4388 MBAMService.exe 4388 MBAMService.exe 4388 MBAMService.exe 4388 MBAMService.exe 4388 MBAMService.exe 4388 MBAMService.exe 4388 MBAMService.exe 4388 MBAMService.exe 4388 MBAMService.exe 4388 MBAMService.exe 4388 MBAMService.exe 4388 MBAMService.exe 4388 MBAMService.exe 4388 MBAMService.exe 4388 MBAMService.exe 4388 MBAMService.exe 4388 MBAMService.exe 4788 MBAMInstallerService.exe 3288 Explorer.EXE 5388 mbamtray.exe 5388 mbamtray.exe 5388 mbamtray.exe 5388 mbamtray.exe 5388 mbamtray.exe 5388 mbamtray.exe 5388 mbamtray.exe 5388 mbamtray.exe 5388 mbamtray.exe 5388 mbamtray.exe 5388 mbamtray.exe 5388 mbamtray.exe 5388 mbamtray.exe 5388 mbamtray.exe 5388 mbamtray.exe 5388 mbamtray.exe 5388 mbamtray.exe 5388 mbamtray.exe 5388 mbamtray.exe 5388 mbamtray.exe 5388 mbamtray.exe 5388 mbamtray.exe 5388 mbamtray.exe 5388 mbamtray.exe 5388 mbamtray.exe 5388 mbamtray.exe 5388 mbamtray.exe 5388 mbamtray.exe 5388 mbamtray.exe 5388 mbamtray.exe 5388 mbamtray.exe 5388 mbamtray.exe 5388 mbamtray.exe 2796 mbam.exe 2796 mbam.exe 2796 mbam.exe -
Registers COM server for autorun 1 TTPs 64 IoCs
Processes:
MBAMService.exeMBAMService.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F36AD0D0-B5F0-4C69-AF08-603D177FEF0E}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F36AD0D0-B5F0-4C69-AF08-603D177FEF0E}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D5599B6B-FA0C-45B5-8309-853B003EA412}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57CE581A-0CB6-4266-9CA0-19364C90A0B3}\InprocServer32\ = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbshlext.dll" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57CE581A-0CB6-4266-9CA0-19364C90A0B3}\InprocServer32\ThreadingModel = "Apartment" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{278637DA-FDFB-45C7-8CD8-F2D8A9199AB0}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{278637DA-FDFB-45C7-8CD8-F2D8A9199AB0}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D372F21-E6DA-4B82-881A-79F6CA6B6AE1}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57CE581A-0CB6-4266-9CA0-19364C90A0B3}\InprocServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{278637DA-FDFB-45C7-8CD8-F2D8A9199AB0}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{580243BF-3CEE-4131-A599-C6FED66BEB1B}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D372F21-E6DA-4B82-881A-79F6CA6B6AE1}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36A65E46-6CC1-4CA2-B51E-F4DD8C993DDC}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DE03E614-112D-43E0-8E15-E7236CC32108}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BF474111-9116-45C6-AF53-209E64F1BB53}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BF474111-9116-45C6-AF53-209E64F1BB53}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D5599B6B-FA0C-45B5-8309-853B003EA412}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36A65E46-6CC1-4CA2-B51E-F4DD8C993DDC}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9DAB0CA5-AE19-41AE-955C-41DD44C52697}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F1C46F8-E697-4175-B240-CDE682A4BA2D}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E1AC7139-D1FF-4DE9-84A4-92E2B47F5D2A}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F415899A-1576-4C8B-BC9F-4854781F8A20}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{580243BF-3CEE-4131-A599-C6FED66BEB1B}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{251AD013-20AD-4C3F-8FE2-F66A429B4819}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{251AD013-20AD-4C3F-8FE2-F66A429B4819}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{03141A2A-5C3A-458E-ABEC-0812AD7FF497}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F415899A-1576-4C8B-BC9F-4854781F8A20}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{130CD414-6BFD-4F6C-9362-A2264B222E76}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{17BE78EE-B40A-4B9E-835F-38EC62F9D479}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D5599B6B-FA0C-45B5-8309-853B003EA412}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{251AD013-20AD-4C3F-8FE2-F66A429B4819}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D372F21-E6DA-4B82-881A-79F6CA6B6AE1}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E1AC7139-D1FF-4DE9-84A4-92E2B47F5D2A}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E1AC7139-D1FF-4DE9-84A4-92E2B47F5D2A}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{130CD414-6BFD-4F6C-9362-A2264B222E76}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9DAB0CA5-AE19-41AE-955C-41DD44C52697}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{376BE474-56D4-4177-BB4E-5610156F36C8}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F415899A-1576-4C8B-BC9F-4854781F8A20}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F1C46F8-E697-4175-B240-CDE682A4BA2D}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{17BE78EE-B40A-4B9E-835F-38EC62F9D479}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{03141A2A-5C3A-458E-ABEC-0812AD7FF497}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{03141A2A-5C3A-458E-ABEC-0812AD7FF497}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36A65E46-6CC1-4CA2-B51E-F4DD8C993DDC}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F6D29500-933C-447C-9D88-9D814AF73808}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE8A9269-9E6E-4683-BCD3-41E9B16696DC}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DE03E614-112D-43E0-8E15-E7236CC32108}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{17BE78EE-B40A-4B9E-835F-38EC62F9D479}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{11D1E5E8-14E1-4B5B-AE1A-2678CB91E8E5}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{11D1E5E8-14E1-4B5B-AE1A-2678CB91E8E5}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{580243BF-3CEE-4131-A599-C6FED66BEB1B}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F1C46F8-E697-4175-B240-CDE682A4BA2D}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{130CD414-6BFD-4F6C-9362-A2264B222E76}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE8A9269-9E6E-4683-BCD3-41E9B16696DC}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE8A9269-9E6E-4683-BCD3-41E9B16696DC}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{376BE474-56D4-4177-BB4E-5610156F36C8}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F6D29500-933C-447C-9D88-9D814AF73808}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DE03E614-112D-43E0-8E15-E7236CC32108}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F36AD0D0-B5F0-4C69-AF08-603D177FEF0E}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{11D1E5E8-14E1-4B5B-AE1A-2678CB91E8E5}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F6D29500-933C-447C-9D88-9D814AF73808}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9DAB0CA5-AE19-41AE-955C-41DD44C52697}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BF474111-9116-45C6-AF53-209E64F1BB53}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{376BE474-56D4-4177-BB4E-5610156F36C8}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{F36AD0D0-B5F0-4C69-AF08-603D177FEF0E}\LOCALSERVER32 MBAMService.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 10 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
firefox.exefirefox.exeMBAMService.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MBAMService.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MBAMService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 5304 timeout.exe -
Processes:
MBAMService.exeMBAMInstallerService.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\mbam.exe = "11000" MBAMService.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\mbamtray.exe = "11000" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION MBAMInstallerService.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\mbam.exe = "11000" MBAMInstallerService.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\mbamtray.exe = "11000" MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION MBAMService.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
MBAMInstallerService.exeMBAMService.exeLogonUI.exembupdatrV5.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs MBAMService.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Malwarebytes MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0\Common MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\Software MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\16.0\Common MBAMInstallerService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates MBAMService.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs MBAMInstallerService.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:\ MBAMInstallerService.exe Set value (str) \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:\ MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\16.0\Common\Security MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs MBAMService.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\16.0 MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA MBAMService.exe Set value (str) \REGISTRY\USER\S-1-5-19\Software\Malwarebytes\FirstRun = "false" MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\16.0\Common\Security MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT mbupdatrV5.exe Key created \REGISTRY\USER\S-1-5-19\Software MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\15.0\Common MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office MBAMInstallerService.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:\ MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs MBAMService.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\15.0 MBAMInstallerService.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:\ MBAMInstallerService.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Malwarebytes\FirstRun = "false" MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: MBAMInstallerService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA MBAMInstallerService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MBAMService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "1" LogonUI.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft MBAMInstallerService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" MBAMService.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Malwarebytes\FirstRun = "false" MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\15.0\Common\Security MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols MBAMInstallerService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (str) \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:\ MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs mbupdatrV5.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: MBAMInstallerService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe -
Modifies registry class 64 IoCs
Processes:
MBAMService.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8D488C7C-023D-4561-B377-DD9FB7124326}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3DCF0F42-EF8F-4450-BA68-42B61F594B2F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A993F934-6341-4D52-AB17-F93184A624E4}\ProxyStubClsid32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C7BCC13C-47B9-4DC0-8FC6-B2A489EF60EF}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3F967173-2B83-4B7F-A633-074B06FD0C64} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6EC225D5-FD37-4F9B-B80F-09FAE36103AE}\TypeLib\ = "{49F6AC60-2104-42C6-8F71-B3916D5AA732}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{55E4B8FB-921C-4751-8B2D-AE33BD7D0B74}\TypeLib\ = "{49F6AC60-2104-42C6-8F71-B3916D5AA732}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{83D0C30B-ECF4-40C5-80EC-21BB47F898A9}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{ADCD8BEB-8924-4876-AE14-2438FF14FA17}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{571FB9A8-E53B-4740-B125-082207566E5F}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B32065E5-189E-4C5F-AA59-32A158BAF5B7}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8CB653AC-F9CF-4277-BFB1-C0ED1C650F56} MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1097B101-1FF8-4DD8-A6C1-6C39FB2EA5D6}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E149FEF9-F1DC-4894-8A8E-AA53F6807EFD}\TypeLib\Version = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A5091804-600E-4226-BF28-80ABFDF4AFAB}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DE6A4256-97CD-4DBB-9D4A-3054B0BB0F8B}\TypeLib\ = "{F5BCAC7E-75E7-4971-B3F3-B197A510F495}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F12E228B-821D-4093-B2E0-7F3E169A925A} MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{63A6AB57-4679-4529-B78D-143547B22799} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{503084FD-0743-46C7-833F-D0057E8AC505}\TypeLib\ = "{A82129F1-32E1-4D79-A39F-EBFEE53A70BF}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{62A3C5F3-503F-4205-A044-5EA683BEDABE}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D51C573D-B305-4980-8DFF-076C1878CCFB}\ = "IScanParametersV10" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A5091804-600E-4226-BF28-80ABFDF4AFAB}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{964AD404-A1EF-4EDA-B8FA-1D8003B29B10}\TypeLib\ = "{0E2822AB-0447-4F28-AF4C-FFDB1E8595AE}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{ECDAC35E-72BB-4856-97E1-226BA47C62C5}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E96FEF0-48F7-4ECB-B010-501044575477}\TypeLib\ = "{FFB94DF8-FC15-411C-B443-E937085E2AC1}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{571FB9A8-E53B-4740-B125-082207566E5F}\ = "IScanControllerV15" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A7FB145-B72D-466E-A3AC-21599BBE9E8C}\ = "ILicenseControllerV5" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E2870643-0645-41F9-BCCB-F5969386162C}\TypeLib\Version = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MB.PoliciesController\CurVer MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DE03E614-112D-43E0-8E15-E7236CC32108}\TypeLib\ = "{226C1698-A075-4315-BB5D-9C164A96ACE7}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FA6C70E7-6A6D-4F4A-99BF-C8B375CB7E0C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1691A7E8-B8D1-46D5-BB29-3A4DB2D809C6}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FFB94DF8-FC15-411C-B443-E937085E2AC1}\1.0\ = "RTPControllerCOMLib" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{97EB7268-0D7B-43F6-9C11-337287F960DF}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4A0A45F1-CFB6-49A7-BBC4-8776F94857A8}\ = "IScanParametersV7" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3F967173-2B83-4B7F-A633-074B06FD0C64}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6ED2B0A1-984E-4A35-9B04-E0EBAFB2842A} MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{738848E2-18E4-40F8-9C08-60BC0505E9E9} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8E1F91DE-30AF-469B-9A09-FCF176207F0F}\TypeLib\ = "{FFB94DF8-FC15-411C-B443-E937085E2AC1}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6B2CCE9B-6446-450F-9C9D-542CD9FA6677}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4412646D-16F5-4F3C-8348-0744CDEBCCBF}\TypeLib\ = "{59DBD1B8-A7BD-4322-998F-41B0D2516FA0}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MB.RTPController\ = "RTPController Class" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{97DA9E74-558F-4085-AE41-6A82ED12D02C}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9CFA1689-38D3-4AE9-B1E8-B039EB7AD988}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C0CEAFA7-4F65-418C-8A61-92B2048115EE} MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B44D50B8-E459-4078-9249-3763459B2676} MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A993F934-6341-4D52-AB17-F93184A624E4}\ProxyStubClsid32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BF474111-9116-45C6-AF53-209E64F1BB53}\Programmable MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{960F2BB5-E954-45C5-97DF-A770D9D8C24B}\TypeLib\ = "{5709DEEB-F05E-4D5C-8DC4-3B0D924EE08F}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MB.CleanController.1\CLSID\ = "{11D1E5E8-14E1-4B5B-AE1A-2678CB91E8E5}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D8258E71-3A7A-4D9D-85BB-C7999F95B7E4}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2FB37514-21FA-4B2C-94DA-1562126E9F5F} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4BDE5F8-F8D4-4E50-937F-85E8382A9FEE}\TypeLib\ = "{74630AE8-C170-4A8F-A90A-F42D63EFE1E8}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MB.UpdateController.1\CLSID MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B1BDE8B0-F598-4334-9991-ECC7442EEAA6}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{23416CFE-018D-418E-8CE9-5729D070CCED}\TypeLib\ = "{226C1698-A075-4315-BB5D-9C164A96ACE7}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{71AC94F2-D545-438F-9156-C231B7D94A56} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2DFD7E94-47E6-483A-B4FD-DC586A52CE5D}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2DEBAD4E-3BAF-44F0-9150-BCCCC3801CF9}\TypeLib\ = "{49F6AC60-2104-42C6-8F71-B3916D5AA732}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0DB6AD16-564C-451A-A173-0F31A62B7A4D} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BD9CB7A5-5C46-4799-A3A4-20FB128E58F1}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{118F4330-CAF5-4A54-ABB0-DC936669ED2F}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{56898B37-6187-4F81-B9C6-8DA97D31F396}\ = "IScanControllerV16" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3DCF0F42-EF8F-4450-BA68-42B61F594B2F} MBAMService.exe -
Processes:
MBAMInstallerService.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\5A8CEF45D7A69859767A8C8B4496B578CF474B1A MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F6108407D6F8BB67980CC2E244C2EBAE1CEF63BE\Blob = 030000000100000014000000f6108407d6f8bb67980cc2e244c2ebae1cef63be2000000001000000f6010000308201f230820178a0030201020213066c9fd7c1bb104c2943e5717b7b2cc81ac10e300a06082a8648ce3d0403033039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412034301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f7420434120343076301006072a8648ce3d020106052b8104002203620004d2ab8a374fa3530dfec18a7b4ba87b464b63b062f62d1bdb087121d200e863bd9a27fbf0396e5dea3da5c981aaa35b2098455d16dbfde8106de39ce0e3bd5f8462f3706433a0cb242f70ba88a12aa075f881ae6206c481db396e29b01efa2e5ca3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414d3ecc73a656ecce1da769a56fb9cf3866d57e581300a06082a8648ce3d040303036800306502303a8b21f1bd7e11add0ef58962fd6eb9d7e908d2bcf6655c32ce328a9700a470ef0375912ff2d9994284e2a4f354d335a023100ea75004e3bc43a941291c958469d211372a7889c8ae44c4adb96d4ac8b6b6b49125333add7e4be24fcb50a76d4a5bc10 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\1C58A3A8518E8759BF075B76B750D4F2DF264FCD MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\2AD974A775F73CBDBBD8F5AC3A49255FA8FB1F8C MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\2AD974A775F73CBDBBD8F5AC3A49255FA8FB1F8C\Blob = 0300000001000000140000002ad974a775f73cbdbbd8f5ac3a49255fa8fb1f8c2000000001000000620400003082045e30820346a0030201020213077312380b9d6688a33b1ed9bf9ccda68e0e0f300d06092a864886f70d01010b05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412031301e170d3232303832333232323132385a170d3330303832333232323132385a303c310b3009060355040613025553310f300d060355040a1306416d617a6f6e311c301a06035504031313416d617a6f6e205253412032303438204d303130820122300d06092a864886f70d01010105000382010f003082010a0282010100eb712ca9cb1f8828923230af8a570f78b73725955587ac675c97d322c8daa214676b7cf067dae2032ab356125dc6b547f96708a7937a9592180fb4f9f910369a7f2f80b64fba134ec75d531ee0dd96330720d396bc12e4745042a1051373b54f9b4424fe2d7fedbc2285ec362133977506ce271882dce3d9c582078d5e26012626671fd93f13cf32ba6bad7864fcaaff0e023c07df9c0578728cfdea75b7032884dae86e078cd05085ef8154b2716eec6d62ef8f94c35ee9c4a4d091c02e249198caeeba258ed4f671b6fb5b6b38064837478d86dcf2ea06fb76377d9eff424e4d588293cfe271c278b17aab4b5b94378881e4d9af24aef872c565fb4bb451e70203010001a382015a3082015630120603551d130101ff040830060101ff020100300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030106082b06010505070302301d0603551d0e0416041481b80e638a891218e5fa3b3b50959fe6e5901385301f0603551d230418301680148418cc8534ecbc0c94942e08599cc7b2104e0a08307b06082b06010505070101046f306d302f06082b060105050730018623687474703a2f2f6f6373702e726f6f746361312e616d617a6f6e74727573742e636f6d303a06082b06010505073002862e687474703a2f2f6372742e726f6f746361312e616d617a6f6e74727573742e636f6d2f726f6f746361312e636572303f0603551d1f043830363034a032a030862e687474703a2f2f63726c2e726f6f746361312e616d617a6f6e74727573742e636f6d2f726f6f746361312e63726c30130603551d20040c300a3008060667810c010201300d06092a864886f70d01010b05000382010100ad00de0205232e063262b46bb19416e41140de2bfa59c135efe0aa8f2b41b9d1f38739001df23db5a7470c0606c691f3075702d4edbd17c1909abf4875a2074f30dd4a6a42b50d3d15c00ffe845bc63c99cc5752b1d86e12d59692934b94e507e88982086a7a34d49e64e13d876a92909a63a14bf88fb6ea34d305be20c2de06e28c9f738b9f4d3985cace19369d85c99ec9f8503fb67e88a1efca84068b50b40a5ca61c44f1fdc8614060f26125aa07f4c7c27375e40c0b428d04e55f4448995b7b898196a7889d4b0d62e804c4d7feb4e8b26dcaecc01cbc385b1ddf85ce5b7ae3494b6cb9a7ddf405b249ade1c5146bc2ccebcd7fd65869bac3207e7fb0b8 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa22000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8DA7F965EC5EFC37910F1C6E59FDC1CC6A6EDE16 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8DA7F965EC5EFC37910F1C6E59FDC1CC6A6EDE16\Blob = 0300000001000000140000008da7f965ec5efc37910f1c6e59fdc1cc6a6ede162000000001000000450300003082034130820229a0030201020213066c9fcf99bf8c0a39e2f0788a43e696365bca300d06092a864886f70d01010b05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412031301e170d3135303532363030303030305a170d3338303131373030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f74204341203130820122300d06092a864886f70d01010105000382010f003082010a0282010100b2788071ca78d5e371af478050747d6ed8d78876f49968f7582160f97484012fac022d86d3a0437a4eb2a4d036ba01be8ddb48c80717364cf4ee8823c73eeb37f5b519f84968b0ded7b976381d619ea4fe8236a5e54a56e445e1f9fdb416fa74da9c9b35392ffab02050066c7ad080b2a6f9afec47198f503807dca2873958f8bad5a9f948673096ee94785e6f89a351c0308666a14566ba54eba3c391f948dcffd1e8302d7d2d747035d78824f79ec4596ebb738717f2324628b843fab71daacab4f29f240e2d4bf7715c5e69ffea9502cb388aae50386fdbfb2d621bc5c71e54e177e067c80f9c8723d63f40207f2080c4804c3e3b24268e04ae6c9ac8aa0d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604148418cc8534ecbc0c94942e08599cc7b2104e0a08300d06092a864886f70d01010b0500038201010098f2375a4190a11ac57651282036230eaee628bbaaf894ae48a4307f1bfc248d4bb4c8a197f6b6f17a70c85393cc0828e39825cf23a4f9de21d37c8509ad4e9a753ac20b6a897876444718656c8d418e3b7f9acbf4b5a750d7052c37e8034bade961a0026ef5f2f0c5b2ed5bb7dcfa945c779e13a57f52ad95f2f8933bde8b5c5bca5a525b60af14f74befa3fb9f40956d3154fc42d3c7461f23add90f48709ad9757871d1724334756e5759c2025c266029cf2319168e8843a5d4e4cb08fb231143e843297262a1a95d5e08d490aeb8d8ce14c2d055f286f6c49343776661c0b9e841d7977860036e4a72aea5d17dba109e866c1b8ab95933f8ebc490bef1b9 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0D44DD8C3C8C1A1A58756481E90F2E2AFFB3D26E MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\1C58A3A8518E8759BF075B76B750D4F2DF264FCD\Blob = 0300000001000000140000001c58a3a8518e8759bf075b76b750d4f2df264fcd2000000001000000c2040000308204be308203a6a003020102021006d8d904d5584346f68a2fa754227ec4300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3231303431343030303030305a170d3331303431333233353935395a304f310b300906035504061302555331153013060355040a130c446967694365727420496e633129302706035504031320446967694365727420544c53205253412053484132353620323032302043413130820122300d06092a864886f70d01010105000382010f003082010a0282010100c14bb3654770bcdd4f58dbec9cedc366e51f311354ad4a66461f2c0aec6407e52edcdcb90a20eddfe3c4d09e9aa97a1d8288e51156db1e9f58c251e72c340d2ed292e156cbf1795fb3bb87ca25037b9a52416610604f571349f0e8376783dfe7d34b674c2251a6df0e9910ed57517426e27dc7ca622e131b7f238825536fc13458008b84fff8bea75849227b96ada2889b15bca07cdfe951a8d5b0ed37e236b4824b62b5499aecc767d6e33ef5e3d6125e44f1bf71427d58840380b18101faf9ca32bbb48e278727c52b74d4a8d697dec364f9cace53a256bc78178e490329aefb494fa415b9cef25c19576d6b79a72ba2272013b5d03d40d321300793ea99f50203010001a38201823082017e30120603551d130101ff040830060101ff020100301d0603551d0e04160414b76ba2eaa8aa848c79eab4da0f98b2c59576b9f4301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030106082b06010505070302307606082b06010505070101046a3068302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304006082b060105050730028634687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274476c6f62616c526f6f7443412e63727430420603551d1f043b30393037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274476c6f62616c526f6f7443412e63726c303d0603551d2004363034300b06096086480186fd6c02013007060567810c01013008060667810c0102013008060667810c0102023008060667810c010203300d06092a864886f70d01010b050003820101008032ce5e0bdd6e5a0d0aafe1d684cbc08efa8570edda5db30cf72b7540fe850afaf33178b7704b1a8958ba80bdf36b1de97ecf0bba589c59d490d3fd6cfdd0986db771825bcf6d0b5a09d07bdec443d82aa4de9e41265fbb8f99cbddaee1a86f9f87fe74b71f1b20abb14fc6f5675d5d9b3ce9ff69f7616cd6d9f3fd36c6ab038876d24b2e7586e3fcd8557d26c21177df3e02b67cf3ab7b7a86366fb8f7d89371cf86df7330fa7babed2a59c842843b11171a52f3c90e147da25b7267ba71ed574766c5b8024a65345e8bd02a3c209c51994ce7529ef76b112b0d927e1de88aeb36164387ea2a63bf753febdec403bb0a3cf730efebaf4cfc8b3610733ef3a4 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\5A8CEF45D7A69859767A8C8B4496B578CF474B1A\Blob = 0300000001000000140000005a8cef45d7a69859767a8c8b4496b578cf474b1a2000000001000000450500003082054130820329a0030201020213066c9fd29635869f0a0fe58678f85b26bb8a37300d06092a864886f70d01010c05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412032301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f74204341203230820222300d06092a864886f70d01010105000382020f003082020a0282020100ad969f2d9c4a4c4a81795199ec8acb6b605113bc4d6d06fcb0088ddd19106ac7260c35d8c06f2084e994b19b8503c35bdb4ae8c8f89076d95b4fe34ce806364dcc9aac3d0c902b92d4061960ac374479858182ad5a37e00dcc9da64c5276ea439db704d150f655e0d5d2a64985e937e9ca7eae5c954d489a3fae205a6d8895d934b8521a4390b0bf6c05b9b678b7ead0e43a3c125362ff4af27bbe3505a91234e3f36474622c3d00495a28fe3244bb87dd652702713bda4af71fdacdf72155904f0fecae82e19f6bd945d3bbf05f87ed3c2c3986da3fdeec7255eb79a3addbdd7cb0ba1ccefcde4f3576cf0ff8781f6a36514627615be99ecff0a2557d7c258a6f2fb4c5cf842e2bfd0d51106cfb5f1bbc1b7ec5ae3b98013192ff0b57f49ab2b957e9abef0d76d1f0eef4ce86a7e06ee9b469a1df69f633c6692e97139ea587b057108137c953b3bb7ff692d19cd018f4926eda834fa663994ca5fb5eef21647a205f6c648515cb37e9620c0b2a16dc012e32da3e4bf59e3af6174094ef9e910886fabe63a85a33eccb744395f96c695236c7296ffc55035c1ffb9fbd47ebe74947950b4e89220949e0f5611ef1bf2e8a726e8059ff573af97532a34e5feced2862d94d73f2cc811760edcdebdcdba7cac57e02bdf2540854fdb42d092c17544a98d154e1516708d2ed6e7e6f3fd22d81592966cb903995111e7427feddebaf0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414b00cf04c30f405580248fd33e552af4b84e36652300d06092a864886f70d01010c05000382020100aaa8808f0e78a3e0a2d4cde6f5987a3bea0003b0970e93bc5aa8f62c8c7287a9b1fc7f73fd637178a58759cf30e10d10b2135a6d82f56ae6809fa0050b68e4476bc76adfb6fd773272e518fa09f4a0932c5dd28c75857665900c0379b7312363ad788309866884cafff9cf269a9279e7cd4bc5e761a717cbf3a91293936ba7e82f5392c46058b0cc0251185b858d625963b6adb4de9afb26f70027c05d55377499c9507fe3592e44e32c25eeec4c3277b49f1ae94b5d20c5dafd1c8716c643e8d4bb269a45705ea90b3753e2467b27fde046f289b7cc42b6cb28266ed9a5c93ac8411360f7508c15aeb26d1a151a5778e6922ad96590823f6c02afae123a27963604d71da28063a99bf1e5bab47c14b04ec9b11f745f38f651ea9bfa2ca211d4a92d271a45b1afb24e710dc05846d66906cb53cbb3fe6b41cd417e7d4c0f7c72797a59cd5e4a0eac9ba99873797cb4f4ccb9b8070cb2745cb8c76f88a190a7f4aaf9bf673af41a15621eb79fbe3db129af67a112f25810195303301bb81a89f69cbd97038ea309f31d8b21f1b4dfe41cd19f650206ea5cd613b384efa2a55c8c7729a768c06bae40d2a8b4eacdf08d4b389c199a1b2854b88990efca75813e1ef26424c718af4eff479e07f63565a4d30a56fff517646cefa822254993b6df0017da587e5deec51bb0d1d15f2110c7f9f3ba020a2707c5f1d6c7d3e0fb09606c MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E\Blob = 030000000100000014000000b51c067cee2b0c3df855ab2d92f4fe39d4e70f0e2000000001000000e1030000308203dd308202c5a003020102020100300d06092a864886f70d01010b050030818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a30818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bdedc103fcf68ffc02b16f5b9f48d99d79e2a2b703615618c347b6d7ca3d352e8943f7a1699bde8a1afd13209cb44977322956fdb9ec8cdd22fa72dc276197eef65a84ec6e19b9892cdc845bd574fb6b5fc589a51052894655f4b8751ce67fe454ae4bf85572570219f8177159eb1e280774c59d48be6cb4f4a4b0f364377992c0ec465e7fe16d534c62afcd1f0b63bb3a9dfbfc7900986174cf26824063f3b2726a190d99cad40e75cc37fb8b89c159f1627f5fb35f6530f8a7b74d765a1e765e34c0e89656998ab3f07fa4cdbddc32317c91cfe05f11f86baa495cd19994d1a2e3635b0976b55662e14b741d96d426d4080459d0980e0ee6defcc3ec1f90f10203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147c0c321fa7d9307fc47d68a362a8a1ceab075b27300d06092a864886f70d01010b050003820101001159fa254f036f94993b9a1f828539d47605945ee128936d625d09c2a0a8d4b07538f1346a9de49f8a862651e62cd1c62d6e95204a9201ecb88a677b31e2672e8c9503262e439d4a31f60eb50cbbb7e2377f22ba00a30e7b52fb6bbb3bc4d379514ecd90f4670719c83c467a0d017dc558e76de68530179a24c410e004f7e0f27fd4aa0aff421d37ed94e5645912207738d3323e3881759673fa688fb1cbce1fc5ecfa9c7ecf7eb1f1072db6fcbfcaa4bfd097054abcea18280290bd5478092171d3d17d1dd916b0a9613dd00a0022fcc77bcb0964450b3b4081f77d7c32f598ca588e7d2aee90597364f936745e25a1f566052e7f3915a92afb508b8e8569f4 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0D44DD8C3C8C1A1A58756481E90F2E2AFFB3D26E\Blob = 0300000001000000140000000d44dd8c3c8c1a1a58756481e90f2e2affb3d26e2000000001000000ba010000308201b63082015ba0030201020213066c9fd5749736663f3b0b9ad9e89e7603f24a300a06082a8648ce3d0403023039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412033301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f7420434120333059301306072a8648ce3d020106082a8648ce3d030107034200042997a7c6417fc00d9be8011b56c6f252a5ba2db212e8d22ed7fac9c5d8aa6d1f73813b3b986b397c33a5c54e868e8017686245577d44581db337e56708eb66dea3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414abb6dbd7069e37ac3086079170c79cc419b178c0300a06082a8648ce3d0403020349003046022100e08592a317b78df92b06a593ac1a98686172fae1a1d0fb1c7860a64399c5b8c40221009c02eff1949cb396f9ebc62af8b62cfe3a901416d78c6324481cdf307dd5683b MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F6108407D6F8BB67980CC2E244C2EBAE1CEF63BE MBAMInstallerService.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
mbamtray.exembam.exepid process 5388 mbamtray.exe 2796 mbam.exe -
Suspicious behavior: EnumeratesProcesses 42 IoCs
Processes:
MBSetup.exeMBAMInstallerService.exeMBAMService.exembamtray.exembam.exepid process 4620 MBSetup.exe 4620 MBSetup.exe 4788 MBAMInstallerService.exe 4788 MBAMInstallerService.exe 4788 MBAMInstallerService.exe 4788 MBAMInstallerService.exe 4788 MBAMInstallerService.exe 4788 MBAMInstallerService.exe 4788 MBAMInstallerService.exe 4788 MBAMInstallerService.exe 4788 MBAMInstallerService.exe 4788 MBAMInstallerService.exe 4388 MBAMService.exe 4388 MBAMService.exe 4388 MBAMService.exe 4388 MBAMService.exe 4388 MBAMService.exe 4388 MBAMService.exe 4388 MBAMService.exe 4388 MBAMService.exe 5388 mbamtray.exe 5388 mbamtray.exe 5388 mbamtray.exe 5388 mbamtray.exe 4388 MBAMService.exe 4388 MBAMService.exe 2796 mbam.exe 2796 mbam.exe 2796 mbam.exe 2796 mbam.exe 4388 MBAMService.exe 4388 MBAMService.exe 4388 MBAMService.exe 4388 MBAMService.exe 4388 MBAMService.exe 4388 MBAMService.exe 4388 MBAMService.exe 4388 MBAMService.exe 4388 MBAMService.exe 4388 MBAMService.exe 2796 mbam.exe 2796 mbam.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
mbam.exepid process 2796 mbam.exe -
Suspicious behavior: LoadsDriver 4 IoCs
Processes:
pid process 644 644 644 644 -
Suspicious use of AdjustPrivilegeToken 26 IoCs
Processes:
MBAMService.exeMBAMService.exeMBAMInstallerService.exefirefox.exeAUDIODG.EXEmbupdatrV5.exembam.exedescription pid process Token: 33 4880 MBAMService.exe Token: SeIncBasePriorityPrivilege 4880 MBAMService.exe Token: 33 4388 MBAMService.exe Token: SeIncBasePriorityPrivilege 4388 MBAMService.exe Token: SeBackupPrivilege 4388 MBAMService.exe Token: SeRestorePrivilege 4388 MBAMService.exe Token: SeTakeOwnershipPrivilege 4388 MBAMService.exe Token: SeTcbPrivilege 4388 MBAMService.exe Token: SeTcbPrivilege 4388 MBAMService.exe Token: SeBackupPrivilege 4388 MBAMService.exe Token: SeRestorePrivilege 4388 MBAMService.exe Token: SeTakeOwnershipPrivilege 4388 MBAMService.exe Token: SeSecurityPrivilege 4388 MBAMService.exe Token: SeSecurityPrivilege 4388 MBAMService.exe Token: SeSecurityPrivilege 4388 MBAMService.exe Token: SeSecurityPrivilege 4388 MBAMService.exe Token: SeTcbPrivilege 4388 MBAMService.exe Token: SeSecurityPrivilege 4788 MBAMInstallerService.exe Token: SeTcbPrivilege 4388 MBAMService.exe Token: SeDebugPrivilege 5196 firefox.exe Token: SeDebugPrivilege 5196 firefox.exe Token: 33 5092 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 5092 AUDIODG.EXE Token: SeBackupPrivilege 1372 mbupdatrV5.exe Token: SeRestorePrivilege 1372 mbupdatrV5.exe Token: SeShutdownPrivilege 2796 mbam.exe -
Suspicious use of FindShellTrayWindow 18 IoCs
Processes:
MBSetup.exembamtray.exefirefox.exepid process 4620 MBSetup.exe 5388 mbamtray.exe 5196 firefox.exe 5196 firefox.exe 5196 firefox.exe 5196 firefox.exe 5388 mbamtray.exe 5388 mbamtray.exe 5388 mbamtray.exe 5388 mbamtray.exe 5388 mbamtray.exe 5388 mbamtray.exe 5388 mbamtray.exe 5388 mbamtray.exe 5388 mbamtray.exe 5388 mbamtray.exe 5388 mbamtray.exe 5388 mbamtray.exe -
Suspicious use of SendNotifyMessage 15 IoCs
Processes:
firefox.exembamtray.exepid process 5196 firefox.exe 5196 firefox.exe 5196 firefox.exe 5388 mbamtray.exe 5388 mbamtray.exe 5388 mbamtray.exe 5388 mbamtray.exe 5388 mbamtray.exe 5388 mbamtray.exe 5388 mbamtray.exe 5388 mbamtray.exe 5388 mbamtray.exe 5388 mbamtray.exe 5388 mbamtray.exe 5388 mbamtray.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
MBSetup.exefirefox.exeLogonUI.exepid process 4620 MBSetup.exe 5196 firefox.exe 4796 LogonUI.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
MBAMInstallerService.exeMBSetup.exeMBAMService.execmd.exefirefox.exefirefox.exedescription pid process target process PID 4788 wrote to memory of 4880 4788 MBAMInstallerService.exe MBAMService.exe PID 4788 wrote to memory of 4880 4788 MBAMInstallerService.exe MBAMService.exe PID 4620 wrote to memory of 5396 4620 MBSetup.exe cmd.exe PID 4620 wrote to memory of 5396 4620 MBSetup.exe cmd.exe PID 4620 wrote to memory of 5396 4620 MBSetup.exe cmd.exe PID 4388 wrote to memory of 5388 4388 MBAMService.exe mbamtray.exe PID 4388 wrote to memory of 5388 4388 MBAMService.exe mbamtray.exe PID 5396 wrote to memory of 5304 5396 cmd.exe timeout.exe PID 5396 wrote to memory of 5304 5396 cmd.exe timeout.exe PID 5396 wrote to memory of 5304 5396 cmd.exe timeout.exe PID 5396 wrote to memory of 5212 5396 cmd.exe firefox.exe PID 5396 wrote to memory of 5212 5396 cmd.exe firefox.exe PID 5212 wrote to memory of 5196 5212 firefox.exe firefox.exe PID 5212 wrote to memory of 5196 5212 firefox.exe firefox.exe PID 5212 wrote to memory of 5196 5212 firefox.exe firefox.exe PID 5212 wrote to memory of 5196 5212 firefox.exe firefox.exe PID 5212 wrote to memory of 5196 5212 firefox.exe firefox.exe PID 5212 wrote to memory of 5196 5212 firefox.exe firefox.exe PID 5212 wrote to memory of 5196 5212 firefox.exe firefox.exe PID 5212 wrote to memory of 5196 5212 firefox.exe firefox.exe PID 5212 wrote to memory of 5196 5212 firefox.exe firefox.exe PID 5212 wrote to memory of 5196 5212 firefox.exe firefox.exe PID 5212 wrote to memory of 5196 5212 firefox.exe firefox.exe PID 5196 wrote to memory of 232 5196 firefox.exe firefox.exe PID 5196 wrote to memory of 232 5196 firefox.exe firefox.exe PID 5196 wrote to memory of 5852 5196 firefox.exe firefox.exe PID 5196 wrote to memory of 5852 5196 firefox.exe firefox.exe PID 5196 wrote to memory of 5852 5196 firefox.exe firefox.exe PID 5196 wrote to memory of 5852 5196 firefox.exe firefox.exe PID 5196 wrote to memory of 5852 5196 firefox.exe firefox.exe PID 5196 wrote to memory of 5852 5196 firefox.exe firefox.exe PID 5196 wrote to memory of 5852 5196 firefox.exe firefox.exe PID 5196 wrote to memory of 5852 5196 firefox.exe firefox.exe PID 5196 wrote to memory of 5852 5196 firefox.exe firefox.exe PID 5196 wrote to memory of 5852 5196 firefox.exe firefox.exe PID 5196 wrote to memory of 5852 5196 firefox.exe firefox.exe PID 5196 wrote to memory of 5852 5196 firefox.exe firefox.exe PID 5196 wrote to memory of 5852 5196 firefox.exe firefox.exe PID 5196 wrote to memory of 5852 5196 firefox.exe firefox.exe PID 5196 wrote to memory of 5852 5196 firefox.exe firefox.exe PID 5196 wrote to memory of 5852 5196 firefox.exe firefox.exe PID 5196 wrote to memory of 5852 5196 firefox.exe firefox.exe PID 5196 wrote to memory of 5852 5196 firefox.exe firefox.exe PID 5196 wrote to memory of 5852 5196 firefox.exe firefox.exe PID 5196 wrote to memory of 5852 5196 firefox.exe firefox.exe PID 5196 wrote to memory of 5852 5196 firefox.exe firefox.exe PID 5196 wrote to memory of 5852 5196 firefox.exe firefox.exe PID 5196 wrote to memory of 5852 5196 firefox.exe firefox.exe PID 5196 wrote to memory of 5852 5196 firefox.exe firefox.exe PID 5196 wrote to memory of 5852 5196 firefox.exe firefox.exe PID 5196 wrote to memory of 5852 5196 firefox.exe firefox.exe PID 5196 wrote to memory of 5852 5196 firefox.exe firefox.exe PID 5196 wrote to memory of 5852 5196 firefox.exe firefox.exe PID 5196 wrote to memory of 5852 5196 firefox.exe firefox.exe PID 5196 wrote to memory of 5852 5196 firefox.exe firefox.exe PID 5196 wrote to memory of 5852 5196 firefox.exe firefox.exe PID 5196 wrote to memory of 5852 5196 firefox.exe firefox.exe PID 5196 wrote to memory of 5852 5196 firefox.exe firefox.exe PID 5196 wrote to memory of 5852 5196 firefox.exe firefox.exe PID 5196 wrote to memory of 5852 5196 firefox.exe firefox.exe PID 5196 wrote to memory of 5852 5196 firefox.exe firefox.exe PID 5196 wrote to memory of 5852 5196 firefox.exe firefox.exe PID 5196 wrote to memory of 5852 5196 firefox.exe firefox.exe PID 5196 wrote to memory of 5852 5196 firefox.exe firefox.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Loads dropped DLL
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\MBSetup.exe"C:\Users\Admin\AppData\Local\Temp\MBSetup.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Checks BIOS information in registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /t 1 & "C:\Program Files\Mozilla Firefox\firefox.exe" -install -extension "C:\Users\Admin\AppData\Local\Temp\{242af0bb-db11-4734-b7a0-61cb8a9b20fb}.xpi"3⤵
- Suspicious use of WriteProcessMemory
PID:5396 -
C:\Windows\SysWOW64\timeout.exetimeout /t 14⤵
- Delays execution with timeout.exe
PID:5304 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -install -extension "C:\Users\Admin\AppData\Local\Temp\{242af0bb-db11-4734-b7a0-61cb8a9b20fb}.xpi"4⤵
- Suspicious use of WriteProcessMemory
PID:5212 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -install -extension C:\Users\Admin\AppData\Local\Temp\{242af0bb-db11-4734-b7a0-61cb8a9b20fb}.xpi5⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5196 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5196.0.678531687\818687138" -parentBuildID 20221007134813 -prefsHandle 1576 -prefMapHandle 1564 -prefsLen 20936 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e81f0f5b-a470-4dd3-a4e4-36161f7f02f2} 5196 "\\.\pipe\gecko-crash-server-pipe.5196" 1676 29f4a6bce58 gpu6⤵PID:232
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5196.1.74128284\1783020623" -parentBuildID 20221007134813 -prefsHandle 2068 -prefMapHandle 2064 -prefsLen 21797 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4e8f738e-7ca3-4470-86e6-853efa7ef1fb} 5196 "\\.\pipe\gecko-crash-server-pipe.5196" 2104 29f4036df58 socket6⤵
- Checks processor information in registry
PID:5852 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5196.2.538467669\485469132" -childID 1 -isForBrowser -prefsHandle 2600 -prefMapHandle 2812 -prefsLen 21900 -prefMapSize 232675 -jsInitHandle 1200 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d552f90a-fd0a-4640-a1e1-46eeda7de3eb} 5196 "\\.\pipe\gecko-crash-server-pipe.5196" 2752 29f4dffa858 tab6⤵PID:6132
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5196.3.706178665\1501797248" -childID 2 -isForBrowser -prefsHandle 3468 -prefMapHandle 3464 -prefsLen 26480 -prefMapSize 232675 -jsInitHandle 1200 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {45eac6fd-d261-41b9-b34f-974686f6b4d6} 5196 "\\.\pipe\gecko-crash-server-pipe.5196" 3480 29f4035ee58 tab6⤵PID:2196
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5196.4.1158391501\1622111473" -childID 3 -isForBrowser -prefsHandle 4344 -prefMapHandle 4544 -prefsLen 26700 -prefMapSize 232675 -jsInitHandle 1200 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f2a8cc16-85e0-42b0-885f-04402527f1c3} 5196 "\\.\pipe\gecko-crash-server-pipe.5196" 4508 29f54089958 tab6⤵PID:1564
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5196.6.788074092\249404434" -childID 5 -isForBrowser -prefsHandle 4944 -prefMapHandle 4940 -prefsLen 26700 -prefMapSize 232675 -jsInitHandle 1200 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ddb4480d-a2a2-49b4-94c3-ebb428250725} 5196 "\\.\pipe\gecko-crash-server-pipe.5196" 4956 29f546e4658 tab6⤵PID:4560
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5196.5.1738113889\800454730" -childID 4 -isForBrowser -prefsHandle 4684 -prefMapHandle 4688 -prefsLen 26700 -prefMapSize 232675 -jsInitHandle 1200 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0d1f6c2c-56d7-4bd7-bdaf-7b501132de73} 5196 "\\.\pipe\gecko-crash-server-pipe.5196" 4676 29f546e4358 tab6⤵PID:2564
-
C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe"C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2796 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"2⤵PID:6048
-
C:\Windows\system32\attrib.exeattrib3⤵
- Views/modifies file attributes
PID:2476
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"1⤵
- Drops file in Drivers directory
- Enumerates connected drives
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe" /Service /Protected2⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Windows directory
- Executes dropped EXE
- Registers COM server for autorun
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4880
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Checks BIOS information in registry
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe"C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5388 -
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\updatrpkg\mbupdatrV5.exe"C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\updatrpkg\mbupdatrV5.exe" "C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE" "C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\config\UpdateControllerConfig.json" "C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE" "C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\dbclsupdate\staging" /db:dbupdate /su:no2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1372
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x3d81⤵
- Suspicious use of AdjustPrivilegeToken
PID:5092
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:5108
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x0 /state0:0xa3aee855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4796
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
3Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\7z.dllFilesize
1.7MB
MD5461faf68ccc02b0223fd273b630f21fe
SHA1363b8beaa74f0f454c2d544ace9e71a84bc2b4cf
SHA256cb07f3f461e9c267831b1ab93af6dfda1bb51d72e42d73d00d26594f09326be1
SHA5124b671f48e45fdedf50c7f7bb6c8d82a3b98f7502006eb002aaf8ff31f25f9ff1257c7bcc12caf622e43d4ec665b19d978ae3e3762f76def0bc71485ebdb8426f
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\Actions.dllFilesize
5.0MB
MD51eff53d95ecaf6bbfffe80d866d8e1dd
SHA1d7ef7d7c77fd04b2c0eb8c16bb3cd08057f6742f
SHA2566dd748f7ca56125cbe158fa3612f08e7312ef58ad5375e6b7ab5532cc16ca0ac
SHA512c59b8e6f0b238a247e64b9c7bb42213dadac1dada63542830a6292361174c935c0c662b2d1aed3fb6100cc4993297b1eaf25e328f2b4613458c4ffca63b9f02d
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ActionsShim.dllFilesize
2.5MB
MD558149edf4990067b4c1ffe1c32a51a01
SHA180c0c8b8def45420159659d2eaad181eb0b05c40
SHA25667af73f9b49ce113d02d7f2824e45d48044273772c94e6e8c300cf86bf83cb55
SHA512fe69f4eccaa35b132b7dfc77fae50733398cfa5ab7377f502a50e1bb83be6b81fad26a0a24f6dfbc99dca6e118784f3452edc4a30c11ac161fc0db62b039cb4e
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\BrowserSDKDLL.dllFilesize
5.8MB
MD51ed53171d00f440f29a12f9beb84dac4
SHA14d9a1e3579b0999f1ab2fa818b588411e9ee920c
SHA256e659e687a872050f9e65d78992d16bd9b393cf3f8e8c94e0e15fb42b7065327e
SHA51217161cfc672d1b996b8af4ebac17f9a8a3807f38c9a23e2e5b4dadcd9a21c3a64faec9bf59147022a9df88b80f89300f1b537091289bd7a42806bd206a317e6e
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\BrowserSDKDLLShim.dllFilesize
2.5MB
MD52e8ad6f405eb7744908f635dc089438a
SHA1f2ca3f55ce4395dfe39a0ba099a39f8c30e263cb
SHA2564824ad6b30b42a9166bfd3db41f11e3cb67e7aab96058b7f946797d7dadba891
SHA5123eacea19caf3f04cddb35091102c5d627b82acc8c73be1bfa4d72932c78cba7821c99c616bbd8d422ce588b865700db560ba441f8a5da6a9629af844f6ad28c5
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\CleanControllerImpl.dllFilesize
6.9MB
MD591153bf872114d85ee3144833ab5a2d4
SHA1935769a4c62a117907c295d85efeaf36412244e8
SHA256c4ab4bbbca3a557aa716986fdaca0ec7cf60577a4047009217ad22363bec8c09
SHA512abb79fddd10cf984d642e1451f0ad4a1d735cb02d5dc57fd2e4f23523e6f77fe02bb1ff732f59cfc52a09490816c5ab4a5cc631c7754e49f6167a0ec1e572510
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\CloudControllerImpl.dllFilesize
4.8MB
MD5d739c6bd5d5cae2ae961a0c2d40eb5b1
SHA116d0d40707bf55f04a0da70798b5368e612fd5e6
SHA25625472857a59a9067c1224b173b378448bb574f5365edbe4a1a46df8810007f9a
SHA5127d80a39f3a91e0faa87ae8143f43d2e8947eaedfd317a1ac1547dfa15b825cc5c200f8baebe127a0bc2379fe90c40f3ea25db09c06b521aad1c189ce24a53c7d
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\LicenseControllerImpl.dllFilesize
4.4MB
MD565e42cbe095830d9d93ecabb13392780
SHA1e60110e159cc4cc92d2606ae3ba3559c10170e5a
SHA256a773e1706bbb6e8cb522d0e1a3d29e496bcbe6a91e221c26bea98292b9316f7f
SHA5126b25cebb6433ec87831a3f0f67b96c7fc37a617158a18d9ac20bd375f46c97da8a41e4379da72808fdd7947705c6c09518c56152f96eebf2bcefb39ffa6202ed
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\MBAMCore.dllFilesize
6.6MB
MD5f5326e215357788237b4c4e78248010b
SHA13fb03c85f0180dc60a9756b50b44e4a59f056be3
SHA2560d0525e66bae8605c0afa6b877ceee4c9b75be15c5c47ba8961041b3bdb848de
SHA51293f456a22d30fde2e5330573f6aa24b7b3ebc633fbb7171b135e4030c127b17c5e3cb2c9a56f62355070c9a6fde564144fe56e1674f5f0d905691e77854789ef
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\MBAMShim.dllFilesize
3.0MB
MD5f44b6c80c46c4cf3071b5f5b916e1271
SHA1839f2238ecbbfa80ebf9c1f77eafc78204b58761
SHA256732523df43358729d5e85cceb557d69016dcdd3e2238d903c33c5327c3131fae
SHA51299be164ae96bc4f93dc896d5df445ad1c2f023f10605a8c9857d7ebedfc5b070f50cd33b401d61003e601a06b8446e6c0b5dbddda4927a2e1352407d3b266942
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\PoliciesControllerImpl.dllFilesize
4.0MB
MD5a343e23fb8bd09e65225b654af948a88
SHA1a61b1685127aa909cad84babfefaa26a382fe12b
SHA25692b73eb638f5d7dc78a93a63145fa7e2e6397a220aff59cbace9f44a427982c0
SHA512312967286d9534dd37105bf329f2d39c4563f6c09868370c3fde582c07cfda90c2a19b1a759c2eac178aa4a7029383836c0d8805aab41ea55deb31ebff5083c2
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ScanControllerImpl.dllFilesize
5.7MB
MD5325cb58e19d485e479945837d7f8c1f8
SHA16102985f07a589eb81badf9aeb66670e7469cc4b
SHA256faded97793f72b925053fad2efcfff9c0e1aea5cded6b1838652a1f86fe4bc5a
SHA5126bbc6129c197d7dbb2b1a8152b2339f54fddeb9fee3a55099d148172ec0b7c9d1102d5315fe885e8264d8b39bae1864d2a825a9ac78bdcc671d6eae8e9de1228
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\Swissarmy.dllFilesize
4.0MB
MD5ae8affa9f5cbf51211132b0146bada81
SHA1912f5d4879047dd2c84e40689dd87fbebeff94aa
SHA25616b70ec44567e4b20216c3906fc40e26671078ee58c50f3fe1b1be8d3b521316
SHA5120b512a695430f433cfc488098ee1e965dcac2b1e0f80d3597858d32fcf6565c2e12135fb7ad2ea266e17c26a802192f47b603413740eccc478000db94aef5397
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\SwissarmyShim.dllFilesize
2.6MB
MD5cff3e356609f66039d7c732b2e7a3c2f
SHA1149741b831d7ec985e12ecb177040e98e6282f36
SHA2562a4a95dff26010278a6d5174dde2ae23269905534be788e3d2fce7baa53f35c3
SHA512dc9c4c78c7c43cb3b87a2bbaa7a19e9b57b3ca8df94dfa1a7657ae18a12fccd8b4cc8a9ae1aeb8457272c226e09f251ffd4922af78346e000727457693b5dd73
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\TelemetryControllerImpl.dllFilesize
5.3MB
MD5c656aeb7dfd645746d1077fcfa3fe5ec
SHA134cb10804d31cd808376a91a7b7a650ae9c34a43
SHA256f08752a9ef44bdd09d1c3bec0a30db3364c501d1742782da9312b08ce88ab5b6
SHA512689fd6b87e71ac229d2829f32112f23fb05198b46322ad60e252a2127796f90ab11d2c9aab4fc160cbc404533c0ff9a3b97bcadcc1f91ec5af977413a3280121
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\UpdateControllerImpl.dllFilesize
4.4MB
MD51fb6a6c92affd0b5e5609f8c978abfb9
SHA1413ac37b4aa6268d1b65b559cc264bc95a204dfc
SHA256ec25b45819d48001ffb178f38292acde49369289335802a59eb6d9071a018936
SHA512885cf1f3d8b2e795db288291f2e6256b38fe8f3b79a276a59f013dd9d1200c1ecfcf537d9f889a488713d6b35753332c22b553ea8f1156f5a6379e23b2633dcb
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeFilesize
1.8MB
MD58b8dce48722a187976860c198d8f4d65
SHA1f9346d6f05b8f232552d26eaba71aa482e324f57
SHA25666035f0d7b5b3dac02e855e764f2a561480edaa4fc7e83cbc3c34c082b391969
SHA5123771dd731c0ff921d06daec013908fe64a10c8a526f517d359b0f3921c6626fd9af371d46751258134c698c3d1c001977d8b27f400c996344c78a5a530b199f8
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\pkgvers.datFilesize
74B
MD52b72eaa94d5555c9febe59145f93807b
SHA1073072d3b089373b09c48e9f6296346addbad960
SHA256bb89ba590b3751d4567ba873f7d91ce3bec27fcafb6349fd4583cb8b7e935000
SHA512e83f6f33e483de0060a11c6477c9895b7882e6ad52ddcb10663315bad2074bb3e25bfbd32c9aa515ccdf7a838a51c41f73e78a44bc1d4418dbc961a1622ccaf1
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\sample.dllFilesize
528KB
MD50d964850f272eb25013c951e9d76c028
SHA1e581fb83527b84c4e55912a9f88107e9ddadfe6c
SHA2562974f71ff7763c6d4844dd67d139d137a85062fe8e8c111e75e7614ac8091b4e
SHA512a7c0e6252091240e33af64ff47208ed4a7c8e5be113fa4f36497280a0523c41e1096112a5fcf5290d61e36d414f970e9aff07a3a5b0ff586028dc4fd6b881f9c
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\version.datFilesize
47B
MD5e20cc04b2fb5c72162454b61d32a501e
SHA131ea8aa3240c2366e3b154d530fcc74de63dd3b3
SHA25650fada56916c80d19adcf00fe3fd9bfb5b71d8a1b0a8bed739a6aea2491a9554
SHA512c3bf5c15229cf5e27024af446ff76158937301b98165a7836d421d24591669ea004ffb6a32c0d1d245a5ef5207ed9022a5cbc0c16ffd20740cf967cc4a2b9e38
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\Global.nmFilesize
336KB
MD56b72d8e773dbf1bf2dd3a295c47233ec
SHA109fd48564a9fd1a3cf17c7bb4f098060e72f4dfd
SHA2562b632d5c7c7d5cca88a4414f00f2586792cc1b62690438c84542a0cb8aa97183
SHA512d2a73b9504b3e222dffcdc2e1494d1fb3cc6d4a2dae93554a7617371e6d41e026243726351243275b90e9835283afca6b28a195aec3f25ef69790af2d6384059
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\Global.srFilesize
13.3MB
MD5a031e0e9af435a4e1cd0e0a116f2675c
SHA11b39a061bd431b4ef6639d42b00d8a4bbf7e198c
SHA2569fb5fea00f908d8ccef799cb9effc70a78ae3f0607400d3b8adb803985aa81a3
SHA512893bf2331bdd342d8f618642caf623a987ee96bcc9b2e5f02662fb64a7e1d82e267d88f373348043191cda9e3799f96282d36314c04ccfb472bd81cbcd9a934b
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\cfg.binFilesize
1KB
MD542dc081efeaeed00967fd339278d6c97
SHA16969f00e1bcb5423395fccc12584e46cabcda9db
SHA256dbaf53794113e4172f5c78d4b1ffdc0a2f1d7a35e5d8e8893f0c2b5d1a3f4bb9
SHA5127ca9cbbb9e9820d6fffe13709d42b90df1fe58060c7a8342c4d3ccb72fe063b3cfcae1797d4bfa897fcd4955bdb5e0fdd585a84c0f7b7479966df27c0245bd0c
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\clean.mbdbFilesize
10KB
MD5c0aab6fc915f7885f456850f8bdcbb20
SHA1f2b945285fe0fa658ba708b5df456bd4bb06e657
SHA25624fe328ed487f236846beb225aaee2e93dba48cb0f4e52f9d7d4e68c647bed0a
SHA512cc8d36f325e0b9a9a33525c6a7fe765b74b7f9d9aa758d9223ace5adcf530fec278fd2fac6d74d5a6a320afaa062ac4ad83b8d373b9e2448589f260ddb9c86b8
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\dbmanifest2.datFilesize
924B
MD573a07533b6b53c0870a334eed8783d92
SHA198f92f3ae589d5e1d5f7c7918361125415ad8f00
SHA25669ac234587e3c4877041ac962473d12e01c4def12659497689d59c846f277f23
SHA5123841c367ca8c0814385281fc626bb5372fddca13230d3cb1f9e86a350ab911d8f99d7dddb1f47e9eaad401a38b7cf3868e4dbf9cecd83b670beec382d2f74049
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\dynconfig.datFilesize
39KB
MD510f23e7c8c791b91c86cd966d67b7bc7
SHA13f596093b2bc33f7a2554818f8e41adbbd101961
SHA256008254ca1f4d6415da89d01a4292911de6135b42833156720a841a22685765dc
SHA5122d1b21371ada038323be412945994d030ee8a9007db072484724616c8597c6998a560bc28886ebf89e2c8919fb70d76c98338d88832351823027491c98d48118
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\exclusions.txtFilesize
23KB
MD5aef4eca7ee01bb1a146751c4d0510d2d
SHA15cf2273da41147126e5e1eabd3182f19304eea25
SHA2569e87e4c9da3337c63b7f0e6ed0eb71696121c74e18a5da577215e18097715e2f
SHA512d31d21e37b0048050b19600f8904354cff3f3ec8291c5a7a54267e14af9fb88dfb6d11e74a037cc0369ade8a8fb9b753861f3b3fb2219563e8ec359f66c042db
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\mbdigsig2.datFilesize
514B
MD528b388df625f8e0779fc68442825be43
SHA16583556d98508b2727fe67acad8e76de380eadf1
SHA256596ca11c7278736ccc18bf639f4c64e1f367469b0ff638b4249a741c1ca1a8a0
SHA512008ba910cd3ac4dbf96699d51850575997a451f1e76b082d5d93850e52de86eb34b9d16c5fd0d25dceefed7c2b08e2b1e7cc4fe212d6fe3617a4988daf175567
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\prot.mbdbFilesize
24B
MD5546d9e30eadad8b22f5b3ffa875144bf
SHA13b323ffef009bfe0662c2bd30bb06af6dfc68e4d
SHA2566089fbf0c0c1413f62e91dc9497bedc6d8a271e9dc761e20adc0dccf6f4a0c1f
SHA5123478f5dcf7af549dd6fe48ad714604200de84a90120b16a32233b6d44fa7240f5f4e5fe803f54b86bbdfd10fa1bfdd88fb85eb6a78e23e426933f98d0a2565ec
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\rdefs.mbdbFilesize
24B
MD52f7423ca7c6a0f1339980f3c8c7de9f8
SHA1102c77faa28885354cfe6725d987bc23bc7108ba
SHA256850a4ea37a0fd6f68bf95422d502b2d1257264eb90cc38c0a3b1b95aa375be55
SHA512e922ac8a7a2cde6d387f8698207cf5efbd45b646986a090e3549d97a7d552dd74179bd7ac20b7d246ca49d340c4c168982c65b4749df760857810b2358e7eb69
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\rules.mbdbFilesize
9.1MB
MD524014deb879194625a9f962acccee727
SHA163dd7ce0fc60a1205cc687cf0040a770fcf6a636
SHA2563e5dfea32dc97a933fae80a1a45459b1c5711e7bd28d935a4340d3bffa5a1feb
SHA512e0aace86ec9196a1f711c6b75d93d69ffad16e35f84c357c677b109daa5a7c4a6699287659e9f78b2676230d496fa08c3f3384edbc9ec40b45b7f79eb8e8d9d5
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\scan.mbdbFilesize
1007KB
MD54ab2935bff4adc4ec36f57da0e42f776
SHA1e40e7d25af74c6ed560a2d4135748338fa3308a3
SHA256ba9f57fc12cfe4c379a69005ee7c4959ad3f7e70f32f967282f808a9ba31541b
SHA512d207cea8e73d6a27e13e2cf28d55d12a95bf867c2a74be5a7cba8069a6f64b47ed36a83832f44105b68fb7643877427a28b252f924ef640107567b90b97444a8
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\tids.mbdbFilesize
176KB
MD565c0d45b039c202a45de514a807ad73c
SHA18c7f0419aeb1f994e7278412d1384105c88008fd
SHA256bc55c025692bd716726d523b239021ae031423a48245b31788fa7b9c02347590
SHA5125f1adace978ba34dd5af86fb74903a43903cae1a9eb72b9f402512b957020452c5477c879c5ead102ce0de6970a4dc32004206a5a205ea37bacd2f21896e77b5
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\wprot2.mbdbFilesize
42.9MB
MD5ffcba7e4e3245c61bda01d94d7f8850b
SHA1e979ade715fab8a1b75610babea901b4c6765fbb
SHA256dc4155c3cf65d9655d0a2d2fa9d7f4e155e0018f6efc849a358488809bb0a953
SHA512539c2f23f2c0626c98797035e2f63db6c6cb888741cde456c9b0bc9a67eae88e4c85a3730db806b89e7770e7f3dffa058d1e4bd47efbc2b5982e285008efb284
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exeFilesize
8.7MB
MD5002c3dd691e6a0fd189f2f279a6e0a68
SHA11d39aacd4aa517b0fde8c46c4f9834e5008c9514
SHA2566ffec3855993062006d638af9d6b22cdfc89724f18085dd77e6e9635b14eb155
SHA51231fac4a1bb1b57b4ef968881cf74119c94cf7794ba74447d568b6877cca6f5b10f973843077d84ca94ff2569e9813d086964867854637d1e151ab115309c6d06
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exeFilesize
8.7MB
MD5002c3dd691e6a0fd189f2f279a6e0a68
SHA11d39aacd4aa517b0fde8c46c4f9834e5008c9514
SHA2566ffec3855993062006d638af9d6b22cdfc89724f18085dd77e6e9635b14eb155
SHA51231fac4a1bb1b57b4ef968881cf74119c94cf7794ba74447d568b6877cca6f5b10f973843077d84ca94ff2569e9813d086964867854637d1e151ab115309c6d06
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exeFilesize
8.9MB
MD5e4472f208d356ea4f562294ad8b82d93
SHA1b34bbadc349e722ef8b211f9205a610fed1f4a32
SHA256822957744702afdd6a571616da66f6c97a693d3a9e4b0c008f7f1614649a04d7
SHA512012c99ca3eb23f49ae916d2d7d62ff428b34ba0340cb6d9c3f80f292e115437f58b3a6bfcffb862f6e1caffa2a12b69bb3e7a56445ccf132cc48a6556290fc9d
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exeFilesize
8.9MB
MD5e4472f208d356ea4f562294ad8b82d93
SHA1b34bbadc349e722ef8b211f9205a610fed1f4a32
SHA256822957744702afdd6a571616da66f6c97a693d3a9e4b0c008f7f1614649a04d7
SHA512012c99ca3eb23f49ae916d2d7d62ff428b34ba0340cb6d9c3f80f292e115437f58b3a6bfcffb862f6e1caffa2a12b69bb3e7a56445ccf132cc48a6556290fc9d
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exeFilesize
8.9MB
MD5e4472f208d356ea4f562294ad8b82d93
SHA1b34bbadc349e722ef8b211f9205a610fed1f4a32
SHA256822957744702afdd6a571616da66f6c97a693d3a9e4b0c008f7f1614649a04d7
SHA512012c99ca3eb23f49ae916d2d7d62ff428b34ba0340cb6d9c3f80f292e115437f58b3a6bfcffb862f6e1caffa2a12b69bb3e7a56445ccf132cc48a6556290fc9d
-
C:\Program Files\Malwarebytes\Anti-Malware\MbamElam.catFilesize
10KB
MD560608328775d6acf03eaab38407e5b7c
SHA19f63644893517286753f63ad6d01bc8bfacf79b1
SHA2563ed5a1668713ef80c2b5599b599f1434ad6648999f335cf69757ea3183c70c59
SHA5129f65212121b8a5d1a0625c3baa14ef04a33b091d26f543324333e38dcdb903e02ccc4d009e22c2e85d2f61d954e0b994c2896e52f685003a6ef34758f8a650c7
-
C:\Program Files\Malwarebytes\Anti-Malware\MbamElam.infFilesize
2KB
MD5c481ad4dd1d91860335787aa61177932
SHA181633414c5bf5832a8584fb0740bc09596b9b66d
SHA256793626d240fd8eefc81b78a57c8dfe12ea247889b6f07918e9fd32a7411aa1c3
SHA512d292e028936412f07264837d4a321ecfa2f5754d4048c8bcf774a0e076e535b361c411301558609d64c71c1ce9b19e6041efa44d201237a7010c553751e1e830
-
C:\Program Files\Malwarebytes\Anti-Malware\MbamElam.sysFilesize
20KB
MD59e77c51e14fa9a323ee1635dc74ecc07
SHA1a78bde0bd73260ce7af9cdc441af9db54d1637c2
SHA256b5619d758ae6a65c1663f065e53e6b68a00511e7d7accb3e07ed94bfd0b1ede0
SHA512a12ccf92bead694f5d3cba7ff7e731a2f862198efc338efc7f33a882fe0eb7499fb3fb533538d0a823e80631a7ca162962fbdfd78e401e3255672910b7140186
-
C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.jsonFilesize
592B
MD54f939b2784da0d892db3747a6d5c2ec6
SHA14381321b01a793ad4a680c596c702ed6ef9c8c83
SHA256ffb2201fd1c2258bc33f4335f26bf80f0948cf66541802940157ae9d69ce842f
SHA51220d74dde51ca018f6bc6c4c980b3775baa62e93187d791eb9e0a9b3185e49efa036d7e43bf4f9f26425dfa58de3385bb160bb1fd7128e7d77130047dc1d97f20
-
C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.jsonFilesize
592B
MD54f939b2784da0d892db3747a6d5c2ec6
SHA14381321b01a793ad4a680c596c702ed6ef9c8c83
SHA256ffb2201fd1c2258bc33f4335f26bf80f0948cf66541802940157ae9d69ce842f
SHA51220d74dde51ca018f6bc6c4c980b3775baa62e93187d791eb9e0a9b3185e49efa036d7e43bf4f9f26425dfa58de3385bb160bb1fd7128e7d77130047dc1d97f20
-
C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.jsonFilesize
654B
MD57de99b5ed2329e4697cbd2d5a588997b
SHA1b3a1f011f5583ba573fa23e082f01720d2de849c
SHA256edfeda89bbc4546d5aa7d107848f60bc260ce4954906e773ca5cdc8893a070e0
SHA5124dc5a83f063b17dc7b2aacdb9e622f3ae8b1bd199d9127ababee2666b229f8b161273dee536727e3c9fabe9cb3d76975de06115e34520a5396e4c1f0ae812a1a
-
C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.json.bakFilesize
592B
MD54f939b2784da0d892db3747a6d5c2ec6
SHA14381321b01a793ad4a680c596c702ed6ef9c8c83
SHA256ffb2201fd1c2258bc33f4335f26bf80f0948cf66541802940157ae9d69ce842f
SHA51220d74dde51ca018f6bc6c4c980b3775baa62e93187d791eb9e0a9b3185e49efa036d7e43bf4f9f26425dfa58de3385bb160bb1fd7128e7d77130047dc1d97f20
-
C:\Program Files\Malwarebytes\Anti-Malware\ctlrvers.datFilesize
8B
MD58e160946d937c3d05c20d4b6956165ed
SHA1d864c75c7df3ae41e1b9278fe2fc8df3e0ccb4f2
SHA256002087a846ca9cc24db51eab7dca9d0e2708bb3ff595046ef6a5b881ea0a7517
SHA512279cc6bd2b1200e147fb12162e31657535687ea0f937eaa0c579550f6a41874d272eff758c34726b330b5fada205e5501393bda39ed2aa37f0acadfdb3341532
-
C:\Program Files\Malwarebytes\Anti-Malware\mb4uns.exeFilesize
3.8MB
MD51c1ed125b4ba65d7499504b2c77a8b27
SHA14754ee30ac153247c8a0e5a264aa48c0f4c20ece
SHA2560113b48553f2a67726a4eaf0fff5b5eda2853aadbae32be7a99629b8a6700196
SHA512a51d3dc077b91b14e5c38083fc1186d5b5504cdbb5439942c39fc4d054aa05ad9bd1d913b7f8bae8d35971ee5f92e1f483cb39b6722a91a0976f96f79e39b512
-
C:\Program Files\Malwarebytes\Anti-Malware\mbam.exeFilesize
22.9MB
MD5b5aee6d83c6e863c1d6297f12046b08a
SHA173d29b270cbfd3c460fab0d928d20e9d04a4ef55
SHA2568ea3e38765219ce853925d3e3a9d9dff9c651ea88cd14f86ce3e82caa56bba8c
SHA51286075d0f152fccf329f34084aaac48be8e36f5dcee0bbb2be025dadc3ab5b9dfdf91f229e0490ba0f6bdea06b8c3e87ae6d5a7d31af02be13f349038171790dd
-
C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exeFilesize
8.8MB
MD589a9601cef4288dc9f6cd0a655794e7d
SHA195663d19c77776ffc06935dbe8afa0f1fa50183b
SHA256f196563e7dfca811272278881c31ec809eb7dd39f6d7032bbea0766da953e386
SHA512dec0102a881499ecccfbe9c224cb3544217b7b48ddb7a5109a9387dead18b1359e63865a8ff406a000205dc742effb220a97e403f5c31cdb0340a9111cc9c882
-
C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dllFilesize
2.7MB
MD5b7e5071b317550d93258f7e1e13e7b6f
SHA12d08d78a5c29cf724bc523530d1a9014642bbc60
SHA256467de01d7cee7ec54166b80658ff22f9feebdb1c24eaf1629cf40e4124508064
SHA5129c35293c95c1a9141740ac99315605964aa37c4a42d3a11cae9e5649ff1427a9480d3d5e7f763212cf13db3511c5ea3c84e68f95f0067fe6339a9d3fb7b27c54
-
C:\Program Files\Malwarebytes\Anti-Malware\offreg.dllFilesize
114KB
MD516663d125398773a90d0a53333b7cf5e
SHA1f92928ae3c9292588547ceaca1cb1d372bfd7936
SHA25638e6811b47262101759aa51a631263d9e3eee5d211164318a751e078afec4cbc
SHA512091764b8ad80aa31eea0bbd91ee505ebdea2654bc8aeaa3081a061d0d37ab13d27dd203075fd0de10c6687591aa0e36139a38af846c4e34e6aa67ab81dc277df
-
C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.catFilesize
10KB
MD51f539a950d77a19b0b44a320ce6641eb
SHA1cf1732f69c54ef296a934a497a91cdcc88ad81bc
SHA2563e3ca6e7d8ce0530fba6aa3971a6386d9cd20cb0811a99351cb0f8cb3f3ba635
SHA512ea423f461e665cbcb7ed934bf20b5243f60f2c7713f950e90e097f943ae8a0633867d1334c5fc742aefdd5928f3f41e14747075552bce474cc454902fb908455
-
C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.infFilesize
2KB
MD50ff3f3ba83e1dc78aa42e205e1a01867
SHA10a557f31af77bfccccd9530227d593efb4809fd2
SHA2569c5dad17bd0878115a88a4c94405fbd9048294462eea474f265ddddedc90771e
SHA51280543530d28722b926d3aeda4a0c61fc5bea1812e38a3a1b7b84a5a1803c078bc54c32eff23b96766fd5e27301818f105d86235cdddbaa0dc51ac347ed3d7dfd
-
C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.sysFilesize
233KB
MD5764310ada7e8b6c20d4e0020c8bf8105
SHA1fcf840985419355c7508e394b5fe8e112d9c6a08
SHA256bf29f76c794067a4f04f794c2b3eab9b6f1a9943c0500cbfd94f619dbde68a38
SHA512451b452207429f1ed84bd23008d1a8a5e98f757e47b0f8f21463eb9cfe93d4e10e8fd4a5e0b794b90925967c1cd133525fce30c00e5629ba61dcb948a5db5b4e
-
C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.sysFilesize
217KB
MD58daa2afcce65641472b57b91f2c1389a
SHA1fc664a927c04b30ed9af629d4c100da41b30f503
SHA256c303ad973ff82f7f9d256b3762dec7064c916c35aa57e7af50cf2248278ac1ff
SHA512ce28db6214a60d0479c537e19cb748ec0468c35552e0e3d13c86240e3d5a57d1dd93d7522adda27f9073fa8908e450c72905601710ab9789e1cb628206c5d7b9
-
C:\Program Files\Malwarebytes\Anti-Malware\srvversion.datFilesize
9B
MD58422d5b676e9b2f9500c2c8abc05dd68
SHA15050fe433fdd3722c0cf9c3b610476c4677de6b3
SHA2562abebd6c118af131c7c4ad0becfa2c983039aafe078f4857ada054645ac8c245
SHA5122572439ac0fd204954bb03e62eac8b5ff8d4feb4ac4db5d46875b65367b76f3d64fcbf0d19a621d58af5884afb7e4851ee9f2d99595dfbbaa6ee94d5383eb728
-
C:\Program Files\Malwarebytes\Anti-Malware\uipkgver.datFilesize
6B
MD574c6677020fc6b6c867aab117078bf5f
SHA18c46db37dc0b39eb963d4144539c8b591e122400
SHA256cdbb9bc874d71e154c71b68b1fe959913d286036dac11e226e5620c919ba9708
SHA5123f9db8d9bb25322f8d8e750750bf92dbe6ac63d686eced65cddfcd61178cf0e947118a491058414d4d2cbb4892e39815565669aee0dfdda23aece72d278292d0
-
C:\Program Files\Malwarebytes\Anti-Malware\version.datFilesize
47B
MD5e20cc04b2fb5c72162454b61d32a501e
SHA131ea8aa3240c2366e3b154d530fcc74de63dd3b3
SHA25650fada56916c80d19adcf00fe3fd9bfb5b71d8a1b0a8bed739a6aea2491a9554
SHA512c3bf5c15229cf5e27024af446ff76158937301b98165a7836d421d24591669ea004ffb6a32c0d1d245a5ef5207ed9022a5cbc0c16ffd20740cf967cc4a2b9e38
-
C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.jsonFilesize
1KB
MD5f3f4e436b5df9546cfd1dcbf086e34c5
SHA176c85a00552b26853e8ff3454d1abf497ad0728d
SHA25646419c49f53b1c77c2dca5c3b209c0b0315a666f8bb63898b36d01f8edc03b8e
SHA512c46c7f4ad620121ebfc839c1e8d7008f02f1d31481be90bd2cd6d5b4f974a7e101f3c14790756570d3c31f9f4bccbc9020ba5acc50a971e06796340f28a8f245
-
C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.jsonFilesize
47KB
MD5aaae519091015cde014189465d174dc3
SHA1a795c972edf07c8a8a8b7d08cf82d964a6926ef4
SHA256de669c343250ac83ef56abdd4b6f5b9e39b1274d85a2385062dcf1e2c079f02c
SHA512e384156cf0937d83d797489aa537c07ada0a6bf010c2be13fa410b06916e6164d320e48875293dd8ffb562a19c2c79a50eab9d6336709849a84f45065c8165e3
-
C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.jsonFilesize
66KB
MD5aa575da42a0fb154e45aa76fb14be945
SHA105d6336af5e71c25d493b7cc0604ead2163d6f7b
SHA25641da70eab377ff752e36af80faf2ded26e23620d04b4961136628241e9a95841
SHA512cc37596c37a492e05fb3e043ecec9e1f5c47bc9850137e467ea96563c36c52d0678f09c7fbe530d496bfc2326e0e7516931b1b1fb516969b83b34358f344c8f3
-
C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.jsonFilesize
66KB
MD57605ede9ae6cfcf769b2bb4ea7e9d7fe
SHA1705872277cdb9067aa4e964c01644c9c02f1cdc2
SHA2562e1e21f8af55c9dc9db2c7210d89451f9de85421de5780afbf5807740acaddba
SHA51225d9048815b77cc4e4ed7407c8ec32a578115294e5db9a4334914d91601e47a9f1d7fc6df2b9e0fa7debcb58151af7527ad9dea2c957d7f8dbaf2125fcb37c35
-
C:\ProgramData\Malwarebytes\MBAMService\config\ArwControllerConfig.jsonFilesize
607B
MD582c1116db2825910c2656e84924b51d7
SHA138da1865508f89f7ac706faccd7293f536ce9787
SHA2563a76c7136f3e2bf6adbc2347e05001bae76c6a04a1c189a1cc18f79b225e9ebc
SHA512ba100f20b04c90ce51144e974cb4d8f80005e1562ea2d2625fc0ac3fbfaca9970cc0eedcf752dad2e4f1bf1a1f09ff1d3473e0da2b48c7af1beca5f84a60c928
-
C:\ProgramData\Malwarebytes\MBAMService\config\CleanControllerConfig.jsonFilesize
847B
MD5e260d34cb8eb7c3d312f1a7f17771646
SHA1332f43c2ba80f6650b0efa8a9fe620e4a0ffb946
SHA2564f9c364fac8910b60f565c518ae037bcd040d3b4bb07b46c3afb9c3ce964dc84
SHA512efbeb72ed08d8579ed859c262996a7a5da7ac31ca856d1e500781bc1c3caed6c0ecc7cd548f2728c16b944d6e60a810bfb25a7f8075c1b827090fea521a3f074
-
C:\ProgramData\Malwarebytes\MBAMService\config\CleanControllerConfig.jsonFilesize
846B
MD585a6331f7cbe9a6e4f83148f3be278b6
SHA1dd836ad82a37cff3176a54218c9f26ff7e927567
SHA256314df71393ceb11ea25b0227afe904b5d259a56191057f3d553a26d1a4abeaec
SHA512a00ed39515b49052546c6a8a57684e0ab95c5de2c54de59f48d736a0502ebfb995d5553841129afecad3dbbfb3f656c6b8b29821545be90288559b589cb1ce85
-
C:\ProgramData\Malwarebytes\MBAMService\config\CloudConfig.jsonFilesize
825B
MD530a07b3da4d9acbf27e25b58e65a1256
SHA1e487cfb9d1b8d1b4c22ec8a75403245d8d0eec70
SHA25696d407813a046554dd805603fbfafa44715c957a59e19534b101499fe9671508
SHA5121f224ff71407a802141a493734e9d22c769066f57696a6152e220a6b4f6d9bf8968b8188589832c4d6d0c40a90ae78b70214682638da9ecdc9c2c2a43f4e2bf0
-
C:\ProgramData\Malwarebytes\MBAMService\config\CloudConfig.jsonFilesize
1KB
MD5cb5310145fae0456ff02823cb27a29e6
SHA180f1cd398ed4bc160833b2c92b27dfe669d482b2
SHA256650fb8649c75f75e6b5448a7366d5f36160c35f23d974632baa3791b6da29ada
SHA512b7a2ca7d76c85ca453317a506a9734db5239b0ae42110b1efb9dfb2f1b8b0883995cd9f6799e76ab287328c810f4d069e6c8ea45007f74f607c3558086494f99
-
C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.jsonFilesize
15KB
MD5ab112c1d8f1c0a41d6972f1284f7b157
SHA10ea13744d187d7ce7bdc7cc7dc3627b8d324f09c
SHA256032a5e930f432d985c3ed8211055da1043b1bb36ce3800169961bff643366163
SHA512ae27439d81ac8a2bf6e76e9a5735bfe92bf0f3e92e34a51e108097739a4a2908afe5e1aefdda85c118b5c660643e4c277e0b9f597b14855b13922e7683fab8f0
-
C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.jsonFilesize
15KB
MD5c60cec4d458b267e2718fef3965a9402
SHA1d05592874e546c358d35a68d33e921f8c4b144a3
SHA256dd5555cd550447fa6554a11d376ab8731f43bc8d6f34388768ab39677388391c
SHA5127172f61da693060926484c43121ae6529f9f002ca3e7afe184419e0318d2f9b50b0a8dc017204c0b2e70eddb5dc0c2283c5b515353d4b4627c6346b7a58797ed
-
C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.jsonFilesize
15KB
MD58a9a571067a87f2f4adcddbc24f8ca20
SHA17e5338a8013f92ca95bf8844fa30e6e254a80e6d
SHA2568d18d51b04cfd84540234b8ac7a42a91b24a4d2c62c4f71beb29471d4eeb5a57
SHA512bc6e16a762208551f3a57d9824fdb4c976845a4d83eeb6fb6ea34d465e201ce4bc33f035545fe637894c0a499b407da0b224855c76b60ff04f27236a52bb5167
-
C:\ProgramData\Malwarebytes\MBAMService\config\MbamClientConfig.jsonFilesize
1KB
MD5fb457eacb6a2e0d723d11f47384ec50b
SHA19cd2cab0fe455f74b5252386e14bf7634d36405b
SHA25654595e078ff218b61d7fd3643a97b567cb5357559136f1bc029efd3268da6e64
SHA51262c2f0e24dcc86b15b854602361ad165ed59262229d82d533444094e701aea4d1196f020c3a871bbbdcdf04b3dfe66686a7df3970187589ddefc5d1ebee49e2b
-
C:\ProgramData\Malwarebytes\MBAMService\config\MbamClientConfig.jsonFilesize
6KB
MD5e5c9663de38953eef7b9466d051ba96b
SHA1ea3c939eff9b8b8db8fbf1fe389aa26e7a5208eb
SHA256d1db4e5b7f74bab5ee5c858712b309c228a25c0c36b9ff5b194121b396da1e86
SHA512b2717e3ff0935a745813245ae3070afab708e087e4704663764ffbe8069a52e576bc93da94bc93ad67ba3491301cb59a48097e571bd7bdfa8daf7446862d4011
-
C:\ProgramData\Malwarebytes\MBAMService\config\MbamClientConfig.jsonFilesize
11KB
MD523733407bc6935b8466d80f954b5efc8
SHA1c19d6a829d653e76dbccdc3cde998796933e65e0
SHA2560c5e1bbe487400ee637949d4fdc0c3f959be7abcb8124e5f71b4fac24813222e
SHA512e88198fa1d92caa6fd62f6fbce90656468b61f0501f33473f0a8c387de8a4b60e507afbf010c4f6f6050cabbce2f495b8fae7dd2bb9a6e2fc3044e0e17239eb0
-
C:\ProgramData\Malwarebytes\MBAMService\config\MbamClientConfig.jsonMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\ProgramData\Malwarebytes\MBAMService\config\MbamClientConfig.jsonFilesize
11KB
MD5e6dda8f79831cc53a749c7f0b44c5a80
SHA1d28c32ec08652063020d2035d008f499834d2a17
SHA2560db6c712d7753ca7553f97e8d66228ebea9a6a70dca6064a8455a0c7bd3ed7e8
SHA512dcd1dfd81071fa0570f343e403b140fbffe615fa9c941aaa50006aa019c9b601a65834137642498d50e08a7765ae463dc3397dbca8ea666890c18f72a734b679
-
C:\ProgramData\Malwarebytes\MBAMService\config\MwacControllerConfig.jsonFilesize
1KB
MD5f445dd1c3279ab6ee27bc0c91f23da51
SHA1e4bc348ecda6fdbd38a9396c3f8cc29530c15723
SHA25621b120e490b9bccdb5f9dde74dca74011e663dbaae9f9ec07dd64884c83f0c32
SHA5129a02f55577ed0374c5732f623183f0682f7b3b0b54b0f4d9079dc630b4bf26a5bda2b5c921da342ff5b30bba93323ae0ca6b50bb74fbb4d2a048a51056f0c501
-
C:\ProgramData\Malwarebytes\MBAMService\config\MwacControllerConfig.jsonFilesize
2KB
MD53e8f1d19b28fa413ed8b9c22825f18d2
SHA105bfb99c86e3c3a94c156604900ecb5663afe6bb
SHA256201d9a437833deb70a00748dd05e3111f42206db4774ad454d4a25a34f311889
SHA512489d5a51227b31ac0b5de103a94d80666e87771f9353fc5b32513b0ae1d8cb3fd0f9292a253d8bdb265b927e8df55182366aa8f67d9df5893deea10b952142dd
-
C:\ProgramData\Malwarebytes\MBAMService\config\PoliciesConfig.jsonFilesize
903B
MD50c057011008af30b8eccafbed9b2ee71
SHA1861f9cd1a9aa65060384d9a2fecd4b632328ece1
SHA2569f6d279c9b85bb3364b93b1ca4f5fa528f9d0cfcb6bf37d143c7a27c3952bce5
SHA512e5e7eb039dfb7f02cea37c263a7c4a340691ac2e4dd52dbadc843cdf00a1f9548f93340b3174d06d54bd834f2898139bd6fc24b22e2ba1dcb2f3f432e4bfb5dc
-
C:\ProgramData\Malwarebytes\MBAMService\config\PoliciesConfig.jsonFilesize
900B
MD5bf39fc8888910fd1500a11f7b7f411a2
SHA12f6d4c57b76282e2daccf1e95936406217911d89
SHA25671e08e31e70ae762c069d08fa94d91a002d267e0877224e4e93ae776b413a3f9
SHA512889a1bdaad2aa45f2e9d533af7e466d5db30405bf08ba71bdfbf374a2e37edda1b16f6644dfcd1dfaef8f3b676e9409d497a528b1965655c81964b90f8230609
-
C:\ProgramData\Malwarebytes\MBAMService\config\RtpConfig.jsonFilesize
1KB
MD54587502b775b10159d93a050d4c08156
SHA10c2642ef37a2525c0cb8c451a1ce8d46c0a27893
SHA2566a6fe1ab6be5b8a91ed3bc5fc5332a21f3a339c91e85851314b0a274f1d4937b
SHA512e288b4c36f5db0282da12618157d23fc895d7c201ffb4b5f3fe843ebae35f2e41933a179a120f97a5dd0f20aa0ded29eb23f08d2ed342d1d1a1385d4d2177adf
-
C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.jsonFilesize
2KB
MD570946a91844d2ae647bc0e1588b08222
SHA1b19709fd8fbd8b5cc76e8d478c567664918a2e4d
SHA256700c5df3c174062b4ef0258e5c548050233f54426c24ab944ec015325a8d4ac2
SHA5122be3c5339026bc18ffedf5ab78ee29a3876346aa6431af14158c7e76273a98219a469046ca323b7e938fe5e837d36b97e5f19d1747225b989ec6568b08d2f49d
-
C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.jsonMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.jsonFilesize
4KB
MD5258a057113d72b8741a0322b202abe8c
SHA1cbfda64163668e7e032f69f21112894f7d7deb1e
SHA25619dc1e595e24564a9db1a3481ed465ef2c229f008884600dfc678a113042d1c0
SHA512250c7e5f319fd699ee019ca416ec9cd871719f2c2cb17f976c49e59ffe899cb74a6f88ec9755d73369359f88386a4b02bc6b23b6269f2a4090ea2484b0618f97
-
C:\ProgramData\Malwarebytes\MBAMService\config\SpConfigFile.jsonFilesize
11KB
MD5703343730f5f5f734f9cffc811c06203
SHA167ccd25ed5da01d6cb08b680562f52e58ca026a4
SHA2560555d3d72c9219ce0d13a3c25eeed1590e3c06fe511bacb91ac8a860330984ee
SHA5128af7a1ddccc70372f7b6e4c4023bcf5df2eb46f621a66cec6207cf986e566816d099b1b6a609154f6bd7f949cfe6e712a62d6c447f5c0e6fd5f809e7690ef3ff
-
C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.jsonFilesize
1KB
MD5f905b5c8f196aac6a81e374b4245bdc0
SHA153ac31b9192ee6f7be55ef05b83eda391234b51a
SHA2561ddac8671449a2d6439b6e598d51a81d0cd40a44ade746ecbe04b370803ad371
SHA512d34ecd91b9f20ddca2557836e452cea4485de1d4e1a1cf61fa41553036623efbc2e45071fab8eb0d14f7859db1ab3f84882d40e82b28465af40bdf2727282cb7
-
C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.jsonFilesize
1KB
MD555b1b8d5eb054efb0dee449e6fb15d5b
SHA1b1cbe933b548975821989ecc66ef43645ccebd08
SHA2566c55616a94c42b3c98bb0a6df4a3bb9328209603cded139ccb29949d2e21ba31
SHA5128a10081792648d5b1e689d16d0c227eef3da74091b5e33ca7ce686bc028bd5f5764690084ec58054f933db845ac5ef277ef2bfd168ed9dfddf545de232e9387d
-
C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.jsonFilesize
1KB
MD59b10974193ac5d3ca6543ea346b62590
SHA13b23b0d3c79388699c9838d8066d794f245b5be2
SHA256be712e84275a2ae29a9df225f3e5522832aea155859cb8c82c21a36409a2f03b
SHA5125f945bf281e4c67d9fd84b63082d890adb053d7b3f0f3f40120c8dcafcf7725d7ff056fa932c2a1f6a43f814332fd655c12bc276123bb0f8698e3868c7984684
-
C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.jsonFilesize
1KB
MD5d4e92aa1d2c6222d9c979cc4062028b0
SHA1b1d00a254519f3c48daaeb372c5eed158384027f
SHA25640d85bc89f7d2a4b1ac9a99e714914577ff8a41b4efe3f99967e0b6cce651ab4
SHA512ea6b57c003c5793f62bf92b46acd38e5a1d519f8575bab7fd7930c3c29d0f55d07b8c8c4eca65faa4778d36cec8a57643db26a38fdd2687a52df20b47466afee
-
C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.jsonFilesize
1KB
MD570a6404cd88bfa1f58279806a80431cd
SHA13766ee7dd1c42aa6e9ea3617cce66517621911f2
SHA256db6833cd865caff2173e9de19942f93157cb0eb2e4d05757fbaea2e90cd89ad2
SHA5125327dafc9e8edbd3a41ac30e74e9d4b7b9e272f13a8eb341d0b6baab9fa8e1f032bd81ba4d0ee64c57d1fb6e8eb230817d566c96749f0ecfd01ca46db7b55664
-
C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.jsonFilesize
1KB
MD5177969dba0f29e295886235f46d35c9e
SHA17e60f46478ff5b8972964bf8f098fa5bc63223e6
SHA2561333e8e316e1d9bfbe628b853686498799dcd0a7ecbaaeced3b242067219f7e1
SHA512473d36c448b86e9ee0511902cc8227e791fd95fedc5ec3fcdf7543a9717cf48fdf7d9f1db39ba80a577ee1dbcd1dbc8d1f1ebefe419b0f16af3df78aceb97c0f
-
C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.jsonFilesize
1KB
MD53380e8bac50f59d74399d2c39d510270
SHA12b6203c479ec83ce4d025bdcfb129e26f22d4ee4
SHA25696e244b256e5fc69e4156b310220c7207463f295af1f6f12050ac4d523a6b206
SHA512a623878869672569946a2ba454ebdb7b932955e4a2d86a09232d5ec0cfdb179cb77feb3877d2d2aa7e0aee55aafabaee2de193fb62c01e7c71ec4a838bf78012
-
C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.jsonFilesize
1KB
MD5dead6bee21403d60dbf737b174ad3b84
SHA103136c0167cf216bcbd3a5bc4599b128dc5c2163
SHA256b0c5cf8fae31d67fa18629234b0febfea33e7d82829eab81b9f84ee8eba5f079
SHA512730405cefa917b42e3a7e00a72e886126eb8ff5a81775cda6695436ee2f6ebed518df05895c1eba42c99ed9da83d5923b7a6e117fcd690deb21d0233a55c7a14
-
C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.jsonFilesize
1KB
MD578d5c6319901eab22aeb2657e753da73
SHA19408824b1475f3065d4f4fc88f255d05bd605210
SHA256e7504da17534d332ae50377a720b27395faa131cde8a1e030d56a76950d96c88
SHA512c7bb01c4722621965a8b634b43a13930be9efdd6f08063066df8220cb5bc2f8a0129f8b113cf19ce012fbe659a8c3b1176ef3d8fd049e8e3c4109982b603d606
-
C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.jsonFilesize
1KB
MD5d61bc268e2539ea4da5a6516102f6e53
SHA19b5c4966c8144c9f5ecaf142445c4879a0506ec1
SHA25666ba17cfe58a4378fc59e06990bc6d748c57b9a7cf3f63a2e381cf3d23e69526
SHA51242b26922d0487d93ba6947e96afec70982ee207ea094bddf87d5fe6c129fee8fe891842f8449b5d93662379f80184c059e699051b57196258633f2efbfef26c1
-
C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.jsonFilesize
1KB
MD52781fc62d3105f44bb887c8e79cec204
SHA18c89ed611543ebac186e8e8991d8604dd73f1132
SHA25612381f02e062eb9a49d4871e1dcd22c8b3f4cd5f6c7e460c1e0bc9a2a44b115b
SHA512f5f1c5b23f8ce5c8e9b62cdd3cd8c945ff80ee35dda2cb08233eff6a30886964b6c81c3964e7f9c1fc4ca3029543983d11a6934e5d1c16c2a559977f6764c2b2
-
C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json.bakFilesize
1KB
MD5c7db15aed24153441185608db3a8212d
SHA19b69b8524809b651becec26f392304238e4284f1
SHA256e5de7f0b12d8b5e10e90117c219c4b64a799244305e720ed01edcc807a084e91
SHA51234a8a148e0d421075fdf750cb3214cc1ce0ccb3a1fb3620c02c55fa331b60604fa403c581e460dddd4c7b386e2c9ec9bd268f5a078b1b47bc7de4b3a808cc4a3
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\Actions.dllFilesize
5.0MB
MD51eff53d95ecaf6bbfffe80d866d8e1dd
SHA1d7ef7d7c77fd04b2c0eb8c16bb3cd08057f6742f
SHA2566dd748f7ca56125cbe158fa3612f08e7312ef58ad5375e6b7ab5532cc16ca0ac
SHA512c59b8e6f0b238a247e64b9c7bb42213dadac1dada63542830a6292361174c935c0c662b2d1aed3fb6100cc4993297b1eaf25e328f2b4613458c4ffca63b9f02d
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\BrowserSDKDLL.dllFilesize
5.8MB
MD51ed53171d00f440f29a12f9beb84dac4
SHA14d9a1e3579b0999f1ab2fa818b588411e9ee920c
SHA256e659e687a872050f9e65d78992d16bd9b393cf3f8e8c94e0e15fb42b7065327e
SHA51217161cfc672d1b996b8af4ebac17f9a8a3807f38c9a23e2e5b4dadcd9a21c3a64faec9bf59147022a9df88b80f89300f1b537091289bd7a42806bd206a317e6e
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\Global.nmFilesize
336KB
MD56b72d8e773dbf1bf2dd3a295c47233ec
SHA109fd48564a9fd1a3cf17c7bb4f098060e72f4dfd
SHA2562b632d5c7c7d5cca88a4414f00f2586792cc1b62690438c84542a0cb8aa97183
SHA512d2a73b9504b3e222dffcdc2e1494d1fb3cc6d4a2dae93554a7617371e6d41e026243726351243275b90e9835283afca6b28a195aec3f25ef69790af2d6384059
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\Global.srFilesize
13.3MB
MD5a031e0e9af435a4e1cd0e0a116f2675c
SHA11b39a061bd431b4ef6639d42b00d8a4bbf7e198c
SHA2569fb5fea00f908d8ccef799cb9effc70a78ae3f0607400d3b8adb803985aa81a3
SHA512893bf2331bdd342d8f618642caf623a987ee96bcc9b2e5f02662fb64a7e1d82e267d88f373348043191cda9e3799f96282d36314c04ccfb472bd81cbcd9a934b
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\MBAMCore.dllFilesize
6.6MB
MD5f5326e215357788237b4c4e78248010b
SHA13fb03c85f0180dc60a9756b50b44e4a59f056be3
SHA2560d0525e66bae8605c0afa6b877ceee4c9b75be15c5c47ba8961041b3bdb848de
SHA51293f456a22d30fde2e5330573f6aa24b7b3ebc633fbb7171b135e4030c127b17c5e3cb2c9a56f62355070c9a6fde564144fe56e1674f5f0d905691e77854789ef
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\cfg.binFilesize
1KB
MD542dc081efeaeed00967fd339278d6c97
SHA16969f00e1bcb5423395fccc12584e46cabcda9db
SHA256dbaf53794113e4172f5c78d4b1ffdc0a2f1d7a35e5d8e8893f0c2b5d1a3f4bb9
SHA5127ca9cbbb9e9820d6fffe13709d42b90df1fe58060c7a8342c4d3ccb72fe063b3cfcae1797d4bfa897fcd4955bdb5e0fdd585a84c0f7b7479966df27c0245bd0c
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\clean.mbdbFilesize
10KB
MD5c0aab6fc915f7885f456850f8bdcbb20
SHA1f2b945285fe0fa658ba708b5df456bd4bb06e657
SHA25624fe328ed487f236846beb225aaee2e93dba48cb0f4e52f9d7d4e68c647bed0a
SHA512cc8d36f325e0b9a9a33525c6a7fe765b74b7f9d9aa758d9223ace5adcf530fec278fd2fac6d74d5a6a320afaa062ac4ad83b8d373b9e2448589f260ddb9c86b8
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\dbmanifest2.datFilesize
924B
MD573a07533b6b53c0870a334eed8783d92
SHA198f92f3ae589d5e1d5f7c7918361125415ad8f00
SHA25669ac234587e3c4877041ac962473d12e01c4def12659497689d59c846f277f23
SHA5123841c367ca8c0814385281fc626bb5372fddca13230d3cb1f9e86a350ab911d8f99d7dddb1f47e9eaad401a38b7cf3868e4dbf9cecd83b670beec382d2f74049
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\dynconfig.datFilesize
39KB
MD510f23e7c8c791b91c86cd966d67b7bc7
SHA13f596093b2bc33f7a2554818f8e41adbbd101961
SHA256008254ca1f4d6415da89d01a4292911de6135b42833156720a841a22685765dc
SHA5122d1b21371ada038323be412945994d030ee8a9007db072484724616c8597c6998a560bc28886ebf89e2c8919fb70d76c98338d88832351823027491c98d48118
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\exclusions.txtFilesize
23KB
MD5aef4eca7ee01bb1a146751c4d0510d2d
SHA15cf2273da41147126e5e1eabd3182f19304eea25
SHA2569e87e4c9da3337c63b7f0e6ed0eb71696121c74e18a5da577215e18097715e2f
SHA512d31d21e37b0048050b19600f8904354cff3f3ec8291c5a7a54267e14af9fb88dfb6d11e74a037cc0369ade8a8fb9b753861f3b3fb2219563e8ec359f66c042db
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\ig.exeFilesize
1.8MB
MD58b8dce48722a187976860c198d8f4d65
SHA1f9346d6f05b8f232552d26eaba71aa482e324f57
SHA25666035f0d7b5b3dac02e855e764f2a561480edaa4fc7e83cbc3c34c082b391969
SHA5123771dd731c0ff921d06daec013908fe64a10c8a526f517d359b0f3921c6626fd9af371d46751258134c698c3d1c001977d8b27f400c996344c78a5a530b199f8
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\mbdigsig2.datFilesize
514B
MD528b388df625f8e0779fc68442825be43
SHA16583556d98508b2727fe67acad8e76de380eadf1
SHA256596ca11c7278736ccc18bf639f4c64e1f367469b0ff638b4249a741c1ca1a8a0
SHA512008ba910cd3ac4dbf96699d51850575997a451f1e76b082d5d93850e52de86eb34b9d16c5fd0d25dceefed7c2b08e2b1e7cc4fe212d6fe3617a4988daf175567
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\prot.mbdbFilesize
24B
MD5546d9e30eadad8b22f5b3ffa875144bf
SHA13b323ffef009bfe0662c2bd30bb06af6dfc68e4d
SHA2566089fbf0c0c1413f62e91dc9497bedc6d8a271e9dc761e20adc0dccf6f4a0c1f
SHA5123478f5dcf7af549dd6fe48ad714604200de84a90120b16a32233b6d44fa7240f5f4e5fe803f54b86bbdfd10fa1bfdd88fb85eb6a78e23e426933f98d0a2565ec
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\rdefs.mbdbFilesize
24B
MD52f7423ca7c6a0f1339980f3c8c7de9f8
SHA1102c77faa28885354cfe6725d987bc23bc7108ba
SHA256850a4ea37a0fd6f68bf95422d502b2d1257264eb90cc38c0a3b1b95aa375be55
SHA512e922ac8a7a2cde6d387f8698207cf5efbd45b646986a090e3549d97a7d552dd74179bd7ac20b7d246ca49d340c4c168982c65b4749df760857810b2358e7eb69
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\rules.mbdbFilesize
9.1MB
MD524014deb879194625a9f962acccee727
SHA163dd7ce0fc60a1205cc687cf0040a770fcf6a636
SHA2563e5dfea32dc97a933fae80a1a45459b1c5711e7bd28d935a4340d3bffa5a1feb
SHA512e0aace86ec9196a1f711c6b75d93d69ffad16e35f84c357c677b109daa5a7c4a6699287659e9f78b2676230d496fa08c3f3384edbc9ec40b45b7f79eb8e8d9d5
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\sample.dllFilesize
528KB
MD50d964850f272eb25013c951e9d76c028
SHA1e581fb83527b84c4e55912a9f88107e9ddadfe6c
SHA2562974f71ff7763c6d4844dd67d139d137a85062fe8e8c111e75e7614ac8091b4e
SHA512a7c0e6252091240e33af64ff47208ed4a7c8e5be113fa4f36497280a0523c41e1096112a5fcf5290d61e36d414f970e9aff07a3a5b0ff586028dc4fd6b881f9c
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\scan.mbdbFilesize
1007KB
MD54ab2935bff4adc4ec36f57da0e42f776
SHA1e40e7d25af74c6ed560a2d4135748338fa3308a3
SHA256ba9f57fc12cfe4c379a69005ee7c4959ad3f7e70f32f967282f808a9ba31541b
SHA512d207cea8e73d6a27e13e2cf28d55d12a95bf867c2a74be5a7cba8069a6f64b47ed36a83832f44105b68fb7643877427a28b252f924ef640107567b90b97444a8
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\tids.mbdbFilesize
176KB
MD565c0d45b039c202a45de514a807ad73c
SHA18c7f0419aeb1f994e7278412d1384105c88008fd
SHA256bc55c025692bd716726d523b239021ae031423a48245b31788fa7b9c02347590
SHA5125f1adace978ba34dd5af86fb74903a43903cae1a9eb72b9f402512b957020452c5477c879c5ead102ce0de6970a4dc32004206a5a205ea37bacd2f21896e77b5
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\wprot2.mbdbFilesize
42.9MB
MD5ffcba7e4e3245c61bda01d94d7f8850b
SHA1e979ade715fab8a1b75610babea901b4c6765fbb
SHA256dc4155c3cf65d9655d0a2d2fa9d7f4e155e0018f6efc849a358488809bb0a953
SHA512539c2f23f2c0626c98797035e2f63db6c6cb888741cde456c9b0bc9a67eae88e4c85a3730db806b89e7770e7f3dffa058d1e4bd47efbc2b5982e285008efb284
-
C:\ProgramData\Malwarebytes\MBAMService\pkgvers.datFilesize
74B
MD52b72eaa94d5555c9febe59145f93807b
SHA1073072d3b089373b09c48e9f6296346addbad960
SHA256bb89ba590b3751d4567ba873f7d91ce3bec27fcafb6349fd4583cb8b7e935000
SHA512e83f6f33e483de0060a11c6477c9895b7882e6ad52ddcb10663315bad2074bb3e25bfbd32c9aa515ccdf7a838a51c41f73e78a44bc1d4418dbc961a1622ccaf1
-
C:\ProgramData\Malwarebytes\MBAMService\updatrpkg\SdkDbUpdatrV5.dllFilesize
2.9MB
MD588c7004e2905c38bab4f67aabf42ee11
SHA1bd0ff3228e1a320d251abb8a9edbfc9c9c5d2682
SHA2561a4ac7732739e9b50f96f623fd0236cf709778dc011bb35bdc304b2beda502ec
SHA512e534b9d37b306c881c9d69c7d24464bef4a94a6180b09c90c8cd5c22b20d27a0832db305a369e2fd9a227cac24128152ca1f5da30df0a0b2611f05024329faa0
-
C:\ProgramData\Malwarebytes\MBAMService\updatrpkg\expapply64.dllFilesize
365KB
MD599c8e47d747b36be8ffcfdd29b80dc3d
SHA19b8e87563fee31abf90bded22241f444b947b071
SHA2560db4dcdf3fbeef2c4d18555f479a28dde3d67ee6f0d27c18925207142b7a38f7
SHA512f9cf4ec06585c6cde57011884141782bde83adf186f57f75576c8dade1e868d6b886daf8fa15c55ac908ff995c4b6323c3a8266dbd664b807cd67cf788f7074e
-
C:\ProgramData\Malwarebytes\MBAMService\updatrpkg\mbupdatrV5.exeFilesize
5.6MB
MD59d3037c085f1e14bed13c66c46c53959
SHA134a083d5a9327155c068b63de898e842ebd0b1ea
SHA2566600f27bb087fca3adbcdfb9ad8c6a626c39f722de1019a9be81729f89dd67b9
SHA51268ba7db4b342ddc9a2774b64a303fc590e871ef732faf9bee1aeee8a625df877025c014d0277877bf6feec2c8b98aa4332e278bef63ebf84d6de8a716848e0d1
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\u5fl9cze.default-release\activity-stream.discovery_stream.json.tmpFilesize
21KB
MD559aaad7a28adf2f9c81bb80438c3caa7
SHA1fc36820bb4827f9207669ec5a5e419f7e564ca2d
SHA2568763f7e886b807dca9e61adcabe680d69134ccec8638b3152a0aac1298cd7fd1
SHA512dcceb36bd9862a1055b36f3a75df596f85968a9adf3058bad504ac47bf5de655487c1dcd0f105187ff50e88fb62b2ce480949a8ba4b56137deda7cb176cfa7f2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u5fl9cze.default-release\prefs.jsFilesize
6KB
MD50172bfd5eabe7e9da89cf2ab8e501a55
SHA14833278fb8db427567eca0f03224a2fd1bb141ec
SHA2568f39fc1a5d5e5a40b345b0c13035124758660e64d7ca98e41de118ee7b6ff77d
SHA51237be4861a38b71a46647a58404a07d68a127018c814d9438857ca46dd41bd16f1d5eb290d708d058853af899714e3914b7dbfa28d09d1dabdc398febe029207b
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u5fl9cze.default-release\prefs.jsFilesize
6KB
MD5afe5178d83dd986b2ca88d594badb4b0
SHA13d08a5809f4d1abc6bea70e7a569c90e7b449433
SHA256140b408dc107e75af259b4643824d2f8f5b4220fcc798e56ede0e9bafa39ed82
SHA5126482d3b80e442058acb5daf34645a5990af5d69b22d8646dc48ca9685a9fb2f44583a7676a6efd056a119649c13be506c9056f42c9cc21e66b59ea1f4cb2d622
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\u5fl9cze.default-release\sessionstore.jsonlz4Filesize
465B
MD5e76b9b2c9e59ad93aa7e71af77712cb7
SHA199e1dfa68048a2518039af5fc3c186fc698cb8c5
SHA2560c76f76c34b01c79af1bd2f1ccee72262cecde4fd244ac7c0f81487b873783f7
SHA5128bdfedb7b5726ef3b062d65ed084d7b47850e049f1087d5fcdcfb7233808e5bf809d3ece8df4c3ea90deb8ab56c1e1b3207f2e4ad5263039167e5bf67a98f558
-
C:\Windows\System32\CatRoot2\dberr.txtFilesize
184KB
MD514fbb0c60624db179a8c250a7f3ebeea
SHA1f9d75bec85648f3283cfcdb91efefacb3a31f2ae
SHA2567ca154c8e889477222de291d6914b0d19c14afb7538bda8538dcd30c2b198736
SHA512df1db818b1859173503761b7a226c4ab04179712fda62c40948257f5dd1cda368aa60f4e63feb0784fb88c59fb14218e3cb6e305df51920da32808afe966fe74
-
C:\Windows\Temp\MBInstallTemp0d71ebc0928611ee83e2eaa4a336bd08\ctlrpkg\mbae64.sysFilesize
154KB
MD595515708f41a7e283d6725506f56f6f2
SHA19afc20a19db3d2a75b6915d8d9af602c5218735e
SHA256321058a27d7462e55e39d253ad5d8b19a9acf754666400f82fe0542f33e733c6
SHA512d9230901adeecb13b1f92287abe9317cdac458348885b96ef6500960793a7586c76ae374df053be948a35b44abe934aa853975a6ccd3788f93909903cc718c08
-
C:\Windows\Temp\MBInstallTemp0d71ebc0928611ee83e2eaa4a336bd08\servicepkg\MBAMService.exeFilesize
8.9MB
MD5e4472f208d356ea4f562294ad8b82d93
SHA1b34bbadc349e722ef8b211f9205a610fed1f4a32
SHA256822957744702afdd6a571616da66f6c97a693d3a9e4b0c008f7f1614649a04d7
SHA512012c99ca3eb23f49ae916d2d7d62ff428b34ba0340cb6d9c3f80f292e115437f58b3a6bfcffb862f6e1caffa2a12b69bb3e7a56445ccf132cc48a6556290fc9d
-
C:\Windows\Temp\MBInstallTemp0d71ebc0928611ee83e2eaa4a336bd08\servicepkg\mbamelam.catFilesize
10KB
MD560608328775d6acf03eaab38407e5b7c
SHA19f63644893517286753f63ad6d01bc8bfacf79b1
SHA2563ed5a1668713ef80c2b5599b599f1434ad6648999f335cf69757ea3183c70c59
SHA5129f65212121b8a5d1a0625c3baa14ef04a33b091d26f543324333e38dcdb903e02ccc4d009e22c2e85d2f61d954e0b994c2896e52f685003a6ef34758f8a650c7
-
C:\Windows\Temp\MBInstallTemp0d71ebc0928611ee83e2eaa4a336bd08\servicepkg\mbamelam.infFilesize
2KB
MD5c481ad4dd1d91860335787aa61177932
SHA181633414c5bf5832a8584fb0740bc09596b9b66d
SHA256793626d240fd8eefc81b78a57c8dfe12ea247889b6f07918e9fd32a7411aa1c3
SHA512d292e028936412f07264837d4a321ecfa2f5754d4048c8bcf774a0e076e535b361c411301558609d64c71c1ce9b19e6041efa44d201237a7010c553751e1e830
-
C:\Windows\Temp\MBInstallTemp0d71ebc0928611ee83e2eaa4a336bd08\servicepkg\mbamelam.sysFilesize
20KB
MD59e77c51e14fa9a323ee1635dc74ecc07
SHA1a78bde0bd73260ce7af9cdc441af9db54d1637c2
SHA256b5619d758ae6a65c1663f065e53e6b68a00511e7d7accb3e07ed94bfd0b1ede0
SHA512a12ccf92bead694f5d3cba7ff7e731a2f862198efc338efc7f33a882fe0eb7499fb3fb533538d0a823e80631a7ca162962fbdfd78e401e3255672910b7140186
-
C:\Windows\Temp\MBInstallTemp0d71ebc0928611ee83e2eaa4a336bd08\servicepkg\mbshlext.dllFilesize
2.7MB
MD5b7e5071b317550d93258f7e1e13e7b6f
SHA12d08d78a5c29cf724bc523530d1a9014642bbc60
SHA256467de01d7cee7ec54166b80658ff22f9feebdb1c24eaf1629cf40e4124508064
SHA5129c35293c95c1a9141740ac99315605964aa37c4a42d3a11cae9e5649ff1427a9480d3d5e7f763212cf13db3511c5ea3c84e68f95f0067fe6339a9d3fb7b27c54
-
C:\Windows\Temp\MBInstallTemp0d71ebc0928611ee83e2eaa4a336bd08\uipkg\QtQuick\Controls.2\HorizontalHeaderView.qmlFilesize
1KB
MD5d8c9674c0e9bddbd8aa59a9d343cf462
SHA1490aa022ac31ddce86d5b62f913b23fbb0de27c2
SHA2561ef333b5fb4d8075973f312ef787237240b9f49f3f9185fb21202883f900e7d7
SHA5120b86ec673133f6400c38b79f9ba4f7b37ce5afdab1a2e34acbf75019e2590cc26b26d323ddc1567c91375053c9c8593be0615389db8eb1a8d1eb084ad4200b82
-
C:\Windows\Temp\MBInstallTemp0d71ebc0928611ee83e2eaa4a336bd08\uipkg\QtQuick\Controls.2\Imagine\VerticalHeaderView.qmlFilesize
1KB
MD5829769b2741d92df3c5d837eee64f297
SHA1f61c91436ca3420c4e9b94833839fd9c14024b69
SHA256489c02f8716e7a1de61834b3d8bbb61bce91ca4a33a6b62342b4c851d93e51e0
SHA5124061c271db37523b9dea9a9973226d91337e1809d4e7767e57ac938d35d77a302363ed92ab4be18c35ba589f528194ad71c93a8507449bf74dd035acf7cdb521
-
\Program Files\Malwarebytes\Anti-Malware\7z.dllFilesize
1.7MB
MD5461faf68ccc02b0223fd273b630f21fe
SHA1363b8beaa74f0f454c2d544ace9e71a84bc2b4cf
SHA256cb07f3f461e9c267831b1ab93af6dfda1bb51d72e42d73d00d26594f09326be1
SHA5124b671f48e45fdedf50c7f7bb6c8d82a3b98f7502006eb002aaf8ff31f25f9ff1257c7bcc12caf622e43d4ec665b19d978ae3e3762f76def0bc71485ebdb8426f
-
\Program Files\Malwarebytes\Anti-Malware\Actions.dllFilesize
5.0MB
MD51eff53d95ecaf6bbfffe80d866d8e1dd
SHA1d7ef7d7c77fd04b2c0eb8c16bb3cd08057f6742f
SHA2566dd748f7ca56125cbe158fa3612f08e7312ef58ad5375e6b7ab5532cc16ca0ac
SHA512c59b8e6f0b238a247e64b9c7bb42213dadac1dada63542830a6292361174c935c0c662b2d1aed3fb6100cc4993297b1eaf25e328f2b4613458c4ffca63b9f02d
-
\Program Files\Malwarebytes\Anti-Malware\ActionsShim.dllFilesize
2.5MB
MD558149edf4990067b4c1ffe1c32a51a01
SHA180c0c8b8def45420159659d2eaad181eb0b05c40
SHA25667af73f9b49ce113d02d7f2824e45d48044273772c94e6e8c300cf86bf83cb55
SHA512fe69f4eccaa35b132b7dfc77fae50733398cfa5ab7377f502a50e1bb83be6b81fad26a0a24f6dfbc99dca6e118784f3452edc4a30c11ac161fc0db62b039cb4e
-
\Program Files\Malwarebytes\Anti-Malware\CleanControllerImpl.dllFilesize
6.9MB
MD591153bf872114d85ee3144833ab5a2d4
SHA1935769a4c62a117907c295d85efeaf36412244e8
SHA256c4ab4bbbca3a557aa716986fdaca0ec7cf60577a4047009217ad22363bec8c09
SHA512abb79fddd10cf984d642e1451f0ad4a1d735cb02d5dc57fd2e4f23523e6f77fe02bb1ff732f59cfc52a09490816c5ab4a5cc631c7754e49f6167a0ec1e572510
-
\Program Files\Malwarebytes\Anti-Malware\CloudControllerImpl.dllFilesize
4.8MB
MD5d739c6bd5d5cae2ae961a0c2d40eb5b1
SHA116d0d40707bf55f04a0da70798b5368e612fd5e6
SHA25625472857a59a9067c1224b173b378448bb574f5365edbe4a1a46df8810007f9a
SHA5127d80a39f3a91e0faa87ae8143f43d2e8947eaedfd317a1ac1547dfa15b825cc5c200f8baebe127a0bc2379fe90c40f3ea25db09c06b521aad1c189ce24a53c7d
-
\Program Files\Malwarebytes\Anti-Malware\LicenseControllerImpl.dllFilesize
4.4MB
MD565e42cbe095830d9d93ecabb13392780
SHA1e60110e159cc4cc92d2606ae3ba3559c10170e5a
SHA256a773e1706bbb6e8cb522d0e1a3d29e496bcbe6a91e221c26bea98292b9316f7f
SHA5126b25cebb6433ec87831a3f0f67b96c7fc37a617158a18d9ac20bd375f46c97da8a41e4379da72808fdd7947705c6c09518c56152f96eebf2bcefb39ffa6202ed
-
\Program Files\Malwarebytes\Anti-Malware\MBAMShim.dllFilesize
3.0MB
MD5f44b6c80c46c4cf3071b5f5b916e1271
SHA1839f2238ecbbfa80ebf9c1f77eafc78204b58761
SHA256732523df43358729d5e85cceb557d69016dcdd3e2238d903c33c5327c3131fae
SHA51299be164ae96bc4f93dc896d5df445ad1c2f023f10605a8c9857d7ebedfc5b070f50cd33b401d61003e601a06b8446e6c0b5dbddda4927a2e1352407d3b266942
-
\Program Files\Malwarebytes\Anti-Malware\PoliciesControllerImpl.dllFilesize
4.0MB
MD5a343e23fb8bd09e65225b654af948a88
SHA1a61b1685127aa909cad84babfefaa26a382fe12b
SHA25692b73eb638f5d7dc78a93a63145fa7e2e6397a220aff59cbace9f44a427982c0
SHA512312967286d9534dd37105bf329f2d39c4563f6c09868370c3fde582c07cfda90c2a19b1a759c2eac178aa4a7029383836c0d8805aab41ea55deb31ebff5083c2
-
\Program Files\Malwarebytes\Anti-Malware\ScanControllerImpl.dllFilesize
5.7MB
MD5325cb58e19d485e479945837d7f8c1f8
SHA16102985f07a589eb81badf9aeb66670e7469cc4b
SHA256faded97793f72b925053fad2efcfff9c0e1aea5cded6b1838652a1f86fe4bc5a
SHA5126bbc6129c197d7dbb2b1a8152b2339f54fddeb9fee3a55099d148172ec0b7c9d1102d5315fe885e8264d8b39bae1864d2a825a9ac78bdcc671d6eae8e9de1228
-
\Program Files\Malwarebytes\Anti-Malware\Swissarmy.dllFilesize
4.0MB
MD5ae8affa9f5cbf51211132b0146bada81
SHA1912f5d4879047dd2c84e40689dd87fbebeff94aa
SHA25616b70ec44567e4b20216c3906fc40e26671078ee58c50f3fe1b1be8d3b521316
SHA5120b512a695430f433cfc488098ee1e965dcac2b1e0f80d3597858d32fcf6565c2e12135fb7ad2ea266e17c26a802192f47b603413740eccc478000db94aef5397
-
\Program Files\Malwarebytes\Anti-Malware\SwissarmyShim.dllFilesize
2.6MB
MD5cff3e356609f66039d7c732b2e7a3c2f
SHA1149741b831d7ec985e12ecb177040e98e6282f36
SHA2562a4a95dff26010278a6d5174dde2ae23269905534be788e3d2fce7baa53f35c3
SHA512dc9c4c78c7c43cb3b87a2bbaa7a19e9b57b3ca8df94dfa1a7657ae18a12fccd8b4cc8a9ae1aeb8457272c226e09f251ffd4922af78346e000727457693b5dd73
-
\Program Files\Malwarebytes\Anti-Malware\TelemetryControllerImpl.dllFilesize
5.3MB
MD5c656aeb7dfd645746d1077fcfa3fe5ec
SHA134cb10804d31cd808376a91a7b7a650ae9c34a43
SHA256f08752a9ef44bdd09d1c3bec0a30db3364c501d1742782da9312b08ce88ab5b6
SHA512689fd6b87e71ac229d2829f32112f23fb05198b46322ad60e252a2127796f90ab11d2c9aab4fc160cbc404533c0ff9a3b97bcadcc1f91ec5af977413a3280121
-
\Program Files\Malwarebytes\Anti-Malware\UpdateControllerImpl.dllFilesize
4.4MB
MD51fb6a6c92affd0b5e5609f8c978abfb9
SHA1413ac37b4aa6268d1b65b559cc264bc95a204dfc
SHA256ec25b45819d48001ffb178f38292acde49369289335802a59eb6d9071a018936
SHA512885cf1f3d8b2e795db288291f2e6256b38fe8f3b79a276a59f013dd9d1200c1ecfcf537d9f889a488713d6b35753332c22b553ea8f1156f5a6379e23b2633dcb
-
\Program Files\Malwarebytes\Anti-Malware\mbshlext.dllFilesize
2.7MB
MD5b7e5071b317550d93258f7e1e13e7b6f
SHA12d08d78a5c29cf724bc523530d1a9014642bbc60
SHA256467de01d7cee7ec54166b80658ff22f9feebdb1c24eaf1629cf40e4124508064
SHA5129c35293c95c1a9141740ac99315605964aa37c4a42d3a11cae9e5649ff1427a9480d3d5e7f763212cf13db3511c5ea3c84e68f95f0067fe6339a9d3fb7b27c54
-
\Program Files\Malwarebytes\Anti-Malware\offreg.dllFilesize
114KB
MD516663d125398773a90d0a53333b7cf5e
SHA1f92928ae3c9292588547ceaca1cb1d372bfd7936
SHA25638e6811b47262101759aa51a631263d9e3eee5d211164318a751e078afec4cbc
SHA512091764b8ad80aa31eea0bbd91ee505ebdea2654bc8aeaa3081a061d0d37ab13d27dd203075fd0de10c6687591aa0e36139a38af846c4e34e6aa67ab81dc277df
-
\Windows\Temp\MBInstallTemp0d71ebc0928611ee83e2eaa4a336bd08\7z.dllFilesize
1.6MB
MD5ab8f0c1a37c0df5c8924aab509db42c9
SHA153dba959124e6d740829bda2360e851bcb85cce8
SHA2566e223b275b84d948cc5ae1f161f0bfff2adb34de04634c84d7dbe9305a4998d5
SHA512ff8a26e8fd5a08c74e5ba93a564e0d3cd932754e7f06993a365bfad06670497889e69ec45bfba1378040b72f82d468e79682beba2439937bb29d2a41da940d4a
-
\Windows\Temp\MBInstallTemp0d71ebc0928611ee83e2eaa4a336bd08\7z.dllFilesize
1.6MB
MD5ab8f0c1a37c0df5c8924aab509db42c9
SHA153dba959124e6d740829bda2360e851bcb85cce8
SHA2566e223b275b84d948cc5ae1f161f0bfff2adb34de04634c84d7dbe9305a4998d5
SHA512ff8a26e8fd5a08c74e5ba93a564e0d3cd932754e7f06993a365bfad06670497889e69ec45bfba1378040b72f82d468e79682beba2439937bb29d2a41da940d4a
-
memory/2796-4357-0x00007FF778490000-0x00007FF779B54000-memory.dmpFilesize
22.8MB
-
memory/2796-4362-0x0000020739CE0000-0x0000020739CF0000-memory.dmpFilesize
64KB
-
memory/2796-4359-0x00007FFF22D50000-0x00007FFF232BB000-memory.dmpFilesize
5.4MB
-
memory/2796-4358-0x00007FFF232C0000-0x00007FFF236DE000-memory.dmpFilesize
4.1MB
-
memory/2796-4445-0x0000020739CE0000-0x0000020739CF0000-memory.dmpFilesize
64KB
-
memory/5388-4121-0x0000021FCFBC0000-0x0000021FCFDC0000-memory.dmpFilesize
2.0MB
-
memory/5388-4119-0x0000021FD02A0000-0x0000021FD06E0000-memory.dmpFilesize
4.2MB
-
memory/5388-4118-0x0000021FCF600000-0x0000021FCF610000-memory.dmpFilesize
64KB
-
memory/5388-4117-0x00007FFF22D50000-0x00007FFF232BB000-memory.dmpFilesize
5.4MB
-
memory/5388-4116-0x00007FFF232C0000-0x00007FFF236DE000-memory.dmpFilesize
4.1MB