Analysis
-
max time kernel
306s -
max time network
367s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
19-01-2024 01:28
Static task
static1
Behavioral task
behavioral1
Sample
MBSetup.exe
Resource
win10v2004-20231215-en
Errors
General
-
Target
MBSetup.exe
-
Size
2.5MB
-
MD5
1e885823577394ea61ea89438ffe2954
-
SHA1
e53e96f7374790bdad8a614949b398b055c3a27b
-
SHA256
7c0b9bceed390f7f28135431c09ac51469ee8e2b8095fb36a37315d811d9ba9c
-
SHA512
73f600833dad0047b6444110d722dc95237b38bb486abc7fc8e4f59b69e2154c885fb46d65f488d5139a0b6e76ebde33ea72711c7f58436650ef992fb8995627
-
SSDEEP
49152:Lw3ye9SPQ1sjDAVj+JeRanStQyfvE0Z3R0nxiIq2ddAsuysSiSF:4yeoCVj+c6KtQRq2ADSiSF
Malware Config
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
MBSetup.exedescription pid process target process PID 4604 created 3444 4604 MBSetup.exe Explorer.EXE -
Drops file in Drivers directory 6 IoCs
Processes:
MBSetup.exeMBAMInstallerService.exeMBAMService.exeMBAMService.exedescription ioc process File created C:\Windows\SysWOW64\drivers\mbamtestfile.dat MBSetup.exe File created C:\Windows\system32\drivers\mbae64.sys MBAMInstallerService.exe File created C:\Windows\system32\DRIVERS\MbamElam.sys MBAMService.exe File opened for modification C:\Windows\system32\DRIVERS\MbamElam.sys MBAMService.exe File created C:\Windows\system32\DRIVERS\mbamswissarmy.sys MBAMService.exe File created C:\Windows\system32\DRIVERS\MbamChameleon.sys MBAMService.exe -
Modifies RDP port number used by Windows 1 TTPs
-
Sets service image path in registry 2 TTPs 2 IoCs
Processes:
MBAMService.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MBAMSwissArmy\ImagePath = "\\SystemRoot\\System32\\Drivers\\mbamswissarmy.sys" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mbamchameleon\ImagePath = "\\SystemRoot\\System32\\Drivers\\MbamChameleon.sys" MBAMService.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
MBSetup.exeMBAMService.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion MBSetup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate MBSetup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion MBAMService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate MBAMService.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Downloads MZ/PE file
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
MBAMService.exeMBAMInstallerService.exedescription ioc process File opened (read-only) \??\E: MBAMService.exe File opened (read-only) \??\S: MBAMService.exe File opened (read-only) \??\A: MBAMInstallerService.exe File opened (read-only) \??\G: MBAMInstallerService.exe File opened (read-only) \??\V: MBAMService.exe File opened (read-only) \??\K: MBAMInstallerService.exe File opened (read-only) \??\Q: MBAMInstallerService.exe File opened (read-only) \??\T: MBAMInstallerService.exe File opened (read-only) \??\H: MBAMService.exe File opened (read-only) \??\J: MBAMService.exe File opened (read-only) \??\O: MBAMService.exe File opened (read-only) \??\R: MBAMService.exe File opened (read-only) \??\U: MBAMInstallerService.exe File opened (read-only) \??\N: MBAMInstallerService.exe File opened (read-only) \??\S: MBAMInstallerService.exe File opened (read-only) \??\Z: MBAMInstallerService.exe File opened (read-only) \??\M: MBAMService.exe File opened (read-only) \??\T: MBAMService.exe File opened (read-only) \??\B: MBAMInstallerService.exe File opened (read-only) \??\M: MBAMInstallerService.exe File opened (read-only) \??\X: MBAMService.exe File opened (read-only) \??\L: MBAMInstallerService.exe File opened (read-only) \??\W: MBAMInstallerService.exe File opened (read-only) \??\A: MBAMService.exe File opened (read-only) \??\Q: MBAMService.exe File opened (read-only) \??\W: MBAMService.exe File opened (read-only) \??\Z: MBAMService.exe File opened (read-only) \??\P: MBAMInstallerService.exe File opened (read-only) \??\R: MBAMInstallerService.exe File opened (read-only) \??\X: MBAMInstallerService.exe File opened (read-only) \??\B: MBAMService.exe File opened (read-only) \??\K: MBAMService.exe File opened (read-only) \??\Y: MBAMService.exe File opened (read-only) \??\E: MBAMInstallerService.exe File opened (read-only) \??\J: MBAMInstallerService.exe File opened (read-only) \??\O: MBAMInstallerService.exe File opened (read-only) \??\V: MBAMInstallerService.exe File opened (read-only) \??\L: MBAMService.exe File opened (read-only) \??\N: MBAMService.exe File opened (read-only) \??\U: MBAMService.exe File opened (read-only) \??\I: MBAMInstallerService.exe File opened (read-only) \??\Y: MBAMInstallerService.exe File opened (read-only) \??\G: MBAMService.exe File opened (read-only) \??\I: MBAMService.exe File opened (read-only) \??\P: MBAMService.exe File opened (read-only) \??\H: MBAMInstallerService.exe -
Drops file in System32 directory 2 IoCs
Processes:
MBAMService.exeMBAMService.exedescription ioc process File opened for modification C:\Windows\System32\CatRoot2\dberr.txt MBAMService.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt MBAMService.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 64 IoCs
Processes:
MBAMInstallerService.exeMBAMService.exedescription ioc process File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Base\TextFieldStyle.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Desktop\RowItemSingleton.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Imagine\Switch.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Material\TextField.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Layouts\qmldir MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Imagine\VerticalHeaderView.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Material\qqc2materialstyleplugin.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\RoundButton.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\CloudControllerImpl.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\api-ms-win-crt-convert-l1-1-0.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\StackViewDelegate.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Base\images\editbox.png MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Imagine\SplitView.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\SpinBox.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Universal\Button.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Button.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Fusion\PageIndicator.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Fusion\SliderGroove.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Imagine\Button.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Material\RadioIndicator.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\RTPControllerImpl.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\SelfProtectionSdk.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\api-ms-win-core-debug-l1-1-0.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\styles\qwindowsvistastyle.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Base\images\[email protected] MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick.2\qtquick2plugin.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\api-ms-win-core-libraryloader-l1-1-0.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Desktop\ToolButtonStyle.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Material\TabBar.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\PrivateWidgets\qmldir MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Fusion\GroupBox.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\api-ms-win-core-console-l1-1-0.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\api-ms-win-core-namedpipe-l1-1-0.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\api-ms-win-core-sysinfo-l1-1-0.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Base\images\focusframe.png MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\TextArea.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\vcruntime140.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Base\images\scrollbar-handle-horizontal.png MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Frame.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Dialogs\qmldir MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Extras\Private\TextSingleton.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\BusyIndicator.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Material\DialogButtonBox.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Material\ScrollBar.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\languages\lang_pt_BR.qm MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\UpdateControllerImpl.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\api-ms-win-crt-string-l1-1-0.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Desktop\GroupBoxStyle.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Flat\qmldir MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Material\SliderHandle.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\languages\lang_ru.qm MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Imagine\TabButton.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Fusion\RadioButton.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\ItemDelegate.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Extras\Tumbler.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\resources\qtwebengine_resources.pak MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\MenuBar.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\SpinBox.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.inf MBAMService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Fusion\Pane.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Imagine\TextArea.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Material\ProgressBar.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\Qt5Charts.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\api-ms-win-core-util-l1-1-0.dll MBAMInstallerService.exe -
Executes dropped EXE 5 IoCs
Processes:
MBAMInstallerService.exeMBAMService.exeMBAMService.exembamtray.exembam.exepid process 2744 MBAMInstallerService.exe 2556 MBAMService.exe 1272 MBAMService.exe 3684 mbamtray.exe 2768 mbam.exe -
Loads dropped DLL 64 IoCs
Processes:
MBAMInstallerService.exeMBAMService.exembamtray.exembam.exepid process 2744 MBAMInstallerService.exe 2744 MBAMInstallerService.exe 1272 MBAMService.exe 1272 MBAMService.exe 1272 MBAMService.exe 1272 MBAMService.exe 1272 MBAMService.exe 1272 MBAMService.exe 1272 MBAMService.exe 1272 MBAMService.exe 1272 MBAMService.exe 1272 MBAMService.exe 1272 MBAMService.exe 1272 MBAMService.exe 1272 MBAMService.exe 1272 MBAMService.exe 1272 MBAMService.exe 1272 MBAMService.exe 1272 MBAMService.exe 1272 MBAMService.exe 1272 MBAMService.exe 1272 MBAMService.exe 1272 MBAMService.exe 1272 MBAMService.exe 1272 MBAMService.exe 1272 MBAMService.exe 1272 MBAMService.exe 2744 MBAMInstallerService.exe 3684 mbamtray.exe 3684 mbamtray.exe 3684 mbamtray.exe 3684 mbamtray.exe 3684 mbamtray.exe 3684 mbamtray.exe 3684 mbamtray.exe 3684 mbamtray.exe 3684 mbamtray.exe 3684 mbamtray.exe 3684 mbamtray.exe 3684 mbamtray.exe 3684 mbamtray.exe 3684 mbamtray.exe 3684 mbamtray.exe 3684 mbamtray.exe 3684 mbamtray.exe 3684 mbamtray.exe 3684 mbamtray.exe 3684 mbamtray.exe 3684 mbamtray.exe 3684 mbamtray.exe 3684 mbamtray.exe 3684 mbamtray.exe 3684 mbamtray.exe 3684 mbamtray.exe 3684 mbamtray.exe 3684 mbamtray.exe 3684 mbamtray.exe 3684 mbamtray.exe 3684 mbamtray.exe 3684 mbamtray.exe 3684 mbamtray.exe 3684 mbamtray.exe 2768 mbam.exe 2768 mbam.exe -
Registers COM server for autorun 1 TTPs 64 IoCs
Processes:
MBAMService.exeMBAMService.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE8A9269-9E6E-4683-BCD3-41E9B16696DC}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36A65E46-6CC1-4CA2-B51E-F4DD8C993DDC}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE8A9269-9E6E-4683-BCD3-41E9B16696DC}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{03141A2A-5C3A-458E-ABEC-0812AD7FF497}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36A65E46-6CC1-4CA2-B51E-F4DD8C993DDC}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F415899A-1576-4C8B-BC9F-4854781F8A20}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BF474111-9116-45C6-AF53-209E64F1BB53}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E1AC7139-D1FF-4DE9-84A4-92E2B47F5D2A}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{130CD414-6BFD-4F6C-9362-A2264B222E76}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{17BE78EE-B40A-4B9E-835F-38EC62F9D479}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{580243BF-3CEE-4131-A599-C6FED66BEB1B}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F1C46F8-E697-4175-B240-CDE682A4BA2D}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E1AC7139-D1FF-4DE9-84A4-92E2B47F5D2A}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{17BE78EE-B40A-4B9E-835F-38EC62F9D479}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9DAB0CA5-AE19-41AE-955C-41DD44C52697}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F36AD0D0-B5F0-4C69-AF08-603D177FEF0E}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F36AD0D0-B5F0-4C69-AF08-603D177FEF0E}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{251AD013-20AD-4C3F-8FE2-F66A429B4819}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{251AD013-20AD-4C3F-8FE2-F66A429B4819}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{03141A2A-5C3A-458E-ABEC-0812AD7FF497}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{376BE474-56D4-4177-BB4E-5610156F36C8}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F36AD0D0-B5F0-4C69-AF08-603D177FEF0E}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{278637DA-FDFB-45C7-8CD8-F2D8A9199AB0}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BF474111-9116-45C6-AF53-209E64F1BB53}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D5599B6B-FA0C-45B5-8309-853B003EA412}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36A65E46-6CC1-4CA2-B51E-F4DD8C993DDC}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57CE581A-0CB6-4266-9CA0-19364C90A0B3}\InprocServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{11D1E5E8-14E1-4B5B-AE1A-2678CB91E8E5}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{130CD414-6BFD-4F6C-9362-A2264B222E76}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{03141A2A-5C3A-458E-ABEC-0812AD7FF497}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57CE581A-0CB6-4266-9CA0-19364C90A0B3}\InprocServer32\ThreadingModel = "Apartment" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F415899A-1576-4C8B-BC9F-4854781F8A20}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E1AC7139-D1FF-4DE9-84A4-92E2B47F5D2A}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57CE581A-0CB6-4266-9CA0-19364C90A0B3}\InprocServer32\ = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbshlext.dll" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{11D1E5E8-14E1-4B5B-AE1A-2678CB91E8E5}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{376BE474-56D4-4177-BB4E-5610156F36C8}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DE03E614-112D-43E0-8E15-E7236CC32108}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{11D1E5E8-14E1-4B5B-AE1A-2678CB91E8E5}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F1C46F8-E697-4175-B240-CDE682A4BA2D}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{17BE78EE-B40A-4B9E-835F-38EC62F9D479}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{251AD013-20AD-4C3F-8FE2-F66A429B4819}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D372F21-E6DA-4B82-881A-79F6CA6B6AE1}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{376BE474-56D4-4177-BB4E-5610156F36C8}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9DAB0CA5-AE19-41AE-955C-41DD44C52697}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F415899A-1576-4C8B-BC9F-4854781F8A20}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{580243BF-3CEE-4131-A599-C6FED66BEB1B}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{580243BF-3CEE-4131-A599-C6FED66BEB1B}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F36AD0D0-B5F0-4C69-AF08-603D177FEF0E}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE8A9269-9E6E-4683-BCD3-41E9B16696DC}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DE03E614-112D-43E0-8E15-E7236CC32108}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F6D29500-933C-447C-9D88-9D814AF73808}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{278637DA-FDFB-45C7-8CD8-F2D8A9199AB0}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{278637DA-FDFB-45C7-8CD8-F2D8A9199AB0}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D372F21-E6DA-4B82-881A-79F6CA6B6AE1}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F6D29500-933C-447C-9D88-9D814AF73808}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F6D29500-933C-447C-9D88-9D814AF73808}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BF474111-9116-45C6-AF53-209E64F1BB53}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F1C46F8-E697-4175-B240-CDE682A4BA2D}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D5599B6B-FA0C-45B5-8309-853B003EA412}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9DAB0CA5-AE19-41AE-955C-41DD44C52697}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D372F21-E6DA-4B82-881A-79F6CA6B6AE1}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D5599B6B-FA0C-45B5-8309-853B003EA412}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DE03E614-112D-43E0-8E15-E7236CC32108}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{130CD414-6BFD-4F6C-9362-A2264B222E76}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
MBAMService.exedescription ioc process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MBAMService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MBAMService.exe -
Processes:
MBAMInstallerService.exeMBAMService.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\mbam.exe = "11000" MBAMInstallerService.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\mbamtray.exe = "11000" MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION MBAMService.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\mbam.exe = "11000" MBAMService.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\mbamtray.exe = "11000" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION MBAMInstallerService.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
MBAMInstallerService.exeMBAMService.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT MBAMInstallerService.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:\ MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\16.0\Common MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\16.0\Common\Security MBAMInstallerService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: MBAMInstallerService.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:\ MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0\Common MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\Software MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft MBAMInstallerService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MBAMService.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0 MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\Software MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\15.0\Common\Security MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\15.0\Common\Security MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs MBAMService.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Malwarebytes MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\15.0\Common MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\16.0\Common MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\16.0\Common MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs MBAMService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\15.0 MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\16.0 MBAMInstallerService.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:\ MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\16.0\Common\Security MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT MBAMService.exe Set value (str) \REGISTRY\USER\S-1-5-19\SOFTWARE\Malwarebytes\FirstRun = "false" MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0\Common\Security MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\15.0\Common MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\MY MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols MBAMInstallerService.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:\ MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: MBAMInstallerService.exe -
Modifies registry class 64 IoCs
Processes:
MBAMService.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BF474111-9116-45C6-AF53-209E64F1BB53}\Version MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8C842243-BDAD-4A93-B282-93E3FCBC1CA4}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{55E4B8FB-921C-4751-8B2D-AE33BD7D0B74} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{767D2042-D2F6-4BAA-B30E-00E0CD4015BD}\TypeLib\ = "{A23C190D-C714-42C7-BDBB-F4E1DE65AF27}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{616E9BE3-358B-4C06-8AAB-0ACF8D089931}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C367B540-CEF4-4271-8395-0C28F0FDADDA}\TypeLib\ = "{0E2822AB-0447-4F28-AF4C-FFDB1E8595AE}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE8A9269-9E6E-4683-BCD3-41E9B16696DC}\Version MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3498D9E4-6476-4AC0-B53A-75BC9955EF37}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2A153977-1A37-4EF7-9226-9E128FA51AE1}\ = "ITelemetryControllerV5" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FFBD938D-3ABA-4895-97EF-5A0BDF7AC07D}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1C5B86F3-CEB8-44E3-9B83-6F6AF035E872}\TypeLib\ = "{783B187E-360F-419C-B6DA-592892764A01}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31A02CB9-6064-4A3B-BCB4-A329528D4648}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{81541635-736E-4460-81AA-86118F313CD5}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F49090F8-7DC6-4CBC-893A-C1B3DCF88D87}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{62A3C5F3-503F-4205-A044-5EA683BEDABE}\ = "IMWACControllerEventsV7" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2E3F70EF-D9BE-485F-A6F5-816DD0EDC757}\ = "IRTPControllerV16" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{61DF8ACF-EC61-4D69-A543-20EA450E1A84}\TypeLib\ = "{59DBD1B8-A7BD-4322-998F-41B0D2516FA0}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2A0F9375-1809-45ED-AFE0-92852B971139}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A583D5DD-F005-4D17-B564-5B594BB58339}\TypeLib\Version = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7995CBA9-83E0-4F28-A50B-DFDE85EBCCD1}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{40D6E119-3897-41B3-AC5D-5FE6F088C97B} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{560EB17C-4365-4DFC-A855-F99B223F02AF}\ = "IScannerEventsV3" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3968399C-D098-40AF-9700-734B46FF03C9}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B1BDE8B0-F598-4334-9991-ECC7442EEAA6}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B1D8E799-D5A2-45B4-9524-067144A201E4}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5BA2811A-EE5B-44DF-81CD-C75BB11A82D4}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0C30B7D9-82A1-4068-8A5B-F4C7D5EF75A3}\ = "IScanControllerEventsV14" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9F798C4B-4059-46F9-A0FE-F6B1664ADE96} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E46A48DF-07CC-4C7F-89BB-145CF0DFC60A}\ = "IMWACControllerV15" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{698A4513-65F0-46A3-9633-220A6E4D1D07}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4412646D-16F5-4F3C-8348-0744CDEBCCBF}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{735BE2C0-5A9B-457A-A0A9-4B27FCED2817}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B471ACFB-E67A-4BE9-A328-F6A906DDDEAA}\ProxyStubClsid32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CFFF19F6-ECFE-446D-ACAD-8DC525DA2563}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A993F934-6341-4D52-AB17-F93184A624E4} MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EEC295FA-EC51-4055-BC47-022FC0FC122F} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6ED2B0A1-984E-4A35-9B04-E0EBAFB2842A}\TypeLib\ = "{5709DEEB-F05E-4D5C-8DC4-3B0D924EE08F}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{63A6AB57-4679-4529-B78D-143547B22799}\ = "_ICleanControllerEventsV2" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{49F6AC60-2104-42C6-8F71-B3916D5AA732}\1.0 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B1790AB-65B0-4F50-812F-7CC86FA94AF7}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6CE18DD5-2BD7-4844-B9AD-DF6A995750A1}\ProxyStubClsid32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F927AD37-BA5F-4B86-AE22-FE2371B12955} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5D448EF3-7261-4C0C-909C-6D56043C259D}\ = "IScanControllerV14" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0E64B3CF-7D56-4F76-8B9F-A6CD0D3393AE}\TypeLib\ = "{5709DEEB-F05E-4D5C-8DC4-3B0D924EE08F}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{36BABBB6-6184-44EC-8109-76CBF522C9EF} MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{893E5593-9490-4E90-9F1E-0B786EC41470} MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1E3F0FEC-3E40-4137-8C7D-090AFA9B6C5E}\ProxyStubClsid32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B9F73DD6-F2A4-40F8-9109-67F6BB8D3704}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4163399F-AB08-4E5E-BE28-6B9440393AD3}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D5599B6B-FA0C-45B5-8309-853B003EA412}\AppID = "{1F7896AD-8886-42CD-8ABD-7A1315A3A5F2}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4E0987E3-3699-4C92-8E76-CAEDA00FA44C}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1E3F0FEC-3E40-4137-8C7D-090AFA9B6C5E}\TypeLib\Version = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{62A3C5F3-503F-4205-A044-5EA683BEDABE} MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8FF168C7-A609-4237-A076-E461334BF4EA} MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0070F531-5D6B-4302-ACA0-6920E95D9A31}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{17A7CC72-3288-442A-ABE8-F8E049B3BE83}\TypeLib\ = "{74630AE8-C170-4A8F-A90A-F42D63EFE1E8}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MB.ArwController\ = "ArwController Class" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{251AD013-20AD-4C3F-8FE2-F66A429B4819}\VersionIndependentProgID\ = "MB.LogController" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9DAB0CA5-AE19-41AE-955C-41DD44C52697}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F36AD0D0-B5F0-4C69-AF08-603D177FEF0E}\ProgID MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5709DEEB-F05E-4D5C-8DC4-3B0D924EE08F}\1.0\0 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C0CEAFA7-4F65-418C-8A61-92B2048115EE}\ProxyStubClsid32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6696D5DD-4143-482C-ABF4-3B215CF3DBFC}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6CE18DD5-2BD7-4844-B9AD-DF6A995750A1} MBAMService.exe -
Processes:
MBAMInstallerService.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\1C58A3A8518E8759BF075B76B750D4F2DF264FCD MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\1C58A3A8518E8759BF075B76B750D4F2DF264FCD\Blob = 0300000001000000140000001c58a3a8518e8759bf075b76b750d4f2df264fcd2000000001000000c2040000308204be308203a6a003020102021006d8d904d5584346f68a2fa754227ec4300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3231303431343030303030305a170d3331303431333233353935395a304f310b300906035504061302555331153013060355040a130c446967694365727420496e633129302706035504031320446967694365727420544c53205253412053484132353620323032302043413130820122300d06092a864886f70d01010105000382010f003082010a0282010100c14bb3654770bcdd4f58dbec9cedc366e51f311354ad4a66461f2c0aec6407e52edcdcb90a20eddfe3c4d09e9aa97a1d8288e51156db1e9f58c251e72c340d2ed292e156cbf1795fb3bb87ca25037b9a52416610604f571349f0e8376783dfe7d34b674c2251a6df0e9910ed57517426e27dc7ca622e131b7f238825536fc13458008b84fff8bea75849227b96ada2889b15bca07cdfe951a8d5b0ed37e236b4824b62b5499aecc767d6e33ef5e3d6125e44f1bf71427d58840380b18101faf9ca32bbb48e278727c52b74d4a8d697dec364f9cace53a256bc78178e490329aefb494fa415b9cef25c19576d6b79a72ba2272013b5d03d40d321300793ea99f50203010001a38201823082017e30120603551d130101ff040830060101ff020100301d0603551d0e04160414b76ba2eaa8aa848c79eab4da0f98b2c59576b9f4301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030106082b06010505070302307606082b06010505070101046a3068302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304006082b060105050730028634687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274476c6f62616c526f6f7443412e63727430420603551d1f043b30393037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274476c6f62616c526f6f7443412e63726c303d0603551d2004363034300b06096086480186fd6c02013007060567810c01013008060667810c0102013008060667810c0102023008060667810c010203300d06092a864886f70d01010b050003820101008032ce5e0bdd6e5a0d0aafe1d684cbc08efa8570edda5db30cf72b7540fe850afaf33178b7704b1a8958ba80bdf36b1de97ecf0bba589c59d490d3fd6cfdd0986db771825bcf6d0b5a09d07bdec443d82aa4de9e41265fbb8f99cbddaee1a86f9f87fe74b71f1b20abb14fc6f5675d5d9b3ce9ff69f7616cd6d9f3fd36c6ab038876d24b2e7586e3fcd8557d26c21177df3e02b67cf3ab7b7a86366fb8f7d89371cf86df7330fa7babed2a59c842843b11171a52f3c90e147da25b7267ba71ed574766c5b8024a65345e8bd02a3c209c51994ce7529ef76b112b0d927e1de88aeb36164387ea2a63bf753febdec403bb0a3cf730efebaf4cfc8b3610733ef3a4 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\5A8CEF45D7A69859767A8C8B4496B578CF474B1A\Blob = 0300000001000000140000005a8cef45d7a69859767a8c8b4496b578cf474b1a2000000001000000450500003082054130820329a0030201020213066c9fd29635869f0a0fe58678f85b26bb8a37300d06092a864886f70d01010c05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412032301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f74204341203230820222300d06092a864886f70d01010105000382020f003082020a0282020100ad969f2d9c4a4c4a81795199ec8acb6b605113bc4d6d06fcb0088ddd19106ac7260c35d8c06f2084e994b19b8503c35bdb4ae8c8f89076d95b4fe34ce806364dcc9aac3d0c902b92d4061960ac374479858182ad5a37e00dcc9da64c5276ea439db704d150f655e0d5d2a64985e937e9ca7eae5c954d489a3fae205a6d8895d934b8521a4390b0bf6c05b9b678b7ead0e43a3c125362ff4af27bbe3505a91234e3f36474622c3d00495a28fe3244bb87dd652702713bda4af71fdacdf72155904f0fecae82e19f6bd945d3bbf05f87ed3c2c3986da3fdeec7255eb79a3addbdd7cb0ba1ccefcde4f3576cf0ff8781f6a36514627615be99ecff0a2557d7c258a6f2fb4c5cf842e2bfd0d51106cfb5f1bbc1b7ec5ae3b98013192ff0b57f49ab2b957e9abef0d76d1f0eef4ce86a7e06ee9b469a1df69f633c6692e97139ea587b057108137c953b3bb7ff692d19cd018f4926eda834fa663994ca5fb5eef21647a205f6c648515cb37e9620c0b2a16dc012e32da3e4bf59e3af6174094ef9e910886fabe63a85a33eccb744395f96c695236c7296ffc55035c1ffb9fbd47ebe74947950b4e89220949e0f5611ef1bf2e8a726e8059ff573af97532a34e5feced2862d94d73f2cc811760edcdebdcdba7cac57e02bdf2540854fdb42d092c17544a98d154e1516708d2ed6e7e6f3fd22d81592966cb903995111e7427feddebaf0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414b00cf04c30f405580248fd33e552af4b84e36652300d06092a864886f70d01010c05000382020100aaa8808f0e78a3e0a2d4cde6f5987a3bea0003b0970e93bc5aa8f62c8c7287a9b1fc7f73fd637178a58759cf30e10d10b2135a6d82f56ae6809fa0050b68e4476bc76adfb6fd773272e518fa09f4a0932c5dd28c75857665900c0379b7312363ad788309866884cafff9cf269a9279e7cd4bc5e761a717cbf3a91293936ba7e82f5392c46058b0cc0251185b858d625963b6adb4de9afb26f70027c05d55377499c9507fe3592e44e32c25eeec4c3277b49f1ae94b5d20c5dafd1c8716c643e8d4bb269a45705ea90b3753e2467b27fde046f289b7cc42b6cb28266ed9a5c93ac8411360f7508c15aeb26d1a151a5778e6922ad96590823f6c02afae123a27963604d71da28063a99bf1e5bab47c14b04ec9b11f745f38f651ea9bfa2ca211d4a92d271a45b1afb24e710dc05846d66906cb53cbb3fe6b41cd417e7d4c0f7c72797a59cd5e4a0eac9ba99873797cb4f4ccb9b8070cb2745cb8c76f88a190a7f4aaf9bf673af41a15621eb79fbe3db129af67a112f25810195303301bb81a89f69cbd97038ea309f31d8b21f1b4dfe41cd19f650206ea5cd613b384efa2a55c8c7729a768c06bae40d2a8b4eacdf08d4b389c199a1b2854b88990efca75813e1ef26424c718af4eff479e07f63565a4d30a56fff517646cefa822254993b6df0017da587e5deec51bb0d1d15f2110c7f9f3ba020a2707c5f1d6c7d3e0fb09606c MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F6108407D6F8BB67980CC2E244C2EBAE1CEF63BE MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\2AD974A775F73CBDBBD8F5AC3A49255FA8FB1F8C MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\2AD974A775F73CBDBBD8F5AC3A49255FA8FB1F8C\Blob = 0300000001000000140000002ad974a775f73cbdbbd8f5ac3a49255fa8fb1f8c2000000001000000620400003082045e30820346a0030201020213077312380b9d6688a33b1ed9bf9ccda68e0e0f300d06092a864886f70d01010b05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412031301e170d3232303832333232323132385a170d3330303832333232323132385a303c310b3009060355040613025553310f300d060355040a1306416d617a6f6e311c301a06035504031313416d617a6f6e205253412032303438204d303130820122300d06092a864886f70d01010105000382010f003082010a0282010100eb712ca9cb1f8828923230af8a570f78b73725955587ac675c97d322c8daa214676b7cf067dae2032ab356125dc6b547f96708a7937a9592180fb4f9f910369a7f2f80b64fba134ec75d531ee0dd96330720d396bc12e4745042a1051373b54f9b4424fe2d7fedbc2285ec362133977506ce271882dce3d9c582078d5e26012626671fd93f13cf32ba6bad7864fcaaff0e023c07df9c0578728cfdea75b7032884dae86e078cd05085ef8154b2716eec6d62ef8f94c35ee9c4a4d091c02e249198caeeba258ed4f671b6fb5b6b38064837478d86dcf2ea06fb76377d9eff424e4d588293cfe271c278b17aab4b5b94378881e4d9af24aef872c565fb4bb451e70203010001a382015a3082015630120603551d130101ff040830060101ff020100300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030106082b06010505070302301d0603551d0e0416041481b80e638a891218e5fa3b3b50959fe6e5901385301f0603551d230418301680148418cc8534ecbc0c94942e08599cc7b2104e0a08307b06082b06010505070101046f306d302f06082b060105050730018623687474703a2f2f6f6373702e726f6f746361312e616d617a6f6e74727573742e636f6d303a06082b06010505073002862e687474703a2f2f6372742e726f6f746361312e616d617a6f6e74727573742e636f6d2f726f6f746361312e636572303f0603551d1f043830363034a032a030862e687474703a2f2f63726c2e726f6f746361312e616d617a6f6e74727573742e636f6d2f726f6f746361312e63726c30130603551d20040c300a3008060667810c010201300d06092a864886f70d01010b05000382010100ad00de0205232e063262b46bb19416e41140de2bfa59c135efe0aa8f2b41b9d1f38739001df23db5a7470c0606c691f3075702d4edbd17c1909abf4875a2074f30dd4a6a42b50d3d15c00ffe845bc63c99cc5752b1d86e12d59692934b94e507e88982086a7a34d49e64e13d876a92909a63a14bf88fb6ea34d305be20c2de06e28c9f738b9f4d3985cace19369d85c99ec9f8503fb67e88a1efca84068b50b40a5ca61c44f1fdc8614060f26125aa07f4c7c27375e40c0b428d04e55f4448995b7b898196a7889d4b0d62e804c4d7feb4e8b26dcaecc01cbc385b1ddf85ce5b7ae3494b6cb9a7ddf405b249ade1c5146bc2ccebcd7fd65869bac3207e7fb0b8 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E\Blob = 030000000100000014000000b51c067cee2b0c3df855ab2d92f4fe39d4e70f0e2000000001000000e1030000308203dd308202c5a003020102020100300d06092a864886f70d01010b050030818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a30818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bdedc103fcf68ffc02b16f5b9f48d99d79e2a2b703615618c347b6d7ca3d352e8943f7a1699bde8a1afd13209cb44977322956fdb9ec8cdd22fa72dc276197eef65a84ec6e19b9892cdc845bd574fb6b5fc589a51052894655f4b8751ce67fe454ae4bf85572570219f8177159eb1e280774c59d48be6cb4f4a4b0f364377992c0ec465e7fe16d534c62afcd1f0b63bb3a9dfbfc7900986174cf26824063f3b2726a190d99cad40e75cc37fb8b89c159f1627f5fb35f6530f8a7b74d765a1e765e34c0e89656998ab3f07fa4cdbddc32317c91cfe05f11f86baa495cd19994d1a2e3635b0976b55662e14b741d96d426d4080459d0980e0ee6defcc3ec1f90f10203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147c0c321fa7d9307fc47d68a362a8a1ceab075b27300d06092a864886f70d01010b050003820101001159fa254f036f94993b9a1f828539d47605945ee128936d625d09c2a0a8d4b07538f1346a9de49f8a862651e62cd1c62d6e95204a9201ecb88a677b31e2672e8c9503262e439d4a31f60eb50cbbb7e2377f22ba00a30e7b52fb6bbb3bc4d379514ecd90f4670719c83c467a0d017dc558e76de68530179a24c410e004f7e0f27fd4aa0aff421d37ed94e5645912207738d3323e3881759673fa688fb1cbce1fc5ecfa9c7ecf7eb1f1072db6fcbfcaa4bfd097054abcea18280290bd5478092171d3d17d1dd916b0a9613dd00a0022fcc77bcb0964450b3b4081f77d7c32f598ca588e7d2aee90597364f936745e25a1f566052e7f3915a92afb508b8e8569f4 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8DA7F965EC5EFC37910F1C6E59FDC1CC6A6EDE16\Blob = 0300000001000000140000008da7f965ec5efc37910f1c6e59fdc1cc6a6ede162000000001000000450300003082034130820229a0030201020213066c9fcf99bf8c0a39e2f0788a43e696365bca300d06092a864886f70d01010b05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412031301e170d3135303532363030303030305a170d3338303131373030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f74204341203130820122300d06092a864886f70d01010105000382010f003082010a0282010100b2788071ca78d5e371af478050747d6ed8d78876f49968f7582160f97484012fac022d86d3a0437a4eb2a4d036ba01be8ddb48c80717364cf4ee8823c73eeb37f5b519f84968b0ded7b976381d619ea4fe8236a5e54a56e445e1f9fdb416fa74da9c9b35392ffab02050066c7ad080b2a6f9afec47198f503807dca2873958f8bad5a9f948673096ee94785e6f89a351c0308666a14566ba54eba3c391f948dcffd1e8302d7d2d747035d78824f79ec4596ebb738717f2324628b843fab71daacab4f29f240e2d4bf7715c5e69ffea9502cb388aae50386fdbfb2d621bc5c71e54e177e067c80f9c8723d63f40207f2080c4804c3e3b24268e04ae6c9ac8aa0d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604148418cc8534ecbc0c94942e08599cc7b2104e0a08300d06092a864886f70d01010b0500038201010098f2375a4190a11ac57651282036230eaee628bbaaf894ae48a4307f1bfc248d4bb4c8a197f6b6f17a70c85393cc0828e39825cf23a4f9de21d37c8509ad4e9a753ac20b6a897876444718656c8d418e3b7f9acbf4b5a750d7052c37e8034bade961a0026ef5f2f0c5b2ed5bb7dcfa945c779e13a57f52ad95f2f8933bde8b5c5bca5a525b60af14f74befa3fb9f40956d3154fc42d3c7461f23add90f48709ad9757871d1724334756e5759c2025c266029cf2319168e8843a5d4e4cb08fb231143e843297262a1a95d5e08d490aeb8d8ce14c2d055f286f6c49343776661c0b9e841d7977860036e4a72aea5d17dba109e866c1b8ab95933f8ebc490bef1b9 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F6108407D6F8BB67980CC2E244C2EBAE1CEF63BE\Blob = 030000000100000014000000f6108407d6f8bb67980cc2e244c2ebae1cef63be2000000001000000f6010000308201f230820178a0030201020213066c9fd7c1bb104c2943e5717b7b2cc81ac10e300a06082a8648ce3d0403033039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412034301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f7420434120343076301006072a8648ce3d020106052b8104002203620004d2ab8a374fa3530dfec18a7b4ba87b464b63b062f62d1bdb087121d200e863bd9a27fbf0396e5dea3da5c981aaa35b2098455d16dbfde8106de39ce0e3bd5f8462f3706433a0cb242f70ba88a12aa075f881ae6206c481db396e29b01efa2e5ca3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414d3ecc73a656ecce1da769a56fb9cf3866d57e581300a06082a8648ce3d040303036800306502303a8b21f1bd7e11add0ef58962fd6eb9d7e908d2bcf6655c32ce328a9700a470ef0375912ff2d9994284e2a4f354d335a023100ea75004e3bc43a941291c958469d211372a7889c8ae44c4adb96d4ac8b6b6b49125333add7e4be24fcb50a76d4a5bc10 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa22000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0D44DD8C3C8C1A1A58756481E90F2E2AFFB3D26E MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8DA7F965EC5EFC37910F1C6E59FDC1CC6A6EDE16 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\5A8CEF45D7A69859767A8C8B4496B578CF474B1A MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0D44DD8C3C8C1A1A58756481E90F2E2AFFB3D26E\Blob = 0300000001000000140000000d44dd8c3c8c1a1a58756481e90f2e2affb3d26e2000000001000000ba010000308201b63082015ba0030201020213066c9fd5749736663f3b0b9ad9e89e7603f24a300a06082a8648ce3d0403023039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412033301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f7420434120333059301306072a8648ce3d020106082a8648ce3d030107034200042997a7c6417fc00d9be8011b56c6f252a5ba2db212e8d22ed7fac9c5d8aa6d1f73813b3b986b397c33a5c54e868e8017686245577d44581db337e56708eb66dea3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414abb6dbd7069e37ac3086079170c79cc419b178c0300a06082a8648ce3d0403020349003046022100e08592a317b78df92b06a593ac1a98686172fae1a1d0fb1c7860a64399c5b8c40221009c02eff1949cb396f9ebc62af8b62cfe3a901416d78c6324481cdf307dd5683b MBAMInstallerService.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
mbamtray.exembam.exepid process 3684 mbamtray.exe 2768 mbam.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
MBSetup.exeMBAMInstallerService.exeMBAMService.exembamtray.exepid process 4604 MBSetup.exe 4604 MBSetup.exe 2744 MBAMInstallerService.exe 2744 MBAMInstallerService.exe 2744 MBAMInstallerService.exe 2744 MBAMInstallerService.exe 2744 MBAMInstallerService.exe 2744 MBAMInstallerService.exe 2744 MBAMInstallerService.exe 2744 MBAMInstallerService.exe 2744 MBAMInstallerService.exe 2744 MBAMInstallerService.exe 1272 MBAMService.exe 1272 MBAMService.exe 1272 MBAMService.exe 1272 MBAMService.exe 1272 MBAMService.exe 1272 MBAMService.exe 1272 MBAMService.exe 1272 MBAMService.exe 3684 mbamtray.exe 3684 mbamtray.exe 3684 mbamtray.exe 3684 mbamtray.exe 1272 MBAMService.exe 1272 MBAMService.exe -
Suspicious behavior: LoadsDriver 4 IoCs
Processes:
pid process 664 664 664 664 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
MBAMService.exeMBAMService.exedescription pid process Token: 33 2556 MBAMService.exe Token: SeIncBasePriorityPrivilege 2556 MBAMService.exe Token: 33 1272 MBAMService.exe Token: SeIncBasePriorityPrivilege 1272 MBAMService.exe Token: SeBackupPrivilege 1272 MBAMService.exe Token: SeRestorePrivilege 1272 MBAMService.exe Token: SeTakeOwnershipPrivilege 1272 MBAMService.exe Token: SeBackupPrivilege 1272 MBAMService.exe Token: SeRestorePrivilege 1272 MBAMService.exe Token: SeTakeOwnershipPrivilege 1272 MBAMService.exe Token: SeSecurityPrivilege 1272 MBAMService.exe Token: SeDebugPrivilege 1272 MBAMService.exe Token: SeDebugPrivilege 1272 MBAMService.exe Token: SeDebugPrivilege 1272 MBAMService.exe Token: SeDebugPrivilege 1272 MBAMService.exe Token: SeDebugPrivilege 1272 MBAMService.exe Token: SeDebugPrivilege 1272 MBAMService.exe Token: SeDebugPrivilege 1272 MBAMService.exe Token: SeDebugPrivilege 1272 MBAMService.exe Token: SeDebugPrivilege 1272 MBAMService.exe Token: SeDebugPrivilege 1272 MBAMService.exe Token: SeDebugPrivilege 1272 MBAMService.exe Token: SeDebugPrivilege 1272 MBAMService.exe Token: SeDebugPrivilege 1272 MBAMService.exe Token: SeDebugPrivilege 1272 MBAMService.exe Token: SeDebugPrivilege 1272 MBAMService.exe Token: SeDebugPrivilege 1272 MBAMService.exe Token: SeDebugPrivilege 1272 MBAMService.exe Token: SeDebugPrivilege 1272 MBAMService.exe Token: SeDebugPrivilege 1272 MBAMService.exe Token: SeDebugPrivilege 1272 MBAMService.exe Token: SeDebugPrivilege 1272 MBAMService.exe Token: SeDebugPrivilege 1272 MBAMService.exe Token: SeDebugPrivilege 1272 MBAMService.exe Token: SeDebugPrivilege 1272 MBAMService.exe Token: SeDebugPrivilege 1272 MBAMService.exe Token: SeDebugPrivilege 1272 MBAMService.exe Token: SeDebugPrivilege 1272 MBAMService.exe Token: SeDebugPrivilege 1272 MBAMService.exe Token: SeDebugPrivilege 1272 MBAMService.exe Token: SeDebugPrivilege 1272 MBAMService.exe Token: SeDebugPrivilege 1272 MBAMService.exe Token: SeDebugPrivilege 1272 MBAMService.exe Token: SeDebugPrivilege 1272 MBAMService.exe Token: SeDebugPrivilege 1272 MBAMService.exe Token: SeDebugPrivilege 1272 MBAMService.exe Token: SeDebugPrivilege 1272 MBAMService.exe Token: SeDebugPrivilege 1272 MBAMService.exe Token: SeDebugPrivilege 1272 MBAMService.exe Token: SeDebugPrivilege 1272 MBAMService.exe Token: SeDebugPrivilege 1272 MBAMService.exe Token: SeDebugPrivilege 1272 MBAMService.exe Token: SeDebugPrivilege 1272 MBAMService.exe Token: SeDebugPrivilege 1272 MBAMService.exe Token: SeDebugPrivilege 1272 MBAMService.exe Token: SeDebugPrivilege 1272 MBAMService.exe Token: SeDebugPrivilege 1272 MBAMService.exe Token: SeDebugPrivilege 1272 MBAMService.exe Token: SeDebugPrivilege 1272 MBAMService.exe Token: SeDebugPrivilege 1272 MBAMService.exe Token: SeDebugPrivilege 1272 MBAMService.exe Token: SeDebugPrivilege 1272 MBAMService.exe Token: SeDebugPrivilege 1272 MBAMService.exe Token: SeDebugPrivilege 1272 MBAMService.exe -
Suspicious use of FindShellTrayWindow 10 IoCs
Processes:
MBSetup.exembamtray.exepid process 4604 MBSetup.exe 3684 mbamtray.exe 3684 mbamtray.exe 3684 mbamtray.exe 3684 mbamtray.exe 3684 mbamtray.exe 3684 mbamtray.exe 3684 mbamtray.exe 3684 mbamtray.exe 3684 mbamtray.exe -
Suspicious use of SendNotifyMessage 8 IoCs
Processes:
mbamtray.exepid process 3684 mbamtray.exe 3684 mbamtray.exe 3684 mbamtray.exe 3684 mbamtray.exe 3684 mbamtray.exe 3684 mbamtray.exe 3684 mbamtray.exe 3684 mbamtray.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
MBAMInstallerService.exeMBAMService.exeMBSetup.exedescription pid process target process PID 2744 wrote to memory of 2556 2744 MBAMInstallerService.exe MBAMService.exe PID 2744 wrote to memory of 2556 2744 MBAMInstallerService.exe MBAMService.exe PID 1272 wrote to memory of 3684 1272 MBAMService.exe mbamtray.exe PID 1272 wrote to memory of 3684 1272 MBAMService.exe mbamtray.exe PID 4604 wrote to memory of 2768 4604 MBSetup.exe mbam.exe PID 4604 wrote to memory of 2768 4604 MBSetup.exe mbam.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\MBSetup.exe"C:\Users\Admin\AppData\Local\Temp\MBSetup.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Checks BIOS information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe"C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
PID:2768
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3324
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost1⤵PID:1692
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"1⤵
- Drops file in Drivers directory
- Enumerates connected drives
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe" /Service /Protected2⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Executes dropped EXE
- Registers COM server for autorun
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2556
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Checks BIOS information in registry
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe"C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3684 -
C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe"C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe"2⤵PID:2456
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x524 0x5041⤵PID:1972
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa399a055 /state1:0x41c64e6d1⤵PID:3432
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Defense Evasion
Modify Registry
3Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\7z.dllFilesize
111KB
MD5d95056ab7a5b5a983d686f4dc9faaa89
SHA11328aa21a665647288de5722c8554cff9914d2f6
SHA256fd65cb55e751b8524f8e6aa56b4dec4623a6a36e4afbef62b97362ac7decfee8
SHA512dc80b67ceeb41d92fab8de139c309e85c46e9afa48d9fcaf91772516c65ebf0f38e393c2ce3ad5ff05ad332334393c26844bce46b63aa1971ff95c8b9d03f02d
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\Actions.dllFilesize
154KB
MD5ce8fa6b547d3034cbddbc8773dbfe60c
SHA11fc9604bf4d476ce0dac5a620472947c6238c6f8
SHA256c774658585b2e2c76bae31b89f8d52ebbcdf790631a11cef1bb546799d6fff62
SHA51289bb43a757db5a040c604a5dc38936dde1c8184bd52ebce6a833591ba5f60d90c317f28ff7f7f9af6f2570ae8ea4908771af8da9fcb89459462d5fd325df6d99
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ActionsShim.dllFilesize
245KB
MD58ba654413c4c284b10a3a2ece391f2ad
SHA1a611e362808b5ce8e64a18a2a188549507479a1f
SHA2563ef791b2df813d9e441e8ffbfdecadc0465191e21fb1888019960db0541a0eaf
SHA512bc4ca7699743a100a1b6efbeef5db8324a7de6ffc6ed447d31c40ace9eea686c134dbb9331ea76d354d4ef605418793e777785fb0aa4bed68e8e6e632a1378ac
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\BrowserSDKDLL.dllFilesize
113KB
MD572db9bb62cb3c772b0be865d58226a3e
SHA197a1e9e8d525d27744e6f4ce1f0df80e080946f0
SHA256d4714e46d63b68a4422d4778bbed6d92e22507dd24eb3b21dbb2c507cbd6b748
SHA512de0639736d67c977a327b85d20f5cd41bb99273d23c672ce62eafeb2ee23cf2e3d6c0e2644366f822e0e06f9b3eb698cabea9f3c4e09bbaf14efc90229f8cfd0
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\BrowserSDKDLLShim.dllFilesize
193KB
MD5cb86ed369ab5837663dafd00e0394959
SHA100ae765c5b950453c1fc442b4bf4d7c355b4e9d3
SHA256d8c1a32b0388d2ca3dfc701eeb32e0a32bc1433d31763ed34ee2c4ee527cfd76
SHA51291da58d68db59b4cf691419f1d7f882856748eaa2fddd6a9be26ef5c6c4256be2389e5d58a050c69f42713d0ff3795a07a356e0c0493497bcf8fc2b8704a7477
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\CleanControllerImpl.dllFilesize
130KB
MD59bd6d32b6eaaec30cc0e35445bf8730c
SHA19d981f5c518879e7a4c6d22d0dc6fcd8c8078d9f
SHA256239d38cd9ce778a95beeb1f8e994c9f688d5ed6706ac3aed3e7a80739e952450
SHA512ef7e617cb90fed45a598346d16cd07235fda143a69901b7902c36753b19373a812f54fd74799c5ae149fcf069a21492ae115be7356e71cc1bcec4b8da149037e
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\CloudControllerImpl.dllFilesize
91KB
MD54d01599b6f4a3b53afced700c1a58112
SHA14650153d3f2cbaff5e4c74986db744b48d7f44f9
SHA2568c3be2d9f308673521965db18767299a4587b6a1e1bf9ff8c39c79bc220c7ce5
SHA5129564f00dee262486ee1c7bd07be2d5e467ae60a50578b67f222a1f8edaa32c935a1e68666707f3638cc7bcae8839b297c8944c36f0babbd14233afd6e0bc6e5c
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\LicenseControllerImpl.dllFilesize
82KB
MD5ac7b9b5c3dc6af9df778df3ec9c52a9e
SHA1360c8d0d996e9b6cc1417ab2b6c1745d1ae3fcd0
SHA2565901d544dd2fd498307304d19f5307ea617482acd7ed08d2128e4579df29e946
SHA512cdec6f332947cff69147292bca3f42314f4cbf97fcb0db033deaf5768c5744f824a6be84eaef4729c180a6cf799ee03753dceed58cb1ca4560b0b7da3c747053
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\MBAMCore.dllFilesize
272KB
MD563f9e980949dd5f799b711fd236ec0cf
SHA1aa5469a06c837c6a0aaef8cb174aee7cce97e2bf
SHA256d55db1e55d2bcbd5fd77bc86191ac4e947cc3c08dbaff010503d69aada655cc6
SHA512f86ea4758ace77469da6b2fb06db8dd2b8b5a4405c003800ad0e0bc17fa3a0763f0644d50e1eb3538f49a94eb6a4ca6c64a6c83615ab96245f8290b8b753e086
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\MBAMShim.dllFilesize
85KB
MD5292bfdef6eab85492803c5f8d919528b
SHA13b363c63f48522e4e7ab7e99c15c84473f7d6bc7
SHA25666cb811a0cb4516f0822d23c919522ebe6293d1b2a16b425c7d4ec24158ab073
SHA512a8d137ee5a9ff49055502c5a1a5892cc4db8aa905354ccbce2e16129c1b76e657cba3c9c7895e98c16e92bc60bd5f40c4f080805bfc2ff9b02b236a99b59de16
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\PoliciesControllerImpl.dllFilesize
218KB
MD581cd1195890404d35e07c88ca3ffc94c
SHA14059521faa007b547b59d92eb5635cee03e22d79
SHA256b8a5dfa84a91b3561ade0f377fe38f3e21b7f7a1d90c63cd6b5e0b7b78c53354
SHA512acd2096620b3461e02c1ee7bfacc642671a0cc470dce5d39b551b79d3d453b09ce6a2be3e64308dd5b4ae490977b1cdec150909133464c095be5112553198faa
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ScanControllerImpl.dllFilesize
57KB
MD5e7673c6453af3fd2c06f71d52be7349e
SHA1863fab3d9c4e4b4309d47c98aec651c1f36e2d72
SHA2567a69c883ef4745bc1c8e262b1669c18e515fa45b1326bd54300355834b59d247
SHA512de2987d5915299a9b61fc57b093956ec6146312b69dbc249b0d0d8b1bfcc9d1d9231d604a37c35cb0c1989378e8375d2b7d1bd003f9a32f56ef322bc2360fc90
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\Swissarmy.dllFilesize
428KB
MD5a3ac91c3c55cc5c98ff6c75a62841924
SHA1abca88e9f7cd0f85c3c97d91beb43f99eba32a08
SHA256521d9d65691c2c0c09a687344a9dbac8d812bf1447f2bc91af4c717aa8d7d07e
SHA512967c063c75628bb06284a0cad49d73c9cafafae1965fd622c388a1bf1db2ae0f75027cec75f34eb2c1d1897976227689236304bea1e76e7743512d64848fc528
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\SwissarmyShim.dllFilesize
96KB
MD58ff37309e09b5d6286edd0af48a42f6b
SHA1fdf522d6c17d2e950462bfb62f294142bf159fc2
SHA256f8a639e3d3b9b8b32bc74fa5bef8b2a1a0146f80870f0cb398b8592ca84bc4f0
SHA512a35440a3c4e52ddaf94c46d888d24403ae36e4370d5ccd08e7ab1b6130527944f656abae87d6aa8fcaa149341979f572521a9ff1ea83a3ca74f35938fbce20b8
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\TelemetryControllerImpl.dllFilesize
98KB
MD545537becaf71dd95fb2b6f895d9f6721
SHA1531c60b1e4e9b1f835de311ae7a9986d5e5f3947
SHA256dd46060a55f1591fd7e80984d7878e493b901f96c0267a5f7dccfed801ec31bd
SHA51286cc17016d455257b1cd4f2fa62d4f6dcf28d11aa4f513942b4da1e137cc0304289985360a91e1966bf5885d485b7bf24ec0f67526e8b3b9ff27855eec25b4b5
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\UpdateControllerImpl.dllFilesize
307KB
MD5a3e26e08912abd5492b0c653e79a05c8
SHA1f3201b2527b97e052593ff3d4618a4008067da39
SHA2567f7f7f6928942f036852b47db922f090ab46f63a4383db31c2ce027e88f6d70f
SHA512556810a6ff3932b8dbeebe0d29b461eca55d4d990bf829c140a1aa3a79513e750a9c111df0b8d91ca8ee905a9df966d177ad332e08a5636a69d5164e1a81f744
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeFilesize
134KB
MD5c15765f03ecb59ab647c36f47523ba77
SHA1c8b3e0debcc1ab71786fa047260e381a29fd9f87
SHA256a2338a656c4ee75946050f877e02c279eab5a1705d82229c6f4d7f212f45ad69
SHA5124a006eaccdfc789679d4d53d72c039e41e3b21314815860128e52350038defb8470aa995ff4f13435b2ddce3c798d2b92d0c4a01dc172d3ddd9346070c7e887e
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\pkgvers.datFilesize
74B
MD55413d950b1ec84d5b14c8775e1b00488
SHA191b100a3d1425351da018fdf1dd05cc7e02aea33
SHA256235120084d27c5048b5cc40791fe6008ea60dd28292928b6f7e9b69f5a5646fb
SHA51200b4ed70ce6e264e8abb77eba2f46929ecec5ca3e92055064e1414fd3a9149c0448ea12625d6af5d07ae07be0f4cb8371a10137c53b0e31eeb9891b758da3a07
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\sample.dllFilesize
147KB
MD5ad7931be45ed43ff7eef1a3e34fc2426
SHA1c62e039b2d812a877e65d198205ba81928af2501
SHA2569ca6564d4a6cc9992b6e7ea43f7e818b22d86b46906df31c99ad33a32f6c8fde
SHA5126f0fc1f06f6e91293b142a36785d602eb9176a819f10cab98b85629dcedff23bbb7dd3ae4363939c641f066d769ca27157518c5ed147e1c13c8d4d6d9f0c33e8
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\Global.nmFilesize
151KB
MD5b8a10a16fb2b33042b8803c86aaec69a
SHA114ef1d07e277d82fce2daee1c034daab0f4ee965
SHA256067896d368d4b62b5005320654ab8c9840a08b6537d34e719cd8553b3c6bba4f
SHA512df84298773cd29b5cd5d8d2092268c9bdcc0a0bfd5e76fd219a37b81f78f5e1c7b0b9304bbed52cbd3261cb2193f73ae15341062c5a396480d3df82d5d820ce3
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\Global.srFilesize
202KB
MD569fb52399dd5104631d4cbdb93d51f43
SHA10c9a0fd8f9cf28d72ac7c34598a030e5db40375d
SHA2564c68ca6cd34afefde77f8b2fbd18df261beb4d6e2dd2778776a31d89ca45dbda
SHA51201439a259e80367d42807894a7ea74985c6b83cf64899762ed316fa5d5656f2b348a93c29b85dd24071f2a29f632f617a4b8daa115eed71fb27e6d2297f7c7ff
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\cfg.binFilesize
1KB
MD586e218784196fe0b6472cd0f20a85069
SHA18a5404e5b49624a5a6c289b299f98c4b72720968
SHA2569aa9ffbaf7126a0b23ddacfaf7f576c85b5a3c3a7d57eac636e73af8842c0902
SHA5121db35f7d6414fb6ceb486c0361ad394dd4f75d73925b17ffedb07d20b2cc264da33a1e9ff2306dc87ddba81099d5dd2c06b0e399de912d6bfa464c62c9ad777f
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\clean.mbdbFilesize
10KB
MD53b1f7981e037649f1b96741f2a643765
SHA1fb7c9e30d1d74821d4ddba7b59b4cb1b3ba2be94
SHA25622951323e3a4a46c088c1e7c71fccf0801bf2f4e8955e3db9c8fde2b727b60bf
SHA512aa2ff4d9868250e37a9a24573a26cc545b79cea57b433f0239adfd54281d8ec2d1909b8faec07f08ea097ba82c36cd3d9d2ea56915ff33361f5b7468bb5d7f6d
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\dbmanifest2.datFilesize
924B
MD54bc44d8f381b5a03716e8200d3e5918f
SHA1ea27d8aeab82be36d8b73f1b5cb892a99f04a822
SHA256e2a914e76cccbc93969bf60d70ebeae64c235939fe5f3f7a56ba4fcda89b7a9a
SHA5129fb0d9818ece9734f67a34833a81ee1b8dabee11f6ac2f68d4424c2f81b8da8fe34aa7cb2edf711de84e1cd5ca7b471a133d5643d3594dc263b9d8446a614bf1
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\dynconfig.datFilesize
39KB
MD510f23e7c8c791b91c86cd966d67b7bc7
SHA13f596093b2bc33f7a2554818f8e41adbbd101961
SHA256008254ca1f4d6415da89d01a4292911de6135b42833156720a841a22685765dc
SHA5122d1b21371ada038323be412945994d030ee8a9007db072484724616c8597c6998a560bc28886ebf89e2c8919fb70d76c98338d88832351823027491c98d48118
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\exclusions.txtFilesize
23KB
MD5aef4eca7ee01bb1a146751c4d0510d2d
SHA15cf2273da41147126e5e1eabd3182f19304eea25
SHA2569e87e4c9da3337c63b7f0e6ed0eb71696121c74e18a5da577215e18097715e2f
SHA512d31d21e37b0048050b19600f8904354cff3f3ec8291c5a7a54267e14af9fb88dfb6d11e74a037cc0369ade8a8fb9b753861f3b3fb2219563e8ec359f66c042db
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\mbdigsig2.datFilesize
514B
MD580a7d1a1a416cf061ea542173be209d5
SHA18a56df1f9e2585031a8334b27a9ef4cc1a9ce095
SHA256c7db3de508aa81d39c055a06c06a463e64378eee40ef84da4a89fb415859819c
SHA51268afd7be2f15b85dc764942d8478bb268e29306df12798f3693d0f1c4c7d03f0ebf665bb9380aed9ddacbd2d35c24ee38cb3651b70476f321d2beda232773199
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\prot.mbdbFilesize
24B
MD5546d9e30eadad8b22f5b3ffa875144bf
SHA13b323ffef009bfe0662c2bd30bb06af6dfc68e4d
SHA2566089fbf0c0c1413f62e91dc9497bedc6d8a271e9dc761e20adc0dccf6f4a0c1f
SHA5123478f5dcf7af549dd6fe48ad714604200de84a90120b16a32233b6d44fa7240f5f4e5fe803f54b86bbdfd10fa1bfdd88fb85eb6a78e23e426933f98d0a2565ec
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\rdefs.mbdbFilesize
24B
MD52f7423ca7c6a0f1339980f3c8c7de9f8
SHA1102c77faa28885354cfe6725d987bc23bc7108ba
SHA256850a4ea37a0fd6f68bf95422d502b2d1257264eb90cc38c0a3b1b95aa375be55
SHA512e922ac8a7a2cde6d387f8698207cf5efbd45b646986a090e3549d97a7d552dd74179bd7ac20b7d246ca49d340c4c168982c65b4749df760857810b2358e7eb69
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\rules.mbdbFilesize
159KB
MD554f31bdfffeed233780dc03ab82a84af
SHA1777fba7c8e2d5553f69bc25b76c924c2ace2d638
SHA256aea5a1657c8170d906b28789f674f68d929744494e64a5390572554575aefd1c
SHA512630b5bc490607d476fcc820c1481d15df178918f3eb7e3b1b12bb1c88f6cc9843ecfea9456e1232456fad815a4ae952d06f3a7215024c4824f1e5b338dd2a3d1
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\scan.mbdbFilesize
150KB
MD5bade0745fdee5fd82ee40ab52264c6cf
SHA1890a52c9ea46b4d2d65dd41bf4132b8df87c7456
SHA25611c337aa73994c2a9a85aa2255bc40f1124fc8ce828e1d1e3f5e8b06fbfb7bb3
SHA5125c6d2710a40a6e3934f6c4c04e3285ce1ae886455464d84ce326e0b5df23bf778793eba5f6f9f0353a4afdf76c297804248f1d3365751b3dad646749c8f3046f
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\tids.mbdbFilesize
18KB
MD5987d994d86b1f531940b200e4b38425c
SHA157476568fefc4ebbbe75856d41313d8e1b9c05b1
SHA25689d19165f839cd48fbbaf9e56386e1cb2e05ff14ae700366108deffab41ac635
SHA512f9cd342262f4c110a39d593179dc880f1528986c16b8b82a7a287e1eea113822e46f10cbc474672f33a973c51f8c51511392234922fd3f52b2c3c122cb5dce70
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\wprot2.mbdbFilesize
92KB
MD527c880b5f703ba36a33bcf55b995f062
SHA194942e9180b64272b018dd493381c5c10c8762b9
SHA256f46f6aa68d2426789dec5664fcc2c0e8635ea49a071dcbb708c18e62df9ef1fb
SHA512130dc15f8aeaaca5e568c43558bbe4b418dd7e206d03d9299185d209bf48e77499192206e7a1d55c3239df66801245947e830c985d63bbae31c03d1038f35ff5
-
C:\Program Files\Malwarebytes\Anti-Malware\7z.dllFilesize
179KB
MD51fed3f3a1cf78257dc5d591056cd4814
SHA160d8b3a8ed058dee4d431ea109d32aa768b5f6f2
SHA2562edf23c3f57e3ed3d0ed20aaf56d5bf272602e8f8e7cc47481759023f22e25c2
SHA51233483b551b1ac8763ffbb83a9b8223a669ce56003f8317815a9cd7137520d383ab0cd2c3367470dc502c1763d6dc6180b836d12be31218299dcee0ffce77c58a
-
C:\Program Files\Malwarebytes\Anti-Malware\Actions.dllFilesize
213KB
MD50a4ad4efc48310b480012c86e9ce736a
SHA148c8ef56936f8577600212840051796bb349091d
SHA2561d7149e126fb7151a0987b8da1c8f42ce499983f29c35619a47977d2f1a59c24
SHA512bfa83afded981913efbf5f01a9f232e70dcdac79ef63cddea9cdbbcc60d2a58795d2ea95df4d3ce588322d005f7d84ca6a8e94a1395d950d6eddcea312733a36
-
C:\Program Files\Malwarebytes\Anti-Malware\ActionsShim.dllFilesize
146KB
MD5a3e26848634b0655b7c503567803cec4
SHA1870be5a12ad76f629aad3fc00df32f3663a888db
SHA256d0dab37626a9fd665d18fff964fe5d31d84ec1953683fa03aaa6b35391fbefff
SHA512daaf6986a589ae0d0465a2ac6c1ff0463b82eb0d393ca6944ec2244b75e1800e9f2cfdf599d66a18160107a6098464681b143a0857b63588894d6a7462b63042
-
C:\Program Files\Malwarebytes\Anti-Malware\CleanControllerImpl.dllFilesize
369KB
MD540492d72433eb2b77fe3e4d2e79d93fe
SHA13b742559ace0c4a54f72198b093c0b487a06acfe
SHA256bbe2bd23eb327b47385bf3180906885d825aa93cca437c0e071202e6e7210014
SHA512a251224bdc301f9be64468318cc2ee1fc15ca5ea9aef14a14764e6fd4f3b96c49d027e8ea6446f8fae57504a27e73feff0ecaa35fa1c2f51a17ee9f039e1d7c9
-
C:\Program Files\Malwarebytes\Anti-Malware\CloudControllerImpl.dllFilesize
106KB
MD5040f54acdcaa2cd3249362828a707027
SHA1334137fdb79aa8290be6f0ed66542282ed03ac07
SHA256d80a43882bc663cb8d42bcf8f4e68d54a521c0c3ab44e71a7054d913bee020f0
SHA512e05800121834982360c710381732ca5291ced16fed33ba6b68b6ba1e705a18b85ad31ad1126342cf4f54835de216c58c51ad3b42b2a171d9fbc308ccc3909394
-
C:\Program Files\Malwarebytes\Anti-Malware\LicenseControllerImpl.dllFilesize
114KB
MD542a7621a16579101ff10632b3aae015f
SHA17f2b015d1e5da14e4d60e2ce89765b2a115519d4
SHA25662ea796d3ea3cab4da1c0d02db1bd77db97a6d607ac49f3f17c7446828a47695
SHA5124f4e7a4063038b48c531ae4d11efa0b93181309429d3a105c437acdcff4856e21a552f8424bd3496818abb7565d916bb15eba9bda18a31e5ec48e5f0602c00c5
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exeFilesize
573KB
MD54bfeb732b4e4de6308edff0da71d3449
SHA11e195ac4ec4453f1110b47e1294321f84448f1f8
SHA2560fe64ebbac1a260e78201e8a7fde8c8517f9ef944b679ec2f49584d235b95ee4
SHA5124172027e01bfcfc8e72cc791479373797df275ef392e2c0b238cfdd251efddc89574796f4dd06dc44dda600b091f9f9ed2cb78d852fd8b043b4c60cf1482b540
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exeFilesize
936KB
MD59483da37187928d819c9665bd7770012
SHA12bd2fed8dd2449b53d47494314da67c0a979842d
SHA2567f8a3ca68117a4428281972277d3daa2e24453057e68ef80ba61ec45bd888c4b
SHA512c7cb9396c1734b78797d678655a342914936c893c5a6096dd46282b857d6e889842197c1eee6fca0d658a60a66dca013fbe9da9cbf5dbf5e879ade2fdfd491e3
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exeFilesize
842KB
MD5cc06153452f4d52599f0681831da275b
SHA1400870a3df2f77a8a1867d0c51b43f6a3a3e7097
SHA256c39bc8d29fef855f6037c9156f30988f16ce9433bf673389239237b40d945b15
SHA5125c796383c36ac84e3ae3590900b847f12b5bb52218b2750083952a8c49c96cdacd4e69226a88f26ff994fc1b71e9f5f62bbc124dd61293c8532ed94ba9a7dc4d
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exeFilesize
1.1MB
MD5014dd49d53fcc8e5342ac5fa768738b2
SHA15b61ed266a3307279313531ec7d4db21e328c59d
SHA2568ff0ef972f52bf6fd1b050b4ba36d6090f27a910328f8758bed8659b95d898a3
SHA512901494850d675be1b2f77dc25265a210810441fa9ec8b2d400ea28c4d8c60328ed3835543fb517b957b6d55583fe05d221d717351c0de0e285660b94fe4bbde6
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exeFilesize
120KB
MD5953a0d36f72c4cdc6549c7822c0312c5
SHA151f4f75615718a46bca8c64d95c25513d2e7e9f4
SHA256521b8e67a5da9719740818919a8a5225314751e5a9936042101d6dd158918e71
SHA5129e71b613b2914a41a2f9716223d00b8159c319db1ca6b334a70a6fda7e67db7cdd416a15e5b4608c38a2bf9e0427e9464b0e18f1c854fd2c01070c652afb6fc8
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMShim.dllFilesize
89KB
MD5abb8f8b3a2bf19d4547e3ce787d5f26d
SHA1687326efe680c50fc32e160c7e5b6dba530f2ab5
SHA256fac5aa05eec6892e0ad5a4d49ad57b2799f193d4ec20a10aa80a3525b00b7a0e
SHA512862a898fa00f1326cfa6a199755d6a6fdd1de6fc83d54d40b175804576deaa5fb2673568cc623ef3d403da2c2733c89c196e5838deb9f30c28641da7c439108f
-
C:\Program Files\Malwarebytes\Anti-Malware\PoliciesControllerImpl.dllFilesize
179KB
MD586782a05feeb65e8251eefb6d6ca9324
SHA1513de3a400f08a546f1fd8171ba41831c46aa391
SHA256f2dcf0756720f8292db17ebaeb88cbdd351b377906064e4fd2632f940f959674
SHA512c41f7a569df7e0537b62676b7c043104bdd9e50386d9b07288ab34773f0a755ed8ab84766a9012193547bf1274910b1a9a5940b51fd84cb53d41cc9681613492
-
C:\Program Files\Malwarebytes\Anti-Malware\ScanControllerImpl.dllFilesize
197KB
MD5a1aeb33af67f39ef9ce78d4ad69d2842
SHA14af0fca3850b1f4456a6ad944927a62d95303f4d
SHA2563471a73f71ad1f2bcb30be720e15e4f91c6cb765a4e86742a8d0820823ea1b1a
SHA5128eec63936585048a4f9a0a3b0619d28932d3d285a947dddc961f4da776b7b95d3082a6367fc7649280e83d99082a8ea3ddb7d7f442cbd8fdab44f0c9cc11bb6e
-
C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.jsonFilesize
592B
MD599a31e423ffbd5c098fe4979326423b5
SHA1db22c538896fdd495ee2bce282375bc0e5143071
SHA256e40a9ca5ab3a3f401b0f43d3d2a0476f98d51149b468df07474fe8452c4a98bc
SHA512f1c0febd64351ee6541a0932e3eec19ac4a7aad3b78328dbefad96c5a2ae04ff69b137d555ed7771187ad1b7a51c9ec8f5bd1c72b5414160a328a13fae596b4e
-
C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.jsonFilesize
654B
MD5820aa563a53a9832f322d40e63b633ff
SHA18c25f7154b47abc52b48eaec4e2f3120a90e1773
SHA2565dc58452f0e61b03425ab537f435528d95bed1d8f20562396f4186d9e3824d9b
SHA512a770ab3b32b4941593e54c9f8abba7f77d26be8e763e9bb3ea004e7de995c8765d33c4e1f4fd93a1beabeb0db2503cadabd2002f00c87e2dbed8013cfb03808f
-
C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.json.bakMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Program Files\Malwarebytes\Anti-Malware\Swissarmy.dllFilesize
47KB
MD5741fe81cde64c577f6d764dfbbf3fa10
SHA19f19745f8fa8ad42b4f65ee78a77a4eb004b3ab7
SHA2567a89c23b3ddbb2fff12d3e27398ee1d7404a102b610cfea9e4b740a563b0d0fb
SHA512172539025ce3993aee6c615c90efea76899d6c034b333897867228c95a7d96cf0d884e4b8b09e55684ba33124f7575a5b3cee19fc2065c99379ad4c44b201104
-
C:\Program Files\Malwarebytes\Anti-Malware\SwissarmyShim.dllFilesize
133KB
MD5978cf1b01d12ccb3ae9504f20980fa09
SHA1cecc391fbe423f323e24198de844ca98165b21bb
SHA256cfc925b8b9aef6836750f75b99e338599d9a535fe7f94d72310840b53b3223b8
SHA512aca950fd612f83d9013b1aada08dfe5e620ea7cfe62a92f5de219f4565b08abf75d71b07bd19934bc53c0ea69b3d10e72ba2a64dd52233eafa03a5b48fab10b6
-
C:\Program Files\Malwarebytes\Anti-Malware\TelemetryControllerImpl.dllFilesize
63KB
MD5bac82ff8a4c65c491622365a760487ad
SHA17c5ead569a28667b84073cf14f70b9b6560d6fee
SHA2566055bf7f302641f4ba5f9af437ae4d3df80fb5f40ec1362f2eafbab707de5679
SHA512f851307d11001bd09a2d09c3ac1a88c85a911180fba01510086ca36030f91316e67bf5e7dd5cb7c6e2bd7af054eba81cbe60296f6adda32fa0bcfffdd97c64db
-
C:\Program Files\Malwarebytes\Anti-Malware\UpdateControllerImpl.dllFilesize
239KB
MD5380428478d104f2e5142a520d5381803
SHA1f20af6e797dd282d5f20cbf6f0cf962197e61c78
SHA25637e4e79358a86f623ae90719b88cebdc2003d4e08cb845f9a9b46d0e1596e549
SHA5127b05bf696053e20195932840c261066ae7ff6e0e98be15fadff5a1006d7fa0a1acd1c0932a0494d3677c8e15a8ac0591dc8e11fcbd99951af60370290e9e175b
-
C:\Program Files\Malwarebytes\Anti-Malware\ctlrvers.datFilesize
8B
MD5bdcf0c6215e107670112af05c22c7b37
SHA1e6cb8f72c2dd147eeb704cca67b5d93c6374d9a2
SHA256ecc6741b9d906863ab55594475e97d1acad054c632504acd17178b0ea91fa76b
SHA5124d72e1adfe1ebf478a751e810e8fe381305bf8305a7915678b68ed3d229245ccedc89b06f4c1cf4f6df4922628b3e4ab6a4517c8f0b5aaaec2374f52d162de6e
-
C:\Program Files\Malwarebytes\Anti-Malware\mb4uns.exeFilesize
40KB
MD57abcb6144a8e8718bcd71fc4fc2a2592
SHA15408da134c71284639c111e4bbb80ae064942844
SHA2567b644bb51a2d4c9aa3250738df73dde26011cc01db5ca69fdcaea120a07225e7
SHA51204464ab1e9735456c7099e0e63b81e0127cda10831a4384431394f973c492c0a3a4421adda59aadc6a8576da17e313e45344ed63c7ee535d31c77dc328703d3c
-
C:\Program Files\Malwarebytes\Anti-Malware\mbam.exeFilesize
57KB
MD591a18a789c2c6ce6abda62763341cc98
SHA1bf8d9f06b2c04ed7352da06b6cde26051042439c
SHA256b95b8b59161972a0e49265f303262ec7f355139c02710ac918744423a335ca88
SHA512c3e0092b64281ac88043e5f5b3e057393960313ccc6676ccd4de0ea6b7149488671b6c973c4cbebe793461e8ab9f762528860276b01c4e799ed27466a2958a97
-
C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exeFilesize
3KB
MD5fc4f87c9b6b3ccdfc53763b003e5d653
SHA1b1f3296506536842f4170cc60ac5b8f0ba1fda8b
SHA2561f99bb87987d493f10e85c64e21bc4c747e9859265ad13245a20324b4d93c07d
SHA5129319cc8dfa4b4ce68e431edfca88e529ac82ab543699151c91f11b69689ae770c489736a0ff64fd6715dc3bc2f094f6903befccd90bb32b6ad3f700216f484d1
-
C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dllFilesize
121KB
MD530d856476489125f28619008fb2091c3
SHA197756b473bc96d20b98407fc2ec949f30f335859
SHA256b3686d2533c1249abf27e6e3d175375c6ecedbb51bdd81485642a839a83c262c
SHA51222d244ee8ea444d35c976d874918950a5727d2fbaedd6b266abba5d3830823c87b8841c2d52f53a4cdc3d121cda7b0d0dfb2fc198b31277ff38dbd05624b59f4
-
C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dllFilesize
169KB
MD51adc25b4061a58f7e15bdee2762b6b8e
SHA1ced1bda19822a2530aa385e583695c7597b3f0c1
SHA256482f0e1944a79a1607b2c469f9f585a743f8fba81905e3fc2ccb5d1a91050b6a
SHA5127a9d0d6e80113a8faac2792eff66940692ec50cbf6eb063d9c259ff02275f985a633e06de7622f8f6fcac00b33578f4799b33ee74275d6983c4b7ac0fe42f70f
-
C:\Program Files\Malwarebytes\Anti-Malware\offreg.dllFilesize
102KB
MD56e050f371bed75c7256e08bc7ed2a8c3
SHA118024225187875382dde2c375e1083a8c94044b2
SHA25693f2327da9a31d0a67905f0c5bfd8b2386c9913b163ed8fc8beca25c7c82a7d5
SHA5124b332574992597f9d6d5b2d276ca47e7102c66fb6970b1b5e26eb8353f84e8c82735f72b2e0b0bc73550ad884bbf3d398f1f77ae0d18a748275d5f5121d962df
-
C:\Program Files\Malwarebytes\Anti-Malware\offreg.dllFilesize
57KB
MD564ad216f15c034b78f73fa3d7ab83592
SHA15270275b0243e039f8a31f5f7a41c5bd58cdebaf
SHA256ce9a9c78f3cf2d4e9def7efe8d0c5ce1f98fecfd432d664ada59fae301ea76ef
SHA512d3f9195e96b535a1465b85ff1300dc505bedff4785e42b7e696ab11e00b9db853d414204a825c6dfbbb3352d1c6ce25ab34a0e3c13310838ae5db8a11451a550
-
C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.catFilesize
10KB
MD5f7c8e0339bd48b6fe8eca81ac3ba5ba5
SHA11369bd4dcfa7709d8eed12fa76fdbebd39dd6bcc
SHA256a9dd01f84a075ea8d0b0968fd7a11720e49f019834f7d4fe80f50dacb12030aa
SHA512c722510c40fbed32bcda3b5b69c590a9043e4e51f8e804f77f73eb8ea0cac0f4a587ef540f2773981839f04e44f48bbc8b5e8c03ded3f0cf637ed1e3172c8e07
-
C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.infFilesize
2KB
MD5d87c2f68057611e687bdb8cc6ebea5b8
SHA127b1311d3b199e4c22772fa1b7ea556805775d37
SHA256ff93773f55bf4a6a0242adf82276a8c95c0b244b9bc05e515c4e810c81a960e8
SHA5124aa65b8911d8a2a0f9ef0ee6e934b94db0a9ad4c2ec543b5edcf21486be43f6ab1fda6617ea2cbb85eff230628c9fa8e7649da915d6de695803b28e55bef5819
-
C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.sysFilesize
92KB
MD500528895f407d0fea3fce7231f022420
SHA175bd56a70877eebcd4747056d97805b7a5cbb57c
SHA25630f65c0da1060154ffb73a7fa2f0088881468c05b83b8a2aea3ecc45166334b8
SHA5122eec9fbbad03603502afa81f0996b6079fa9282de26d9b4dd3f8a5585291c6affad4abfacc33d463644ae37097c043524ec8c2331547fd6e0de3a9109de82bc5
-
C:\Program Files\Malwarebytes\Anti-Malware\srvversion.datFilesize
9B
MD5f726542aded84023a13eb78929733a4c
SHA1a6e6cc94faa58f8f9de95d6fcdd6a7ef8a86565c
SHA256ca8a93db9b23da70acf8913f25b52c74ba3cb9a705de99e8cffeec3053c97316
SHA512a0c11b133436d6f186c7ad44e307b7c7190b7c685c9e750e4d8eeb90e1c5efb9a6397ff575c998cf3d334a670b331b1ac5e30d6524e6c051e9a3fa5ddd367673
-
C:\Program Files\Malwarebytes\Anti-Malware\uipkgver.datFilesize
6B
MD574c6677020fc6b6c867aab117078bf5f
SHA18c46db37dc0b39eb963d4144539c8b591e122400
SHA256cdbb9bc874d71e154c71b68b1fe959913d286036dac11e226e5620c919ba9708
SHA5123f9db8d9bb25322f8d8e750750bf92dbe6ac63d686eced65cddfcd61178cf0e947118a491058414d4d2cbb4892e39815565669aee0dfdda23aece72d278292d0
-
C:\Program Files\Malwarebytes\Anti-Malware\version.datFilesize
47B
MD55ce5a9993fe65b33fceb820423c09d4b
SHA1cc2026078110225741bd5cf26064e26be7768ef8
SHA256de9191ff2f5ed5fe4f5485bab393fe0567f3249940d05414b23ee8ba6a375c61
SHA51211339670d1c58bdfee88edbd7b3a17c5ed86b8f7def80b267d684f74c657669744d825b76b15fa51e6e93d24126c506e49cdb59f4138b34e548d50306d2e902d
-
C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.jsonFilesize
1KB
MD5db978492323e8f5c30f36215b1ae0b80
SHA1becf02283722d92e83c15032bf20022cbff28abb
SHA25607299c88c2e92adc8802ff1fd42ce7325dd78782488bb8218e90a8530c49cb0d
SHA51212a9f5ad4cbf16ecf0265dfb9abb7c4534a21ecc109bb9e4346f18d5385985cb61feb24c06bea080b142ad640b1faf9c050a19c0fc37427cf560f232d67e32f9
-
C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.jsonFilesize
33KB
MD577687aa05046be89b3dd2cf34e95b097
SHA19051c74dab2f9fc1afb9d1809bfecda38b4fc0aa
SHA256a0636385ea7ab59155f7e7e96010bb49ecada30642c8ef04de4d210eff42e724
SHA512b0a0215e9d1003f8cfcb0319e2e85ae3c5a1c5c81924e8f21386416143280f3546e32c1e76c9cc8500970aec8eecf50a03e9fa02d8495575fb8fa789d2d020f2
-
C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.jsonFilesize
1KB
MD5eb6276a1f4cb11ce8e4a52e455d53e83
SHA150d987e0913eed45c1d14cd7eb4f0e4a7c96804b
SHA256c578d961f193c8d6f35535c12ab8e058b191756dfd6055bfacbd0ed868508b06
SHA512435d16c713ecbfe26c753ff83e8050432aa61ea570e39032aceb8102d93110fd3e418fe5592ab755d6a5ae79c45fb71d45dc393a4470181bb870383424e640eb
-
C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.jsonFilesize
1KB
MD52dfb98dd310454dac83193051c4e2ad2
SHA1b2e4a3ae3bb899f81370389253e358de6a581b12
SHA25633ca300359b390bac05e63dfc6875e2ffee48e4b4eaecfc6064745de78acbc9e
SHA512c076a022d3b3deeb1697ef8fe887846eb9fd62591ac364b3f284d0f38cb26d082da28ba096b9cf5c255a5a9ac11a811ab16289839fe403a142d8d4e0957ab10b
-
C:\ProgramData\Malwarebytes\MBAMService\config\ArwControllerConfig.jsonFilesize
607B
MD59c8153fd093dede1c8e240594e628f4b
SHA130797cb3d4fac247eed66037439c6f8c16e62ecd
SHA256b8f79dedd76bd3641010258002416742f3ad3738ce975d3b198d6de162226b9b
SHA512f1d84283089d777404bd86e3aa558ada4bf00a5afc48db7afd503c115f30ed7d171f198562717ecc39660c5f9ae98506c24b2db73d3e49ccefce8fa5bf2c73c1
-
C:\ProgramData\Malwarebytes\MBAMService\config\CleanControllerConfig.jsonFilesize
847B
MD580837caa8f1b873eb054821404647c42
SHA1e9c6e6667d6970478981f0d4122a2f3e45ae203e
SHA25646ae96f7e30e9cb54d92cd9c08bfe9c28580662f0e5dfea2023b3ad3b99c836e
SHA512e1e4a8c5243ab923ab94ca8f7f23799d1ba7f5394ddeace5d536f6e6a937bf6ae0e3b21021a2d3a5e8d55dcafcd84fbf16af3d8c999a888aace4966baab6b8cc
-
C:\ProgramData\Malwarebytes\MBAMService\config\CleanControllerConfig.jsonFilesize
846B
MD52461a1afdb214f19128535766da4eb37
SHA13b30ccadf1bf9fae65ffcca2b5641780b88fb68c
SHA256fbd5029f8de991f82a688e19f87ab85f5f880cca36daed8cb36fc320fdbd2a4a
SHA512cc7955f17751228e527888bcb4d7946f1e71041cfd1bddcf481996aa5bd5d774446710dd6be3fb246ec859482a4c961e3ea56a787654b7125b885efac170a14e
-
C:\ProgramData\Malwarebytes\MBAMService\config\CloudConfig.jsonFilesize
825B
MD5505e6890249340f2602651e16fecd225
SHA1755c04555198bad24848cc44bdf1de7f3b81c93d
SHA2564eeb8e12eb3c9ad460ff8bb943b81bbad1e06dda53f925476ba1f4688ef5d96b
SHA512f2b5af279041c22211899a8fd2fabf7581abeeba89a90ef7056e69dea8746d7ab2f1e56b684b9c2d9946f5a3bf99994f1afba98bdd1075c1d1a5325fec81a9f3
-
C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.jsonFilesize
15KB
MD54197d948d4a6eb3efa4e16063388d9d1
SHA12df076457e5de85c4ae8f218e2bec87c543440d2
SHA2560e17825505fb8f2abdd881c0e47eaf09243f10a7aadbe4f4b1dab9050e701f0a
SHA512b8ded4b5e853aa142a1527900e1486826a42490e9c0e049259bdb8584abf1ceeff94f067de7b500c421cb45cc9ec45cf1b51aebd4e9c65c18306d74efb3e475c
-
C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.jsonFilesize
15KB
MD5e3876f00b8817d0226fbcd1e0aa97158
SHA180a4e3ec9c9c07c7001a6e81e688cd36efea7754
SHA256c8f9aa8e7b162642c617f30082a5b8797ec29546057fb070df599a8b173ae1c2
SHA51220f608ea2ef4e1e459e4b5de25edeb7dc0e780aba3e09a1ab117b53814c798a08f2427c7f65409fbb11bab785c819f0e4954548b231127aea79d61fb794cc0f9
-
C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.jsonFilesize
15KB
MD5c39081ef81e3d320ce0484bcbcdf8d22
SHA16d6f0ecb9506a04d68f7db8a681ca5cedcce5b6c
SHA2562d86fe03337e58287eec2fa2f0460b0a26aed1d39dce47cda3b4383d6c3b0fba
SHA512b199ef7284d2300b67391f3684d128ba1bfe2d6e6959676019bb91736882cf771f45b84899173751dfb0d91171ec4b76f96ad9c2b4e6b92541e087306e1675ba
-
C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.jsonFilesize
15KB
MD51c0df124a2743798663c5815a4fdc9a5
SHA15e188e49dc933a8b0c9eabb3de96fdd5c3bab06f
SHA256909197c4ec84b13f18a8e09c7af3b60dc6a6b7f5eb983cb00d6676cefd91c200
SHA512fd330e1af543420b60f0ca8501c22a2204282133278d9dd3ca1e7e7fb062b97db9d05f87304d31db0c0ee4031e74998ce28c5b4c131cd5044d189ec41540dbcb
-
C:\ProgramData\Malwarebytes\MBAMService\config\MbamClientConfig.jsonFilesize
1KB
MD580f4e88fae63ff79fa95f1c903bc6b3e
SHA1066aa624a17c3ec9a240631c33e45f9ee20bb8b3
SHA25627da5bf77305ce79ca89a694ba664b5ac1e20ec547eb7f4b8d8fceb56ca2912b
SHA512c01df7ac70d18dd8ffd64db48c7cbac2b8ef4941286c2a4085a5d9e41d5ef5bbf7973974b1c8f4a069da3e9d82aa5693afda71e0c02bfe39d406c322e79e186e
-
C:\ProgramData\Malwarebytes\MBAMService\config\MbamClientConfig.jsonFilesize
10KB
MD5f49a2a541d3be6c91e116cde81f5c296
SHA1aa2faad6eec0e69ea8df3c0cb0cee0909bd57b30
SHA256a661e2fa542459e9ea8e5863480165bf325470840068bc1de3694326382b283d
SHA5120c41db0bcbf9fd3bee78a9aac8d79f2d256e67e90b42e4c5416899d1c44f8372c3c24876b886695acd3aeab037b7f12418e6a350b8f82f4fa36637b58dc7ed1c
-
C:\ProgramData\Malwarebytes\MBAMService\config\MbamClientConfig.jsonFilesize
10KB
MD54dbbd9f814c7ea26568c152f54a210d0
SHA1a672fba2e0b48ade819dfc7d27634b9c51af289f
SHA2563301c7aefb7955146612887356d6b00b0ffc55d144f97354a9d39a0bb794a669
SHA512e685d0bbcd0b47a06f011de6804e1cf2afc6cf1bbed7c56d130f9808919db2d614b5e14b5b46552ae1ffd273e9e2e13eea4a52625db6bd93791507c3aa784734
-
C:\ProgramData\Malwarebytes\MBAMService\config\MwacControllerConfig.jsonFilesize
1KB
MD5c5cd9626111f856fd1ecb04f90ff806f
SHA19f2b6987984175d02529dadee632d200e9cc8ad1
SHA256e24b730201231dc51db26a8b5856bdf1d0e8b8a4a184713b663e16ca3913d80d
SHA5128e6247ff3e083158d7872a1e6df8551d951c25da9c059fba292ea9470f9aeeb6a0dc1c6ba0e5c40567a30183785904b153650cc75a47599da7178846ff31e744
-
C:\ProgramData\Malwarebytes\MBAMService\config\MwacControllerConfig.jsonFilesize
2KB
MD58740feedceb5e2ad6a3fb0aed5a70899
SHA1e9eae790b2d1c2413a9667a8914780152e58e22a
SHA2560a8cdb1ff8a8dea75f809054354696098e20c7033d73bd158aa8678257e63e7d
SHA51238733de4452f353c9d3864e6e1ddae7b679d7fa2b7b881896d5b1d82fa5c6c7eafd950dc06d3a246de956791d24c769dbbf267014174ac7b363aa3e9ff43d357
-
C:\ProgramData\Malwarebytes\MBAMService\config\PoliciesConfig.jsonFilesize
903B
MD51c020706e24ecc6ef80a5447c6d5deab
SHA1dec6ccd00682abfe069ef06787f2359ea666ae68
SHA2560b68692435b977d7e598916dec7b91ecb2af8258dac7ed5904f657b5c00b744f
SHA5123901df2335f26ac73d1fdf39f034ec3344d77ad4e0dddc8c45562fb9aca44ebd9f8bbcb2529b24f50a24dd288bcebe28d789dfb477e497497d1ba585fa243898
-
C:\ProgramData\Malwarebytes\MBAMService\config\RtpConfig.jsonFilesize
1KB
MD5754c39bc25aa432f0bfc21c4d66a1d14
SHA1eb457ac159914ec396284bc4087fc1a70bc158d2
SHA2567c282b8f431827ecba1e1d67f6dfaf41080d153a12aeed3a6b715b45fb925cdb
SHA5128f93de78e58af2be8ea8237169f230a8f4727ac929b1f8b781ce1c464433c3c0ac352ddb7026df71627ea9aa209087f182157b6b91ac2ae76e0de65e5b73bdd5
-
C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.jsonFilesize
2KB
MD5c7fd4d5350b053739e73c6329b133b45
SHA17ee19b0bcff7419748270a8cb36950944ed34da6
SHA25610f23cc4680c3ba083192c81c3339076598c69b92dcb95a2a0d9e0910026b497
SHA51268216c30f950af97839bd6f60d9fbedd36ff868267c13132e20e06911e847b282cc15e3e2b35008f6b14a972bada1405eaef1904171005daf13f39c730e82d7c
-
C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.jsonFilesize
4KB
MD53df27f069f805336a81a5d1bef91f375
SHA1d8702a370c790b53bca505cb782128eada6c0f60
SHA2563e9a403a56d93caf01ea44ec17bd0d3e546d8a8241ff9d5dd87770911e81d53f
SHA51298c4ad4f8df73e0eebc4006713167233e3bc2226d5481d0ea0d618ee6aa8ddc6a5b48ab092d726e21cb315b3d1462598eeb55191044f50ce57f5ac3157e15d1c
-
C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.jsonFilesize
4KB
MD56c45ae373f230b890de964f063e6fae8
SHA1f7d5a6198619309cb0ada1e02562f8f90d6ff626
SHA256381d130bf7b839b2505e225774fd5284d622091dd1a378dbd0099b6dae1aa439
SHA5123ff44422a3ca517ce176e3f4f76d50f714bd448377962c08ba062951be133f0bf959046bf33fc07960eaa0f7f6265577c85a623618835f9bb9a711b75ab155a8
-
C:\ProgramData\Malwarebytes\MBAMService\config\SpConfigFile.jsonFilesize
11KB
MD5ea7a4b19d759be53ca7a924c89db29d2
SHA1901c7728dc2bc4782cbaf4eedb407a9f25ceb62a
SHA256a3adc0cb74c6d2f8b892254ba02d9053a99311c7127ba66337f1d4fa0c3d37d4
SHA5120b1b6d3b79d1128691d51e86ae3c54ebbebe8db5d3b7d4d52177fc7aafc413dd4d3a4680e5a27096323fa863193a7c83054781e9b06af7e821c865089431a5c5
-
C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.jsonFilesize
1KB
MD50e517807dc606a7a5bc18e2667cd05e8
SHA1ab10a2c91629689ce3d241e437e0bd54843b5623
SHA25650ef88dd35bcddf0936b76610b942ecf6cc573566e54cef8f4eaecab7167dc99
SHA5125006877229b4888ccb222ee8683769aa2b5bc95ede543d67cb1a9d2483c518008ad1c44300ec2a4d78e3ad7059e42067c8ed6ed8afa4e17a7c0875421b2dc601
-
C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.jsonFilesize
1KB
MD58dd0957245270bb5afc2cc33ebe129ba
SHA1598e06aa836660885564d318a87c2b40e2eb6d26
SHA2568cbf7671477af1f7d029764dbcacbbe71fb423a475def8292f131a94b8e45fe2
SHA512271e90483c9340b0155b967d3a8a48c4d8245efb3d74038b722fd5556533d76d889bf0c0f36aa0b595d40f1ae873cb9d5d48e2fd435ede4ab2efa61fe75f5c74
-
C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.jsonFilesize
1KB
MD57c9a728e5550add50a51a210df863969
SHA1063246a0188fcc1e2439e8f91523a8aec2c8f96e
SHA2560250aca0f8e5d093acccf33266086fcb928ec2bb9e494fa2384d49425c404c3b
SHA51276dcc1b01fc0e39163d2e70038b1ecb39568b06da9869ee4cabbde77c5c3a193de11d5f0175abdbcbb281e6b1ccc5514b0c93d0c1a09740f118def3f98116412
-
C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.jsonFilesize
1KB
MD579e5e077fa2ec903d0a4398b71ecacc7
SHA116c1ce3f8aa7fc08e3d92e566ec3929cf548192f
SHA256c97132bd89fe5db39a1d505253d612cfde8c42ee0d3040b64b89c06ea0d5df77
SHA5128c23e51aa3dde9138a5b7fa960119528643ac85c44ee35246330708eae0affbd0e4c9fb41cabb0e27dfe193183d98405fca661f204669742a6d692ce1e688fd6
-
C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.jsonFilesize
1KB
MD5e678826bd48bd151865c090e980c4bcb
SHA1c4587e242c493fda8ae544376e83ddac82ce4c21
SHA256cfb08cf0b232d624c21c4f42346f7db4d5b14f2d0a5f9363ef47fa1bb1db611e
SHA512b6b3d4f4e2c95f37630c8a6ae3f0740aa50d8bbe78fd317ead115f60c3d4cd99badce44f92f8e348f9a67118aeb6034bda32c49fbd22835de8e00854d538db5d
-
C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.jsonFilesize
1KB
MD5b017333c143a44cf340a96e184f2e8d5
SHA17002859c12e2be8c026cb01ed8c47376dbcf1d02
SHA256bede9f69004dff29919939aed107492efa0b89145b914ecb0ae377f443592d87
SHA512362cc18717854c87cbcffeeb1c3acc3823b3960af162ed674b45e9bf9423a8bbb4feae694262206077172fcea47b50ea872bf589225d432f721ecabc8b8381a0
-
C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.jsonFilesize
1KB
MD52335133930c51f7591171ea033b2450b
SHA1ea50ba63d6a591874ca7dd4ee75448e5c9aa4a8a
SHA2565ca636411304b79e0f74a8c24269956912b13a9dc29ba07372b486046ded9550
SHA512eaec1c305921fcb293abf9b4e21c39d242e81b45a5dc1c624b223ea1a9fee3ff9ef155d16f01e24a270f18f24e850e39000a455123f42e0a5302f083bafba899
-
C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.jsonFilesize
1KB
MD5f033bbc3d0c511e5a73608add0991402
SHA12217954c8c80ff60de6dc01983d3954bfc2e73ab
SHA256b21869ca08c0a591447a7f40e2fda9b19358dbabad102e5e2a6d9f9c64488c56
SHA512631409a522dfb2439f5fc5f9c985bdc61ce3d846d46a8ab3abe8b2d17097a56a3d8604a2b7d7b3613f1274fad43829ef326011d288b3ec94a9da11953d33c42a
-
C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.jsonFilesize
1KB
MD54a2f3d722089bbdb47fb32789d4b4042
SHA15ff91db29f7ec1e201aeaf9e9a5ac4db40e4ac42
SHA25619df1b69d2c58824a28594783201db4cd775162fc8bf61257534cf93c5e35a5a
SHA5127d79819d0191d489958917ceff0552b3a56974b93c2a6017350a6abde67840f2eaa307946c5458dc96e7bd60a3a633d4784503bf3909c528183c5036ba7391d3
-
C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json.bakFilesize
1KB
MD587e12d5a66ded19a27ebecaedf0088fb
SHA10361752b44d751cb2e043c8ef5d033b05613da23
SHA256a2027d226a4b86d61ffe33bf4b206f0d7e027f6e44c96bfe0895cc2d5881d0f2
SHA512b565f51cfcf9ddade60a70e3f8ce2d453b79c4967d488fee920d75a7a8fc7faba18ebd824d4d2a6b761adb9372421cf1edc5cfef0c96e53bd713ecc9df8a1971
-
C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json.bakFilesize
1KB
MD5461f5f123101f5bed99ece66eea5e78f
SHA1c95ebdd2fe0fc0491441dd63710459eb9bcfe291
SHA256c2a2dd2e1e884f78d9b12c8fa8c9c3d0060b28c516228907ecafb474650da5bf
SHA512db46da431e461e364fd9ba0e9b7eb5b6ae9a534d74f553abb8944acb460bde748e4601184ed5d2a717b79246e4f68b6fdeda843877097b4fceb536247b0deb14
-
C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json.bakFilesize
1KB
MD53f2880263b1a6a1a5a7beb4b1078d16e
SHA1c17c75ff3a9557a728c6188a2dcf3068b3f71bcd
SHA256df615cb9034dc2e41a58708b4ad161f21213267deb1bb63ad4aa89debf08fb42
SHA512b70caa24fc0bafd73fa7a881c436ef4c497a853ad9f6c66294bf5dc9eb149ccdbe9f56437d0021b818e4867fcf44fe014acfb772a259707ac180bd721fa807eb
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\Actions.dllFilesize
100KB
MD566aa5f5239a231ee96863f0ecdc37f9b
SHA16cc73e187804a31ad4fec0b2158bef9de6794917
SHA2567a1f097855641896c9d7c85d785eb2e1939db6f40b8db9617b93f6e50b39770c
SHA512899b438e29acda38b5e338262badf95c713945118b4e9e5e0cf0bd8474e993da4bf412c5bb14407e89f1ed42218b0205f58cd64d18ba3f519bedc588c2033b63
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\BrowserSDKDLL.dllFilesize
255KB
MD5681027595ce6d1c10ffc556d774d0563
SHA1775be6c3cbf393966f461339568ccd380aff579e
SHA2562b64db3db5afd781be9d721e3bcce959cc71d5638e83944899ac067d2e852eb5
SHA512fbc24eafeafde50274198fa7a7f129c97cc8cb3024dda502102b3d60e5107cd2ebc5d6c5a9c07bc043a61e40e2a5b86948ca8f494fa58b62a2a9b46886adee38
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\Global.nmFilesize
137KB
MD5a523f54335aa3996f6fedc0eb00066bb
SHA104e0584c79b86398d0616b475d782b3d6dcf18e9
SHA2569951915f993d3b7f601630c9f9def39890d0f9b186327ec16474df4068f41e80
SHA5120a2422b7b3ac33798607b289d07c34920e59f7b57bff75a3ad4896c0374d1ef30ae1b836bc57b976beeca8e1c2f6205b0af204a75b7f7a73529ea280b9254723
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\Global.srFilesize
94KB
MD509f106df552f0aa9909e0afde6a5bfe0
SHA11405f899b8ba9253f9105f714fd98d74def5ea49
SHA2563af01dcba35bf99ee870845c685d7efea849c706e061b0e59b48606e32d67646
SHA512a8e12b7fcc95a883311eedbe87b438d025620f2b53ddd7827dafb53c49d17a8b184c214874f1fd04b1c9e1f1db9121ea951e10468f0e01408a356c9bf00661e6
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\ig.exeFilesize
115KB
MD5c565eaae35a2cb6511e7775c82036c2b
SHA146be448d3298fe11977077393bc1f1296505a437
SHA256e25dc2076610fb218b26ddbb6a7c432b52c3bc3b2b13922852fc4955df64f4b2
SHA512f8170f52d115adbebc512ed55eb9b818ca54768e7c9468233de6ab50f7af4905d384164de5e2a82da01be3e8b7616a2c19da9f3c465dfc66da989d3821b4ec44
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\rules.mbdbFilesize
204KB
MD547cba191a28ad023c778172b85059c4a
SHA164a486350a2ef5fb80765677251fae94c9ef861c
SHA2562a059e6072f53be5fed61a75cfe7617ffdf0d1b122853c7e66835b6f32dc2cdf
SHA512cd9f63b6db92af6f2b1ecd4ff516c5d5a596059724bedf288926a5d29d6ccd781491a6abc980440837ac4121ad70f13e62d2a8b1b12307084c2e8c0d78c7b059
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\sample.dllFilesize
152KB
MD54ce8294c8e85e97a476dbea6a85d3792
SHA1339a1fac6393b6d029023cab46bf847f34fbfc33
SHA256a18ff5e90b47d481c81b52c70d96a550264f13cd0e45ddc3ee7d455d1643e867
SHA512d9e6a7a70d456d0cf898b0f50bc20abeb65c04cf746b665559aa20d9f207d2a7909407e0ad070b2a8837018a0bd56f8aa346ec665287d1789d5acdeae81b0902
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\scan.mbdbFilesize
196KB
MD5972a3c411a96b241d3b2896675a264b6
SHA12e4aca42f2c87348490fa3852ac9866b2c3d8a63
SHA2565a59748d0b2e76e9649ba0b90b62bf31a921630d56a82dc50f556dd975e3c9cb
SHA512e6db14300097371fef01440accdd56a51765254e461e40b522d746d8da58591673ce026bba39aa246b73fce3eef86a46a1b0e042c942d2ab5816cee2c4f2604f
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\tids.mbdbFilesize
177KB
MD52c9d746b882deedc823976deb17c0c75
SHA1e5aaf244c0101ddbb0e51ffe0c872d92d3c60502
SHA256478d2f5639d5af50dcf7fc463a61d3317e49a934855d66570d7c74adbdec9dfa
SHA5125d1a6c63655f7c00e0c6d09fe7495a6e513f266212eb655e578fda52fc9afee34898a5862260ca10f62aff640db0a131e1edd8e19ebc978a9bd9e819ab1e30e2
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\wprot2.mbdbFilesize
260KB
MD594cc11949856b532cbd51117e44f61c8
SHA157d76c65a05b0ec78341177eb1d8eabd52e781d9
SHA2566b25be3ee2033bbb69d8bf6803d88da5e95bd6dc8f516aa21c9abc430f3a7360
SHA5125408a23b36e7402558c5f13478929703f12535d4b6724d0bbed653a5a95fdc5fd0b54871503e9867576fbb866fc6b6933c12dab9eac3d23b2cda96acb60b6673
-
C:\Windows\System32\CatRoot2\dberr.txtFilesize
149KB
MD5129c1f1c77b539aa983e9c2d16e58696
SHA10be80bceebe67b66e50fa5c4af517b341f40851a
SHA256d28b60ee7deb54ddd2ea661a12e2c9c7b0b11645a9e1ed0705dafd7e7699f2ea
SHA5123637872307ff631263d444d15c93e19986ef5d95cd1be2e56d71485e424ff831e063ec62de85e5c2479a15cd4ee8e35abdae45a895cc5b1c1a5c81ec6fcc3fd3
-
C:\Windows\Temp\MBInstallTemp5f645f47b66a11ee9102d2066d8f1295\7z.dllFilesize
1.6MB
MD5ab8f0c1a37c0df5c8924aab509db42c9
SHA153dba959124e6d740829bda2360e851bcb85cce8
SHA2566e223b275b84d948cc5ae1f161f0bfff2adb34de04634c84d7dbe9305a4998d5
SHA512ff8a26e8fd5a08c74e5ba93a564e0d3cd932754e7f06993a365bfad06670497889e69ec45bfba1378040b72f82d468e79682beba2439937bb29d2a41da940d4a
-
C:\Windows\Temp\MBInstallTemp5f645f47b66a11ee9102d2066d8f1295\ctlrpkg\mbae64.sysFilesize
154KB
MD595515708f41a7e283d6725506f56f6f2
SHA19afc20a19db3d2a75b6915d8d9af602c5218735e
SHA256321058a27d7462e55e39d253ad5d8b19a9acf754666400f82fe0542f33e733c6
SHA512d9230901adeecb13b1f92287abe9317cdac458348885b96ef6500960793a7586c76ae374df053be948a35b44abe934aa853975a6ccd3788f93909903cc718c08
-
C:\Windows\Temp\MBInstallTemp5f645f47b66a11ee9102d2066d8f1295\dbclspkg\MBAMCoreV5.dllFilesize
3.9MB
MD54c65d93d7ba454fca55243eac6aac111
SHA1738850579df9c406d89e36b27a77817e90e6b3ff
SHA256933edf9ed4e974784ccb63083770981499a7594a055c7a55129d93c834851678
SHA512e157864e0897a6637bde7b2ceef96f5f3e58ec1f0a323a45331383ad908fc038421f5d722c8b85c65d14eb8739913af528bcff63dd2b5a89cb61e848c7bf2cbe
-
C:\Windows\Temp\MBInstallTemp5f645f47b66a11ee9102d2066d8f1295\servicepkg\MBAMService.exeFilesize
7.2MB
MD574527ef67eaa9cf60fa22a3df59d6ecf
SHA1a0cf41107e046f41361fb65a98ca630d4b9c41a4
SHA256e896ad996024b9ccb3ba09e6c57c85a6918864b3166bc65e9aae90adc2428cac
SHA51258efeb1911e03be311ee87747f546a36cbaaebea9a8207043d42c846913ebcf3a74ed63b7b200418821e06e20bbecd17756aa924e72a435bdc2441c3e0f97983
-
C:\Windows\Temp\MBInstallTemp5f645f47b66a11ee9102d2066d8f1295\servicepkg\mbamelam.catFilesize
10KB
MD560608328775d6acf03eaab38407e5b7c
SHA19f63644893517286753f63ad6d01bc8bfacf79b1
SHA2563ed5a1668713ef80c2b5599b599f1434ad6648999f335cf69757ea3183c70c59
SHA5129f65212121b8a5d1a0625c3baa14ef04a33b091d26f543324333e38dcdb903e02ccc4d009e22c2e85d2f61d954e0b994c2896e52f685003a6ef34758f8a650c7
-
C:\Windows\Temp\MBInstallTemp5f645f47b66a11ee9102d2066d8f1295\servicepkg\mbamelam.infFilesize
2KB
MD5c481ad4dd1d91860335787aa61177932
SHA181633414c5bf5832a8584fb0740bc09596b9b66d
SHA256793626d240fd8eefc81b78a57c8dfe12ea247889b6f07918e9fd32a7411aa1c3
SHA512d292e028936412f07264837d4a321ecfa2f5754d4048c8bcf774a0e076e535b361c411301558609d64c71c1ce9b19e6041efa44d201237a7010c553751e1e830
-
C:\Windows\Temp\MBInstallTemp5f645f47b66a11ee9102d2066d8f1295\servicepkg\mbamelam.sysFilesize
20KB
MD59e77c51e14fa9a323ee1635dc74ecc07
SHA1a78bde0bd73260ce7af9cdc441af9db54d1637c2
SHA256b5619d758ae6a65c1663f065e53e6b68a00511e7d7accb3e07ed94bfd0b1ede0
SHA512a12ccf92bead694f5d3cba7ff7e731a2f862198efc338efc7f33a882fe0eb7499fb3fb533538d0a823e80631a7ca162962fbdfd78e401e3255672910b7140186
-
C:\Windows\Temp\MBInstallTemp5f645f47b66a11ee9102d2066d8f1295\servicepkg\mbshlext.dllFilesize
104KB
MD546f3df83ee49c0b7066de5d14b163510
SHA184b1f99ba4ed2a1e21f00ac681fa6755f2f700d7
SHA256b8632991ef1f4aed871c3824e47d3ceafa58bc97de0472e7bcfe51d844b9ebae
SHA512067203c11192dd169937182c6bddaf2053d48d963c5ed130895868ab4e1ebec4a3ee6431e6e586b1fdb365cedaf64b84af423a7b9f19b6aa2e975ee5a2ecb512
-
C:\Windows\Temp\MBInstallTemp5f645f47b66a11ee9102d2066d8f1295\uipkg\QtQuick\Controls.2\HorizontalHeaderView.qmlFilesize
1KB
MD5d8c9674c0e9bddbd8aa59a9d343cf462
SHA1490aa022ac31ddce86d5b62f913b23fbb0de27c2
SHA2561ef333b5fb4d8075973f312ef787237240b9f49f3f9185fb21202883f900e7d7
SHA5120b86ec673133f6400c38b79f9ba4f7b37ce5afdab1a2e34acbf75019e2590cc26b26d323ddc1567c91375053c9c8593be0615389db8eb1a8d1eb084ad4200b82
-
C:\Windows\Temp\MBInstallTemp5f645f47b66a11ee9102d2066d8f1295\uipkg\QtQuick\Controls.2\Imagine\VerticalHeaderView.qmlFilesize
1KB
MD5829769b2741d92df3c5d837eee64f297
SHA1f61c91436ca3420c4e9b94833839fd9c14024b69
SHA256489c02f8716e7a1de61834b3d8bbb61bce91ca4a33a6b62342b4c851d93e51e0
SHA5124061c271db37523b9dea9a9973226d91337e1809d4e7767e57ac938d35d77a302363ed92ab4be18c35ba589f528194ad71c93a8507449bf74dd035acf7cdb521
-
memory/1272-4063-0x000001C7FB600000-0x000001C7FB953000-memory.dmpFilesize
3.3MB
-
memory/1272-4238-0x000001C7FB600000-0x000001C7FB953000-memory.dmpFilesize
3.3MB
-
memory/1272-3224-0x000001C7FB600000-0x000001C7FB953000-memory.dmpFilesize
3.3MB
-
memory/1272-3213-0x000001C7FB600000-0x000001C7FB953000-memory.dmpFilesize
3.3MB
-
memory/1272-4102-0x000001C7FB600000-0x000001C7FB953000-memory.dmpFilesize
3.3MB
-
memory/2456-4268-0x00007FFAEAE30000-0x00007FFAEB39B000-memory.dmpFilesize
5.4MB
-
memory/2456-4267-0x00007FFAEB3A0000-0x00007FFAEB7BE000-memory.dmpFilesize
4.1MB
-
memory/2768-4176-0x00007FF7EBC90000-0x00007FF7ED354000-memory.dmpFilesize
22.8MB
-
memory/2768-4178-0x00007FFAEAE30000-0x00007FFAEB39B000-memory.dmpFilesize
5.4MB
-
memory/2768-4177-0x00007FFAEB3A0000-0x00007FFAEB7BE000-memory.dmpFilesize
4.1MB
-
memory/2768-4179-0x0000023F854D0000-0x0000023F854E0000-memory.dmpFilesize
64KB
-
memory/2768-4251-0x0000023F854D0000-0x0000023F854E0000-memory.dmpFilesize
64KB
-
memory/3684-4070-0x000001DEF99A0000-0x000001DEF9BA0000-memory.dmpFilesize
2.0MB
-
memory/3684-4068-0x000001DEF9560000-0x000001DEF99A0000-memory.dmpFilesize
4.2MB
-
memory/3684-4067-0x000001DEF6FB0000-0x000001DEF6FC0000-memory.dmpFilesize
64KB
-
memory/3684-4066-0x00007FFAEB3A0000-0x00007FFAEB7BE000-memory.dmpFilesize
4.1MB
-
memory/3684-4065-0x00007FFAEAE30000-0x00007FFAEB39B000-memory.dmpFilesize
5.4MB