Analysis
-
max time kernel
929s -
max time network
850s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system -
submitted
27-03-2024 22:30
Static task
static1
Behavioral task
behavioral1
Sample
MBSetup.exe
Resource
win11-20240221-en
General
-
Target
MBSetup.exe
-
Size
2.5MB
-
MD5
1e885823577394ea61ea89438ffe2954
-
SHA1
e53e96f7374790bdad8a614949b398b055c3a27b
-
SHA256
7c0b9bceed390f7f28135431c09ac51469ee8e2b8095fb36a37315d811d9ba9c
-
SHA512
73f600833dad0047b6444110d722dc95237b38bb486abc7fc8e4f59b69e2154c885fb46d65f488d5139a0b6e76ebde33ea72711c7f58436650ef992fb8995627
-
SSDEEP
49152:Lw3ye9SPQ1sjDAVj+JeRanStQyfvE0Z3R0nxiIq2ddAsuysSiSF:4yeoCVj+c6KtQRq2ADSiSF
Malware Config
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
MBSetup.exedescription pid process target process PID 1180 created 3304 1180 MBSetup.exe Explorer.EXE -
Drops file in Drivers directory 15 IoCs
Processes:
MBAMService.exeMBAMService.exeMBSetup.exeMBAMInstallerService.exedescription ioc process File created C:\Windows\system32\DRIVERS\MbamElam.sys MBAMService.exe File created C:\Windows\system32\DRIVERS\mbamswissarmy.sys MBAMService.exe File created C:\Windows\system32\DRIVERS\MbamChameleon.sys MBAMService.exe File created C:\Windows\system32\DRIVERS\SETFF2B.tmp MBAMService.exe File created C:\Windows\system32\DRIVERS\SET196C.tmp MBAMService.exe File created C:\Windows\SysWOW64\drivers\mbamtestfile.dat MBSetup.exe File created C:\Windows\system32\DRIVERS\mwac.sys MBAMService.exe File created C:\Windows\system32\DRIVERS\SETC9A.tmp MBAMService.exe File opened for modification C:\Windows\system32\DRIVERS\SET196C.tmp MBAMService.exe File opened for modification C:\Windows\system32\DRIVERS\SETFF2B.tmp MBAMService.exe File opened for modification C:\Windows\system32\DRIVERS\farflt11.sys MBAMService.exe File created C:\Windows\system32\DRIVERS\mbam.sys MBAMService.exe File created C:\Windows\system32\drivers\mbae64.sys MBAMInstallerService.exe File opened for modification C:\Windows\system32\DRIVERS\MbamElam.sys MBAMService.exe File opened for modification C:\Windows\system32\DRIVERS\SETC9A.tmp MBAMService.exe -
Modifies RDP port number used by Windows 1 TTPs
-
Sets service image path in registry 2 TTPs 2 IoCs
Processes:
MBAMService.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MBAMSwissArmy\ImagePath = "\\SystemRoot\\System32\\Drivers\\mbamswissarmy.sys" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mbamchameleon\ImagePath = "\\SystemRoot\\System32\\Drivers\\MbamChameleon.sys" MBAMService.exe -
Checks BIOS information in registry 2 TTPs 6 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
MBAMService.exembupdatrV5.exeMBSetup.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion MBAMService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate MBAMService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion mbupdatrV5.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate mbupdatrV5.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion MBSetup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate MBSetup.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
MBAMService.exeMBAMInstallerService.exedescription ioc process File opened (read-only) \??\L: MBAMService.exe File opened (read-only) \??\S: MBAMService.exe File opened (read-only) \??\H: MBAMInstallerService.exe File opened (read-only) \??\Y: MBAMInstallerService.exe File opened (read-only) \??\L: MBAMInstallerService.exe File opened (read-only) \??\P: MBAMInstallerService.exe File opened (read-only) \??\E: MBAMService.exe File opened (read-only) \??\G: MBAMService.exe File opened (read-only) \??\U: MBAMService.exe File opened (read-only) \??\A: MBAMInstallerService.exe File opened (read-only) \??\A: MBAMService.exe File opened (read-only) \??\H: MBAMService.exe File opened (read-only) \??\K: MBAMService.exe File opened (read-only) \??\G: MBAMInstallerService.exe File opened (read-only) \??\Q: MBAMInstallerService.exe File opened (read-only) \??\T: MBAMInstallerService.exe File opened (read-only) \??\J: MBAMService.exe File opened (read-only) \??\M: MBAMService.exe File opened (read-only) \??\T: MBAMService.exe File opened (read-only) \??\V: MBAMService.exe File opened (read-only) \??\I: MBAMInstallerService.exe File opened (read-only) \??\K: MBAMInstallerService.exe File opened (read-only) \??\X: MBAMInstallerService.exe File opened (read-only) \??\Z: MBAMInstallerService.exe File opened (read-only) \??\N: MBAMInstallerService.exe File opened (read-only) \??\R: MBAMInstallerService.exe File opened (read-only) \??\S: MBAMInstallerService.exe File opened (read-only) \??\N: MBAMService.exe File opened (read-only) \??\X: MBAMService.exe File opened (read-only) \??\Y: MBAMService.exe File opened (read-only) \??\Z: MBAMService.exe File opened (read-only) \??\Q: MBAMService.exe File opened (read-only) \??\R: MBAMService.exe File opened (read-only) \??\W: MBAMInstallerService.exe File opened (read-only) \??\W: MBAMService.exe File opened (read-only) \??\B: MBAMInstallerService.exe File opened (read-only) \??\E: MBAMInstallerService.exe File opened (read-only) \??\J: MBAMInstallerService.exe File opened (read-only) \??\B: MBAMService.exe File opened (read-only) \??\I: MBAMService.exe File opened (read-only) \??\O: MBAMService.exe File opened (read-only) \??\P: MBAMService.exe File opened (read-only) \??\M: MBAMInstallerService.exe File opened (read-only) \??\O: MBAMInstallerService.exe File opened (read-only) \??\U: MBAMInstallerService.exe File opened (read-only) \??\V: MBAMInstallerService.exe -
Drops file in System32 directory 21 IoCs
Processes:
MBAMService.exeMBAMService.exedescription ioc process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_6E4F36431D86962EFD432400DF65AC90 MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_6E4F36431D86962EFD432400DF65AC90 MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1B1401C7EC8E96BC79CBFD92F9DF762D_E35D496D1CD0B884BEBCAFED0FE61600 MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\FA0E447C3E79584EC91182C66BBD2DB7 MBAMService.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt MBAMService.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\572BF21E454637C9F000BE1AF9B1E1A9 MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\38D10539991D1B84467F968981C3969D_C92678066E2B4B4986BC7641EEC08637 MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\117308CCCD9C93758827D7CC85BB135E MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FA0E447C3E79584EC91182C66BBD2DB7 MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DA3B6E45325D5FFF28CF6BAD6065C907_FBEAFB4EE7383EC8E0A3A2C1EC7FCEAC MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\572BF21E454637C9F000BE1AF9B1E1A9 MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\117308CCCD9C93758827D7CC85BB135E MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DA3B6E45325D5FFF28CF6BAD6065C907_FBEAFB4EE7383EC8E0A3A2C1EC7FCEAC MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\38D10539991D1B84467F968981C3969D_C92678066E2B4B4986BC7641EEC08637 MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1B1401C7EC8E96BC79CBFD92F9DF762D_E35D496D1CD0B884BEBCAFED0FE61600 MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\229169D96B9C20761B929D428962A0A2_FC65190A8D1232A1711F16F9F20C5149 MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\229169D96B9C20761B929D428962A0A2_FC65190A8D1232A1711F16F9F20C5149 MBAMService.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 64 IoCs
Processes:
MBAMInstallerService.exeMBAMService.exedescription ioc process File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Fusion\Dialog.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Fusion\DialogButtonBox.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Universal\CheckDelegate.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\Qt5QmlWorkerScript.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Desktop\ComboBoxStyle.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Desktop\TextAreaStyle.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\Qt\labs\settings\qmldir MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\sdk\farflt11.sys MBAMService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\languages\lang_de.qm MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\api-ms-win-core-heap-l1-1-0.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\api-ms-win-core-libraryloader-l1-1-0.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Page.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Universal\SwitchIndicator.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Extras\plugins.qmltypes MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\sdk\farflt11.inf MBAMService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\api-ms-win-core-util-l1-1-0.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Base\TabViewStyle.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Material\ElevationEffect.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Imagine\DelayButton.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Imagine\Slider.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Dialogs\Private\dialogsprivateplugin.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\languages\lang_nl.qm MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\BrowserSDKDLLShim.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Fusion\RadioIndicator.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Universal\ScrollBar.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Dialogs\images\copy.png MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Dialogs\WidgetColorDialog.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Fusion\Frame.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Material\SwitchIndicator.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Universal\ApplicationWindow.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Fusion\ScrollIndicator.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Fusion\ToolSeparator.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Imagine\CheckBox.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\languages\lang_sl.qm MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\qmldir MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Base\RadioButtonStyle.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Private\AbstractCheckable.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Base\ToolBarStyle.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Desktop\RowItemSingleton.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Fusion\TextField.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\RadioDelegate.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Private\TableViewItemDelegateLoader.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Base\images\check.png MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Base\MenuBarStyle.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Universal\Label.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\msvcp140_1.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Fusion\SpinBox.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Imagine\SwitchDelegate.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\TextField.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Material\ScrollBar.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Tumbler.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Universal\ScrollIndicator.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\SPControllerImpl.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQml\qmlplugin.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Material\PageIndicator.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\MBAMCrashHandler.exe MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Material\MenuBarItem.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Extras\DelayButton.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Fusion\RoundButton.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\languages\lang_zh_TW.qm MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\mbamelam.cat MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Base\DialStyle.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.inf MBAMService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Base\images\arrow-down.png MBAMInstallerService.exe -
Executes dropped EXE 24 IoCs
Processes:
MBAMInstallerService.exeMBAMService.exeMBAMService.exembamtray.exembam.exeig.exeig.exeig.exeig.exeig.exeig.exeig.exeig.exeig.exeig.exeig.exeig.exeig.exeig.exeig.exeig.exeig.exeig.exembupdatrV5.exepid process 2488 MBAMInstallerService.exe 3632 MBAMService.exe 736 MBAMService.exe 1140 mbamtray.exe 2848 mbam.exe 4724 ig.exe 2488 ig.exe 1784 ig.exe 1700 ig.exe 4328 ig.exe 808 ig.exe 2212 ig.exe 1136 ig.exe 3296 ig.exe 1976 ig.exe 2392 ig.exe 1964 ig.exe 4060 ig.exe 1564 ig.exe 3452 ig.exe 2320 ig.exe 896 ig.exe 4300 ig.exe 5044 mbupdatrV5.exe -
Loads dropped DLL 64 IoCs
Processes:
MBAMInstallerService.exeMBAMService.exembamtray.exepid process 2488 MBAMInstallerService.exe 2488 MBAMInstallerService.exe 736 MBAMService.exe 736 MBAMService.exe 736 MBAMService.exe 736 MBAMService.exe 736 MBAMService.exe 736 MBAMService.exe 736 MBAMService.exe 736 MBAMService.exe 736 MBAMService.exe 736 MBAMService.exe 736 MBAMService.exe 736 MBAMService.exe 736 MBAMService.exe 736 MBAMService.exe 736 MBAMService.exe 736 MBAMService.exe 736 MBAMService.exe 736 MBAMService.exe 736 MBAMService.exe 736 MBAMService.exe 736 MBAMService.exe 736 MBAMService.exe 736 MBAMService.exe 736 MBAMService.exe 736 MBAMService.exe 2488 MBAMInstallerService.exe 736 MBAMService.exe 736 MBAMService.exe 736 MBAMService.exe 736 MBAMService.exe 1140 mbamtray.exe 1140 mbamtray.exe 1140 mbamtray.exe 1140 mbamtray.exe 1140 mbamtray.exe 1140 mbamtray.exe 1140 mbamtray.exe 1140 mbamtray.exe 1140 mbamtray.exe 1140 mbamtray.exe 1140 mbamtray.exe 1140 mbamtray.exe 1140 mbamtray.exe 1140 mbamtray.exe 1140 mbamtray.exe 1140 mbamtray.exe 1140 mbamtray.exe 1140 mbamtray.exe 1140 mbamtray.exe 1140 mbamtray.exe 1140 mbamtray.exe 1140 mbamtray.exe 1140 mbamtray.exe 1140 mbamtray.exe 1140 mbamtray.exe 1140 mbamtray.exe 1140 mbamtray.exe 1140 mbamtray.exe 1140 mbamtray.exe 1140 mbamtray.exe 1140 mbamtray.exe 1140 mbamtray.exe -
Registers COM server for autorun 1 TTPs 64 IoCs
Processes:
MBAMService.exeMBAMService.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{580243BF-3CEE-4131-A599-C6FED66BEB1B}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E1AC7139-D1FF-4DE9-84A4-92E2B47F5D2A}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{17BE78EE-B40A-4B9E-835F-38EC62F9D479}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{03141A2A-5C3A-458E-ABEC-0812AD7FF497}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{03141A2A-5C3A-458E-ABEC-0812AD7FF497}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{376BE474-56D4-4177-BB4E-5610156F36C8}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{11D1E5E8-14E1-4B5B-AE1A-2678CB91E8E5}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D372F21-E6DA-4B82-881A-79F6CA6B6AE1}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{130CD414-6BFD-4F6C-9362-A2264B222E76}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D5599B6B-FA0C-45B5-8309-853B003EA412}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D5599B6B-FA0C-45B5-8309-853B003EA412}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57CE581A-0CB6-4266-9CA0-19364C90A0B3}\InprocServer32\ThreadingModel = "Apartment" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F36AD0D0-B5F0-4C69-AF08-603D177FEF0E}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BF474111-9116-45C6-AF53-209E64F1BB53}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE8A9269-9E6E-4683-BCD3-41E9B16696DC}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{11D1E5E8-14E1-4B5B-AE1A-2678CB91E8E5}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F6D29500-933C-447C-9D88-9D814AF73808}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F36AD0D0-B5F0-4C69-AF08-603D177FEF0E}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F415899A-1576-4C8B-BC9F-4854781F8A20}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE8A9269-9E6E-4683-BCD3-41E9B16696DC}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36A65E46-6CC1-4CA2-B51E-F4DD8C993DDC}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DE03E614-112D-43E0-8E15-E7236CC32108}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{376BE474-56D4-4177-BB4E-5610156F36C8}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9DAB0CA5-AE19-41AE-955C-41DD44C52697}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{251AD013-20AD-4C3F-8FE2-F66A429B4819}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{17BE78EE-B40A-4B9E-835F-38EC62F9D479}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DE03E614-112D-43E0-8E15-E7236CC32108}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{580243BF-3CEE-4131-A599-C6FED66BEB1B}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F1C46F8-E697-4175-B240-CDE682A4BA2D}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36A65E46-6CC1-4CA2-B51E-F4DD8C993DDC}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36A65E46-6CC1-4CA2-B51E-F4DD8C993DDC}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{251AD013-20AD-4C3F-8FE2-F66A429B4819}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F1C46F8-E697-4175-B240-CDE682A4BA2D}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{03141A2A-5C3A-458E-ABEC-0812AD7FF497}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57CE581A-0CB6-4266-9CA0-19364C90A0B3}\InprocServer32\ = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbshlext.dll" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F36AD0D0-B5F0-4C69-AF08-603D177FEF0E}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E1AC7139-D1FF-4DE9-84A4-92E2B47F5D2A}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{376BE474-56D4-4177-BB4E-5610156F36C8}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D372F21-E6DA-4B82-881A-79F6CA6B6AE1}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{278637DA-FDFB-45C7-8CD8-F2D8A9199AB0}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{11D1E5E8-14E1-4B5B-AE1A-2678CB91E8E5}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E1AC7139-D1FF-4DE9-84A4-92E2B47F5D2A}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{130CD414-6BFD-4F6C-9362-A2264B222E76}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{130CD414-6BFD-4F6C-9362-A2264B222E76}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE8A9269-9E6E-4683-BCD3-41E9B16696DC}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F415899A-1576-4C8B-BC9F-4854781F8A20}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{278637DA-FDFB-45C7-8CD8-F2D8A9199AB0}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{580243BF-3CEE-4131-A599-C6FED66BEB1B}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9DAB0CA5-AE19-41AE-955C-41DD44C52697}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9DAB0CA5-AE19-41AE-955C-41DD44C52697}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57CE581A-0CB6-4266-9CA0-19364C90A0B3}\InprocServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F415899A-1576-4C8B-BC9F-4854781F8A20}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BF474111-9116-45C6-AF53-209E64F1BB53}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BF474111-9116-45C6-AF53-209E64F1BB53}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D5599B6B-FA0C-45B5-8309-853B003EA412}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F6D29500-933C-447C-9D88-9D814AF73808}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{278637DA-FDFB-45C7-8CD8-F2D8A9199AB0}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F36AD0D0-B5F0-4C69-AF08-603D177FEF0E}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F1C46F8-E697-4175-B240-CDE682A4BA2D}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F6D29500-933C-447C-9D88-9D814AF73808}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{251AD013-20AD-4C3F-8FE2-F66A429B4819}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{17BE78EE-B40A-4B9E-835F-38EC62F9D479}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DE03E614-112D-43E0-8E15-E7236CC32108}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D372F21-E6DA-4B82-881A-79F6CA6B6AE1}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
MBAMService.exedescription ioc process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MBAMService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MBAMService.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Processes:
MBAMService.exeMBAMInstallerService.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION MBAMService.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\mbam.exe = "11000" MBAMService.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\mbamtray.exe = "11000" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION MBAMInstallerService.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\mbam.exe = "11000" MBAMInstallerService.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\mbamtray.exe = "11000" MBAMInstallerService.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
mbupdatrV5.exeMBAMInstallerService.exeMBAMService.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA mbupdatrV5.exe Set value (str) \REGISTRY\USER\S-1-5-19\Software\Malwarebytes\FirstRun = "false" MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0\Common\Security MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\16.0 MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs MBAMService.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\15.0 MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\16.0\Common MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Malwarebytes MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0 MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Malwarebytes MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\16.0\Common\Security MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs MBAMService.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs mbupdatrV5.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\16.0 MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0\Common MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates mbupdatrV5.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\16.0 MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT mbupdatrV5.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs MBAMService.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\15.0 MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs MBAMService.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:\ MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\15.0\Common\Security MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs MBAMService.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot MBAMService.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\16.0\Common\Security MBAMInstallerService.exe -
Modifies registry class 64 IoCs
Processes:
MBAMService.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8FF168C7-A609-4237-A076-E461334BF4EA}\ = "_IMWACControllerEventsV10" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C7BCC13C-47B9-4DC0-8FC6-B2A489EF60EF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C0CEAFA7-4F65-418C-8A61-92B2048115EE}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{44AC1571-055F-4CC8-B7D8-EA022C4CC112} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E8D2DC04-56F2-4F6F-8E11-8CB2BB337FCA}\ = "IRTPControllerV17" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C85F3EB8-B099-4598-89C3-E33BAC2CE53D}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3F967173-2B83-4B7F-A633-074B06FD0C64}\ = "IScanControllerEventsV7" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{49207D05-5DFE-4F52-9286-1856A92A5BFE}\ProxyStubClsid32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{81541635-736E-4460-81AA-86118F313CD5}\ProxyStubClsid32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{346CF9BC-3AD5-43BA-B348-EFB88F75360F}\ProxyStubClsid32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{71AC94F2-D545-438F-9156-C231B7D94A56}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{82AA83E1-EC24-4908-90E5-FAA212B30200}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE8A9269-9E6E-4683-BCD3-41E9B16696DC}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5709DEEB-F05E-4D5C-8DC4-3B0D924EE08F}\1.0 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{71B13605-3569-4F4A-B971-08FF179A3A60}\ProxyStubClsid32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{56898B37-6187-4F81-B9C6-8DA97D31F396}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8307A4A5-A025-438B-B23B-8EE38A453D54}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C367B540-CEF4-4271-8395-0C28F0FDADDA}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C85F3EB8-B099-4598-89C3-E33BAC2CE53D}\TypeLib\Version = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F5BCAC7E-75E7-4971-B3F3-B197A510F495}\1.0\0 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EE77988C-B530-4686-8294-F7AB429DFD0C}\TypeLib\Version = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FA6C70E7-6A6D-4F4A-99BF-C8B375CB7E0C}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{929A5C6C-42D7-4248-9533-03C32165691F}\TypeLib\ = "{59DBD1B8-A7BD-4322-998F-41B0D2516FA0}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A0101B90-FD0B-40CF-90E4-33650F09A80F} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CC4D9C86-78F2-435F-8355-5328509E04F1}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B1F1EB48-7803-4D84-B07F-255FE87083F4}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B860FC17-5606-4F3A-8AE5-E1C139D8BDE3}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8CB653AC-F9CF-4277-BFB1-C0ED1C650F56} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5091804-600E-4226-BF28-80ABFDF4AFAB}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8FEFED84-854E-4029-A986-1D7774D4CF7D} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C0CEAFA7-4F65-418C-8A61-92B2048115EE}\ = "ICloudControllerV3" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{995A8F3B-6B5F-4773-898A-862D50142B4C}\ = "_IAEControllerEventsV2" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0C4652FC-FA35-4394-A133-F68409776465}\TypeLib\ = "{6C5B978B-68C9-45C7-9D6E-0BA57A3C7EB2}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BF474111-9116-45C6-AF53-209E64F1BB53}\VersionIndependentProgID MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B38EDC4F-A2CD-4F76-8607-F123FE4031D5}\TypeLib\Version = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3B42C782-9650-4EFF-9618-91118DF96061}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CE7ABFE9-8F8F-4EDD-86BD-9209FD072126}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E149FEF9-F1DC-4894-8A8E-AA53F6807EFD}\ = "_ICleanControllerEventsV7" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3F967173-2B83-4B7F-A633-074B06FD0C64}\TypeLib\ = "{5709DEEB-F05E-4D5C-8DC4-3B0D924EE08F}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{36BABBB6-6184-44EC-8109-76CBF522C9EF}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A82D6A8-59F8-4B47-BBD0-8F5E5DBB3C7D}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D4AC5360-A581-42A7-8DD6-D63A5C3AA7F1}\TypeLib\ = "{A23C190D-C714-42C7-BDBB-F4E1DE65AF27}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{698A4513-65F0-46A3-9633-220A6E4D1D07}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{130CD414-6BFD-4F6C-9362-A2264B222E76} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8FF168C7-A609-4237-A076-E461334BF4EA}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E2870643-0645-41F9-BCCB-F5969386162C}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C0D8223D-D594-4147-BAD8-1E2B54ED1990} MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FA6C70E7-6A6D-4F4A-99BF-C8B375CB7E0C} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4163399F-AB08-4E5E-BE28-6B9440393AD3}\TypeLib\ = "{49F6AC60-2104-42C6-8F71-B3916D5AA732}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99E6F3FE-333C-462C-8C39-BC27DCA4A80E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{76AD4430-9C5C-4FC2-A15F-4E16ACD735AC}\TypeLib\ = "{FFB94DF8-FC15-411C-B443-E937085E2AC1}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2E423AF9-25D2-451E-8D81-08D44F63D83F}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DF39921A-6060-472F-A358-1CE8D2F8779C}\ = "IScanControllerEventsV10" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{71AC94F2-D545-438F-9156-C231B7D94A56}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{96C7187E-6EC4-49BD-88C7-04A3A8A97CC5}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1917B432-C1CE-4A96-A08E-A270E00E5B23}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C731375E-3199-4C88-8326-9F81D3224DAD}\1.0\0\win64 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C731375E-3199-4C88-8326-9F81D3224DAD}\1.0\HELPDIR MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6655E528-3168-47A4-BF82-A71E9E6AB5F7} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{71B13605-3569-4F4A-B971-08FF179A3A60}\TypeLib\ = "{5709DEEB-F05E-4D5C-8DC4-3B0D924EE08F}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31BF2366-C6DB-49F1-96A5-8026B9DF4152}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MB.RTPController.1\ = "RTPController Class" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EAD7766B-F8F3-4944-AFE6-5D667E535709}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{172ABF99-1426-47CA-895B-092E23728E8A}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe -
Processes:
MBAMInstallerService.exeMBAMService.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa22000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F6108407D6F8BB67980CC2E244C2EBAE1CEF63BE MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d0140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b4030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3490f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d578112861900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0D44DD8C3C8C1A1A58756481E90F2E2AFFB3D26E MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 5c0000000100000004000000001000001900000001000000100000009f687581f7ef744ecfc12b9cee6238f10f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa2140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a2040000000100000010000000be954f16012122448ca8bc279602acf52000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 MBAMService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a MBAMService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\5A8CEF45D7A69859767A8C8B4496B578CF474B1A MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\1C58A3A8518E8759BF075B76B750D4F2DF264FCD\Blob = 0300000001000000140000001c58a3a8518e8759bf075b76b750d4f2df264fcd2000000001000000c2040000308204be308203a6a003020102021006d8d904d5584346f68a2fa754227ec4300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3231303431343030303030305a170d3331303431333233353935395a304f310b300906035504061302555331153013060355040a130c446967694365727420496e633129302706035504031320446967694365727420544c53205253412053484132353620323032302043413130820122300d06092a864886f70d01010105000382010f003082010a0282010100c14bb3654770bcdd4f58dbec9cedc366e51f311354ad4a66461f2c0aec6407e52edcdcb90a20eddfe3c4d09e9aa97a1d8288e51156db1e9f58c251e72c340d2ed292e156cbf1795fb3bb87ca25037b9a52416610604f571349f0e8376783dfe7d34b674c2251a6df0e9910ed57517426e27dc7ca622e131b7f238825536fc13458008b84fff8bea75849227b96ada2889b15bca07cdfe951a8d5b0ed37e236b4824b62b5499aecc767d6e33ef5e3d6125e44f1bf71427d58840380b18101faf9ca32bbb48e278727c52b74d4a8d697dec364f9cace53a256bc78178e490329aefb494fa415b9cef25c19576d6b79a72ba2272013b5d03d40d321300793ea99f50203010001a38201823082017e30120603551d130101ff040830060101ff020100301d0603551d0e04160414b76ba2eaa8aa848c79eab4da0f98b2c59576b9f4301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030106082b06010505070302307606082b06010505070101046a3068302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304006082b060105050730028634687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274476c6f62616c526f6f7443412e63727430420603551d1f043b30393037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274476c6f62616c526f6f7443412e63726c303d0603551d2004363034300b06096086480186fd6c02013007060567810c01013008060667810c0102013008060667810c0102023008060667810c010203300d06092a864886f70d01010b050003820101008032ce5e0bdd6e5a0d0aafe1d684cbc08efa8570edda5db30cf72b7540fe850afaf33178b7704b1a8958ba80bdf36b1de97ecf0bba589c59d490d3fd6cfdd0986db771825bcf6d0b5a09d07bdec443d82aa4de9e41265fbb8f99cbddaee1a86f9f87fe74b71f1b20abb14fc6f5675d5d9b3ce9ff69f7616cd6d9f3fd36c6ab038876d24b2e7586e3fcd8557d26c21177df3e02b67cf3ab7b7a86366fb8f7d89371cf86df7330fa7babed2a59c842843b11171a52f3c90e147da25b7267ba71ed574766c5b8024a65345e8bd02a3c209c51994ce7529ef76b112b0d927e1de88aeb36164387ea2a63bf753febdec403bb0a3cf730efebaf4cfc8b3610733ef3a4 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800001900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa20f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b4040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e MBAMService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F6108407D6F8BB67980CC2E244C2EBAE1CEF63BE\Blob = 030000000100000014000000f6108407d6f8bb67980cc2e244c2ebae1cef63be2000000001000000f6010000308201f230820178a0030201020213066c9fd7c1bb104c2943e5717b7b2cc81ac10e300a06082a8648ce3d0403033039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412034301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f7420434120343076301006072a8648ce3d020106052b8104002203620004d2ab8a374fa3530dfec18a7b4ba87b464b63b062f62d1bdb087121d200e863bd9a27fbf0396e5dea3da5c981aaa35b2098455d16dbfde8106de39ce0e3bd5f8462f3706433a0cb242f70ba88a12aa075f881ae6206c481db396e29b01efa2e5ca3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414d3ecc73a656ecce1da769a56fb9cf3866d57e581300a06082a8648ce3d040303036800306502303a8b21f1bd7e11add0ef58962fd6eb9d7e908d2bcf6655c32ce328a9700a470ef0375912ff2d9994284e2a4f354d335a023100ea75004e3bc43a941291c958469d211372a7889c8ae44c4adb96d4ac8b6b6b49125333add7e4be24fcb50a76d4a5bc10 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 MBAMService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\1C58A3A8518E8759BF075B76B750D4F2DF264FCD MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a MBAMService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E\Blob = 030000000100000014000000b51c067cee2b0c3df855ab2d92f4fe39d4e70f0e2000000001000000e1030000308203dd308202c5a003020102020100300d06092a864886f70d01010b050030818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a30818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bdedc103fcf68ffc02b16f5b9f48d99d79e2a2b703615618c347b6d7ca3d352e8943f7a1699bde8a1afd13209cb44977322956fdb9ec8cdd22fa72dc276197eef65a84ec6e19b9892cdc845bd574fb6b5fc589a51052894655f4b8751ce67fe454ae4bf85572570219f8177159eb1e280774c59d48be6cb4f4a4b0f364377992c0ec465e7fe16d534c62afcd1f0b63bb3a9dfbfc7900986174cf26824063f3b2726a190d99cad40e75cc37fb8b89c159f1627f5fb35f6530f8a7b74d765a1e765e34c0e89656998ab3f07fa4cdbddc32317c91cfe05f11f86baa495cd19994d1a2e3635b0976b55662e14b741d96d426d4080459d0980e0ee6defcc3ec1f90f10203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147c0c321fa7d9307fc47d68a362a8a1ceab075b27300d06092a864886f70d01010b050003820101001159fa254f036f94993b9a1f828539d47605945ee128936d625d09c2a0a8d4b07538f1346a9de49f8a862651e62cd1c62d6e95204a9201ecb88a677b31e2672e8c9503262e439d4a31f60eb50cbbb7e2377f22ba00a30e7b52fb6bbb3bc4d379514ecd90f4670719c83c467a0d017dc558e76de68530179a24c410e004f7e0f27fd4aa0aff421d37ed94e5645912207738d3323e3881759673fa688fb1cbce1fc5ecfa9c7ecf7eb1f1072db6fcbfcaa4bfd097054abcea18280290bd5478092171d3d17d1dd916b0a9613dd00a0022fcc77bcb0964450b3b4081f77d7c32f598ca588e7d2aee90597364f936745e25a1f566052e7f3915a92afb508b8e8569f4 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8DA7F965EC5EFC37910F1C6E59FDC1CC6A6EDE16 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\5A8CEF45D7A69859767A8C8B4496B578CF474B1A\Blob = 0300000001000000140000005a8cef45d7a69859767a8c8b4496b578cf474b1a2000000001000000450500003082054130820329a0030201020213066c9fd29635869f0a0fe58678f85b26bb8a37300d06092a864886f70d01010c05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412032301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f74204341203230820222300d06092a864886f70d01010105000382020f003082020a0282020100ad969f2d9c4a4c4a81795199ec8acb6b605113bc4d6d06fcb0088ddd19106ac7260c35d8c06f2084e994b19b8503c35bdb4ae8c8f89076d95b4fe34ce806364dcc9aac3d0c902b92d4061960ac374479858182ad5a37e00dcc9da64c5276ea439db704d150f655e0d5d2a64985e937e9ca7eae5c954d489a3fae205a6d8895d934b8521a4390b0bf6c05b9b678b7ead0e43a3c125362ff4af27bbe3505a91234e3f36474622c3d00495a28fe3244bb87dd652702713bda4af71fdacdf72155904f0fecae82e19f6bd945d3bbf05f87ed3c2c3986da3fdeec7255eb79a3addbdd7cb0ba1ccefcde4f3576cf0ff8781f6a36514627615be99ecff0a2557d7c258a6f2fb4c5cf842e2bfd0d51106cfb5f1bbc1b7ec5ae3b98013192ff0b57f49ab2b957e9abef0d76d1f0eef4ce86a7e06ee9b469a1df69f633c6692e97139ea587b057108137c953b3bb7ff692d19cd018f4926eda834fa663994ca5fb5eef21647a205f6c648515cb37e9620c0b2a16dc012e32da3e4bf59e3af6174094ef9e910886fabe63a85a33eccb744395f96c695236c7296ffc55035c1ffb9fbd47ebe74947950b4e89220949e0f5611ef1bf2e8a726e8059ff573af97532a34e5feced2862d94d73f2cc811760edcdebdcdba7cac57e02bdf2540854fdb42d092c17544a98d154e1516708d2ed6e7e6f3fd22d81592966cb903995111e7427feddebaf0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414b00cf04c30f405580248fd33e552af4b84e36652300d06092a864886f70d01010c05000382020100aaa8808f0e78a3e0a2d4cde6f5987a3bea0003b0970e93bc5aa8f62c8c7287a9b1fc7f73fd637178a58759cf30e10d10b2135a6d82f56ae6809fa0050b68e4476bc76adfb6fd773272e518fa09f4a0932c5dd28c75857665900c0379b7312363ad788309866884cafff9cf269a9279e7cd4bc5e761a717cbf3a91293936ba7e82f5392c46058b0cc0251185b858d625963b6adb4de9afb26f70027c05d55377499c9507fe3592e44e32c25eeec4c3277b49f1ae94b5d20c5dafd1c8716c643e8d4bb269a45705ea90b3753e2467b27fde046f289b7cc42b6cb28266ed9a5c93ac8411360f7508c15aeb26d1a151a5778e6922ad96590823f6c02afae123a27963604d71da28063a99bf1e5bab47c14b04ec9b11f745f38f651ea9bfa2ca211d4a92d271a45b1afb24e710dc05846d66906cb53cbb3fe6b41cd417e7d4c0f7c72797a59cd5e4a0eac9ba99873797cb4f4ccb9b8070cb2745cb8c76f88a190a7f4aaf9bf673af41a15621eb79fbe3db129af67a112f25810195303301bb81a89f69cbd97038ea309f31d8b21f1b4dfe41cd19f650206ea5cd613b384efa2a55c8c7729a768c06bae40d2a8b4eacdf08d4b389c199a1b2854b88990efca75813e1ef26424c718af4eff479e07f63565a4d30a56fff517646cefa822254993b6df0017da587e5deec51bb0d1d15f2110c7f9f3ba020a2707c5f1d6c7d3e0fb09606c MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0D44DD8C3C8C1A1A58756481E90F2E2AFFB3D26E\Blob = 0300000001000000140000000d44dd8c3c8c1a1a58756481e90f2e2affb3d26e2000000001000000ba010000308201b63082015ba0030201020213066c9fd5749736663f3b0b9ad9e89e7603f24a300a06082a8648ce3d0403023039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412033301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f7420434120333059301306072a8648ce3d020106082a8648ce3d030107034200042997a7c6417fc00d9be8011b56c6f252a5ba2db212e8d22ed7fac9c5d8aa6d1f73813b3b986b397c33a5c54e868e8017686245577d44581db337e56708eb66dea3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414abb6dbd7069e37ac3086079170c79cc419b178c0300a06082a8648ce3d0403020349003046022100e08592a317b78df92b06a593ac1a98686172fae1a1d0fb1c7860a64399c5b8c40221009c02eff1949cb396f9ebc62af8b62cfe3a901416d78c6324481cdf307dd5683b MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\2AD974A775F73CBDBBD8F5AC3A49255FA8FB1F8C MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8DA7F965EC5EFC37910F1C6E59FDC1CC6A6EDE16\Blob = 0300000001000000140000008da7f965ec5efc37910f1c6e59fdc1cc6a6ede162000000001000000450300003082034130820229a0030201020213066c9fcf99bf8c0a39e2f0788a43e696365bca300d06092a864886f70d01010b05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412031301e170d3135303532363030303030305a170d3338303131373030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f74204341203130820122300d06092a864886f70d01010105000382010f003082010a0282010100b2788071ca78d5e371af478050747d6ed8d78876f49968f7582160f97484012fac022d86d3a0437a4eb2a4d036ba01be8ddb48c80717364cf4ee8823c73eeb37f5b519f84968b0ded7b976381d619ea4fe8236a5e54a56e445e1f9fdb416fa74da9c9b35392ffab02050066c7ad080b2a6f9afec47198f503807dca2873958f8bad5a9f948673096ee94785e6f89a351c0308666a14566ba54eba3c391f948dcffd1e8302d7d2d747035d78824f79ec4596ebb738717f2324628b843fab71daacab4f29f240e2d4bf7715c5e69ffea9502cb388aae50386fdbfb2d621bc5c71e54e177e067c80f9c8723d63f40207f2080c4804c3e3b24268e04ae6c9ac8aa0d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604148418cc8534ecbc0c94942e08599cc7b2104e0a08300d06092a864886f70d01010b0500038201010098f2375a4190a11ac57651282036230eaee628bbaaf894ae48a4307f1bfc248d4bb4c8a197f6b6f17a70c85393cc0828e39825cf23a4f9de21d37c8509ad4e9a753ac20b6a897876444718656c8d418e3b7f9acbf4b5a750d7052c37e8034bade961a0026ef5f2f0c5b2ed5bb7dcfa945c779e13a57f52ad95f2f8933bde8b5c5bca5a525b60af14f74befa3fb9f40956d3154fc42d3c7461f23add90f48709ad9757871d1724334756e5759c2025c266029cf2319168e8843a5d4e4cb08fb231143e843297262a1a95d5e08d490aeb8d8ce14c2d055f286f6c49343776661c0b9e841d7977860036e4a72aea5d17dba109e866c1b8ab95933f8ebc490bef1b9 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\2AD974A775F73CBDBBD8F5AC3A49255FA8FB1F8C\Blob = 0300000001000000140000002ad974a775f73cbdbbd8f5ac3a49255fa8fb1f8c2000000001000000620400003082045e30820346a0030201020213077312380b9d6688a33b1ed9bf9ccda68e0e0f300d06092a864886f70d01010b05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412031301e170d3232303832333232323132385a170d3330303832333232323132385a303c310b3009060355040613025553310f300d060355040a1306416d617a6f6e311c301a06035504031313416d617a6f6e205253412032303438204d303130820122300d06092a864886f70d01010105000382010f003082010a0282010100eb712ca9cb1f8828923230af8a570f78b73725955587ac675c97d322c8daa214676b7cf067dae2032ab356125dc6b547f96708a7937a9592180fb4f9f910369a7f2f80b64fba134ec75d531ee0dd96330720d396bc12e4745042a1051373b54f9b4424fe2d7fedbc2285ec362133977506ce271882dce3d9c582078d5e26012626671fd93f13cf32ba6bad7864fcaaff0e023c07df9c0578728cfdea75b7032884dae86e078cd05085ef8154b2716eec6d62ef8f94c35ee9c4a4d091c02e249198caeeba258ed4f671b6fb5b6b38064837478d86dcf2ea06fb76377d9eff424e4d588293cfe271c278b17aab4b5b94378881e4d9af24aef872c565fb4bb451e70203010001a382015a3082015630120603551d130101ff040830060101ff020100300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030106082b06010505070302301d0603551d0e0416041481b80e638a891218e5fa3b3b50959fe6e5901385301f0603551d230418301680148418cc8534ecbc0c94942e08599cc7b2104e0a08307b06082b06010505070101046f306d302f06082b060105050730018623687474703a2f2f6f6373702e726f6f746361312e616d617a6f6e74727573742e636f6d303a06082b06010505073002862e687474703a2f2f6372742e726f6f746361312e616d617a6f6e74727573742e636f6d2f726f6f746361312e636572303f0603551d1f043830363034a032a030862e687474703a2f2f63726c2e726f6f746361312e616d617a6f6e74727573742e636f6d2f726f6f746361312e63726c30130603551d20040c300a3008060667810c010201300d06092a864886f70d01010b05000382010100ad00de0205232e063262b46bb19416e41140de2bfa59c135efe0aa8f2b41b9d1f38739001df23db5a7470c0606c691f3075702d4edbd17c1909abf4875a2074f30dd4a6a42b50d3d15c00ffe845bc63c99cc5752b1d86e12d59692934b94e507e88982086a7a34d49e64e13d876a92909a63a14bf88fb6ea34d305be20c2de06e28c9f738b9f4d3985cace19369d85c99ec9f8503fb67e88a1efca84068b50b40a5ca61c44f1fdc8614060f26125aa07f4c7c27375e40c0b428d04e55f4448995b7b898196a7889d4b0d62e804c4d7feb4e8b26dcaecc01cbc385b1ddf85ce5b7ae3494b6cb9a7ddf405b249ade1c5146bc2ccebcd7fd65869bac3207e7fb0b8 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 040000000100000010000000be954f16012122448ca8bc279602acf5140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a2030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa20f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e1900000001000000100000009f687581f7ef744ecfc12b9cee6238f12000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 MBAMService.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
mbamtray.exembam.exepid process 1140 mbamtray.exe 2848 mbam.exe -
Suspicious behavior: EnumeratesProcesses 58 IoCs
Processes:
MBSetup.exeMBAMInstallerService.exeMBAMService.exembamtray.exembam.exemsedge.exemsedge.exemsedge.exeidentity_helper.exemsedge.exepid process 1180 MBSetup.exe 1180 MBSetup.exe 2488 MBAMInstallerService.exe 2488 MBAMInstallerService.exe 2488 MBAMInstallerService.exe 2488 MBAMInstallerService.exe 2488 MBAMInstallerService.exe 2488 MBAMInstallerService.exe 2488 MBAMInstallerService.exe 2488 MBAMInstallerService.exe 2488 MBAMInstallerService.exe 2488 MBAMInstallerService.exe 736 MBAMService.exe 736 MBAMService.exe 736 MBAMService.exe 736 MBAMService.exe 736 MBAMService.exe 736 MBAMService.exe 736 MBAMService.exe 736 MBAMService.exe 736 MBAMService.exe 736 MBAMService.exe 1140 mbamtray.exe 1140 mbamtray.exe 1140 mbamtray.exe 1140 mbamtray.exe 2848 mbam.exe 2848 mbam.exe 2848 mbam.exe 2848 mbam.exe 4744 msedge.exe 4744 msedge.exe 692 msedge.exe 692 msedge.exe 736 MBAMService.exe 736 MBAMService.exe 2000 msedge.exe 2000 msedge.exe 3412 identity_helper.exe 3412 identity_helper.exe 736 MBAMService.exe 736 MBAMService.exe 2848 mbam.exe 2848 mbam.exe 2848 mbam.exe 2848 mbam.exe 736 MBAMService.exe 736 MBAMService.exe 736 MBAMService.exe 736 MBAMService.exe 736 MBAMService.exe 736 MBAMService.exe 736 MBAMService.exe 736 MBAMService.exe 3580 msedge.exe 3580 msedge.exe 3580 msedge.exe 3580 msedge.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
mbamtray.exepid process 1140 mbamtray.exe -
Suspicious behavior: LoadsDriver 13 IoCs
Processes:
pid process 680 680 680 680 680 680 680 680 680 680 680 680 680 -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
Processes:
msedge.exepid process 692 msedge.exe 692 msedge.exe 692 msedge.exe 692 msedge.exe 692 msedge.exe 692 msedge.exe 692 msedge.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
MBAMService.exeMBAMService.exedescription pid process Token: 33 3632 MBAMService.exe Token: SeIncBasePriorityPrivilege 3632 MBAMService.exe Token: 33 736 MBAMService.exe Token: SeIncBasePriorityPrivilege 736 MBAMService.exe Token: SeBackupPrivilege 736 MBAMService.exe Token: SeRestorePrivilege 736 MBAMService.exe Token: SeTakeOwnershipPrivilege 736 MBAMService.exe Token: SeDebugPrivilege 736 MBAMService.exe Token: SeBackupPrivilege 736 MBAMService.exe Token: SeRestorePrivilege 736 MBAMService.exe Token: SeTakeOwnershipPrivilege 736 MBAMService.exe Token: SeSecurityPrivilege 736 MBAMService.exe Token: SeDebugPrivilege 736 MBAMService.exe Token: SeDebugPrivilege 736 MBAMService.exe Token: SeDebugPrivilege 736 MBAMService.exe Token: SeDebugPrivilege 736 MBAMService.exe Token: SeDebugPrivilege 736 MBAMService.exe Token: SeDebugPrivilege 736 MBAMService.exe Token: SeDebugPrivilege 736 MBAMService.exe Token: SeDebugPrivilege 736 MBAMService.exe Token: SeDebugPrivilege 736 MBAMService.exe Token: SeDebugPrivilege 736 MBAMService.exe Token: SeDebugPrivilege 736 MBAMService.exe Token: SeDebugPrivilege 736 MBAMService.exe Token: SeDebugPrivilege 736 MBAMService.exe Token: SeDebugPrivilege 736 MBAMService.exe Token: SeDebugPrivilege 736 MBAMService.exe Token: SeDebugPrivilege 736 MBAMService.exe Token: SeDebugPrivilege 736 MBAMService.exe Token: SeDebugPrivilege 736 MBAMService.exe Token: SeDebugPrivilege 736 MBAMService.exe Token: SeDebugPrivilege 736 MBAMService.exe Token: SeDebugPrivilege 736 MBAMService.exe Token: SeDebugPrivilege 736 MBAMService.exe Token: SeDebugPrivilege 736 MBAMService.exe Token: SeDebugPrivilege 736 MBAMService.exe Token: SeDebugPrivilege 736 MBAMService.exe Token: SeDebugPrivilege 736 MBAMService.exe Token: SeDebugPrivilege 736 MBAMService.exe Token: SeDebugPrivilege 736 MBAMService.exe Token: SeDebugPrivilege 736 MBAMService.exe Token: SeDebugPrivilege 736 MBAMService.exe Token: SeDebugPrivilege 736 MBAMService.exe Token: SeDebugPrivilege 736 MBAMService.exe Token: SeDebugPrivilege 736 MBAMService.exe Token: SeDebugPrivilege 736 MBAMService.exe Token: SeDebugPrivilege 736 MBAMService.exe Token: SeDebugPrivilege 736 MBAMService.exe Token: SeDebugPrivilege 736 MBAMService.exe Token: SeDebugPrivilege 736 MBAMService.exe Token: SeDebugPrivilege 736 MBAMService.exe Token: SeDebugPrivilege 736 MBAMService.exe Token: SeDebugPrivilege 736 MBAMService.exe Token: SeDebugPrivilege 736 MBAMService.exe Token: SeDebugPrivilege 736 MBAMService.exe Token: SeDebugPrivilege 736 MBAMService.exe Token: SeDebugPrivilege 736 MBAMService.exe Token: SeDebugPrivilege 736 MBAMService.exe Token: SeDebugPrivilege 736 MBAMService.exe Token: SeDebugPrivilege 736 MBAMService.exe Token: SeDebugPrivilege 736 MBAMService.exe Token: SeDebugPrivilege 736 MBAMService.exe Token: SeDebugPrivilege 736 MBAMService.exe Token: SeDebugPrivilege 736 MBAMService.exe -
Suspicious use of FindShellTrayWindow 59 IoCs
Processes:
MBSetup.exembamtray.exemsedge.exembam.exepid process 1180 MBSetup.exe 1140 mbamtray.exe 1140 mbamtray.exe 1140 mbamtray.exe 1140 mbamtray.exe 1140 mbamtray.exe 1140 mbamtray.exe 1140 mbamtray.exe 1140 mbamtray.exe 1140 mbamtray.exe 1140 mbamtray.exe 1140 mbamtray.exe 692 msedge.exe 692 msedge.exe 692 msedge.exe 692 msedge.exe 692 msedge.exe 692 msedge.exe 692 msedge.exe 692 msedge.exe 692 msedge.exe 692 msedge.exe 692 msedge.exe 692 msedge.exe 692 msedge.exe 692 msedge.exe 692 msedge.exe 692 msedge.exe 692 msedge.exe 692 msedge.exe 692 msedge.exe 692 msedge.exe 692 msedge.exe 692 msedge.exe 692 msedge.exe 692 msedge.exe 692 msedge.exe 1140 mbamtray.exe 1140 mbamtray.exe 1140 mbamtray.exe 1140 mbamtray.exe 1140 mbamtray.exe 1140 mbamtray.exe 2848 mbam.exe 1140 mbamtray.exe 1140 mbamtray.exe 1140 mbamtray.exe 1140 mbamtray.exe 1140 mbamtray.exe 1140 mbamtray.exe 1140 mbamtray.exe 1140 mbamtray.exe 1140 mbamtray.exe 1140 mbamtray.exe 1140 mbamtray.exe 1140 mbamtray.exe 1140 mbamtray.exe 1140 mbamtray.exe 1140 mbamtray.exe -
Suspicious use of SendNotifyMessage 41 IoCs
Processes:
mbamtray.exemsedge.exepid process 1140 mbamtray.exe 1140 mbamtray.exe 1140 mbamtray.exe 1140 mbamtray.exe 1140 mbamtray.exe 1140 mbamtray.exe 1140 mbamtray.exe 1140 mbamtray.exe 1140 mbamtray.exe 1140 mbamtray.exe 692 msedge.exe 692 msedge.exe 692 msedge.exe 692 msedge.exe 692 msedge.exe 692 msedge.exe 692 msedge.exe 692 msedge.exe 692 msedge.exe 692 msedge.exe 692 msedge.exe 692 msedge.exe 1140 mbamtray.exe 1140 mbamtray.exe 1140 mbamtray.exe 1140 mbamtray.exe 1140 mbamtray.exe 1140 mbamtray.exe 1140 mbamtray.exe 1140 mbamtray.exe 1140 mbamtray.exe 1140 mbamtray.exe 1140 mbamtray.exe 1140 mbamtray.exe 1140 mbamtray.exe 1140 mbamtray.exe 1140 mbamtray.exe 1140 mbamtray.exe 1140 mbamtray.exe 1140 mbamtray.exe 1140 mbamtray.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
MBAMInstallerService.exeMBAMService.exeMBSetup.exemsedge.exedescription pid process target process PID 2488 wrote to memory of 3632 2488 MBAMInstallerService.exe MBAMService.exe PID 2488 wrote to memory of 3632 2488 MBAMInstallerService.exe MBAMService.exe PID 736 wrote to memory of 1140 736 MBAMService.exe mbamtray.exe PID 736 wrote to memory of 1140 736 MBAMService.exe mbamtray.exe PID 1180 wrote to memory of 2848 1180 MBSetup.exe mbam.exe PID 1180 wrote to memory of 2848 1180 MBSetup.exe mbam.exe PID 736 wrote to memory of 4724 736 MBAMService.exe ig.exe PID 736 wrote to memory of 4724 736 MBAMService.exe ig.exe PID 736 wrote to memory of 4724 736 MBAMService.exe ig.exe PID 736 wrote to memory of 2488 736 MBAMService.exe ig.exe PID 736 wrote to memory of 2488 736 MBAMService.exe ig.exe PID 736 wrote to memory of 2488 736 MBAMService.exe ig.exe PID 736 wrote to memory of 1784 736 MBAMService.exe ig.exe PID 736 wrote to memory of 1784 736 MBAMService.exe ig.exe PID 736 wrote to memory of 1784 736 MBAMService.exe ig.exe PID 736 wrote to memory of 1700 736 MBAMService.exe ig.exe PID 736 wrote to memory of 1700 736 MBAMService.exe ig.exe PID 736 wrote to memory of 1700 736 MBAMService.exe ig.exe PID 736 wrote to memory of 4328 736 MBAMService.exe ig.exe PID 736 wrote to memory of 4328 736 MBAMService.exe ig.exe PID 736 wrote to memory of 4328 736 MBAMService.exe ig.exe PID 736 wrote to memory of 808 736 MBAMService.exe ig.exe PID 736 wrote to memory of 808 736 MBAMService.exe ig.exe PID 736 wrote to memory of 808 736 MBAMService.exe ig.exe PID 736 wrote to memory of 2212 736 MBAMService.exe ig.exe PID 736 wrote to memory of 2212 736 MBAMService.exe ig.exe PID 736 wrote to memory of 2212 736 MBAMService.exe ig.exe PID 736 wrote to memory of 1136 736 MBAMService.exe ig.exe PID 736 wrote to memory of 1136 736 MBAMService.exe ig.exe PID 736 wrote to memory of 1136 736 MBAMService.exe ig.exe PID 736 wrote to memory of 3296 736 MBAMService.exe ig.exe PID 736 wrote to memory of 3296 736 MBAMService.exe ig.exe PID 736 wrote to memory of 3296 736 MBAMService.exe ig.exe PID 736 wrote to memory of 1976 736 MBAMService.exe ig.exe PID 736 wrote to memory of 1976 736 MBAMService.exe ig.exe PID 736 wrote to memory of 1976 736 MBAMService.exe ig.exe PID 736 wrote to memory of 2392 736 MBAMService.exe ig.exe PID 736 wrote to memory of 2392 736 MBAMService.exe ig.exe PID 736 wrote to memory of 2392 736 MBAMService.exe ig.exe PID 736 wrote to memory of 1964 736 MBAMService.exe ig.exe PID 736 wrote to memory of 1964 736 MBAMService.exe ig.exe PID 736 wrote to memory of 1964 736 MBAMService.exe ig.exe PID 736 wrote to memory of 4060 736 MBAMService.exe ig.exe PID 736 wrote to memory of 4060 736 MBAMService.exe ig.exe PID 736 wrote to memory of 4060 736 MBAMService.exe ig.exe PID 736 wrote to memory of 1564 736 MBAMService.exe ig.exe PID 736 wrote to memory of 1564 736 MBAMService.exe ig.exe PID 736 wrote to memory of 1564 736 MBAMService.exe ig.exe PID 736 wrote to memory of 3452 736 MBAMService.exe ig.exe PID 736 wrote to memory of 3452 736 MBAMService.exe ig.exe PID 736 wrote to memory of 3452 736 MBAMService.exe ig.exe PID 736 wrote to memory of 2320 736 MBAMService.exe ig.exe PID 736 wrote to memory of 2320 736 MBAMService.exe ig.exe PID 736 wrote to memory of 2320 736 MBAMService.exe ig.exe PID 736 wrote to memory of 896 736 MBAMService.exe ig.exe PID 736 wrote to memory of 896 736 MBAMService.exe ig.exe PID 736 wrote to memory of 896 736 MBAMService.exe ig.exe PID 736 wrote to memory of 4300 736 MBAMService.exe ig.exe PID 736 wrote to memory of 4300 736 MBAMService.exe ig.exe PID 736 wrote to memory of 4300 736 MBAMService.exe ig.exe PID 692 wrote to memory of 2168 692 msedge.exe msedge.exe PID 692 wrote to memory of 2168 692 msedge.exe msedge.exe PID 692 wrote to memory of 2364 692 msedge.exe msedge.exe PID 692 wrote to memory of 2364 692 msedge.exe msedge.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3304
-
C:\Users\Admin\AppData\Local\Temp\MBSetup.exe"C:\Users\Admin\AppData\Local\Temp\MBSetup.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Checks BIOS information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe"C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:2848 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:692 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd548b3cb8,0x7ffd548b3cc8,0x7ffd548b3cd83⤵PID:2168
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1624,11833059107094620821,8884098616236644224,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1796 /prefetch:23⤵PID:2364
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1624,11833059107094620821,8884098616236644224,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
PID:4744 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1624,11833059107094620821,8884098616236644224,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:83⤵PID:1980
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1624,11833059107094620821,8884098616236644224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:13⤵PID:4004
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1624,11833059107094620821,8884098616236644224,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:13⤵PID:1976
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1624,11833059107094620821,8884098616236644224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4028 /prefetch:13⤵PID:3384
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1624,11833059107094620821,8884098616236644224,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4500 /prefetch:13⤵PID:1252
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1624,11833059107094620821,8884098616236644224,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3340 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:2000 -
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1624,11833059107094620821,8884098616236644224,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5360 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:3412 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1624,11833059107094620821,8884098616236644224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:13⤵PID:1844
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1624,11833059107094620821,8884098616236644224,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3060 /prefetch:13⤵PID:2416
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1624,11833059107094620821,8884098616236644224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4844 /prefetch:13⤵PID:764
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1624,11833059107094620821,8884098616236644224,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=3456 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
PID:3580
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"1⤵
- Drops file in Drivers directory
- Enumerates connected drives
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe" /Service /Protected2⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Executes dropped EXE
- Registers COM server for autorun
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3632
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Checks BIOS information in registry
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:736 -
C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe"C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1140 -
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:4724 -
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:2488 -
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:1784 -
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:1700 -
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:4328 -
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:808 -
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:2212 -
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:1136 -
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:3296 -
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:1976 -
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:2392 -
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:1964 -
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:4060 -
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:1564 -
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:3452 -
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:2320 -
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:896 -
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:4300 -
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\updatrpkg\mbupdatrV5.exe"C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\updatrpkg\mbupdatrV5.exe" "C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE" "C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\config\UpdateControllerConfig.json" "C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE" "C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\dbclsupdate\staging" /db:dbupdate /su:no2⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:5044
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004CC 0x00000000000004681⤵PID:5080
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3404
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2384
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Defense Evasion
Modify Registry
3Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\7z.dllFilesize
1.3MB
MD50fced59d9211580d1165d10d81e7d7ea
SHA1906462be5b312ba5294e32fca3d86db64f369f88
SHA2567a200d6551b2c2d6c5e9c18ff254613087ee2a5625ffdc91d9d528e4f2473a28
SHA512c1187fdeae1757f373f6c75dd1d1624452b8a85337bd38325cdbfb8608abb58d95c4c94da02e0e596aaf6cef79e0e4171a3ce675708e02c1f3019d7e96059d17
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\Actions.dllFilesize
2.7MB
MD594dd30cb428b2d1c0d7c651e5b4a229b
SHA15b22dd8bb4bdb576198978dbb02101520bbffebb
SHA256e32247abf12c537ff13fdb642b8f790b40ba31bd301576e8011ed0ef2dd1d02e
SHA5124c024429f554b223d8a455e26ed9b410633d8af129f4588adea91b07dd8a9d8db16b7f6b712af86f589e450aedb1ee7e3431e0e2392e395a22b48f0039a576e6
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ActionsShim.dllFilesize
911KB
MD5310713b907a45e2be8ddbdce8e0ca5dc
SHA13e707a2c4dcdaaaba9685e5f7562fd9881d823ab
SHA25643fdfc71f0270cae80b0faff36170db9d16649bdf756c46cce99362d421c665f
SHA51288a79051ea3db39919ee3a917a850e2b20f07e70f2067fe4158bb8c11bf31285e1b03bc212117216f682521af831057beae0b5c9ac1005e6230404702e1e03f5
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\BrowserSDKDLL.dllFilesize
2.0MB
MD58b5e4df36c8227700820a3f12d5f78a3
SHA1d544947bfad571b81c06194df2ef56b8de9faf57
SHA256bf54f9801164cf0b10968a77e7668e028f25a12760d796214bd25122308efa4a
SHA51202b046e53991db5d9dee9f8e3436c91c4483f320b34106ebcf79d3252825505d5a1c86817ee1feb7367e8eba186ba76e15972afc324476f03dd3a807652010fa
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\BrowserSDKDLLShim.dllFilesize
1.4MB
MD5e18ea059241c0db6b7e69f7c41c49160
SHA122c62e60d685411ae38baf13a27f440dee2e9d53
SHA256fc11df71cb924eaa8eb1622544121f51d0ee23446bc2db52db276939e5bb01b7
SHA5123af967856d0d14a4bf229071fc64082807c1710c66bd4b0f30fd67ca809a1e9149fc59a75c2b6ef53a5ffceab6b2e86dec596ca6eee5abaedc04c899dba5defc
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\CleanControllerImpl.dllFilesize
1016KB
MD5d2f5fbe2712837a24a436b5bc9e7edd9
SHA1a702a618bdd457db56966f1a7a7bd12984b02c47
SHA2565760f6a2237e941ec93947a7e05b2ad8306ddd943fec354d763993cab7976ef3
SHA512284a3435a14b562027c54405f669e4de41859e696c32071e351d800fefcb29306beb49519347a4e013088ac333609cdafefb8ffd6c4112a7953b4e1d801f17db
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\CloudControllerImpl.dllFilesize
1.7MB
MD56d883ac00eb204db60ba906a256ee33d
SHA1de0ce829e7724933952ce2622b04fee13b6ca331
SHA25646fc9a5b392729aa63ac5e56f92802c483047f41e528c15d476aa8821bc78bfa
SHA512c4ca0f3be9a59c99180c78c41102df93a5953a50adc3f54034da2ab04fc7ff594823ff4e03c427697a7b788e71973fdb0869a6c309b16424fa0e69d811bbb85c
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\LicenseControllerImpl.dllFilesize
4.4MB
MD5af93fb0f8f40f94482f1199cbf67dc0e
SHA1ddd06d773149cd0b80c0d660edf453d9e93f3c66
SHA25617f3115bffaf7f28540c13d4bf7182481dee8ef70cb8468488ff44b7f56da75d
SHA51292762f4875dfce2e4c8777a836c259dba56086469b27ed2a833645598dcb11bf33e112995ae583e5e8c7d407667b3f3bd8eaaeddd45d7332df820a3a797e9db8
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\MBAMCore.dllFilesize
2.1MB
MD5e387f31289fb42ef3e9c39e70e674b0c
SHA1bda232ce164234cc5ff02d7a4dda6ea1e3ed514b
SHA256c398a820d20bf4accf82c5072a706b017ba987eb3d091b9b00f7c0e5fc070fe3
SHA512e323c51813733749a78a54cd98169705c887b458cec5f2c115840640683c81b1cf621c589b390d3f2039df577dfa3b73449fb3e110a55eda6a7236333de36fa1
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\MBAMShim.dllFilesize
309KB
MD52db9c28ca164363339980126a187a107
SHA176dabc5d02a7cbd54136306b5a762ff1cfeaafce
SHA2569ccccc510ddc29f28d67dc814ef67b3395bc1591bbc64fe1e31c79639a6063c2
SHA5125cf014b0ff8ad0e59925a2e952215d97b5f830866f0666f33f8971feb7a90d6e465582ec0176f8698a35f43cabc8c4c214e094c813ee41e74e32247c57be743b
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\PoliciesControllerImpl.dllFilesize
4.2MB
MD52c3a623bc7035ff473ba7118afe1b1eb
SHA1fc63dc1ed60a79bc6d4c69d2c7aad5b8d0999421
SHA2568d502eb7c1f76cc5210029b011f52a6f4d86dca1dad91dc5fecb5870d2e9182b
SHA51233bf3593dad88e0ad123105e42f41e51fef6282e96524be9bac212856f654c229e931fc25fa06048125b94a8cea49d2c09a0bda4c2bb4ba03b6d2036bc64244f
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ScanControllerImpl.dllFilesize
879KB
MD5e433d8d9edea057b5ec7a321f0582dce
SHA13b128a85fe54b7de55046c1eb6d0f8ff7b1e1ffc
SHA2562073bc742ca68b5f08febf280c8cc42b4b14084c200660e6b1ea73c5975b11f9
SHA5125a94134e959582e9af0a809e31a2291f04cd12527c6250c6bd6c0a94d2c7a9a1dd7e812acbfda05b4b304ddfaa63b6406c5f1c8a93da70ef62e63095aa686bd9
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\Swissarmy.dllFilesize
106KB
MD532f58c47f76edfcc918577e60ed655ff
SHA1d499e3d89c49ffde1082265624080a75973f3405
SHA25672954f2304852da13070ec4f87418f961bbd1cc3297c4e490c1e9707bd4af57e
SHA5123ec03ca66c4b71fe3d9d6865eac90b9d7d397ca8d54443a5fc770137bcb473fa8437b396816b75d7b41a2ea109e9cd3a96e7f0905e1a2a6e7461b3b5ba53b4a8
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\SwissarmyShim.dllFilesize
352KB
MD56be12e5f70f2774aef817e94f68ae880
SHA11d337f36bcca143628c726b3e7ed84882cb9504d
SHA256809e50c29fd107a7ba3eae86e9170b43cff89ed69bb546792672595b3125a74f
SHA512ca4e19ba427f4e45e29ec0ed6566bae65fd9bde1f43951953b555db4760758322782d62c7976c9a28e68036d75d8ad508d77ea2ea4a1ebdd93c9742aff1f5dcc
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\TelemetryControllerImpl.dllFilesize
489KB
MD5c3b90c1b7d8cf8e48873557e65c695be
SHA1e4e84352207ae93179e1792ecf811d19b0677c9c
SHA256bea5a6aaa149681f65cef5fe250a39d2cd2acb75052333e0c4b99eac78b59559
SHA51282c85ebba6e57e13ded6a0d8fa7ace5f7dcfde6298c11d0bcf01e616e0e77e82335f0c9324a455d92a41ca01b10956731573597dbf179ba5c0d294b35d336f84
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\UpdateControllerImpl.dllFilesize
4.4MB
MD55bb0f098e4aa3d027f4d0c6f3822a711
SHA16fe92307e93cb754f2900ffb4529590236466701
SHA256a94f20b1ff9c564c6f276ea69ec9d2794be4913a1d632785af21423d2315a08a
SHA5126efa858e647ec4f21eb9fff186b368ddda4c5b6987ace47a89f1faf4af97c883114291bb5aeb905a34495ae2de6e4669e146419708978875fe40df25f893ad47
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeFilesize
1.8MB
MD5bbb352dbbf17f6fc29cd86bc1d80a417
SHA11c83c920ae75d0f6e8634804e508e9156f565148
SHA25673df768292a90e52fcbc5dedc51f8091083fb6042f4413d69afeace1cb0ba509
SHA51212242406306d9808afb3c9d9d590867f4d116a765d0ec761436b4e272ce456b0b72a5687856d1b6672980faf4246721d297b0520821d5fcb81d7eaa86775ee5f
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\pkgvers.datFilesize
75B
MD5f43d56be35fa551234d6a777bdd3afc7
SHA14052c545ef9269a974c864ba19f6841a8e17fbc5
SHA25664b5c5f6901184cf865bd5074d2a8defef8101a9987bae7872b8feb7d2a123b5
SHA5125c9e3d03981393adc425d3ffc0b4e32dbacb00addc1cafdc689775e01bba1ea4f12e62d615ea8be12844cf3095baf8187b8b89ead0ea26c35d9f8bccd267b1e4
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\Global.nmFilesize
334KB
MD543b0d8bbc920f3877cf805f68e9c11ba
SHA1f7839ac0b088d566f43ae4f871e9e34c5cee7655
SHA25672de69a0110fc29e450611bba0f5177907a2a755881700315fceb7ab3589f4f3
SHA5127a723cd541476e3726ec79414beb1140926eaa965f0a8699c9f0e28fe9439f481283f1b92e82e70f58163ce7442d544d747d6eff40ee49aba9e4cd33a6e6e633
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\Global.srFilesize
3.7MB
MD5c1ea33b8b3e6d5b924487b6ff75bf9e9
SHA103767a6e6b9553e29e6900aee85b829b4bdda934
SHA25602a97ca7d0cc0915034eb5ed8000e611c6f23b5a020a967d5d5481fbe818bd3b
SHA512380c78e69ebab9fbb1c0321ddbbdf28ea7a92fce2ce5f24e8ca3578335c1ca3f40427548b07d8667810a5b415080f98e4081a3b65d98d5b5bdac63406b834025
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\cfg.binFilesize
953B
MD54fff83d97512a23cc5335a9ddcf3b550
SHA1f11de2a71940ddde785b6d4901ec437f825c410e
SHA256eb082811e1c4f6d25290d5f483c1944fffcc2efcc60aae36a4b8cf914c0de98f
SHA5121549581ddf208ea7d3da52431a3a2af2471aa408081bf1d693dd0e0daefdf8b31f182481c57d9db1eb4e6c2833af704ff3c003bcfae3041fa0c35d20c9d01d07
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\clean.mbdbFilesize
11KB
MD5400e8fdfcf13a1338f876c7c298c1c14
SHA1587faf41a26469b3bc2417c6917015345f1dbfe2
SHA25621e358f07016d05a07ade331be2396cd638de102e32c1954e5517c5b1b4e3c2c
SHA5120c3963326368703d20c8c7d64c1c23e76d75c9eed33318da3f79f6bfec10715b6573530bb4ac73233309711dac1e92147220493ca36825e0591ea1104940e657
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\dbmanifest2.datFilesize
924B
MD5ab839a1341561227673f4749e5b57dae
SHA1eeb7547a98b6e92e0a72701db1ca6c264375d207
SHA2567295847362b9754ae698eeae875ad104d5cf8d29fd65b80da33212a47c8825d6
SHA51297d2ed28367080f23ce553f41cb18ef6ba93ef7243d755dfe22f7a33346e763bb19aaf4618a1ea3a101d0c6ede6dc1a2c8cf486fd83cb881fd531c808bf42c31
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\dynconfig.datFilesize
39KB
MD510f23e7c8c791b91c86cd966d67b7bc7
SHA13f596093b2bc33f7a2554818f8e41adbbd101961
SHA256008254ca1f4d6415da89d01a4292911de6135b42833156720a841a22685765dc
SHA5122d1b21371ada038323be412945994d030ee8a9007db072484724616c8597c6998a560bc28886ebf89e2c8919fb70d76c98338d88832351823027491c98d48118
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\exclusions.txtFilesize
23KB
MD5aef4eca7ee01bb1a146751c4d0510d2d
SHA15cf2273da41147126e5e1eabd3182f19304eea25
SHA2569e87e4c9da3337c63b7f0e6ed0eb71696121c74e18a5da577215e18097715e2f
SHA512d31d21e37b0048050b19600f8904354cff3f3ec8291c5a7a54267e14af9fb88dfb6d11e74a037cc0369ade8a8fb9b753861f3b3fb2219563e8ec359f66c042db
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\mbdigsig2.datFilesize
514B
MD5591931f2dac1422bee7f3a2df7fa31a1
SHA1584b749c18c676bd9e616cba373e61eb653b049f
SHA25681fcdc5283774f9b08e1460c96617188972e0336cbc088bc185acc3a3df0f719
SHA512c59248e4954c798241ff5cb0e71d3ae5320b4f29a74aee3af67b383c8487477e4114d65784dcf7a4fdf9d81aea5f22eea9390d3516718c69ea7f979b1b2807cb
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\prot.mbdbFilesize
24B
MD5546d9e30eadad8b22f5b3ffa875144bf
SHA13b323ffef009bfe0662c2bd30bb06af6dfc68e4d
SHA2566089fbf0c0c1413f62e91dc9497bedc6d8a271e9dc761e20adc0dccf6f4a0c1f
SHA5123478f5dcf7af549dd6fe48ad714604200de84a90120b16a32233b6d44fa7240f5f4e5fe803f54b86bbdfd10fa1bfdd88fb85eb6a78e23e426933f98d0a2565ec
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\rdefs.mbdbFilesize
24B
MD52f7423ca7c6a0f1339980f3c8c7de9f8
SHA1102c77faa28885354cfe6725d987bc23bc7108ba
SHA256850a4ea37a0fd6f68bf95422d502b2d1257264eb90cc38c0a3b1b95aa375be55
SHA512e922ac8a7a2cde6d387f8698207cf5efbd45b646986a090e3549d97a7d552dd74179bd7ac20b7d246ca49d340c4c168982c65b4749df760857810b2358e7eb69
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\rules.mbdbFilesize
9.3MB
MD527f4cb6771475229974099c98ea9be64
SHA11bbef8aa0ac25d4a52d4b053068a7243e3002585
SHA256c2b6e2a45d876ab7c1a702b092d13441c87c7e077c6dde6cdf11b38fb78c9844
SHA5128ae4b5368e1f40c1a3cbbde67b81b40fd054ff5c600bce05d071b9393bb4341316b89e30ad74c0a400e520623919a1e9e7135b9b2f3d9b3e5396f8a9ddd09a89
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\scan.mbdbFilesize
940KB
MD518e9305a9b271f1939678f3f678e105b
SHA10af5f2acf72c3ebe486583f0d69cea8e1641979f
SHA25622b4764372b61ec3dae9804745baaaba4ea87035d47c4a8217e4da63a232ffd9
SHA5128816293a91a27788cf64916e61f99d789ea8480b1c0f88c098cb3356f948489f028a047c1c3a315c29d44bd4de7099237be30f0d76f386ace52bee04e17a429b
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\tids.mbdbFilesize
170KB
MD5a4ddcb5e7e5336cde5989e4971c7e053
SHA160bbb60224c267ed29a2c1f55737f14eadab2d45
SHA256b14c15b3e173374e622277cf69ba04fe7aff8d07980e23a947cd5e89a74b4aa3
SHA5120ef97545eced43a9015f21ad9bdc9c9d12cb078cf9d9dc3bdd1b514f44335bfa2e7296f4c3d4457322d03b18739ab0044b1057480f8657a65f12cc3f1fa5555a
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\wprot2.mbdbFilesize
5.9MB
MD589280258a0371fdfdec1359784a79440
SHA15bd1f020ffb1453a624206289a81dc39e615ad78
SHA2566747792b0a5fcadc2f1c7e7f77453363dc2f2b49f275cc44bff9593b05ca7173
SHA512513e56ab49ae1faa7d166f718a830e8048b6358d61c1e4563c1c099d9affbbc0599983b19cc442d2893a5511987cb783a8f176138cd721f4c017152e810f4ad2
-
C:\Program Files\Malwarebytes\Anti-Malware\7z.dllFilesize
1019KB
MD550129cebbfb03c9a7eb2e6e60a14d9b7
SHA10b351213759148e65113755e28d6dd95d1294cac
SHA25667f042f3cf185ed25385a81885289a7de0985cc7bda4db6f769d7796ccd6d5b6
SHA5121bfa6687cf6bbb1f7213f84ee79c6baee597506920d7030f227531bb73606df3a18fe701d73fb5f701fffc37cd8c079fb6c0c7809f9c59270c04ceefc404609d
-
C:\Program Files\Malwarebytes\Anti-Malware\Actions.dllFilesize
198KB
MD52b4f8d6d9f43367a014578a0ce5c5ba4
SHA1464465818e2246be884235974a815c03e968a26c
SHA2563340e2d55c14f3010d653aeb3cc2ef4d6cea61b429f851ed5545b9ba96e28bb6
SHA512fb3039a4bdd6499c4b08fc466628f837e5df3258f2415aa2253fed55a06fd2228c419474b166af5709090ec9eb1d2a93a2f04ef9b02d63c4aa2fcada74570b76
-
C:\Program Files\Malwarebytes\Anti-Malware\ActionsShim.dllFilesize
685KB
MD5ccbd4958a834e1b80929512b7c5fe082
SHA1e62c08f9ea76da12dba4a30894f246eedfd17d7b
SHA256c20e7f39b67121bf50013169e9b0f6e773ddbf6e130b95864788cc3d7378dc6c
SHA5120aaaa593bfc777f19822576363bfa05857251be660de24fc7486c07a8ad900afbcf529c8643a03d9a712ab5ee317e825a14e554e49621bd8e18abc3aad4d1236
-
C:\Program Files\Malwarebytes\Anti-Malware\CleanControllerImpl.dllFilesize
900KB
MD5536d6ada3982ca9609135a0138e8d23c
SHA1e3378c1110d5624ccb85e20050422bd04032a71e
SHA256ecb5208be238be79bd00d9dbd4a6bfb25795d3388e3156e35606c035756b09bf
SHA512de40848ea7e457c9fb15cfd33fd4e20e4f8a220591540d90a6eba0398410475d2e97335938afbfc7694abaa4f5d59ad39dbeb6befd9f358f29dfd075d2b70984
-
C:\Program Files\Malwarebytes\Anti-Malware\CloudControllerImpl.dllFilesize
1.0MB
MD55b9fc0c58d398b3bcbad06b7014d349a
SHA108795e0fe5e13932b64f069ce20a97762dfd2060
SHA2561073ab9282389d9ad598b075141f963b4155e6a4774f0d638ca717bbc42a06ce
SHA51269b38294c8ecd8f53aacca552bfb46d8f047e8bcea7d8b8c0ef742a0c5f93ea7ac8e98cd376ad5bdbdf63e0024ad4100bfcdce30b8156f53cd0dc6e9d2ccdea3
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exeFilesize
8.8MB
MD51a574e12eeb2e56a2b9f6db52a9ba756
SHA1e86ce4cd80c1b5162656d9f703a5abcdff883c2f
SHA256225264f714b9ea7f378eec1efc59c2a01aff564a832a87e8a59578addcfc44a3
SHA512da46d6b5b7055a5e184bc384d843493ea44bd3caff361d885c4f80df91e833f44754f66a6372c56ca5c17440401a9f76653528ff20c79d4c2ec63c1de5acc6c2
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMShim.dllFilesize
395KB
MD53b6e149f59f6a2396193955ad89af1b5
SHA168e8b199c04b72ec2ab54dc68f2d5210ece0a947
SHA256308250f655c13b765ef52dca6e9d724f6d89c8b5ba32b7ee9e8eaabe4d3efd0f
SHA51231c49f4041be2baad68ab0b85caa33da2cf333c38853398fa10162b18eb0b0758a5a195cec852b4bb1c966857fa1e6917f12cae48a5253e04be585b002720069
-
C:\Program Files\Malwarebytes\Anti-Malware\ScanControllerImpl.dllFilesize
393KB
MD52965c2baa79c3c5f714a6052ef0c075e
SHA1704f841493c1cfdbcd4edcb016e0460a5d599202
SHA2569afa4995049bf175320bc0b9c56579acee0c560539a495dd4b77613ebd57b8fa
SHA51232bbe2cb22cbe98b26c6f0f4e6a2209c08d5968ed3d8df62b252652b9d8999fa5ec7bab607459635259c13475faecc3918c600a2923e908448523696f55ae06a
-
C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.jsonFilesize
593B
MD5964b21bec59e3cad580a24c1bd251ad0
SHA127ea822c2a72fb210364553ac477baea775acc15
SHA256186bc13c2c6011266bc6085160edd117cae1eaa9fc0c23583c81ec3ca015176b
SHA512e4e6cfc07f52e1c6c89df1c44014f5044719ca3e5bfcd077909c30dad135f514dc361abe2e29235945c093f8fb6b2eb08715a9f3824dc916bb6ad6247b485e90
-
C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.jsonFilesize
655B
MD5175207cb3f0dc8f7392850ae30c64af7
SHA1b6b5dea1dc8759795e13666c2540beeacaf25469
SHA25644e0bd502ab068e4c0a3334a935d78ec8c5a310ecb661e1b51604cb5d56bad12
SHA5129f0958ee20f732386228146a97fa939d7076e5e275af8b46b4ce16702e5acb88ac33414094f2780193e9a29f04b8311a6ee8587d380a94e2ae1ff43821e021a3
-
C:\Program Files\Malwarebytes\Anti-Malware\Swissarmy.dllFilesize
15KB
MD5949389c876e5c946fc9ccfe9a7103428
SHA1221f1a6033119758f0b5c7708df03f1ee11ec49e
SHA2561808e3c814c783ff4f590b103144874332c498833a1f649385e2734fe57ee14d
SHA51207df7f685bb1be857a370af140f6bbdaaed9cf4d56edeccbff94948964295a2f37dc7fb5ff89bde0f94e6c1c96fa288783a12ee39db3d995203809e602e88527
-
C:\Program Files\Malwarebytes\Anti-Malware\Swissarmy.dllFilesize
20KB
MD5af75cb07f3302afb6ed9e5ff9fda020d
SHA194a38e02b7bc18037b83ce0158d7ce74a783abd5
SHA256fee21430011a2137b93eeb9ff8ba73074db45824ee91d4c66ff72e67f6532cca
SHA5129d0ca6ed365b8eab715a6cdc7453af7873308fd936c546bb2c2d2e12c2f3b9ce45cba6b6a112a392417658db865356a5f30133fe6039376d0fbabd1a144e1de7
-
C:\Program Files\Malwarebytes\Anti-Malware\SwissarmyShim.dllFilesize
190KB
MD56530510f45fd2557fbf793b33874b2c1
SHA1791454fe72aaaedb97997fbe8dfdae4501c24a87
SHA25676d0b4fe20a2c07ef570746f8fb6fe60c63c02546a8b2c6d8d5e51d4ff299471
SHA512f96251af549cd9558ee145d6681ac8ee438bef1bfa4e2224ae13d71c476dc478c2394e92b5a768690cdc9045dd18e72191e97fddc59ff7475978cef1973e1eea
-
C:\Program Files\Malwarebytes\Anti-Malware\TelemetryControllerImpl.dllFilesize
147KB
MD51912e3f470677b9df066ef1129b27125
SHA13e6f1774bce1f97dc824a7bf2c69dc9ef7ef8807
SHA256a278eb508c35eeaba49f5998e63c3a02175b98d29fd975fcadf39b0f5eca84ff
SHA512c92c05944aaedb78b3d9309a25a62a9d5d7aacdf1ab0a24c81bbb2f41054be0d7843c876345f7f6c10674272a11676f321ae8ac1b502e00c29d496390e161551
-
C:\Program Files\Malwarebytes\Anti-Malware\ctlrvers.datFilesize
8B
MD5fec127e13e92bd1f04d996fac7046635
SHA1877a5b96775bf145e03cdfad001f0ae2c33c15ea
SHA256971cb318c8273a8756df2f052cb6647bc781013ebc94b6afd1ea6f77c9203a78
SHA512513103bc332bb56a46c334677a356daff982f989b7b98cff478fba97185b224f06d0f55c3f9dee24c3fe4286864a11f35ac45f7b9b226be728d497e3bad3014a
-
C:\Program Files\Malwarebytes\Anti-Malware\mb4uns.exeFilesize
3.8MB
MD53a5511aa0b3391e371578630e91e621d
SHA1f8d945927213f6a56fbb53bb1f4b73dcb7cee5eb
SHA256c2769b3f017e519ada2501fcef35322c8eace083473b49fa42abb857f24c109e
SHA5126a4de6671772777f8f26901bea002eb9f8707dc3e5f9e9085b90f8abd1a1c551b435cda946216bad756120e3c076c7470305f45756fee240860888df41b6a422
-
C:\Program Files\Malwarebytes\Anti-Malware\mbam.exeFilesize
14.6MB
MD5b476ada49668c0076b8d77e37505b8dd
SHA1bb057bb1dcbe7f0a4733d9e9f3c8049c3d37e560
SHA25643f3e981c7c9519724c4976f7aec843c2dbede3086739fbc4d7d4ed357c732a7
SHA51276bc81867efa6d6e0b5787d582d913f70af2bdfd28f123e79f7851f4ea9a0d5551e4b4eeca8e33750df530ed244ea342bfc5165d1d66fad85df267da775d46fc
-
C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exeFilesize
448KB
MD52b4b4c14276471c9bd98a2f11eef094a
SHA10ebe42c960aee2e917adde89fa3962aab42c7fe1
SHA256d10e592566ef1a88f2ba5268d0f4ce0c8837808e798c48b04594b7d305fdb7f7
SHA5126ee29a7c572b615f2212ca6ecc5bacf4a0a883ba08114d7599dccbdfe9e2392f6bb8ec0ed85f29176df0ba7f439cc1874f6a9539769278bfd851973da696ec0f
-
C:\Program Files\Malwarebytes\Anti-Malware\offreg.dllFilesize
114KB
MD5f782f049b0e8c13b21f8e10e705bd7e5
SHA15c11f955e3983c50ea46b5d432c97c9148ac8e9f
SHA25616c450a310edbea07f578f31368f168ec338011cd117406898593e86ebb83dae
SHA512eed29c42b14ff26a030f53d61d6dc8e3971e478dc7646b26189f14f16699b6bedc170c4bcc37efe2e8f3048bde37480033b49eaf1a4712b88464f5da0efc18f2
-
C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.catFilesize
10KB
MD5f7c8e0339bd48b6fe8eca81ac3ba5ba5
SHA11369bd4dcfa7709d8eed12fa76fdbebd39dd6bcc
SHA256a9dd01f84a075ea8d0b0968fd7a11720e49f019834f7d4fe80f50dacb12030aa
SHA512c722510c40fbed32bcda3b5b69c590a9043e4e51f8e804f77f73eb8ea0cac0f4a587ef540f2773981839f04e44f48bbc8b5e8c03ded3f0cf637ed1e3172c8e07
-
C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.infFilesize
2KB
MD5d87c2f68057611e687bdb8cc6ebea5b8
SHA127b1311d3b199e4c22772fa1b7ea556805775d37
SHA256ff93773f55bf4a6a0242adf82276a8c95c0b244b9bc05e515c4e810c81a960e8
SHA5124aa65b8911d8a2a0f9ef0ee6e934b94db0a9ad4c2ec543b5edcf21486be43f6ab1fda6617ea2cbb85eff230628c9fa8e7649da915d6de695803b28e55bef5819
-
C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.sysFilesize
233KB
MD54b2cc2d3ebf42659ea5e6e63584e1b76
SHA10042da8151f2e10a31ecceb60795eb428316e820
SHA2563db4366ccb9d94062388000926c060e2524c7d3ee4b6b7c7cf06f909f747fc6c
SHA512804d64d346b3dbb1ce3095a5d0fa7acc5da0bf832c458e557dac486559fe53144f15f08c444fea84a01471fd5981e68801a809b143c56b5b63e3e16de9db0d98
-
C:\Program Files\Malwarebytes\Anti-Malware\sdk\farflt11.catFilesize
10KB
MD5502fd7720b5d16fb4466eb705015b807
SHA100ee5f87b5b322d14d1119846f8700f9c1696901
SHA256b4336baf58e50be497286785e5721eacd113c44b212ff5f7ce9d3b909bf6d392
SHA512e6b414d58fe5757cc673654fe5faf953a7626ae992f4a5a0214310c72eb36ddf29f1ea58d72d51bf612a88fffda26290618dca0c44e516ed87256cba9c06888c
-
C:\Program Files\Malwarebytes\Anti-Malware\sdk\farflt11.infFilesize
2KB
MD5711bd19edced87c3777b0b6a5a32bbf8
SHA19ddf9ff2ee2018c6e7830936c325e699728f7d4b
SHA25684c4f8147bfcf02981da93b52fe4204251657305a1839bf3a19f61be4d13d37b
SHA512e0cef3fc1377785f934f6b3f68409505cb54ca7bdd3df501d6d6e5671323a4d219a177f6fa3c58ba76675f1c297b64e5fb5612eddc73aa40ed87cc6e1b18cc63
-
C:\Program Files\Malwarebytes\Anti-Malware\sdk\farflt11.sysFilesize
228KB
MD5b98ec70c4d212eb019e7927bbb1b3dc4
SHA1cfc84115ca08a3df95c394567ed5c3d923c299d7
SHA2562f8d40a5af572c889458deb3ea6ffae01c8fe7f6395c12018bc27cd4ad2882ae
SHA5123aefaff33c665b2aa92c32411b242248d4a196f6d42c0a673769cf17083993e32502f39c3573754a0a35294753bd20cc47ecd48c7f5dcc11c6d701e7a5f7b3d5
-
C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.catFilesize
11KB
MD51cd8abdaea3bcd30214f01046ecd450d
SHA1abc8fef03a274dcb9f15c17396e9f0af85a0b0fd
SHA256cf981ad0b084c330fbfc00f9e559404c6731d407a9f004ce68b50ecd7abe7425
SHA512a04f2beafbe2311a5eec84f8ecff16db1dda864d420643184b0164aca9958b679205c3ab23bb71095d710f45dc4c3c51ff8b267c36a1ffc768126b48556f5f86
-
C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.infFilesize
3KB
MD55a9717e1385703e8f06b27aa10a69e87
SHA184ee67a9167b5eb6560711b9871de98898ad07a5
SHA25647b7c516bb57c612de19f0ca865590af95b6e32bf873a0fef9e011b2c5b483d4
SHA512dd3c7278c2c11ad15a55fae6d19b96dadd92f85b7f0c8ce934298258af00bb5c052a84a98499b8867b0f43704fb307c67d03692ca69dda4d814c6c17dd73df44
-
C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.sysFilesize
218KB
MD5262ccb223392f18adb4b4c846905c4da
SHA163403407fbe1712a4bfad0a74efabeba297325ca
SHA2565d2004603e3b392693a1e74926a36a2ab3573c6790b00ddb14564c8affbd4f4f
SHA51268b2684b9f0a2e5e33b76e43ac4b25b8e7d3dc3d678fc3c90d70ec5ee65ebdd884d838950fb4bc5145ff927e25796d2e6e97ee6bf365ed4f66ac7f7ba8f63b33
-
C:\Program Files\Malwarebytes\Anti-Malware\srvversion.datFilesize
10B
MD590ae63f8dcc2bafa9d4d5ddcf57ce24c
SHA1880b08f4da4f79c065fa6d52df993a634525e1bb
SHA2566c5fe0f7058acc754b18a3e7982361279c796623f2cccc3d29f043b806dc02af
SHA512160a3413a9e1ae55252cea4f787cd1e7ce5274a0f2813bc59c13eac2dfc161979682bb40b96bdc46898f74087cd07f0118b9cef21e9ba8cfcd989ab1a87f8c67
-
C:\Program Files\Malwarebytes\Anti-Malware\uipkgver.datFilesize
6B
MD574c6677020fc6b6c867aab117078bf5f
SHA18c46db37dc0b39eb963d4144539c8b591e122400
SHA256cdbb9bc874d71e154c71b68b1fe959913d286036dac11e226e5620c919ba9708
SHA5123f9db8d9bb25322f8d8e750750bf92dbe6ac63d686eced65cddfcd61178cf0e947118a491058414d4d2cbb4892e39815565669aee0dfdda23aece72d278292d0
-
C:\Program Files\Malwarebytes\Anti-Malware\version.datFilesize
47B
MD5738ed93dd0aece39d16b863413906728
SHA18c43078d99ffd2b27994b1393acd9a7fcf387eca
SHA2563a5946b0df14978b314edd411afb42d702b8464e5cd63d40bc180806808e828f
SHA512078f0e2653454439ae7e31272f25bb8d7a38beb57c4f8ac9df4df83192d7c976fb21234fa81fd0ac0bbd39d8f7d6cb2a71f9f3f25e3f1c52d50ad0edc6b1df68
-
C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.jsonFilesize
1KB
MD514f19e000faebf6f8afcabfabbb4ff9f
SHA107bba9a4e4d339d734cd070c9baf005e901c6961
SHA25606b17487361b82647128c276dbfa91561eabe8caa8b59b878103f6eca0c6d451
SHA512976ed50a43dcd1a693a05e40bd954ab35c94e7c0f1cea7ea65aebfe689473e566295de80a994dac07d15d77c9a4a0c2a7f3c6a714190d1e915bf15a233bdd0da
-
C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.jsonFilesize
47KB
MD5faf207a0c62b2e4be7fcd392e6286b55
SHA1dee514f01d6c07a05985fdb6d9c5d18cd027f3a5
SHA25651925dbfb3959fa5637d2ef009d558a8971831b0f14b1632777d7d41474ff310
SHA512bbd824a4ae12116132acb12daffe4ff41fcc2503fc8d16f7390846882dfacd049b509a8ee7598e015ccc67406ad85106e36efac35fe9daa21e39adaaa573c68c
-
C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.jsonFilesize
66KB
MD50bd6cc409e56e10dbf97a4fcc022942c
SHA140f37e1796679d538bedc8f1ae73d7c1ced1c91e
SHA25698e1873112995680e8d50ed041753533c6118eebf84f7e5e5586dc78bb1d0e1e
SHA512614f2c0bed15b261bd3634504f0e0c52ae26c3990407d033d5616c98c8b4475d1d852baca62166268542f12217bae0d4ec244bef9249022de45571095baf7d0a
-
C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.jsonFilesize
66KB
MD5f2f8c6012dc2dbb7637f3779dbee4e3b
SHA17b50fe55ac4d8e420712fb76da963db4ba1da083
SHA25649d6c687422d4aa0ffd6c82213872698c6bc3058f920d7eeb7208d037c75b740
SHA51240d418a3216b85297639279f8db311c9e61c0f2733d00557fead1ac143eca26ef85183f5e62c275d5b240a5a17a9bcfac1f008290d5579174ed805d8434f2f36
-
C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.jsonFilesize
89KB
MD5b30b82ccafa24ad363c7c896a48310cc
SHA1b17770d809a6d86495e03bd354101f244aa54454
SHA256fa8d98d98ea9e9596607de0884582755b6a6592c5e3cfea88e5d2ee43d5d813a
SHA5128ed9662def471daa80d6a038574492f20be339516f698facc7cb823113c87aa598d69261f9760d46e85358617164b9ef4d848e6a91c9a1a3e9fa3c18ebd70776
-
C:\ProgramData\Malwarebytes\MBAMService\config\ArwControllerConfig.jsonFilesize
607B
MD5c97ee34811f5f21ff1c928dcefd01c47
SHA1a3e3f0c4023df33239d92c5faa1e7ee0598eb48a
SHA2567145dd3787903087a31c4f9ae9399f58baf8c9d95184c5dce178a8c579bf2bb0
SHA512bc5a9d4a4364b7e330dde068d68a7ae7bd3825d4472724160e8ff69b2619f83ba98c09be39a6ace2e80a2c401e3c0c0224c3d6c1f33983a21c12f27d6696fd9a
-
C:\ProgramData\Malwarebytes\MBAMService\config\ArwControllerConfig.jsonFilesize
608B
MD5a15b7c8968c4edbd69840f046158b45e
SHA1bfc0f9be91e61b152aa287c4d8f3d29e05a15574
SHA256fd479b1381ff699727591b32e92f74012e9010bafece75d79731a253a31bdeb8
SHA5128eacebf97f15e7286d95ab631b5cc96dfbe1c0284a90de498e61841e6384f4ebe61fa8aeb51982b80f2687ac9e79f0b3c7a72b112e9fd4b12f89a2f7d543019c
-
C:\ProgramData\Malwarebytes\MBAMService\config\CleanControllerConfig.jsonFilesize
847B
MD58d050bc2de3ccf97fa71dddeaa29b015
SHA1426f6aca19a1729c9b5e1dbc10fc35020f294b8c
SHA2561dbb94aa5d9f7192d91842cb04a71a5fa51eb736943771b22ce81ecdd40dd241
SHA512432dccb34c18675d14cb18eeb2d772ec3f6d69d37c56821db9771a3811041f74b76740138b26b6194dc4155fc9b8a9f07b303f94b08d7c2e1fb261bb8f8bdd23
-
C:\ProgramData\Malwarebytes\MBAMService\config\CleanControllerConfig.jsonFilesize
846B
MD5bfeda1549a782ecd4b5e0116724e6028
SHA164f9062e5cae3cf56303a32562f17787a00bb28e
SHA256e6578ed7e5d8b150efe572395ce48a0a5c43951fdcfbc1138c5ccaa70c9bbb1a
SHA512d720ac3b143947963845e8bc7da65cc19d19e98d24a8b306f53da38d1ab854e8065d5099b2d28a194effb8efed097f2174819148921e949095080e0c065c34b5
-
C:\ProgramData\Malwarebytes\MBAMService\config\CloudConfig.jsonFilesize
825B
MD54af331c21bd7a60f51d53aea7602483f
SHA1b59ca634198352768327ee7bf43e59e31b581910
SHA256ad2647482c65ce90809a4847a991452c6835a8fca06938330a85ee6203503396
SHA512ee90c6ca4f33d0d967e16ec474a1ca4d2bf7f337445864759312d1650a96945b8b7cf91a5beee81ee8785978d758ae9c9fdf27ab57fa3591cc5be5281bd7f10e
-
C:\ProgramData\Malwarebytes\MBAMService\config\CloudConfig.jsonFilesize
1KB
MD542ae87a8dec52b0e4c5591d68fad28df
SHA1ac21f87a44b11c40497e7df412aa98bb1e69abb9
SHA2561e184230aece2bb18a0c2af15ba957fafbfd9ac0659e3de1e687775547ad7c39
SHA5126e71b36656825b57acfdcc310590b300c8c95172b1d8b6b0e438f041d6a2acd8be43a931692531443a5355bcfde20963b9f4b3f3a1f957c5c359e5f3e5d1ac74
-
C:\ProgramData\Malwarebytes\MBAMService\config\IrisData.jsonFilesize
107B
MD5ecba6f9a122ebbcc86912daee66a9d01
SHA1e8468515bf7ee917e277bd343a987b0da08248a2
SHA256f59cbb877245e7dc1f19f8370ac897d629ff2ebe59a01d797d3d3f9a03d928f0
SHA512dd40d216766fcfe1a3579d7b2c3c36ac1eca1b42be8838e9a7b17b79ddd27b56eeddcd44ef675cc3c9f7ddfcfa9804f8287fd61b5a25a73d6f35a6e0f645f7b4
-
C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.jsonFilesize
15KB
MD5fb1753bba9f5e8bbccb9b79c2a98bb43
SHA1bdb3a4fe36f5376b16055ef15b2e758d8ba47436
SHA256bfc139eca831499ebefca790ce0d18893e3827384d55ca4f3b9c53e3eabd7645
SHA51256d3c352760bff9620239ce99db4a7cc5522601b6d8f96848dc422aab14a5415400e936a902d59398f1cadbe5e1d26f4b7a623c23c33b64f0de7891c6290d628
-
C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.jsonFilesize
16KB
MD537fe7677cd52d91fd2eeb430e83831c0
SHA1ed70dcd26cace9787c2bdc8f5e9ea576feefb28f
SHA2565961b1f458dddae876a0a7235e8b0051d276b410e08750108d9820459ab60a91
SHA512272b335b8e43ebd475f0ff3bd34ffe823121db5bdffc7c8f768af79a695ae4446e02e4e59ae321ea1c6855692c9a8f27f4ebc12f2286249110147317948d43fb
-
C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.jsonFilesize
16KB
MD5683b4d143ee29b177bacb3b8e359e8da
SHA14913948db3683cf26427e52822b90c2dfb69a947
SHA256994591ac68acc3e844eb7e22d432050e809cc13009d89274c9b945777f701b5f
SHA512c34630f335362e8351bed20e9d6b2b1c656cc770c710058d5951bf3b8215393904429ef4334fd0e225ebf3dd5dfde50f3caa810b60bc3440ca2aebcc909042bd
-
C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.jsonFilesize
16KB
MD58bbda362f43f47c088d0de3266d31a5a
SHA10e6833c3c9eb2363b3c861fe8acbf0a5e7e5a09e
SHA256ce637a9c687f838dbfcfd360d8836b0d3efe3a2013448cd4bffa14df258f40dc
SHA512be6fa93c618f0b7a1d4c9e3494169e8530365f9278666f62ab8ee0485e6bee1b431aeac6430402c607006b3f7857b56c8803a20a5377e53c8d30eb5b375d11a5
-
C:\ProgramData\Malwarebytes\MBAMService\config\MbamClientConfig.jsonFilesize
13KB
MD54fda54d4d445a0b4cb807c3c4bdb389e
SHA1efa808489bb217ef301cd2c14f5760b4c84144da
SHA25610bf9782d59af21bb2937bf4652a6b4380f5d0de27221ade9685efa745912804
SHA5125f5dfd5126ddf85af3181cac92534665281b32c522f33bbe68e6e8c182f80fafda1545175a142a1c5b582d90a53bd436dcbc867694fdfe66303779358bd6613c
-
C:\ProgramData\Malwarebytes\MBAMService\config\MbamClientConfig.jsonFilesize
13KB
MD5d6fdcb9b170bc26ffbedc935df6e1419
SHA137e5d167643d22b0d7c6f5fd09a748dd2a56312c
SHA2565a823517ba60973e41e22d7256021dd0bd64ff418e35e78a7ea9ff4dc324af4b
SHA5129217f02ec24b20c397779a95fbad30c260633b66f0bcc2af664e5a39250e47420852c30ca216ae4a20721c0da9e42f57569cb6baf61d9d3f353bfb56285c7528
-
C:\ProgramData\Malwarebytes\MBAMService\config\MbamClientConfig.jsonFilesize
13KB
MD576c63d5eb0785867a7be4b9b04c643b5
SHA1332cefcb7f3429cbf5babb53a52fbe31d2635516
SHA256dfb1804653e993fe147241be07a97d470ea3e9512a5f04311ff97bc77cfb1839
SHA512860c169b57db7674d471a120cf51c38fe5cbbe8d9a46aedf603faf339981e5e212e023225770762170106e2ec048f21055263af0748275fe88d2efbd36a6cabd
-
C:\ProgramData\Malwarebytes\MBAMService\config\MwacControllerConfig.jsonFilesize
2KB
MD573f89ed94e57d939034d51026482aca2
SHA15fad394412cf9c9ef377993703165b39f8d8a7f1
SHA256e5b4c5d890cd3f2add1edb4d2fae8fdf3ac661178ea80752fd0a17fe1d133782
SHA512e0a916cc518128e4153dd1eae8ee1a57c406f15571353be418f3dac84a2cebc60181fec2eb97bba800a4204563b1406fa8a42868ff8f6d79ecb10eb5d6d32e63
-
C:\ProgramData\Malwarebytes\MBAMService\config\PoliciesConfig.jsonFilesize
814B
MD558aab449eb2efdb7e5a31298db64e2df
SHA1d3eab2a344e237c948c8f49235f0c89e9e910cec
SHA2567e0ee7be5fc42298aa30cd801ec40c2fb8f0debb297337bab9d06317dcf8f658
SHA51251aa0c3ef8d243d7e50e8f4992f504472deb005de6320af35e7fa71b0cdd6a1fb0bd2aadd315289fded80d8736e38efd602571e602cfc349c68efd0dc1cb865d
-
C:\ProgramData\Malwarebytes\MBAMService\config\RtpConfig.jsonFilesize
1KB
MD52d80362f0f055a912ecf12347eb445e2
SHA1624cfde731c43ea475f1c4999c00f2991c93d2d9
SHA25627dbf14f0e758ccce00d017b6c1f64b7bed1ec11ac4904871a91a95cb5c9406f
SHA5122b307f1b51441ff10236772f17e1fe0bc813384fda2d133e4032d7d918090e7fd892c30e446315dbacf95250f8753cfab526e060f3112cd90318b6aa92eeb2fe
-
C:\ProgramData\Malwarebytes\MBAMService\config\RtpConfig.jsonFilesize
1KB
MD50497bd5a0bdd7f87a221c3b2c7ad52e1
SHA116b95ba5f5fc17d0069adedc11b0e1b8e1cefda4
SHA256da1444a2549d5f7712851af7cb089a0ef73987b4b5f47006fed14ab94e703ee3
SHA512cd32daefd3d298a48ea7f60176448adf15881ef6a070e50fdb5bfb8b4fec9ad7078ad9b84355ddb7ac69ae679da0e3a9e79731486a691e56275c300e6b2a3b83
-
C:\ProgramData\Malwarebytes\MBAMService\config\RtpConfig.jsonFilesize
1KB
MD56b666eb619d243de0631b2fb93249d3e
SHA1e7b230449e6ab57134667f3ef38941a096cc98de
SHA2567fd45f7472a7a9caccfd98a04aa599198e6a58fc81e23605b0ab14a29677e64c
SHA512c4f8aa61f88917d8602faaac97e967e318e56cf825fc4de05a4d5f2ccdd03a2c249c7ef43369387c75dd0c64a8d71f3351190c4a3e745427c8247613c1275e36
-
C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.jsonFilesize
2KB
MD507c87dbd584fb492708e395f51ea4d09
SHA1135589f85ff97328d0e1f3fe38a8524985c22b05
SHA256b50b3904ba858f0fe39fe45897da21bb2e5a6d31a97d6d37cb1c8cbd782fee67
SHA512210ffdc35c8f59b9d16fd538b9003c9d2b07a9b5827d043c76ddeebe9e65d27c32f6c823e86b8dca4ff89a5d5bdc04acc88a5eb229ccd9fd4a0605375dce701e
-
C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.jsonFilesize
4KB
MD5df25cd52c954e240499499762e939918
SHA19d44244e3b5b7a7ccea55392d2bd02f47cc8739d
SHA256e8ba45594ff62e9f39b66431986c9a6210f4d0656c042685320312c31461431b
SHA51285cc05d838acca1aafad56dc9d8429c078f3f73b124b57bebedbdb43d59164369fa8479ca6d85757b04bd4ae85e4659feac2a8810d4a83e3ad9b1f3f152d95c0
-
C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.jsonFilesize
4KB
MD59fc793ee6f5bc33260502368a5f08800
SHA193a21a13520f233992769e14e35936bd7722da4e
SHA25650369130088486471147ce3b028e21308f5256fe172101f5839008a1857ecf26
SHA51211db39369cfa3f09d07b914449b3b1328c2c0fa0df9ba4ed678fbe9560edac8ac38b22dafb318c3a9173bfef309d0b8b5484c3df74f72bee1996fd8f64cb594e
-
C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.jsonFilesize
7KB
MD5839895cc234bede615a855a74d5d17c9
SHA101dd25585785009b03efdeba3d431ad92e4f02bd
SHA2567a45fe261c479d9942cdc8dea6ced927c2a2a30ea96cc5ea8478f8961f06e6f3
SHA512417180a7700685d6964873b7e070f199d46e7270136dde04a6be2413c30f0bf5867e42f28c75005b15b9bf80863d439cf812205595550ba5bd32f37a74a21c09
-
C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.jsonFilesize
4KB
MD5890f75848d4c4a8922af902e8551c32d
SHA1741e900ac2f2bb5ae11e3e5bf69b3b36843467b5
SHA25690afebd9110a37b1ce00c1259b5e3ef70090f3de5fdfa73015d716be362b2ec0
SHA512d9fba814cc3a7445d407a0cf0777414b4ca9a59b9da809fe9a53adb1a3ffdcab1306188d18efe96177e9cf2c916220ae51fed805db283d7d5ca2ff79ada27b80
-
C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.jsonFilesize
4KB
MD5eb29f724c2334100cad3365e5f0e21aa
SHA1596da9b0f2c7a1893641b1642a9735e1d194edfe
SHA256d5920c573fec6ac06a38d89a279a0911d0c72dc29a5ebfd545c5626851beb9bc
SHA512e5932089cb8f0ec4591d34a32b3b5f7b13091deecacabfb484c53c7010fcc1aa02049bb34ca608744f73b3c450121c56cf96150db91d5f1441f6f43407e85143
-
C:\ProgramData\Malwarebytes\MBAMService\config\SpConfigFile.jsonFilesize
11KB
MD5d07798b9c8fa40a829f45f5d2a6724c8
SHA17edafe2a548cf0ccd64dabbfa661c3fccf808dbc
SHA2563a4351b99bcae8c5db9c2d3e1814ab8eb07a2c8fcc897049d5cac50106b3d8d2
SHA512f4a246c9592335e2fdcb778571cb97e5afe3eba60312a4c429777c518f294929e2a4eea773b96e0783713180a6078615d13fedbb73f62063c0fdee73fc1f4c97
-
C:\ProgramData\Malwarebytes\MBAMService\config\SpConfigFile.jsonFilesize
11KB
MD5c11c24e66d82cd1192083f178cc53ca6
SHA1aa182ebc85c2e24123900385b8343d6735237546
SHA2569a3a2d1c7a80219409a3851aefc96a00c5ab795a8aee10671abf2fde67dbb772
SHA512fae9f4c96ccc928368af1f517fa35a1614165a29e4eea5e551183f75be3f116916e6ea143deba20d1a28436420b5ad58e3dcef90996ec0f8809a67bc7291e5de
-
C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.jsonFilesize
1KB
MD5019624d1ba91338d1f93ecc47e9ce32f
SHA112ead098f9952fabcccac2ee31a3908db2a8ff72
SHA256005306864e7435bb885062a0c55fc1c28e3a6738c7b382ff54ec36df3ce6af57
SHA512e3be7e61d75d0e544a8b45faa4bfeaa463f8d47b078f121e539b31647c32dc206c2fb38717c96c9383a1649a47fba425de3579acf738037826bab926f4d22eba
-
C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.jsonFilesize
1KB
MD5439511e283ea8a963ef83b16edf96433
SHA1481c68499c69a13f848148df0c262466bd338f3b
SHA2566ba8e75ff94465d36ace339fd5575f94451d889c290491e567dbfe1a64b05baa
SHA512869e2b2609865791a4a79f8608a87cfe191c5fa44a1334a308e6d054f2ecb3bb09ac7b3b0a214ce437b806ed8f1d1f839372e1dc4183878658b02ec9a2d0e44e
-
C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.jsonFilesize
1KB
MD5db30bff16491a6a8d163de388cb276a6
SHA16f28c4fa37aaaf8fa823a61fe3311f89ab101fc4
SHA256e6e80de7412821b02b8df98b723a15f0aad9bfac9026a7f3313d6baed9f05e4b
SHA512c5c8ece5dfc4f11649d89c92b0db80fc6c3389f620b3339358831a2ca73411633c634488c53ad919a2e5e55e888e7afe4117b949521bbe3bd127069647c93a78
-
C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.jsonFilesize
1KB
MD51c14058e927286488a604467b64c970a
SHA1909b6b255edc2de6e08bc4f6450a96cefda7f0c3
SHA2566303c8ccd899ef3c93642b0bdd1f1e3c3fabdd504d0b78372e19345387826d3a
SHA5120bfd7b2c92ac3ac7cad26a66a9a896001dae892f6d55ab8f301dc07dbc18bdcb0569ddbc52bef68526e807202bec00fbba822181a2260f9dc25c9436754f9c7c
-
C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.jsonFilesize
1KB
MD581d1f6c2d78d1cd52c7a945a2eb2bfc8
SHA15ef61386636e6d82e64f8a5d0d3dc221401f0f94
SHA2569e3658ae0123aac7d8c8e061da964d7ea5a9b232b3365e99e1e7c8a2b350b4e6
SHA512418d9c6ff0bcfc1142c080aaf6c5d4c474c28e1930c2ee3dadeefec9de4453b4ce986cefd9c3c2fe522c3560eec423671e12435092da46e6dc67d85c65fe72e9
-
C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.jsonFilesize
1KB
MD5388822cc4ca671afa4655631c29c6116
SHA15e04c30384317bd0a94ce210e0bc547bf56849fb
SHA25641aa69be22fcd34eebc02d82c797df0216f1949593616b306d09e2c7786c72d7
SHA512e4b02c9aa659267a0da13c94d84d11cda74b64a8fe932fbf873b945421b5f5d7e8578c2bcdcde95bb135025e000615d1edf909bf6cb513f9c121cd3f68212b1e
-
C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.jsonFilesize
1KB
MD5f0406dfff570136b4b675bb20fb42d4e
SHA1eebc55a86475839f3ccf78a9f8d0e8e319e570b1
SHA2560de4a22440cb8c4f811fb62d23e512645829c33c03fcf8bf2d51b63f098d8756
SHA512a0f8cc4a1519b3b4ee0c273b247a55f93e0f209fce5a918b8cb30b50a8d4b6fa87d9cda8830f6322dfc4c1077209a12b33fcf54581a35c2e3c471569646262d1
-
C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.jsonMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.jsonFilesize
1KB
MD565e36015ff9dbe94e33b46f2e7d404cd
SHA12f09b41010d43de47a25ce5cf49e651f50657cff
SHA256234f4b0bae72ed774e5cba2e411cf0c1ce642c1d0773089a3ecd08584e0ad92c
SHA5120be01ddcd5a12cf3e67ca62ac942e607737c14fe7a439313dea9ff93b74eb8f94860eb0d5ecedfee7b1b3fe0d7652fb443b122b6befe87822901056946bea20a
-
C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.jsonFilesize
1KB
MD51ad8105da6314bd4f17c80ec2e0015ea
SHA161c366b3ecae4c777fc1b0ed5f7d3db294e859de
SHA2569f1fce09f1ce071abb19c77b1faaf7719fdbad987a2eb4b4c43d34427655fff0
SHA512b6ca492901673f1e3f84db12a991183b9fb0d975ee3f4b703561d3eb82a53c054b59e25852358d79a439262474580266ae1b47078a0fd3a6ee6ccbfdf411090b
-
C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.jsonFilesize
1KB
MD55a27efc41683915fb12a5d63686e6ebb
SHA1e2fc702e82b868cf39e1d5db7cd1463323055fbc
SHA2561badcf723c1a0426c73441dbb2786e013b95ffd36ba0a48b36a03bfccd418a4a
SHA5121ec9d107b8a6b436d518661be41d029497fe856d1bbe35b2f1f9aa900c50510b490b970b36ac3c41794282694724c24b97749e5a11efcba003852917f9be4d3a
-
C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.jsonFilesize
1KB
MD5ec9d8c52f9c9f0fd762eb73b5fc1ecd3
SHA17055d2dcc9ae76b3fc0ac026f4c778d643fd6f5d
SHA256e25faf7715c52051dcb5177d3f6dfe6c60b2b8a2887fa5f3b836c73cdfa90183
SHA512ee97d1ec3c1406318f9f1181f687cb2be621f3b8c2ba2b02230d8f7eb77723b071b1cafda41e8f3aa8745d229541050417003176817ac636f9694958a6418d78
-
C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.jsonFilesize
1KB
MD5a2e3f6da9e0bd417ed8ba0f9a2bc6376
SHA1ec585a8d8d8ca14681ca0ce4b043b3281c2fbe55
SHA25691ca636f84d8a8617d31e252e044bfd69f0139e97732a8a2aa1ee31299b99c18
SHA51213106d0eaad11a458f348c9e65fd9f17b695af6512c695cf2f118f841ef46622570198d95d83899452bef6ddcf4e0a8dfc512d459423b42e5072c9301f764a90
-
C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json.bakFilesize
1KB
MD5a0ff79a9cf778c33f3c46019dbae6768
SHA1a96e2743ff0128462a1925186058932627979e9e
SHA25677a9e813602f16b48d953a3580bf955f45c34867f5fd9feb33fa6d2af5006409
SHA5122264531db395928258cb7f57b4f3e14b0490cd66acb74f5855f9da47543ff9037993c3335b4fd486002054e139112d437bc12b121b6f32539e327670804cfaee
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\Actions.dllFilesize
2.3MB
MD5db189f99a94dec3d60c77192ed231f11
SHA11e3d771ced8654cb5812072cf2dec920fae2c643
SHA2560814e7d7607f515d4aff81a2d651a3295a5a2e0960fdc36c4df0b076cfbbb4fc
SHA512ccdb9685b14e129724502ff842d640b90f0d5eb28bfab66892a4ac15f35e4244476e2c654aca2a3d2070a231beb15d32a9dc08121e21a81a5677630bc9f15db6
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\BrowserSDKDLL.dllFilesize
2.2MB
MD58853ba8ba50135e9e66b766317775164
SHA118917b17649051208aeae8c62d0f6b890abbce68
SHA256dc1241ac1a36c6f9fe86cf9eebb7c5b8a9e3d1ee656599f220f907b705bcbd40
SHA5126698106d404da7a33dc732abb9172e30e7f34428e6d929349868a3cbf92540a47663d00b12bea2cc3b446edcc0891c1f60794aef19a579b54aa8f1014bfab1d2
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\Global.srFilesize
2.2MB
MD536980b07d77ebf420b6f4f894f64bba5
SHA11d8f74a66a74b2faf9b82da25dab08c9303de53c
SHA2563167052b9e2b3239d75506b24c2ec9d820d6e06d92da1dd6b99c4996c113ea96
SHA5129f25302ddf5c3c2929a4f1d1ec308504fc6bd70b969796d85b92b3e6b5b8330342c46a30222bdb0cc464c339d986f650197dbbba6f2a5476e1f0e754d8318c5f
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\ig.exeFilesize
1.6MB
MD54c9f49cca0218cabacc10db24abb8313
SHA1119a604a9b858e78095fe437d2fb8d1f2bd260f5
SHA2565311f3141b274a298cea211da7a1a0967e14f6189c4b90342518f41ccf65b5ef
SHA512004ce098d1de00afdf127fb5180501ab734e89dd5c596af983b7f8ec828435688774acc97f48753ba2fae9e025bd36237dbf516c867db75b5cf16f670e454100
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\rules.mbdbFilesize
2.5MB
MD59350b046eb8d40f184cf3bb8f711c68b
SHA1af5ef478b0d8b43ebdc47db158d6d82928ac4267
SHA256aea8bf4f80a13b394117838a71aca05b0bf09fa4d44b691bfbd354848cfb2d20
SHA5123bb54c43d61ae3392e6de72e6884fc740b195a38be623c1cba609255c8b2315dd64875fc5d216aaad3fc89f48073754af645c5420741505eef8a7493fafe8f1b
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\sample.dllFilesize
528KB
MD5746df014f6869285e5545505d5fec062
SHA152d5f0232b78c0d8746a29e75f80a2b436f38b69
SHA25622047c6efd6906c64ebb45bf08632220aa82c03d1fe21b79502b0cb7b67b32c2
SHA51258e7a0051cff72168ec56072339b2a4961a9bc12600a6fe4dd3c01f0aa8b7d22e3d79d72c7ee9a622508e4052eb7c82d047063659c23b34bf93eff7124619848
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\wprot2.mbdbFilesize
3.2MB
MD51e4fe51e7d2463a6e33383f85a0f7612
SHA167fdec02700cc8f3743d7e1cad47c8212e68ded7
SHA2560338949964a33e753986f17719c6f36cefae5b4c5a29fde8c0a9e36602783dff
SHA512bfe2e329595cafb585836868f5c75e8907b05003669cb752b7aee7e1f85244cb28afa4617f0f8e2fcfcb8d6bcf24e0ee783061a0681f90c896ef6a769c571d97
-
C:\ProgramData\Malwarebytes\MBAMService\logs\mbae-default.logFilesize
1KB
MD54fb20665040e87f0b1a835433adbdb2e
SHA1624bf6be2a232e3d1f350d7b8bb71cdf965c9435
SHA256af19d009d1bc2f36cde594ff5f5967875b7435165723899e856597f0a2e413b7
SHA51266106b547855fb4307d2e1dc4fd112e785881add3521a0656622ecdbab727d50a3ab1d0ec415f89a8071b6ead6a3c2c39dbe380f83b771a81d7c797ba3d4425f
-
C:\ProgramData\Malwarebytes\MBAMService\updatrpkg\SdkDbUpdatrV5.dllFilesize
2.6MB
MD55c4b6998682070ad73cd246eae251ccb
SHA1d4e3eef6332a6598e5d63741f3407574c7de5f5b
SHA25654e0e90cc5cfef91ceab363c6cad54c7190cfbbecf6353181779938a3f8de8a1
SHA512e1f844ecb631b628ff37068ef474b070e22c5be6453c77acde53e886b7e9109f22d09748a7902e64237f5cc9d05818080c0bb5697918235ea2d4ceefb68b8524
-
C:\ProgramData\Malwarebytes\MBAMService\updatrpkg\mbupdatrV5.exeFilesize
5.8MB
MD52809313bcf5a1ee3fe0354be67b1e817
SHA117d46c0ad6c215b48205b77979b302fb61609984
SHA256af0864b02cc0c285df0fe650bc41cc6baa57221c46157c31b0eef2c1e01f009e
SHA512000fd950f851610ee267d77fdbe3b19ffc22bedc247a88c9c8fdf2684e799bd863ef77307250771c39ff32da914377d5cadd60d9c0e3be9ce2f82b158ae3bee1
-
C:\ProgramData\Malwarebytes\MBAMService\version.datFilesize
26B
MD5f9d3599da03526aa9eca0dfb8f6cd16c
SHA1eec07f6f684dc12edce039822683cd5180d42e77
SHA256b00febeee42e94004d5cdc1280c2777d1344282eaaa4d29db2f42eba9367905a
SHA51215787e7f90663a4d2181fabe438cabf99e7b32185918b1ceb82851141d7bceb1db04c8b46be2510e5975ae48981151d0bb860fb1a4fbab5765f95fe2e0498192
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD55c3ea95e17becd26086dd59ba83b8e84
SHA17943b2a84dcf26240afc77459ffaaf269bfef29f
SHA256a241c88bb86182b5998d9818e6e054d29b201b53f4f1a6b9b2ee8ba22dd238dc
SHA51264c905e923298528783dc64450c96390dc5edbda51f553c04d88ee944b0c660b05392dc0c823d7fb47f604b04061390b285f982dfcc767c8168ccb00d7e94e21
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5c65e704fc47bc3d9d2c45a244bb74d76
SHA13e7917feebea866e0909e089e0b976b4a0947a6e
SHA2562e5d6a5eeb72575f974d5fa3cdff7ad4d87a361399ffdd4b03f93cdbdec3a110
SHA51236c3be0e5fbc23c5c0ad2e14cfb1cf7913bea9a5aeb83f9f6fcf5dbc52a94d8ccb370cef723b0cda82b5fba1941b6a9ff57f77ff0076a2c5cf4250711e3dd909
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD5db65bcb9589fd27be626728f6f727605
SHA1aa176395b6b70097bf1c06b0ea63e2fd0f20f69f
SHA256eda208be18c0e802fc393b23f0925d9ccc9ae41bafebb252867f123da07eb946
SHA5123a7bd823d3e56dd87cd7d43fc4d414ca182f42ce91fe01af022220a63f902ed0607b9abd1a967dacb48583a166d8c15cff5d5470ab395663109f2c119811d8aa
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD5813b12a4b564d28ba447883b8e11a983
SHA1a5e1282f37be89692442e8727bfc79ef1dd18279
SHA256b404921d050ac294d9fbc5884557d5a73e56ddac7b02c55000ea545d4146ff8b
SHA5124cbf2458ed975f6c19a170753357b3755a4439d67c37faa964f562fee65cf95e85eccfeff0691fe8214df1b5b497cfa056facae60fce24bf4332caf2506d1b56
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD55172d4292b6c30d3320222fbe9e2f9a6
SHA1c4d10e4972d29a8bd6b2980dea47801621966f8f
SHA2563a2496b1f0adf33b60d499eaec93976984bf9c121b2b4e6b91122de98f8ec521
SHA51234ee604b6a1bd36f2d386de93061535bf5dd532b140411ce0b614f3eaf8b4e29179818e71e2184b25e0e6d956c8e612c63aaaaea0f554bf4548b7a13e84cca08
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
10KB
MD556764d7ff16885b56d96fb64f62609b1
SHA130ed59abe4578036ebcc25089f23dbd8b61f81af
SHA2560afa226dbf7e068d8c74bc151833909d8050fc2c246a0b547b7c7fd5e5caf94e
SHA5125c16796db684a8a3bf886cbe38828f41264b387db8f68bf77e886d61d060e4430b52ad2db5af7d63a726fdd757e8fb84f20fd951e834508a272abb3ce0765615
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD518461ce5c8c802787e5ed490a5cd43b4
SHA18e8c81bd701a7952232a286f549bfec7b101ce68
SHA256cd80058ad80fa73b7aab3654988c3b4242491b228a308f9689c3a83f7ac63efc
SHA51253ac426fc8bdcfe690b766fe1ec441fcc15a211cab31ebfd859679f63a13d7a1c0b3005fd0719a28f040d95d58205b00cfb9e503a45212f7cbf3a04ffe61b446
-
C:\Windows\System32\CatRoot2\dberr.txtFilesize
2KB
MD5041aa84b38f9f657db17ccfcaa83f201
SHA19ecdc614f34dab9da444c06c33d4b530a2b3fafd
SHA2566d0809d1723dfa94fcf454e95f3ed4e8f6ef99ad405bf8d3411954895de17fdb
SHA512d82a4a42aad0a0a04b10d2665a03ba0636343c81cbc3972e8b804da3f1476333f04893e3934f899a5b75ae3f84fb6b9f29b504e86261cf0526915472155d3923
-
C:\Windows\Temp\MBInstallTempc2261da5ec8911eea6f35abeb01d5fe6\7z.dllFilesize
1.6MB
MD5ab8f0c1a37c0df5c8924aab509db42c9
SHA153dba959124e6d740829bda2360e851bcb85cce8
SHA2566e223b275b84d948cc5ae1f161f0bfff2adb34de04634c84d7dbe9305a4998d5
SHA512ff8a26e8fd5a08c74e5ba93a564e0d3cd932754e7f06993a365bfad06670497889e69ec45bfba1378040b72f82d468e79682beba2439937bb29d2a41da940d4a
-
C:\Windows\Temp\MBInstallTempc2261da5ec8911eea6f35abeb01d5fe6\ctlrpkg\mbae64.sysFilesize
154KB
MD595515708f41a7e283d6725506f56f6f2
SHA19afc20a19db3d2a75b6915d8d9af602c5218735e
SHA256321058a27d7462e55e39d253ad5d8b19a9acf754666400f82fe0542f33e733c6
SHA512d9230901adeecb13b1f92287abe9317cdac458348885b96ef6500960793a7586c76ae374df053be948a35b44abe934aa853975a6ccd3788f93909903cc718c08
-
C:\Windows\Temp\MBInstallTempc2261da5ec8911eea6f35abeb01d5fe6\dbclspkg\MBAMCoreV5.dllFilesize
6.7MB
MD5b2763acfd7ac2ce596a4f3a930dd2a3f
SHA1ac18df54e4b64268e93b6e0af650d6cd8fe60274
SHA2563b8fdecc7155bbb62b1d76aa30f06bf079924bc794cf700f5d51ade13444d049
SHA51240b9f4bd1dc10034a5b18d3c0d2447a98aa6e4655d5d43b22aae83720e9eda8f818cf7febc0e8d0cd3b3f051805407a6112b66eb4fddd49ae2ca882a1aaa57b3
-
C:\Windows\Temp\MBInstallTempc2261da5ec8911eea6f35abeb01d5fe6\servicepkg\MBAMService.exeFilesize
8.5MB
MD51cf215acd0ff47d93dd5c503f7f096b5
SHA1cc905a2fa8caed90b1c53e84f2afa608296ae284
SHA256a84747e773dbc0a1c740bf6d531a147e37d4619ff260664bfca9947aca68c2b7
SHA512b26a267ce87123cbba59720d868f0ada8b2c9af56593473608e07811a0dc97537a961c5154e26a2a001e1b3a49545ddccdc86a5a4ab7867a1881df953762bdb0
-
C:\Windows\Temp\MBInstallTempc2261da5ec8911eea6f35abeb01d5fe6\servicepkg\mbamelam.catFilesize
10KB
MD560608328775d6acf03eaab38407e5b7c
SHA19f63644893517286753f63ad6d01bc8bfacf79b1
SHA2563ed5a1668713ef80c2b5599b599f1434ad6648999f335cf69757ea3183c70c59
SHA5129f65212121b8a5d1a0625c3baa14ef04a33b091d26f543324333e38dcdb903e02ccc4d009e22c2e85d2f61d954e0b994c2896e52f685003a6ef34758f8a650c7
-
C:\Windows\Temp\MBInstallTempc2261da5ec8911eea6f35abeb01d5fe6\servicepkg\mbamelam.infFilesize
2KB
MD5c481ad4dd1d91860335787aa61177932
SHA181633414c5bf5832a8584fb0740bc09596b9b66d
SHA256793626d240fd8eefc81b78a57c8dfe12ea247889b6f07918e9fd32a7411aa1c3
SHA512d292e028936412f07264837d4a321ecfa2f5754d4048c8bcf774a0e076e535b361c411301558609d64c71c1ce9b19e6041efa44d201237a7010c553751e1e830
-
C:\Windows\Temp\MBInstallTempc2261da5ec8911eea6f35abeb01d5fe6\servicepkg\mbamelam.sysFilesize
20KB
MD59e77c51e14fa9a323ee1635dc74ecc07
SHA1a78bde0bd73260ce7af9cdc441af9db54d1637c2
SHA256b5619d758ae6a65c1663f065e53e6b68a00511e7d7accb3e07ed94bfd0b1ede0
SHA512a12ccf92bead694f5d3cba7ff7e731a2f862198efc338efc7f33a882fe0eb7499fb3fb533538d0a823e80631a7ca162962fbdfd78e401e3255672910b7140186
-
C:\Windows\Temp\MBInstallTempc2261da5ec8911eea6f35abeb01d5fe6\servicepkg\mbshlext.dllFilesize
2.7MB
MD5b7e5071b317550d93258f7e1e13e7b6f
SHA12d08d78a5c29cf724bc523530d1a9014642bbc60
SHA256467de01d7cee7ec54166b80658ff22f9feebdb1c24eaf1629cf40e4124508064
SHA5129c35293c95c1a9141740ac99315605964aa37c4a42d3a11cae9e5649ff1427a9480d3d5e7f763212cf13db3511c5ea3c84e68f95f0067fe6339a9d3fb7b27c54
-
C:\Windows\Temp\MBInstallTempc2261da5ec8911eea6f35abeb01d5fe6\uipkg\QtQuick\Controls.2\HorizontalHeaderView.qmlFilesize
1KB
MD5d8c9674c0e9bddbd8aa59a9d343cf462
SHA1490aa022ac31ddce86d5b62f913b23fbb0de27c2
SHA2561ef333b5fb4d8075973f312ef787237240b9f49f3f9185fb21202883f900e7d7
SHA5120b86ec673133f6400c38b79f9ba4f7b37ce5afdab1a2e34acbf75019e2590cc26b26d323ddc1567c91375053c9c8593be0615389db8eb1a8d1eb084ad4200b82
-
C:\Windows\Temp\MBInstallTempc2261da5ec8911eea6f35abeb01d5fe6\uipkg\QtQuick\Controls.2\Imagine\VerticalHeaderView.qmlFilesize
1KB
MD5829769b2741d92df3c5d837eee64f297
SHA1f61c91436ca3420c4e9b94833839fd9c14024b69
SHA256489c02f8716e7a1de61834b3d8bbb61bce91ca4a33a6b62342b4c851d93e51e0
SHA5124061c271db37523b9dea9a9973226d91337e1809d4e7767e57ac938d35d77a302363ed92ab4be18c35ba589f528194ad71c93a8507449bf74dd035acf7cdb521
-
memory/736-4277-0x000002163A0E0000-0x000002163A469000-memory.dmpFilesize
3.5MB
-
memory/736-4460-0x000002163A0E0000-0x000002163A469000-memory.dmpFilesize
3.5MB
-
memory/736-4659-0x000002163A0E0000-0x000002163A469000-memory.dmpFilesize
3.5MB
-
memory/1140-4669-0x000001E6A7B00000-0x000001E6A7B02000-memory.dmpFilesize
8KB
-
memory/1140-4675-0x000001E6A7B20000-0x000001E6A7B22000-memory.dmpFilesize
8KB
-
memory/1140-4647-0x000001E6A7A30000-0x000001E6A7A32000-memory.dmpFilesize
8KB
-
memory/1140-4644-0x000001E6A7A20000-0x000001E6A7A22000-memory.dmpFilesize
8KB
-
memory/1140-4643-0x000001E6A7A10000-0x000001E6A7A11000-memory.dmpFilesize
4KB
-
memory/1140-4641-0x000001E6A7A10000-0x000001E6A7A11000-memory.dmpFilesize
4KB
-
memory/1140-4667-0x000001E6A7A20000-0x000001E6A7A22000-memory.dmpFilesize
8KB
-
memory/1140-4276-0x00007FFD5A9F0000-0x00007FFD5AE0E000-memory.dmpFilesize
4.1MB
-
memory/1140-4670-0x000001E6A7B00000-0x000001E6A7B02000-memory.dmpFilesize
8KB
-
memory/1140-4672-0x000001E6A7B10000-0x000001E6A7B12000-memory.dmpFilesize
8KB
-
memory/1140-4673-0x000001E6A7B10000-0x000001E6A7B12000-memory.dmpFilesize
8KB
-
memory/1140-4645-0x000001E6A7A20000-0x000001E6A7A22000-memory.dmpFilesize
8KB
-
memory/1140-4642-0x000001E6A7A10000-0x000001E6A7A11000-memory.dmpFilesize
4KB
-
memory/1140-4639-0x000001E6A7A10000-0x000001E6A7A11000-memory.dmpFilesize
4KB
-
memory/1140-4640-0x000001E6A7A10000-0x000001E6A7A11000-memory.dmpFilesize
4KB
-
memory/1140-4275-0x00007FFD59F50000-0x00007FFD5A4BB000-memory.dmpFilesize
5.4MB
-
memory/1140-4638-0x000001E6A7A10000-0x000001E6A7A11000-memory.dmpFilesize
4KB
-
memory/1140-4636-0x000001E6A7900000-0x000001E6A7901000-memory.dmpFilesize
4KB
-
memory/1140-4278-0x000001E6A71E0000-0x000001E6A71F0000-memory.dmpFilesize
64KB
-
memory/1140-4279-0x000001E6A7FD0000-0x000001E6A8410000-memory.dmpFilesize
4.2MB
-
memory/1140-4281-0x000001E6A8410000-0x000001E6A8610000-memory.dmpFilesize
2.0MB
-
memory/1140-4634-0x000001E6A7900000-0x000001E6A7901000-memory.dmpFilesize
4KB
-
memory/1140-4635-0x000001E6A7900000-0x000001E6A7901000-memory.dmpFilesize
4KB
-
memory/2848-5134-0x000001B35C010000-0x000001B35C011000-memory.dmpFilesize
4KB
-
memory/2848-5135-0x000001B35C010000-0x000001B35C011000-memory.dmpFilesize
4KB
-
memory/2848-5137-0x000001B35BDB0000-0x000001B35BDB1000-memory.dmpFilesize
4KB
-
memory/2848-5138-0x000001B35BDB0000-0x000001B35BDB1000-memory.dmpFilesize
4KB
-
memory/2848-5139-0x000001B35BDB0000-0x000001B35BDB1000-memory.dmpFilesize
4KB
-
memory/2848-5140-0x000001B35BDB0000-0x000001B35BDB1000-memory.dmpFilesize
4KB
-
memory/2848-5141-0x000001B35BDB0000-0x000001B35BDB1000-memory.dmpFilesize
4KB
-
memory/2848-5143-0x000001B35C010000-0x000001B35C011000-memory.dmpFilesize
4KB
-
memory/2848-5142-0x000001B35C010000-0x000001B35C011000-memory.dmpFilesize
4KB
-
memory/2848-5145-0x000001B35BDC0000-0x000001B35BDC1000-memory.dmpFilesize
4KB
-
memory/2848-5148-0x000001B35BDD0000-0x000001B35BDD2000-memory.dmpFilesize
8KB
-
memory/2848-5151-0x000001B35BDD0000-0x000001B35BDD2000-memory.dmpFilesize
8KB
-
memory/2848-5133-0x000001B35C010000-0x000001B35C011000-memory.dmpFilesize
4KB
-
memory/2848-5132-0x000001B35C010000-0x000001B35C011000-memory.dmpFilesize
4KB
-
memory/2848-4461-0x000001B3543C0000-0x000001B3543D0000-memory.dmpFilesize
64KB
-
memory/2848-4455-0x00007FFD59F50000-0x00007FFD5A4BB000-memory.dmpFilesize
5.4MB
-
memory/2848-4454-0x00007FF7A5E70000-0x00007FF7A7535000-memory.dmpFilesize
22.8MB
-
memory/2848-4456-0x00007FFD5A9F0000-0x00007FFD5AE0E000-memory.dmpFilesize
4.1MB
-
memory/2848-5131-0x000001B35C010000-0x000001B35C011000-memory.dmpFilesize
4KB
-
memory/2848-5130-0x000001B35C010000-0x000001B35C011000-memory.dmpFilesize
4KB
-
memory/2848-5129-0x000001B35C010000-0x000001B35C011000-memory.dmpFilesize
4KB
-
memory/2848-4717-0x000001B3543C0000-0x000001B3543D0000-memory.dmpFilesize
64KB