Resubmissions
Analysis
-
max time kernel
175s -
max time network
275s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 13:48
Behavioral task
behavioral1
Sample
Example.exe
Resource
win10v2004-20240426-en
General
-
Target
Example.exe
-
Size
72KB
-
MD5
769acadd308f5e635ba0f60255258d22
-
SHA1
5139323e6c04c0ac7ddafbce0d84a40dd0e22ff7
-
SHA256
adbabdf88158f3e792220225c4adfcc2365ebbc9944b3f889535c911395c6e32
-
SHA512
333aabaff89d67f5878392390519e4c8af0e6edf6d2ef52213c9c3ab9a712ab602f294e2f0cb8bd8426e17310d5850256f488463a558bafe232e302a88499ae0
-
SSDEEP
1536:IfEWlH3PB9hfNu13I2M/rOgmVU4JMb+KR0Nc8QsJq39:sEW5Rfc38/rCVte0Nc8QsC9
Malware Config
Extracted
metasploit
windows/reverse_http
http://89.197.154.116:7810/_n2FhQsri0qDbYJs5SL36gPEbqqjEMToTP1hIlmJ--o3hdWcF1UzdLme4PK4Jgp_xV4sF7-6Ax2hdDABs2pJ9fkDvKLjv4LgCu5HUw3s561jklwzdZhKfGS13lKNSRJC0Hm-48wy11TFYlbo8JPCAaH2Bvzyc52vBHt_LHZo2aZzbZ3
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
MBAMService.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe" MBAMService.exe -
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
MBSetup.exedescription pid process target process PID 5512 created 3548 5512 MBSetup.exe Explorer.EXE -
Downloads MZ/PE file
-
Drops file in Drivers directory 9 IoCs
Processes:
MBAMInstallerService.exeMBAMService.exeMBSetup.exeMBAMService.exedescription ioc process File created C:\Windows\system32\drivers\mbae64.sys MBAMInstallerService.exe File created C:\Windows\system32\DRIVERS\mbamswissarmy.sys MBAMService.exe File created C:\Windows\system32\DRIVERS\mwac.sys MBAMService.exe File created C:\Windows\system32\DRIVERS\farflt.sys MBAMService.exe File created C:\Windows\system32\DRIVERS\mbam.sys MBAMService.exe File created C:\Windows\SysWOW64\drivers\mbamtestfile.dat MBSetup.exe File opened for modification C:\Windows\system32\DRIVERS\MbamElam.sys MBAMService.exe File created C:\Windows\system32\DRIVERS\MbamChameleon.sys MBAMService.exe File created C:\Windows\system32\DRIVERS\MbamElam.sys MBAMService.exe -
Modifies RDP port number used by Windows 1 TTPs
-
Sets service image path in registry 2 TTPs 2 IoCs
Processes:
MBAMService.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MBAMSwissArmy\ImagePath = "\\SystemRoot\\System32\\Drivers\\mbamswissarmy.sys" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mbamchameleon\ImagePath = "\\SystemRoot\\System32\\Drivers\\MbamChameleon.sys" MBAMService.exe -
Checks BIOS information in registry 2 TTPs 6 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
mbupdatrV5.exeMBSetup.exeMBAMService.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion mbupdatrV5.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate mbupdatrV5.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion MBSetup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate MBSetup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion MBAMService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate MBAMService.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Malwarebytes.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation Malwarebytes.exe -
Executes dropped EXE 29 IoCs
Processes:
MBSetup.exeMBAMInstallerService.exeMBVpnTunnelService.exeMBAMService.exeMBAMService.exeMalwarebytes.exeig.exeig.exeig.exeig.exeig.exeig.exeig.exeig.exeig.exeig.exeig.exeig.exeig.exeig.exeig.exeig.exeig.exeig.exeMalwarebytes.exeMalwarebytes.exeMBAMWsc.exembupdatrV5.exeig.exepid process 5512 MBSetup.exe 5748 MBAMInstallerService.exe 5624 MBVpnTunnelService.exe 1692 MBAMService.exe 5268 MBAMService.exe 6612 Malwarebytes.exe 7148 ig.exe 7156 ig.exe 7164 ig.exe 5896 ig.exe 5604 ig.exe 5788 ig.exe 5908 ig.exe 3628 ig.exe 6120 ig.exe 3136 ig.exe 5332 ig.exe 3324 ig.exe 4732 ig.exe 4680 ig.exe 1264 ig.exe 4060 ig.exe 6124 ig.exe 3380 ig.exe 1192 Malwarebytes.exe 4176 Malwarebytes.exe 6100 MBAMWsc.exe 3568 mbupdatrV5.exe 396 ig.exe -
Loads dropped DLL 64 IoCs
Processes:
MBAMInstallerService.exeMBVpnTunnelService.exeMBAMService.exeMalwarebytes.exepid process 5748 MBAMInstallerService.exe 5748 MBAMInstallerService.exe 5748 MBAMInstallerService.exe 5624 MBVpnTunnelService.exe 5268 MBAMService.exe 5268 MBAMService.exe 5268 MBAMService.exe 5268 MBAMService.exe 5268 MBAMService.exe 5268 MBAMService.exe 5268 MBAMService.exe 5268 MBAMService.exe 5268 MBAMService.exe 5268 MBAMService.exe 5268 MBAMService.exe 5268 MBAMService.exe 5268 MBAMService.exe 5268 MBAMService.exe 5268 MBAMService.exe 5268 MBAMService.exe 5268 MBAMService.exe 5268 MBAMService.exe 5268 MBAMService.exe 5268 MBAMService.exe 5268 MBAMService.exe 5268 MBAMService.exe 5268 MBAMService.exe 5268 MBAMService.exe 5268 MBAMService.exe 5268 MBAMService.exe 5748 MBAMInstallerService.exe 5268 MBAMService.exe 5268 MBAMService.exe 5268 MBAMService.exe 5268 MBAMService.exe 5268 MBAMService.exe 6612 Malwarebytes.exe 6612 Malwarebytes.exe 6612 Malwarebytes.exe 6612 Malwarebytes.exe 6612 Malwarebytes.exe 6612 Malwarebytes.exe 6612 Malwarebytes.exe 6612 Malwarebytes.exe 6612 Malwarebytes.exe 6612 Malwarebytes.exe 6612 Malwarebytes.exe 6612 Malwarebytes.exe 6612 Malwarebytes.exe 6612 Malwarebytes.exe 6612 Malwarebytes.exe 6612 Malwarebytes.exe 6612 Malwarebytes.exe 6612 Malwarebytes.exe 6612 Malwarebytes.exe 6612 Malwarebytes.exe 6612 Malwarebytes.exe 6612 Malwarebytes.exe 6612 Malwarebytes.exe 6612 Malwarebytes.exe 6612 Malwarebytes.exe 6612 Malwarebytes.exe 6612 Malwarebytes.exe 6612 Malwarebytes.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Registers COM server for autorun 1 TTPs 64 IoCs
Processes:
MBAMService.exeMBAMService.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F36AD0D0-B5F0-4C69-AF08-603D177FEF0E}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{580243BF-3CEE-4131-A599-C6FED66BEB1B}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{251AD013-20AD-4C3F-8FE2-F66A429B4819}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{17BE78EE-B40A-4B9E-835F-38EC62F9D479}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36A65E46-6CC1-4CA2-B51E-F4DD8C993DDC}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{05098CD5-9914-48C2-A453-DB782F55A65F}\InProcServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F36AD0D0-B5F0-4C69-AF08-603D177FEF0E}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{278637DA-FDFB-45C7-8CD8-F2D8A9199AB0}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{251AD013-20AD-4C3F-8FE2-F66A429B4819}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE8A9269-9E6E-4683-BCD3-41E9B16696DC}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{03141A2A-5C3A-458E-ABEC-0812AD7FF497}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{278637DA-FDFB-45C7-8CD8-F2D8A9199AB0}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BF474111-9116-45C6-AF53-209E64F1BB53}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{03141A2A-5C3A-458E-ABEC-0812AD7FF497}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F6D29500-933C-447C-9D88-9D814AF73808}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E1AC7139-D1FF-4DE9-84A4-92E2B47F5D2A}\LocalServer32 MBAMService.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F36AD0D0-B5F0-4C69-AF08-603D177FEF0E}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F415899A-1576-4C8B-BC9F-4854781F8A20}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D5599B6B-FA0C-45B5-8309-853B003EA412}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{376BE474-56D4-4177-BB4E-5610156F36C8}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57CE581A-0CB6-4266-9CA0-19364C90A0B3}\InprocServer32\ = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbshlext.dll" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57CE581A-0CB6-4266-9CA0-19364C90A0B3}\InprocServer32\ThreadingModel = "Apartment" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{05098CD5-9914-48C2-A453-DB782F55A65F}\InProcServer32\ThreadingModel = "Both" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{11D1E5E8-14E1-4B5B-AE1A-2678CB91E8E5}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{580243BF-3CEE-4131-A599-C6FED66BEB1B}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F1C46F8-E697-4175-B240-CDE682A4BA2D}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D372F21-E6DA-4B82-881A-79F6CA6B6AE1}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D372F21-E6DA-4B82-881A-79F6CA6B6AE1}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E1AC7139-D1FF-4DE9-84A4-92E2B47F5D2A}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{580243BF-3CEE-4131-A599-C6FED66BEB1B}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F1C46F8-E697-4175-B240-CDE682A4BA2D}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{376BE474-56D4-4177-BB4E-5610156F36C8}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57CE581A-0CB6-4266-9CA0-19364C90A0B3}\InprocServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F36AD0D0-B5F0-4C69-AF08-603D177FEF0E}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36A65E46-6CC1-4CA2-B51E-F4DD8C993DDC}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F6D29500-933C-447C-9D88-9D814AF73808}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{11D1E5E8-14E1-4B5B-AE1A-2678CB91E8E5}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{130CD414-6BFD-4F6C-9362-A2264B222E76}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36A65E46-6CC1-4CA2-B51E-F4DD8C993DDC}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F415899A-1576-4C8B-BC9F-4854781F8A20}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F415899A-1576-4C8B-BC9F-4854781F8A20}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BF474111-9116-45C6-AF53-209E64F1BB53}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F6D29500-933C-447C-9D88-9D814AF73808}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DE03E614-112D-43E0-8E15-E7236CC32108}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BF474111-9116-45C6-AF53-209E64F1BB53}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE8A9269-9E6E-4683-BCD3-41E9B16696DC}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D5599B6B-FA0C-45B5-8309-853B003EA412}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9DAB0CA5-AE19-41AE-955C-41DD44C52697}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{130CD414-6BFD-4F6C-9362-A2264B222E76}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{03141A2A-5C3A-458E-ABEC-0812AD7FF497}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F1C46F8-E697-4175-B240-CDE682A4BA2D}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D372F21-E6DA-4B82-881A-79F6CA6B6AE1}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE8A9269-9E6E-4683-BCD3-41E9B16696DC}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DE03E614-112D-43E0-8E15-E7236CC32108}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{376BE474-56D4-4177-BB4E-5610156F36C8}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{05098CD5-9914-48C2-A453-DB782F55A65F}\InProcServer32\ = "C:\\PROGRAM FILES\\MALWAREBYTES\\ANTI-MALWARE\\mbamsi64.dll" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E1AC7139-D1FF-4DE9-84A4-92E2B47F5D2A}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{17BE78EE-B40A-4B9E-835F-38EC62F9D479}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{17BE78EE-B40A-4B9E-835F-38EC62F9D479}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D5599B6B-FA0C-45B5-8309-853B003EA412}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{278637DA-FDFB-45C7-8CD8-F2D8A9199AB0}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{11D1E5E8-14E1-4B5B-AE1A-2678CB91E8E5}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{251AD013-20AD-4C3F-8FE2-F66A429B4819}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{130CD414-6BFD-4F6C-9362-A2264B222E76}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
MBAMService.exeMBAMInstallerService.exedescription ioc process File opened (read-only) \??\R: MBAMService.exe File opened (read-only) \??\G: MBAMInstallerService.exe File opened (read-only) \??\Y: MBAMInstallerService.exe File opened (read-only) \??\A: MBAMService.exe File opened (read-only) \??\B: MBAMService.exe File opened (read-only) \??\H: MBAMService.exe File opened (read-only) \??\L: MBAMService.exe File opened (read-only) \??\M: MBAMService.exe File opened (read-only) \??\Z: MBAMInstallerService.exe File opened (read-only) \??\S: MBAMService.exe File opened (read-only) \??\T: MBAMService.exe File opened (read-only) \??\H: MBAMInstallerService.exe File opened (read-only) \??\P: MBAMInstallerService.exe File opened (read-only) \??\V: MBAMInstallerService.exe File opened (read-only) \??\Y: MBAMService.exe File opened (read-only) \??\E: MBAMInstallerService.exe File opened (read-only) \??\K: MBAMInstallerService.exe File opened (read-only) \??\E: MBAMService.exe File opened (read-only) \??\G: MBAMService.exe File opened (read-only) \??\J: MBAMService.exe File opened (read-only) \??\K: MBAMService.exe File opened (read-only) \??\N: MBAMService.exe File opened (read-only) \??\W: MBAMInstallerService.exe File opened (read-only) \??\U: MBAMInstallerService.exe File opened (read-only) \??\X: MBAMInstallerService.exe File opened (read-only) \??\I: MBAMService.exe File opened (read-only) \??\U: MBAMService.exe File opened (read-only) \??\X: MBAMService.exe File opened (read-only) \??\O: MBAMInstallerService.exe File opened (read-only) \??\T: MBAMInstallerService.exe File opened (read-only) \??\W: MBAMService.exe File opened (read-only) \??\B: MBAMInstallerService.exe File opened (read-only) \??\J: MBAMInstallerService.exe File opened (read-only) \??\L: MBAMInstallerService.exe File opened (read-only) \??\S: MBAMInstallerService.exe File opened (read-only) \??\O: MBAMService.exe File opened (read-only) \??\P: MBAMService.exe File opened (read-only) \??\Q: MBAMService.exe File opened (read-only) \??\A: MBAMInstallerService.exe File opened (read-only) \??\Q: MBAMInstallerService.exe File opened (read-only) \??\I: MBAMInstallerService.exe File opened (read-only) \??\V: MBAMService.exe File opened (read-only) \??\Z: MBAMService.exe File opened (read-only) \??\M: MBAMInstallerService.exe File opened (read-only) \??\N: MBAMInstallerService.exe File opened (read-only) \??\R: MBAMInstallerService.exe -
Drops file in System32 directory 64 IoCs
Processes:
MBVpnTunnelService.exeMBAMService.exeDrvInst.exedescription ioc process File created C:\Windows\System32\DriverStore\FileRepository\netmlx4eth63.inf_amd64_3809a4a3e7e07703\netmlx4eth63.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\rt640x64.inf_amd64_8984d8483eef476c\rt640x64.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\572BF21E454637C9F000BE1AF9B1E1A9 MBAMService.exe File created C:\Windows\System32\DriverStore\FileRepository\netimm.inf_amd64_8b2087393aaef952\netimm.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{eb95b397-ef37-b94a-9f61-ed4062a692e2}\mbtun.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{eb95b397-ef37-b94a-9f61-ed4062a692e2} DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\netwtw08.inf_amd64_7c0c516fb22456cd\netwtw08.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\net8192su64.inf_amd64_66c8bfc7a4b1feed\net8192su64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\mrvlpcie8897.inf_amd64_07fc330c5a5730ca\mrvlpcie8897.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netv1x64.inf_amd64_30040c3eb9d7ade4\netv1x64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netloop.inf_amd64_762588e32974f9e8\netloop.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netsstpa.inf_amd64_e76c5387d67e3fd6\netsstpa.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netl1c63x64.inf_amd64_4d6630ce07a4fb42\netl1c63x64.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Malwarebytes\Logs\MBAMSI.alt1.log MBAMService.exe File created C:\Windows\System32\DriverStore\FileRepository\usbnet.inf_amd64_9e6bb7a4b7338267\usbnet.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netr28x.inf_amd64_5d63c7bcbf29107f\netr28x.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{eb95b397-ef37-b94a-9f61-ed4062a692e2}\mbtun.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{eb95b397-ef37-b94a-9f61-ed4062a692e2}\mbtun.inf DrvInst.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_6E4F36431D86962EFD432400DF65AC90 MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141 MBAMService.exe File created C:\Windows\System32\DriverStore\FileRepository\net1ic64.inf_amd64_5f033e913d34d111\net1ic64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netnvm64.inf_amd64_35bbbe80dec15683\netnvm64.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{eb95b397-ef37-b94a-9f61-ed4062a692e2}\SET6935.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\netbc63a.inf_amd64_7ba6c9cea77dd549\netbc63a.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\rtwlanu_oldic.inf_amd64_1a82423cc076e882\rtwlanu_oldic.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netvwwanmp.inf_amd64_f9e30429669d7fff\netvwwanmp.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\mbtun.inf_amd64_add82795013a7c3b\mbtun.inf DrvInst.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_6E4F36431D86962EFD432400DF65AC90 MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\38D10539991D1B84467F968981C3969D_C92678066E2B4B4986BC7641EEC08637 MBAMService.exe File created C:\Windows\System32\DriverStore\FileRepository\net7500-x64-n650f.inf_amd64_cc87c915f33d1c27\net7500-x64-n650f.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netwew00.inf_amd64_325c0bd6349ed81c\netwew00.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netbxnda.inf_amd64_1fff3bc87a99b0f1\netbxnda.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netavpna.inf_amd64_f6f0831ba09dd9f5\netavpna.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\mwlu97w8x64.inf_amd64_23bc3dc6d91eebdc\mwlu97w8x64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\Temp\{eb95b397-ef37-b94a-9f61-ed4062a692e2}\SET6935.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{eb95b397-ef37-b94a-9f61-ed4062a692e2}\SET6964.tmp DrvInst.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\117308CCCD9C93758827D7CC85BB135E MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_56DB209C155B5A05FCBF555DF7E6D1BB MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_56DB209C155B5A05FCBF555DF7E6D1BB MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3E3E9689537B6B136ECF210088069D55_A925FAB5FFC3CEDB8E62B2DCCBBBB4F2 MBAMService.exe File created C:\Windows\System32\DriverStore\FileRepository\net8192se64.inf_amd64_167684f9283b4eca\net8192se64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netrtwlane01.inf_amd64_b02695ef070d7a42\netrtwlane01.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netax88772.inf_amd64_5d1c92f42d958529\netax88772.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\kdnic.inf_amd64_6649425cdcae9b5f\kdnic.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\bthpan.inf_amd64_b06c3bc32f7db374\bthpan.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\wceisvista.inf_amd64_07ad61d07466a58a\wceisvista.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3E3E9689537B6B136ECF210088069D55_EF6C9357BB54DDB629FD2D79F1594F95 MBAMService.exe File created C:\Windows\System32\DriverStore\FileRepository\netwew01.inf_amd64_153e01d761813df2\netwew01.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netjme.inf_amd64_752bf22f1598bb7e\netjme.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\usbncm.inf_amd64_9957a38c3d2283ed\usbncm.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3E3E9689537B6B136ECF210088069D55_A925FAB5FFC3CEDB8E62B2DCCBBBB4F2 MBAMService.exe File created C:\Windows\System32\DriverStore\FileRepository\netwtw04.inf_amd64_c8f5ae6576289a2d\netwtw04.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\net8185.inf_amd64_7a30f5a9441cd55b\net8185.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netrtwlane.inf_amd64_20caba88bd7f0bb3\netrtwlane.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{eb95b397-ef37-b94a-9f61-ed4062a692e2}\SET6975.tmp DrvInst.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\572BF21E454637C9F000BE1AF9B1E1A9 MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\FA0E447C3E79584EC91182C66BBD2DB7 MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_D2F6556190F7B1A25A117FFB5467EEBD MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_D2F6556190F7B1A25A117FFB5467EEBD MBAMService.exe File created C:\Windows\System32\DriverStore\FileRepository\netelx.inf_amd64_7812e4e45c4a5eb1\netelx.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netwlv64.inf_amd64_0b9818131664d91e\netwlv64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\bcmwdidhdpcie.inf_amd64_977dcc915465b0e9\bcmwdidhdpcie.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netathrx.inf_amd64_220db23f5419ea8d\netathrx.PNF MBVpnTunnelService.exe -
Drops file in Program Files directory 64 IoCs
Processes:
MBAMInstallerService.exeMBAMService.exedescription ioc process File created C:\Program Files\Malwarebytes\Anti-Malware\Actions.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\BrowserSDKDLL.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\pl\PresentationCore.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\pl\WindowsFormsIntegration.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\PresentationFramework-SystemXmlLinq.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\ja\ReachFramework.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\malwarebytes_assistant.runtimeconfig.json MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Net.ServicePoint.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\de\System.Windows.Controls.Ribbon.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\de\WindowsFormsIntegration.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\PresentationFramework-SystemCore.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\PresentationFramework.AeroLite.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\ru\System.Windows.Forms.Primitives.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\tr\UIAutomationClient.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\zh-Hant\System.Xaml.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Reflection.Emit.Lightweight.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\DirectWriteForwarder.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\fr\UIAutomationProvider.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\ActionsShim.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\sdk\farflt.tmf MBAMService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\Microsoft.DiaSymReader.Native.amd64.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Threading.Tasks.Extensions.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\de\UIAutomationTypes.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\Prism.Wpf.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\Serilog.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-file-l2-1-0.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Security.Cryptography.X509Certificates.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\System.Diagnostics.EventLog.Messages.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\System.Windows.Forms.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\ja\System.Windows.Forms.Primitives.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\Swissarmy.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\Serilog.Extensions.Logging.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\zh-Hant\UIAutomationTypes.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\PoliciesControllerImpl.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-private-l1-1-0.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.Serialization.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\de\System.Xaml.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Windows.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\ja\UIAutomationTypes.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\Microsoft.Win32.Registry.AccessControl.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\ru\UIAutomationClientSideProviders.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\tr\WindowsFormsIntegration.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-stdio-l1-1-0.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Dynamic.Runtime.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Security.Cryptography.Encoding.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\SwissarmyShim.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\Microsoft.EntityFrameworkCore.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\WindowsBase.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\it\System.Windows.Controls.Ribbon.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\System.Printing.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\zh-Hans\UIAutomationClient.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\SQLitePCLRaw.provider.e_sqlcipher.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\netstandard.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Reflection.DispatchProxy.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Reflection.Metadata.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\mbam.manifest.json MBAMInstallerService.exe File created C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\sdk\mbam.cat MBAMService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\zh-Hans\ReachFramework.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.tmf MBAMService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\sdk\mwac.inf MBAMService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-synch-l1-2-0.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\de\System.Windows.Forms.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\Microsoft.VisualBasic.Forms.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\System.Text.Json.dll MBAMInstallerService.exe -
Drops file in Windows directory 5 IoCs
Processes:
svchost.exeDrvInst.exeMBVpnTunnelService.exedescription ioc process File opened for modification C:\Windows\INF\setupapi.dev.log svchost.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\inf\oem3.inf DrvInst.exe File created C:\Windows\inf\oem3.inf DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log MBVpnTunnelService.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3484 3500 WerFault.exe Example.exe -
Checks SCSI registry key(s) 3 TTPs 26 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
svchost.exeDrvInst.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs DrvInst.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
MBAMService.exedescription ioc process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MBAMService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MBAMService.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Processes:
MBAMInstallerService.exeMBAMService.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION MBAMInstallerService.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Malwarebytes.exe = "11000" MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION MBAMService.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\mbam.exe = "11000" MBAMService.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\mbamtray.exe = "11000" MBAMService.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
MBAMInstallerService.exeDrvInst.exeMBAMService.exeMBAMWsc.exembupdatrV5.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:\ MBAMInstallerService.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:\ MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\15.0\Common\Security MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\15.0\Common MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root MBAMService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MBAMWsc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\15.0 MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT mbupdatrV5.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust MBAMService.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA mbupdatrV5.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs mbupdatrV5.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates MBAMService.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\15.0\Common\Security MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0 MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\16.0 MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\16.0\Common MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates MBAMService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MBAMWsc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\16.0 MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\15.0 MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Malwarebytes MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Malwarebytes MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed MBAMService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MBAMWsc.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:\ MBAMInstallerService.exe -
Modifies registry class 64 IoCs
Processes:
MBAMService.exeMalwarebytes.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E4BDE5F8-F8D4-4E50-937F-85E8382A9FEE} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D51C573D-B305-4980-8DFF-076C1878CCFB}\TypeLib\Version = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{25321640-5EF1-4095-A0DA-30DE19699441}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{983849D5-BFE9-43E9-A9A0-CBAFBC917F39}\ = "_ICleanControllerEventsV4" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6B2CCE9B-6446-450F-9C9D-542CD9FA6677}\TypeLib\Version = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{62A3C5F3-503F-4205-A044-5EA683BEDABE}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E1BA0B73-14BD-4C9D-98CA-99355BD4EB24}\TypeLib\ = "{2446F405-83F0-460F-B837-F04540BB330C}" MBAMService.exe Set value (int) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" Malwarebytes.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9DAB0CA5-AE19-41AE-955C-41DD44C52697}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EF7DFB76-BA49-4191-8B62-0AC3571C56D7} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{553B1C62-BE94-4CE0-8041-EB3BC1329D20}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F641DDA1-271F-47C7-90C2-4327665959DF} MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7196E77C-8EA5-4824-92C9-BAE8671149FA} MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{346CF9BC-3AD5-43BA-B348-EFB88F75360F}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1C5B86F3-CEB8-44E3-9B83-6F6AF035E872}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8153C0A7-AC17-452A-9388-358F782478D4}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3DCF0F42-EF8F-4450-BA68-42B61F594B2F}\TypeLib\ = "{226C1698-A075-4315-BB5D-9C164A96ACE7}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6696D5DD-4143-482C-ABF4-3B215CF3DBFC}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{834906DC-FA0F-4F61-BC62-24B0BEB3769C}\ = "_IRTPControllerEvents" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8C842243-BDAD-4A93-B282-93E3FCBC1CA4}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{553B1C62-BE94-4CE0-8041-EB3BC1329D20}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{115D004C-CC20-4945-BCC8-FE5043DD42D0}\ = "IScanControllerV7" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{55E4B8FB-921C-4751-8B2D-AE33BD7D0B74} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4163399F-AB08-4E5E-BE28-6B9440393AD3}\ = "IMWACControllerV13" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FFBD938D-3ABA-4895-97EF-5A0BDF7AC07D}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{239C7555-993F-4071-9081-D2AE0B590D63}\ = "IScanControllerEventsV6" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FC60FEE4-E373-4962-B548-BA2E06119D54}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3DCF0F42-EF8F-4450-BA68-42B61F594B2F}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B44D50B8-E459-4078-9249-3763459B2676}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E7DAEEB9-30B6-4AC4-BB74-7763C950D8EC}\ = "IMWACControllerEvents" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FFB94DF8-FC15-411C-B443-E937085E2AC1}\1.0\ = "RTPControllerCOMLib" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A9AE95CF-6463-415A-94AC-F895D0962D30}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5091804-600E-4226-BF28-80ABFDF4AFAB}\TypeLib\Version = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{172ABF99-1426-47CA-895B-092E23728E8A}\ProxyStubClsid32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{63A6AB57-4679-4529-B78D-143547B22799}\ProxyStubClsid32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0B14402F-4F35-443E-A34E-0F511098C644}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{983849D5-BFE9-43E9-A9A0-CBAFBC917F39}\TypeLib\Version = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FB586AB4-56F2-4EFA-9756-EE9A399B44DE} MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A993F934-6341-4D52-AB17-F93184A624E4}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{56898B37-6187-4F81-B9C6-8DA97D31F396}\ = "IScanControllerV16" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6ED2B0A1-984E-4A35-9B04-E0EBAFB2842A}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C0CEAFA7-4F65-418C-8A61-92B2048115EE}\ = "ICloudControllerV3" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1691A7E8-B8D1-46D5-BB29-3A4DB2D809C6}\ProxyStubClsid32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0DB6AD16-564C-451A-A173-0F31A62B7A4D}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{66328184-6592-46BE-B950-4FDA4417DF2E}\TypeLib\ = "{F5BCAC7E-75E7-4971-B3F3-B197A510F495}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AFC6D7FD-62B9-4016-9674-53BAC603E9FC}\ = "ITelemetryControllerV11" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F3968E6D-3FD5-4707-A5A8-4E8C3C042062}\ = "_IScanControllerEventsV12" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8E1F91DE-30AF-469B-9A09-FCF176207F0F}\TypeLib\ = "{FFB94DF8-FC15-411C-B443-E937085E2AC1}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C9669A3D-81E8-46F6-A51E-815A0863D612}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D372F21-E6DA-4B82-881A-79F6CA6B6AE1}\VersionIndependentProgID\ = "MB.PoliciesController" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BFC6C7E6-8475-4F9B-AC56-AD22BECF91C4}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{00A73BC0-754E-44E1-B190-D59E187A5EA1}\TypeLib\Version = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B1D8E799-D5A2-45B4-9524-067144A201E4}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{24F9231B-265E-4C66-B10B-D438EF1EB510}\ = "_IMWACControllerEventsV7" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A9D47FCC-ECEC-453C-9936-2CD0F16A8696}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FA484BC6-E101-4A87-AAF3-B468B3F2C6BB}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{36F3C7D7-BCB1-4359-AB71-0CB816FE3D38}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B3B24818-1CC9-4825-96A9-1DB596E079C8}\ = "_ILogControllerEvents" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C7BCC13C-47B9-4DC0-8FC6-B2A489EF60EF}\ = "IScanControllerV4" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3F967173-2B83-4B7F-A633-074B06FD0C64} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BF153224-DA64-41F1-AA87-321B345870FA}\ = "ICleanControllerEventsV8" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DB82CDC6-F12A-4156-8DBF-EC7465B9C0B9}\ProxyStubClsid32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BFC6C7E6-8475-4F9B-AC56-AD22BECF91C4}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C7BCC13C-47B9-4DC0-8FC6-B2A489EF60EF}\TypeLib\ = "{5709DEEB-F05E-4D5C-8DC4-3B0D924EE08F}" MBAMService.exe -
Processes:
MBAMService.exeMBAMInstallerService.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 5c0000000100000004000000001000001900000001000000100000009f687581f7ef744ecfc12b9cee6238f10f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa2140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a2040000000100000010000000be954f16012122448ca8bc279602acf52000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 MBAMService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8DA7F965EC5EFC37910F1C6E59FDC1CC6A6EDE16\Blob = 0300000001000000140000008da7f965ec5efc37910f1c6e59fdc1cc6a6ede162000000001000000450300003082034130820229a0030201020213066c9fcf99bf8c0a39e2f0788a43e696365bca300d06092a864886f70d01010b05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412031301e170d3135303532363030303030305a170d3338303131373030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f74204341203130820122300d06092a864886f70d01010105000382010f003082010a0282010100b2788071ca78d5e371af478050747d6ed8d78876f49968f7582160f97484012fac022d86d3a0437a4eb2a4d036ba01be8ddb48c80717364cf4ee8823c73eeb37f5b519f84968b0ded7b976381d619ea4fe8236a5e54a56e445e1f9fdb416fa74da9c9b35392ffab02050066c7ad080b2a6f9afec47198f503807dca2873958f8bad5a9f948673096ee94785e6f89a351c0308666a14566ba54eba3c391f948dcffd1e8302d7d2d747035d78824f79ec4596ebb738717f2324628b843fab71daacab4f29f240e2d4bf7715c5e69ffea9502cb388aae50386fdbfb2d621bc5c71e54e177e067c80f9c8723d63f40207f2080c4804c3e3b24268e04ae6c9ac8aa0d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604148418cc8534ecbc0c94942e08599cc7b2104e0a08300d06092a864886f70d01010b0500038201010098f2375a4190a11ac57651282036230eaee628bbaaf894ae48a4307f1bfc248d4bb4c8a197f6b6f17a70c85393cc0828e39825cf23a4f9de21d37c8509ad4e9a753ac20b6a897876444718656c8d418e3b7f9acbf4b5a750d7052c37e8034bade961a0026ef5f2f0c5b2ed5bb7dcfa945c779e13a57f52ad95f2f8933bde8b5c5bca5a525b60af14f74befa3fb9f40956d3154fc42d3c7461f23add90f48709ad9757871d1724334756e5759c2025c266029cf2319168e8843a5d4e4cb08fb231143e843297262a1a95d5e08d490aeb8d8ce14c2d055f286f6c49343776661c0b9e841d7977860036e4a72aea5d17dba109e866c1b8ab95933f8ebc490bef1b9 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\5A8CEF45D7A69859767A8C8B4496B578CF474B1A\Blob = 0300000001000000140000005a8cef45d7a69859767a8c8b4496b578cf474b1a2000000001000000450500003082054130820329a0030201020213066c9fd29635869f0a0fe58678f85b26bb8a37300d06092a864886f70d01010c05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412032301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f74204341203230820222300d06092a864886f70d01010105000382020f003082020a0282020100ad969f2d9c4a4c4a81795199ec8acb6b605113bc4d6d06fcb0088ddd19106ac7260c35d8c06f2084e994b19b8503c35bdb4ae8c8f89076d95b4fe34ce806364dcc9aac3d0c902b92d4061960ac374479858182ad5a37e00dcc9da64c5276ea439db704d150f655e0d5d2a64985e937e9ca7eae5c954d489a3fae205a6d8895d934b8521a4390b0bf6c05b9b678b7ead0e43a3c125362ff4af27bbe3505a91234e3f36474622c3d00495a28fe3244bb87dd652702713bda4af71fdacdf72155904f0fecae82e19f6bd945d3bbf05f87ed3c2c3986da3fdeec7255eb79a3addbdd7cb0ba1ccefcde4f3576cf0ff8781f6a36514627615be99ecff0a2557d7c258a6f2fb4c5cf842e2bfd0d51106cfb5f1bbc1b7ec5ae3b98013192ff0b57f49ab2b957e9abef0d76d1f0eef4ce86a7e06ee9b469a1df69f633c6692e97139ea587b057108137c953b3bb7ff692d19cd018f4926eda834fa663994ca5fb5eef21647a205f6c648515cb37e9620c0b2a16dc012e32da3e4bf59e3af6174094ef9e910886fabe63a85a33eccb744395f96c695236c7296ffc55035c1ffb9fbd47ebe74947950b4e89220949e0f5611ef1bf2e8a726e8059ff573af97532a34e5feced2862d94d73f2cc811760edcdebdcdba7cac57e02bdf2540854fdb42d092c17544a98d154e1516708d2ed6e7e6f3fd22d81592966cb903995111e7427feddebaf0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414b00cf04c30f405580248fd33e552af4b84e36652300d06092a864886f70d01010c05000382020100aaa8808f0e78a3e0a2d4cde6f5987a3bea0003b0970e93bc5aa8f62c8c7287a9b1fc7f73fd637178a58759cf30e10d10b2135a6d82f56ae6809fa0050b68e4476bc76adfb6fd773272e518fa09f4a0932c5dd28c75857665900c0379b7312363ad788309866884cafff9cf269a9279e7cd4bc5e761a717cbf3a91293936ba7e82f5392c46058b0cc0251185b858d625963b6adb4de9afb26f70027c05d55377499c9507fe3592e44e32c25eeec4c3277b49f1ae94b5d20c5dafd1c8716c643e8d4bb269a45705ea90b3753e2467b27fde046f289b7cc42b6cb28266ed9a5c93ac8411360f7508c15aeb26d1a151a5778e6922ad96590823f6c02afae123a27963604d71da28063a99bf1e5bab47c14b04ec9b11f745f38f651ea9bfa2ca211d4a92d271a45b1afb24e710dc05846d66906cb53cbb3fe6b41cd417e7d4c0f7c72797a59cd5e4a0eac9ba99873797cb4f4ccb9b8070cb2745cb8c76f88a190a7f4aaf9bf673af41a15621eb79fbe3db129af67a112f25810195303301bb81a89f69cbd97038ea309f31d8b21f1b4dfe41cd19f650206ea5cd613b384efa2a55c8c7729a768c06bae40d2a8b4eacdf08d4b389c199a1b2854b88990efca75813e1ef26424c718af4eff479e07f63565a4d30a56fff517646cefa822254993b6df0017da587e5deec51bb0d1d15f2110c7f9f3ba020a2707c5f1d6c7d3e0fb09606c MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F6108407D6F8BB67980CC2E244C2EBAE1CEF63BE MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0D44DD8C3C8C1A1A58756481E90F2E2AFFB3D26E\Blob = 0300000001000000140000000d44dd8c3c8c1a1a58756481e90f2e2affb3d26e2000000001000000ba010000308201b63082015ba0030201020213066c9fd5749736663f3b0b9ad9e89e7603f24a300a06082a8648ce3d0403023039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412033301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f7420434120333059301306072a8648ce3d020106082a8648ce3d030107034200042997a7c6417fc00d9be8011b56c6f252a5ba2db212e8d22ed7fac9c5d8aa6d1f73813b3b986b397c33a5c54e868e8017686245577d44581db337e56708eb66dea3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414abb6dbd7069e37ac3086079170c79cc419b178c0300a06082a8648ce3d0403020349003046022100e08592a317b78df92b06a593ac1a98686172fae1a1d0fb1c7860a64399c5b8c40221009c02eff1949cb396f9ebc62af8b62cfe3a901416d78c6324481cdf307dd5683b MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\2AD974A775F73CBDBBD8F5AC3A49255FA8FB1F8C MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa22000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8DA7F965EC5EFC37910F1C6E59FDC1CC6A6EDE16 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\2AD974A775F73CBDBBD8F5AC3A49255FA8FB1F8C\Blob = 0300000001000000140000002ad974a775f73cbdbbd8f5ac3a49255fa8fb1f8c2000000001000000620400003082045e30820346a0030201020213077312380b9d6688a33b1ed9bf9ccda68e0e0f300d06092a864886f70d01010b05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412031301e170d3232303832333232323132385a170d3330303832333232323132385a303c310b3009060355040613025553310f300d060355040a1306416d617a6f6e311c301a06035504031313416d617a6f6e205253412032303438204d303130820122300d06092a864886f70d01010105000382010f003082010a0282010100eb712ca9cb1f8828923230af8a570f78b73725955587ac675c97d322c8daa214676b7cf067dae2032ab356125dc6b547f96708a7937a9592180fb4f9f910369a7f2f80b64fba134ec75d531ee0dd96330720d396bc12e4745042a1051373b54f9b4424fe2d7fedbc2285ec362133977506ce271882dce3d9c582078d5e26012626671fd93f13cf32ba6bad7864fcaaff0e023c07df9c0578728cfdea75b7032884dae86e078cd05085ef8154b2716eec6d62ef8f94c35ee9c4a4d091c02e249198caeeba258ed4f671b6fb5b6b38064837478d86dcf2ea06fb76377d9eff424e4d588293cfe271c278b17aab4b5b94378881e4d9af24aef872c565fb4bb451e70203010001a382015a3082015630120603551d130101ff040830060101ff020100300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030106082b06010505070302301d0603551d0e0416041481b80e638a891218e5fa3b3b50959fe6e5901385301f0603551d230418301680148418cc8534ecbc0c94942e08599cc7b2104e0a08307b06082b06010505070101046f306d302f06082b060105050730018623687474703a2f2f6f6373702e726f6f746361312e616d617a6f6e74727573742e636f6d303a06082b06010505073002862e687474703a2f2f6372742e726f6f746361312e616d617a6f6e74727573742e636f6d2f726f6f746361312e636572303f0603551d1f043830363034a032a030862e687474703a2f2f63726c2e726f6f746361312e616d617a6f6e74727573742e636f6d2f726f6f746361312e63726c30130603551d20040c300a3008060667810c010201300d06092a864886f70d01010b05000382010100ad00de0205232e063262b46bb19416e41140de2bfa59c135efe0aa8f2b41b9d1f38739001df23db5a7470c0606c691f3075702d4edbd17c1909abf4875a2074f30dd4a6a42b50d3d15c00ffe845bc63c99cc5752b1d86e12d59692934b94e507e88982086a7a34d49e64e13d876a92909a63a14bf88fb6ea34d305be20c2de06e28c9f738b9f4d3985cace19369d85c99ec9f8503fb67e88a1efca84068b50b40a5ca61c44f1fdc8614060f26125aa07f4c7c27375e40c0b428d04e55f4448995b7b898196a7889d4b0d62e804c4d7feb4e8b26dcaecc01cbc385b1ddf85ce5b7ae3494b6cb9a7ddf405b249ade1c5146bc2ccebcd7fd65869bac3207e7fb0b8 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2 MBAMService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E\Blob = 030000000100000014000000b51c067cee2b0c3df855ab2d92f4fe39d4e70f0e2000000001000000e1030000308203dd308202c5a003020102020100300d06092a864886f70d01010b050030818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a30818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bdedc103fcf68ffc02b16f5b9f48d99d79e2a2b703615618c347b6d7ca3d352e8943f7a1699bde8a1afd13209cb44977322956fdb9ec8cdd22fa72dc276197eef65a84ec6e19b9892cdc845bd574fb6b5fc589a51052894655f4b8751ce67fe454ae4bf85572570219f8177159eb1e280774c59d48be6cb4f4a4b0f364377992c0ec465e7fe16d534c62afcd1f0b63bb3a9dfbfc7900986174cf26824063f3b2726a190d99cad40e75cc37fb8b89c159f1627f5fb35f6530f8a7b74d765a1e765e34c0e89656998ab3f07fa4cdbddc32317c91cfe05f11f86baa495cd19994d1a2e3635b0976b55662e14b741d96d426d4080459d0980e0ee6defcc3ec1f90f10203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147c0c321fa7d9307fc47d68a362a8a1ceab075b27300d06092a864886f70d01010b050003820101001159fa254f036f94993b9a1f828539d47605945ee128936d625d09c2a0a8d4b07538f1346a9de49f8a862651e62cd1c62d6e95204a9201ecb88a677b31e2672e8c9503262e439d4a31f60eb50cbbb7e2377f22ba00a30e7b52fb6bbb3bc4d379514ecd90f4670719c83c467a0d017dc558e76de68530179a24c410e004f7e0f27fd4aa0aff421d37ed94e5645912207738d3323e3881759673fa688fb1cbce1fc5ecfa9c7ecf7eb1f1072db6fcbfcaa4bfd097054abcea18280290bd5478092171d3d17d1dd916b0a9613dd00a0022fcc77bcb0964450b3b4081f77d7c32f598ca588e7d2aee90597364f936745e25a1f566052e7f3915a92afb508b8e8569f4 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F6108407D6F8BB67980CC2E244C2EBAE1CEF63BE\Blob = 030000000100000014000000f6108407d6f8bb67980cc2e244c2ebae1cef63be2000000001000000f6010000308201f230820178a0030201020213066c9fd7c1bb104c2943e5717b7b2cc81ac10e300a06082a8648ce3d0403033039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412034301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f7420434120343076301006072a8648ce3d020106052b8104002203620004d2ab8a374fa3530dfec18a7b4ba87b464b63b062f62d1bdb087121d200e863bd9a27fbf0396e5dea3da5c981aaa35b2098455d16dbfde8106de39ce0e3bd5f8462f3706433a0cb242f70ba88a12aa075f881ae6206c481db396e29b01efa2e5ca3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414d3ecc73a656ecce1da769a56fb9cf3866d57e581300a06082a8648ce3d040303036800306502303a8b21f1bd7e11add0ef58962fd6eb9d7e908d2bcf6655c32ce328a9700a470ef0375912ff2d9994284e2a4f354d335a023100ea75004e3bc43a941291c958469d211372a7889c8ae44c4adb96d4ac8b6b6b49125333add7e4be24fcb50a76d4a5bc10 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\1C58A3A8518E8759BF075B76B750D4F2DF264FCD MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\1C58A3A8518E8759BF075B76B750D4F2DF264FCD\Blob = 0300000001000000140000001c58a3a8518e8759bf075b76b750d4f2df264fcd2000000001000000c2040000308204be308203a6a003020102021006d8d904d5584346f68a2fa754227ec4300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3231303431343030303030305a170d3331303431333233353935395a304f310b300906035504061302555331153013060355040a130c446967694365727420496e633129302706035504031320446967694365727420544c53205253412053484132353620323032302043413130820122300d06092a864886f70d01010105000382010f003082010a0282010100c14bb3654770bcdd4f58dbec9cedc366e51f311354ad4a66461f2c0aec6407e52edcdcb90a20eddfe3c4d09e9aa97a1d8288e51156db1e9f58c251e72c340d2ed292e156cbf1795fb3bb87ca25037b9a52416610604f571349f0e8376783dfe7d34b674c2251a6df0e9910ed57517426e27dc7ca622e131b7f238825536fc13458008b84fff8bea75849227b96ada2889b15bca07cdfe951a8d5b0ed37e236b4824b62b5499aecc767d6e33ef5e3d6125e44f1bf71427d58840380b18101faf9ca32bbb48e278727c52b74d4a8d697dec364f9cace53a256bc78178e490329aefb494fa415b9cef25c19576d6b79a72ba2272013b5d03d40d321300793ea99f50203010001a38201823082017e30120603551d130101ff040830060101ff020100301d0603551d0e04160414b76ba2eaa8aa848c79eab4da0f98b2c59576b9f4301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030106082b06010505070302307606082b06010505070101046a3068302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304006082b060105050730028634687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274476c6f62616c526f6f7443412e63727430420603551d1f043b30393037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274476c6f62616c526f6f7443412e63726c303d0603551d2004363034300b06096086480186fd6c02013007060567810c01013008060667810c0102013008060667810c0102023008060667810c010203300d06092a864886f70d01010b050003820101008032ce5e0bdd6e5a0d0aafe1d684cbc08efa8570edda5db30cf72b7540fe850afaf33178b7704b1a8958ba80bdf36b1de97ecf0bba589c59d490d3fd6cfdd0986db771825bcf6d0b5a09d07bdec443d82aa4de9e41265fbb8f99cbddaee1a86f9f87fe74b71f1b20abb14fc6f5675d5d9b3ce9ff69f7616cd6d9f3fd36c6ab038876d24b2e7586e3fcd8557d26c21177df3e02b67cf3ab7b7a86366fb8f7d89371cf86df7330fa7babed2a59c842843b11171a52f3c90e147da25b7267ba71ed574766c5b8024a65345e8bd02a3c209c51994ce7529ef76b112b0d927e1de88aeb36164387ea2a63bf753febdec403bb0a3cf730efebaf4cfc8b3610733ef3a4 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 040000000100000010000000be954f16012122448ca8bc279602acf5140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a2030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa20f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e1900000001000000100000009f687581f7ef744ecfc12b9cee6238f12000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\5A8CEF45D7A69859767A8C8B4496B578CF474B1A MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0D44DD8C3C8C1A1A58756481E90F2E2AFFB3D26E MBAMInstallerService.exe -
NTFS ADS 2 IoCs
Processes:
msedge.exeMBAMInstallerService.exedescription ioc process File opened for modification C:\Users\Admin\Downloads\Unconfirmed 976616.crdownload:SmartScreen msedge.exe File created C:\Program Files\Malwarebytes\Anti-Malware\mbuns.exe\:SmartScreen:$DATA MBAMInstallerService.exe -
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc stream HTTP User-Agent header 199 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) 1 -
Suspicious behavior: EnumeratesProcesses 52 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exeMBSetup.exeMBAMInstallerService.exeMBAMService.exeMalwarebytes.exepid process 3028 msedge.exe 3028 msedge.exe 4868 msedge.exe 4868 msedge.exe 400 identity_helper.exe 400 identity_helper.exe 3160 msedge.exe 3160 msedge.exe 5252 msedge.exe 5252 msedge.exe 5512 MBSetup.exe 5512 MBSetup.exe 5748 MBAMInstallerService.exe 5748 MBAMInstallerService.exe 5748 MBAMInstallerService.exe 5748 MBAMInstallerService.exe 5748 MBAMInstallerService.exe 5748 MBAMInstallerService.exe 5748 MBAMInstallerService.exe 5748 MBAMInstallerService.exe 5268 MBAMService.exe 5268 MBAMService.exe 5268 MBAMService.exe 5268 MBAMService.exe 5268 MBAMService.exe 5268 MBAMService.exe 5268 MBAMService.exe 5268 MBAMService.exe 5268 MBAMService.exe 5268 MBAMService.exe 5268 MBAMService.exe 5268 MBAMService.exe 5268 MBAMService.exe 5268 MBAMService.exe 6612 Malwarebytes.exe 6612 Malwarebytes.exe 5268 MBAMService.exe 5268 MBAMService.exe 5268 MBAMService.exe 5268 MBAMService.exe 5268 MBAMService.exe 5268 MBAMService.exe 5268 MBAMService.exe 5268 MBAMService.exe 5268 MBAMService.exe 5268 MBAMService.exe 5268 MBAMService.exe 5268 MBAMService.exe 5268 MBAMService.exe 5268 MBAMService.exe 5268 MBAMService.exe 5268 MBAMService.exe -
Suspicious behavior: LoadsDriver 14 IoCs
Processes:
pid process 660 660 660 660 660 660 660 660 660 660 660 660 660 660 -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
Processes:
msedge.exepid process 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
svchost.exeMBAMService.exeMBAMService.exedescription pid process Token: SeAuditPrivilege 5432 svchost.exe Token: SeSecurityPrivilege 5432 svchost.exe Token: 33 1692 MBAMService.exe Token: SeIncBasePriorityPrivilege 1692 MBAMService.exe Token: 33 5268 MBAMService.exe Token: SeIncBasePriorityPrivilege 5268 MBAMService.exe Token: SeBackupPrivilege 5268 MBAMService.exe Token: SeRestorePrivilege 5268 MBAMService.exe Token: SeTakeOwnershipPrivilege 5268 MBAMService.exe Token: SeDebugPrivilege 5268 MBAMService.exe Token: SeBackupPrivilege 5268 MBAMService.exe Token: SeRestorePrivilege 5268 MBAMService.exe Token: SeTakeOwnershipPrivilege 5268 MBAMService.exe Token: SeSecurityPrivilege 5268 MBAMService.exe Token: SeDebugPrivilege 5268 MBAMService.exe Token: SeDebugPrivilege 5268 MBAMService.exe Token: SeDebugPrivilege 5268 MBAMService.exe Token: SeDebugPrivilege 5268 MBAMService.exe Token: SeDebugPrivilege 5268 MBAMService.exe Token: SeDebugPrivilege 5268 MBAMService.exe Token: SeDebugPrivilege 5268 MBAMService.exe Token: SeDebugPrivilege 5268 MBAMService.exe Token: SeDebugPrivilege 5268 MBAMService.exe Token: SeDebugPrivilege 5268 MBAMService.exe Token: SeDebugPrivilege 5268 MBAMService.exe Token: SeDebugPrivilege 5268 MBAMService.exe Token: SeDebugPrivilege 5268 MBAMService.exe Token: SeDebugPrivilege 5268 MBAMService.exe Token: SeDebugPrivilege 5268 MBAMService.exe Token: SeDebugPrivilege 5268 MBAMService.exe Token: SeDebugPrivilege 5268 MBAMService.exe Token: SeDebugPrivilege 5268 MBAMService.exe Token: SeDebugPrivilege 5268 MBAMService.exe Token: SeDebugPrivilege 5268 MBAMService.exe Token: SeDebugPrivilege 5268 MBAMService.exe Token: SeDebugPrivilege 5268 MBAMService.exe Token: SeDebugPrivilege 5268 MBAMService.exe Token: SeDebugPrivilege 5268 MBAMService.exe Token: SeDebugPrivilege 5268 MBAMService.exe Token: SeDebugPrivilege 5268 MBAMService.exe Token: SeDebugPrivilege 5268 MBAMService.exe Token: SeDebugPrivilege 5268 MBAMService.exe Token: SeDebugPrivilege 5268 MBAMService.exe Token: SeDebugPrivilege 5268 MBAMService.exe Token: SeDebugPrivilege 5268 MBAMService.exe Token: SeDebugPrivilege 5268 MBAMService.exe Token: SeDebugPrivilege 5268 MBAMService.exe Token: SeDebugPrivilege 5268 MBAMService.exe Token: SeDebugPrivilege 5268 MBAMService.exe Token: SeDebugPrivilege 5268 MBAMService.exe Token: SeDebugPrivilege 5268 MBAMService.exe Token: SeDebugPrivilege 5268 MBAMService.exe Token: SeDebugPrivilege 5268 MBAMService.exe Token: SeDebugPrivilege 5268 MBAMService.exe Token: SeDebugPrivilege 5268 MBAMService.exe Token: SeDebugPrivilege 5268 MBAMService.exe Token: SeDebugPrivilege 5268 MBAMService.exe Token: SeDebugPrivilege 5268 MBAMService.exe Token: SeDebugPrivilege 5268 MBAMService.exe Token: SeDebugPrivilege 5268 MBAMService.exe Token: SeDebugPrivilege 5268 MBAMService.exe Token: SeDebugPrivilege 5268 MBAMService.exe Token: SeDebugPrivilege 5268 MBAMService.exe Token: SeDebugPrivilege 5268 MBAMService.exe -
Suspicious use of FindShellTrayWindow 62 IoCs
Processes:
msedge.exeMBSetup.exeMalwarebytes.exepid process 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 5512 MBSetup.exe 4868 msedge.exe 6612 Malwarebytes.exe 6612 Malwarebytes.exe 6612 Malwarebytes.exe 6612 Malwarebytes.exe 6612 Malwarebytes.exe 6612 Malwarebytes.exe 6612 Malwarebytes.exe 6612 Malwarebytes.exe 6612 Malwarebytes.exe 6612 Malwarebytes.exe 6612 Malwarebytes.exe 6612 Malwarebytes.exe 6612 Malwarebytes.exe 6612 Malwarebytes.exe 6612 Malwarebytes.exe 6612 Malwarebytes.exe 6612 Malwarebytes.exe 6612 Malwarebytes.exe 6612 Malwarebytes.exe 6612 Malwarebytes.exe 6612 Malwarebytes.exe 6612 Malwarebytes.exe 6612 Malwarebytes.exe -
Suspicious use of SendNotifyMessage 41 IoCs
Processes:
msedge.exeMalwarebytes.exepid process 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 6612 Malwarebytes.exe 6612 Malwarebytes.exe 6612 Malwarebytes.exe 6612 Malwarebytes.exe 6612 Malwarebytes.exe 6612 Malwarebytes.exe 6612 Malwarebytes.exe 6612 Malwarebytes.exe 6612 Malwarebytes.exe 6612 Malwarebytes.exe 6612 Malwarebytes.exe 6612 Malwarebytes.exe 6612 Malwarebytes.exe 6612 Malwarebytes.exe 6612 Malwarebytes.exe 6612 Malwarebytes.exe 6612 Malwarebytes.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Malwarebytes.exepid process 6612 Malwarebytes.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 4868 wrote to memory of 4400 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 4400 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 864 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 864 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 864 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 864 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 864 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 864 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 864 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 864 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 864 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 864 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 864 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 864 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 864 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 864 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 864 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 864 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 864 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 864 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 864 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 864 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 864 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 864 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 864 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 864 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 864 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 864 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 864 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 864 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 864 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 864 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 864 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 864 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 864 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 864 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 864 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 864 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 864 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 864 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 864 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 864 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 3028 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 3028 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 4476 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 4476 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 4476 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 4476 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 4476 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 4476 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 4476 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 4476 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 4476 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 4476 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 4476 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 4476 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 4476 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 4476 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 4476 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 4476 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 4476 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 4476 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 4476 4868 msedge.exe msedge.exe PID 4868 wrote to memory of 4476 4868 msedge.exe msedge.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\Example.exe"C:\Users\Admin\AppData\Local\Temp\Example.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3500 -s 11003⤵
- Program crash
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default2⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd51af46f8,0x7ffd51af4708,0x7ffd51af47183⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,2985056007841598119,2860703585332390494,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:23⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,2985056007841598119,2860703585332390494,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,2985056007841598119,2860703585332390494,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2985056007841598119,2860703585332390494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2985056007841598119,2860703585332390494,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2985056007841598119,2860703585332390494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4072 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2985056007841598119,2860703585332390494,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4656 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,2985056007841598119,2860703585332390494,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4972 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,2985056007841598119,2860703585332390494,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4972 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2985056007841598119,2860703585332390494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3548 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2985056007841598119,2860703585332390494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2985056007841598119,2860703585332390494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2985056007841598119,2860703585332390494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2128,2985056007841598119,2860703585332390494,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5544 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2128,2985056007841598119,2860703585332390494,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5536 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2985056007841598119,2860703585332390494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2128,2985056007841598119,2860703585332390494,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6068 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,2985056007841598119,2860703585332390494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6056 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2128,2985056007841598119,2860703585332390494,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6296 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2128,2985056007841598119,2860703585332390494,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6564 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\Downloads\MBSetup.exe"C:\Users\Admin\Downloads\MBSetup.exe"3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Checks BIOS information in registry
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe"C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe"2⤵
- Executes dropped EXE
-
C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe"C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe"3⤵
- Executes dropped EXE
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Malwarebytes Scan Report 2024-05-24 135033.txt2⤵
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Malwarebytes Scan Report 2024-05-24 135120.txt2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3500 -ip 35001⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies system certificate store
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe" /installmbtun2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe" /Service /Protected2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Registers COM server for autorun
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "9" "C:\Program Files\Malwarebytes\Anti-Malware\mbtun\mbtun.inf" "9" "4ba9030c7" "0000000000000148" "Service-0x0-3e7$\Default" "0000000000000158" "208" "C:\Program Files\Malwarebytes\Anti-Malware\mbtun"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"1⤵
- Modifies WinLogon for persistence
- Drops file in Drivers directory
- Sets service image path in registry
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe"C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe" nowindow2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
- Executes dropped EXE
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
- Executes dropped EXE
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
- Executes dropped EXE
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
- Executes dropped EXE
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
- Executes dropped EXE
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
- Executes dropped EXE
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
- Executes dropped EXE
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
- Executes dropped EXE
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
- Executes dropped EXE
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
- Executes dropped EXE
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
- Executes dropped EXE
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
- Executes dropped EXE
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
- Executes dropped EXE
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
- Executes dropped EXE
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
- Executes dropped EXE
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
- Executes dropped EXE
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
- Executes dropped EXE
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
- Executes dropped EXE
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMWsc.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMWsc.exe" /wac 0 /status on true /updatesubstatus none /scansubstatus none /settingssubstatus none2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\updatrpkg\mbupdatrV5.exe"C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\updatrpkg\mbupdatrV5.exe" "C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE" "C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\config\UpdateControllerConfig.json" "C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE" "C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\dbclsupdate\staging" /db:dbupdate /su:no2⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Modifies data under HKEY_USERS
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\LocalLow\IGDump\neuxfnhlkormbfqqxwkuddapdjvvyupq\ig.exeig.exe timer 4000 sshtorobjiefuakwxjgqwrygfaygaqhj.ext2⤵
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Defense Evasion
Modify Registry
4Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\LicenseControllerImpl.dllFilesize
4.8MB
MD50ea9e23809dada42b3fee0210d8c7907
SHA1a468e990f09610226170edb07ae0e3839abff4e5
SHA25660d1140904e0e8b19c1d2812fe80e3b7e2e071dd4a1b27647bc6dd94bdfa51bc
SHA512b0d5e6f7e84f1209df2adbaa238e6497980a3a44a10de8b6dc38f81d84b8376b85e3582854cf4887d2459bb3590dd555e2f6cb7cdf3f0d43a4f4093175f4f2cb
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\PoliciesControllerImpl.dllFilesize
4.2MB
MD580202b21a6f3df9d0d54f20a381df93c
SHA16915dcc75d0b84e5db40656d6382cb217a1996c2
SHA2564217a62ea3df3bd98e40d205b4fb5f9673c340c366551adb771ff3e34e7bdcfc
SHA5128d691deae1f7c5243d045940f7f728a874e72550859b291119c9b951bd95232980dc2a1b3c19154c723c42e0aa93747a046f747bbc305941594477a39c2925f1
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\UpdateControllerImpl.dllFilesize
4.3MB
MD56867cbf4557635aca16ac6fba455e82c
SHA141994b5169762474d9febff66ed3ece998f691ca
SHA25626de9b9f28927dcc71c40ba623a77a7b47bace9d749d06a1b3e229e296513846
SHA51224fd41344211e1c95c44a4338c33e0d6c734107757694e3b59773c574ac424cd030bf37fd08fec2824e3111a52c5288bf8dd8a8900457b8749246142d019de74
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\clean.mbdbFilesize
12KB
MD51b72bfcf3ae80509713e957b3f950be4
SHA1a7c0f7bb9101c475673acf718c8aa1574416befa
SHA256bfc85dbf2dfee4e1fd388e0b9a4ddd45c55581e23e62504a97283104e470b278
SHA512f069f188b025b817758b814e7df917211acfb086877992f31f1cdec3da101920bdee5dbb9a3e999c80ab73b33bdd002df2c46bdf96a8f4e71aa9fba30e70df49
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\dbmanifest2.datFilesize
924B
MD5b5d686f0109b4da06fd619f40cab2684
SHA1ce8791415e5baf73594a15a234da49b4575a0ee0
SHA256f374d3ae3bc5e292d92b84ae1b4b5345d613276b44e6b76eb71dcf4a7371b0b9
SHA512760910c9cec91239af7dc959f82b441aedfef153f8ce566e8642d93ae9f9254dfed585fc2c29a6cde68def0b4c845138113d1f2a9cd857e50789ed73abe6e871
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\dynconfig.datFilesize
39KB
MD510f23e7c8c791b91c86cd966d67b7bc7
SHA13f596093b2bc33f7a2554818f8e41adbbd101961
SHA256008254ca1f4d6415da89d01a4292911de6135b42833156720a841a22685765dc
SHA5122d1b21371ada038323be412945994d030ee8a9007db072484724616c8597c6998a560bc28886ebf89e2c8919fb70d76c98338d88832351823027491c98d48118
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\exclusions.txtFilesize
23KB
MD5aef4eca7ee01bb1a146751c4d0510d2d
SHA15cf2273da41147126e5e1eabd3182f19304eea25
SHA2569e87e4c9da3337c63b7f0e6ed0eb71696121c74e18a5da577215e18097715e2f
SHA512d31d21e37b0048050b19600f8904354cff3f3ec8291c5a7a54267e14af9fb88dfb6d11e74a037cc0369ade8a8fb9b753861f3b3fb2219563e8ec359f66c042db
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\mbdigsig2.datFilesize
514B
MD5bd6d9bb58b8581fc95fef454475c2788
SHA1fd69008d87820353475fe49f31f9e52591e8e5f5
SHA256656ef0611cb8c8524151eee0990355c2af122f2809c8307113283ac263a88ca6
SHA51258891804707415c99438b5c2aa668c67d44922187c7f4072afd773e2dde8aaa0fd8ab129b23af3c9ebae670f66621e308ce8058aa74038d6cb15bbd614510898
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\prot.mbdbFilesize
24B
MD5546d9e30eadad8b22f5b3ffa875144bf
SHA13b323ffef009bfe0662c2bd30bb06af6dfc68e4d
SHA2566089fbf0c0c1413f62e91dc9497bedc6d8a271e9dc761e20adc0dccf6f4a0c1f
SHA5123478f5dcf7af549dd6fe48ad714604200de84a90120b16a32233b6d44fa7240f5f4e5fe803f54b86bbdfd10fa1bfdd88fb85eb6a78e23e426933f98d0a2565ec
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\rdefs.mbdbFilesize
24B
MD52f7423ca7c6a0f1339980f3c8c7de9f8
SHA1102c77faa28885354cfe6725d987bc23bc7108ba
SHA256850a4ea37a0fd6f68bf95422d502b2d1257264eb90cc38c0a3b1b95aa375be55
SHA512e922ac8a7a2cde6d387f8698207cf5efbd45b646986a090e3549d97a7d552dd74179bd7ac20b7d246ca49d340c4c168982c65b4749df760857810b2358e7eb69
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\rules.mbdbFilesize
9.5MB
MD5ed2297d755befec7d543bcb7994abf4e
SHA1d5db5a0cc5e6fd81772ef9ad64581a567c419f94
SHA25699d0ebdd9409278d39f98915631f76b00e5153386f661f8ac5ca0e02ec23ec7b
SHA51207e0708653783db9dc8a4debc3187b81c1b7a842b76fd25611a69c2ed323597f5d077c6c3d4c0a219b0b06899c42210b970c03fb099a1c696a4363fcbde9b25e
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\scan.mbdbFilesize
903KB
MD53d8466d247e8b7b6f8a7a79b376c0210
SHA1ae67e1b8086ce322a2a6ae30ce47bb6c38bcec15
SHA2563f974a806cc9e912fe60d4999d914a961b37603a964f0f579c3b2eb2d1aaf5f9
SHA5120b38118ae78a034e437283f43e65825792589dade077eaf21a05d7460c95f08b125385ac0a58043a34853b031b54293c9ec400bef6579e479767f1b56a574f74
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\tids.mbdbFilesize
169KB
MD5156f3b1c0b0625b251c1a90892152dda
SHA1d5a7c80c94e0e6bef543f0ac2dfccf9e2b826168
SHA2565c2a7393bbbae54a0fe9da46d7ac3a64ee92a03776a326b293ed8573ce89ec30
SHA512019a527a7519326e982ab7d61bfca93fe87c94798d3fe83778d6de23d3699a120b60491ff716ce85f8c57864c4ce06e643b0ab82c4b7d5ffa75a6f4d53c6e8f9
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\wprot2.mbdbFilesize
26.6MB
MD5f86d079723311cb7fd9470632d726fdc
SHA1aaffc3b17352be4c11af1ee6eea3aa0ea84070c7
SHA25663aeff3dafd621d03152db0a7a6dd31e4fea4844d03a4a66cbbc52e9710943d1
SHA5123c5ae9479c50e9071591f7a3c06bc60b6639634c61cb6e430767155c3df61ef61d31d960e60d2a10966af9b44b3cfa375636b9908aebe26181d90e6b5cab9ad5
-
C:\PROGRA~1\MALWAR~1\ANTI-M~1\mbtun\mbtun.catFilesize
10KB
MD58abff1fbf08d70c1681a9b20384dbbf9
SHA1c9762e121e4f8a7ad931eee58ee60c8e9fc3ecb6
SHA2569ceb410494b95397ec1f8fa505d071672bf61f81cc596b8eccd167a77893c658
SHA51237998e0aee93ff47fe5b1636fce755966debe417a790e1aebd7674c86c1583feef04648a7bc79e4dedaabb731051f4f803932ac49ea0be05776c0f4d218b076f
-
C:\PROGRA~1\MALWAR~1\ANTI-M~1\mbtun\mbtun.sysFilesize
107KB
MD583d4fba999eb8b34047c38fabef60243
SHA125731b57e9968282610f337bc6d769aa26af4938
SHA2566903e60784b9fa5d8b417f93f19665c59946a4de099bd1011ab36271b267261c
SHA51247faab5fff3e3e2d2aea0a425444aa2e215f1d5bf97edee2a3bb773468e1092919036bcd5002357594b62519bf3a8980749d8d0f6402de0e73c2125d26e78f1e
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exeFilesize
9.6MB
MD5a545b29abb9db951e9e2508a1bbc8d2a
SHA1061494912b29c965638263b7321a54b9e0399417
SHA2567607ca2abc8f5dfe7a100ccf73d885375ec599b0648ebd964ffb8bff39c821df
SHA512e7e33f5e49570ea74d427e12c049a7f0f89f7e4d3c7c511f59170cfb166bb5dd49ebfaa5a968dfdc15758f3177d7d39beebce26e593629aa0eac630748b403f1
-
C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exeFilesize
2.9MB
MD546f875f1fe3d6063b390e3a170c90e50
SHA162b901749a6e3964040f9af5ddb9a684936f6c30
SHA2561cf9d3512efffaa2290c105ac8b7534026604067c9b533e7b7df2e017569a4ec
SHA512fdfb348061158f8133380e9a94215f4bfc0f6ce643a129d623cb8034c49144f1489de56cd076da645478506d9fbddc7590fe3d643622210084b15fdf0d16b557
-
C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exeFilesize
288KB
MD5589a48dafeb9c78b9d8094ee4ac4b055
SHA10629e032dacc0335ba1e3061bf10eab93f3d624d
SHA256c39ff9286ce4346089bbeae39afa198c032ff473b480760408ffaba11f63b08a
SHA5122fc385198d654f2e6b4928a7292c5ee14e703b987711395a2a10afd05bb1cb09f79a212158e2869c94c83685efdc3fe9a60906407dfa5abe8dd38e0b45225659
-
C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.jsonFilesize
621B
MD5cfe9e6a23c7edec47050c61dadca72e5
SHA14fbc692f5b127186889907939378977b3f05aaa3
SHA256676042c1a17eadef7c8acc363f3f1f12dc25e2559d64bad5802cc4f0fa90d928
SHA512fb67bff171a6432b5b16857c15a9022d947e66abc7e1e66aee04cdcd278ac30cba1edd7b02295c8c8fb5ae9e4a35604a789ad808fc56010947e4b890126e32df
-
C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.jsonFilesize
654B
MD53be5abe0f202557eee241399c28a005a
SHA1010f8f5ed66b98b17c85cce940586ac704b77cce
SHA256e7640b2001d4f31887e38960e3e738bd8653e0757b412fba3ae45e0328058246
SHA5128b9a9412488fd4f9d5bd3187e1c0bcb67628a888b93152a3ede4bc3cd867ae38db664a5ba1f379753afe85cdbdfaf23599ac56ca670baa06895fc7ffcd0b45de
-
C:\Program Files\Malwarebytes\Anti-Malware\ctlrvers.datFilesize
8B
MD517412178172b24c5e570f6f13c42f4c0
SHA1f0aac01bdd57f034d9cda7dbec9dd97c0dcb81eb
SHA2562f2bb8b0a74e9049f4ee9dd039d81bc853fa8db3f311a799032f002b9cc1de41
SHA5123b9808f22e3455505da42b26d3c0c0d56cbac41fd0d2076c3363273d9e77064047d8fc7b969612a5f5c78e0588f510ddd5b2173be224b1b5eedc5e51e9e5a92e
-
C:\Program Files\Malwarebytes\Anti-Malware\expapply64.dllFilesize
365KB
MD599c8e47d747b36be8ffcfdd29b80dc3d
SHA19b8e87563fee31abf90bded22241f444b947b071
SHA2560db4dcdf3fbeef2c4d18555f479a28dde3d67ee6f0d27c18925207142b7a38f7
SHA512f9cf4ec06585c6cde57011884141782bde83adf186f57f75576c8dade1e868d6b886daf8fa15c55ac908ff995c4b6323c3a8266dbd664b807cd67cf788f7074e
-
C:\Program Files\Malwarebytes\Anti-Malware\mb5uns.exeFilesize
3.8MB
MD5eaac9032a5151ea0d7b74ae4bab32b35
SHA1f2c1f886868f6b9f78aeda8cf95df5051239c1ef
SHA256807379fdd7315c29bc1e96ed224285ac5ae0226bdfa5318642eaed6bb0ca3191
SHA51291fc6c387ee270372c401aa27aa399c5f6091dbcf1e94058c88e5edb473a7876c9de632cff5a4d6479a2a9bdcfb499c8ac6cdd3bd954b04db89685ccde0661db
-
C:\Program Files\Malwarebytes\Anti-Malware\mbamsi64.dllFilesize
2.9MB
MD5ba3dd20eaddaf6f0b9f652490b2f7b39
SHA14bc99d0c45055704bd73a65839d7a9da17ec118c
SHA25690817632a51faf2d54ce2126a133bb0eb3c1f85206649448d23233979b4cfe1d
SHA512012cfa7cad96def22fc89e95b95e67ba98023a754f22af43aa6b8a54b12faaf01339c982a0076797b94c53a55311ddb3e29a2dc7014ae8ad0d5529aceafb2324
-
C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dllFilesize
2.7MB
MD5b7e5071b317550d93258f7e1e13e7b6f
SHA12d08d78a5c29cf724bc523530d1a9014642bbc60
SHA256467de01d7cee7ec54166b80658ff22f9feebdb1c24eaf1629cf40e4124508064
SHA5129c35293c95c1a9141740ac99315605964aa37c4a42d3a11cae9e5649ff1427a9480d3d5e7f763212cf13db3511c5ea3c84e68f95f0067fe6339a9d3fb7b27c54
-
C:\Program Files\Malwarebytes\Anti-Malware\mbtun.dllFilesize
2.8MB
MD52bbf63f1dab335f5caf431dbd4f38494
SHA190f1d818ac8a4881bf770c1ff474f35cdaa4fcd0
SHA256f21a980316bd4c57c70e00840ab76d9ad412092d7d2d6a2cff4f1311f7c05364
SHA512ebb9834323329dc01ba2c87e5fad1083a4cb86f5ed761cb63299ac5336a9843a1aadd42fbed706797c2295117af1c00f96806422338352653c8e0255fecc2fd5
-
C:\Program Files\Malwarebytes\Anti-Malware\mbtun\mbtun.infFilesize
1KB
MD55d1917024b228efbeab3c696e663873e
SHA1cec5e88c2481d323ec366c18024d61a117f01b21
SHA2564a350fc20834a579c5a58352b7a3aa02a454abbbd9eecd3cd6d2a14864a49cd8
SHA51214b345f03284b8c1d97219e3dd1a3910c1e453f93f51753f417e643f50922e55c0e23aab1d437300e6c196c7017d7b7538de4850df74b3599e90f3941b40ab4a
-
C:\Program Files\Malwarebytes\Anti-Malware\offreg.dllFilesize
114KB
MD5f782f049b0e8c13b21f8e10e705bd7e5
SHA15c11f955e3983c50ea46b5d432c97c9148ac8e9f
SHA25616c450a310edbea07f578f31368f168ec338011cd117406898593e86ebb83dae
SHA512eed29c42b14ff26a030f53d61d6dc8e3971e478dc7646b26189f14f16699b6bedc170c4bcc37efe2e8f3048bde37480033b49eaf1a4712b88464f5da0efc18f2
-
C:\Program Files\Malwarebytes\Anti-Malware\sdk\farflt.catFilesize
11KB
MD5cffd7ecf8765733aa7a2c36ca5f1eac0
SHA1549b0974cf92676a7589466a3ee29e1dd45afa6d
SHA25689c561a58d649d5f29fe1c576ca46245780369845df32045a64739b4056d8bb3
SHA51247006f07c3270f358ce67c235739ebaa17b8fbd9a05da9f05a079322a003f8e6d704d3c5353e1a186df74b1bd6438526f6701a0c173563d676846c0f0f230be6
-
C:\Program Files\Malwarebytes\Anti-Malware\sdk\farflt.infFilesize
2KB
MD5358bb9bf66f2e514310dc22e4e3a4dc5
SHA187bfc1398e6756273eee909a0dfb4ef18b38d17c
SHA256ff51780a5a854b2c18f71ae426cb066a13723ef6155e24f4910137c9e8dfdc17
SHA512301ec5ec5c0813951843011f2204924240235494999136ea30a557cbf58146fc6043a8866b344fa7deb927d7c83d44e2aaf45adca7d221aba5d36715b9a63e09
-
C:\Program Files\Malwarebytes\Anti-Malware\sdk\farflt.sysFilesize
196KB
MD59c4bec17ba2add58348045dbc762ab67
SHA1b00ed0ca3634a93a23f70e79bda67c945dc915b6
SHA2569c3b11ba1d4e462d9470fa0b50a61fde9f00cf4adfafd8e8b19f1e8af369cdd6
SHA5126aab0e3d3c189c18ea6540d1736b64a518958c62e1cb0a2874826f6cfd76e3a06fdbd28ae0b81e2fc8fc20601d00d804d86fe9887ab6919dd8090a696fb52b31
-
C:\Program Files\Malwarebytes\Anti-Malware\sdk\farflt.tmfFilesize
63KB
MD505486a31377c07a62cbd8ecb63b2ea81
SHA115503875354b6686e9a9ca7a6bc333fad33407ed
SHA256d1da47e79e90130249e75cb40f41210256f90bf56d6036e0e75bdf3bdee611a2
SHA512e1bd08bfdfaa9dfb128cd85ac0a2950747e6d18bb24aebc78919a180994e333773d0d30b958b00804c4af535b443be1ac28d6c3237256eba62d3c0812009c975
-
C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.catFilesize
11KB
MD5aef40e9e7ca500f8d23f53a9b7b4fd1f
SHA19d6c9f4c18b6d57e43f26bb2593c11264a1eaa41
SHA2568e66264dc7478e517b72af31ca7a308be15ce7dc9060e5f0488fb186ab1220b3
SHA512f6857b87a244dd68ac14016bd6e25e31d45b1b00fcbe70129dccd33ab8db1d01d4c31651f5f7c08d237c76c0291a35e262fc7c25670ac11166354841272e1277
-
C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.infFilesize
3KB
MD55a9717e1385703e8f06b27aa10a69e87
SHA184ee67a9167b5eb6560711b9871de98898ad07a5
SHA25647b7c516bb57c612de19f0ca865590af95b6e32bf873a0fef9e011b2c5b483d4
SHA512dd3c7278c2c11ad15a55fae6d19b96dadd92f85b7f0c8ce934298258af00bb5c052a84a98499b8867b0f43704fb307c67d03692ca69dda4d814c6c17dd73df44
-
C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.sysFilesize
217KB
MD5ef356c49f9dbbfa13365a3fda7dfdaa2
SHA1ac5286b5570b83b733f5833e92a220e2ceb0ef7c
SHA256a507ab3164163a52c2039a02a1f5b7ab55fc120b1c1aa73930184086bcc5597b
SHA512d2d88333f367d0ccefca84b4a24185dea257b30a15c28ed26b00f04ac90b3b2c4e4c5c42e4bdb97e07895c4a5f3d38786fe811d3eb04bc10a1a4b7a55795d8f5
-
C:\Program Files\Malwarebytes\Anti-Malware\srvversion.datFilesize
9B
MD535c919c92586d90651a5183e962c4a5a
SHA148653cfa8c7a378f7226b3cc55052af55091f5c0
SHA25669cbe3b65794fd3ddb7e49ce394a6ce5ec8d8512d4a5932f24417c4c7b61e1fb
SHA512ea1159f582119a37dc4f3408028a00886bb4760cc5c3b51da53f186cec81ac2aba35ccf24bb2d35aee6effcf787f548583bb41977827c3ef0987a9daabb2e9c8
-
C:\Program Files\Malwarebytes\Anti-Malware\version.datFilesize
47B
MD5b254ba3d36c2e884aacee760fe274c29
SHA127eed9f7c6cc40e54eae9cefc33cbca9fe7cf2d5
SHA2565bafd4f4a9b4a5c02b5c6926db768d219e6ba7ad0d9440d73f90f00c5c630ab4
SHA5126e5390c50a5590df3276e3377e0badf2af9c801a67a09cda47f8b0ee63979ed50934516fcdef78d897fc120c6184f09a5d54d8ea94e2cb177adcd613fe5db48f
-
C:\ProgramData\Malwarebytes\MBAMService\ARW\mbarwind.arwFilesize
1KB
MD531f4ed6c2077a6712cfc2b27762b580b
SHA157c68266fc9b49c5d7dc62a15eb6636befcbc84b
SHA2561ca6574269eb2e6daa059cec58c5e999fc6345bb8a93a7b3e22fefd34a7ea8b3
SHA51213d9727a694c88fde149517beb4d16938f328486065b9d491151b06855312cd0b5deda67a2ee4ba85280d19d7d6b648bf0b6ffd3ed9cb346ba9ed0cfe9ceeed6
-
C:\ProgramData\Malwarebytes\MBAMService\LOGS\mbae-default.logFilesize
1KB
MD5234467c9b67f2d314b438b36ab62cc89
SHA1e7a2cc6ead28b23a2a9e962c070fb2cc37ca7572
SHA2566ebbd73612b36c3fd84692c9659b43cb71eebeb79cbdfddb2a8866fed1533728
SHA5128466105d705ad08e55ea38b23cc6c436240877b7ccd7ed4257bd0cdb13ed50ffff16d3ec8a73254bdfd4a8c008de6451e7330f43ae14d671b736b477ffcc054f
-
C:\ProgramData\Malwarebytes\MBAMService\Quarantine\a10961b0-19d4-11ef-a20e-fe5db4a87adc.dataFilesize
2KB
MD536c5e63b9295db67b8eeeb9060864c41
SHA1f70ae18467d9206ccbf1ed82d0f7ad2e6cbe21c8
SHA2569e4f69142c2fca0477145debda99245bce9d26cded27001218428119502bfd87
SHA512a818bd4600739d84c07d7ea1df01a51cadcefd9a935444fb7bce120c47a837458ac7b6e59944005638381d142a149d1b73abc44f525c5d6502d09e4027932796
-
C:\ProgramData\Malwarebytes\MBAMService\Quarantine\a5191da4-19d4-11ef-acee-fe5db4a87adc.dataFilesize
2KB
MD540d72f382d5c0253ccb61f35e5b14963
SHA138c137c55180f3e0ee343e66fa5a29357de5aaa6
SHA2560c04c5b8cc3df80897a8abe26166ef0f7ae96476371c6aa60e97667bd8cb29a2
SHA512ae2108858a2a4d40d865668172febe3d12846715a2f738f5e5bf7fb867556faa4dff944b9543da2bbaec4f11a705f4d05f31797fe196be658ca2c5c899ddf257
-
C:\ProgramData\Malwarebytes\MBAMService\ScanResults\977daf8e-19d4-11ef-87a0-fe5db4a87adc.jsonFilesize
8KB
MD59b27d41933130c4f283666e8a5a69d00
SHA1ad276f47f845c75ab1b36c9f2cea7a30186d1c75
SHA2561e8874dca8e29900e2ea16754bfed9d011216f71295ba0c3da77a294bb300443
SHA51240edd1ad14842bc43c2fce525e07e7b0cc771bc862c75c5f4d9fe470e699573061e42271fc927b5cdbef29a25bccbbdb314e233f7fe8ac9b4fced70b1cc760f4
-
C:\ProgramData\Malwarebytes\MBAMService\ScanResults\977daf8e-19d4-11ef-87a0-fe5db4a87adc.jsonFilesize
8KB
MD54d41b1ffb232f7032f46ab1c9591e5fc
SHA102cdd2b78c766033e4fc7198f084f9c200b5ffad
SHA2565d7482cede432efbe7308663c136c00efd4b897add758d8c0c5f3ed0169de0d5
SHA5122176f94ba02d6f4f11e2f6ef06e5f6a2a32fd745b7cfe559572327dbca10a90569a285d1e132e588fa17849a93b06d7623a75c4707ba4803404a6da0f7035d84
-
C:\ProgramData\Malwarebytes\MBAMService\ScanResults\b32500b6-19d4-11ef-a477-fe5db4a87adc.jsonFilesize
8KB
MD56d83d3592d877fbec4ef25c9d2be60e0
SHA1a141e8c567e8b3dbad97efed790b695774e28ec5
SHA256ee97e80a4e4de31323b1b61fbb667ea7e55da9e520bff150d227443d7db71e67
SHA512ce8d31fa9b508f4a1b30be8f064973fd53f40f957c657bdba3c2d339e482e1a460b14d687fc4490487bbb287db564102bfa682107d682068f4ce3f3aa6d0b1f3
-
C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.jsonFilesize
1KB
MD524d105088c2f7b55931e5cc75f01eddb
SHA144756f3e83590a0c536c0a19a6a88dcd8a876a64
SHA2564df8e0b2029e2443c80cb168e0c7477bae5d1ed3c96754d127cbc9217af34240
SHA512b5433ca027312d46e7987f89daaa41e98056fac583b39d9c7e6d9f6f62f95e9f6c8541664494b3bcaa30aa3f940fce798b912833568b5c738fe89bd076d48256
-
C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.jsonFilesize
47KB
MD59d871c8eb0e08fe75046f00275417ce4
SHA1c52969431254c92ad2b85872df998db5ec740cbb
SHA256fd81318ba8918fc09fc979bc261c6484d48efae1ac83f66e48e334fb132b47ea
SHA5124238c78f5bec82d73c2010595d4b42d6f4a9dfee553ef464bf44ce691d70d39ebd21d5312f18378abdc7a109872ec56e2c96ed7f7e772add001f6007419b8abc
-
C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.jsonFilesize
66KB
MD5d5097a7628fa9993d83c775eb54e1a61
SHA1a6496bf7c1e2428c7457547ca32020d31093bf8b
SHA256851baf58c0e6b04f0d9fc08f0d314c59ffa335406e8efe010e351966b46c4829
SHA5120efc6475dea9a6c80fffbe9aa92843ff0d6464e31a1f0c3722269c7744a678de0c24b48689f4fe89034cbe92e612bf6d9deb4f1032f6c8fb00258afa30a9cff0
-
C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.jsonFilesize
66KB
MD566de003872a6fb88244793afb25ecb52
SHA16ff76c0771466c4540cb4ceb5673c50e1075a6c8
SHA2569e4a31c4f846867614cf2413011dc6ec327b1f77212efc8bcd0f89e8b6b0ef7c
SHA5124c35cdf98ead8573f0c87ddd2abffd0e0ddff83c05bda6109ec856cabc074fc98af7b3a81c4cbde631576b06b4f78a1f5bfb3ca9f5c037addbb2d0fc9d76156f
-
C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.jsonFilesize
89KB
MD54168d06c29647cac1be28d120d0580c8
SHA13f93f8c1dc1aeb2706a4062446d7f4d6dcdc293e
SHA256ff4b69544e9d1d87f06c065fb69024117f77274bc4f12c6c267db0898a78075d
SHA512862883555715650efd3826f9de442d73eb93d774579dd922fc7a780dae1a6846e22855e0f03b9b29edb400a8a7f6c34f55feed2206a7415dc1ec569ec03557fa
-
C:\ProgramData\Malwarebytes\MBAMService\config\ArwControllerConfig.jsonFilesize
607B
MD50ff17c10f8179066da874e8fad406005
SHA160de43ebc6056cab54411054509d06313b44ddba
SHA25658f93d2247b34be39195c6665841d1d4a482d7a2019b655111cf7c91294a3d25
SHA5123d29bb8586ca5a22fb3bfedc8b547add75770bcec89c8a7f5081873431350683edfc386a620bfcd1bacb8a826969a59b43882a0d713ab05536c4912b2c29ed54
-
C:\ProgramData\Malwarebytes\MBAMService\config\ArwControllerConfig.jsonFilesize
608B
MD59f79a850d655bdad52ea52498cabd420
SHA11e906c5d2602d7d40980c30ef8d90acce186d241
SHA2561e3a876020d22b57001dd4d1d9947d40b0c31d5af8767c5a943224155a7be57f
SHA51228332278c942747822eb5d6a3005dc55f79379c7fbf884d5b1f61d45cde0a5a948afd9c583d077e60107f075372ddf96bac42338c4db7611b6267d372d35059d
-
C:\ProgramData\Malwarebytes\MBAMService\config\CleanControllerConfig.jsonFilesize
847B
MD57cbb93939dc7e924257048fe3c8abcd0
SHA10958120affb3bd5e98f0b3feab122f940a18c080
SHA256f3a06e7b004f82a43e517db31d9e2a4bd9fe5d4f1b878680bd51a96318491bb0
SHA512b1e461e939340e5cfa39b934ab21e482d37583933f4fb594360718b1e95986d2f2d7afac628b0736ce59869dd016736176f4cdb9a8596096a83817a3aaef6181
-
C:\ProgramData\Malwarebytes\MBAMService\config\CleanControllerConfig.jsonFilesize
846B
MD5db31898d2a939830541d3c5bc804cb8d
SHA15ee968d50abe4b6711070ebbe0105fdeadc8aec2
SHA256acf3781e8480d0dcf68e6d8a70ff69866d1cadc346bf5b49ce30bcb993dad2fc
SHA5123b500e16718a97f3df70daee3d0777897b248d7e294608d095dff5d19066f1a280f7020b3e0650a0f47830b580fb34d454683ad1bd9b1fc07063028a12536d26
-
C:\ProgramData\Malwarebytes\MBAMService\config\CloudConfig.jsonFilesize
827B
MD598dc2241345a049b114e9aca3c0d2478
SHA196a6e5b4248d260ca72fa424229ada34e96ab33c
SHA2561490cab748b9273708ca10d7282b01bd99e1045932195c7a4d7b7c180570eb4a
SHA512c02a1a11e151bbfca924e15a519c8321e194a3e14e11406ef923f7aab06d1b8ddd06dc5feb27e77864ff00ad94556ddcb2ba52bf845016af41a20a476fb02e54
-
C:\ProgramData\Malwarebytes\MBAMService\config\CloudConfig.jsonFilesize
1KB
MD50a997abf36f75afae94573e4ed6401e1
SHA130f9072bf3cb0c99b6e4c20cde82ccaea53ecfdd
SHA256533d71f9cf0b5e5ac57d34f4d60700fbe17c8c3fa8efb93bbba7137349256440
SHA512744361cbf09fb4eab4a013fa548507071a4b29458549db4bb94f8381005203fb3893371fcbc082a21977c55889684298c2d0976c899f28883f0dd86d5c76ced0
-
C:\ProgramData\Malwarebytes\MBAMService\config\CloudConfig.jsonFilesize
2KB
MD5979a0831df3de2ba9e5f561f1d84384b
SHA152ba0a88d409d5d67ef5fa621610e81d0a926f0a
SHA256721cf2b20e46f1e9bb90934a6367524f830667aa6f16bef699e0b2ff5935038b
SHA512261c969753a0e434f532b218bfa57cfa3e7bae11a8a110e01ac9ac1b8f26ef2efa83d33003032396913ff9a33f16efc32ba510e02e123af6aed5a19100d25da5
-
C:\ProgramData\Malwarebytes\MBAMService\config\CloudConfig.jsonFilesize
2KB
MD5765a21ba1d9e8854516a8eb26830d575
SHA1f47568e4426a9ceb6ae297f911a3ba6abb52d69d
SHA256a6608b42ad86f0e2a319cccdf336342a22fb0aef03e27b52f6155b36246a9475
SHA512dce6c036e09387fd86a3fb2851c6867ebfcbfeef7886da8ce0597bfd9247ad52ba127ef822cb3b598a25a09a6a1ae10376ce3844c5c5a99726d608c472526802
-
C:\ProgramData\Malwarebytes\MBAMService\config\CloudConfig.jsonFilesize
1KB
MD545e771c9009f2f6376ef0d32e91685c1
SHA1d2b08e3f819fda750d2289ec2ea38729020b98c3
SHA2560604901b52b65ebf9ea0792a6430ed8a4fdaf85b5c884c1bfd4a539a133cd0d0
SHA5122df48d54c1faab44f7c6df430ce8e68c9a48b6ee747b1392bac34d6e13400cbdf02b856fea8fb4b2f8742288d6c648aeeff06e3269bc6a9a398964901936e962
-
C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.jsonFilesize
11KB
MD5f28e7ee345bee4e1bae50f63b99df475
SHA118c0b5b8f2f05899c3b461a3c32425a3e46fa345
SHA25639b2206c799610341fc4a51e43cebd2fd4532380601b66905915472399f7dec4
SHA5121e67dbb317d49388c9d6f1970b8fae753cd6773791e6f2c1a5e8c8f158f227db1fdd355666cc5f777e7075cd92db050c5243b9044684e7da22b239937744c2b6
-
C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.jsonFilesize
11KB
MD5bed8d10a8fdd9b9f1ff9f9d1b845a1de
SHA10a4752f60bb0113d72f1c60e2c63bbb3757b015a
SHA2563c3c4bcaa67c269086367befa5a0c69eaa03f6e63d5d0320c8c5e893945c9965
SHA512518c814830807057026bc14f3ea6e9b02d3b1ea5c916a7662753d31da98ff1f97ac167ca88f057e08e977833ebd3b1ce2807862e0bcc704f27ca0b786ad53588
-
C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.jsonFilesize
11KB
MD5a032c7eee0dc3b09810b183c5b4faa80
SHA126e63ecba0117b0be1b22c8e86c9a7ace246f0aa
SHA25671a17b8267e3623fae83c4dbc5ed00a44f40f28c65c7294310680dd4d7a37e1c
SHA512155e629f9dc4c2ebf8455315f1720e9efbffbabade7ed689342dba1272dda610d6956ead1e6200db5e82597e181183558f4ae1971f129059a94703b0f50e0e44
-
C:\ProgramData\Malwarebytes\MBAMService\config\MwacControllerConfig.jsonFilesize
1KB
MD51d28a650a636317fd4d7453831672b62
SHA1b6865f755fc709b256b1235a3adb1429106acdc2
SHA256f0b24632af6b93d3ecc206d5ca14c5db156aab30c19db0ba1f8ab38f1b484d83
SHA5127e41d1e130a9d3e91d987dc025513bad6cf1531e2df2f397a1ba1984a686d7ddc9f2001d877ea7e7b2a1b380862ec803c2405bd1852f885c68fed42b48495014
-
C:\ProgramData\Malwarebytes\MBAMService\config\MwacControllerConfig.jsonFilesize
2KB
MD5e3c7b286939e90580010d9826ec5e24b
SHA19350aef4b678cb7822e7ea19437ce5e9dbc0e568
SHA256fceba3e60dca324f9d6a8e04eb5ef54f2c295ddefab88ffa975556d18754974f
SHA5129ea32e9bf25da6d8581f8f2da21e29ce7254d964af69e285d921fb374cba3808f191639cd4c1f8bcb3331543a4ae616d200ead0285f5000a92e55bd9eb4d1f70
-
C:\ProgramData\Malwarebytes\MBAMService\config\PoliciesConfig.jsonFilesize
814B
MD52171031164325f5144f4f1bebbea1370
SHA1696cfff212c0c315e0108fd1dbe1ab6c24d98e5b
SHA25665b48b3757ea31e14d1fb4f428d3cef11aa4683649153c380ebdc84a19e552d5
SHA51209b944ed9f48774fae393eb49f707d57feb3e3ccc7d266e45d8f6a8679511fc619d3b7c28c18c07976d10687f24a4f39812628f432eb57e52d6a6a85cf334079
-
C:\ProgramData\Malwarebytes\MBAMService\config\PoliciesConfig.jsonFilesize
816B
MD576708f95741a35a33f89fe85d435f79a
SHA1ad21294f2ef1138264753f16c1aed5187ffbb7f7
SHA2564f2ed5ff1c6ae9f28ac88e6729643bef77609011c016ac3f75ed42572e775b3e
SHA5126a966155a3a38418f1730f02af572f2560ed219e94c6a32a6e3f2c2e79257c7edec3ec856e18b0ad87e51bfbd3ef31d0f0176dbb0ce42cefce2a6063035e9e46
-
C:\ProgramData\Malwarebytes\MBAMService\config\RtpConfig.jsonFilesize
1KB
MD557c5d73946db2cebf528f5fb8da97506
SHA1f1370cd0f70cbd80de05e96cfb00608d76e2f8f3
SHA256f7c54139e78e8fc3fd2018dd1d438f131ff59945c534adbfc954e6599c6238a2
SHA5122a1af4ac9e4a8504d2885d4003bb04d5efd253253a895ebf17e944250dc8e6eb5532a2340791d3d82daa4eb58c9c8d459a0da3d83a2c80eb0989fd4b18f27f1c
-
C:\ProgramData\Malwarebytes\MBAMService\config\RtpConfig.jsonFilesize
1KB
MD5ae02dc1556b89d038c3876183282ce96
SHA1fb10fd2c2fcc52cca58a4aca908470a94972668d
SHA25655ea0bd3371b6d3c0dd7e6f15aae92a86f34ac5d0fef32b11d27fd7e5f33744b
SHA51271425f7fea3122be5f3f0dc0954b4843bb377feaa3bb8025fb05f23a42538961c779dcc94017b740d45bb67f7fcbcc41d4b83d756f7f87127a5b9932c6770b45
-
C:\ProgramData\Malwarebytes\MBAMService\config\RtpConfig.jsonFilesize
1KB
MD501ef25623c7be2b440f7d2971da7cb6d
SHA117a8eead02670d749efa7cd2099886e5f5a8256f
SHA25628829bf46c0468bbd0efdc2b8a44df7288b032210d47135cf0146fda461db4a7
SHA5125a5bea0f504e080de6a1ee2c3144b1623cbe9a8f8adae499d8cf62a50c70c6d8f47e4e7c1df22bcbd095620727b79759ffc48fbbb7e3d20693821850f8ac9dd1
-
C:\ProgramData\Malwarebytes\MBAMService\config\RtpConfig.jsonFilesize
1KB
MD5a628cd64511ee68bdf4f63429ac9a8e6
SHA1966adf938e6fb8c8c08aba13a6e6d15008f9a125
SHA2561ca95177af147ca5fd573b12c8a6c4578c21f28ded1b98930509632a5136990b
SHA51226c301f2f4ac4a79f49061370c0492ba2ee7a82c740da6da5ed5f1bd909a7b14510ee82532bd9f6c410763ee34b82b4a05ee4b1652451df020a16fa531586048
-
C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.jsonFilesize
2KB
MD5061b1387eb00cfb0737f56ed4e89b776
SHA10c22838ccd1a18058aff54fe881af9d2de2888af
SHA2561f870b664e5edd84e75d18fda425cbe85bd176d1a1f10e2435b3fb5f0d307aef
SHA5124953afc31a0aa7ec72d0790594efee835f217b9fcf8b9693a32242751d962f15d9b0c11ce5c1241ff21076e2ceeebb53c38a5f68ee8b9271cf480d5d5937c4ed
-
C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.jsonFilesize
4KB
MD5a9c2b1c7ec1b52175c93c352b0f20309
SHA16685c323b2cdb5b2ece72163143540e1a58ef552
SHA2566771ad8f3f85d1ea82eea0d01ec7d3cf41159b43cedb99d1dccfbba49e778532
SHA512bef53d29f92c4f1537f8d11ebcfe75c060fa327f1ed4a04cf43b6c93453e427d8330ad04529ff258c27e10f5870bcb5077bfdd0c7c1246a80803aee513d00b4d
-
C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.jsonFilesize
7KB
MD5c15cf628e39b860c7f76b0bbe3211c03
SHA13f78ee51f735f531f51e48d5e23d7f9a9defe381
SHA256b16401001191c81be8c6c194ea89ef604d021ff096648e0cc691852ffca3ced4
SHA512fb64451438375fb4a3ec7d62d84cf9086e1635a4149897dafe03c68075cfd1431d2e7c929acce3779e0b1d3191f480923b307ef16dbea8d5160d6964fc58eaa4
-
C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.jsonFilesize
7KB
MD51bcb459e5630d3f06247cd9c5281aefe
SHA1b3753f918886df20c526730e4e665fe4885a3c77
SHA2565e73fc2b1932908d47f3ddfe495e285a7570eb52ba8f3596bd23827226597035
SHA512c6f008a7080d245815ec583e16a8cee6fa5251210b14580a9ed7339a6c9129fd9c292024a1c1f8444168d9b676d4040b9179599486a059557d91becdab4efcbe
-
C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.jsonFilesize
7KB
MD5f67df6cd97a79d9f211d2e4b8b18ee5f
SHA148418dd4f6ba788f7071454388f260e6726465a7
SHA2561f57acd6358758db8fa7dc19d7cd81aa79a09d0fbe444e573d7743330b91412c
SHA5120135e9840d0de4c685a29174fe81958c5661ac57634c214a0c5d9990f57a37609dc286e265c5cf035299ad8f81bdbfd9ea1bd9ddb8fc87c98cc031fe50022857
-
C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.jsonFilesize
7KB
MD517136c36517317e4ac55ac8ee2ea44f6
SHA12b72c84fc0f829b864f360858abb581d951b98e7
SHA2564ada5cafa6e4a07c6e8b12b923d3bcb73cfb2644cece193cbcd3f043942f18e4
SHA51208706b70b8f3857901ecfb99a3dc46baafe633c37f0b3d989002e5ac027b932ec71bb569ab24d4e7066d97b16ed40721ac9eca35b403ca8f0a2678145cf1e58e
-
C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.jsonFilesize
7KB
MD5e8bc6d92fd04c72ff9cf5198db1c94a9
SHA17ace67ea2bdd6786e70f48510079cdfbcff0f561
SHA256ba31427ca332c939e79b3bdb041eb24e6ba0d33f3fbb314d5245cc6cdc95f70f
SHA512d9992111180fbfd6286fa5d66aeadfffc114c273fe978f4063b98f7682629c1ae0047801cbcb108594ae79b31a6d7a476a64743ae9a5c34d70249fc137c37fa9
-
C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.jsonFilesize
7KB
MD56341ff60eb0af8519752885a2d9397e8
SHA1ea5a4c847c35ca6acc23dac9189d2b725346304f
SHA2563ff8bc17b95879af8936e533eafa9f9cb001098115386da04e969d2533829ec7
SHA51287b3238e83e3d3cfbbc5f9d22ad92e162b53882b973ea885b7a125507a14afd69e4b5f9ac42cdd923c6a9561ec5ef23ab407a3dc644c024d6bb00141e577f430
-
C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.jsonFilesize
7KB
MD5b27f25a8586ed2169f3dbd9a7431f8e6
SHA14c632a33ec0f26ce7a93a736389317670aafea07
SHA2567243299a403eb442a8747fea6c6e4cb8f992b8d70be9cf1bdb16c60ce0ed266b
SHA5121c58b32df99dc1204577a5778410f0fef39469e7565e306d912a254a10390413c8fc41db47d54565e75b6df6db4479f2afd2e996e8ba8a404ae129adc1e8ccab
-
C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.jsonFilesize
7KB
MD5a9c05b79f2f645108402e3779c85aa9c
SHA11376309b2cc91f5697e8ac842d4bab8aa208abf9
SHA256bc7b9ed198f2e0fddd26882e2df388dd578fcc02c90260ea47c4d4f3c405f1f9
SHA512ee59a104cb6002826142a90d8043370b4f97f827800736c2cb0b0478bfd5c850629d7f890c72b2f34e1ba77fe1ce36f3727174525b031bad11cd50457c9ed678
-
C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.jsonFilesize
7KB
MD59686d842bac19703f7ef74ebc9f280c5
SHA1db5784dfd7ed9a7301b19b8118a47b12262d9c1b
SHA256d229161eff269f316d363e7cec8a3196621317ea9bd93c0086a320e404437d28
SHA5128e66bd9b91f56b68018014bcb1adc083605b2d2df07c0fec43a9c47aa9632486ccd1545be5a6476500f91736cfd2338d83297910ccb03dfe8c99876c901d65b3
-
C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.jsonFilesize
7KB
MD5064b474ca0be65fa48c47bb74653a93a
SHA183180ff75714537827a2ab369108bf7cb30ed381
SHA256027037931da0a073655e2fa2be07e1b90194122c5983250cc10422c93b56f290
SHA512b040e8b9e3cd6cffd2baf4f953906b0ffc1c155345783d3e48c667ac09052991b84c2bc2ce3d55eb77d2f9c7b047d79f35f73dbb4cc95bb2e3396f989c23c1f4
-
C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.jsonFilesize
7KB
MD565c3f35d33e0ddf4530a6ecefb98e9ba
SHA195574cd8d55c5534809326fac424fe69cffef89e
SHA25606e45ea6b777125498fdc06d47347810cb837e059a12634532e08edf55940dc2
SHA512fe15fa6443cd99d0c9c37908e8353e6db5932d377fc4c74662d5c3266de16ce5f6620453fe6a7329836ace24d3045fbd172d008bb4d157672c17c9f627070cda
-
C:\ProgramData\Malwarebytes\MBAMService\config\SpConfigFile.jsonFilesize
11KB
MD55d1df7918f2a903939391d212194e5a2
SHA1f5cb329e59dce12d348911f39e7791fe9e66ac8e
SHA2560c2c3d4e4f9a359ebd54f914b2491a15f78724d05a32192f11b7ff50cd7da88c
SHA512476f4fbe68d37372f38dde8af5f52c1b88b03979056b71cd801825bc21e468dd4679e86e1dc003b1bcc9bace213263478928d7a12fe012f6254ec9000455e6e7
-
C:\ProgramData\Malwarebytes\MBAMService\config\SpConfigFile.jsonFilesize
11KB
MD53d7990d81c46a77bd5f20491e72c7ed9
SHA1d5fa19847cac14118c87db3cb9226b9109943cd0
SHA25678f22d01d37fd67220fa9513da871d184893eb1baf61a554fcb6f9b8efbf929f
SHA51242a0b3535cab5585fab6b641c574d49b919080ffb348cc9b35465404575c9a6299b8cfbfe9184829557b5224d8e859e5e0a798971d8e2e2e39375c6dd82cfe04
-
C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.jsonFilesize
1KB
MD5353c7137dd6a974ccfe63bd06ebe03f8
SHA16c69ccaa44b132de0c9acf3a107e87c88bc55618
SHA256d143871ffe55808f9b1ad730409a93d89ce7c3ae918009524015ba4c13eceb64
SHA51297bb509cb2dd4a7de7b06c855860f6a9dc21600cfae2b3722d6316dd26267bfbdbfd5c50b276421d2011b9de767391fee28aed2e10823d8e39b03b2a20261e23
-
C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.jsonFilesize
1KB
MD5b2ab7065b4a31315e133d74b2dcca4cf
SHA1e6dd9809724f330f89f1bb71e5f044920aca3960
SHA2563644141d4fc9997df442fdccae850e84c6fc56c194103b309ad70b64cdedf292
SHA5126b5177a729a8246f36d69df5f27430ca5f605faccff46579984aa474bec7f75f2de18f14114ef5ceb1c208c1eb18acd6815213b8f884b4e4c4916bcee4694a77
-
C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.jsonFilesize
1KB
MD5fbc0c696befc403717d8f88e8f4d0387
SHA1c3abcea3894f54d7fd0118c28d2bb374b0fb7897
SHA256d1ed83a578964611ffd7b217a308ad9991d1c68832c085f4cd96a652eb7cf941
SHA512acf85a75c1a8194c78b942ee483aabd50af608fc0be107ef61a531c9a915765e3bddce55191025e347c79b47cce6a7eadef6ff59f50bd2128da232a6c381a308
-
C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.jsonFilesize
1KB
MD5f32f728fbf68a7e4f0ab28920e90dd8b
SHA1fa0d83c1e98e0e75f6b8dca35ae476b9a0594c7d
SHA256840c1ab51adba8d5971d105d34a78c3b9d16c513eb04f51c177f27a4d3d670ae
SHA5124abf8790fbb2aa1542952f3cd10845fa0a3a45641a9ae4ff9fd621a24847de5054c60594986f5d50202c5dcc9344939c1aea71a794f5e6454bb270cc2a5951fa
-
C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.jsonFilesize
1KB
MD537755c51bddd3f5e9b50575b3b96c9ec
SHA1f24b34243cbe3630784c0bc9c3ad96d9a3fe6388
SHA2565bc0e6beb927e7a6c9919b2512944e16fccd3df7a072dcbc765e7752c1e49334
SHA51203134b3fc995daf27d07988f58712257b58690c17e0758bb13436ee4636d981a0ead17554bac010bbb2dad92d28d2c8f39cdfffd33fac45e35c3935fd5199dcb
-
C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.jsonFilesize
1KB
MD5ee86c58c76d8aa1ef45a05aa8b81dd76
SHA1d0c8dbebee1297be9a355820090ab7eb0108fbd5
SHA2566d197018c386ea28c69cc4b2322216a3432de444d344c4db838631d71e4caa2d
SHA51227bcceba2521e4aefb439480dde253e48595a55717195b90e015c701e2d9061793b3232a6e83d00203b1f8798a85f1bb5ea14971a62d5349d6c4aaec614c9579
-
C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.jsonFilesize
1KB
MD52e0f3a5403182ee2ed6397578b81cd20
SHA1d10cd5d56d9d396a04e117b107505a03d90dfbbd
SHA25661fabe14dee88e8299c80a693eb48c32399c7cdc69c52bb0abcbab95939b7871
SHA5127363841b0ec2ddcdade34fa65ab4a503431a98f5ce9b0af9cd543fd7a1ccd899930d8bece9cfab9d67aa73e054ce5c00b875af9909606ad6ba7e1a4f744dfbe6
-
C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.jsonFilesize
1KB
MD5f1a83793ae643b4c57d2b2c098f2b8b3
SHA179bccfd004deacb3997fd4cca71449a747ff0e97
SHA2569b0b8002039255e03b22d91ec3ee51fea897c0331b45a2b52541a59756985a1e
SHA5129e24b3dabab276bd365e52547befef4b5b56b2623e2b77c91e0df9cd1e54f665ebcfacf8264004c6ac8643c7a118acb0268aa4d753e4b9fb947d0cdfbb01b610
-
C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.jsonFilesize
1KB
MD5aefe056fc707ea14167820c86e31e3d2
SHA13743e467e57ba9362497ccc820c282bcaba1ed66
SHA2561ed7db11c6af3d19488199f1e1a9533ca2241dbd5029aa2ac65e15dfca0fb41b
SHA5127d10ba3e5a4ee193b992ade716f1ea25f5a4ba058c89067f42544cbd71e1c58b2198624785a12f20070dab1a3b2245e961ab0f30fa6ec6f8e0373c2847fa0797
-
C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.jsonFilesize
1KB
MD532bfa73f124c6d39b1ba9ed5f6c37bb8
SHA18f9ca672a16f9f9f1ae87ac029bab86df2067be9
SHA256a28770d48d52dadaad28f12b4df46c2dab4650655cd229c96bea2d89c14987ee
SHA512a19247326d482813401fed10ad0eee66fd0890b3c82801c8f571aaa53ce108d794b7c3a50046bafbc1fe9fbed3bd3ba1c68031c2af703b5ac90961959728a22e
-
C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.jsonFilesize
1KB
MD51b8f70d0c390ffac92fb875e2d7568cb
SHA108c07468b24c38737f86ce17832d2d15d51b9706
SHA25627ed6ea09447447b79f0279f86bd616884efd8531851160a7944b034a8c204ed
SHA5127360e6483abd579d939f45ea596347517a80ce919c677762b2c3f8f6975cc7544f74cce824673958371ef7373de7105ef00b0d4e5f31912f1227a408a49b56f7
-
C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.jsonFilesize
1KB
MD583dec380347ef4a77ca7d45a21d612e7
SHA1723168e89b28dd7fdb5459cb2a161c56d83546ca
SHA25666bff92aaa0e9d1d0e18f779b42d7cc7d7fec84d1e25eb80961b181dc77df9c9
SHA512a565ea99ed84083f355d2a5bd4ad9e990f69b51181d4b01471d30074308495afe9c1a1d0bc64c88fd6776d25d423102426294a8b552d92ab38b895f63b89209a
-
C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.jsonFilesize
1KB
MD5f9a5336961705e94be6cc0d9f3b62aa4
SHA1cf1fb92b35bb3daf88e89384b860bc73d5bd4075
SHA2567c28319bb3d0d64d56b1a4c6cb9f323bfa40924a5cc32abb5f69bd8d0fc78b40
SHA51277cbb692c9d1763d2d696cf2cb82d2a1b092d26728e93407fb61af880ef7792bbe033982aeb2f63c7a6bfe3b9c78a7e78d051ca892acae4a79276d6957a9f894
-
C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.jsonFilesize
1KB
MD52b9a293a4e30dd9f6496d125ff03f42b
SHA1e848e41e0a8b2a1db39f1e711389a1659c2bbb35
SHA25668ce4546ba31446dec35a5bc2d1f0650933da69b79e3dc283a3cc6571c3bc166
SHA512025515ab2107f39435967797544fe567e87515ff5c5b5a7801536070e61a01d2789ab6d192f53971a101e7ef30793713e4701e6b032f111d4a1a68aaffd91a2f
-
C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.jsonFilesize
1KB
MD548ca26ae3752946b7557db4effc71421
SHA1d5cecaf1a9612d6470dba578945f94676b928354
SHA2561efc27897d18cf6c1449edbf466d0d48aa88e29f5bc8e7bb44a6d9ba4959e107
SHA512095de6e3592c0e77a94131c11aa110ed10e327f2df54f01170d0003ddea8901bc10c4bc8aa0df61414a79114ce4221beba2f9eee8dce12a80d36c6e3d8a0a9f8
-
C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.jsonFilesize
1KB
MD585cd0c968cfb0d1ef985af5a5b9eb032
SHA16cc143c7b775c5598b678ce2595f1aec9f3aa170
SHA2560b8ad4dd1ae4c2291def86c54007cb3dda125f60039dd7fcf69d0d4d51f0b79d
SHA5128e7db51484997cd3ae48abc7a336163900e338d87e6a1faa909f49a585af4d27e0e20292f9092edd304b43fd90ba096f8c14242897dc24589ab2766bc94ba86d
-
C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.jsonFilesize
1KB
MD533763fda19d288e139cffe5c39cd5ff3
SHA1f4af5c085b44474dca596fa6a1975ea8524a941e
SHA2564ebfeae2b55155bee7bde8d1d49ec52e909c8b0d8483dd7ae64676712aa5e1f1
SHA512a3bd78d019c3d4398da280c2777f05234f07264808aa850d2e60e149034130d3aebcedfad7167cab238c9f94e5c3fb0dcb59a11b53fc4d79b20140f174b27190
-
C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.jsonFilesize
1KB
MD5eac887cd7ac59e3f20663104f08101c9
SHA1874a8885675149046c1e1db75bf6e5b5413b6925
SHA256d78001e6314da55842ec6da1771eab9e5efc8c747bb087c11f99239b594c3485
SHA512108571a17da8de660094eea039bee01f56c4632b7dd9558c6450e28969732e23dce610cf09b6dc7635b4ddecb75e569cfc36fe29d0c299f0e4cb26785853a003
-
C:\ProgramData\Malwarebytes\MBAMService\config\VPNControllerConfig.jsonFilesize
1KB
MD5c9bc920ebbb331f292af1ce8f8362d7b
SHA1c944b4f39a43c65d25643aaf76844876dc1b2ff1
SHA2564e551b39d09e0d3839d55ff289bb137e95a100f6180c461acf146a222b1f2807
SHA5122eaaef525c60afdf5cd66217405ff87e50f7917398ef81c82d6cb8e86d26b4cbf15825fa7cde45dfe6c23e89bd4dfc9a5709205b8ef2ac11b71126699fbb9c48
-
C:\ProgramData\Malwarebytes\MBAMService\config\VPNControllerConfig.jsonFilesize
1KB
MD54008e81b60d01c8b5837997429943f5d
SHA1de2019b2237c2d018e3fb0382be8c10d6af9673b
SHA2560dcfdc06755361ea91ebb0d356bada37ee1aaaf23da06c9e88e424882f506cdc
SHA512bd81b56b375a2b671b957d80fa67bf068cb1ca31f94c2d9ec779fe3f23c5c6cf96207e47ecc14aa196ce09e5284cdd57559249200f701bdc5a20fd9c66862dd1
-
C:\ProgramData\Malwarebytes\MBAMService\config\VPNServerListConfig.jsonFilesize
125B
MD578daa2ed414f7d5e40755e49077d3992
SHA1186bb967d3946d03c097fccc00f97221e07104dc
SHA2569385d6734334374b774eb9b5a45471ae28cebb667965c54200791a8e2292330d
SHA5126faf166673497b2179db05a17f96dd15e527eee1ce530b5ca6419cb87bb8d117f2709bb10c5bf828a99e2c2ef0432c2d75f5b8e303bf981aa0d084d10f2041f3
-
C:\ProgramData\Malwarebytes\MBAMService\dds_tmp\D16.tmpFilesize
116KB
MD5699dd61122d91e80abdfcc396ce0ec10
SHA17b23a6562e78e1d4be2a16fc7044bdcea724855e
SHA256f843cd00d9aff9a902dd7c98d6137639a10bd84904d81a085c28a3b29f8223c1
SHA5122517e52f7f03580afd8f928c767d264033a191e831a78eed454ea35c9514c0f0df127f49a306088d766908af7880f713f5009c31ce6b0b1e4d0b67e49447bfff
-
C:\ProgramData\Malwarebytes\MBAMService\dds_tmp\D1B.tmpFilesize
1.1MB
MD53b337c2d41069b0a1e43e30f891c3813
SHA1ebee2827b5cb153cbbb51c9718da1549fa80fc5c
SHA256c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
SHA512fdb3012a71221447b35757ed2bdca6ed1f8833b2f81d03aabebd2cd7780a33a9c3d816535d03c5c3edd5aaf11d91156842b380e2a63135e3c7f87193ad211499
-
C:\ProgramData\Malwarebytes\MBAMService\dds_tmp\D1E.tmpFilesize
4.7MB
MD5a7b7470c347f84365ffe1b2072b4f95c
SHA157a96f6fb326ba65b7f7016242132b3f9464c7a3
SHA256af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
SHA51283391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d
-
C:\ProgramData\Malwarebytes\MBAMService\dds_tmp\D22.tmpFilesize
504KB
MD5b5d0f85e7c820db76ef2f4535552f03c
SHA191eff42f542175a41549bc966e9b249b65743951
SHA2563d6d6e7a6f4729a7a416165beabda8a281afff082ebb538df29e8f03e1a4741c
SHA5125246ebeaf84a0486ff5adb2083f60465fc68393d50af05d17f704d08229ce948860018cbe880c40d5700154c3e61fc735c451044f85e03d78568d60de80752f7
-
C:\ProgramData\Malwarebytes\MBAMService\dds_tmp\D32.tmpFilesize
1.8MB
MD5804b9539f7be4ece92993dc95c8486f5
SHA1ec3ca8f8d3cd2f68f676ad831f3f736d9c64895c
SHA25676d0da51c2ed6ce4de34f0f703af564cbefd54766572a36b5a45494a88479e0b
SHA512146c3b2a0416ac19b29a281e3fc3a9c4c5d6bdfc45444c2619f8f91beb0bdd615b26d5bd73f0537a4158f81b5eb3b9b4605b3e2000425f38eeeb94aa8b1a49f2
-
C:\ProgramData\Malwarebytes\MBAMService\dds_tmp\D6A.tmpFilesize
1.2MB
MD5607039b9e741f29a5996d255ae7ea39f
SHA19ea6ef007bee59e05dd9dd994da2a56a8675a021
SHA256be81804da3077e93880b506e3f3061403ce6bf9ce50b9c0fcc63bb50b4352369
SHA5120766c98228f6ccc907674e3b9cebe64eee234138b8d3f00848433388ad609fa38d17a961227e683e92241b163aa30cf06708a458f2bc4d3704d5aa7a7182ca50
-
C:\ProgramData\Malwarebytes\MBAMService\dds_tmp\DAA.tmpFilesize
68KB
MD554dde63178e5f043852e1c1b5cde0c4b
SHA1a4b6b1d4e265bd2b2693fbd9e75a2fc35078e9bd
SHA256f95a10c990529409e7abbc9b9ca64e87728dd75008161537d58117cbc0e80f9d
SHA512995d33b9a1b4d25cd183925031cffa7a64e0a1bcd3eb65ae9b7e65e87033cd790be48cd927e6fa56e7c5e7e70f524dccc665beddb51c004101e3d4d9d7874b45
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\Actions.dllFilesize
4.5MB
MD520d70c6e04dbf14c01ab2d756e97854f
SHA1f172c8b8c0e87d2a9ab064513dce004d16d03e0d
SHA256c4002339b58bc493ae3540bafe1b2ca0a70bba0f853e29f60e0f6a1680fa9a24
SHA51213e073cd4b3d53c6d9fdda671a55962266b5c0a18abcb5774092c35f0d0bf2c5d0d9802d8955d32cceb166821634bfc067dac7809c9ade143cf3a3b497743b36
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\BrowserSDKDLL.dllFilesize
5.4MB
MD5a3fe79081a59d493c01b5c1139babdc9
SHA11505cb4053bcd9b55c40227ad6b62a2457cebbdf
SHA25660c8c024ff020f04fcccec10ee78872bb1e6985463d6370c6af095761d88b860
SHA51222310a585edb36050ff20356cd9eb5129cdae3ffea2ccd7a54d9652dbd336d7f402ed119dc59ae3250b93bad40e75983184256c0bb239cff049bbb983f487bdc
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\Global.nmFilesize
335KB
MD508e1e49f695c1982c9fb804e375a0d7e
SHA16b2304a055cb5b7a0841c8e647f81c69776309c4
SHA2567594c8779ae6969e96630fec20fe5dcdd2ebe2f55823214c6536a965fbb7fa30
SHA512dce3dd8466b70e293171139fe73208c5c8bcb1069f674b5178f937040183c70d84cf8141faac4a5a01b4fd70e85e827bf36c4b968579a8b40aa9f8e05b41a7f7
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\Global.srFilesize
14.5MB
MD594bb8196b21032e92cc249e785ea17ac
SHA1f68f5db6dbfc0b9ef9a82bba0c68e9125fdbb477
SHA256c9842b0d14fcea90c3dab8c7b7241ee990bc4cb9f194fba6f2011e4a3f335135
SHA5129c8197be300d0e867f2611686762d9ada3ae4c2dd013fda6c5be51781d1ba0834763083827d323a7565a2860a8e0986c41e0a4565af5f3d3d69f8250121f8f42
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\cfg.binFilesize
845B
MD51bea85f6f77b365122fd5f51b10777e3
SHA12431dda3ae3310739fdbc59a1c40aadf5b0c5e2f
SHA256ebb6bfbcb66f79d34e10c57e70b26aee5f99e11207e6f103c660b4c2a005f771
SHA51201402e189787bb653c14400721acd55ed2ae78f94c4ce9d0c9b9fd8a49ee504136bee56deaf24291e0594dfc73489a973d54f2e19094ea21f061cad2daf35460
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\ig.exeFilesize
1.8MB
MD5478df352bc79ef18c258b53f662b0885
SHA1e80aff69534545fa437074818da66c5b06ce85a7
SHA25695370683adaec8d785ee7368d590cac8de0e7add72c88c24aaefcbfde9ac1826
SHA5121771d6d85614369c810a52c2044b4e8b6014fe4ee62c1586b28442eafdd0db50c9d514a3e0c94cca2a2450da2fca19ddca74608dea5ab0edf87a7d78b34685bb
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\sample.dllFilesize
529KB
MD571c2939bcb601b29868a2549fc22a827
SHA1e4065e0a62cd60915ebae2d510830f50b3a4c266
SHA2561a2348213858488dfb80c9ae5ed650352879a9593c776e56edea92ea1c1e146f
SHA512ba2f9a22a3be1f470dfa7ea933eee04d4fcd5c8b38b0d2d3ed38d197e5f3aa3ecf3f82fdcd11aad34bb427ea39ea394220ba1a628c6aed3d6c80289b795b1028
-
C:\ProgramData\Malwarebytes\MBAMService\pkgvers.datFilesize
75B
MD5d1b0dda720b52477dd0691036803f8e8
SHA12ad5ad646267cf262d96249f4bf833bc7b80df1f
SHA256804f1983d1c7b189d58a99d384af01eea794c7eb7508fc237f05c1d1b9916edc
SHA512c4a2d24157f0e82c599a53638461e0c0615012b4ecf112006bfdd579cfca022001653e44655f122f89a92cbb99ef016dc0360039d9f53b9c5247e4f7a9e848ab
-
C:\ProgramData\Malwarebytes\MBAMService\updatrpkg\SdkDbUpdatrV5.dllFilesize
2.6MB
MD55c4b6998682070ad73cd246eae251ccb
SHA1d4e3eef6332a6598e5d63741f3407574c7de5f5b
SHA25654e0e90cc5cfef91ceab363c6cad54c7190cfbbecf6353181779938a3f8de8a1
SHA512e1f844ecb631b628ff37068ef474b070e22c5be6453c77acde53e886b7e9109f22d09748a7902e64237f5cc9d05818080c0bb5697918235ea2d4ceefb68b8524
-
C:\ProgramData\Malwarebytes\MBAMService\updatrpkg\mbupdatrV5.exeFilesize
5.9MB
MD529f9d89e02980685ff1f024468dd2316
SHA1eb0bdd93268b2a553bc1b9f34c06803f26e981cc
SHA2562d2d04f3f4c09222accadd7ee64c57b5d9b7c96f5aaaa7aa8f2be7b717e47e56
SHA512cd828a4c373686b4a8fd885fdb507987d5708c8f6b665af27ad038aed9313bddc646fd3fbe8b09149eef6c4dfd9149ddfcac80b0c02087f88d6ce5961fb02309
-
C:\ProgramData\Malwarebytes\MBAMService\version.datFilesize
26B
MD55a640bba568c313332bc71f4b52acd2d
SHA1eda253fe1a4027ee6690d473c8a052b2c6ee2e6a
SHA25624e4cc445b0929cefa003912e07d976f86109fdf6fb675502a8390ad63ee19c5
SHA5128fbc23daea0a15971addf3e0879f95c2bf4246fcf8d1b2bd777608b63faf5e6b2e2c62fc557c80fc46523e29420c92ff6ae70fa97fa801122d8235baa64662d5
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD52daa93382bba07cbc40af372d30ec576
SHA1c5e709dc3e2e4df2ff841fbde3e30170e7428a94
SHA2561826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30
SHA51265635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5ecdc2754d7d2ae862272153aa9b9ca6e
SHA1c19bed1c6e1c998b9fa93298639ad7961339147d
SHA256a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7
SHA512cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
2KB
MD5449a35c2426aab1fdb39656d8309d4b2
SHA128981231a2bb60d4bd6e5c28d7e1ab78966dade2
SHA2563eb9b68cfe097e821fd5ae7962edbcf9f583f800151530910ba18f22f87bc804
SHA512af4cdad0196a197ff08e9c4f97619ed2c37db1576313aace34017bceb344c1f6681b7a5a75b116e6fbcd4f935cbef0892a156082624e945f70efb11d53f125ba
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
1KB
MD5182b0dab1e8b7d66ec9483af083b4c02
SHA15e92244c4e436da13be053b58bc4b958a2106890
SHA25603bf93cc67405b2e82607bf3ba3075cf636ebe0ac1d6f8df8c32adf163d017f3
SHA512453075ec19a88315656b02504e625d3feed4827b2d851cb03e9db5472885111f3a981474118521a79e5cc029fe5c3dcaf760ab6ac2155d751138ea801874a19a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
7KB
MD58b7bfc134ef6675389def77619fbd9d5
SHA1a09fe14d5782563375acbf617a20dbd77b465064
SHA256ea0ecfea09192c5cea36902a828f9f0d0c91ba81d69619c740cc4819efd51c8c
SHA5121e29c8ce79b8bd32628c1b89cc53158f934d7a783eccd009b9407836db5299f6ccee0bd3760c9c91e6085e6e880c7170dbebf05b902bdeeec178d92c645b968f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD5c9d343901ba11f78ba93e159ad433080
SHA19929fa3545091cde1b413ee10bbd554a5e9cc165
SHA256621aa0ccf413e183040991a4b75b66698985100d54dc59f9d4d4b164e8823e13
SHA512b149479d46ad06fa7c0bc6e22c0dfdbe6959d9162b88791e29993de6255f1474e079b63ad8f1e239b290297a9eb1cb482eec2b4096946ede4d84898f31ba67c6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5bc8aeab940eeb085463e6668982e0692
SHA163e7a767f38a4dd1978aa06acae9193e4fb32799
SHA2563dea83da441d8b75cbc19ea14781a51d01b0b602330ae25ef70cb9da8af9aa73
SHA5129ac78f655b443850a23b24bb2cbb998b9cc148235340cde7b0b555c04d35f6b1cb7d2d06178a89d293dfad4a5b3d13f48e50301059f4d61fb275a4acdc57dccd
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
7KB
MD500285ec2196139d75e8e1f1b75909c4d
SHA1b8cf0bf4d9d87275554ec0f49273d8732a55275d
SHA256cb8a338d5a88f973da87276a970c82fbe8825802722f51ae9ae2a9a83412fe0a
SHA51248dddff102452dafc5d4f6dc22e1cc61c9f0d59567636c09066b7c13571daad09b5a5e504330fedb175015cd1391fd2579c2ca82fcc9df341c282e6115a9f093
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
1KB
MD5ddc69c386cc958beec0036308a91aef2
SHA1a2bc73f0088172dd6d898552d5ea3bb4b2b38512
SHA256be1d992610d9370c558bdbcf164cb9db94e703557c4839d29a8560aa1f4f1f6b
SHA5125f2b681a5a21548bd50e7de36846fade29810df7231db3c8553a0a4e104444b844432dfd9b4fb4feadf9f6606a8fb019eeb3d9d45c413fac20fc12fa460ab5d0
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d040.TMPFilesize
1KB
MD58af7a04d5045f8bc4ced00f06dacee79
SHA171d4261fd4182e299beb478329dd744b2a31460d
SHA2563c32a83a4d8d59b44644fe252c70d2b509def489eb272256a33a2c5c87811850
SHA5129255582c58281bf0dad95e46b7495514df88a1a1464ba521dc713cc29bf650b03ddd6ee0bdddcd72628da851fd6f2b2cc999ea8519d509ef9b0b359c54228ee9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD53a6698a5774d735d6de81e438b43ffad
SHA1517e633f7740fd6c689a9e38b6d0d36fc29ef05d
SHA256902300c4aad42726ee9485ad4c12315397869fad7dfa72c12f5452cedebdf80e
SHA5129f55c59c5b1f6d34895670664a4ce98ba8b8c505fe5c1252d03c825f505ed1fc40f2b193794d585c00026ced97ced314551042e9ed5f43ba5104ff8bfb1b881c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD5d9a5b11856dbd145f9b1b5f965008c79
SHA17c55af3a428b3db3f028e0205e7e818889fd22b6
SHA256e830bb216256a8aba75e6ae7febc8be1516d20495aa0830c315bf01060d8d089
SHA512725f414d6879c5cb496c2eb4fd8606841c881fe4415d5ec8bd770315c594b0db5f548756510491fb438a5692df07709aa81e23cda9e46e778be62c1a0d4d197e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD518162902355016c9e9d23c09c912b2a7
SHA18595341bbc95070d5285636b52bfb9120a85385b
SHA25684827c50883bec4fc7789e913d873566ae18bf5f690b443e06a51f7c4650abb2
SHA512c0f261bbda90846ee83ae8a9b0813db40e82e5e6ed14b11f06ae3daa81c047b6561481ed6b5d0da1239a602aa6d2ee95ddda1ae45ace672f37f16798e686452f
-
C:\Users\Admin\Downloads\MBSetup.exeFilesize
2.5MB
MD56107ffe4a1a1ee9eb2453ca669791ac9
SHA18f69617ffd69adab260500ec25d5ae50cc49b882
SHA2563c68baabc345c58d95825e548a395d305775b7f0313ec42997c17870ea6a458f
SHA512305ed565d5b61271e3deac9ab254ce2d70c031f4713c9b37212ea56ff061b8ce0afb5002c02a5252991c506d217f3f6aad439c192384646432f2ae71c252fb56
-
C:\Windows\System32\CatRoot2\dberr.txtFilesize
22KB
MD58198cdeed545ca056353fc3a83242e79
SHA1be8194fde310875281faabfcda28915acd46ae83
SHA2560b8e25f5101d991a65702608548d22da847728e3f0f901ba5e285bad4077238f
SHA512b1a936949c91fa56a77efbdede2966b0fd1923f369db7ca8a62aa028565f681aff2b04d43c456cd7685f2e63107833c2b200ec0e9cb703cbc24ee38797e706fe
-
C:\Windows\System32\catroot2\dberr.txtFilesize
22KB
MD50fcedc42a5e7bb680d9b0fb13b6a760b
SHA16b4d250cd6228b71b078e65b1fea45422ab3fa9f
SHA2561bf46f8eb48a12683649fb01cb3dc536ae8328a59fc6959b3c744ec84d78c657
SHA512aeae8ce719ba31711c1730620c3b246b02e1bed4a08545f52eb0e1eecbc2f3083441bfd29cbe17a2257cdcea7d7932315f0cd007d9c434908438a1d53d713796
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\21EA03E12A6F9D076B6BC3318EA9363E_6EF0095DA824AE045AE9FC5B645DF095Filesize
5B
MD55bfa51f3a417b98e7443eca90fc94703
SHA18c015d80b8a23f780bdd215dc842b0f5551f63bd
SHA256bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128
SHA5124cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399
-
C:\Windows\System32\drivers\mbam.sysFilesize
76KB
MD5113e213914c40631aedef185984c5629
SHA157bf886bfe1e4d765ea43e4c91709a5c4a9a024a
SHA256d314cea3ba19c49342763fca6b64a33f12d730a8fa531ed9f7e75675035ba004
SHA51276d7286963f28430d8a9bc3b59adf209b5fceb6a5248b7be54c60fff0b931ba2cf46a779f7e66008baa0853ad6ce55a4b9dd56e33574230d1e2588f7679630b8
-
C:\Windows\System32\drivers\mbamswissarmy.sysFilesize
233KB
MD54b2cc2d3ebf42659ea5e6e63584e1b76
SHA10042da8151f2e10a31ecceb60795eb428316e820
SHA2563db4366ccb9d94062388000926c060e2524c7d3ee4b6b7c7cf06f909f747fc6c
SHA512804d64d346b3dbb1ce3095a5d0fa7acc5da0bf832c458e557dac486559fe53144f15f08c444fea84a01471fd5981e68801a809b143c56b5b63e3e16de9db0d98
-
C:\Windows\Temp\MBInstallTemp6aa6d83f19d411efb0b1fe5db4a87adc\7z.dllFilesize
2.5MB
MD5a144e24209683e3cba6e29dab5764162
SHA1ab2112cce717bec8f5667721a072d790484095ec
SHA256b2ff9dbf90cbd0c45cd7d95ce4892377ec7e92970e05f2e56b0ce93861190348
SHA5122c823981b53b7eb7c1b726468d3b28c234c7e555aab35e759e88d38658566d267a20867f1cb18d96c830e7d53643629a9fa313eecee8b553703086fbb64cc984
-
C:\Windows\Temp\MBInstallTemp6aa6d83f19d411efb0b1fe5db4a87adc\ctlrpkg\Malwarebytes_Assistant.runtimeconfig.jsonFilesize
372B
MD5d94cf983fba9ab1bb8a6cb3ad4a48f50
SHA104855d8b7a76b7ec74633043ef9986d4500ca63c
SHA2561eca0f0c70070aa83bb609e4b749b26dcb4409784326032726394722224a098a
SHA51209a9667d4f4622817116c8bc27d3d481d5d160380a2e19b8944bdd1271a83f718415ce5e6d66e82e36819e575ec1b55f19c45213e0013b877b8d61e6feb9d998
-
C:\Windows\Temp\MBInstallTemp6aa6d83f19d411efb0b1fe5db4a87adc\ctlrpkg\mbae64.sysFilesize
154KB
MD595515708f41a7e283d6725506f56f6f2
SHA19afc20a19db3d2a75b6915d8d9af602c5218735e
SHA256321058a27d7462e55e39d253ad5d8b19a9acf754666400f82fe0542f33e733c6
SHA512d9230901adeecb13b1f92287abe9317cdac458348885b96ef6500960793a7586c76ae374df053be948a35b44abe934aa853975a6ccd3788f93909903cc718c08
-
C:\Windows\Temp\MBInstallTemp6aa6d83f19d411efb0b1fe5db4a87adc\dbclspkg\MBAMCoreV5.dllFilesize
6.7MB
MD565dae541c8dbc3e18f1bc9150ffad616
SHA1f9c98b9eee98e94240c425a4548aae1b5d943ea6
SHA25675249cc6d5ddbb92a76f6750165380eb3b6182cdd4733d8a18003b7dfc88b558
SHA5124f2755add2fa384d617e7bd6d5d2c793503b54a284eb04be78682a0b6cfa7e6369995ae6625bd085ba2887b5034760323dfc61c2b28ea6db91b9d17a8394e988
-
C:\Windows\Temp\MBInstallTemp6aa6d83f19d411efb0b1fe5db4a87adc\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\mscordaccore.dllFilesize
1.3MB
MD53143ffcfcc9818e0cd47cb9a980d2169
SHA172f1932fda377d3d71cb10f314fd946fab2ea77a
SHA256b7fb9547e4359f6c116bd0dbe36a8ed05b7a490720f5a0d9013284be36b590b7
SHA512904800d157eb010e7d17210f5797409fea005eed46fbf209bca454768b28f74ff3ff468eaad2cfd3642155d4978326274331a0a4e2c701dd7017e56ddfe5424b
-
C:\Windows\Temp\MBInstallTemp6aa6d83f19d411efb0b1fe5db4a87adc\servicepkg\MBAMService.exeFilesize
8.5MB
MD58c89563b4351b2c39d94c81ec37ace7b
SHA14c238dcd62b99226b3ac1a67c7b7c2cc2ad1edf4
SHA256d17e0a77d02d5875318c14af09ee900bc4bafb87a96b2f84dfc9ef7656884228
SHA5128f1421c8a553acc7d4541cf6d319ab97abf2803a2c0c83ac7ac8d1dc9335eeb0bd911e79a0bedc14e65f1eb523efb76f9cfea0dd71a79e43c9501c954546ef2a
-
C:\Windows\Temp\MBInstallTemp6aa6d83f19d411efb0b1fe5db4a87adc\servicepkg\mbamelam.catFilesize
10KB
MD560608328775d6acf03eaab38407e5b7c
SHA19f63644893517286753f63ad6d01bc8bfacf79b1
SHA2563ed5a1668713ef80c2b5599b599f1434ad6648999f335cf69757ea3183c70c59
SHA5129f65212121b8a5d1a0625c3baa14ef04a33b091d26f543324333e38dcdb903e02ccc4d009e22c2e85d2f61d954e0b994c2896e52f685003a6ef34758f8a650c7
-
C:\Windows\Temp\MBInstallTemp6aa6d83f19d411efb0b1fe5db4a87adc\servicepkg\mbamelam.infFilesize
2KB
MD5c481ad4dd1d91860335787aa61177932
SHA181633414c5bf5832a8584fb0740bc09596b9b66d
SHA256793626d240fd8eefc81b78a57c8dfe12ea247889b6f07918e9fd32a7411aa1c3
SHA512d292e028936412f07264837d4a321ecfa2f5754d4048c8bcf774a0e076e535b361c411301558609d64c71c1ce9b19e6041efa44d201237a7010c553751e1e830
-
C:\Windows\Temp\MBInstallTemp6aa6d83f19d411efb0b1fe5db4a87adc\servicepkg\mbamelam.sysFilesize
20KB
MD59e77c51e14fa9a323ee1635dc74ecc07
SHA1a78bde0bd73260ce7af9cdc441af9db54d1637c2
SHA256b5619d758ae6a65c1663f065e53e6b68a00511e7d7accb3e07ed94bfd0b1ede0
SHA512a12ccf92bead694f5d3cba7ff7e731a2f862198efc338efc7f33a882fe0eb7499fb3fb533538d0a823e80631a7ca162962fbdfd78e401e3255672910b7140186
-
\??\pipe\LOCAL\crashpad_4868_MGLRPBYHWJEVEGKYMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/3500-1-0x0000000002E60000-0x0000000003260000-memory.dmpFilesize
4.0MB
-
memory/3500-0-0x0000000000560000-0x0000000000561000-memory.dmpFilesize
4KB
-
memory/5268-4633-0x000002AD87AA0000-0x000002AD87FF2000-memory.dmpFilesize
5.3MB
-
memory/5268-5399-0x000002AD87AA0000-0x000002AD87FF2000-memory.dmpFilesize
5.3MB
-
memory/5268-3767-0x000002AD87AA0000-0x000002AD87FF2000-memory.dmpFilesize
5.3MB
-
memory/5268-4848-0x000002AD87AA0000-0x000002AD87FF2000-memory.dmpFilesize
5.3MB
-
memory/5268-5494-0x000002AD87AA0000-0x000002AD87FF2000-memory.dmpFilesize
5.3MB
-
memory/5268-4963-0x000002AD87AA0000-0x000002AD87FF2000-memory.dmpFilesize
5.3MB
-
memory/5268-5511-0x000002AD87AA0000-0x000002AD87FF2000-memory.dmpFilesize
5.3MB
-
memory/5268-4692-0x000002AD87AA0000-0x000002AD87FF2000-memory.dmpFilesize
5.3MB
-
memory/5268-4998-0x000002AD87AA0000-0x000002AD87FF2000-memory.dmpFilesize
5.3MB
-
memory/5268-5196-0x000002AD87AA0000-0x000002AD87FF2000-memory.dmpFilesize
5.3MB
-
memory/5268-5588-0x000002AD87AA0000-0x000002AD87FF2000-memory.dmpFilesize
5.3MB
-
memory/5268-5612-0x000002AD87AA0000-0x000002AD87FF2000-memory.dmpFilesize
5.3MB
-
memory/5268-5613-0x000002AD87AA0000-0x000002AD87FF2000-memory.dmpFilesize
5.3MB