Analysis
-
max time kernel
139s -
max time network
279s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
26-05-2024 11:21
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://www.google.com
Resource
win11-20240426-en
General
-
Target
http://www.google.com
Malware Config
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
MBSetup.exedescription pid process target process PID 404 created 3352 404 MBSetup.exe Explorer.EXE -
Downloads MZ/PE file
-
Drops file in Drivers directory 9 IoCs
Processes:
MBSetup.exeMBAMService.exeMBAMInstallerService.exeMBAMService.exedescription ioc process File created C:\Windows\SysWOW64\drivers\mbamtestfile.dat MBSetup.exe File created C:\Windows\system32\DRIVERS\mwac.sys MBAMService.exe File created C:\Windows\system32\DRIVERS\farflt11.sys MBAMService.exe File created C:\Windows\system32\DRIVERS\mbam.sys MBAMService.exe File created C:\Windows\system32\drivers\mbae64.sys MBAMInstallerService.exe File created C:\Windows\system32\DRIVERS\MbamElam.sys MBAMService.exe File opened for modification C:\Windows\system32\DRIVERS\MbamElam.sys MBAMService.exe File created C:\Windows\system32\DRIVERS\mbamswissarmy.sys MBAMService.exe File created C:\Windows\system32\DRIVERS\MbamChameleon.sys MBAMService.exe -
Modifies RDP port number used by Windows 1 TTPs
-
Sets service image path in registry 2 TTPs 2 IoCs
Processes:
MBAMService.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mbamchameleon\ImagePath = "\\SystemRoot\\System32\\Drivers\\MbamChameleon.sys" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MBAMSwissArmy\ImagePath = "\\SystemRoot\\System32\\Drivers\\mbamswissarmy.sys" MBAMService.exe -
Checks BIOS information in registry 2 TTPs 6 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
mbupdatrV5.exeMBSetup.exeMBAMService.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate mbupdatrV5.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion MBSetup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate MBSetup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion MBAMService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate MBAMService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion mbupdatrV5.exe -
Executes dropped EXE 14 IoCs
Processes:
MBSetup.exeMBAMInstallerService.exeMBVpnTunnelService.exeMBAMService.exeMBAMService.exeMalwarebytes.exeMalwarebytes.exeMalwarebytes.exeMBAMWsc.exembupdatrV5.exeig.exeig.exeig.exeig.exepid process 404 MBSetup.exe 812 MBAMInstallerService.exe 3612 MBVpnTunnelService.exe 4460 MBAMService.exe 2824 MBAMService.exe 1804 Malwarebytes.exe 2488 Malwarebytes.exe 5064 Malwarebytes.exe 2416 MBAMWsc.exe 3120 mbupdatrV5.exe 4836 ig.exe 4896 ig.exe 2800 ig.exe 2132 ig.exe -
Loads dropped DLL 64 IoCs
Processes:
MBAMInstallerService.exeMBVpnTunnelService.exeMBAMService.exeMalwarebytes.exepid process 812 MBAMInstallerService.exe 812 MBAMInstallerService.exe 812 MBAMInstallerService.exe 3612 MBVpnTunnelService.exe 2824 MBAMService.exe 2824 MBAMService.exe 2824 MBAMService.exe 2824 MBAMService.exe 2824 MBAMService.exe 2824 MBAMService.exe 2824 MBAMService.exe 2824 MBAMService.exe 2824 MBAMService.exe 2824 MBAMService.exe 2824 MBAMService.exe 2824 MBAMService.exe 2824 MBAMService.exe 2824 MBAMService.exe 2824 MBAMService.exe 2824 MBAMService.exe 2824 MBAMService.exe 2824 MBAMService.exe 2824 MBAMService.exe 2824 MBAMService.exe 2824 MBAMService.exe 2824 MBAMService.exe 2824 MBAMService.exe 2824 MBAMService.exe 2824 MBAMService.exe 2824 MBAMService.exe 812 MBAMInstallerService.exe 1804 Malwarebytes.exe 1804 Malwarebytes.exe 1804 Malwarebytes.exe 1804 Malwarebytes.exe 1804 Malwarebytes.exe 1804 Malwarebytes.exe 1804 Malwarebytes.exe 1804 Malwarebytes.exe 1804 Malwarebytes.exe 1804 Malwarebytes.exe 1804 Malwarebytes.exe 1804 Malwarebytes.exe 1804 Malwarebytes.exe 1804 Malwarebytes.exe 1804 Malwarebytes.exe 1804 Malwarebytes.exe 1804 Malwarebytes.exe 1804 Malwarebytes.exe 1804 Malwarebytes.exe 1804 Malwarebytes.exe 1804 Malwarebytes.exe 1804 Malwarebytes.exe 1804 Malwarebytes.exe 1804 Malwarebytes.exe 1804 Malwarebytes.exe 1804 Malwarebytes.exe 1804 Malwarebytes.exe 1804 Malwarebytes.exe 1804 Malwarebytes.exe 1804 Malwarebytes.exe 1804 Malwarebytes.exe 1804 Malwarebytes.exe 1804 Malwarebytes.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Registers COM server for autorun 1 TTPs 64 IoCs
Processes:
MBAMService.exeMBAMService.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9DAB0CA5-AE19-41AE-955C-41DD44C52697}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{11D1E5E8-14E1-4B5B-AE1A-2678CB91E8E5}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{251AD013-20AD-4C3F-8FE2-F66A429B4819}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36A65E46-6CC1-4CA2-B51E-F4DD8C993DDC}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{05098CD5-9914-48C2-A453-DB782F55A65F}\InProcServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F36AD0D0-B5F0-4C69-AF08-603D177FEF0E}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{11D1E5E8-14E1-4B5B-AE1A-2678CB91E8E5}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BF474111-9116-45C6-AF53-209E64F1BB53}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{17BE78EE-B40A-4B9E-835F-38EC62F9D479}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D5599B6B-FA0C-45B5-8309-853B003EA412}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36A65E46-6CC1-4CA2-B51E-F4DD8C993DDC}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DE03E614-112D-43E0-8E15-E7236CC32108}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DE03E614-112D-43E0-8E15-E7236CC32108}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DE03E614-112D-43E0-8E15-E7236CC32108}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57CE581A-0CB6-4266-9CA0-19364C90A0B3}\InprocServer32\ThreadingModel = "Apartment" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F415899A-1576-4C8B-BC9F-4854781F8A20}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F36AD0D0-B5F0-4C69-AF08-603D177FEF0E}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{11D1E5E8-14E1-4B5B-AE1A-2678CB91E8E5}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D372F21-E6DA-4B82-881A-79F6CA6B6AE1}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D372F21-E6DA-4B82-881A-79F6CA6B6AE1}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D5599B6B-FA0C-45B5-8309-853B003EA412}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F6D29500-933C-447C-9D88-9D814AF73808}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{580243BF-3CEE-4131-A599-C6FED66BEB1B}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{03141A2A-5C3A-458E-ABEC-0812AD7FF497}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36A65E46-6CC1-4CA2-B51E-F4DD8C993DDC}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{376BE474-56D4-4177-BB4E-5610156F36C8}\LocalServer32 MBAMService.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F36AD0D0-B5F0-4C69-AF08-603D177FEF0E}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{05098CD5-9914-48C2-A453-DB782F55A65F}\InProcServer32\ = "C:\\PROGRAM FILES\\MALWAREBYTES\\ANTI-MALWARE\\mbamsi64.dll" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F415899A-1576-4C8B-BC9F-4854781F8A20}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F415899A-1576-4C8B-BC9F-4854781F8A20}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E1AC7139-D1FF-4DE9-84A4-92E2B47F5D2A}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F6D29500-933C-447C-9D88-9D814AF73808}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F6D29500-933C-447C-9D88-9D814AF73808}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{05098CD5-9914-48C2-A453-DB782F55A65F}\InProcServer32\ThreadingModel = "Both" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BF474111-9116-45C6-AF53-209E64F1BB53}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F1C46F8-E697-4175-B240-CDE682A4BA2D}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E1AC7139-D1FF-4DE9-84A4-92E2B47F5D2A}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE8A9269-9E6E-4683-BCD3-41E9B16696DC}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9DAB0CA5-AE19-41AE-955C-41DD44C52697}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9DAB0CA5-AE19-41AE-955C-41DD44C52697}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57CE581A-0CB6-4266-9CA0-19364C90A0B3}\InprocServer32\ = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbshlext.dll" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{278637DA-FDFB-45C7-8CD8-F2D8A9199AB0}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{580243BF-3CEE-4131-A599-C6FED66BEB1B}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{251AD013-20AD-4C3F-8FE2-F66A429B4819}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D372F21-E6DA-4B82-881A-79F6CA6B6AE1}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{376BE474-56D4-4177-BB4E-5610156F36C8}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F1C46F8-E697-4175-B240-CDE682A4BA2D}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{278637DA-FDFB-45C7-8CD8-F2D8A9199AB0}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BF474111-9116-45C6-AF53-209E64F1BB53}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E1AC7139-D1FF-4DE9-84A4-92E2B47F5D2A}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{130CD414-6BFD-4F6C-9362-A2264B222E76}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{580243BF-3CEE-4131-A599-C6FED66BEB1B}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{03141A2A-5C3A-458E-ABEC-0812AD7FF497}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F36AD0D0-B5F0-4C69-AF08-603D177FEF0E}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{130CD414-6BFD-4F6C-9362-A2264B222E76}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE8A9269-9E6E-4683-BCD3-41E9B16696DC}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE8A9269-9E6E-4683-BCD3-41E9B16696DC}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D5599B6B-FA0C-45B5-8309-853B003EA412}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57CE581A-0CB6-4266-9CA0-19364C90A0B3}\InprocServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{251AD013-20AD-4C3F-8FE2-F66A429B4819}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{17BE78EE-B40A-4B9E-835F-38EC62F9D479}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{17BE78EE-B40A-4B9E-835F-38EC62F9D479}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{278637DA-FDFB-45C7-8CD8-F2D8A9199AB0}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F1C46F8-E697-4175-B240-CDE682A4BA2D}\LocalServer32 MBAMService.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
MBAMService.exeMBAMInstallerService.exedescription ioc process File opened (read-only) \??\A: MBAMService.exe File opened (read-only) \??\J: MBAMService.exe File opened (read-only) \??\U: MBAMService.exe File opened (read-only) \??\V: MBAMService.exe File opened (read-only) \??\E: MBAMInstallerService.exe File opened (read-only) \??\N: MBAMInstallerService.exe File opened (read-only) \??\X: MBAMInstallerService.exe File opened (read-only) \??\L: MBAMService.exe File opened (read-only) \??\M: MBAMService.exe File opened (read-only) \??\P: MBAMService.exe File opened (read-only) \??\T: MBAMService.exe File opened (read-only) \??\R: MBAMInstallerService.exe File opened (read-only) \??\B: MBAMService.exe File opened (read-only) \??\E: MBAMService.exe File opened (read-only) \??\O: MBAMService.exe File opened (read-only) \??\R: MBAMService.exe File opened (read-only) \??\B: MBAMInstallerService.exe File opened (read-only) \??\K: MBAMInstallerService.exe File opened (read-only) \??\Q: MBAMInstallerService.exe File opened (read-only) \??\Y: MBAMInstallerService.exe File opened (read-only) \??\Q: MBAMService.exe File opened (read-only) \??\S: MBAMService.exe File opened (read-only) \??\J: MBAMInstallerService.exe File opened (read-only) \??\L: MBAMInstallerService.exe File opened (read-only) \??\U: MBAMInstallerService.exe File opened (read-only) \??\W: MBAMInstallerService.exe File opened (read-only) \??\G: MBAMService.exe File opened (read-only) \??\K: MBAMService.exe File opened (read-only) \??\X: MBAMService.exe File opened (read-only) \??\A: MBAMInstallerService.exe File opened (read-only) \??\M: MBAMInstallerService.exe File opened (read-only) \??\O: MBAMInstallerService.exe File opened (read-only) \??\V: MBAMInstallerService.exe File opened (read-only) \??\H: MBAMService.exe File opened (read-only) \??\Z: MBAMService.exe File opened (read-only) \??\W: MBAMService.exe File opened (read-only) \??\Y: MBAMService.exe File opened (read-only) \??\H: MBAMInstallerService.exe File opened (read-only) \??\I: MBAMInstallerService.exe File opened (read-only) \??\P: MBAMInstallerService.exe File opened (read-only) \??\S: MBAMInstallerService.exe File opened (read-only) \??\T: MBAMInstallerService.exe File opened (read-only) \??\I: MBAMService.exe File opened (read-only) \??\N: MBAMService.exe File opened (read-only) \??\G: MBAMInstallerService.exe File opened (read-only) \??\Z: MBAMInstallerService.exe -
Drops file in System32 directory 64 IoCs
Processes:
MBVpnTunnelService.exeDrvInst.exeMBAMService.exedescription ioc process File created C:\Windows\System32\DriverStore\FileRepository\netwtw06.inf_amd64_2edd50e7a54d503b\netwtw06.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netefe3e.inf_amd64_7830581a689ef40d\netefe3e.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netjme.inf_amd64_752bf22f1598bb7e\netjme.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netl160a.inf_amd64_e4cbe375963a69e9\netl160a.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netax88179_178a.inf_amd64_a8bb8a6e92764769\netax88179_178a.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netwbw02.inf_amd64_1c4077fa004e73b4\netwbw02.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netl1c63x64.inf_amd64_4d6630ce07a4fb42\netl1c63x64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\net1yx64.inf_amd64_8604d8a50804b9c1\net1yx64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netmlx4eth63.inf_amd64_3809a4a3e7e07703\netmlx4eth63.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{84e9f5df-623b-c849-aa23-30a8d4ad2c38} DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\mwlu97w8x64.inf_amd64_23bc3dc6d91eebdc\mwlu97w8x64.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_6E4F36431D86962EFD432400DF65AC90 MBAMService.exe File created C:\Windows\System32\DriverStore\FileRepository\netwew01.inf_amd64_153e01d761813df2\netwew01.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netbc63a.inf_amd64_7ba6c9cea77dd549\netbc63a.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netwsw00.inf_amd64_24d55504ae3587aa\netwsw00.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netimm.inf_amd64_8b2087393aaef952\netimm.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{84e9f5df-623b-c849-aa23-30a8d4ad2c38}\SET77FC.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\netr28x.inf_amd64_5d63c7bcbf29107f\netr28x.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netrtwlane_13.inf_amd64_992f4f46e65f30d4\netrtwlane_13.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netwtw02.inf_amd64_42e02bae858d0fbd\netwtw02.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\kdnic.inf_amd64_49825a4c00258135\kdnic.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\net8185.inf_amd64_7a30f5a9441cd55b\net8185.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netmyk64.inf_amd64_1f949c30555f4111\netmyk64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\c_net.inf_amd64_cf2766005585f6cd\c_net.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netathr10x.inf_amd64_2691c4f95b80eb3b\netathr10x.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{84e9f5df-623b-c849-aa23-30a8d4ad2c38}\mbtun.cat DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\qcwlan64.inf_amd64_71c84e1405061462\qcwlan64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\usb4p2pnetadapter.inf_amd64_a9fd59ce64f17c8a\usb4p2pnetadapter.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netwtw04.inf_amd64_c8f5ae6576289a2d\netwtw04.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\wceisvista.inf_amd64_3aa3e69e968123a7\wceisvista.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\38D10539991D1B84467F968981C3969D_C92678066E2B4B4986BC7641EEC08637 MBAMService.exe File created C:\Windows\System32\DriverStore\FileRepository\netelx.inf_amd64_7812e4e45c4a5eb1\netelx.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\nett4x64.inf_amd64_54eacac1858c78ab\nett4x64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netrtwlane.inf_amd64_35c52a008b0fba12\netrtwlane.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netg664.inf_amd64_84cd7b2798e0a666\netg664.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netvwwanmp.inf_amd64_2299fee965b7e92c\netvwwanmp.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\bthpan.inf_amd64_a31306bfdf7135b0\bthpan.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{84e9f5df-623b-c849-aa23-30a8d4ad2c38}\mbtun.inf DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{84e9f5df-623b-c849-aa23-30a8d4ad2c38}\SET77FC.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\ndisimplatformmp.inf_amd64_206e9e544d84356f\ndisimplatformmp.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\mrvlpcie8897.inf_amd64_07fc330c5a5730ca\mrvlpcie8897.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netrtwlanu.inf_amd64_1815bafd14dc59f0\netrtwlanu.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netrtwlane01.inf_amd64_b02695ef070d7a42\netrtwlane01.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\rtwlanu_oldic.inf_amd64_1a82423cc076e882\rtwlanu_oldic.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netk57a.inf_amd64_d823e3edc27ae17c\netk57a.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\Temp\{84e9f5df-623b-c849-aa23-30a8d4ad2c38}\SET77FA.tmp DrvInst.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\572BF21E454637C9F000BE1AF9B1E1A9 MBAMService.exe File created C:\Windows\System32\DriverStore\FileRepository\netwlv64.inf_amd64_0b9818131664d91e\netwlv64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netxex64.inf_amd64_ede00b448bfe8099\netxex64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\net7400-x64-n650.inf_amd64_557ce3b37c3e0e3b\net7400-x64-n650.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netl1e64.inf_amd64_8d5ca5ab1472fc44\netl1e64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netnvma.inf_amd64_7080f6b8ea1744fb\netnvma.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netr28ux.inf_amd64_d5996f2a9d9aa9e3\netr28ux.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\net8192se64.inf_amd64_167684f9283b4eca\net8192se64.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\netrasa.inf_amd64_1ed57daf97af7063\netrasa.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\netl260a.inf_amd64_783312763f8749c7\netl260a.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\wnetvsc.inf_amd64_2518575b045d267b\wnetvsc.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\rndiscmp.inf_amd64_04b60d124553a40f\rndiscmp.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netrtwlans.inf_amd64_97cd1a72c2a7829c\netrtwlans.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\athw8x.inf_amd64_55014eff4ceefbdf\athw8x.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\mbtun.inf_amd64_add82795013a7c3b\mbtun.cat DrvInst.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E MBAMService.exe -
Drops file in Program Files directory 64 IoCs
Processes:
MBAMInstallerService.exeMBAMService.exeMBSetup.exeMBVpnTunnelService.exedescription ioc process File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Reflection.Emit.ILGeneration.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.sys MBAMService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Xml.XmlDocument.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.UI.TrayNotification.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\zh-Hant\System.Windows.Forms.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\Microsoft.EntityFrameworkCore.Relational.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-math-l1-1-0.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\ucrtbase.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\Accessibility.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\System.Threading.AccessControl.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\UIAutomationClientSideProviders.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\BrowserSDKDLL.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\Microsoft.EntityFrameworkCore.Abstractions.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Text.Encoding.Extensions.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Transactions.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\ru\PresentationFramework.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\ru\System.Windows.Forms.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\it\UIAutomationTypes.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\pl\UIAutomationProvider.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\SecurityProductInformation.ini MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\9ad6a706-8fa8-433c-924c-bbc4060f393c MBSetup.exe File created C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe MBSetup.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Dynamic.Runtime.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\it\System.Windows.Input.Manipulations.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\DryIoc.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\SQLitePCLRaw.batteries_v2.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\5128e1bf1b5211ef9d7bca658e39cca4 MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\clretwrc.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Data.Common.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\System.Resources.Extensions.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\malwarebytes_assistant.exe MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\TelemetryControllerImpl.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\mbuns.exe MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\.version MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-heap-l1-1-0.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\es\System.Windows.Controls.Ribbon.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Net.Requests.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\PresentationFramework.Aero2.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\mbae-api-na.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\SwissarmyShim.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-file-l1-1-0.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.CompilerServices.VisualC.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\pt-BR\System.Windows.Forms.Primitives.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\System.Windows.Extensions.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-convert-l1-1-0.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Private.Xml.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\Microsoft.Win32.Registry.AccessControl.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\zh-Hant\PresentationCore.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Threading.Timer.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\WindowsFormsIntegration.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\pt-BR\Microsoft.VisualBasic.Forms.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\System.DirectoryServices.Protocols.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\mscordbi.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.ComponentModel.Primitives.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Resources.Reader.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Security.Principal.Windows.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\mbtun\mbtun.inf MBVpnTunnelService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-stdio-l1-1-0.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\ru\PresentationCore.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\System.Diagnostics.EventLog.Messages.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\tr\ReachFramework.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.Serialization.Formatters.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\de\UIAutomationClientSideProviders.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnel_wireguard.dll MBAMInstallerService.exe -
Drops file in Windows directory 5 IoCs
Processes:
svchost.exeDrvInst.exeMBVpnTunnelService.exedescription ioc process File opened for modification C:\Windows\INF\setupapi.dev.log svchost.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\inf\oem3.inf DrvInst.exe File created C:\Windows\inf\oem3.inf DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log MBVpnTunnelService.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 26 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
DrvInst.exesvchost.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs DrvInst.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
MBAMService.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MBAMService.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MBAMService.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Processes:
MBAMService.exeMBAMInstallerService.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\mbamtray.exe = "11000" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION MBAMInstallerService.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Malwarebytes.exe = "11000" MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION MBAMService.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\mbam.exe = "11000" MBAMService.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
MBAMService.exeMBAMInstallerService.exeDrvInst.exembupdatrV5.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\15.0\Common MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs mbupdatrV5.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:\ MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates MBAMService.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\15.0 MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT mbupdatrV5.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates mbupdatrV5.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs mbupdatrV5.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0\Common MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs MBAMService.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs MBAMService.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Malwarebytes MBAMInstallerService.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Malwarebytes\FirstRun = "false" MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0 MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\15.0\Common\Security MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0\Common\Security MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software MBAMService.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:\ MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\16.0\Common\Security MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs MBAMService.exe -
Modifies registry class 64 IoCs
Processes:
MBAMService.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9DAB0CA5-AE19-41AE-955C-41DD44C52697}\Programmable MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7995CBA9-83E0-4F28-A50B-DFDE85EBCCD1}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{108E7F3D-FB06-4024-94FB-3B8E687587E4}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{83D0C30B-ECF4-40C5-80EC-21BB47F898A9}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B9442AA1-AEB8-4FB4-B998-BFBC37BA8A99}\ = "ISPControllerEvents" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FFBD938D-3ABA-4895-97EF-5A0BDF7AC07D}\ = "_IPoliciesControllerEventsV2" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7968A0D1-5C9E-4F28-8C2F-E215BC7DF146} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MB.ArwController.1\ = "ArwController Class" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{17BE78EE-B40A-4B9E-835F-38EC62F9D479}\ = "NormalScanParameters Class" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9F0067A5-A8F1-46BF-AA32-F418656FDE6F}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DE6A4256-97CD-4DBB-9D4A-3054B0BB0F8B}\TypeLib\ = "{F5BCAC7E-75E7-4971-B3F3-B197A510F495}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79D77750-02E0-4451-A7BB-524ACD93DD93}\ProxyStubClsid32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EF7DFB76-BA49-4191-8B62-0AC3571C56D7} MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{735BE2C0-5A9B-457A-A0A9-4B27FCED2817}\ProxyStubClsid32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F275D775-3A22-4C5A-B9AD-6FE8008304D0}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{090D2E82-C71B-414E-AF6A-6681A92FF2B3}\ = "IRTPControllerV7" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{77AD284A-4686-413D-AA76-BDFC1DF52A19}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0C4652FC-FA35-4394-A133-F68409776465}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36A65E46-6CC1-4CA2-B51E-F4DD8C993DDC}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3498D9E4-6476-4AC0-B53A-75BC9955EF37}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAD7766B-F8F3-4944-AFE6-5D667E535709}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6B3DFEA6-6514-42CF-A091-C4DFFD9C2158}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5083B4CA-BBA6-43DD-B36E-DEA787CA0CAD}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F3B74800-4C27-4692-BC00-5AE37FA118E4}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{616E9BE3-358B-4C06-8AAB-0ACF8D089931}\ = "ISPControllerEventsV2" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5D448EF3-7261-4C0C-909C-6D56043C259D}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E298372C-5B10-42B4-B44C-7B85EA0722A3}\TypeLib\ = "{F5BCAC7E-75E7-4971-B3F3-B197A510F495}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3A7FB145-B72D-466E-A3AC-21599BBE9E8C}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E2D56B7B-4B87-45A1-A6D3-5C77035141A6}\ProxyStubClsid32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7C710FA9-862A-40CF-9F54-063EF8FC8438}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{834906DC-FA0F-4F61-BC62-24B0BEB3769C}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E3D4AC2-A9AE-478A-91EE-79C35D3CA8C7}\ProxyStubClsid32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A0EB1521-C843-47D5-88D2-5449A2F5F40B}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MB.SPController\CurVer\ = "MB.SPController.1" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{571FB9A8-E53B-4740-B125-082207566E5F}\ = "IScanControllerV15" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{56898B37-6187-4F81-B9C6-8DA97D31F396} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3641B831-731C-4963-B50B-D84902285C26}\ = "ICleanControllerV4" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D8891F9E-90C4-4B3D-B87B-92DEA9221EBB}\TypeLib\ = "{226C1698-A075-4315-BB5D-9C164A96ACE7}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MB.VPNController.1\ = "VPNController Class" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{50538523-AA2F-40D3-9B58-DB51D5BD3D4A}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{748A86D4-7EDF-41EF-A1EF-9582643B1C9F}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A0101B90-FD0B-40CF-90E4-33650F09A80F}\TypeLib\ = "{A82129F1-32E1-4D79-A39F-EBFEE53A70BF}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8FF168C7-A609-4237-A076-E461334BF4EA} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9DAB0CA5-AE19-41AE-955C-41DD44C52697}\AppID = "{1F7896AD-8886-42CD-8ABD-7A1315A3A5F2}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{562B1FA7-13DE-40A1-8839-AB2C5FA3129C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6696D5DD-4143-482C-ABF4-3B215CF3DBFC}\ = "ILicenseControllerEventsV2" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{18C5830A-FF78-4172-9DFB-E4016D1C1F31}\TypeLib\ = "{FFB94DF8-FC15-411C-B443-E937085E2AC1}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99E6F3FE-333C-462C-8C39-BC27DCA4A80E}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A2D4A69C-14CA-4825-9376-5B4215AF5C5E} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{560EB17C-4365-4DFC-A855-F99B223F02AF}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{02143C0F-1656-4B2E-95E7-EA8178A29E2E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{226C1698-A075-4315-BB5D-9C164A96ACE7}\1.0\0\win64\ = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\\6" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E46A48DF-07CC-4C7F-89BB-145CF0DFC60A}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{960F2BB5-E954-45C5-97DF-A770D9D8C24B}\ = "IScanParametersV9" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{560EB17C-4365-4DFC-A855-F99B223F02AF}\ = "IScannerEventsV3" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{778103CC-4FA4-42AC-8981-D6F11ACC6B7F}\ProxyStubClsid32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EBA4A79D-9F4E-4E7A-AC00-49ECE23C20B6}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{503084FD-0743-46C7-833F-D0057E8AC505}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F418F2F6-5173-4E4F-80EF-AF21E516C461}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C9669A3D-81E8-46F6-A51E-815A0863D612} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE8A9269-9E6E-4683-BCD3-41E9B16696DC}\TypeLib\ = "{5709DEEB-F05E-4D5C-8DC4-3B0D924EE08F}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5083B4CA-BBA6-43DD-B36E-DEA787CA0CAD}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B1D8E799-D5A2-45B4-9524-067144A201E4}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F36AD0D0-B5F0-4C69-AF08-603D177FEF0E}\Version\ = "1.0" MBAMService.exe -
Processes:
MBAMInstallerService.exeMBAMService.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8DA7F965EC5EFC37910F1C6E59FDC1CC6A6EDE16\Blob = 0300000001000000140000008da7f965ec5efc37910f1c6e59fdc1cc6a6ede162000000001000000450300003082034130820229a0030201020213066c9fcf99bf8c0a39e2f0788a43e696365bca300d06092a864886f70d01010b05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412031301e170d3135303532363030303030305a170d3338303131373030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f74204341203130820122300d06092a864886f70d01010105000382010f003082010a0282010100b2788071ca78d5e371af478050747d6ed8d78876f49968f7582160f97484012fac022d86d3a0437a4eb2a4d036ba01be8ddb48c80717364cf4ee8823c73eeb37f5b519f84968b0ded7b976381d619ea4fe8236a5e54a56e445e1f9fdb416fa74da9c9b35392ffab02050066c7ad080b2a6f9afec47198f503807dca2873958f8bad5a9f948673096ee94785e6f89a351c0308666a14566ba54eba3c391f948dcffd1e8302d7d2d747035d78824f79ec4596ebb738717f2324628b843fab71daacab4f29f240e2d4bf7715c5e69ffea9502cb388aae50386fdbfb2d621bc5c71e54e177e067c80f9c8723d63f40207f2080c4804c3e3b24268e04ae6c9ac8aa0d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604148418cc8534ecbc0c94942e08599cc7b2104e0a08300d06092a864886f70d01010b0500038201010098f2375a4190a11ac57651282036230eaee628bbaaf894ae48a4307f1bfc248d4bb4c8a197f6b6f17a70c85393cc0828e39825cf23a4f9de21d37c8509ad4e9a753ac20b6a897876444718656c8d418e3b7f9acbf4b5a750d7052c37e8034bade961a0026ef5f2f0c5b2ed5bb7dcfa945c779e13a57f52ad95f2f8933bde8b5c5bca5a525b60af14f74befa3fb9f40956d3154fc42d3c7461f23add90f48709ad9757871d1724334756e5759c2025c266029cf2319168e8843a5d4e4cb08fb231143e843297262a1a95d5e08d490aeb8d8ce14c2d055f286f6c49343776661c0b9e841d7977860036e4a72aea5d17dba109e866c1b8ab95933f8ebc490bef1b9 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F6108407D6F8BB67980CC2E244C2EBAE1CEF63BE\Blob = 030000000100000014000000f6108407d6f8bb67980cc2e244c2ebae1cef63be2000000001000000f6010000308201f230820178a0030201020213066c9fd7c1bb104c2943e5717b7b2cc81ac10e300a06082a8648ce3d0403033039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412034301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f7420434120343076301006072a8648ce3d020106052b8104002203620004d2ab8a374fa3530dfec18a7b4ba87b464b63b062f62d1bdb087121d200e863bd9a27fbf0396e5dea3da5c981aaa35b2098455d16dbfde8106de39ce0e3bd5f8462f3706433a0cb242f70ba88a12aa075f881ae6206c481db396e29b01efa2e5ca3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414d3ecc73a656ecce1da769a56fb9cf3866d57e581300a06082a8648ce3d040303036800306502303a8b21f1bd7e11add0ef58962fd6eb9d7e908d2bcf6655c32ce328a9700a470ef0375912ff2d9994284e2a4f354d335a023100ea75004e3bc43a941291c958469d211372a7889c8ae44c4adb96d4ac8b6b6b49125333add7e4be24fcb50a76d4a5bc10 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\2AD974A775F73CBDBBD8F5AC3A49255FA8FB1F8C MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 040000000100000010000000be954f16012122448ca8bc279602acf5140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a2030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa20f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e1900000001000000100000009f687581f7ef744ecfc12b9cee6238f12000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 MBAMService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 5c0000000100000004000000001000001900000001000000100000009f687581f7ef744ecfc12b9cee6238f10f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa2140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a2040000000100000010000000be954f16012122448ca8bc279602acf52000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 MBAMService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d0030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d578112861900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8DA7F965EC5EFC37910F1C6E59FDC1CC6A6EDE16 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa22000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\1C58A3A8518E8759BF075B76B750D4F2DF264FCD MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0D44DD8C3C8C1A1A58756481E90F2E2AFFB3D26E\Blob = 0300000001000000140000000d44dd8c3c8c1a1a58756481e90f2e2affb3d26e2000000001000000ba010000308201b63082015ba0030201020213066c9fd5749736663f3b0b9ad9e89e7603f24a300a06082a8648ce3d0403023039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412033301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f7420434120333059301306072a8648ce3d020106082a8648ce3d030107034200042997a7c6417fc00d9be8011b56c6f252a5ba2db212e8d22ed7fac9c5d8aa6d1f73813b3b986b397c33a5c54e868e8017686245577d44581db337e56708eb66dea3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414abb6dbd7069e37ac3086079170c79cc419b178c0300a06082a8648ce3d0403020349003046022100e08592a317b78df92b06a593ac1a98686172fae1a1d0fb1c7860a64399c5b8c40221009c02eff1949cb396f9ebc62af8b62cfe3a901416d78c6324481cdf307dd5683b MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\5A8CEF45D7A69859767A8C8B4496B578CF474B1A MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\5A8CEF45D7A69859767A8C8B4496B578CF474B1A\Blob = 0300000001000000140000005a8cef45d7a69859767a8c8b4496b578cf474b1a2000000001000000450500003082054130820329a0030201020213066c9fd29635869f0a0fe58678f85b26bb8a37300d06092a864886f70d01010c05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412032301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f74204341203230820222300d06092a864886f70d01010105000382020f003082020a0282020100ad969f2d9c4a4c4a81795199ec8acb6b605113bc4d6d06fcb0088ddd19106ac7260c35d8c06f2084e994b19b8503c35bdb4ae8c8f89076d95b4fe34ce806364dcc9aac3d0c902b92d4061960ac374479858182ad5a37e00dcc9da64c5276ea439db704d150f655e0d5d2a64985e937e9ca7eae5c954d489a3fae205a6d8895d934b8521a4390b0bf6c05b9b678b7ead0e43a3c125362ff4af27bbe3505a91234e3f36474622c3d00495a28fe3244bb87dd652702713bda4af71fdacdf72155904f0fecae82e19f6bd945d3bbf05f87ed3c2c3986da3fdeec7255eb79a3addbdd7cb0ba1ccefcde4f3576cf0ff8781f6a36514627615be99ecff0a2557d7c258a6f2fb4c5cf842e2bfd0d51106cfb5f1bbc1b7ec5ae3b98013192ff0b57f49ab2b957e9abef0d76d1f0eef4ce86a7e06ee9b469a1df69f633c6692e97139ea587b057108137c953b3bb7ff692d19cd018f4926eda834fa663994ca5fb5eef21647a205f6c648515cb37e9620c0b2a16dc012e32da3e4bf59e3af6174094ef9e910886fabe63a85a33eccb744395f96c695236c7296ffc55035c1ffb9fbd47ebe74947950b4e89220949e0f5611ef1bf2e8a726e8059ff573af97532a34e5feced2862d94d73f2cc811760edcdebdcdba7cac57e02bdf2540854fdb42d092c17544a98d154e1516708d2ed6e7e6f3fd22d81592966cb903995111e7427feddebaf0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414b00cf04c30f405580248fd33e552af4b84e36652300d06092a864886f70d01010c05000382020100aaa8808f0e78a3e0a2d4cde6f5987a3bea0003b0970e93bc5aa8f62c8c7287a9b1fc7f73fd637178a58759cf30e10d10b2135a6d82f56ae6809fa0050b68e4476bc76adfb6fd773272e518fa09f4a0932c5dd28c75857665900c0379b7312363ad788309866884cafff9cf269a9279e7cd4bc5e761a717cbf3a91293936ba7e82f5392c46058b0cc0251185b858d625963b6adb4de9afb26f70027c05d55377499c9507fe3592e44e32c25eeec4c3277b49f1ae94b5d20c5dafd1c8716c643e8d4bb269a45705ea90b3753e2467b27fde046f289b7cc42b6cb28266ed9a5c93ac8411360f7508c15aeb26d1a151a5778e6922ad96590823f6c02afae123a27963604d71da28063a99bf1e5bab47c14b04ec9b11f745f38f651ea9bfa2ca211d4a92d271a45b1afb24e710dc05846d66906cb53cbb3fe6b41cd417e7d4c0f7c72797a59cd5e4a0eac9ba99873797cb4f4ccb9b8070cb2745cb8c76f88a190a7f4aaf9bf673af41a15621eb79fbe3db129af67a112f25810195303301bb81a89f69cbd97038ea309f31d8b21f1b4dfe41cd19f650206ea5cd613b384efa2a55c8c7729a768c06bae40d2a8b4eacdf08d4b389c199a1b2854b88990efca75813e1ef26424c718af4eff479e07f63565a4d30a56fff517646cefa822254993b6df0017da587e5deec51bb0d1d15f2110c7f9f3ba020a2707c5f1d6c7d3e0fb09606c MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0D44DD8C3C8C1A1A58756481E90F2E2AFFB3D26E MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F6108407D6F8BB67980CC2E244C2EBAE1CEF63BE MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\1C58A3A8518E8759BF075B76B750D4F2DF264FCD\Blob = 0300000001000000140000001c58a3a8518e8759bf075b76b750d4f2df264fcd2000000001000000c2040000308204be308203a6a003020102021006d8d904d5584346f68a2fa754227ec4300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3231303431343030303030305a170d3331303431333233353935395a304f310b300906035504061302555331153013060355040a130c446967694365727420496e633129302706035504031320446967694365727420544c53205253412053484132353620323032302043413130820122300d06092a864886f70d01010105000382010f003082010a0282010100c14bb3654770bcdd4f58dbec9cedc366e51f311354ad4a66461f2c0aec6407e52edcdcb90a20eddfe3c4d09e9aa97a1d8288e51156db1e9f58c251e72c340d2ed292e156cbf1795fb3bb87ca25037b9a52416610604f571349f0e8376783dfe7d34b674c2251a6df0e9910ed57517426e27dc7ca622e131b7f238825536fc13458008b84fff8bea75849227b96ada2889b15bca07cdfe951a8d5b0ed37e236b4824b62b5499aecc767d6e33ef5e3d6125e44f1bf71427d58840380b18101faf9ca32bbb48e278727c52b74d4a8d697dec364f9cace53a256bc78178e490329aefb494fa415b9cef25c19576d6b79a72ba2272013b5d03d40d321300793ea99f50203010001a38201823082017e30120603551d130101ff040830060101ff020100301d0603551d0e04160414b76ba2eaa8aa848c79eab4da0f98b2c59576b9f4301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030106082b06010505070302307606082b06010505070101046a3068302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304006082b060105050730028634687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274476c6f62616c526f6f7443412e63727430420603551d1f043b30393037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274476c6f62616c526f6f7443412e63726c303d0603551d2004363034300b06096086480186fd6c02013007060567810c01013008060667810c0102013008060667810c0102023008060667810c010203300d06092a864886f70d01010b050003820101008032ce5e0bdd6e5a0d0aafe1d684cbc08efa8570edda5db30cf72b7540fe850afaf33178b7704b1a8958ba80bdf36b1de97ecf0bba589c59d490d3fd6cfdd0986db771825bcf6d0b5a09d07bdec443d82aa4de9e41265fbb8f99cbddaee1a86f9f87fe74b71f1b20abb14fc6f5675d5d9b3ce9ff69f7616cd6d9f3fd36c6ab038876d24b2e7586e3fcd8557d26c21177df3e02b67cf3ab7b7a86366fb8f7d89371cf86df7330fa7babed2a59c842843b11171a52f3c90e147da25b7267ba71ed574766c5b8024a65345e8bd02a3c209c51994ce7529ef76b112b0d927e1de88aeb36164387ea2a63bf753febdec403bb0a3cf730efebaf4cfc8b3610733ef3a4 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\2AD974A775F73CBDBBD8F5AC3A49255FA8FB1F8C\Blob = 0300000001000000140000002ad974a775f73cbdbbd8f5ac3a49255fa8fb1f8c2000000001000000620400003082045e30820346a0030201020213077312380b9d6688a33b1ed9bf9ccda68e0e0f300d06092a864886f70d01010b05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412031301e170d3232303832333232323132385a170d3330303832333232323132385a303c310b3009060355040613025553310f300d060355040a1306416d617a6f6e311c301a06035504031313416d617a6f6e205253412032303438204d303130820122300d06092a864886f70d01010105000382010f003082010a0282010100eb712ca9cb1f8828923230af8a570f78b73725955587ac675c97d322c8daa214676b7cf067dae2032ab356125dc6b547f96708a7937a9592180fb4f9f910369a7f2f80b64fba134ec75d531ee0dd96330720d396bc12e4745042a1051373b54f9b4424fe2d7fedbc2285ec362133977506ce271882dce3d9c582078d5e26012626671fd93f13cf32ba6bad7864fcaaff0e023c07df9c0578728cfdea75b7032884dae86e078cd05085ef8154b2716eec6d62ef8f94c35ee9c4a4d091c02e249198caeeba258ed4f671b6fb5b6b38064837478d86dcf2ea06fb76377d9eff424e4d588293cfe271c278b17aab4b5b94378881e4d9af24aef872c565fb4bb451e70203010001a382015a3082015630120603551d130101ff040830060101ff020100300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030106082b06010505070302301d0603551d0e0416041481b80e638a891218e5fa3b3b50959fe6e5901385301f0603551d230418301680148418cc8534ecbc0c94942e08599cc7b2104e0a08307b06082b06010505070101046f306d302f06082b060105050730018623687474703a2f2f6f6373702e726f6f746361312e616d617a6f6e74727573742e636f6d303a06082b06010505073002862e687474703a2f2f6372742e726f6f746361312e616d617a6f6e74727573742e636f6d2f726f6f746361312e636572303f0603551d1f043830363034a032a030862e687474703a2f2f63726c2e726f6f746361312e616d617a6f6e74727573742e636f6d2f726f6f746361312e63726c30130603551d20040c300a3008060667810c010201300d06092a864886f70d01010b05000382010100ad00de0205232e063262b46bb19416e41140de2bfa59c135efe0aa8f2b41b9d1f38739001df23db5a7470c0606c691f3075702d4edbd17c1909abf4875a2074f30dd4a6a42b50d3d15c00ffe845bc63c99cc5752b1d86e12d59692934b94e507e88982086a7a34d49e64e13d876a92909a63a14bf88fb6ea34d305be20c2de06e28c9f738b9f4d3985cace19369d85c99ec9f8503fb67e88a1efca84068b50b40a5ca61c44f1fdc8614060f26125aa07f4c7c27375e40c0b428d04e55f4448995b7b898196a7889d4b0d62e804c4d7feb4e8b26dcaecc01cbc385b1ddf85ce5b7ae3494b6cb9a7ddf405b249ade1c5146bc2ccebcd7fd65869bac3207e7fb0b8 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800001900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa20f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e MBAMService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E\Blob = 030000000100000014000000b51c067cee2b0c3df855ab2d92f4fe39d4e70f0e2000000001000000e1030000308203dd308202c5a003020102020100300d06092a864886f70d01010b050030818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a30818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bdedc103fcf68ffc02b16f5b9f48d99d79e2a2b703615618c347b6d7ca3d352e8943f7a1699bde8a1afd13209cb44977322956fdb9ec8cdd22fa72dc276197eef65a84ec6e19b9892cdc845bd574fb6b5fc589a51052894655f4b8751ce67fe454ae4bf85572570219f8177159eb1e280774c59d48be6cb4f4a4b0f364377992c0ec465e7fe16d534c62afcd1f0b63bb3a9dfbfc7900986174cf26824063f3b2726a190d99cad40e75cc37fb8b89c159f1627f5fb35f6530f8a7b74d765a1e765e34c0e89656998ab3f07fa4cdbddc32317c91cfe05f11f86baa495cd19994d1a2e3635b0976b55662e14b741d96d426d4080459d0980e0ee6defcc3ec1f90f10203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147c0c321fa7d9307fc47d68a362a8a1ceab075b27300d06092a864886f70d01010b050003820101001159fa254f036f94993b9a1f828539d47605945ee128936d625d09c2a0a8d4b07538f1346a9de49f8a862651e62cd1c62d6e95204a9201ecb88a677b31e2672e8c9503262e439d4a31f60eb50cbbb7e2377f22ba00a30e7b52fb6bbb3bc4d379514ecd90f4670719c83c467a0d017dc558e76de68530179a24c410e004f7e0f27fd4aa0aff421d37ed94e5645912207738d3323e3881759673fa688fb1cbce1fc5ecfa9c7ecf7eb1f1072db6fcbfcaa4bfd097054abcea18280290bd5478092171d3d17d1dd916b0a9613dd00a0022fcc77bcb0964450b3b4081f77d7c32f598ca588e7d2aee90597364f936745e25a1f566052e7f3915a92afb508b8e8569f4 MBAMInstallerService.exe -
NTFS ADS 2 IoCs
Processes:
chrome.exeMBAMInstallerService.exedescription ioc process File opened for modification C:\Users\Admin\Downloads\MBSetup.exe:Zone.Identifier chrome.exe File created C:\Program Files\Malwarebytes\Anti-Malware\mbuns.exe\:Zone.Identifier:$DATA MBAMInstallerService.exe -
Suspicious behavior: EnumeratesProcesses 35 IoCs
Processes:
chrome.exeMBSetup.exeMBAMInstallerService.exeMBAMService.exeMalwarebytes.exepid process 1316 chrome.exe 1316 chrome.exe 404 MBSetup.exe 404 MBSetup.exe 812 MBAMInstallerService.exe 812 MBAMInstallerService.exe 812 MBAMInstallerService.exe 812 MBAMInstallerService.exe 812 MBAMInstallerService.exe 812 MBAMInstallerService.exe 812 MBAMInstallerService.exe 812 MBAMInstallerService.exe 2824 MBAMService.exe 2824 MBAMService.exe 2824 MBAMService.exe 2824 MBAMService.exe 2824 MBAMService.exe 2824 MBAMService.exe 2824 MBAMService.exe 2824 MBAMService.exe 2824 MBAMService.exe 2824 MBAMService.exe 2824 MBAMService.exe 2824 MBAMService.exe 1804 Malwarebytes.exe 2824 MBAMService.exe 2824 MBAMService.exe 2824 MBAMService.exe 2824 MBAMService.exe 2824 MBAMService.exe 2824 MBAMService.exe 2824 MBAMService.exe 2824 MBAMService.exe 2824 MBAMService.exe 2824 MBAMService.exe -
Suspicious behavior: LoadsDriver 11 IoCs
Processes:
pid process 676 676 676 676 676 676 676 676 676 676 676 -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
Processes:
chrome.exepid process 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 1316 chrome.exe Token: SeCreatePagefilePrivilege 1316 chrome.exe Token: SeShutdownPrivilege 1316 chrome.exe Token: SeCreatePagefilePrivilege 1316 chrome.exe Token: SeShutdownPrivilege 1316 chrome.exe Token: SeCreatePagefilePrivilege 1316 chrome.exe Token: SeShutdownPrivilege 1316 chrome.exe Token: SeCreatePagefilePrivilege 1316 chrome.exe Token: SeShutdownPrivilege 1316 chrome.exe Token: SeCreatePagefilePrivilege 1316 chrome.exe Token: SeShutdownPrivilege 1316 chrome.exe Token: SeCreatePagefilePrivilege 1316 chrome.exe Token: SeShutdownPrivilege 1316 chrome.exe Token: SeCreatePagefilePrivilege 1316 chrome.exe Token: SeShutdownPrivilege 1316 chrome.exe Token: SeCreatePagefilePrivilege 1316 chrome.exe Token: SeShutdownPrivilege 1316 chrome.exe Token: SeCreatePagefilePrivilege 1316 chrome.exe Token: SeShutdownPrivilege 1316 chrome.exe Token: SeCreatePagefilePrivilege 1316 chrome.exe Token: SeShutdownPrivilege 1316 chrome.exe Token: SeCreatePagefilePrivilege 1316 chrome.exe Token: SeShutdownPrivilege 1316 chrome.exe Token: SeCreatePagefilePrivilege 1316 chrome.exe Token: SeShutdownPrivilege 1316 chrome.exe Token: SeCreatePagefilePrivilege 1316 chrome.exe Token: SeShutdownPrivilege 1316 chrome.exe Token: SeCreatePagefilePrivilege 1316 chrome.exe Token: SeShutdownPrivilege 1316 chrome.exe Token: SeCreatePagefilePrivilege 1316 chrome.exe Token: SeShutdownPrivilege 1316 chrome.exe Token: SeCreatePagefilePrivilege 1316 chrome.exe Token: SeShutdownPrivilege 1316 chrome.exe Token: SeCreatePagefilePrivilege 1316 chrome.exe Token: SeShutdownPrivilege 1316 chrome.exe Token: SeCreatePagefilePrivilege 1316 chrome.exe Token: SeShutdownPrivilege 1316 chrome.exe Token: SeCreatePagefilePrivilege 1316 chrome.exe Token: SeShutdownPrivilege 1316 chrome.exe Token: SeCreatePagefilePrivilege 1316 chrome.exe Token: SeShutdownPrivilege 1316 chrome.exe Token: SeCreatePagefilePrivilege 1316 chrome.exe Token: SeShutdownPrivilege 1316 chrome.exe Token: SeCreatePagefilePrivilege 1316 chrome.exe Token: SeShutdownPrivilege 1316 chrome.exe Token: SeCreatePagefilePrivilege 1316 chrome.exe Token: SeShutdownPrivilege 1316 chrome.exe Token: SeCreatePagefilePrivilege 1316 chrome.exe Token: SeShutdownPrivilege 1316 chrome.exe Token: SeCreatePagefilePrivilege 1316 chrome.exe Token: SeShutdownPrivilege 1316 chrome.exe Token: SeCreatePagefilePrivilege 1316 chrome.exe Token: SeShutdownPrivilege 1316 chrome.exe Token: SeCreatePagefilePrivilege 1316 chrome.exe Token: SeShutdownPrivilege 1316 chrome.exe Token: SeCreatePagefilePrivilege 1316 chrome.exe Token: SeShutdownPrivilege 1316 chrome.exe Token: SeCreatePagefilePrivilege 1316 chrome.exe Token: SeShutdownPrivilege 1316 chrome.exe Token: SeCreatePagefilePrivilege 1316 chrome.exe Token: SeShutdownPrivilege 1316 chrome.exe Token: SeCreatePagefilePrivilege 1316 chrome.exe Token: SeShutdownPrivilege 1316 chrome.exe Token: SeCreatePagefilePrivilege 1316 chrome.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
chrome.exeMBSetup.exeMalwarebytes.exepid process 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 404 MBSetup.exe 1316 chrome.exe 1804 Malwarebytes.exe 1804 Malwarebytes.exe 1804 Malwarebytes.exe 1804 Malwarebytes.exe 1804 Malwarebytes.exe 1804 Malwarebytes.exe 1804 Malwarebytes.exe 1804 Malwarebytes.exe 1804 Malwarebytes.exe 1804 Malwarebytes.exe 1804 Malwarebytes.exe 1804 Malwarebytes.exe 1804 Malwarebytes.exe 1804 Malwarebytes.exe 1804 Malwarebytes.exe 1804 Malwarebytes.exe 1804 Malwarebytes.exe 1804 Malwarebytes.exe 1804 Malwarebytes.exe 1804 Malwarebytes.exe 1804 Malwarebytes.exe 1804 Malwarebytes.exe 1804 Malwarebytes.exe 1804 Malwarebytes.exe 1804 Malwarebytes.exe 1804 Malwarebytes.exe 1804 Malwarebytes.exe -
Suspicious use of SendNotifyMessage 37 IoCs
Processes:
chrome.exeMalwarebytes.exepid process 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1316 chrome.exe 1804 Malwarebytes.exe 1804 Malwarebytes.exe 1804 Malwarebytes.exe 1804 Malwarebytes.exe 1804 Malwarebytes.exe 1804 Malwarebytes.exe 1804 Malwarebytes.exe 1804 Malwarebytes.exe 1804 Malwarebytes.exe 1804 Malwarebytes.exe 1804 Malwarebytes.exe 1804 Malwarebytes.exe 1804 Malwarebytes.exe 1804 Malwarebytes.exe 1804 Malwarebytes.exe 1804 Malwarebytes.exe 1804 Malwarebytes.exe 1804 Malwarebytes.exe 1804 Malwarebytes.exe 1804 Malwarebytes.exe 1804 Malwarebytes.exe 1804 Malwarebytes.exe 1804 Malwarebytes.exe 1804 Malwarebytes.exe 1804 Malwarebytes.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
MBSetup.exeMiniSearchHost.exepid process 404 MBSetup.exe 4124 MiniSearchHost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 1316 wrote to memory of 2120 1316 chrome.exe chrome.exe PID 1316 wrote to memory of 2120 1316 chrome.exe chrome.exe PID 1316 wrote to memory of 4224 1316 chrome.exe chrome.exe PID 1316 wrote to memory of 4224 1316 chrome.exe chrome.exe PID 1316 wrote to memory of 4224 1316 chrome.exe chrome.exe PID 1316 wrote to memory of 4224 1316 chrome.exe chrome.exe PID 1316 wrote to memory of 4224 1316 chrome.exe chrome.exe PID 1316 wrote to memory of 4224 1316 chrome.exe chrome.exe PID 1316 wrote to memory of 4224 1316 chrome.exe chrome.exe PID 1316 wrote to memory of 4224 1316 chrome.exe chrome.exe PID 1316 wrote to memory of 4224 1316 chrome.exe chrome.exe PID 1316 wrote to memory of 4224 1316 chrome.exe chrome.exe PID 1316 wrote to memory of 4224 1316 chrome.exe chrome.exe PID 1316 wrote to memory of 4224 1316 chrome.exe chrome.exe PID 1316 wrote to memory of 4224 1316 chrome.exe chrome.exe PID 1316 wrote to memory of 4224 1316 chrome.exe chrome.exe PID 1316 wrote to memory of 4224 1316 chrome.exe chrome.exe PID 1316 wrote to memory of 4224 1316 chrome.exe chrome.exe PID 1316 wrote to memory of 4224 1316 chrome.exe chrome.exe PID 1316 wrote to memory of 4224 1316 chrome.exe chrome.exe PID 1316 wrote to memory of 4224 1316 chrome.exe chrome.exe PID 1316 wrote to memory of 4224 1316 chrome.exe chrome.exe PID 1316 wrote to memory of 4224 1316 chrome.exe chrome.exe PID 1316 wrote to memory of 4224 1316 chrome.exe chrome.exe PID 1316 wrote to memory of 4224 1316 chrome.exe chrome.exe PID 1316 wrote to memory of 4224 1316 chrome.exe chrome.exe PID 1316 wrote to memory of 4224 1316 chrome.exe chrome.exe PID 1316 wrote to memory of 4224 1316 chrome.exe chrome.exe PID 1316 wrote to memory of 4224 1316 chrome.exe chrome.exe PID 1316 wrote to memory of 4224 1316 chrome.exe chrome.exe PID 1316 wrote to memory of 4224 1316 chrome.exe chrome.exe PID 1316 wrote to memory of 4224 1316 chrome.exe chrome.exe PID 1316 wrote to memory of 4224 1316 chrome.exe chrome.exe PID 1316 wrote to memory of 1596 1316 chrome.exe chrome.exe PID 1316 wrote to memory of 1596 1316 chrome.exe chrome.exe PID 1316 wrote to memory of 236 1316 chrome.exe chrome.exe PID 1316 wrote to memory of 236 1316 chrome.exe chrome.exe PID 1316 wrote to memory of 236 1316 chrome.exe chrome.exe PID 1316 wrote to memory of 236 1316 chrome.exe chrome.exe PID 1316 wrote to memory of 236 1316 chrome.exe chrome.exe PID 1316 wrote to memory of 236 1316 chrome.exe chrome.exe PID 1316 wrote to memory of 236 1316 chrome.exe chrome.exe PID 1316 wrote to memory of 236 1316 chrome.exe chrome.exe PID 1316 wrote to memory of 236 1316 chrome.exe chrome.exe PID 1316 wrote to memory of 236 1316 chrome.exe chrome.exe PID 1316 wrote to memory of 236 1316 chrome.exe chrome.exe PID 1316 wrote to memory of 236 1316 chrome.exe chrome.exe PID 1316 wrote to memory of 236 1316 chrome.exe chrome.exe PID 1316 wrote to memory of 236 1316 chrome.exe chrome.exe PID 1316 wrote to memory of 236 1316 chrome.exe chrome.exe PID 1316 wrote to memory of 236 1316 chrome.exe chrome.exe PID 1316 wrote to memory of 236 1316 chrome.exe chrome.exe PID 1316 wrote to memory of 236 1316 chrome.exe chrome.exe PID 1316 wrote to memory of 236 1316 chrome.exe chrome.exe PID 1316 wrote to memory of 236 1316 chrome.exe chrome.exe PID 1316 wrote to memory of 236 1316 chrome.exe chrome.exe PID 1316 wrote to memory of 236 1316 chrome.exe chrome.exe PID 1316 wrote to memory of 236 1316 chrome.exe chrome.exe PID 1316 wrote to memory of 236 1316 chrome.exe chrome.exe PID 1316 wrote to memory of 236 1316 chrome.exe chrome.exe PID 1316 wrote to memory of 236 1316 chrome.exe chrome.exe PID 1316 wrote to memory of 236 1316 chrome.exe chrome.exe PID 1316 wrote to memory of 236 1316 chrome.exe chrome.exe PID 1316 wrote to memory of 236 1316 chrome.exe chrome.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www.google.com2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffcc48bab58,0x7ffcc48bab68,0x7ffcc48bab783⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1680 --field-trial-handle=1864,i,3917890001193557215,16644500681981570543,131072 /prefetch:23⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2100 --field-trial-handle=1864,i,3917890001193557215,16644500681981570543,131072 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2164 --field-trial-handle=1864,i,3917890001193557215,16644500681981570543,131072 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2872 --field-trial-handle=1864,i,3917890001193557215,16644500681981570543,131072 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2880 --field-trial-handle=1864,i,3917890001193557215,16644500681981570543,131072 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4180 --field-trial-handle=1864,i,3917890001193557215,16644500681981570543,131072 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3224 --field-trial-handle=1864,i,3917890001193557215,16644500681981570543,131072 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4460 --field-trial-handle=1864,i,3917890001193557215,16644500681981570543,131072 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4604 --field-trial-handle=1864,i,3917890001193557215,16644500681981570543,131072 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4484 --field-trial-handle=1864,i,3917890001193557215,16644500681981570543,131072 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4620 --field-trial-handle=1864,i,3917890001193557215,16644500681981570543,131072 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5036 --field-trial-handle=1864,i,3917890001193557215,16644500681981570543,131072 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5024 --field-trial-handle=1864,i,3917890001193557215,16644500681981570543,131072 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5032 --field-trial-handle=1864,i,3917890001193557215,16644500681981570543,131072 /prefetch:83⤵
- NTFS ADS
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5352 --field-trial-handle=1864,i,3917890001193557215,16644500681981570543,131072 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5048 --field-trial-handle=1864,i,3917890001193557215,16644500681981570543,131072 /prefetch:83⤵
-
C:\Users\Admin\Downloads\MBSetup.exe"C:\Users\Admin\Downloads\MBSetup.exe"3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Checks BIOS information in registry
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe"C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe"2⤵
- Executes dropped EXE
-
C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe"C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe"3⤵
- Executes dropped EXE
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies system certificate store
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe" /installmbtun2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe" /Service /Protected2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Registers COM server for autorun
- Modifies registry class
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "9" "C:\Program Files\Malwarebytes\Anti-Malware\mbtun\mbtun.inf" "9" "4ba9030c7" "0000000000000150" "Service-0x0-3e7$\Default" "0000000000000160" "208" "C:\Program Files\Malwarebytes\Anti-Malware\mbtun"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe"C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe" nowindow2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMWsc.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMWsc.exe" /wac 0 /status on true /updatesubstatus none /scansubstatus none /settingssubstatus none2⤵
- Executes dropped EXE
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\updatrpkg\mbupdatrV5.exe"C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\updatrpkg\mbupdatrV5.exe" "C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE" "C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\config\UpdateControllerConfig.json" "C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE" "C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\dbclsupdate\staging" /db:dbupdate /su:no2⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Modifies data under HKEY_USERS
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
- Executes dropped EXE
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
- Executes dropped EXE
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
- Executes dropped EXE
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
- Executes dropped EXE
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca1⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Defense Evasion
Modify Registry
3Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\LicenseControllerImpl.dllFilesize
4.8MB
MD50ea9e23809dada42b3fee0210d8c7907
SHA1a468e990f09610226170edb07ae0e3839abff4e5
SHA25660d1140904e0e8b19c1d2812fe80e3b7e2e071dd4a1b27647bc6dd94bdfa51bc
SHA512b0d5e6f7e84f1209df2adbaa238e6497980a3a44a10de8b6dc38f81d84b8376b85e3582854cf4887d2459bb3590dd555e2f6cb7cdf3f0d43a4f4093175f4f2cb
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\PoliciesControllerImpl.dllFilesize
4.2MB
MD580202b21a6f3df9d0d54f20a381df93c
SHA16915dcc75d0b84e5db40656d6382cb217a1996c2
SHA2564217a62ea3df3bd98e40d205b4fb5f9673c340c366551adb771ff3e34e7bdcfc
SHA5128d691deae1f7c5243d045940f7f728a874e72550859b291119c9b951bd95232980dc2a1b3c19154c723c42e0aa93747a046f747bbc305941594477a39c2925f1
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\UpdateControllerImpl.dllFilesize
4.3MB
MD56867cbf4557635aca16ac6fba455e82c
SHA141994b5169762474d9febff66ed3ece998f691ca
SHA25626de9b9f28927dcc71c40ba623a77a7b47bace9d749d06a1b3e229e296513846
SHA51224fd41344211e1c95c44a4338c33e0d6c734107757694e3b59773c574ac424cd030bf37fd08fec2824e3111a52c5288bf8dd8a8900457b8749246142d019de74
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\pkgvers.datFilesize
75B
MD5cb094d819ee4c396812c0dacfc97a14f
SHA1e55f9915725975c480db48ca82721b72f315e770
SHA2560b9d33b6897188302e94ec2ca82df69b45cbe305650e42fc8945a7a61065a926
SHA5129fb97c6fa5bd1de3edb27b74c4b54c579489cd44af0668f767f471ead18875e46c44311934a6990cec5432cd2942d12c2fd2c8a400b5f053113bd4a9bb2532d3
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\Global.nmFilesize
335KB
MD57d46aed7c1d4f0f0529d9b4f7c36311c
SHA1388b1fac69a021e7f85ff16fcb14e77d66c28452
SHA256cbc07be233f55688675b0560e073f93bc4277454ddca511a2541b908c90d3de2
SHA51279d8f47cc0e5d04a904e7f1912c634d80a74f2ff1dd3b92f6f14251ad1459029d1a48bed578191cb61c853344d45f55555ec2397b9366921a5df1e114593753e
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\Global.srFilesize
14.7MB
MD5a4029188c3d574887c5f62cd31379a58
SHA1b288dbd76c5eaa844079ff3e82452a211f6b1dd9
SHA256ad139fa68d0df43ff34cea8ad7620e491e5d9cdae6991881358af4f1699de6bd
SHA5123a23f3941700901e5ef28dbeafd378f675a73823edafdcf2d8af714cd794df7f3aa7d7c0460361a816d9ca079e888bacaabb6edde5251023a31294a845436403
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\clean.mbdbFilesize
12KB
MD5c29c4877c7965d6df9c53ac62a38d1a5
SHA1ddeb3a9f7e517153bdd602e10487a1841576659e
SHA2565d0d97f54a41d991189cbc57bf321ae379ab9c0c514b8a257a5a332495ea9935
SHA512c22fc183c60c35b02ee618d3014a91634c866194eb28fa02a0c76af2b8e0aa2f6887e2578d50d3ebacc2fd9620d34e25c63344e930442b8194141e6d8187c04a
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\dbmanifest2.datFilesize
924B
MD56793078dde551a47df5c087d05a53649
SHA1c2c61d657329e3de90c8810a6afef6dafc875228
SHA256eb428aa365df62198e3fd49f86a1f598e97d4619828f44cf222139241633c388
SHA512ee117a5a2768ac15fa046b59866be394dc3c87df72bac44461f805cd66cdf2dd2a0dbabbb18d7b84a9b2c1351445a1e4f84b08cec18d07acd4e8b19e1f4ace0c
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\dynconfig.datFilesize
39KB
MD510f23e7c8c791b91c86cd966d67b7bc7
SHA13f596093b2bc33f7a2554818f8e41adbbd101961
SHA256008254ca1f4d6415da89d01a4292911de6135b42833156720a841a22685765dc
SHA5122d1b21371ada038323be412945994d030ee8a9007db072484724616c8597c6998a560bc28886ebf89e2c8919fb70d76c98338d88832351823027491c98d48118
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\exclusions.txtFilesize
23KB
MD5aef4eca7ee01bb1a146751c4d0510d2d
SHA15cf2273da41147126e5e1eabd3182f19304eea25
SHA2569e87e4c9da3337c63b7f0e6ed0eb71696121c74e18a5da577215e18097715e2f
SHA512d31d21e37b0048050b19600f8904354cff3f3ec8291c5a7a54267e14af9fb88dfb6d11e74a037cc0369ade8a8fb9b753861f3b3fb2219563e8ec359f66c042db
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\mbdigsig2.datFilesize
514B
MD5aca4783bfc9e6bf0a9770cc204c7d958
SHA157a60be315e901a2954178a7f851d16438b78d35
SHA25632c5981a3d74e655ac6425fc12bb3d7fca416ef0213a20b3f92821183213bf77
SHA51235fb721663f9cdc11af18c9eba168bfc792a47d21334a20eca3ce9dec4809bfcc8e4f842727a649cd122eb94d654a43811b8a8a435f1d831491ae8b68213eb2b
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\prot.mbdbFilesize
24B
MD5546d9e30eadad8b22f5b3ffa875144bf
SHA13b323ffef009bfe0662c2bd30bb06af6dfc68e4d
SHA2566089fbf0c0c1413f62e91dc9497bedc6d8a271e9dc761e20adc0dccf6f4a0c1f
SHA5123478f5dcf7af549dd6fe48ad714604200de84a90120b16a32233b6d44fa7240f5f4e5fe803f54b86bbdfd10fa1bfdd88fb85eb6a78e23e426933f98d0a2565ec
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\rdefs.mbdbFilesize
24B
MD52f7423ca7c6a0f1339980f3c8c7de9f8
SHA1102c77faa28885354cfe6725d987bc23bc7108ba
SHA256850a4ea37a0fd6f68bf95422d502b2d1257264eb90cc38c0a3b1b95aa375be55
SHA512e922ac8a7a2cde6d387f8698207cf5efbd45b646986a090e3549d97a7d552dd74179bd7ac20b7d246ca49d340c4c168982c65b4749df760857810b2358e7eb69
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\rules.mbdbFilesize
9.5MB
MD59db860969758fe929c5becec0e126fa8
SHA121d191243b9a6bef367faa037c9dbe109f4f9225
SHA2563dd79c020cd3d42015e60f09e1f01a37aa00d30c4efdbec4a97c30a19da43840
SHA512e51625a88d165c5559b34a1b1920959223fe3fec67cac2ca29e6d31fa82224853bb70771dd34857baaa6e5370b01b0efecf4b262b20493fbe967ddfaf40192e8
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\scan.mbdbFilesize
902KB
MD50aa86d4c5ea7a81134d88a9ccf8ae588
SHA1edf9d85f8374689982a1f28ce746aa31065e737c
SHA25633e2a07613983527b727fa3ed8b82b2ebab20cf12be6806c68e5aa70d46fe3b1
SHA512d174842679972ad1f2b53498d85c12a85f288c97a7f3a3f4705aadb1dcc114a70f20fc32bc3f55a6ed06011408b8f49326f01249b7636e17852a6ec4667ea990
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\tids.mbdbFilesize
169KB
MD54f67314cca28f7f16f8578c7354dd586
SHA1da2bb639707cff6da54081992e4fa1f496b279ed
SHA2560e66a1fd17a72042fc3034a19c3d1b818276251495f2ec67540ddc553ad6a1f7
SHA5124ee0d5b48468adfab6a3b444c6ffb34b7bb12c3a11c703bbe6a297f0e7240ae89faefbea09e814167ec8a3902427620636d9b295bb47a7b9d30d709c363fdaf1
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\wprot2.mbdbFilesize
26.2MB
MD552d40c51af3c2f502a4e98214399e3b4
SHA17d6036b988d2c3aaf4a6bd8772e8b1053a6811c4
SHA256160992e4690fecf6c0a31114531bb47694ce86e8d62bd4b1f59581cecd183d60
SHA512274de32faa2e90585f4a4f7cc078165edcf341c5fa98c6913447575662a34e8ba74d6642b8f1c39141d943f5bd33466eb85ff419067a7880eee0fd8e51386768
-
C:\PROGRA~1\MALWAR~1\ANTI-M~1\mbtun\mbtun.catFilesize
10KB
MD58abff1fbf08d70c1681a9b20384dbbf9
SHA1c9762e121e4f8a7ad931eee58ee60c8e9fc3ecb6
SHA2569ceb410494b95397ec1f8fa505d071672bf61f81cc596b8eccd167a77893c658
SHA51237998e0aee93ff47fe5b1636fce755966debe417a790e1aebd7674c86c1583feef04648a7bc79e4dedaabb731051f4f803932ac49ea0be05776c0f4d218b076f
-
C:\PROGRA~1\MALWAR~1\ANTI-M~1\mbtun\mbtun.sysFilesize
107KB
MD583d4fba999eb8b34047c38fabef60243
SHA125731b57e9968282610f337bc6d769aa26af4938
SHA2566903e60784b9fa5d8b417f93f19665c59946a4de099bd1011ab36271b267261c
SHA51247faab5fff3e3e2d2aea0a425444aa2e215f1d5bf97edee2a3bb773468e1092919036bcd5002357594b62519bf3a8980749d8d0f6402de0e73c2125d26e78f1e
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exeFilesize
9.6MB
MD5a545b29abb9db951e9e2508a1bbc8d2a
SHA1061494912b29c965638263b7321a54b9e0399417
SHA2567607ca2abc8f5dfe7a100ccf73d885375ec599b0648ebd964ffb8bff39c821df
SHA512e7e33f5e49570ea74d427e12c049a7f0f89f7e4d3c7c511f59170cfb166bb5dd49ebfaa5a968dfdc15758f3177d7d39beebce26e593629aa0eac630748b403f1
-
C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exeFilesize
2.9MB
MD546f875f1fe3d6063b390e3a170c90e50
SHA162b901749a6e3964040f9af5ddb9a684936f6c30
SHA2561cf9d3512efffaa2290c105ac8b7534026604067c9b533e7b7df2e017569a4ec
SHA512fdfb348061158f8133380e9a94215f4bfc0f6ce643a129d623cb8034c49144f1489de56cd076da645478506d9fbddc7590fe3d643622210084b15fdf0d16b557
-
C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exeFilesize
288KB
MD5589a48dafeb9c78b9d8094ee4ac4b055
SHA10629e032dacc0335ba1e3061bf10eab93f3d624d
SHA256c39ff9286ce4346089bbeae39afa198c032ff473b480760408ffaba11f63b08a
SHA5122fc385198d654f2e6b4928a7292c5ee14e703b987711395a2a10afd05bb1cb09f79a212158e2869c94c83685efdc3fe9a60906407dfa5abe8dd38e0b45225659
-
C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.jsonFilesize
621B
MD539f70486351886c4ca101b218342f0a9
SHA130616f3672f4cb9c7da6827c5fbecd68667b829f
SHA2569436b24d4bea0bfad47194fec2861c365abe5be2f3a6ffb0de936c136c2c8af3
SHA5126cfad24dfb0375a7930e3c57cb3ad9265ce1e39955506ebb7a54b0f320615b817fb657b6d70288e276a5a7b29be9c367f18f92d218cdff327ce22989aa1aa31d
-
C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.jsonFilesize
654B
MD587a68d99c78c754ce4cbfbe613118387
SHA1f5ed1f24c0465ea1a48cb5802a81c33b392b1bbf
SHA256bde20a463f6b7f89054574803ffcfcc132f6e5799c20b803dc680fbba0990ccc
SHA512cc27782664577ae0f832e7f7bda40e46faf787646cdc8c4e1712ee0174edf4e799c59876196404106d7b0f8a395c3d3b609240d1ec2bd666a260838814321f2f
-
C:\Program Files\Malwarebytes\Anti-Malware\ctlrvers.datFilesize
8B
MD517412178172b24c5e570f6f13c42f4c0
SHA1f0aac01bdd57f034d9cda7dbec9dd97c0dcb81eb
SHA2562f2bb8b0a74e9049f4ee9dd039d81bc853fa8db3f311a799032f002b9cc1de41
SHA5123b9808f22e3455505da42b26d3c0c0d56cbac41fd0d2076c3363273d9e77064047d8fc7b969612a5f5c78e0588f510ddd5b2173be224b1b5eedc5e51e9e5a92e
-
C:\Program Files\Malwarebytes\Anti-Malware\mb5uns.exeFilesize
3.8MB
MD5eaac9032a5151ea0d7b74ae4bab32b35
SHA1f2c1f886868f6b9f78aeda8cf95df5051239c1ef
SHA256807379fdd7315c29bc1e96ed224285ac5ae0226bdfa5318642eaed6bb0ca3191
SHA51291fc6c387ee270372c401aa27aa399c5f6091dbcf1e94058c88e5edb473a7876c9de632cff5a4d6479a2a9bdcfb499c8ac6cdd3bd954b04db89685ccde0661db
-
C:\Program Files\Malwarebytes\Anti-Malware\mbamelam.sysFilesize
20KB
MD59e77c51e14fa9a323ee1635dc74ecc07
SHA1a78bde0bd73260ce7af9cdc441af9db54d1637c2
SHA256b5619d758ae6a65c1663f065e53e6b68a00511e7d7accb3e07ed94bfd0b1ede0
SHA512a12ccf92bead694f5d3cba7ff7e731a2f862198efc338efc7f33a882fe0eb7499fb3fb533538d0a823e80631a7ca162962fbdfd78e401e3255672910b7140186
-
C:\Program Files\Malwarebytes\Anti-Malware\mbamsi64.dllFilesize
2.9MB
MD5ba3dd20eaddaf6f0b9f652490b2f7b39
SHA14bc99d0c45055704bd73a65839d7a9da17ec118c
SHA25690817632a51faf2d54ce2126a133bb0eb3c1f85206649448d23233979b4cfe1d
SHA512012cfa7cad96def22fc89e95b95e67ba98023a754f22af43aa6b8a54b12faaf01339c982a0076797b94c53a55311ddb3e29a2dc7014ae8ad0d5529aceafb2324
-
C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dllFilesize
2.7MB
MD5b7e5071b317550d93258f7e1e13e7b6f
SHA12d08d78a5c29cf724bc523530d1a9014642bbc60
SHA256467de01d7cee7ec54166b80658ff22f9feebdb1c24eaf1629cf40e4124508064
SHA5129c35293c95c1a9141740ac99315605964aa37c4a42d3a11cae9e5649ff1427a9480d3d5e7f763212cf13db3511c5ea3c84e68f95f0067fe6339a9d3fb7b27c54
-
C:\Program Files\Malwarebytes\Anti-Malware\mbtun.dllFilesize
2.8MB
MD52bbf63f1dab335f5caf431dbd4f38494
SHA190f1d818ac8a4881bf770c1ff474f35cdaa4fcd0
SHA256f21a980316bd4c57c70e00840ab76d9ad412092d7d2d6a2cff4f1311f7c05364
SHA512ebb9834323329dc01ba2c87e5fad1083a4cb86f5ed761cb63299ac5336a9843a1aadd42fbed706797c2295117af1c00f96806422338352653c8e0255fecc2fd5
-
C:\Program Files\Malwarebytes\Anti-Malware\mbtun\mbtun.infFilesize
1KB
MD55d1917024b228efbeab3c696e663873e
SHA1cec5e88c2481d323ec366c18024d61a117f01b21
SHA2564a350fc20834a579c5a58352b7a3aa02a454abbbd9eecd3cd6d2a14864a49cd8
SHA51214b345f03284b8c1d97219e3dd1a3910c1e453f93f51753f417e643f50922e55c0e23aab1d437300e6c196c7017d7b7538de4850df74b3599e90f3941b40ab4a
-
C:\Program Files\Malwarebytes\Anti-Malware\offreg.dllFilesize
114KB
MD5f782f049b0e8c13b21f8e10e705bd7e5
SHA15c11f955e3983c50ea46b5d432c97c9148ac8e9f
SHA25616c450a310edbea07f578f31368f168ec338011cd117406898593e86ebb83dae
SHA512eed29c42b14ff26a030f53d61d6dc8e3971e478dc7646b26189f14f16699b6bedc170c4bcc37efe2e8f3048bde37480033b49eaf1a4712b88464f5da0efc18f2
-
C:\Program Files\Malwarebytes\Anti-Malware\sdk\farflt11.catFilesize
10KB
MD5cab9aa45b50d2419e3a772946d790d04
SHA1047a95827e31c5fd366e8e43f517b1b903ed8e8a
SHA2560fedc4eaf11613bd44b76276542e3cabb36ce312fb37cf04b402741406b7c2cf
SHA51249a047a631d026dce5a302318f10c48de26e4788eb28fdedc3347d61f4696cd1fa2047bc2f64aee71fc5a6edc0a1ff026c66513784c68f1406d03b8a69447599
-
C:\Program Files\Malwarebytes\Anti-Malware\sdk\farflt11.infFilesize
2KB
MD51b378aed3afa33a9d68845f94546a2f6
SHA195b809a20490f689a2062637da54a8c65f791363
SHA2566ef70c4c969b91775368b3c5a6d0dce4c5a5d59463e32b872474f0c50b59774a
SHA512fe0706f48ae52a14936e372dc1406720baf21e018b12ad79727da892c498fc62af59efd08024ba257a94442270c1fe59859a81a2eb7be54be6c7a3cb76051808
-
C:\Program Files\Malwarebytes\Anti-Malware\sdk\farflt11.sysFilesize
229KB
MD505c4546c48547386962794da5cbb5f09
SHA1b61ed60ea92c221ed5a966e9a23b7ab8bfd461af
SHA2560b544b88164e64e3cdff31737a1e72baf855be114c2586ce16ffebf787d42593
SHA512b2446f22fd79db6ef3085e96305c3230ffa9dc8459caf2d4ecef33f8f94bb22bfd805b8a5f62e0eeab61e4b80f808f0790c0ce6e9222c0d2abaaa7ee32d9b145
-
C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.catFilesize
11KB
MD5aef40e9e7ca500f8d23f53a9b7b4fd1f
SHA19d6c9f4c18b6d57e43f26bb2593c11264a1eaa41
SHA2568e66264dc7478e517b72af31ca7a308be15ce7dc9060e5f0488fb186ab1220b3
SHA512f6857b87a244dd68ac14016bd6e25e31d45b1b00fcbe70129dccd33ab8db1d01d4c31651f5f7c08d237c76c0291a35e262fc7c25670ac11166354841272e1277
-
C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.infFilesize
3KB
MD55a9717e1385703e8f06b27aa10a69e87
SHA184ee67a9167b5eb6560711b9871de98898ad07a5
SHA25647b7c516bb57c612de19f0ca865590af95b6e32bf873a0fef9e011b2c5b483d4
SHA512dd3c7278c2c11ad15a55fae6d19b96dadd92f85b7f0c8ce934298258af00bb5c052a84a98499b8867b0f43704fb307c67d03692ca69dda4d814c6c17dd73df44
-
C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.sysFilesize
217KB
MD5ef356c49f9dbbfa13365a3fda7dfdaa2
SHA1ac5286b5570b83b733f5833e92a220e2ceb0ef7c
SHA256a507ab3164163a52c2039a02a1f5b7ab55fc120b1c1aa73930184086bcc5597b
SHA512d2d88333f367d0ccefca84b4a24185dea257b30a15c28ed26b00f04ac90b3b2c4e4c5c42e4bdb97e07895c4a5f3d38786fe811d3eb04bc10a1a4b7a55795d8f5
-
C:\Program Files\Malwarebytes\Anti-Malware\srvversion.datFilesize
9B
MD535c919c92586d90651a5183e962c4a5a
SHA148653cfa8c7a378f7226b3cc55052af55091f5c0
SHA25669cbe3b65794fd3ddb7e49ce394a6ce5ec8d8512d4a5932f24417c4c7b61e1fb
SHA512ea1159f582119a37dc4f3408028a00886bb4760cc5c3b51da53f186cec81ac2aba35ccf24bb2d35aee6effcf787f548583bb41977827c3ef0987a9daabb2e9c8
-
C:\Program Files\Malwarebytes\Anti-Malware\version.datFilesize
47B
MD544a066e1d108f3ee657aacc41a2ccbbf
SHA1fae90d1d8898385c0520f551f1894f65ca13f706
SHA25678a6b1923ccf638c0e435eb6119f72f77f454a9228ffdc67ddd4af90e9903657
SHA512d8f35576e1c537b26bdc7eef9140fead0266862889e429d46372063295f6733c406c29103f3e279474ea37c45f1684b0a67f61a39c5284cfa92249c13e7d9989
-
C:\ProgramData\Malwarebytes\MBAMService\LOGS\mbae-default.logFilesize
1KB
MD5c7e64c0e7fe484378c1fae2aa8e19b77
SHA113da48be7427bd73092edb4fa37a6d11e829052a
SHA256d52a6c9d784d89959b149226983d28daac4ece40107051e5a28e556d291b3fa1
SHA512f74fc65f9512402fd0ca3834d1e1ae10ea186743715a4ab8f8789ae773bd3060eb2a4f4a43d69b36c4b930ef279d75e8679ddb871eab998115a669bb0c1f03f1
-
C:\ProgramData\Malwarebytes\MBAMService\ScanResults\7d41dc6a-1b52-11ef-b972-ca658e39cca4.jsonFilesize
25KB
MD557ddc5b944c999b1412ae3693f09a010
SHA14f9e304404c67da38bfdfaa202fc4200ca4b858a
SHA2560dc066608555aaeaaafb015ed44c1a31ee74b2544cc76c757957d0fe53f38b3c
SHA512c0208fa5d5cbd8d4b661b4ab4c0002c1e8462859f2fa4de9a41991a83ae1ddec6b6f154316293ddc946c219421c0b22f7149f0306d29d3f86e9afa801d5618a7
-
C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.jsonFilesize
1KB
MD5a962393033d5a9719595357ca83c89da
SHA1f7c03e3cf69b763c2d8c76d4ab361a10e93f7dfa
SHA256a10525ffeee44d2549f32a867799d687f709b368033ec1045447df766609f672
SHA51277c382a1f0aaeb0f88c4d9acc84b3f08bf173a693ea746607f2d6cfa45da97ba1bf26aadf65156dacc1e472c34cb36798c1df0e56ee7c0f163089f6ec390a9a1
-
C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.jsonFilesize
47KB
MD52d00cbbc05672dd86b40537293653b88
SHA1e016b15852d89d85777f5556c32c6ae301cdc10d
SHA256506a2a4dc289aab4bc8ff9870233029b7178336cab44d2cb8c0bdb5593707fea
SHA51210a205b6054d4019073266285fcc01680452cb3ff0be05861904764cc2113bd50c5569f8c86a98db7cccf28db22610863b70c9a8bb8686d5407f1ed119cce297
-
C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.jsonFilesize
66KB
MD5882658591b13770d9f34923bd3808535
SHA124d663c0e0ebbb0e888181f3426b4fc367520786
SHA2562f7c1120129fdbc9585f45dd4c4ee73316ea9dadf48e3ed0f1a00ca12aaef39a
SHA512083f7f97c2f8aafbe8707e9502e18b012bcfd5d4ba1230eb2e6f7455ec69c821d289acb778ba8cbe73e3f7ade6e279d9b9e354081589953f61fdec995726cf57
-
C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.jsonFilesize
66KB
MD525eac49d82c9b9d2c4bd9091ed7bda60
SHA154c6c92cd3836d019c4ec5c1ea5446b59c18d21a
SHA256ef2f58150b3341b6c2314639e6aa9a733e472c6554701f56e383b631306103b6
SHA512cc0e9b9ae95d2a112bedd5bc92aa32a4645b1aefdb7683cd6367e4fb441d990a3de0aaf5cc7550453ef0c4db88f5682e445eccd64d3370bcb446d241f818bdf1
-
C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.jsonFilesize
89KB
MD564b8342944ac4185a91150fa10355815
SHA197a4536683baf25413839238d6e3eddc2d4d0efe
SHA256630dc490fcdd53b2b886ea60ce4982997fdda66237570be98f1c9e8e9068bbec
SHA512a9c178042af90bf08a53f77935aab998555db63ff9768ae1d43300c6dba3660b63842d907a585b63032a94c1e9f24c4c970dc74ba96c4007f6b784eaef3fbfd2
-
C:\ProgramData\Malwarebytes\MBAMService\config\ArwControllerConfig.jsonFilesize
607B
MD5ca299f3d044186c2bad2f06d687ad902
SHA1a5622d16e1effeaf9e20c1e1a8c3907e06c1c779
SHA256f730fe67c5441ecf294e45b223ef0bcb322928e5c415f334d691dcacccb2fac6
SHA51277e4f4925fc7c498258e93faa397f758febd584cf42e3c353b1102eff7e0bf3de3c87c1b0ac03f9967bb31edbd43e11c28f655fe4d470d884fbb1faf446e5942
-
C:\ProgramData\Malwarebytes\MBAMService\config\ArwControllerConfig.jsonFilesize
608B
MD55514c48ed19b2b1230bb5e01f00f5461
SHA1560a342e0a8a6b14734dbf39a0902f62269cf113
SHA256525c72bf79c4c8f770db359a9a8ce8d439e7e70fc469d55e8ad49ad8feadf43c
SHA512d4404a87310b954cdc7b17beb0a288ee08888ec0d80e6f386548cef6e33af8e966efef784e27abab74bc75a06b0af9452de19cce2a6d3a5b09964ce938a90c34
-
C:\ProgramData\Malwarebytes\MBAMService\config\CleanControllerConfig.jsonFilesize
847B
MD5787cc4e07a930d3b5f72dee2b597d776
SHA100b837f1dd2b6b68ff81a81b181ac32d6fc3e958
SHA256236a1bd58d1b550b2f4f3e7bddf1d1f19d9c2291ec7451a863b4116a13aa5609
SHA512616d0fd2019d7a21323da4cf3415914a6e0746f75850f48c749826266fbe7d2954cc4eb7dd4724950263fb7562f43329a8cf0344646395bf04c2f53550b7a7c5
-
C:\ProgramData\Malwarebytes\MBAMService\config\CleanControllerConfig.jsonFilesize
846B
MD5b96a041cae96afb5d80a04657c6adb5b
SHA1188e3dff38b668257d18b10411e4b077031f7292
SHA256c80ed5c8c28d0a3f64df32d3bb1edbc4a907318bc2eea813bdc5a3ed09116c23
SHA512d56b2073ebf05a17ba13ca0051ef8b53c08733e26a767f7e51b59981f37011a7388642e79e303b6c3b7dbe9b8fd08b8679334d2bfea1bebad60a2b0ee30b3e67
-
C:\ProgramData\Malwarebytes\MBAMService\config\CloudConfig.jsonFilesize
827B
MD502d67a36d3c6fc41663ba1074702b87e
SHA177325f7e0b457447fe577070b5e05643b2e58589
SHA256d025b8777a51306987fdd97c261bba0f4f43978e6e483c62c7cab39fa811d68d
SHA5127511b3638df4657956d6b37e87318ba60d6437d60123658e43da7a0b2cc52941a9c3b48ecb36664090a5bd3dc65e3750c1166d08cf721eb683c7d392a9f931b9
-
C:\ProgramData\Malwarebytes\MBAMService\config\CloudConfig.jsonFilesize
1KB
MD59fb02ff541b65012c9575941a21cbb9e
SHA1b1be9b43ced95648604a9c76123c2030e6e37b7f
SHA256e7cbefc373d7b348ef506f369a53093aa76a73b04cfefff4274aba827309ad3f
SHA512c6a872db96a597bd9a5222d4872c165ac978cb6c5d426f4d7e851e7c305b1ab348f35ac6395104b5e751211e3c41ec13bd90e8b6d460b0a7b7325a9ec5c71230
-
C:\ProgramData\Malwarebytes\MBAMService\config\CloudConfig.jsonFilesize
2KB
MD5e017a59ca67fa29cbf6dcf8fc5961978
SHA1b4a227fb15977e0bebe31f9023d89b94018b8998
SHA2563aba7b58903f83ffeba19fb425cb87069b3f4652ab19d179286a9e13ede4223f
SHA512142582c75f1e701b615d4e0e1de6f110e7999a6072b6fc4c17314e4a88efca2ee92107666e9a5c0937e648660554293e8b7207ec723441da72c8ac9d5d39c9a9
-
C:\ProgramData\Malwarebytes\MBAMService\config\CloudConfig.jsonFilesize
2KB
MD596d2cf26a0245a67e25667fafa641ce8
SHA1c4bd08155122cfa097673774db459b15b04262ba
SHA256f88e31eba1c5939b9da66733f4242d8ef9a9f6e8de3055941989c72476f37f82
SHA512351771763726db43f25659e9f7df4a307c948a831d3e87073f1b49b5ba42b21961b05425bfb31a2d5a1ee96761742e4bc4c6490b92aa4886f1e7bea407e54696
-
C:\ProgramData\Malwarebytes\MBAMService\config\CloudConfig.jsonFilesize
3KB
MD593a7c28de58e8481f89e936a3878a745
SHA1390e3b1b5bb2d4c0e00c4a2c03475d723cfa97db
SHA25694b58111c288d1ceb08b37f03c0d28a28c842ac624c1dcf5d53ad51a2066370a
SHA5125f7c1cc6bbd72ccca1111c3d819823c3ef83f38438be22b5007c16154ab960a4a4c8ce50b943975dd704b09a8c5661812dbc377a379ef39cdd27cfa0fb12a19d
-
C:\ProgramData\Malwarebytes\MBAMService\config\CloudConfig.jsonFilesize
3KB
MD52caa31a5a5a73b3f2a4d342f213040f0
SHA1dbd8fc9c66ad6288c41f30e2a4b38a858420e0e3
SHA256fc79ba2c0362a98aa22f6d2b0e24affce76dfd3f10df4d7f672533a80b15c3ca
SHA51228beeb9f8b26deac2556b9e691a8f3e787605dc9be6fe9ab7b1356fcf24a5a01822a0f59a5a3edac4a008b20b4c0709f45b30a8de01aef48e8b361ea82f27f26
-
C:\ProgramData\Malwarebytes\MBAMService\config\CloudConfig.jsonFilesize
3KB
MD56fc456802f2736b4114a5d14bccc7983
SHA1d2f9db00110c42939a7a2e5143a4edf7f2eb2d0d
SHA256f88cb2b08aa7522057fe3400a25843d1bb9593edbe7a0f42df3df3be857de75d
SHA5125359dc6f40fcf30b209d0a722b0925e610c9f8cdba3c33664695a119606b137c7bb30d1cd54fb658a78d0e37ba9c58f4c84ab561de8d04468cd8e9c7968b3f54
-
C:\ProgramData\Malwarebytes\MBAMService\config\CloudConfig.jsonFilesize
1KB
MD5ddfb6220a0044b84ded83ca03bbc7923
SHA1f9d13dc15a88f15afc1bb90d67c23ec65de76b78
SHA256ea2f9e2fd00f896b01e0fc1905839c3e5509f3ad1a9a844fbb96dc8a2858caa1
SHA51270eff7c04467b38af8aa6ae1a73007060d3d1057f656f000c06b65f3999c37d8ef7febae3b4e92c897edc663fbf21d04959f78b6673877696dc6468cb563d8d6
-
C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.jsonFilesize
11KB
MD5b14560e1fb0410d6697be2da843a25d9
SHA11992d152d3f0bff397947bd8bf39ccc78cb53cb5
SHA25679bf826b0c8f8059d13f23e8472fd4869a128d6e706df26920dcd6f69dd43744
SHA512512c5b7700f9990fdbc469c85e2887853e6167b643942a50e1aec3c0f1b25441dc77a3e9559b360e0b86fd9dc95dd6aaa44a0edcd3096f5cf9d818c67b8a5607
-
C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.jsonFilesize
11KB
MD51f34c11abebcacd66512e14e50e8e8ce
SHA19e8c688f86e81e4c2ead1c8ad2998eda62789813
SHA2560061f5ff71d9120b180be6f5262adcd8236122b98809eff69c5f84babbcf3912
SHA512ea9fbd681e82bb4a1e5b31788dafaaa7722aec27dd7870774976035f35c014c9e8c43fde3c9fc8286f5018f26cc1d77d72d57301d279e719a2f324df0ef2c393
-
C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.jsonFilesize
11KB
MD5088270d51693f088ae083ec7f7565085
SHA1cc2a507c59a036891f68b6f0f4aaa46d4952b21f
SHA2566ec3024a059e8af9ff15e9b63bde8265b467d7b064a2d74bbb0f80088af37f44
SHA512d02fc0c307f944c189d7b57926256e581c60f36591fa7f2fc02857c00211ccecfc49a3dc00d81526975c372462af4aca7e2656eef9f7f973fe6f022f9d3d1de8
-
C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.jsonFilesize
11KB
MD58b66d6b55c0e1b2d8981f3c3a99c3338
SHA17f81fed72fc07bc0adec5bb65b0c7ed85f8bbb85
SHA25663978a465cbaa247e252a2c401ac65fccd23313d10ace6f81758da540db8ad84
SHA512e627ccb97672c2e8e2410a9e9d451c2ae4390dc24ea1d96d173761b987a902d32fa13a9c9be249f5d040ddca737ea8050741d9de16614c0121ef1711e695cfa1
-
C:\ProgramData\Malwarebytes\MBAMService\config\MwacControllerConfig.jsonFilesize
1KB
MD5f0a67e26146e90b50b442f412d6c47ef
SHA1ee047f3d59ff80aa697f5460578fa2bd0c007b3c
SHA2568962c6814ed8a6b6b3ec130a52fe2c627f10117db02b17d9e1a6da25f38a769e
SHA5124bb4dd386738df3b1fd29df5cd0c1bbd6436b57efa1638f893b8bdf6bde24d543b8570db58b97384376955a746e9f635ec0508734863a11c7e58a02877723ec8
-
C:\ProgramData\Malwarebytes\MBAMService\config\MwacControllerConfig.json.bakFilesize
2KB
MD588f7c37a454ec3884a621894cd08de14
SHA149535502f3f9e13d0540de4de344f473d156118a
SHA2561ea8c0728e56411ea26faa328ae7f9f6a54c1e9de0a08ea5863951af70dd5dee
SHA512130267ac19d52bd596a07262e599d57b57a4d6bdd9ee5d293b8b5b167315eb5ab5242bc96899da4117ca65f913b91b4e2bf3d69fb8247dde4ce2d9b865e74111
-
C:\ProgramData\Malwarebytes\MBAMService\config\PoliciesConfig.jsonFilesize
814B
MD50b75ec4f1b0a541883604f718c0ae24a
SHA11e363060b38183bdb3aea46223a13ea54566f179
SHA2566a6dae5bb6958aae347ff035e5c99d5eb56964561059de5b5a1915fc2cbda016
SHA512f045cdb8e541b119e4e177a3c95357c6098a875209eefe40d1ba45994188bd353053ba363b26d61083c94cc55941f2255fa4591e100112e5e0f0b610af8e1a1e
-
C:\ProgramData\Malwarebytes\MBAMService\config\PoliciesConfig.jsonFilesize
816B
MD53b61b1ba5e5c3a06c650ac2584e8a597
SHA181b5b1bc4e895c64c4120902a6ccf46055cdd39b
SHA25685e8b048f10e32bd67f948b080fc3b1b44b358df6fab5de8f9f5ef7e7f57e85a
SHA512173f22b21b5d879c7cdc3afffd40cd807f85639e081f7d77445f3eeeb939d222952d63670287db87b7e014f02e2b29bcde5c69f630b15318323889b42b6f69bf
-
C:\ProgramData\Malwarebytes\MBAMService\config\RtpConfig.jsonFilesize
1KB
MD581f3709f4eb418e7839693b541484283
SHA1d351296dcffb8f3a2a87d1a923908bae4f630310
SHA256e78ab3c89eb6cf56c6427c5969a57bf41aba170d354c2492f29477dd56709a99
SHA51279a48974c1ff424327591604a2415548762bbb3282276ee1185ad78e208c68cd37991327907a88e564cf4fda44e9917f487f2e53b426e8d5b47528c59bff4661
-
C:\ProgramData\Malwarebytes\MBAMService\config\RtpConfig.jsonFilesize
1KB
MD5cb9c2a156649dd0aef92f39f58773155
SHA16381a9b6d53060c0cc3a61f4ff41f29822b37d91
SHA256448981c34aea9dee695ddadfb63257a835d4f09867a11731c87d66ba72c35d23
SHA512f12007e0b8d3f3e5a739029544b5c621ce10f57b95e80550662a6f71bccdc00fb30c90b0e20227fa7adfc5894dec1acf61e04baa4dff1f42c9b4235623452fa7
-
C:\ProgramData\Malwarebytes\MBAMService\config\RtpConfig.jsonFilesize
1KB
MD596dc633c8b6da7d5316f332f358d29b9
SHA12e95909773f82c27d30f23770edf5c716322f375
SHA256270b1036bae0d3b907869b169351d30991c5ce866a2be6109d622b1c74e14cd0
SHA512f6ed3d44e1ec27b69f77dc0762931a890ddae627c9e568afde75b85bea378754ba444bcf34785db691ea85830e8181369e8ff0bc142d4ddac7d90f87132252e0
-
C:\ProgramData\Malwarebytes\MBAMService\config\RtpConfig.jsonFilesize
1KB
MD57b673af70b41acc41ccec135ea13e118
SHA1a6e30be305fe88204d18a3c2dd7ee31759ade4af
SHA25693e512708ab667eff694921eb5b99b90aafb43d99a8bb0e4ade75f0910bedd45
SHA512cbf6913dacc2cafb3f393105fe58a87f6412152a397e9ed944ae5b8a1b49967f80a39cc642ede6ef6c2386f2b868d79ddc3322299321a8d5855a704a9c2640c2
-
C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.jsonFilesize
2KB
MD5a91be39ed47abe46c8f2a87369874062
SHA1efe174e617ffc8948f6b5afbca1f834ff48bfb11
SHA25696bff8341af2a479b9b9f47d7dcc786792fa07a80654ad1fb6d2249da3f23993
SHA5128db54258a6424be8d2d0d020bd9ec39fd1d562bc8beffe27509f29408035c4e07fc071bd17379281059db42a780801b522db11cd6833176ca1018ac71f64257a
-
C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.jsonFilesize
4KB
MD5ccc1fca5bbcf64b06768b7a17d3ea3b2
SHA1dc89e82859e621b39f1222f746e8d1f815ebce9e
SHA25623d06ab95b7799eebc2616d7256cc932523c2c68367f6b3be83496a76f24fc57
SHA512a4dc3d91ad93d4924a8157b69793263a64cf3cb0724a196a92b08059925d3e03cf63ab2ce77a43736e2fe53e0901603523a71fede5a3e9064fbef60f6e555d8c
-
C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.jsonFilesize
7KB
MD5e73b8a01cefef77ab9f11008108bdc32
SHA166fcd4c8b0a0adb56ae434961bcceea06ea793f5
SHA256240b6b8a8c59adac12b69379338eb74eb6e25c8306eef250a64fa6d7da16271c
SHA512aa11073d9656312e88272061fcacc7bbd0c4fc9531e84b6cbaee4233d66ae61da61267b5d69b2443ab78eb80f094448c62e8a205192858bd4a5fddd4ae58fdd8
-
C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.jsonFilesize
7KB
MD58f5d91f84066c6b2722de968795b56da
SHA1ab56c8229ff2a2dc749bd8d575ee73daa8fd8933
SHA2561f785e2de7df7ee3c642e4ddeb4c1f1ef9c8d5e7085faef7bd179b424fb7f7dc
SHA512204f16b3029ad7c2ddb801426a5ca528df31a91fa123e41f58ef4bea283aaf2b60276c8c35c7d6eed6b9cd07b8a607d03ec814c4d631dda4cdb9668d17afd1cc
-
C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.jsonFilesize
7KB
MD5cc1c52e540602a7fc39933db1ca7261d
SHA12366700ff099ea1e70e3cda61d21c7b842306013
SHA256bbb1aee7e8fafa28e1153f675e315439e5d25da133a28d8ff57d27699aa7f50c
SHA51221fb3d62f71619cfb63f00cdf27d3228756f944e7d682e882973d1c33b476950f7f21e99d6cfb390f09a14b92337358e0ada9ccfdc6da9c2245c71bfb3cda330
-
C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.jsonFilesize
7KB
MD52e56ddfe5adc5f78b723305fb7e5d2b3
SHA1396a580d5549b3183e0831c0fe410759afa37a4b
SHA2569633fac18a4a3e84c44d486cfdf319c08581f0956cca56c764ea1211c5701ccf
SHA512896cf5b41473c9e6fefdb2506ba5b66ebadf8da6f922128ed735a1120db1e4090be4168865973c5d6d23e0f337c7d99edc71a90404089c262166cfdf49476f94
-
C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.jsonFilesize
7KB
MD5f3be721b0e8c42c53ee739f4b0b7e930
SHA1011b1fd838e4f1d18f60d70c50f597090e7915ad
SHA25621fcbef2cfe54b74b2c0668073f29a584b6593137c98f15bfb1673b30e55d24e
SHA5121e0603635c52d9471068c41f63af217706fb056a3d323b0289e176987c277a15ff46f86693657f211fdf213b1fdc4f63cc23a0dd5a57176442530ddb5deedcb2
-
C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.jsonFilesize
7KB
MD55595df36ae8ddc33d8b517eadffa8932
SHA1ea98daf2936c3fa09851c97ac1cf0ecac2163d77
SHA256142ba356c8ed44de7d6ae1c1a6d81f2df03f001a09f0839fd3c70b1cca7c79b7
SHA512909bef06bb77798fc88310409df51817e2a3287135866bcbc5a9c98208fe4a6d653c23e37ba0e41876f2f82997039c4f38e7247ea68d4ea26a851c7b7d5c714c
-
C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.jsonFilesize
7KB
MD52236571a1169ff933afae65fe292ace4
SHA17c95ae5ffff765696eeec39e5460a961cbf74d05
SHA256f4606f4c55733592aeb34ecf8d10e1c21c8fb5477e8644c29419e8dcf37dc547
SHA512f027317f79ed08199b2ac320a1c0915aff00ed5786df03ec87d6517d068ed46cb92c8b1867e8ed17867891a9005e36bcc14071cf986a0368b1e8158c1a1a6544
-
C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.jsonFilesize
7KB
MD57cb3abf644f84888d7c810f611a841e0
SHA193e8bdb31e3c7a5de4616cf08fd4a54eb4591cfc
SHA256fafed0c7a4bc3b394c7a2880a443655ee1cdfb4820d8fedcdf7466034624d436
SHA512bf7411308e2f7cb379406ce518e052cf2003923bf0f90a01b921e095a65413aec4b97ee6d7a8a844769d3bf56928ef444323ad2cccb8a0f558289b70f23f0a6c
-
C:\ProgramData\Malwarebytes\MBAMService\config\SpConfigFile.jsonFilesize
11KB
MD539878f7ba14435b53a12ed07d5335273
SHA1859089fdc0e89f58d73e94708410a62579fdd49e
SHA2562bbff9597f704ada80169502301ae75bf751b3f0dcf54415eafc2f797031d215
SHA512370570c60aec90b2357a0ddae7063b05284d571d43493c5632e3d6393b95cfb609aa514ec6f09cf18a18e8c2a2f53f6f5c4a24c6b3a559d859421740ae36e173
-
C:\ProgramData\Malwarebytes\MBAMService\config\SpConfigFile.jsonFilesize
11KB
MD56dc46f31e51e907ea5e96f4a291e4df0
SHA14065bfe0c04729310991882575dfdc114952d546
SHA25684d9f69e353d64b2f8bb3c087957d123bed70bb88aa2b641e3982068439fe315
SHA5129033e457020c302064c976cd24d9fc766434419816890955396bd5c8c261041405debd35bbf87e4d8c2a3f872e1b1f385b7b4d2ca7d96a918c6d5c5ff2374e58
-
C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.jsonFilesize
1KB
MD51292763aa1c2f698861f5b183ca06c2e
SHA1b23369b2e6e8dc01b81f69d5e580743440f00944
SHA25615d0d8bd02598a7a6a35afe0f716e64f65e7c7910c2f776babef585257052368
SHA5126d32b020efd59bb3b108f765a5c1642c35471dd13c8577c4e05981bbb6a5a8d205079d1663cf856c85fc042c9ae1bb00288f2077fcfdedb4094d0ad04f0cae7f
-
C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.jsonFilesize
1KB
MD52475ef3315906fabf1161c52c21def54
SHA1a4070db794bee597d2d240162931ed0729eb7b7b
SHA256869f3ed6ac2e136e58c0507b1dc56ef9b9bf6496bdc414ce9adfc680e564b111
SHA51278def1d55b5dbaed5aff1b9150633a33a0637711bff7965a6bf672d9936e4de208cfcb1258ae3cf3bbf350c04addf24b9b0f99c41719d67790d90186469cbc3e
-
C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.jsonFilesize
1KB
MD5f12791f417dbad3cfa9a9bab9b3a2d42
SHA1eb8c59df97fbabed9c4fc6ce9013aee85337827b
SHA25629eb0f831725cda5e087c0563c4a698f5f468d9d38641f4900485a890fab2101
SHA5124fd8673859ba6f7d9481df24ac2c518735235c5bc31cda48a2fbf66631b14e7f799efbece7082ac382b94992756744763c2105af2ebc1075e5db3cce00634251
-
C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.jsonFilesize
1KB
MD539404d5d5a2c8c537fe027761afebd32
SHA1f4de1c69550ab75dcb8782dc3c084e4bfd7193bc
SHA2568484b9009c2e44ffa95e133c2d00c3d88e35a97aa44aa3eed148a0d4a36797b1
SHA512ec0f6bfde250434f9049cb0f3940643271bdf6fe408fe80bc4d9d4385154bd6856503b96a029155db30662e31c15eca24bbb2776402f1b2e6aa25e68be4cfb1e
-
C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.jsonFilesize
1KB
MD5eab30783e304484ef5a393e21d4c37ac
SHA1c09a324e5b9212511b92b158616b299dad3ac545
SHA256219359648a80038a25fb00a670814e8cc9ebec447dadb48c7b656b8d57a08d61
SHA5124e0033d8095c3a82e619d26d2044f57044afd43f3ce23a91e91c0d33a6273e74f1e93463b660bb5887a30a51b8e1a9f20da4db4c59e92b6532a491932a08dd87
-
C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.jsonFilesize
1KB
MD53660e28ad549d7ff9bf74d77b999628f
SHA1486a07b97ba0bdd8c089b1da101df94c247273fc
SHA256bf092a1d9db6f7b467bbc0572d56e3313adbe9980b0f8dc4572cce3691c37097
SHA5125ab2f100b157c21ad7cf904874fd1955d07eaebc9466adea510be3c14b0e5dfcd041432099e0008a3624c0931770be504ae1a62887cd8e405ccc6dd01828cdb2
-
C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.jsonFilesize
1KB
MD5bf1ee5b2286f335c8ed57aa1d9fb0905
SHA1c192761d2d98147a936eedec5aef3932a0a433e9
SHA25650aa1e5c376a4c58843a9509ac3690b385652f45049a86e53a26f8bef4d176bc
SHA512bd01a1a7dbd9e86fa86d14362c9147341139d48a0b3f7c855d3703c905554c5258312101dae3236c2770e38870e0c6ad775880859a6a692ed7285491c9df05bd
-
C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.jsonFilesize
1KB
MD55156f625d2ecbb125583876208be0013
SHA1fec3da0c802cf16aac1677dc3ff319ea4babcfa7
SHA2569634d009689631495f9f25905a1c95663c727faff9b426e8b9961b989ea5d36b
SHA512768b91106c547dfce9575bd11b491bc6f2ab850c49cd75234a091c1ddcb8e10018095f305b75859ebe0dcda05c8180c516979369fd63ec04f618bcea61352eb2
-
C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.jsonFilesize
1KB
MD5b3b465f112f05faf86fe0000e5f82efe
SHA1c9026bed18cd0bc89b1437c55ec495f9433edf1a
SHA25654bd258712d387092d92ef62229a0e91266b87eaef4e115c639d4f26661d9213
SHA512105839beb65880a378b23d6818ea3bee792f6997a5b4e830ea738e4517dbb06801ceff95bdfe7e11aaaaba8d5b7272d94bce83943b0a339ec9a46b40ba565302
-
C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.jsonFilesize
1KB
MD59c2452edb98cb68ed73a2612786450ee
SHA115a19c0ad4334a0c1f56d132903b4a20932896b5
SHA25605866adfec0ea8d843c3c97248e2dd79fc76d3905d943990af0f891f71378124
SHA5121bde0bbeccc15230851187372d6d18a3b0560faf2250cdf298b72d9e15aca98ab32613e507ec0c30e8debaafc3492cf6130919f20be74c41b122d257213cbf06
-
C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.jsonFilesize
1KB
MD50a54be7a6e8916cfb7357ab04eb51cf5
SHA170bc94e285cc756332f5197616b1de99dc0aefec
SHA256ba5e319014842afe9cd7b6092adbb3a151a5bc30992d3eca7cbee121afd1afd5
SHA512a30b0d671c270b1928a3f35617b0ded496b86bbc2dae8fa905773d26d9cb721043ac0d00671808b682df649a3ab3a29a34b2e3c470ef686e64f75aefab078939
-
C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.jsonFilesize
1KB
MD5d5cc1d86c575daeef9b685daa3bd00fb
SHA1dd97891c59f886f27db78926de3e99db6630eb05
SHA25641e69d181e8603a6fa6aa20f355c45a6eb71ca29bcb58812ad174850764d36ab
SHA512c0564e748b9ccd70e8f88b8ab67ca52c3982f0fd9d777951aa22cb2227ee5cebaf3845170cb6fd52bfcf008ed8b3b4eb8f87158b794c75acda4be329046ce610
-
C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json.bakFilesize
1KB
MD51239675fc8d74363e7b7a0342a60dab1
SHA166fae647899a307b46d75846624be8f6ad1e43b3
SHA256915cb26a4d19bd4fded6232ca6d2abb2b183921db76c7a0eba66321d4fa81c35
SHA512ab5380d50b8bb52077962adc7cdd81289467451ab4f5e74384fa030a0b5bfa149785afa965fbaa1f0eb6f460b7253e9fb5d004cf8b0fd5f6afc007d6b574241d
-
C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json.bakFilesize
1KB
MD506cc66aaff9701ba0203548c8d4bee07
SHA1d19e1eb218537b6a455fd6b4510c0271e8c07fb4
SHA25671fe8c4d9c75bcfc6dfa46a5f7a53e517ae7afaf8c63cedb7bb0d909d30b9000
SHA512e47fb5a12e90e42e74690fe70bc240751106c4377a0b6df8c350039b889ff76297bb7f4e8ce50438987e9c258acd7471867acb088dea4950c8ea31e98b67c43e
-
C:\ProgramData\Malwarebytes\MBAMService\config\VPNControllerConfig.jsonFilesize
1KB
MD5d8366a3a58e1e504e60c322dfa8eb0db
SHA187f9e97e79b44837b529c95fddd88695f8e90a4f
SHA256452ebb40f8c324fad3906cc3f59cf69b0c093434f5dc8bf26fefe64ff254cd59
SHA51218b0325ffa444ad696806caea14d321c14786035bd67bba814b2e7913571e1e2585115f8cc4d64a69eb506130dee2d4afbfdf534530eb36cec8c9e3ed272a0d2
-
C:\ProgramData\Malwarebytes\MBAMService\config\VPNControllerConfig.jsonFilesize
1KB
MD51501e991ceccb8c3aa5a8b26bfee37fc
SHA144b257f2daddd40d3c730d42bdfef1d5f147ba91
SHA2564b864638bef1cddbbd150a7f4e7a3b1de813b39616a6ac155e3d4c5361fdd18a
SHA51288c0e90c6839c3011b30a4248ba0017d5d1c8ebdd16b8ea5ce8ce0a79d1413d041f184471770df00b79c0a812b58527b37d5c31c4b2dbf1c87a5a4ac81ace275
-
C:\ProgramData\Malwarebytes\MBAMService\config\VPNServerListConfig.jsonFilesize
125B
MD5192fdda4f11749fc626dbe82f8edccab
SHA15577489de2da1a3d4e82c0f114fcfb369c214e43
SHA25623851b99c52668ef71d827ff2c47defeabf7a77714fbf8581bab18c94536101d
SHA5129e1052d1dce1ff49f772db8cdc3d6d964cd766b2f9980a645dc96b86bb767c50fd474c896ac7f17d0287c9ccd291cd10650b7a6be6f89c67af4ab012b509d49b
-
C:\ProgramData\Malwarebytes\MBAMService\dds_tmp\D20.tmpFilesize
1.1MB
MD53b337c2d41069b0a1e43e30f891c3813
SHA1ebee2827b5cb153cbbb51c9718da1549fa80fc5c
SHA256c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
SHA512fdb3012a71221447b35757ed2bdca6ed1f8833b2f81d03aabebd2cd7780a33a9c3d816535d03c5c3edd5aaf11d91156842b380e2a63135e3c7f87193ad211499
-
C:\ProgramData\Malwarebytes\MBAMService\dds_tmp\D25.tmpFilesize
504KB
MD5b5d0f85e7c820db76ef2f4535552f03c
SHA191eff42f542175a41549bc966e9b249b65743951
SHA2563d6d6e7a6f4729a7a416165beabda8a281afff082ebb538df29e8f03e1a4741c
SHA5125246ebeaf84a0486ff5adb2083f60465fc68393d50af05d17f704d08229ce948860018cbe880c40d5700154c3e61fc735c451044f85e03d78568d60de80752f7
-
C:\ProgramData\Malwarebytes\MBAMService\dds_tmp\D33.tmpFilesize
1.8MB
MD5804b9539f7be4ece92993dc95c8486f5
SHA1ec3ca8f8d3cd2f68f676ad831f3f736d9c64895c
SHA25676d0da51c2ed6ce4de34f0f703af564cbefd54766572a36b5a45494a88479e0b
SHA512146c3b2a0416ac19b29a281e3fc3a9c4c5d6bdfc45444c2619f8f91beb0bdd615b26d5bd73f0537a4158f81b5eb3b9b4605b3e2000425f38eeeb94aa8b1a49f2
-
C:\ProgramData\Malwarebytes\MBAMService\dds_tmp\D55.tmpFilesize
68KB
MD554dde63178e5f043852e1c1b5cde0c4b
SHA1a4b6b1d4e265bd2b2693fbd9e75a2fc35078e9bd
SHA256f95a10c990529409e7abbc9b9ca64e87728dd75008161537d58117cbc0e80f9d
SHA512995d33b9a1b4d25cd183925031cffa7a64e0a1bcd3eb65ae9b7e65e87033cd790be48cd927e6fa56e7c5e7e70f524dccc665beddb51c004101e3d4d9d7874b45
-
C:\ProgramData\Malwarebytes\MBAMService\dds_tmp\D61.tmpFilesize
1.2MB
MD5607039b9e741f29a5996d255ae7ea39f
SHA19ea6ef007bee59e05dd9dd994da2a56a8675a021
SHA256be81804da3077e93880b506e3f3061403ce6bf9ce50b9c0fcc63bb50b4352369
SHA5120766c98228f6ccc907674e3b9cebe64eee234138b8d3f00848433388ad609fa38d17a961227e683e92241b163aa30cf06708a458f2bc4d3704d5aa7a7182ca50
-
C:\ProgramData\Malwarebytes\MBAMService\dds_tmp\D65.tmpFilesize
116KB
MD5699dd61122d91e80abdfcc396ce0ec10
SHA17b23a6562e78e1d4be2a16fc7044bdcea724855e
SHA256f843cd00d9aff9a902dd7c98d6137639a10bd84904d81a085c28a3b29f8223c1
SHA5122517e52f7f03580afd8f928c767d264033a191e831a78eed454ea35c9514c0f0df127f49a306088d766908af7880f713f5009c31ce6b0b1e4d0b67e49447bfff
-
C:\ProgramData\Malwarebytes\MBAMService\dds_tmp\D66.tmpFilesize
4.7MB
MD5a7b7470c347f84365ffe1b2072b4f95c
SHA157a96f6fb326ba65b7f7016242132b3f9464c7a3
SHA256af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
SHA51283391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\Actions.dllFilesize
4.5MB
MD520d70c6e04dbf14c01ab2d756e97854f
SHA1f172c8b8c0e87d2a9ab064513dce004d16d03e0d
SHA256c4002339b58bc493ae3540bafe1b2ca0a70bba0f853e29f60e0f6a1680fa9a24
SHA51213e073cd4b3d53c6d9fdda671a55962266b5c0a18abcb5774092c35f0d0bf2c5d0d9802d8955d32cceb166821634bfc067dac7809c9ade143cf3a3b497743b36
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\BrowserSDKDLL.dllFilesize
5.4MB
MD5a3fe79081a59d493c01b5c1139babdc9
SHA11505cb4053bcd9b55c40227ad6b62a2457cebbdf
SHA25660c8c024ff020f04fcccec10ee78872bb1e6985463d6370c6af095761d88b860
SHA51222310a585edb36050ff20356cd9eb5129cdae3ffea2ccd7a54d9652dbd336d7f402ed119dc59ae3250b93bad40e75983184256c0bb239cff049bbb983f487bdc
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\cfg.binFilesize
845B
MD51bea85f6f77b365122fd5f51b10777e3
SHA12431dda3ae3310739fdbc59a1c40aadf5b0c5e2f
SHA256ebb6bfbcb66f79d34e10c57e70b26aee5f99e11207e6f103c660b4c2a005f771
SHA51201402e189787bb653c14400721acd55ed2ae78f94c4ce9d0c9b9fd8a49ee504136bee56deaf24291e0594dfc73489a973d54f2e19094ea21f061cad2daf35460
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\ig.exeFilesize
1.8MB
MD5478df352bc79ef18c258b53f662b0885
SHA1e80aff69534545fa437074818da66c5b06ce85a7
SHA25695370683adaec8d785ee7368d590cac8de0e7add72c88c24aaefcbfde9ac1826
SHA5121771d6d85614369c810a52c2044b4e8b6014fe4ee62c1586b28442eafdd0db50c9d514a3e0c94cca2a2450da2fca19ddca74608dea5ab0edf87a7d78b34685bb
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\sample.dllFilesize
529KB
MD571c2939bcb601b29868a2549fc22a827
SHA1e4065e0a62cd60915ebae2d510830f50b3a4c266
SHA2561a2348213858488dfb80c9ae5ed650352879a9593c776e56edea92ea1c1e146f
SHA512ba2f9a22a3be1f470dfa7ea933eee04d4fcd5c8b38b0d2d3ed38d197e5f3aa3ecf3f82fdcd11aad34bb427ea39ea394220ba1a628c6aed3d6c80289b795b1028
-
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\version.datFilesize
26B
MD56ec2d877d80609b91e3264197f9dfa59
SHA1a0a8a36ed994ce4aed74fbf923baec08503ef680
SHA256d0360853e6bb0ea6160fe553e121ae279c11536319d9eca87590e556bc834395
SHA512c296b49812dfa98350e6e57431dbbf43fb50399a11a1a27c796da098b95d4fcb03865df0e33220efaa41016df75704a5d421561fb6f32bde1d0b76bc78ecebf8
-
C:\ProgramData\Malwarebytes\MBAMService\updatrpkg\SdkDbUpdatrV5.dllFilesize
2.6MB
MD55c4b6998682070ad73cd246eae251ccb
SHA1d4e3eef6332a6598e5d63741f3407574c7de5f5b
SHA25654e0e90cc5cfef91ceab363c6cad54c7190cfbbecf6353181779938a3f8de8a1
SHA512e1f844ecb631b628ff37068ef474b070e22c5be6453c77acde53e886b7e9109f22d09748a7902e64237f5cc9d05818080c0bb5697918235ea2d4ceefb68b8524
-
C:\ProgramData\Malwarebytes\MBAMService\updatrpkg\expapply64.dllFilesize
365KB
MD599c8e47d747b36be8ffcfdd29b80dc3d
SHA19b8e87563fee31abf90bded22241f444b947b071
SHA2560db4dcdf3fbeef2c4d18555f479a28dde3d67ee6f0d27c18925207142b7a38f7
SHA512f9cf4ec06585c6cde57011884141782bde83adf186f57f75576c8dade1e868d6b886daf8fa15c55ac908ff995c4b6323c3a8266dbd664b807cd67cf788f7074e
-
C:\ProgramData\Malwarebytes\MBAMService\updatrpkg\mbupdatrV5.exeFilesize
5.9MB
MD529f9d89e02980685ff1f024468dd2316
SHA1eb0bdd93268b2a553bc1b9f34c06803f26e981cc
SHA2562d2d04f3f4c09222accadd7ee64c57b5d9b7c96f5aaaa7aa8f2be7b717e47e56
SHA512cd828a4c373686b4a8fd885fdb507987d5708c8f6b665af27ad038aed9313bddc646fd3fbe8b09149eef6c4dfd9149ddfcac80b0c02087f88d6ce5961fb02309
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
1KB
MD507b737913a9bf98c63275bddd825e8c2
SHA1e404ab1df2c3b16c0479bd6aee3f72037866dec7
SHA256ebccb131eae3c0970ee355a9a7225c95a56a3a6252c33332780abde4a077381b
SHA512b3ac0e12b99ca66faf0dd7a6c9e11ea04004a07fa3383a31f60dfcb12117cebe876a2ea7b8b59af9100a624ad33a17005275d09197a2272cbd39a875c0279c76
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1Filesize
264KB
MD59d0ed4d6fc7cbe5587a92c2b29af9941
SHA19c4acf63c3c3af44d896aa27886369ff7b42e73b
SHA256c0a87207dc7da671e82d8693ca1d892a08629f11ae66c62f55bb487595809f73
SHA512e46382e88558a86b4c8e670fe25c2790009e8f371cba85dbad9f46d98a2f120eafffd92417062dc3c9ca1d591b337d7cc1741712d272ceb4dd735721a54a42df
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
6KB
MD51eed95e25a80518ebeb44d1b5df40ebb
SHA12d6604fd2120dac7ff464b2dcb9e11f70cee0f0c
SHA256ced800fb8ab9d0755226f72247048c0f21ca1829a6e1aa07ad7a811b7d60df75
SHA51225decb462fb93c7282029b1226b9057565cfe2ea360422fd2d464c58ac472aca7eca44d9e38181078f9515c56df8ee5289ef3013eb647ecb28aa31c00529433a
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending ReportsFilesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
692B
MD5ddebeab6bae1b1874d3d3d37ffd088aa
SHA1b89579834ecf9de835668551c20be86fc8d76d67
SHA2567f03b6b241fad3133caf3d8195edd9df54d98d78f7b09734d4dd41a2311aefb2
SHA512b4d7404ef3526852e30bb32b6d1c371302705de553e6e84e0c2809e4beb038686e80cf237c78f056a982e4cae2b44c5d6d8050a78f4708dc6f9b6ce92000d0df
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
1KB
MD597eff2076856a5a755be678421a93158
SHA148ab29370be1fb153483fab110543b48290e2033
SHA25633f91b7b35855521643f1b30fb7c026216e1075b8de4c4d94c628f4f03f4af57
SHA512d7bb7816fc7a0b0f1d2738fc820595e5d8f56cd951dde9462b729943a89128808b79147825bf81ca1c3b35a8ace2fa95da1a7e1e9665a0043b28af749e7d41e6
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
524B
MD565e997b619f57455875a73dd51ab4262
SHA150edaa90926faf2b4898c4d538b9a150922518ed
SHA25675c1999d6c6e88220f9d5fc588595d22f6603c92798b30e9cc705e10afd4d001
SHA5122fdef7b5ff53177b15948cdbb52bd80f084cfbbf657fda3a5ff9a938afbd78bc15ed69bdd3d21a98b9863ec5dca1e645b7b78635ed5de4215beb1b389e84f4c4
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
8KB
MD585ff8735c562742ca7db98abfc073ea2
SHA1d380872320e9c5f062212736a9adbf7cfa46cf41
SHA256fe984b2d2abf4f9308575f096d58a5722719275ef1c6edd2bed2b9c949c27f43
SHA51278a2a166783e47387cdb2e66c2bee899ef352233bd6efa6da64c3e5fb32d1b6a9e982acda92ba6dd684875263e529f1bf00b60701ee548872c7039c58cd0c66f
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
7KB
MD5723f390eedb1a7b4f2984d2ae1d119e7
SHA1f8681654be94d1d5da6f0f22e10d78e8602127e9
SHA2562cd87dd01cf2b47fcd476472b21438147ff940ce69172dc5405bc0ada6b5c24c
SHA512ba4d4780feed4bf86e8f6ef4d69d6253b032bbf669109f81b8fe4ea9c600abf2a07ed196bbbaa2469be6307e6aa166d1b41d28ca04d6ac4f9a339ef384acb879
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
7KB
MD59bfde457930d5d90eafc7763dfb90da0
SHA1a9be7ae70db02bd4a14626b5834e3bef28e521bb
SHA25688d2c2158e77396c68d0b6a04813f183c37ac61ffe04b2b541c87befdbe40d3b
SHA51230b642d5001346b6d9c62c91cbdfd33a7c5bf776b673da4f13b4d21eb2c10c166ea5a3e37c5296d5d88574c4ab3a5794217037cd2660ed34c366d5db9d6e1672
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
7KB
MD5c6687b7ba660f6bfe43b91b25bab756e
SHA1d92f21593942e815ec8d886f57d7adf56a3d5eb8
SHA25645f80788a56b9d99ae1f3c317b4dc5c677cd50e2e2a593229688f2364348d3d7
SHA512edf8faad545da175dcf46e30096ee9e24733c1acc5500fd28c4c562087ee28a83f3b4cf691bcfbdb94d32cba8b1629a381052c7466baf550ff7153ddb74768f7
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
7KB
MD5c885ed3e9e59faec6366a28a7d911163
SHA1c6abb1498d291820c1e63662b0efe16158178ffa
SHA25672b1378ae6b1c84d582e6cac1059aa657c7b6a76dcc0e4e09d83d34c41524eb0
SHA51284720dfd5a6bd0e57c2465fdf684c89e24d2dc629d0f7ea409615aceb5b2ddc7c5838342a3306c97037c25caa9e6f15bdecf9596eea30dc76d70d614efdb9e8c
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txtFilesize
56B
MD594275bde03760c160b707ba8806ef545
SHA1aad8d87b0796de7baca00ab000b2b12a26427859
SHA256c58cb79fa4a9ade48ed821dd9f98957b0adfda7c2d267e3d07951c2d371aa968
SHA5122aabd49bc9f0ed3a5c690773f48a92dbbbd60264090a0db2fe0f166f8c20c767a74d1e1d7cc6a46c34cfbd1587ddb565e791d494cd0d2ca375ab8cc11cd8f930
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe578de8.TMPFilesize
120B
MD5b6429a15849cc6c25eb857eff086a58c
SHA1a7f5851b346552a7a353a1df73aceccac469a589
SHA256814d3d09b81e5d4b74346ff81b8b3b6b1c8d5327bc6d570df4b296f9436bcca3
SHA5121680070af76780d035d4ea7efbf53168ea5e29c85ae65bce9f1942357a596ff67cb9d41db6e50d7f196488fd8c260756663073cc2608598c475fe89b4915384d
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
130KB
MD5a109186cf3d1132c8dcf5fadf2f737a7
SHA1d05e60b5d85c8c2c12946b8d2d80af184a15c691
SHA256366ce70dec58fc937c157769e05ba28de824471cf0eb862463d930bf85975799
SHA51251261d181c4f82a5c97428a6f4f7c6ef904886dda2b1ad636b369ad9a8bd39db29a31fc3c6a00ecfa2e8b81cd9d9c5fb0dc5d3fa1301301e767ce6ff9c0b5a92
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
130KB
MD5a2d3d0fe8922048715698f91697bd333
SHA166fcd0ebb56bd109615448fa14cc1ccb98f505ea
SHA2561fb35bae63076c7324e5f063ff335acf496bbeb526326044f46e82bc04d402bb
SHA51268e760a0d218bd656884941172449e0649a2dbc682d9ad3cb283bdc04c9c01e06a8b6d00c0b46b81d7a888b316a8fe5db76be8cf11ca9b453d33ad6f0655b530
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info CacheFilesize
102KB
MD5d0eff207f51eba2cf289b8a80b344eb1
SHA126d991b720f8907eeb0efb35260f38e0ada8ab53
SHA2565b7ae12a0da84f0173b3fc26ba88a104c7e527ff6e88f182ce68d59f41a7950a
SHA5120b3283783585370098c86767f6ad090a921d2bf1119ab442fb140df68da8784f8869a61c3b6d1bc68ab47c6783a66a7b1ffe9ebd2e51e9863ad82dcede26b2b0
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe580f4d.TMPFilesize
82KB
MD59f7a867276be17f3767d9340922c7459
SHA18b3e946ce8e8d09cbbea2372b64824e691c57cbd
SHA256c2be25bb253b5553ee73e556dfbf775af1bfa4eecb5b250a80470d427285eb9d
SHA51231f4820c61d9d5c64de508b92dbf74c88b7e55ce721db27fd67ee36817a6d574868fa9c724640706f2bfa05e55db32eb9d410f6da5420190b67eb53f934e9848
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\~earchHoverUnifiedTileModelCache.tmpFilesize
10KB
MD52e56dbd85517148dc8733dd106b003a9
SHA1df530ee34696db5b5c216babc7fa952520f80422
SHA256d19ad8afb24f2052791aebbea64a71d3bf3221d2a0b1e83e5f6d6c2ddfa5a513
SHA512aa3d23635fa90e3bda66b8489686afc0ff085d94a7e275437d1575d3baacae941c2051115e9b6dd3f8cd6d61b884ca9708282bc172cdee0d4dc58b1f6e8ea82c
-
C:\Users\Admin\Downloads\MBSetup.exeFilesize
2.5MB
MD56107ffe4a1a1ee9eb2453ca669791ac9
SHA18f69617ffd69adab260500ec25d5ae50cc49b882
SHA2563c68baabc345c58d95825e548a395d305775b7f0313ec42997c17870ea6a458f
SHA512305ed565d5b61271e3deac9ab254ce2d70c031f4713c9b37212ea56ff061b8ce0afb5002c02a5252991c506d217f3f6aad439c192384646432f2ae71c252fb56
-
C:\Users\Admin\Downloads\MBSetup.exe:Zone.IdentifierFilesize
26B
MD5fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1d59fc84cdd5217c6cf74785703655f78da6b582b
SHA256eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
SHA512aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
-
C:\Windows\System32\CatRoot2\dberr.txtFilesize
2KB
MD5bc4a39e4ebc566bfdd3c0adef0685032
SHA13c0b5a4b7cc3a83387b390ee6632716b659edd62
SHA256adb986e0460f5a1252fdae062ab2b52d0953573ea8d59d7a575b36a16849371b
SHA5121274204f244d1b66bb939ac8d3cf97adf5ed98bab6f9e6b114110d47aeb487866b4c30d490a7786805a4d8586dcbc963f9fdf9088405caa2f69880565ccaaa32
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\21EA03E12A6F9D076B6BC3318EA9363E_6EF0095DA824AE045AE9FC5B645DF095Filesize
5B
MD55bfa51f3a417b98e7443eca90fc94703
SHA18c015d80b8a23f780bdd215dc842b0f5551f63bd
SHA256bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128
SHA5124cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399
-
C:\Windows\System32\drivers\mbam.sysFilesize
76KB
MD5113e213914c40631aedef185984c5629
SHA157bf886bfe1e4d765ea43e4c91709a5c4a9a024a
SHA256d314cea3ba19c49342763fca6b64a33f12d730a8fa531ed9f7e75675035ba004
SHA51276d7286963f28430d8a9bc3b59adf209b5fceb6a5248b7be54c60fff0b931ba2cf46a779f7e66008baa0853ad6ce55a4b9dd56e33574230d1e2588f7679630b8
-
C:\Windows\System32\drivers\mbamswissarmy.sysFilesize
233KB
MD54b2cc2d3ebf42659ea5e6e63584e1b76
SHA10042da8151f2e10a31ecceb60795eb428316e820
SHA2563db4366ccb9d94062388000926c060e2524c7d3ee4b6b7c7cf06f909f747fc6c
SHA512804d64d346b3dbb1ce3095a5d0fa7acc5da0bf832c458e557dac486559fe53144f15f08c444fea84a01471fd5981e68801a809b143c56b5b63e3e16de9db0d98
-
C:\Windows\Temp\MBInstallTemp5128e1c01b5211ef88ebca658e39cca4\7z.dllFilesize
2.5MB
MD5a144e24209683e3cba6e29dab5764162
SHA1ab2112cce717bec8f5667721a072d790484095ec
SHA256b2ff9dbf90cbd0c45cd7d95ce4892377ec7e92970e05f2e56b0ce93861190348
SHA5122c823981b53b7eb7c1b726468d3b28c234c7e555aab35e759e88d38658566d267a20867f1cb18d96c830e7d53643629a9fa313eecee8b553703086fbb64cc984
-
C:\Windows\Temp\MBInstallTemp5128e1c01b5211ef88ebca658e39cca4\ctlrpkg\Malwarebytes_Assistant.runtimeconfig.jsonFilesize
372B
MD5d94cf983fba9ab1bb8a6cb3ad4a48f50
SHA104855d8b7a76b7ec74633043ef9986d4500ca63c
SHA2561eca0f0c70070aa83bb609e4b749b26dcb4409784326032726394722224a098a
SHA51209a9667d4f4622817116c8bc27d3d481d5d160380a2e19b8944bdd1271a83f718415ce5e6d66e82e36819e575ec1b55f19c45213e0013b877b8d61e6feb9d998
-
C:\Windows\Temp\MBInstallTemp5128e1c01b5211ef88ebca658e39cca4\ctlrpkg\mbae64.sysFilesize
154KB
MD595515708f41a7e283d6725506f56f6f2
SHA19afc20a19db3d2a75b6915d8d9af602c5218735e
SHA256321058a27d7462e55e39d253ad5d8b19a9acf754666400f82fe0542f33e733c6
SHA512d9230901adeecb13b1f92287abe9317cdac458348885b96ef6500960793a7586c76ae374df053be948a35b44abe934aa853975a6ccd3788f93909903cc718c08
-
C:\Windows\Temp\MBInstallTemp5128e1c01b5211ef88ebca658e39cca4\dbclspkg\MBAMCoreV5.dllFilesize
6.7MB
MD565dae541c8dbc3e18f1bc9150ffad616
SHA1f9c98b9eee98e94240c425a4548aae1b5d943ea6
SHA25675249cc6d5ddbb92a76f6750165380eb3b6182cdd4733d8a18003b7dfc88b558
SHA5124f2755add2fa384d617e7bd6d5d2c793503b54a284eb04be78682a0b6cfa7e6369995ae6625bd085ba2887b5034760323dfc61c2b28ea6db91b9d17a8394e988
-
C:\Windows\Temp\MBInstallTemp5128e1c01b5211ef88ebca658e39cca4\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\mscordaccore.dllFilesize
1.3MB
MD53143ffcfcc9818e0cd47cb9a980d2169
SHA172f1932fda377d3d71cb10f314fd946fab2ea77a
SHA256b7fb9547e4359f6c116bd0dbe36a8ed05b7a490720f5a0d9013284be36b590b7
SHA512904800d157eb010e7d17210f5797409fea005eed46fbf209bca454768b28f74ff3ff468eaad2cfd3642155d4978326274331a0a4e2c701dd7017e56ddfe5424b
-
C:\Windows\Temp\MBInstallTemp5128e1c01b5211ef88ebca658e39cca4\servicepkg\MBAMService.exeFilesize
8.5MB
MD58c89563b4351b2c39d94c81ec37ace7b
SHA14c238dcd62b99226b3ac1a67c7b7c2cc2ad1edf4
SHA256d17e0a77d02d5875318c14af09ee900bc4bafb87a96b2f84dfc9ef7656884228
SHA5128f1421c8a553acc7d4541cf6d319ab97abf2803a2c0c83ac7ac8d1dc9335eeb0bd911e79a0bedc14e65f1eb523efb76f9cfea0dd71a79e43c9501c954546ef2a
-
C:\Windows\Temp\MBInstallTemp5128e1c01b5211ef88ebca658e39cca4\servicepkg\mbamelam.catFilesize
10KB
MD560608328775d6acf03eaab38407e5b7c
SHA19f63644893517286753f63ad6d01bc8bfacf79b1
SHA2563ed5a1668713ef80c2b5599b599f1434ad6648999f335cf69757ea3183c70c59
SHA5129f65212121b8a5d1a0625c3baa14ef04a33b091d26f543324333e38dcdb903e02ccc4d009e22c2e85d2f61d954e0b994c2896e52f685003a6ef34758f8a650c7
-
C:\Windows\Temp\MBInstallTemp5128e1c01b5211ef88ebca658e39cca4\servicepkg\mbamelam.infFilesize
2KB
MD5c481ad4dd1d91860335787aa61177932
SHA181633414c5bf5832a8584fb0740bc09596b9b66d
SHA256793626d240fd8eefc81b78a57c8dfe12ea247889b6f07918e9fd32a7411aa1c3
SHA512d292e028936412f07264837d4a321ecfa2f5754d4048c8bcf774a0e076e535b361c411301558609d64c71c1ce9b19e6041efa44d201237a7010c553751e1e830
-
\??\pipe\crashpad_1316_HYOIDVWFMAQINVATMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/2824-4435-0x00000292C1C50000-0x00000292C1E70000-memory.dmpFilesize
2.1MB
-
memory/2824-5046-0x00000292C1C50000-0x00000292C1E70000-memory.dmpFilesize
2.1MB
-
memory/2824-4735-0x00000292C1C50000-0x00000292C1E70000-memory.dmpFilesize
2.1MB
-
memory/2824-4879-0x00000292C1C50000-0x00000292C1E70000-memory.dmpFilesize
2.1MB
-
memory/2824-5497-0x00000292C1C50000-0x00000292C1E70000-memory.dmpFilesize
2.1MB
-
memory/2824-5552-0x00000292C1C50000-0x00000292C1E70000-memory.dmpFilesize
2.1MB
-
memory/2824-5570-0x00000292C1C50000-0x00000292C1E70000-memory.dmpFilesize
2.1MB