Analysis
- max time kernel
79s - max time network
83s - platform
windows11-21h2_x64 - resource
win11-20240426-en - resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system - submitted
11/06/2024, 16:01
Behavioral task
behavioral1
Sample
malwarebytes-4-6-8-370.exe
Resource
win11-20240426-en
windows11-21h2-x64
28 signatures
150 seconds
Errors
Reason
Machine shutdown
General
- Target malwarebytes-4-6-8-370.exe
- Size 2.5MB
- Sample240611-tf9f4sshpr
- SHA256 377ac497bdeb20e13ea84ca1eab709946535b77d4231007a7646509386a4af33
- MD5 7ce024e6e2248ee891248469894d8a9c
- SHA1 13db96c5e8d67b7f1141d22567741cd45d659c1a
- SHA512 ce5b6e7b7da5d3d00ad1df64006c24c291e24cb63e855855375e52e7a18ea7b3d283fababb79046a59533bcd80d8c18f604d9ace64af7e712f18020e5b351eff
- SSDEEP 49152:YXrcUh6gxrxD0Xc3StQyfvE0Z3R0nxiIq2ddIAuSF:4rNRxrxA6KtQRq2SSF
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 2068 created 3296 2068 malwarebytes-4-6-8-370.exe 53 - Drops file in Drivers directory 9 IoCs
description ioc Process File created C:\Windows\system32\DRIVERS\MbamElam.sys MBAMService.exe File opened for modification C:\Windows\system32\DRIVERS\MbamElam.sys MBAMService.exe File created C:\Windows\system32\DRIVERS\mwac.sys MBAMService.exe File created C:\Windows\system32\DRIVERS\farflt11.sys MBAMService.exe File created C:\Windows\system32\DRIVERS\mbam.sys MBAMService.exe File created C:\Windows\SysWOW64\drivers\mbamtestfile.dat malwarebytes-4-6-8-370.exe File created C:\Windows\system32\drivers\mbae64.sys MBAMInstallerService.exe File created C:\Windows\system32\DRIVERS\mbamswissarmy.sys MBAMService.exe File created C:\Windows\system32\DRIVERS\MbamChameleon.sys MBAMService.exe - Modifies RDP port number used by Windows 1 TTPs
- Sets service image path in registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MBAMSwissArmy\ImagePath = "\\SystemRoot\\System32\\Drivers\\mbamswissarmy.sys" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mbamchameleon\ImagePath = "\\SystemRoot\\System32\\Drivers\\MbamChameleon.sys" MBAMService.exe - Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate MBAMService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion malwarebytes-4-6-8-370.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate malwarebytes-4-6-8-370.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion MBAMService.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Downloads MZ/PE file
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: MBAMInstallerService.exe File opened (read-only) \??\G: MBAMInstallerService.exe File opened (read-only) \??\N: MBAMInstallerService.exe File opened (read-only) \??\R: MBAMInstallerService.exe File opened (read-only) \??\S: MBAMInstallerService.exe File opened (read-only) \??\R: MBAMService.exe File opened (read-only) \??\W: MBAMService.exe File opened (read-only) \??\Z: MBAMService.exe File opened (read-only) \??\X: MBAMInstallerService.exe File opened (read-only) \??\Y: MBAMInstallerService.exe File opened (read-only) \??\T: MBAMInstallerService.exe File opened (read-only) \??\U: MBAMInstallerService.exe File opened (read-only) \??\W: MBAMInstallerService.exe File opened (read-only) \??\Y: MBAMService.exe File opened (read-only) \??\E: MBAMInstallerService.exe File opened (read-only) \??\A: MBAMService.exe File opened (read-only) \??\B: MBAMService.exe File opened (read-only) \??\U: MBAMService.exe File opened (read-only) \??\L: MBAMInstallerService.exe File opened (read-only) \??\N: MBAMService.exe File opened (read-only) \??\P: MBAMService.exe File opened (read-only) \??\V: MBAMService.exe File opened (read-only) \??\B: MBAMInstallerService.exe File opened (read-only) \??\P: MBAMInstallerService.exe File opened (read-only) \??\Z: MBAMInstallerService.exe File opened (read-only) \??\I: MBAMService.exe File opened (read-only) \??\Q: MBAMService.exe File opened (read-only) \??\T: MBAMService.exe File opened (read-only) \??\M: MBAMService.exe File opened (read-only) \??\E: MBAMService.exe File opened (read-only) \??\J: MBAMService.exe File opened (read-only) \??\L: MBAMService.exe File opened (read-only) \??\M: MBAMInstallerService.exe File opened (read-only) \??\O: MBAMInstallerService.exe File opened (read-only) \??\V: MBAMInstallerService.exe File opened (read-only) \??\K: MBAMService.exe File opened (read-only) \??\O: MBAMService.exe File opened (read-only) \??\S: MBAMService.exe File opened (read-only) \??\K: MBAMInstallerService.exe File opened (read-only) \??\Q: MBAMInstallerService.exe File opened (read-only) \??\H: MBAMService.exe File opened (read-only) \??\H: MBAMInstallerService.exe File opened (read-only) \??\I: MBAMInstallerService.exe File opened (read-only) \??\G: MBAMService.exe File opened (read-only) \??\X: MBAMService.exe File opened (read-only) \??\J: MBAMInstallerService.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\FA0E447C3E79584EC91182C66BBD2DB7 MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\572BF21E454637C9F000BE1AF9B1E1A9 MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\572BF21E454637C9F000BE1AF9B1E1A9 MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\117308CCCD9C93758827D7CC85BB135E MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FA0E447C3E79584EC91182C66BBD2DB7 MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_6E4F36431D86962EFD432400DF65AC90 MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_6E4F36431D86962EFD432400DF65AC90 MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\38D10539991D1B84467F968981C3969D_C92678066E2B4B4986BC7641EEC08637 MBAMService.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt MBAMService.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\38D10539991D1B84467F968981C3969D_C92678066E2B4B4986BC7641EEC08637 MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\117308CCCD9C93758827D7CC85BB135E MBAMService.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Malwarebytes\Anti-Malware\vcruntime140.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\api-ms-win-core-heap-l1-1-0.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\api-ms-win-core-processenvironment-l1-1-0.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Imagine\BusyIndicator.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Imagine\Dialog.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Material\Dial.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Material\qqc2materialstyleplugin.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\languages\lang_cs.qm MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\VerticalHeaderView.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Universal\TextArea.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\mbamelam.sys MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\plugins.qmltypes MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Base\CalendarStyle.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Fusion\Tumbler.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Imagine\Drawer.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Imagine\ItemDelegate.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\BrowserSDKDLL.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Base\images\button_down.png MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Base\images\focusframe.png MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Base\images\groupbox.png MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Base\images\spinner_small.png MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\TreeView.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\ScrollIndicator.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Universal\Frame.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Private\FocusFrame.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\msvcp140.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Universal\ProgressBar.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Dialogs\qmldir MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.inf MBAMService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\Qt5Svg.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Base\images\scrollbar-handle-horizontal.png MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Fusion\BusyIndicator.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Imagine\MenuItem.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Dialogs\images\warning.png MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtWebEngineProcess.exe MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\styles\qwindowsvistastyle.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Private\TextInputWithHandles.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Material\VerticalHeaderView.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\ig.exe MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\api-ms-win-crt-convert-l1-1-0.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Menu.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Private\Control.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Dialogs\qml\qmldir MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\XmlListModel\qmldir MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\mbamelam.cat MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtCharts\qtchartsqml2.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Base\images\knob.png MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Desktop\qmldir MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Switch.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Material\Switch.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Extras\Dial.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtCharts\plugins.qmltypes MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\SwitchDelegate.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Material\BusyIndicator.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\api-ms-win-crt-private-l1-1-0.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Drawer.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Imagine\qmldir MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Universal\ItemDelegate.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Dialogs\DefaultFontDialog.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Extras\Private\CircularTickmarkLabel.qml MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\rtp.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\languages\lang_nl.qm MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\MwacLib.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Base\images\leftanglearrow.png MBAMInstallerService.exe - Executes dropped EXE 10 IoCs
pid Process 3696 MBAMInstallerService.exe 1952 MBAMService.exe 768 MBAMService.exe 4084 mbamtray.exe 5432 ig.exe 5440 ig.exe 5448 ig.exe 5456 ig.exe 5688 mbam.exe 1368 MBAMWsc.exe - Loads dropped DLL 64 IoCs
pid Process 3696 MBAMInstallerService.exe 3696 MBAMInstallerService.exe 768 MBAMService.exe 768 MBAMService.exe 768 MBAMService.exe 768 MBAMService.exe 768 MBAMService.exe 768 MBAMService.exe 768 MBAMService.exe 768 MBAMService.exe 768 MBAMService.exe 768 MBAMService.exe 768 MBAMService.exe 768 MBAMService.exe 768 MBAMService.exe 768 MBAMService.exe 768 MBAMService.exe 768 MBAMService.exe 768 MBAMService.exe 768 MBAMService.exe 768 MBAMService.exe 768 MBAMService.exe 768 MBAMService.exe 768 MBAMService.exe 768 MBAMService.exe 768 MBAMService.exe 768 MBAMService.exe 3696 MBAMInstallerService.exe 768 MBAMService.exe 768 MBAMService.exe 768 MBAMService.exe 768 MBAMService.exe 4084 mbamtray.exe 4084 mbamtray.exe 4084 mbamtray.exe 4084 mbamtray.exe 4084 mbamtray.exe 4084 mbamtray.exe 4084 mbamtray.exe 4084 mbamtray.exe 4084 mbamtray.exe 4084 mbamtray.exe 4084 mbamtray.exe 4084 mbamtray.exe 4084 mbamtray.exe 4084 mbamtray.exe 4084 mbamtray.exe 4084 mbamtray.exe 4084 mbamtray.exe 4084 mbamtray.exe 4084 mbamtray.exe 4084 mbamtray.exe 4084 mbamtray.exe 4084 mbamtray.exe 4084 mbamtray.exe 4084 mbamtray.exe 4084 mbamtray.exe 4084 mbamtray.exe 4084 mbamtray.exe 4084 mbamtray.exe 4084 mbamtray.exe 4084 mbamtray.exe 4084 mbamtray.exe 4084 mbamtray.exe - Registers COM server for autorun 1 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57CE581A-0CB6-4266-9CA0-19364C90A0B3}\InprocServer32\ = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbshlext.dll" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{580243BF-3CEE-4131-A599-C6FED66BEB1B}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{251AD013-20AD-4C3F-8FE2-F66A429B4819}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE8A9269-9E6E-4683-BCD3-41E9B16696DC}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{03141A2A-5C3A-458E-ABEC-0812AD7FF497}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F6D29500-933C-447C-9D88-9D814AF73808}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DE03E614-112D-43E0-8E15-E7236CC32108}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F36AD0D0-B5F0-4C69-AF08-603D177FEF0E}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{278637DA-FDFB-45C7-8CD8-F2D8A9199AB0}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{580243BF-3CEE-4131-A599-C6FED66BEB1B}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D372F21-E6DA-4B82-881A-79F6CA6B6AE1}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D5599B6B-FA0C-45B5-8309-853B003EA412}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{376BE474-56D4-4177-BB4E-5610156F36C8}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E1AC7139-D1FF-4DE9-84A4-92E2B47F5D2A}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9DAB0CA5-AE19-41AE-955C-41DD44C52697}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{11D1E5E8-14E1-4B5B-AE1A-2678CB91E8E5}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F1C46F8-E697-4175-B240-CDE682A4BA2D}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{130CD414-6BFD-4F6C-9362-A2264B222E76}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F6D29500-933C-447C-9D88-9D814AF73808}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{376BE474-56D4-4177-BB4E-5610156F36C8}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9DAB0CA5-AE19-41AE-955C-41DD44C52697}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57CE581A-0CB6-4266-9CA0-19364C90A0B3}\InprocServer32\ThreadingModel = "Apartment" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{11D1E5E8-14E1-4B5B-AE1A-2678CB91E8E5}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{11D1E5E8-14E1-4B5B-AE1A-2678CB91E8E5}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{17BE78EE-B40A-4B9E-835F-38EC62F9D479}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D5599B6B-FA0C-45B5-8309-853B003EA412}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{376BE474-56D4-4177-BB4E-5610156F36C8}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36A65E46-6CC1-4CA2-B51E-F4DD8C993DDC}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F1C46F8-E697-4175-B240-CDE682A4BA2D}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E1AC7139-D1FF-4DE9-84A4-92E2B47F5D2A}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE8A9269-9E6E-4683-BCD3-41E9B16696DC}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{17BE78EE-B40A-4B9E-835F-38EC62F9D479}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{03141A2A-5C3A-458E-ABEC-0812AD7FF497}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F36AD0D0-B5F0-4C69-AF08-603D177FEF0E}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{278637DA-FDFB-45C7-8CD8-F2D8A9199AB0}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{278637DA-FDFB-45C7-8CD8-F2D8A9199AB0}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DE03E614-112D-43E0-8E15-E7236CC32108}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F415899A-1576-4C8B-BC9F-4854781F8A20}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BF474111-9116-45C6-AF53-209E64F1BB53}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F6D29500-933C-447C-9D88-9D814AF73808}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F36AD0D0-B5F0-4C69-AF08-603D177FEF0E}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{580243BF-3CEE-4131-A599-C6FED66BEB1B}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{251AD013-20AD-4C3F-8FE2-F66A429B4819}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9DAB0CA5-AE19-41AE-955C-41DD44C52697}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F415899A-1576-4C8B-BC9F-4854781F8A20}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BF474111-9116-45C6-AF53-209E64F1BB53}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36A65E46-6CC1-4CA2-B51E-F4DD8C993DDC}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DE03E614-112D-43E0-8E15-E7236CC32108}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F415899A-1576-4C8B-BC9F-4854781F8A20}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BF474111-9116-45C6-AF53-209E64F1BB53}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F1C46F8-E697-4175-B240-CDE682A4BA2D}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D372F21-E6DA-4B82-881A-79F6CA6B6AE1}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D5599B6B-FA0C-45B5-8309-853B003EA412}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F36AD0D0-B5F0-4C69-AF08-603D177FEF0E}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{130CD414-6BFD-4F6C-9362-A2264B222E76}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE8A9269-9E6E-4683-BCD3-41E9B16696DC}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{17BE78EE-B40A-4B9E-835F-38EC62F9D479}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{03141A2A-5C3A-458E-ABEC-0812AD7FF497}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D372F21-E6DA-4B82-881A-79F6CA6B6AE1}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E1AC7139-D1FF-4DE9-84A4-92E2B47F5D2A}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{130CD414-6BFD-4F6C-9362-A2264B222E76}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36A65E46-6CC1-4CA2-B51E-F4DD8C993DDC}\LocalServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57CE581A-0CB6-4266-9CA0-19364C90A0B3}\InprocServer32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{251AD013-20AD-4C3F-8FE2-F66A429B4819}\LocalServer32 MBAMService.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MBAMService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MBAMService.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION MBAMInstallerService.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\mbam.exe = "11000" MBAMInstallerService.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\mbamtray.exe = "11000" MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION MBAMService.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\mbam.exe = "11000" MBAMService.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\mbamtray.exe = "11000" MBAMService.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\15.0\Common\Security MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\16.0 MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\15.0\Common MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\16.0 MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0 MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft MBAMInstallerService.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:\ MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\16.0\Common\Security MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust MBAMService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs MBAMInstallerService.exe Set value (str) \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:\ MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\16.0\Common MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols MBAMInstallerService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Malwarebytes MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs MBAMService.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs MBAMService.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed MBAMService.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\16.0\Common MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root MBAMService.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Malwarebytes MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs MBAMService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\15.0\Common MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs MBAMService.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Malwarebytes\FirstRun = "false" MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\16.0\Common\Security MBAMInstallerService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "198" LogonUI.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:\ MBAMInstallerService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432" LogonUI.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{61964EBA-D9C0-4834-B01C-A6133F432BB1}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8FEFED84-854E-4029-A986-1D7774D4CF7D}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C2E404A3-4E3F-4094-AE06-5E38D39B79AE} MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DD3CFEBD-3B8E-4651-BB7C-537D1F03E59C} MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{76AD4430-9C5C-4FC2-A15F-4E16ACD735AC}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EEC295FA-EC51-4055-BC47-022FC0FC122F}\1.0\0\win64\ = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\\16" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E1AC7139-D1FF-4DE9-84A4-92E2B47F5D2A}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7995CBA9-83E0-4F28-A50B-DFDE85EBCCD1}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E1BA0B73-14BD-4C9D-98CA-99355BD4EB24}\TypeLib\Version = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D10B0F61-43AA-40F4-9C6C-57D29CA8544E} MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F418F2F6-5173-4E4F-80EF-AF21E516C461}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{237E618C-D739-4C8A-9F72-5CD4EF91CBE5}\TypeLib\ = "{49F6AC60-2104-42C6-8F71-B3916D5AA732}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{616E9BE3-358B-4C06-8AAB-0ACF8D089931}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD3CFEBD-3B8E-4651-BB7C-537D1F03E59C}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A2D4A69C-14CA-4825-9376-5B4215AF5C5E}\TypeLib\Version = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8640989C-20B4-41BE-BFE1-218EF5B076A6}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FA6C70E7-6A6D-4F4A-99BF-C8B375CB7E0C}\ = "ILinker" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F22E03D6-F159-40A0-9476-16F3377B58C9}\TypeLib\ = "{49F6AC60-2104-42C6-8F71-B3916D5AA732}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{ADCD8BEB-8924-4876-AE14-2438FF14FA17}\ProxyStubClsid32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F927AD37-BA5F-4B86-AE22-FE2371B12955} MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{10DAE713-FD88-4ADB-9406-04CB574D543C} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F418F2F6-5173-4E4F-80EF-AF21E516C461}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{24F9231B-265E-4C66-B10B-D438EF1EB510}\ = "_IMWACControllerEventsV7" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{778103CC-4FA4-42AC-8981-D6F11ACC6B7F}\ = "IScanControllerV19" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8153C0A7-AC17-452A-9388-358F782478D4}\TypeLib\ = "{A82129F1-32E1-4D79-A39F-EBFEE53A70BF}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D57ACF19-30E3-4B7E-BCDD-6EEB8E57AF27}\ProxyStubClsid32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{53260A87-5F77-4449-95F1-77A210A2A6D8} MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{25321640-5EF1-4095-A0DA-30DE19699441} MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3DCF0F42-EF8F-4450-BA68-42B61F594B2F}\ProxyStubClsid32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EDF63EDA-B622-44E2-8053-8877E33BB49A}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F22E03D6-F159-40A0-9476-16F3377B58C9}\ = "_IMWACControllerEventsV9" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6B2CCE9B-6446-450F-9C9D-542CD9FA6677}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A9D47FCC-ECEC-453C-9936-2CD0F16A8696}\TypeLib\ = "{FFB94DF8-FC15-411C-B443-E937085E2AC1}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D2D1C2BC-3427-478E-A903-ADFBCF5711CD}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{ADCD8BEB-8924-4876-AE14-2438FF14FA17}\TypeLib\ = "{0E2822AB-0447-4F28-AF4C-FFDB1E8595AE}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8153C0A7-AC17-452A-9388-358F782478D4}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{72F290D5-789C-4D8A-9EBE-63ECEA150373}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{08927360-710B-483B-BEEC-17E51FF84AF9} MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C9669A3D-81E8-46F6-A51E-815A0863D612}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{50538523-AA2F-40D3-9B58-DB51D5BD3D4A}\TypeLib\Version = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{332AFEBA-9341-4CEC-8EA6-DB155A99DF63} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{55D0C28B-2BF3-4230-B48D-DB2C2D7BF6F8}\ = "ICleanControllerEventsV3" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D8891F9E-90C4-4B3D-B87B-92DEA9221EBB}\ = "ITelemetryControllerV8" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C2E404A3-4E3F-4094-AE06-5E38D39B79AE}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2846D47E-9B85-4836-B883-6A7B493E2D6A}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1C510D99-F27D-457F-9469-CFC179DBE0C7}\TypeLib\ = "{2446F405-83F0-460F-B837-F04540BB330C}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MB.AEController\CurVer\ = "MB.AEController.1" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8C842243-BDAD-4A93-B282-93E3FCBC1CA4}\TypeLib\ = "{C731375E-3199-4C88-8326-9F81D3224DAD}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{19B9825A-26E8-468B-BD9F-3034509098F0}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{34544A67-823A-484D-8E18-371AFEAEC02E}\ = "IRTPControllerEventsV6" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4BDE5F8-F8D4-4E50-937F-85E8382A9FEE}\ = "IUpdateControllerV3" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6C5B978B-68C9-45C7-9D6E-0BA57A3C7EB2}\1.0\0 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3F656FD9-2597-4587-8F05-781C11710867} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3968399C-D098-40AF-9700-734B46FF03C9}\ = "_IScanControllerEventsV8" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1E3F0FEC-3E40-4137-8C7D-090AFA9B6C5E} MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2650A9C4-A53C-4BEF-B766-7405B4D5562B}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1A173904-D20F-4872-93D5-CBC1336AE0D6}\TypeLib\ = "{FFB94DF8-FC15-411C-B443-E937085E2AC1}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{32DF4C97-FE35-41AA-B18F-583AA53723A3} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{473BC184-760C-4255-A118-E8064C4EC595}\ = "_ISPControllerEvents" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F6A99D88-2CA0-4781-86B9-2014CDC372E8}\ProxyStubClsid32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7EF16D72-5906-4045-86BC-16826F6212FE}\ProxyStubClsid32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E149FEF9-F1DC-4894-8A8E-AA53F6807EFD} MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D1E6E99C-9728-4244-9570-215B400D226D} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8E1F91DE-30AF-469B-9A09-FCF176207F0F}\TypeLib\ = "{FFB94DF8-FC15-411C-B443-E937085E2AC1}" MBAMService.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\1C58A3A8518E8759BF075B76B750D4F2DF264FCD MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\2AD974A775F73CBDBBD8F5AC3A49255FA8FB1F8C MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0D44DD8C3C8C1A1A58756481E90F2E2AFFB3D26E\Blob = 190000000100000010000000e9fe3f941400b279d238b701cb8c891e0f00000001000000200000006d29dbed0025d7540e14e4110aefa547c48fc75c85e2180b6038f18e126cb74f0300000001000000140000000d44dd8c3c8c1a1a58756481e90f2e2affb3d26e140000000100000014000000abb6dbd7069e37ac3086079170c79cc419b178c02000000001000000ba010000308201b63082015ba0030201020213066c9fd5749736663f3b0b9ad9e89e7603f24a300a06082a8648ce3d0403023039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412033301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f7420434120333059301306072a8648ce3d020106082a8648ce3d030107034200042997a7c6417fc00d9be8011b56c6f252a5ba2db212e8d22ed7fac9c5d8aa6d1f73813b3b986b397c33a5c54e868e8017686245577d44581db337e56708eb66dea3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414abb6dbd7069e37ac3086079170c79cc419b178c0300a06082a8648ce3d0403020349003046022100e08592a317b78df92b06a593ac1a98686172fae1a1d0fb1c7860a64399c5b8c40221009c02eff1949cb396f9ebc62af8b62cfe3a901416d78c6324481cdf307dd5683b MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474 MBAMService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\1C58A3A8518E8759BF075B76B750D4F2DF264FCD\Blob = 1900000001000000100000003b878212830eb36469856f1c683b836c0300000001000000140000001c58a3a8518e8759bf075b76b750d4f2df264fcd2000000001000000c2040000308204be308203a6a003020102021006d8d904d5584346f68a2fa754227ec4300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3231303431343030303030305a170d3331303431333233353935395a304f310b300906035504061302555331153013060355040a130c446967694365727420496e633129302706035504031320446967694365727420544c53205253412053484132353620323032302043413130820122300d06092a864886f70d01010105000382010f003082010a0282010100c14bb3654770bcdd4f58dbec9cedc366e51f311354ad4a66461f2c0aec6407e52edcdcb90a20eddfe3c4d09e9aa97a1d8288e51156db1e9f58c251e72c340d2ed292e156cbf1795fb3bb87ca25037b9a52416610604f571349f0e8376783dfe7d34b674c2251a6df0e9910ed57517426e27dc7ca622e131b7f238825536fc13458008b84fff8bea75849227b96ada2889b15bca07cdfe951a8d5b0ed37e236b4824b62b5499aecc767d6e33ef5e3d6125e44f1bf71427d58840380b18101faf9ca32bbb48e278727c52b74d4a8d697dec364f9cace53a256bc78178e490329aefb494fa415b9cef25c19576d6b79a72ba2272013b5d03d40d321300793ea99f50203010001a38201823082017e30120603551d130101ff040830060101ff020100301d0603551d0e04160414b76ba2eaa8aa848c79eab4da0f98b2c59576b9f4301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030106082b06010505070302307606082b06010505070101046a3068302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304006082b060105050730028634687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274476c6f62616c526f6f7443412e63727430420603551d1f043b30393037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274476c6f62616c526f6f7443412e63726c303d0603551d2004363034300b06096086480186fd6c02013007060567810c01013008060667810c0102013008060667810c0102023008060667810c010203300d06092a864886f70d01010b050003820101008032ce5e0bdd6e5a0d0aafe1d684cbc08efa8570edda5db30cf72b7540fe850afaf33178b7704b1a8958ba80bdf36b1de97ecf0bba589c59d490d3fd6cfdd0986db771825bcf6d0b5a09d07bdec443d82aa4de9e41265fbb8f99cbddaee1a86f9f87fe74b71f1b20abb14fc6f5675d5d9b3ce9ff69f7616cd6d9f3fd36c6ab038876d24b2e7586e3fcd8557d26c21177df3e02b67cf3ab7b7a86366fb8f7d89371cf86df7330fa7babed2a59c842843b11171a52f3c90e147da25b7267ba71ed574766c5b8024a65345e8bd02a3c209c51994ce7529ef76b112b0d927e1de88aeb36164387ea2a63bf753febdec403bb0a3cf730efebaf4cfc8b3610733ef3a4 MBAMService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 5c0000000100000004000000001000001900000001000000100000009f687581f7ef744ecfc12b9cee6238f10f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa2140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a2040000000100000010000000be954f16012122448ca8bc279602acf52000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8DA7F965EC5EFC37910F1C6E59FDC1CC6A6EDE16\Blob = 0300000001000000140000008da7f965ec5efc37910f1c6e59fdc1cc6a6ede162000000001000000450300003082034130820229a0030201020213066c9fcf99bf8c0a39e2f0788a43e696365bca300d06092a864886f70d01010b05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412031301e170d3135303532363030303030305a170d3338303131373030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f74204341203130820122300d06092a864886f70d01010105000382010f003082010a0282010100b2788071ca78d5e371af478050747d6ed8d78876f49968f7582160f97484012fac022d86d3a0437a4eb2a4d036ba01be8ddb48c80717364cf4ee8823c73eeb37f5b519f84968b0ded7b976381d619ea4fe8236a5e54a56e445e1f9fdb416fa74da9c9b35392ffab02050066c7ad080b2a6f9afec47198f503807dca2873958f8bad5a9f948673096ee94785e6f89a351c0308666a14566ba54eba3c391f948dcffd1e8302d7d2d747035d78824f79ec4596ebb738717f2324628b843fab71daacab4f29f240e2d4bf7715c5e69ffea9502cb388aae50386fdbfb2d621bc5c71e54e177e067c80f9c8723d63f40207f2080c4804c3e3b24268e04ae6c9ac8aa0d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604148418cc8534ecbc0c94942e08599cc7b2104e0a08300d06092a864886f70d01010b0500038201010098f2375a4190a11ac57651282036230eaee628bbaaf894ae48a4307f1bfc248d4bb4c8a197f6b6f17a70c85393cc0828e39825cf23a4f9de21d37c8509ad4e9a753ac20b6a897876444718656c8d418e3b7f9acbf4b5a750d7052c37e8034bade961a0026ef5f2f0c5b2ed5bb7dcfa945c779e13a57f52ad95f2f8933bde8b5c5bca5a525b60af14f74befa3fb9f40956d3154fc42d3c7461f23add90f48709ad9757871d1724334756e5759c2025c266029cf2319168e8843a5d4e4cb08fb231143e843297262a1a95d5e08d490aeb8d8ce14c2d055f286f6c49343776661c0b9e841d7977860036e4a72aea5d17dba109e866c1b8ab95933f8ebc490bef1b9 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\5A8CEF45D7A69859767A8C8B4496B578CF474B1A MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0D44DD8C3C8C1A1A58756481E90F2E2AFFB3D26E\Blob = 0300000001000000140000000d44dd8c3c8c1a1a58756481e90f2e2affb3d26e2000000001000000ba010000308201b63082015ba0030201020213066c9fd5749736663f3b0b9ad9e89e7603f24a300a06082a8648ce3d0403023039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412033301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f7420434120333059301306072a8648ce3d020106082a8648ce3d030107034200042997a7c6417fc00d9be8011b56c6f252a5ba2db212e8d22ed7fac9c5d8aa6d1f73813b3b986b397c33a5c54e868e8017686245577d44581db337e56708eb66dea3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414abb6dbd7069e37ac3086079170c79cc419b178c0300a06082a8648ce3d0403020349003046022100e08592a317b78df92b06a593ac1a98686172fae1a1d0fb1c7860a64399c5b8c40221009c02eff1949cb396f9ebc62af8b62cfe3a901416d78c6324481cdf307dd5683b MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F6108407D6F8BB67980CC2E244C2EBAE1CEF63BE\Blob = 030000000100000014000000f6108407d6f8bb67980cc2e244c2ebae1cef63be2000000001000000f6010000308201f230820178a0030201020213066c9fd7c1bb104c2943e5717b7b2cc81ac10e300a06082a8648ce3d0403033039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412034301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f7420434120343076301006072a8648ce3d020106052b8104002203620004d2ab8a374fa3530dfec18a7b4ba87b464b63b062f62d1bdb087121d200e863bd9a27fbf0396e5dea3da5c981aaa35b2098455d16dbfde8106de39ce0e3bd5f8462f3706433a0cb242f70ba88a12aa075f881ae6206c481db396e29b01efa2e5ca3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414d3ecc73a656ecce1da769a56fb9cf3866d57e581300a06082a8648ce3d040303036800306502303a8b21f1bd7e11add0ef58962fd6eb9d7e908d2bcf6655c32ce328a9700a470ef0375912ff2d9994284e2a4f354d335a023100ea75004e3bc43a941291c958469d211372a7889c8ae44c4adb96d4ac8b6b6b49125333add7e4be24fcb50a76d4a5bc10 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F6108407D6F8BB67980CC2E244C2EBAE1CEF63BE MBAMService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F6108407D6F8BB67980CC2E244C2EBAE1CEF63BE\Blob = 140000000100000014000000d3ecc73a656ecce1da769a56fb9cf3866d57e581030000000100000014000000f6108407d6f8bb67980cc2e244c2ebae1cef63be0f0000000100000030000000e0da58676e3a50de9d8cb3aa5ffeffdae691ba9705b3abe41a09270d63a3284f58247ce20d354b579eb548755912e8332000000001000000f6010000308201f230820178a0030201020213066c9fd7c1bb104c2943e5717b7b2cc81ac10e300a06082a8648ce3d0403033039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412034301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f7420434120343076301006072a8648ce3d020106052b8104002203620004d2ab8a374fa3530dfec18a7b4ba87b464b63b062f62d1bdb087121d200e863bd9a27fbf0396e5dea3da5c981aaa35b2098455d16dbfde8106de39ce0e3bd5f8462f3706433a0cb242f70ba88a12aa075f881ae6206c481db396e29b01efa2e5ca3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414d3ecc73a656ecce1da769a56fb9cf3866d57e581300a06082a8648ce3d040303036800306502303a8b21f1bd7e11add0ef58962fd6eb9d7e908d2bcf6655c32ce328a9700a470ef0375912ff2d9994284e2a4f354d335a023100ea75004e3bc43a941291c958469d211372a7889c8ae44c4adb96d4ac8b6b6b49125333add7e4be24fcb50a76d4a5bc10 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2 MBAMService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 1900000001000000100000009f687581f7ef744ecfc12b9cee6238f10f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa2140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a22000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 MBAMService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 19000000010000001000000068cb42b035ea773e52ef50ecf50ec5290f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae474140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df020000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 MBAMService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\2AD974A775F73CBDBBD8F5AC3A49255FA8FB1F8C\Blob = 0300000001000000140000002ad974a775f73cbdbbd8f5ac3a49255fa8fb1f8c2000000001000000620400003082045e30820346a0030201020213077312380b9d6688a33b1ed9bf9ccda68e0e0f300d06092a864886f70d01010b05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412031301e170d3232303832333232323132385a170d3330303832333232323132385a303c310b3009060355040613025553310f300d060355040a1306416d617a6f6e311c301a06035504031313416d617a6f6e205253412032303438204d303130820122300d06092a864886f70d01010105000382010f003082010a0282010100eb712ca9cb1f8828923230af8a570f78b73725955587ac675c97d322c8daa214676b7cf067dae2032ab356125dc6b547f96708a7937a9592180fb4f9f910369a7f2f80b64fba134ec75d531ee0dd96330720d396bc12e4745042a1051373b54f9b4424fe2d7fedbc2285ec362133977506ce271882dce3d9c582078d5e26012626671fd93f13cf32ba6bad7864fcaaff0e023c07df9c0578728cfdea75b7032884dae86e078cd05085ef8154b2716eec6d62ef8f94c35ee9c4a4d091c02e249198caeeba258ed4f671b6fb5b6b38064837478d86dcf2ea06fb76377d9eff424e4d588293cfe271c278b17aab4b5b94378881e4d9af24aef872c565fb4bb451e70203010001a382015a3082015630120603551d130101ff040830060101ff020100300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030106082b06010505070302301d0603551d0e0416041481b80e638a891218e5fa3b3b50959fe6e5901385301f0603551d230418301680148418cc8534ecbc0c94942e08599cc7b2104e0a08307b06082b06010505070101046f306d302f06082b060105050730018623687474703a2f2f6f6373702e726f6f746361312e616d617a6f6e74727573742e636f6d303a06082b06010505073002862e687474703a2f2f6372742e726f6f746361312e616d617a6f6e74727573742e636f6d2f726f6f746361312e636572303f0603551d1f043830363034a032a030862e687474703a2f2f63726c2e726f6f746361312e616d617a6f6e74727573742e636f6d2f726f6f746361312e63726c30130603551d20040c300a3008060667810c010201300d06092a864886f70d01010b05000382010100ad00de0205232e063262b46bb19416e41140de2bfa59c135efe0aa8f2b41b9d1f38739001df23db5a7470c0606c691f3075702d4edbd17c1909abf4875a2074f30dd4a6a42b50d3d15c00ffe845bc63c99cc5752b1d86e12d59692934b94e507e88982086a7a34d49e64e13d876a92909a63a14bf88fb6ea34d305be20c2de06e28c9f738b9f4d3985cace19369d85c99ec9f8503fb67e88a1efca84068b50b40a5ca61c44f1fdc8614060f26125aa07f4c7c27375e40c0b428d04e55f4448995b7b898196a7889d4b0d62e804c4d7feb4e8b26dcaecc01cbc385b1ddf85ce5b7ae3494b6cb9a7ddf405b249ade1c5146bc2ccebcd7fd65869bac3207e7fb0b8 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\5A8CEF45D7A69859767A8C8B4496B578CF474B1A MBAMService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8DA7F965EC5EFC37910F1C6E59FDC1CC6A6EDE16\Blob = 19000000010000001000000094ba2a8e68434595d5aff46246c54c120f00000001000000200000006fc4b8ac3d2b52c08baf56255e43d22c762962e4facab01ace16d48ec008be0a0300000001000000140000008da7f965ec5efc37910f1c6e59fdc1cc6a6ede161400000001000000140000008418cc8534ecbc0c94942e08599cc7b2104e0a082000000001000000450300003082034130820229a0030201020213066c9fcf99bf8c0a39e2f0788a43e696365bca300d06092a864886f70d01010b05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412031301e170d3135303532363030303030305a170d3338303131373030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f74204341203130820122300d06092a864886f70d01010105000382010f003082010a0282010100b2788071ca78d5e371af478050747d6ed8d78876f49968f7582160f97484012fac022d86d3a0437a4eb2a4d036ba01be8ddb48c80717364cf4ee8823c73eeb37f5b519f84968b0ded7b976381d619ea4fe8236a5e54a56e445e1f9fdb416fa74da9c9b35392ffab02050066c7ad080b2a6f9afec47198f503807dca2873958f8bad5a9f948673096ee94785e6f89a351c0308666a14566ba54eba3c391f948dcffd1e8302d7d2d747035d78824f79ec4596ebb738717f2324628b843fab71daacab4f29f240e2d4bf7715c5e69ffea9502cb388aae50386fdbfb2d621bc5c71e54e177e067c80f9c8723d63f40207f2080c4804c3e3b24268e04ae6c9ac8aa0d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604148418cc8534ecbc0c94942e08599cc7b2104e0a08300d06092a864886f70d01010b0500038201010098f2375a4190a11ac57651282036230eaee628bbaaf894ae48a4307f1bfc248d4bb4c8a197f6b6f17a70c85393cc0828e39825cf23a4f9de21d37c8509ad4e9a753ac20b6a897876444718656c8d418e3b7f9acbf4b5a750d7052c37e8034bade961a0026ef5f2f0c5b2ed5bb7dcfa945c779e13a57f52ad95f2f8933bde8b5c5bca5a525b60af14f74befa3fb9f40956d3154fc42d3c7461f23add90f48709ad9757871d1724334756e5759c2025c266029cf2319168e8843a5d4e4cb08fb231143e843297262a1a95d5e08d490aeb8d8ce14c2d055f286f6c49343776661c0b9e841d7977860036e4a72aea5d17dba109e866c1b8ab95933f8ebc490bef1b9 MBAMService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E\Blob = 0f000000010000002000000071b437f087f3700ffd4e2fa46f42b6b810d7bf19adfedf951c023edd65b50b05030000000100000014000000b51c067cee2b0c3df855ab2d92f4fe39d4e70f0e2000000001000000e1030000308203dd308202c5a003020102020100300d06092a864886f70d01010b050030818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a30818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bdedc103fcf68ffc02b16f5b9f48d99d79e2a2b703615618c347b6d7ca3d352e8943f7a1699bde8a1afd13209cb44977322956fdb9ec8cdd22fa72dc276197eef65a84ec6e19b9892cdc845bd574fb6b5fc589a51052894655f4b8751ce67fe454ae4bf85572570219f8177159eb1e280774c59d48be6cb4f4a4b0f364377992c0ec465e7fe16d534c62afcd1f0b63bb3a9dfbfc7900986174cf26824063f3b2726a190d99cad40e75cc37fb8b89c159f1627f5fb35f6530f8a7b74d765a1e765e34c0e89656998ab3f07fa4cdbddc32317c91cfe05f11f86baa495cd19994d1a2e3635b0976b55662e14b741d96d426d4080459d0980e0ee6defcc3ec1f90f10203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147c0c321fa7d9307fc47d68a362a8a1ceab075b27300d06092a864886f70d01010b050003820101001159fa254f036f94993b9a1f828539d47605945ee128936d625d09c2a0a8d4b07538f1346a9de49f8a862651e62cd1c62d6e95204a9201ecb88a677b31e2672e8c9503262e439d4a31f60eb50cbbb7e2377f22ba00a30e7b52fb6bbb3bc4d379514ecd90f4670719c83c467a0d017dc558e76de68530179a24c410e004f7e0f27fd4aa0aff421d37ed94e5645912207738d3323e3881759673fa688fb1cbce1fc5ecfa9c7ecf7eb1f1072db6fcbfcaa4bfd097054abcea18280290bd5478092171d3d17d1dd916b0a9613dd00a0022fcc77bcb0964450b3b4081f77d7c32f598ca588e7d2aee90597364f936745e25a1f566052e7f3915a92afb508b8e8569f4 MBAMService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\5A8CEF45D7A69859767A8C8B4496B578CF474B1A\Blob = 0f0000000100000030000000d746a5bf1663a495fb88bbe77dbce6a325c994a696299331ef4c5afa26c00970bacdd3d3b49db055b6582b5d1a54b7af0300000001000000140000005a8cef45d7a69859767a8c8b4496b578cf474b1a2000000001000000450500003082054130820329a0030201020213066c9fd29635869f0a0fe58678f85b26bb8a37300d06092a864886f70d01010c05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412032301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f74204341203230820222300d06092a864886f70d01010105000382020f003082020a0282020100ad969f2d9c4a4c4a81795199ec8acb6b605113bc4d6d06fcb0088ddd19106ac7260c35d8c06f2084e994b19b8503c35bdb4ae8c8f89076d95b4fe34ce806364dcc9aac3d0c902b92d4061960ac374479858182ad5a37e00dcc9da64c5276ea439db704d150f655e0d5d2a64985e937e9ca7eae5c954d489a3fae205a6d8895d934b8521a4390b0bf6c05b9b678b7ead0e43a3c125362ff4af27bbe3505a91234e3f36474622c3d00495a28fe3244bb87dd652702713bda4af71fdacdf72155904f0fecae82e19f6bd945d3bbf05f87ed3c2c3986da3fdeec7255eb79a3addbdd7cb0ba1ccefcde4f3576cf0ff8781f6a36514627615be99ecff0a2557d7c258a6f2fb4c5cf842e2bfd0d51106cfb5f1bbc1b7ec5ae3b98013192ff0b57f49ab2b957e9abef0d76d1f0eef4ce86a7e06ee9b469a1df69f633c6692e97139ea587b057108137c953b3bb7ff692d19cd018f4926eda834fa663994ca5fb5eef21647a205f6c648515cb37e9620c0b2a16dc012e32da3e4bf59e3af6174094ef9e910886fabe63a85a33eccb744395f96c695236c7296ffc55035c1ffb9fbd47ebe74947950b4e89220949e0f5611ef1bf2e8a726e8059ff573af97532a34e5feced2862d94d73f2cc811760edcdebdcdba7cac57e02bdf2540854fdb42d092c17544a98d154e1516708d2ed6e7e6f3fd22d81592966cb903995111e7427feddebaf0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414b00cf04c30f405580248fd33e552af4b84e36652300d06092a864886f70d01010c05000382020100aaa8808f0e78a3e0a2d4cde6f5987a3bea0003b0970e93bc5aa8f62c8c7287a9b1fc7f73fd637178a58759cf30e10d10b2135a6d82f56ae6809fa0050b68e4476bc76adfb6fd773272e518fa09f4a0932c5dd28c75857665900c0379b7312363ad788309866884cafff9cf269a9279e7cd4bc5e761a717cbf3a91293936ba7e82f5392c46058b0cc0251185b858d625963b6adb4de9afb26f70027c05d55377499c9507fe3592e44e32c25eeec4c3277b49f1ae94b5d20c5dafd1c8716c643e8d4bb269a45705ea90b3753e2467b27fde046f289b7cc42b6cb28266ed9a5c93ac8411360f7508c15aeb26d1a151a5778e6922ad96590823f6c02afae123a27963604d71da28063a99bf1e5bab47c14b04ec9b11f745f38f651ea9bfa2ca211d4a92d271a45b1afb24e710dc05846d66906cb53cbb3fe6b41cd417e7d4c0f7c72797a59cd5e4a0eac9ba99873797cb4f4ccb9b8070cb2745cb8c76f88a190a7f4aaf9bf673af41a15621eb79fbe3db129af67a112f25810195303301bb81a89f69cbd97038ea309f31d8b21f1b4dfe41cd19f650206ea5cd613b384efa2a55c8c7729a768c06bae40d2a8b4eacdf08d4b389c199a1b2854b88990efca75813e1ef26424c718af4eff479e07f63565a4d30a56fff517646cefa822254993b6df0017da587e5deec51bb0d1d15f2110c7f9f3ba020a2707c5f1d6c7d3e0fb09606c MBAMService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\5A8CEF45D7A69859767A8C8B4496B578CF474B1A\Blob = 0300000001000000140000005a8cef45d7a69859767a8c8b4496b578cf474b1a2000000001000000450500003082054130820329a0030201020213066c9fd29635869f0a0fe58678f85b26bb8a37300d06092a864886f70d01010c05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412032301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f74204341203230820222300d06092a864886f70d01010105000382020f003082020a0282020100ad969f2d9c4a4c4a81795199ec8acb6b605113bc4d6d06fcb0088ddd19106ac7260c35d8c06f2084e994b19b8503c35bdb4ae8c8f89076d95b4fe34ce806364dcc9aac3d0c902b92d4061960ac374479858182ad5a37e00dcc9da64c5276ea439db704d150f655e0d5d2a64985e937e9ca7eae5c954d489a3fae205a6d8895d934b8521a4390b0bf6c05b9b678b7ead0e43a3c125362ff4af27bbe3505a91234e3f36474622c3d00495a28fe3244bb87dd652702713bda4af71fdacdf72155904f0fecae82e19f6bd945d3bbf05f87ed3c2c3986da3fdeec7255eb79a3addbdd7cb0ba1ccefcde4f3576cf0ff8781f6a36514627615be99ecff0a2557d7c258a6f2fb4c5cf842e2bfd0d51106cfb5f1bbc1b7ec5ae3b98013192ff0b57f49ab2b957e9abef0d76d1f0eef4ce86a7e06ee9b469a1df69f633c6692e97139ea587b057108137c953b3bb7ff692d19cd018f4926eda834fa663994ca5fb5eef21647a205f6c648515cb37e9620c0b2a16dc012e32da3e4bf59e3af6174094ef9e910886fabe63a85a33eccb744395f96c695236c7296ffc55035c1ffb9fbd47ebe74947950b4e89220949e0f5611ef1bf2e8a726e8059ff573af97532a34e5feced2862d94d73f2cc811760edcdebdcdba7cac57e02bdf2540854fdb42d092c17544a98d154e1516708d2ed6e7e6f3fd22d81592966cb903995111e7427feddebaf0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414b00cf04c30f405580248fd33e552af4b84e36652300d06092a864886f70d01010c05000382020100aaa8808f0e78a3e0a2d4cde6f5987a3bea0003b0970e93bc5aa8f62c8c7287a9b1fc7f73fd637178a58759cf30e10d10b2135a6d82f56ae6809fa0050b68e4476bc76adfb6fd773272e518fa09f4a0932c5dd28c75857665900c0379b7312363ad788309866884cafff9cf269a9279e7cd4bc5e761a717cbf3a91293936ba7e82f5392c46058b0cc0251185b858d625963b6adb4de9afb26f70027c05d55377499c9507fe3592e44e32c25eeec4c3277b49f1ae94b5d20c5dafd1c8716c643e8d4bb269a45705ea90b3753e2467b27fde046f289b7cc42b6cb28266ed9a5c93ac8411360f7508c15aeb26d1a151a5778e6922ad96590823f6c02afae123a27963604d71da28063a99bf1e5bab47c14b04ec9b11f745f38f651ea9bfa2ca211d4a92d271a45b1afb24e710dc05846d66906cb53cbb3fe6b41cd417e7d4c0f7c72797a59cd5e4a0eac9ba99873797cb4f4ccb9b8070cb2745cb8c76f88a190a7f4aaf9bf673af41a15621eb79fbe3db129af67a112f25810195303301bb81a89f69cbd97038ea309f31d8b21f1b4dfe41cd19f650206ea5cd613b384efa2a55c8c7729a768c06bae40d2a8b4eacdf08d4b389c199a1b2854b88990efca75813e1ef26424c718af4eff479e07f63565a4d30a56fff517646cefa822254993b6df0017da587e5deec51bb0d1d15f2110c7f9f3ba020a2707c5f1d6c7d3e0fb09606c MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 0f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa22000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 MBAMService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 0f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0D44DD8C3C8C1A1A58756481E90F2E2AFFB3D26E MBAMService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\5A8CEF45D7A69859767A8C8B4496B578CF474B1A\Blob = 140000000100000014000000b00cf04c30f405580248fd33e552af4b84e366520300000001000000140000005a8cef45d7a69859767a8c8b4496b578cf474b1a0f0000000100000030000000d746a5bf1663a495fb88bbe77dbce6a325c994a696299331ef4c5afa26c00970bacdd3d3b49db055b6582b5d1a54b7af2000000001000000450500003082054130820329a0030201020213066c9fd29635869f0a0fe58678f85b26bb8a37300d06092a864886f70d01010c05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412032301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f74204341203230820222300d06092a864886f70d01010105000382020f003082020a0282020100ad969f2d9c4a4c4a81795199ec8acb6b605113bc4d6d06fcb0088ddd19106ac7260c35d8c06f2084e994b19b8503c35bdb4ae8c8f89076d95b4fe34ce806364dcc9aac3d0c902b92d4061960ac374479858182ad5a37e00dcc9da64c5276ea439db704d150f655e0d5d2a64985e937e9ca7eae5c954d489a3fae205a6d8895d934b8521a4390b0bf6c05b9b678b7ead0e43a3c125362ff4af27bbe3505a91234e3f36474622c3d00495a28fe3244bb87dd652702713bda4af71fdacdf72155904f0fecae82e19f6bd945d3bbf05f87ed3c2c3986da3fdeec7255eb79a3addbdd7cb0ba1ccefcde4f3576cf0ff8781f6a36514627615be99ecff0a2557d7c258a6f2fb4c5cf842e2bfd0d51106cfb5f1bbc1b7ec5ae3b98013192ff0b57f49ab2b957e9abef0d76d1f0eef4ce86a7e06ee9b469a1df69f633c6692e97139ea587b057108137c953b3bb7ff692d19cd018f4926eda834fa663994ca5fb5eef21647a205f6c648515cb37e9620c0b2a16dc012e32da3e4bf59e3af6174094ef9e910886fabe63a85a33eccb744395f96c695236c7296ffc55035c1ffb9fbd47ebe74947950b4e89220949e0f5611ef1bf2e8a726e8059ff573af97532a34e5feced2862d94d73f2cc811760edcdebdcdba7cac57e02bdf2540854fdb42d092c17544a98d154e1516708d2ed6e7e6f3fd22d81592966cb903995111e7427feddebaf0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414b00cf04c30f405580248fd33e552af4b84e36652300d06092a864886f70d01010c05000382020100aaa8808f0e78a3e0a2d4cde6f5987a3bea0003b0970e93bc5aa8f62c8c7287a9b1fc7f73fd637178a58759cf30e10d10b2135a6d82f56ae6809fa0050b68e4476bc76adfb6fd773272e518fa09f4a0932c5dd28c75857665900c0379b7312363ad788309866884cafff9cf269a9279e7cd4bc5e761a717cbf3a91293936ba7e82f5392c46058b0cc0251185b858d625963b6adb4de9afb26f70027c05d55377499c9507fe3592e44e32c25eeec4c3277b49f1ae94b5d20c5dafd1c8716c643e8d4bb269a45705ea90b3753e2467b27fde046f289b7cc42b6cb28266ed9a5c93ac8411360f7508c15aeb26d1a151a5778e6922ad96590823f6c02afae123a27963604d71da28063a99bf1e5bab47c14b04ec9b11f745f38f651ea9bfa2ca211d4a92d271a45b1afb24e710dc05846d66906cb53cbb3fe6b41cd417e7d4c0f7c72797a59cd5e4a0eac9ba99873797cb4f4ccb9b8070cb2745cb8c76f88a190a7f4aaf9bf673af41a15621eb79fbe3db129af67a112f25810195303301bb81a89f69cbd97038ea309f31d8b21f1b4dfe41cd19f650206ea5cd613b384efa2a55c8c7729a768c06bae40d2a8b4eacdf08d4b389c199a1b2854b88990efca75813e1ef26424c718af4eff479e07f63565a4d30a56fff517646cefa822254993b6df0017da587e5deec51bb0d1d15f2110c7f9f3ba020a2707c5f1d6c7d3e0fb09606c MBAMService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 5c000000010000000400000000080000190000000100000010000000fd960962ac6938e0d4b0769aa1a64e26030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a1d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e76200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb65809000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e650040000000100000010000000324a4bbbc863699bbe749ac6dd1d46242000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 MBAMService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F6108407D6F8BB67980CC2E244C2EBAE1CEF63BE\Blob = 190000000100000010000000f933477d7483263afe071268578f9e420f0000000100000030000000e0da58676e3a50de9d8cb3aa5ffeffdae691ba9705b3abe41a09270d63a3284f58247ce20d354b579eb548755912e833030000000100000014000000f6108407d6f8bb67980cc2e244c2ebae1cef63be140000000100000014000000d3ecc73a656ecce1da769a56fb9cf3866d57e5812000000001000000f6010000308201f230820178a0030201020213066c9fd7c1bb104c2943e5717b7b2cc81ac10e300a06082a8648ce3d0403033039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412034301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f7420434120343076301006072a8648ce3d020106052b8104002203620004d2ab8a374fa3530dfec18a7b4ba87b464b63b062f62d1bdb087121d200e863bd9a27fbf0396e5dea3da5c981aaa35b2098455d16dbfde8106de39ce0e3bd5f8462f3706433a0cb242f70ba88a12aa075f881ae6206c481db396e29b01efa2e5ca3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414d3ecc73a656ecce1da769a56fb9cf3866d57e581300a06082a8648ce3d040303036800306502303a8b21f1bd7e11add0ef58962fd6eb9d7e908d2bcf6655c32ce328a9700a470ef0375912ff2d9994284e2a4f354d335a023100ea75004e3bc43a941291c958469d211372a7889c8ae44c4adb96d4ac8b6b6b49125333add7e4be24fcb50a76d4a5bc10 MBAMService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\2AD974A775F73CBDBBD8F5AC3A49255FA8FB1F8C\Blob = 14000000010000001400000081b80e638a891218e5fa3b3b50959fe6e59013850300000001000000140000002ad974a775f73cbdbbd8f5ac3a49255fa8fb1f8c19000000010000001000000087513236ba5fcaae2b242962815926f82000000001000000620400003082045e30820346a0030201020213077312380b9d6688a33b1ed9bf9ccda68e0e0f300d06092a864886f70d01010b05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412031301e170d3232303832333232323132385a170d3330303832333232323132385a303c310b3009060355040613025553310f300d060355040a1306416d617a6f6e311c301a06035504031313416d617a6f6e205253412032303438204d303130820122300d06092a864886f70d01010105000382010f003082010a0282010100eb712ca9cb1f8828923230af8a570f78b73725955587ac675c97d322c8daa214676b7cf067dae2032ab356125dc6b547f96708a7937a9592180fb4f9f910369a7f2f80b64fba134ec75d531ee0dd96330720d396bc12e4745042a1051373b54f9b4424fe2d7fedbc2285ec362133977506ce271882dce3d9c582078d5e26012626671fd93f13cf32ba6bad7864fcaaff0e023c07df9c0578728cfdea75b7032884dae86e078cd05085ef8154b2716eec6d62ef8f94c35ee9c4a4d091c02e249198caeeba258ed4f671b6fb5b6b38064837478d86dcf2ea06fb76377d9eff424e4d588293cfe271c278b17aab4b5b94378881e4d9af24aef872c565fb4bb451e70203010001a382015a3082015630120603551d130101ff040830060101ff020100300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030106082b06010505070302301d0603551d0e0416041481b80e638a891218e5fa3b3b50959fe6e5901385301f0603551d230418301680148418cc8534ecbc0c94942e08599cc7b2104e0a08307b06082b06010505070101046f306d302f06082b060105050730018623687474703a2f2f6f6373702e726f6f746361312e616d617a6f6e74727573742e636f6d303a06082b06010505073002862e687474703a2f2f6372742e726f6f746361312e616d617a6f6e74727573742e636f6d2f726f6f746361312e636572303f0603551d1f043830363034a032a030862e687474703a2f2f63726c2e726f6f746361312e616d617a6f6e74727573742e636f6d2f726f6f746361312e63726c30130603551d20040c300a3008060667810c010201300d06092a864886f70d01010b05000382010100ad00de0205232e063262b46bb19416e41140de2bfa59c135efe0aa8f2b41b9d1f38739001df23db5a7470c0606c691f3075702d4edbd17c1909abf4875a2074f30dd4a6a42b50d3d15c00ffe845bc63c99cc5752b1d86e12d59692934b94e507e88982086a7a34d49e64e13d876a92909a63a14bf88fb6ea34d305be20c2de06e28c9f738b9f4d3985cace19369d85c99ec9f8503fb67e88a1efca84068b50b40a5ca61c44f1fdc8614060f26125aa07f4c7c27375e40c0b428d04e55f4448995b7b898196a7889d4b0d62e804c4d7feb4e8b26dcaecc01cbc385b1ddf85ce5b7ae3494b6cb9a7ddf405b249ade1c5146bc2ccebcd7fd65869bac3207e7fb0b8 MBAMService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d0030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d578112861900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F6108407D6F8BB67980CC2E244C2EBAE1CEF63BE MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E MBAMService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E\Blob = 1400000001000000140000007c0c321fa7d9307fc47d68a362a8a1ceab075b27030000000100000014000000b51c067cee2b0c3df855ab2d92f4fe39d4e70f0e0f000000010000002000000071b437f087f3700ffd4e2fa46f42b6b810d7bf19adfedf951c023edd65b50b052000000001000000e1030000308203dd308202c5a003020102020100300d06092a864886f70d01010b050030818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a30818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bdedc103fcf68ffc02b16f5b9f48d99d79e2a2b703615618c347b6d7ca3d352e8943f7a1699bde8a1afd13209cb44977322956fdb9ec8cdd22fa72dc276197eef65a84ec6e19b9892cdc845bd574fb6b5fc589a51052894655f4b8751ce67fe454ae4bf85572570219f8177159eb1e280774c59d48be6cb4f4a4b0f364377992c0ec465e7fe16d534c62afcd1f0b63bb3a9dfbfc7900986174cf26824063f3b2726a190d99cad40e75cc37fb8b89c159f1627f5fb35f6530f8a7b74d765a1e765e34c0e89656998ab3f07fa4cdbddc32317c91cfe05f11f86baa495cd19994d1a2e3635b0976b55662e14b741d96d426d4080459d0980e0ee6defcc3ec1f90f10203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147c0c321fa7d9307fc47d68a362a8a1ceab075b27300d06092a864886f70d01010b050003820101001159fa254f036f94993b9a1f828539d47605945ee128936d625d09c2a0a8d4b07538f1346a9de49f8a862651e62cd1c62d6e95204a9201ecb88a677b31e2672e8c9503262e439d4a31f60eb50cbbb7e2377f22ba00a30e7b52fb6bbb3bc4d379514ecd90f4670719c83c467a0d017dc558e76de68530179a24c410e004f7e0f27fd4aa0aff421d37ed94e5645912207738d3323e3881759673fa688fb1cbce1fc5ecfa9c7ecf7eb1f1072db6fcbfcaa4bfd097054abcea18280290bd5478092171d3d17d1dd916b0a9613dd00a0022fcc77bcb0964450b3b4081f77d7c32f598ca588e7d2aee90597364f936745e25a1f566052e7f3915a92afb508b8e8569f4 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\2AD974A775F73CBDBBD8F5AC3A49255FA8FB1F8C MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0D44DD8C3C8C1A1A58756481E90F2E2AFFB3D26E\Blob = 140000000100000014000000abb6dbd7069e37ac3086079170c79cc419b178c00300000001000000140000000d44dd8c3c8c1a1a58756481e90f2e2affb3d26e0f00000001000000200000006d29dbed0025d7540e14e4110aefa547c48fc75c85e2180b6038f18e126cb74f2000000001000000ba010000308201b63082015ba0030201020213066c9fd5749736663f3b0b9ad9e89e7603f24a300a06082a8648ce3d0403023039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412033301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f7420434120333059301306072a8648ce3d020106082a8648ce3d030107034200042997a7c6417fc00d9be8011b56c6f252a5ba2db212e8d22ed7fac9c5d8aa6d1f73813b3b986b397c33a5c54e868e8017686245577d44581db337e56708eb66dea3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414abb6dbd7069e37ac3086079170c79cc419b178c0300a06082a8648ce3d0403020349003046022100e08592a317b78df92b06a593ac1a98686172fae1a1d0fb1c7860a64399c5b8c40221009c02eff1949cb396f9ebc62af8b62cfe3a901416d78c6324481cdf307dd5683b MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8DA7F965EC5EFC37910F1C6E59FDC1CC6A6EDE16 MBAMService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0D44DD8C3C8C1A1A58756481E90F2E2AFFB3D26E\Blob = 0f00000001000000200000006d29dbed0025d7540e14e4110aefa547c48fc75c85e2180b6038f18e126cb74f0300000001000000140000000d44dd8c3c8c1a1a58756481e90f2e2affb3d26e2000000001000000ba010000308201b63082015ba0030201020213066c9fd5749736663f3b0b9ad9e89e7603f24a300a06082a8648ce3d0403023039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412033301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f7420434120333059301306072a8648ce3d020106082a8648ce3d030107034200042997a7c6417fc00d9be8011b56c6f252a5ba2db212e8d22ed7fac9c5d8aa6d1f73813b3b986b397c33a5c54e868e8017686245577d44581db337e56708eb66dea3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414abb6dbd7069e37ac3086079170c79cc419b178c0300a06082a8648ce3d0403020349003046022100e08592a317b78df92b06a593ac1a98686172fae1a1d0fb1c7860a64399c5b8c40221009c02eff1949cb396f9ebc62af8b62cfe3a901416d78c6324481cdf307dd5683b MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\1C58A3A8518E8759BF075B76B750D4F2DF264FCD MBAMService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa22000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8DA7F965EC5EFC37910F1C6E59FDC1CC6A6EDE16 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F6108407D6F8BB67980CC2E244C2EBAE1CEF63BE\Blob = 0f0000000100000030000000e0da58676e3a50de9d8cb3aa5ffeffdae691ba9705b3abe41a09270d63a3284f58247ce20d354b579eb548755912e833030000000100000014000000f6108407d6f8bb67980cc2e244c2ebae1cef63be2000000001000000f6010000308201f230820178a0030201020213066c9fd7c1bb104c2943e5717b7b2cc81ac10e300a06082a8648ce3d0403033039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412034301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f7420434120343076301006072a8648ce3d020106052b8104002203620004d2ab8a374fa3530dfec18a7b4ba87b464b63b062f62d1bdb087121d200e863bd9a27fbf0396e5dea3da5c981aaa35b2098455d16dbfde8106de39ce0e3bd5f8462f3706433a0cb242f70ba88a12aa075f881ae6206c481db396e29b01efa2e5ca3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414d3ecc73a656ecce1da769a56fb9cf3866d57e581300a06082a8648ce3d040303036800306502303a8b21f1bd7e11add0ef58962fd6eb9d7e908d2bcf6655c32ce328a9700a470ef0375912ff2d9994284e2a4f354d335a023100ea75004e3bc43a941291c958469d211372a7889c8ae44c4adb96d4ac8b6b6b49125333add7e4be24fcb50a76d4a5bc10 MBAMService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8DA7F965EC5EFC37910F1C6E59FDC1CC6A6EDE16\Blob = 0f00000001000000200000006fc4b8ac3d2b52c08baf56255e43d22c762962e4facab01ace16d48ec008be0a0300000001000000140000008da7f965ec5efc37910f1c6e59fdc1cc6a6ede162000000001000000450300003082034130820229a0030201020213066c9fcf99bf8c0a39e2f0788a43e696365bca300d06092a864886f70d01010b05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412031301e170d3135303532363030303030305a170d3338303131373030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f74204341203130820122300d06092a864886f70d01010105000382010f003082010a0282010100b2788071ca78d5e371af478050747d6ed8d78876f49968f7582160f97484012fac022d86d3a0437a4eb2a4d036ba01be8ddb48c80717364cf4ee8823c73eeb37f5b519f84968b0ded7b976381d619ea4fe8236a5e54a56e445e1f9fdb416fa74da9c9b35392ffab02050066c7ad080b2a6f9afec47198f503807dca2873958f8bad5a9f948673096ee94785e6f89a351c0308666a14566ba54eba3c391f948dcffd1e8302d7d2d747035d78824f79ec4596ebb738717f2324628b843fab71daacab4f29f240e2d4bf7715c5e69ffea9502cb388aae50386fdbfb2d621bc5c71e54e177e067c80f9c8723d63f40207f2080c4804c3e3b24268e04ae6c9ac8aa0d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604148418cc8534ecbc0c94942e08599cc7b2104e0a08300d06092a864886f70d01010b0500038201010098f2375a4190a11ac57651282036230eaee628bbaaf894ae48a4307f1bfc248d4bb4c8a197f6b6f17a70c85393cc0828e39825cf23a4f9de21d37c8509ad4e9a753ac20b6a897876444718656c8d418e3b7f9acbf4b5a750d7052c37e8034bade961a0026ef5f2f0c5b2ed5bb7dcfa945c779e13a57f52ad95f2f8933bde8b5c5bca5a525b60af14f74befa3fb9f40956d3154fc42d3c7461f23add90f48709ad9757871d1724334756e5759c2025c266029cf2319168e8843a5d4e4cb08fb231143e843297262a1a95d5e08d490aeb8d8ce14c2d055f286f6c49343776661c0b9e841d7977860036e4a72aea5d17dba109e866c1b8ab95933f8ebc490bef1b9 MBAMService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 040000000100000010000000324a4bbbc863699bbe749ac6dd1d46240f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb658140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a190000000100000010000000fd960962ac6938e0d4b0769aa1a64e262000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0D44DD8C3C8C1A1A58756481E90F2E2AFFB3D26E MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8DA7F965EC5EFC37910F1C6E59FDC1CC6A6EDE16\Blob = 1400000001000000140000008418cc8534ecbc0c94942e08599cc7b2104e0a080300000001000000140000008da7f965ec5efc37910f1c6e59fdc1cc6a6ede160f00000001000000200000006fc4b8ac3d2b52c08baf56255e43d22c762962e4facab01ace16d48ec008be0a2000000001000000450300003082034130820229a0030201020213066c9fcf99bf8c0a39e2f0788a43e696365bca300d06092a864886f70d01010b05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412031301e170d3135303532363030303030305a170d3338303131373030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f74204341203130820122300d06092a864886f70d01010105000382010f003082010a0282010100b2788071ca78d5e371af478050747d6ed8d78876f49968f7582160f97484012fac022d86d3a0437a4eb2a4d036ba01be8ddb48c80717364cf4ee8823c73eeb37f5b519f84968b0ded7b976381d619ea4fe8236a5e54a56e445e1f9fdb416fa74da9c9b35392ffab02050066c7ad080b2a6f9afec47198f503807dca2873958f8bad5a9f948673096ee94785e6f89a351c0308666a14566ba54eba3c391f948dcffd1e8302d7d2d747035d78824f79ec4596ebb738717f2324628b843fab71daacab4f29f240e2d4bf7715c5e69ffea9502cb388aae50386fdbfb2d621bc5c71e54e177e067c80f9c8723d63f40207f2080c4804c3e3b24268e04ae6c9ac8aa0d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604148418cc8534ecbc0c94942e08599cc7b2104e0a08300d06092a864886f70d01010b0500038201010098f2375a4190a11ac57651282036230eaee628bbaaf894ae48a4307f1bfc248d4bb4c8a197f6b6f17a70c85393cc0828e39825cf23a4f9de21d37c8509ad4e9a753ac20b6a897876444718656c8d418e3b7f9acbf4b5a750d7052c37e8034bade961a0026ef5f2f0c5b2ed5bb7dcfa945c779e13a57f52ad95f2f8933bde8b5c5bca5a525b60af14f74befa3fb9f40956d3154fc42d3c7461f23add90f48709ad9757871d1724334756e5759c2025c266029cf2319168e8843a5d4e4cb08fb231143e843297262a1a95d5e08d490aeb8d8ce14c2d055f286f6c49343776661c0b9e841d7977860036e4a72aea5d17dba109e866c1b8ab95933f8ebc490bef1b9 MBAMService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E\Blob = 19000000010000001000000060e2dc65295f1062e558f3fef235ed3c0f000000010000002000000071b437f087f3700ffd4e2fa46f42b6b810d7bf19adfedf951c023edd65b50b05030000000100000014000000b51c067cee2b0c3df855ab2d92f4fe39d4e70f0e1400000001000000140000007c0c321fa7d9307fc47d68a362a8a1ceab075b272000000001000000e1030000308203dd308202c5a003020102020100300d06092a864886f70d01010b050030818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a30818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bdedc103fcf68ffc02b16f5b9f48d99d79e2a2b703615618c347b6d7ca3d352e8943f7a1699bde8a1afd13209cb44977322956fdb9ec8cdd22fa72dc276197eef65a84ec6e19b9892cdc845bd574fb6b5fc589a51052894655f4b8751ce67fe454ae4bf85572570219f8177159eb1e280774c59d48be6cb4f4a4b0f364377992c0ec465e7fe16d534c62afcd1f0b63bb3a9dfbfc7900986174cf26824063f3b2726a190d99cad40e75cc37fb8b89c159f1627f5fb35f6530f8a7b74d765a1e765e34c0e89656998ab3f07fa4cdbddc32317c91cfe05f11f86baa495cd19994d1a2e3635b0976b55662e14b741d96d426d4080459d0980e0ee6defcc3ec1f90f10203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147c0c321fa7d9307fc47d68a362a8a1ceab075b27300d06092a864886f70d01010b050003820101001159fa254f036f94993b9a1f828539d47605945ee128936d625d09c2a0a8d4b07538f1346a9de49f8a862651e62cd1c62d6e95204a9201ecb88a677b31e2672e8c9503262e439d4a31f60eb50cbbb7e2377f22ba00a30e7b52fb6bbb3bc4d379514ecd90f4670719c83c467a0d017dc558e76de68530179a24c410e004f7e0f27fd4aa0aff421d37ed94e5645912207738d3323e3881759673fa688fb1cbce1fc5ecfa9c7ecf7eb1f1072db6fcbfcaa4bfd097054abcea18280290bd5478092171d3d17d1dd916b0a9613dd00a0022fcc77bcb0964450b3b4081f77d7c32f598ca588e7d2aee90597364f936745e25a1f566052e7f3915a92afb508b8e8569f4 MBAMService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E\Blob = 030000000100000014000000b51c067cee2b0c3df855ab2d92f4fe39d4e70f0e2000000001000000e1030000308203dd308202c5a003020102020100300d06092a864886f70d01010b050030818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a30818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bdedc103fcf68ffc02b16f5b9f48d99d79e2a2b703615618c347b6d7ca3d352e8943f7a1699bde8a1afd13209cb44977322956fdb9ec8cdd22fa72dc276197eef65a84ec6e19b9892cdc845bd574fb6b5fc589a51052894655f4b8751ce67fe454ae4bf85572570219f8177159eb1e280774c59d48be6cb4f4a4b0f364377992c0ec465e7fe16d534c62afcd1f0b63bb3a9dfbfc7900986174cf26824063f3b2726a190d99cad40e75cc37fb8b89c159f1627f5fb35f6530f8a7b74d765a1e765e34c0e89656998ab3f07fa4cdbddc32317c91cfe05f11f86baa495cd19994d1a2e3635b0976b55662e14b741d96d426d4080459d0980e0ee6defcc3ec1f90f10203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147c0c321fa7d9307fc47d68a362a8a1ceab075b27300d06092a864886f70d01010b050003820101001159fa254f036f94993b9a1f828539d47605945ee128936d625d09c2a0a8d4b07538f1346a9de49f8a862651e62cd1c62d6e95204a9201ecb88a677b31e2672e8c9503262e439d4a31f60eb50cbbb7e2377f22ba00a30e7b52fb6bbb3bc4d379514ecd90f4670719c83c467a0d017dc558e76de68530179a24c410e004f7e0f27fd4aa0aff421d37ed94e5645912207738d3323e3881759673fa688fb1cbce1fc5ecfa9c7ecf7eb1f1072db6fcbfcaa4bfd097054abcea18280290bd5478092171d3d17d1dd916b0a9613dd00a0022fcc77bcb0964450b3b4081f77d7c32f598ca588e7d2aee90597364f936745e25a1f566052e7f3915a92afb508b8e8569f4 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\1C58A3A8518E8759BF075B76B750D4F2DF264FCD\Blob = 0300000001000000140000001c58a3a8518e8759bf075b76b750d4f2df264fcd2000000001000000c2040000308204be308203a6a003020102021006d8d904d5584346f68a2fa754227ec4300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3231303431343030303030305a170d3331303431333233353935395a304f310b300906035504061302555331153013060355040a130c446967694365727420496e633129302706035504031320446967694365727420544c53205253412053484132353620323032302043413130820122300d06092a864886f70d01010105000382010f003082010a0282010100c14bb3654770bcdd4f58dbec9cedc366e51f311354ad4a66461f2c0aec6407e52edcdcb90a20eddfe3c4d09e9aa97a1d8288e51156db1e9f58c251e72c340d2ed292e156cbf1795fb3bb87ca25037b9a52416610604f571349f0e8376783dfe7d34b674c2251a6df0e9910ed57517426e27dc7ca622e131b7f238825536fc13458008b84fff8bea75849227b96ada2889b15bca07cdfe951a8d5b0ed37e236b4824b62b5499aecc767d6e33ef5e3d6125e44f1bf71427d58840380b18101faf9ca32bbb48e278727c52b74d4a8d697dec364f9cace53a256bc78178e490329aefb494fa415b9cef25c19576d6b79a72ba2272013b5d03d40d321300793ea99f50203010001a38201823082017e30120603551d130101ff040830060101ff020100301d0603551d0e04160414b76ba2eaa8aa848c79eab4da0f98b2c59576b9f4301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030106082b06010505070302307606082b06010505070101046a3068302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304006082b060105050730028634687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274476c6f62616c526f6f7443412e63727430420603551d1f043b30393037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274476c6f62616c526f6f7443412e63726c303d0603551d2004363034300b06096086480186fd6c02013007060567810c01013008060667810c0102013008060667810c0102023008060667810c010203300d06092a864886f70d01010b050003820101008032ce5e0bdd6e5a0d0aafe1d684cbc08efa8570edda5db30cf72b7540fe850afaf33178b7704b1a8958ba80bdf36b1de97ecf0bba589c59d490d3fd6cfdd0986db771825bcf6d0b5a09d07bdec443d82aa4de9e41265fbb8f99cbddaee1a86f9f87fe74b71f1b20abb14fc6f5675d5d9b3ce9ff69f7616cd6d9f3fd36c6ab038876d24b2e7586e3fcd8557d26c21177df3e02b67cf3ab7b7a86366fb8f7d89371cf86df7330fa7babed2a59c842843b11171a52f3c90e147da25b7267ba71ed574766c5b8024a65345e8bd02a3c209c51994ce7529ef76b112b0d927e1de88aeb36164387ea2a63bf753febdec403bb0a3cf730efebaf4cfc8b3610733ef3a4 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a2030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa20f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e2000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A MBAMService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\2AD974A775F73CBDBBD8F5AC3A49255FA8FB1F8C\Blob = 19000000010000001000000087513236ba5fcaae2b242962815926f80300000001000000140000002ad974a775f73cbdbbd8f5ac3a49255fa8fb1f8c2000000001000000620400003082045e30820346a0030201020213077312380b9d6688a33b1ed9bf9ccda68e0e0f300d06092a864886f70d01010b05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412031301e170d3232303832333232323132385a170d3330303832333232323132385a303c310b3009060355040613025553310f300d060355040a1306416d617a6f6e311c301a06035504031313416d617a6f6e205253412032303438204d303130820122300d06092a864886f70d01010105000382010f003082010a0282010100eb712ca9cb1f8828923230af8a570f78b73725955587ac675c97d322c8daa214676b7cf067dae2032ab356125dc6b547f96708a7937a9592180fb4f9f910369a7f2f80b64fba134ec75d531ee0dd96330720d396bc12e4745042a1051373b54f9b4424fe2d7fedbc2285ec362133977506ce271882dce3d9c582078d5e26012626671fd93f13cf32ba6bad7864fcaaff0e023c07df9c0578728cfdea75b7032884dae86e078cd05085ef8154b2716eec6d62ef8f94c35ee9c4a4d091c02e249198caeeba258ed4f671b6fb5b6b38064837478d86dcf2ea06fb76377d9eff424e4d588293cfe271c278b17aab4b5b94378881e4d9af24aef872c565fb4bb451e70203010001a382015a3082015630120603551d130101ff040830060101ff020100300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030106082b06010505070302301d0603551d0e0416041481b80e638a891218e5fa3b3b50959fe6e5901385301f0603551d230418301680148418cc8534ecbc0c94942e08599cc7b2104e0a08307b06082b06010505070101046f306d302f06082b060105050730018623687474703a2f2f6f6373702e726f6f746361312e616d617a6f6e74727573742e636f6d303a06082b06010505073002862e687474703a2f2f6372742e726f6f746361312e616d617a6f6e74727573742e636f6d2f726f6f746361312e636572303f0603551d1f043830363034a032a030862e687474703a2f2f63726c2e726f6f746361312e616d617a6f6e74727573742e636f6d2f726f6f746361312e63726c30130603551d20040c300a3008060667810c010201300d06092a864886f70d01010b05000382010100ad00de0205232e063262b46bb19416e41140de2bfa59c135efe0aa8f2b41b9d1f38739001df23db5a7470c0606c691f3075702d4edbd17c1909abf4875a2074f30dd4a6a42b50d3d15c00ffe845bc63c99cc5752b1d86e12d59692934b94e507e88982086a7a34d49e64e13d876a92909a63a14bf88fb6ea34d305be20c2de06e28c9f738b9f4d3985cace19369d85c99ec9f8503fb67e88a1efca84068b50b40a5ca61c44f1fdc8614060f26125aa07f4c7c27375e40c0b428d04e55f4448995b7b898196a7889d4b0d62e804c4d7feb4e8b26dcaecc01cbc385b1ddf85ce5b7ae3494b6cb9a7ddf405b249ade1c5146bc2ccebcd7fd65869bac3207e7fb0b8 MBAMService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 040000000100000010000000be954f16012122448ca8bc279602acf5140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a2030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa20f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e1900000001000000100000009f687581f7ef744ecfc12b9cee6238f12000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 MBAMService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800001900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa20f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e MBAMService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df0030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae4740f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f20000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 MBAMService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\1C58A3A8518E8759BF075B76B750D4F2DF264FCD\Blob = 140000000100000014000000b76ba2eaa8aa848c79eab4da0f98b2c59576b9f40300000001000000140000001c58a3a8518e8759bf075b76b750d4f2df264fcd1900000001000000100000003b878212830eb36469856f1c683b836c2000000001000000c2040000308204be308203a6a003020102021006d8d904d5584346f68a2fa754227ec4300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3231303431343030303030305a170d3331303431333233353935395a304f310b300906035504061302555331153013060355040a130c446967694365727420496e633129302706035504031320446967694365727420544c53205253412053484132353620323032302043413130820122300d06092a864886f70d01010105000382010f003082010a0282010100c14bb3654770bcdd4f58dbec9cedc366e51f311354ad4a66461f2c0aec6407e52edcdcb90a20eddfe3c4d09e9aa97a1d8288e51156db1e9f58c251e72c340d2ed292e156cbf1795fb3bb87ca25037b9a52416610604f571349f0e8376783dfe7d34b674c2251a6df0e9910ed57517426e27dc7ca622e131b7f238825536fc13458008b84fff8bea75849227b96ada2889b15bca07cdfe951a8d5b0ed37e236b4824b62b5499aecc767d6e33ef5e3d6125e44f1bf71427d58840380b18101faf9ca32bbb48e278727c52b74d4a8d697dec364f9cace53a256bc78178e490329aefb494fa415b9cef25c19576d6b79a72ba2272013b5d03d40d321300793ea99f50203010001a38201823082017e30120603551d130101ff040830060101ff020100301d0603551d0e04160414b76ba2eaa8aa848c79eab4da0f98b2c59576b9f4301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030106082b06010505070302307606082b06010505070101046a3068302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304006082b060105050730028634687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274476c6f62616c526f6f7443412e63727430420603551d1f043b30393037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274476c6f62616c526f6f7443412e63726c303d0603551d2004363034300b06096086480186fd6c02013007060567810c01013008060667810c0102013008060667810c0102023008060667810c010203300d06092a864886f70d01010b050003820101008032ce5e0bdd6e5a0d0aafe1d684cbc08efa8570edda5db30cf72b7540fe850afaf33178b7704b1a8958ba80bdf36b1de97ecf0bba589c59d490d3fd6cfdd0986db771825bcf6d0b5a09d07bdec443d82aa4de9e41265fbb8f99cbddaee1a86f9f87fe74b71f1b20abb14fc6f5675d5d9b3ce9ff69f7616cd6d9f3fd36c6ab038876d24b2e7586e3fcd8557d26c21177df3e02b67cf3ab7b7a86366fb8f7d89371cf86df7330fa7babed2a59c842843b11171a52f3c90e147da25b7267ba71ed574766c5b8024a65345e8bd02a3c209c51994ce7529ef76b112b0d927e1de88aeb36164387ea2a63bf753febdec403bb0a3cf730efebaf4cfc8b3610733ef3a4 MBAMService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\5A8CEF45D7A69859767A8C8B4496B578CF474B1A\Blob = 1900000001000000100000001453ecde791c95bb23a22893e83ab8cd0f0000000100000030000000d746a5bf1663a495fb88bbe77dbce6a325c994a696299331ef4c5afa26c00970bacdd3d3b49db055b6582b5d1a54b7af0300000001000000140000005a8cef45d7a69859767a8c8b4496b578cf474b1a140000000100000014000000b00cf04c30f405580248fd33e552af4b84e366522000000001000000450500003082054130820329a0030201020213066c9fd29635869f0a0fe58678f85b26bb8a37300d06092a864886f70d01010c05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412032301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f74204341203230820222300d06092a864886f70d01010105000382020f003082020a0282020100ad969f2d9c4a4c4a81795199ec8acb6b605113bc4d6d06fcb0088ddd19106ac7260c35d8c06f2084e994b19b8503c35bdb4ae8c8f89076d95b4fe34ce806364dcc9aac3d0c902b92d4061960ac374479858182ad5a37e00dcc9da64c5276ea439db704d150f655e0d5d2a64985e937e9ca7eae5c954d489a3fae205a6d8895d934b8521a4390b0bf6c05b9b678b7ead0e43a3c125362ff4af27bbe3505a91234e3f36474622c3d00495a28fe3244bb87dd652702713bda4af71fdacdf72155904f0fecae82e19f6bd945d3bbf05f87ed3c2c3986da3fdeec7255eb79a3addbdd7cb0ba1ccefcde4f3576cf0ff8781f6a36514627615be99ecff0a2557d7c258a6f2fb4c5cf842e2bfd0d51106cfb5f1bbc1b7ec5ae3b98013192ff0b57f49ab2b957e9abef0d76d1f0eef4ce86a7e06ee9b469a1df69f633c6692e97139ea587b057108137c953b3bb7ff692d19cd018f4926eda834fa663994ca5fb5eef21647a205f6c648515cb37e9620c0b2a16dc012e32da3e4bf59e3af6174094ef9e910886fabe63a85a33eccb744395f96c695236c7296ffc55035c1ffb9fbd47ebe74947950b4e89220949e0f5611ef1bf2e8a726e8059ff573af97532a34e5feced2862d94d73f2cc811760edcdebdcdba7cac57e02bdf2540854fdb42d092c17544a98d154e1516708d2ed6e7e6f3fd22d81592966cb903995111e7427feddebaf0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414b00cf04c30f405580248fd33e552af4b84e36652300d06092a864886f70d01010c05000382020100aaa8808f0e78a3e0a2d4cde6f5987a3bea0003b0970e93bc5aa8f62c8c7287a9b1fc7f73fd637178a58759cf30e10d10b2135a6d82f56ae6809fa0050b68e4476bc76adfb6fd773272e518fa09f4a0932c5dd28c75857665900c0379b7312363ad788309866884cafff9cf269a9279e7cd4bc5e761a717cbf3a91293936ba7e82f5392c46058b0cc0251185b858d625963b6adb4de9afb26f70027c05d55377499c9507fe3592e44e32c25eeec4c3277b49f1ae94b5d20c5dafd1c8716c643e8d4bb269a45705ea90b3753e2467b27fde046f289b7cc42b6cb28266ed9a5c93ac8411360f7508c15aeb26d1a151a5778e6922ad96590823f6c02afae123a27963604d71da28063a99bf1e5bab47c14b04ec9b11f745f38f651ea9bfa2ca211d4a92d271a45b1afb24e710dc05846d66906cb53cbb3fe6b41cd417e7d4c0f7c72797a59cd5e4a0eac9ba99873797cb4f4ccb9b8070cb2745cb8c76f88a190a7f4aaf9bf673af41a15621eb79fbe3db129af67a112f25810195303301bb81a89f69cbd97038ea309f31d8b21f1b4dfe41cd19f650206ea5cd613b384efa2a55c8c7729a768c06bae40d2a8b4eacdf08d4b389c199a1b2854b88990efca75813e1ef26424c718af4eff479e07f63565a4d30a56fff517646cefa822254993b6df0017da587e5deec51bb0d1d15f2110c7f9f3ba020a2707c5f1d6c7d3e0fb09606c MBAMService.exe - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 4084 mbamtray.exe 5688 mbam.exe - Suspicious behavior: EnumeratesProcesses 32 IoCs
pid Process 2068 malwarebytes-4-6-8-370.exe 2068 malwarebytes-4-6-8-370.exe 3696 MBAMInstallerService.exe 3696 MBAMInstallerService.exe 3696 MBAMInstallerService.exe 3696 MBAMInstallerService.exe 3696 MBAMInstallerService.exe 3696 MBAMInstallerService.exe 3696 MBAMInstallerService.exe 3696 MBAMInstallerService.exe 3696 MBAMInstallerService.exe 3696 MBAMInstallerService.exe 768 MBAMService.exe 768 MBAMService.exe 768 MBAMService.exe 768 MBAMService.exe 768 MBAMService.exe 768 MBAMService.exe 768 MBAMService.exe 768 MBAMService.exe 768 MBAMService.exe 768 MBAMService.exe 4084 mbamtray.exe 4084 mbamtray.exe 4084 mbamtray.exe 4084 mbamtray.exe 5688 mbam.exe 5688 mbam.exe 5688 mbam.exe 5688 mbam.exe 768 MBAMService.exe 768 MBAMService.exe - Suspicious behavior: LoadsDriver 13 IoCs
pid Process 680 Process not Found 680 Process not Found 680 Process not Found 680 Process not Found 680 Process not Found 680 Process not Found 680 Process not Found 680 Process not Found 680 Process not Found 680 Process not Found 680 Process not Found 680 Process not Found 680 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: 33 1952 MBAMService.exe Token: SeIncBasePriorityPrivilege 1952 MBAMService.exe Token: 33 768 MBAMService.exe Token: SeIncBasePriorityPrivilege 768 MBAMService.exe Token: SeBackupPrivilege 768 MBAMService.exe Token: SeRestorePrivilege 768 MBAMService.exe Token: SeTakeOwnershipPrivilege 768 MBAMService.exe Token: SeDebugPrivilege 768 MBAMService.exe Token: SeBackupPrivilege 768 MBAMService.exe Token: SeRestorePrivilege 768 MBAMService.exe Token: SeTakeOwnershipPrivilege 768 MBAMService.exe Token: SeDebugPrivilege 768 MBAMService.exe Token: SeSecurityPrivilege 768 MBAMService.exe Token: SeDebugPrivilege 768 MBAMService.exe Token: SeDebugPrivilege 768 MBAMService.exe Token: SeDebugPrivilege 768 MBAMService.exe Token: SeDebugPrivilege 768 MBAMService.exe Token: SeDebugPrivilege 768 MBAMService.exe Token: SeDebugPrivilege 768 MBAMService.exe Token: SeDebugPrivilege 768 MBAMService.exe Token: SeDebugPrivilege 768 MBAMService.exe Token: SeDebugPrivilege 768 MBAMService.exe Token: SeDebugPrivilege 768 MBAMService.exe Token: SeDebugPrivilege 768 MBAMService.exe Token: SeDebugPrivilege 768 MBAMService.exe Token: SeDebugPrivilege 768 MBAMService.exe Token: SeDebugPrivilege 768 MBAMService.exe Token: SeDebugPrivilege 768 MBAMService.exe Token: SeDebugPrivilege 768 MBAMService.exe Token: SeDebugPrivilege 768 MBAMService.exe Token: SeDebugPrivilege 768 MBAMService.exe Token: SeDebugPrivilege 768 MBAMService.exe Token: SeDebugPrivilege 768 MBAMService.exe Token: SeDebugPrivilege 768 MBAMService.exe Token: SeDebugPrivilege 768 MBAMService.exe Token: SeDebugPrivilege 768 MBAMService.exe Token: SeDebugPrivilege 768 MBAMService.exe Token: SeDebugPrivilege 768 MBAMService.exe Token: SeDebugPrivilege 768 MBAMService.exe Token: SeDebugPrivilege 768 MBAMService.exe Token: SeDebugPrivilege 768 MBAMService.exe Token: SeDebugPrivilege 768 MBAMService.exe Token: SeDebugPrivilege 768 MBAMService.exe Token: SeDebugPrivilege 768 MBAMService.exe Token: SeDebugPrivilege 768 MBAMService.exe Token: SeDebugPrivilege 768 MBAMService.exe Token: SeDebugPrivilege 768 MBAMService.exe Token: SeDebugPrivilege 768 MBAMService.exe Token: SeDebugPrivilege 768 MBAMService.exe Token: SeDebugPrivilege 768 MBAMService.exe Token: SeDebugPrivilege 768 MBAMService.exe Token: SeDebugPrivilege 768 MBAMService.exe Token: SeDebugPrivilege 768 MBAMService.exe Token: SeDebugPrivilege 768 MBAMService.exe Token: SeDebugPrivilege 768 MBAMService.exe Token: SeDebugPrivilege 768 MBAMService.exe Token: SeDebugPrivilege 768 MBAMService.exe Token: SeDebugPrivilege 768 MBAMService.exe Token: SeDebugPrivilege 768 MBAMService.exe Token: SeDebugPrivilege 768 MBAMService.exe Token: SeDebugPrivilege 768 MBAMService.exe Token: SeDebugPrivilege 768 MBAMService.exe Token: SeDebugPrivilege 768 MBAMService.exe Token: SeDebugPrivilege 768 MBAMService.exe - Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 2068 malwarebytes-4-6-8-370.exe 4084 mbamtray.exe 4084 mbamtray.exe 4084 mbamtray.exe 4084 mbamtray.exe 4084 mbamtray.exe 4084 mbamtray.exe 4084 mbamtray.exe 4084 mbamtray.exe 4084 mbamtray.exe 4084 mbamtray.exe 4084 mbamtray.exe 4084 mbamtray.exe 4084 mbamtray.exe 4084 mbamtray.exe 4084 mbamtray.exe 4084 mbamtray.exe 4084 mbamtray.exe - Suspicious use of SendNotifyMessage 14 IoCs
pid Process 4084 mbamtray.exe 4084 mbamtray.exe 4084 mbamtray.exe 4084 mbamtray.exe 4084 mbamtray.exe 4084 mbamtray.exe 4084 mbamtray.exe 4084 mbamtray.exe 4084 mbamtray.exe 4084 mbamtray.exe 4084 mbamtray.exe 4084 mbamtray.exe 4084 mbamtray.exe 4084 mbamtray.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2728 LogonUI.exe - Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 3696 wrote to memory of 1952 3696 MBAMInstallerService.exe 78 PID 3696 wrote to memory of 1952 3696 MBAMInstallerService.exe 78 PID 768 wrote to memory of 4084 768 MBAMService.exe 81 PID 768 wrote to memory of 4084 768 MBAMService.exe 81 PID 768 wrote to memory of 5432 768 MBAMService.exe 82 PID 768 wrote to memory of 5432 768 MBAMService.exe 82 PID 768 wrote to memory of 5432 768 MBAMService.exe 82 PID 768 wrote to memory of 5440 768 MBAMService.exe 83 PID 768 wrote to memory of 5440 768 MBAMService.exe 83 PID 768 wrote to memory of 5440 768 MBAMService.exe 83 PID 768 wrote to memory of 5448 768 MBAMService.exe 84 PID 768 wrote to memory of 5448 768 MBAMService.exe 84 PID 768 wrote to memory of 5448 768 MBAMService.exe 84 PID 768 wrote to memory of 5456 768 MBAMService.exe 85 PID 768 wrote to memory of 5456 768 MBAMService.exe 85 PID 768 wrote to memory of 5456 768 MBAMService.exe 85 PID 2068 wrote to memory of 5688 2068 malwarebytes-4-6-8-370.exe 86 PID 2068 wrote to memory of 5688 2068 malwarebytes-4-6-8-370.exe 86
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3296
-
C:\Users\Admin\AppData\Local\Temp\malwarebytes-4-6-8-370.exe"C:\Users\Admin\AppData\Local\Temp\malwarebytes-4-6-8-370.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Checks BIOS information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2068
-
-
C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe"C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
PID:5688
-
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"1⤵
- Drops file in Drivers directory
- Enumerates connected drives
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe" /Service /Protected2⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Executes dropped EXE
- Registers COM server for autorun
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1952
-
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Checks BIOS information in registry
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe"C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4084
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:5432
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:5440
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:5448
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:5456
-
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMWsc.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMWsc.exe" /wac 0 /status off true /updatesubstatus none /scansubstatus none /settingssubstatus none2⤵
- Executes dropped EXE
PID:1368
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004B8 0x00000000000004701⤵PID:1740
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3a18055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2728
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Defense Evasion
Modify Registry
3Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\7z.dll
- Size 1.7MB
- SHA256 77a4eb913e5bc068fe1479f6da9bd2b31303b6d23c7e353dde2984fa373273f2
- MD5 b9bab3b367c53472908741b774fce358
- SHA1 987e358915e7bb78491a65073189642f88d0d823
- SHA512 60b3858901df2ad51db7efde8673fd17c529c09029247d6bfb6565031d53d00b1d554ba558b0440a00c961204b0bb812d0f9ceef16a7fc1934f6b1a5efa91745
- SSDEEP 24576:oLB2ycglUr6G8epqFMyn9w44NBdzHq5FmBq7Wk2zjt:gB2GUr1882ANBdzHq5B7WlF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ActionsShim.dll
- Size 2.2MB
- SHA256 81a28988d59a8e75b771456f61aa3029f334f2a492da70f53bd93403122e2951
- MD5 13ee270968b2eaf9d45770e831412c0a
- SHA1 6f4bfee0efd52db649a9378298148fd5ae5001e1
- SHA512 36f9339f15bd1982fe196eaf23ed879db5fdf1cc1c41683a915d1ee9718053720c9794e77d093a51adf9c20f58b2f5191abeecef41ea87746933c845be48bcde
- SSDEEP 49152:jR3rKKPT0xXxBg7KNvBtFXTM6utS1vdPUGu5hK:JLeFDMb8F2Gu/K
- MD5 SHA1 SHA512 SSDEEP
- Path C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\BrowserSDKDLL.dll
- Size 5.4MB
- SHA256 c726b443321a75311e22b53417556d60aa479bbd11deb2308f38b5ad6542d8d3
- MD5 956b145931bec84ebc422b5d1d333c49
- SHA1 9264cc2ae8c856f84f1d0888f67aea01cdc3e056
- SHA512 fb9632e708cdae81f4b8c0e39fed2309ef810ca3e7e1045cf51e358d7fdb5f77d4888e95bdd627bfa525a8014f4bd6e1fbc74a7d50e6a91a970021bf1491c57c
- SSDEEP 49152:WOMS+osEWWJTo6sMtR1X5A8sCpyFebxLku0b1vecPa3o4TpB4Rm284WJ7ibgAAnA:fq4L1+flWXAyOI3zam/i
- MD5 SHA1 SHA512 SSDEEP
- Path C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\BrowserSDKDLLShim.dll
- Size 2.2MB
- SHA256 fb970b37252187b89d386c1e20260ffd7ef311d5f4943286955403123b5ba4d6
- MD5 f1848947da7a0a936075bc2600bfbafb
- SHA1 72cc97578edc7826ba04060ea1f60a1f17da25ef
- SHA512 575a683d28c1ee3f56f9cd7c30c14cc92e3e5353a0724c04542d08fe19b219c090b0df1e87767b23bc7298d4bd85e9ddd79183fde70009efb87e3f44406c7e51
- SSDEEP 49152:fZ0HSx0VU4YZZmQ7i4WkqN4cqHD8TB24nWdPfensaTz13:USx7H4W1enjTz13
- MD5 SHA1 SHA512 SSDEEP
- Path C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\CleanControllerImpl.dll
- Size 6.6MB
- SHA256 b2185815e7724eaecc7cb35cbb4667948a4d93697de5dd2bc058e4c604a90735
- MD5 af90150f1e491048599c39a64014f093
- SHA1 185528c8652fd1ad9f5a706870aa9e3129855b41
- SHA512 ac72684392ff795f10c8e18761a9ae8fb5fbc7f50bb4a4fb17457c1612a9525b9b9193f68fac5af309aff64cf569539b7d6bd363c0070bfe0765d3362bff0d35
- SSDEEP 98304:o0pieOW+iLogw4G+O/bZttCf/Xed7X2SBbBmp0:ITXiLoX4G3bZtYfvC7X2SBMp0
- MD5 SHA1 SHA512 SSDEEP
- Path C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\CloudControllerImpl.dll
- Size 5.0MB
- SHA256 28d80c2f0af4294180fe431e8bcefabcf4c2fd2ac1b2f35f9e24d03f88652a40
- MD5 d071fdd70e6c320bf6096740ae37f345
- SHA1 a9b0e5a33ed426eb4cfa3c820b7edf512f6d2187
- SHA512 b6b68a5e995f1c1a48c6af47800457d2dbb11a4e4366adfa328cd560c41eb060135e90c421722de8b07765caec117e856ba3615ad1f53b7e461e649d00759f51
- SSDEEP 49152:qcXJPJKw3+cDx5NPGZT+geufeUB6vWW3JKfMxchWIeCRz/KQTGvlwGIB9ZSi35hR:PyfevMwUZh35ytxkRlLtsID
- MD5 SHA1 SHA512 SSDEEP
- Path C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\LicenseControllerImpl.dll
- Size 4.4MB
- SHA256 17f3115bffaf7f28540c13d4bf7182481dee8ef70cb8468488ff44b7f56da75d
- MD5 af93fb0f8f40f94482f1199cbf67dc0e
- SHA1 ddd06d773149cd0b80c0d660edf453d9e93f3c66
- SHA512 92762f4875dfce2e4c8777a836c259dba56086469b27ed2a833645598dcb11bf33e112995ae583e5e8c7d407667b3f3bd8eaaeddd45d7332df820a3a797e9db8
- SSDEEP 49152:ngiVC6oelcPrM8BGYGqrj7I0HCEERmnkoBh+pRP9QnryLtzPVZlcx+yPcFfQBMtT:U6oeJRq0E+pvQrytpXFftMun
- MD5 SHA1 SHA512 SSDEEP
- Path C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\MBAMShim.dll
- Size 2.7MB
- SHA256 29605d569b63258124bf550bfe076d80c154b6ce4d1c7a55f93541d6110f4f2e
- MD5 c980568936edacb72f8301212f89fb15
- SHA1 6e42ca2f9f66ce37f133842d11f9d3ce5bbb0b92
- SHA512 76a861767480fd6c7f3fbef88cab90506a9a783d532dc5a79784df1d31e41628f7cf9512b05745b199dd513de4c3011bd27dc5d04ed77115bd4161cba76c40d9
- SSDEEP 49152:PlwG4ajulQnmwKAZT0EmCTj7dBjrBhXwAUI3yVgMPdPY4N8K5Oo:Tir+B+AUTi4Kvo
- MD5 SHA1 SHA512 SSDEEP
- Path C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\PoliciesControllerImpl.dll
- Size 4.2MB
- SHA256 4217a62ea3df3bd98e40d205b4fb5f9673c340c366551adb771ff3e34e7bdcfc
- MD5 80202b21a6f3df9d0d54f20a381df93c
- SHA1 6915dcc75d0b84e5db40656d6382cb217a1996c2
- SHA512 8d691deae1f7c5243d045940f7f728a874e72550859b291119c9b951bd95232980dc2a1b3c19154c723c42e0aa93747a046f747bbc305941594477a39c2925f1
- SSDEEP 49152:pnSAaHDtPy60gAIKmDb3ye7oq0yp41vk8WhBYMQ15nsGtnPJZnSHyPW4xfA+jFDi:pUjdJ0ClfIMw5ntt2d4xY+ji3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ScanControllerImpl.dll
- Size 5.3MB
- SHA256 23feea6a672a097ae98ee9dfcc19fdd233a2a6b35caf62be773ad9b17ce0afd7
- MD5 dc0faa2c37fe59718247f09c5e6c2259
- SHA1 9874a8326e30ff36bcef268a61aed8970ad68aec
- SHA512 3cbca3cb26d1c8c29edb421c9e131b55e0c20c0cf446b7b65c6b7d209a003a870ee63d6a3b725eaa660f6d8d8c9a0b0a3f90045e3c255957ebee3005f650594e
- SSDEEP 98304:h3zIn5BimgyioTutZXHMKl6UF9SgEJUwI0rE121GMIB054Mlb:hxwI0Y121GM4m
- MD5 SHA1 SHA512 SSDEEP
- Path C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\Swissarmy.dll
- Size 3.6MB
- SHA256 0ab5bb50043f3d4c500a65d5ecc716841ac89160b5509f0c847c93e0ce187a41
- MD5 c83e0ccd9556a6a5942c44b2d41e5192
- SHA1 4199fbbe10004603861c24de8ebffafbf7cc28e7
- SHA512 18c7e6dfd4f20966913234b4463f8f6934f829cf91879709343ab694e5ce96fad8615d0b5b0a5609a3bee1d160c8ff6173fe7dbee009dc1225d6e3aeb0995b13
- SSDEEP 49152:CX56PF5mUe5C+ESJTNMA4TpU7ki9NBmMTM35cn+83FkZdPwtgQFpqyNKMj+fhuK6:3Cn1+MQpc+83AWtgy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\SwissarmyShim.dll
- Size 2.2MB
- SHA256 ee996a9f0631cb6253c63122df4e5fc0aa1026c2a6c6bdb9bb3a11a848102be7
- MD5 e2a94500d8638cec43ea7804ac28c8df
- SHA1 8c7c6a76e55ceab47f0cb5ef7a80935f2fb02e05
- SHA512 8811b7ec4028f0857a9c6d59ee2006ce61634fd08cdce2db8ccb78f17abfd443e0a54977edb157e06ad321f30004ec6f0ad1d26b93c45b0de1f3f9d73d19901c
- SSDEEP 49152:KgFZncWsautHhfk712uK44B7UIZDkdQWSZIVA7y0dPlUTLOtP:d0/jUEk+XjUTCtP
- MD5 SHA1 SHA512 SSDEEP
- Path C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\TelemetryControllerImpl.dll
- Size 5.1MB
- SHA256 a2810cab5f9e7ce85be8ae7ba9d30e909e1e322bf10a84e651e16db39b251796
- MD5 8c0dc4b519228df594105f9fe7aaa0f9
- SHA1 a1682e4c5ab80bfdb52c3234dc7172838f7c8594
- SHA512 c0a7393d665b6006496b698f250cd86c09ec5601fdb297ee7483ad560427b37cbe75b3d1bf4c711433a5f324a1a1bd9699738efb2daa61c26b9c3ba6963e663f
- SSDEEP 49152:sjt1UQrJyKv7wCu2JPDxeB50AOCAWqaWdWzdbWqa4Odgsi7wWiSelWXBX4jAw+oq:o1PerdVWuNn43+oMDtlTn1tCJ9MjU6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\UpdateControllerImpl.dll
- Size 4.4MB
- SHA256 44ea7c113d818660726d660b3910af8954e5088b47133f689b12afa27727d09c
- MD5 8e543c479f0c3882c6115e0eb9580c9d
- SHA1 5d2c9137f655bfff1817577e4c5ec27e55c4cdb0
- SHA512 d3df24b2172b0779ce9bb219a0e3a20be70346060325420de502d4f9fd618831cff7619cae199356cecc74a6570cb0ef975abd0a049f7964dc871e50ebc2845c
- SSDEEP 49152:3PGgp0e0W0Z/m4O+Apii0ckLs4hHb1fM5BBIkl/mz4/ctRPTZmLAIyPhsj852Yfa:eeR0FTLkIkwz6ctoysj8g
- MD5 SHA1 SHA512 SSDEEP
- Path C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\Global.nm
- Size 335KB
- SHA256 294686695079a8ccc8baef88166e6724e095dfbad86c469cc1dd0eda5cd17b46
- MD5 88e14c4397d044e0e1b3ec232a83f31f
- SHA1 3049ed816ba63229e2f3e17b775a2737fdb18787
- SHA512 a08b4f520f1f3947b89f2ca13a6efd489a41356e624b62d13e5e741d887ded2cf401efd3da68a46c90a5e12cbaf2b47c0879db47bd2ced821c42808d1d9faaf2
- SSDEEP 6144:9hGxOSg0QRcnfJcNys2RMXjbqhocw9kTqziGEstw3DwFG/qoAMvqBHo2k+9sCDNt:9hG4Sg0QRcnfJMys2RMXjbqhocw9kTq/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\Global.sr
- Size 16.9MB
- SHA256 438eda5898030545fbf99be8286e186b80da751fb36c16aabe0fb282a5a777bc
- MD5 9d8d48cfe6b77d5f399124bc728fc0a2
- SHA1 9205cb35f79af1fcdf3d4829a7d1d82b53992785
- SHA512 05e0f2d115555479341608d2eba9989d469adc595b4d459d05457103c8a261e0cb5adb8b8fed4ae5e276d3107150e2d8d3a886ea04c8729bd1b5a194ab9ee7dc
- SSDEEP 196608:piJD5KateRaLgr25+SjrI8NULzFzVTTU7D75vnjzWcjqXNBMChKKLFRjdx69wSNf:piR8EgSYSjHyFUDRjPjGvhDYFF9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\cfg.bin
- Size 1KB
- SHA256 4783d65126b8c83fd9aa8ee0e8428d10c20adb3daee6b6c92dab9aaa26964a67
- MD5 634c582955715ab32ddfe83406564b05
- SHA1 79c0a481c1ff351c2e622e440bf7e6795ca6efff
- SHA512 38af39912704bed274cbea2c8cc0d136b94e328433cc02bfa7f04fdd9313473e11f6e6cd34a7b4614de55de0d8746ade1040a9eca4f37fff178a07d3e8f5b1d6
- MD5 SHA1 SHA512
- Path C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\clean.mbdb
- Size 13KB
- SHA256 c3183b5302b4d7ebb1a10caf3850714f174686811f69ff19ee5c30473ee14dec
- MD5 d70b65324834040c082ab4eba259a956
- SHA1 f0afd0c92ba69805c72d6737466c25390fd3df7c
- SHA512 0c07f4c28571bb495adf8f24c492f475cfa9a4483e93d6c3e9ed1522f6fcb03f8ea17bca7ff0180d4e9d758126db105f9016609b0d9033cd9d2c609b1512145b
- SSDEEP 384:ljFf5W00P8b98Of/cdY4K8DSWzi8AMHE6GrxqRpFH:lJY00P8b+eEe4K8Pi7MHEZ4FH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\dbmanifest2.dat
- Size 924B
- SHA256 8f4bbb96ffab016f850c54e845f0155af653495fb7d5ee9227db9d5c37d0df55
- MD5 4432f69fdbaa587445bae0f933d90f97
- SHA1 6c2467ac8f94c262d9582dfb2832f2ae4c65c084
- SHA512 40757d955a8b31177dd410ee19132982657504db4ca068c49f9b89bd97b1e730e97af13012b960b330f795ce77517a91c2c63dcaff0d427385519a04682dc51c
- MD5 SHA1 SHA512
- Path C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\dynconfig.dat
- Size 39KB
- SHA256 008254ca1f4d6415da89d01a4292911de6135b42833156720a841a22685765dc
- MD5 10f23e7c8c791b91c86cd966d67b7bc7
- SHA1 3f596093b2bc33f7a2554818f8e41adbbd101961
- SHA512 2d1b21371ada038323be412945994d030ee8a9007db072484724616c8597c6998a560bc28886ebf89e2c8919fb70d76c98338d88832351823027491c98d48118
- SSDEEP 384:jNOT68xDvtG9ObE7L8u8sXNVkIfvs4FRj:ay8u8KVkIXsWRj
- MD5 SHA1 SHA512 SSDEEP
- Path C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\exclusions.txt
- Size 23KB
- SHA256 9e87e4c9da3337c63b7f0e6ed0eb71696121c74e18a5da577215e18097715e2f
- MD5 aef4eca7ee01bb1a146751c4d0510d2d
- SHA1 5cf2273da41147126e5e1eabd3182f19304eea25
- SHA512 d31d21e37b0048050b19600f8904354cff3f3ec8291c5a7a54267e14af9fb88dfb6d11e74a037cc0369ade8a8fb9b753861f3b3fb2219563e8ec359f66c042db
- SSDEEP 384:OpHJUPIIawosLqVqmv4EHUtVbUQIKiKn6p+C+vNCMSP+TyHS7ivS/6:mYmsGfvSp/6pzgH4cyH9E6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\mbdigsig2.dat
- Size 514B
- SHA256 f3eed3a38d3d6a94eaa83d4bb6893e4f114c4f1b66182ccb279d548169a5dcb4
- MD5 10c5aca6a34bf6a02966f6337bdca164
- SHA1 b63f6cbe199d0c13277613a69dbcd3e1452bf9d4
- SHA512 7796b75c5f186907ce1a96fda98ba6fab6f1461f5b42ac592c06a4cc01dd4037a29c3b4f82c01bbb115e907e347e2bb70b93ea93644f7c50bb17a298e9037f6d
- MD5 SHA1 SHA512
- Path C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\prot.mbdb
- Size 24B
- SHA256 6089fbf0c0c1413f62e91dc9497bedc6d8a271e9dc761e20adc0dccf6f4a0c1f
- MD5 546d9e30eadad8b22f5b3ffa875144bf
- SHA1 3b323ffef009bfe0662c2bd30bb06af6dfc68e4d
- SHA512 3478f5dcf7af549dd6fe48ad714604200de84a90120b16a32233b6d44fa7240f5f4e5fe803f54b86bbdfd10fa1bfdd88fb85eb6a78e23e426933f98d0a2565ec
- MD5 SHA1 SHA512
- Path C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\rdefs.mbdb
- Size 24B
- SHA256 850a4ea37a0fd6f68bf95422d502b2d1257264eb90cc38c0a3b1b95aa375be55
- MD5 2f7423ca7c6a0f1339980f3c8c7de9f8
- SHA1 102c77faa28885354cfe6725d987bc23bc7108ba
- SHA512 e922ac8a7a2cde6d387f8698207cf5efbd45b646986a090e3549d97a7d552dd74179bd7ac20b7d246ca49d340c4c168982c65b4749df760857810b2358e7eb69
- MD5 SHA1 SHA512
- Path C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\rules.mbdb
- Size 9.6MB
- SHA256 dc6c11974f8c792271d2112801bd4d318a7153f4ab6667f5ea06ce4a460a8a20
- MD5 39a73fffb7913e998ae04dc9867ad4e7
- SHA1 4c48cfe074ef9c66634d835f78e7df2a19bd904e
- SHA512 d160b105e29aa1c704c9fcaa4c777deee9217382cef9b68c85c194e426001b00a4d9ae7b997a0f9e4bc0ec9202dfa65a0dd682cacbaf7b448d2b9bd89c45fa47
- SSDEEP 196608:OlrHnesd6BAGewyuA+m5uSnVTUsE1xKAfnuXNyEXb3rP+n3UyDnuDoMw:QbeswBAGewNmlnVwsEpfudyEXO3UouXw
- MD5 SHA1 SHA512 SSDEEP
- Path C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\scan.mbdb
- Size 893KB
- SHA256 0c1035a9df4074897e41c153963cc7b102bf534a972d311c85528d3657bc82e4
- MD5 b8a8f4846c44870cd0c827b711d920dd
- SHA1 37f1ff00714ed02277b9e20b023c0873b6a53af4
- SHA512 965ba0e059ff0577e6a6f3a16bbd59d70ab084b57e4c47cc13618803933ab0ab37efe8cfdd1b4034726d2d3d46e7dff62c1477057342ae9799937a2ae1508750
- SSDEEP 24576:UcZxveEbh1VHni9AL/b6kyZPMb97j5ll5xd9QrPLzRNuAf:9ZxveE9jMAf6kSw9X5DXQrPLbf
- MD5 SHA1 SHA512 SSDEEP
- Path C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\tids.mbdb
- Size 169KB
- SHA256 9bdcb56ca8268a24544f8ec1054391129fd12b1fa099a884affd0466b302f915
- MD5 902193e59c104e6cfc9feebe0aaf01ef
- SHA1 401f7eea67a239346aa0647ea40ce0adb4ab367a
- SHA512 ce18c4327a6fce0277d283b77df564c109ad7e574c0dc2aef3c56b3a10c25c584581a05cd765bfa2e255f10515ddc619f8c206d2e8ef050e0ffd9442e7a9a5d2
- SSDEEP 3072:rnzvAtvGpXFwiFtniKJi0eCzk8gPUKBBOYidly3HRwhLESjaHp0u24Z4:n/XmktnCCzk8gMy7sly3RIPaHau2V
- MD5 SHA1 SHA512 SSDEEP
- Path C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\wprot2.mbdb
- Size 25.7MB
- SHA256 caf9af39443ace93d64d14a6bd4a60f6f7f79ae76b8877efbc905098d594dd1a
- MD5 10cee9183253ed74d13b5248649273c6
- SHA1 82e680bb0c965b1454fcc0095268e63b1f65515f
- SHA512 e8471bf141c476aa0011f09d743d233735229d189247a4d9d0f365df1563510534f6592a2f31f4a057922dfb49a2751ed64b411ba39e590f88f2890bc0f40172
- SSDEEP 393216:Ek7xiYV6bo0V12X8wB/41m4KaF0iH3NiH+i52YH4/2z8VReIYsVPYyUp6Iy+sf0Z:lUboWsX5/41mG8eUrwV0I6lspcV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
- Size 9.4MB
- SHA256 07dde8806d61d71b56b87dddaf3c7d15f020d3b2b6e3b007808bc63dfeba05b2
- MD5 fafe37f692197bab48355c29a4e226b9
- SHA1 f224d38334037ed4254358a08e0396f490a13860
- SHA512 154edfeecf0a010a229a35ad99cfed23d0038b8b0e5ce774a7b33d5026bd4afa4f85386f713bd85bf38336750b0c08936276925aa7c32b0dd6ce0a177ffed44d
- SSDEEP 98304:pa9Szki5pZ0uAiM5tWKRPv9reT007kxNyFh2LET2W+hDIYx:s9SwMpZ0795tWKxvR9076NXEZ+hD9x
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.json
- Size 593B
- SHA256 69b6f01eae3c1226f8dcb8ccf7843c88fe27613cee0788bd123d9457511c49d3
- MD5 e855eacaac23de800a57974d6aed7462
- SHA1 0cfccc05d99659e3716ce3b3719348d08c8ad12d
- SHA512 58235ea6d3fd50d94f5ba4cd1e0926c5753107d28d6247f6bfb07f43e97c0437964830db1c4d3fbcc211252fb51eddced3a639333c7e0855e3822524e989054a
- MD5 SHA1 SHA512
- Path C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.json
- Size 655B
- SHA256 cdedb9c5e29871e4382d1cdc589de8671e047e132db0e5d7818fa213d36c243d
- MD5 3c5670f1adbdcde991e5fdf31cceb55b
- SHA1 2831f67570a2447d06e3f5929f4cf543d46aa764
- SHA512 df6eb8348777e7b803deb029238d0746f88f397f9e8ec5fd3e9a03205b243de2481ac3806293effc9b666b3b4989d60bb7cd0c6cb70cac492fd1641ddb5d2e87
- MD5 SHA1 SHA512
- Path C:\Program Files\Malwarebytes\Anti-Malware\ctlrvers.dat
- Size 8B
- SHA256 b9925b2d26efce2eb059f257b55d25596e7737f3b3847b92583be421a89d1b58
- MD5 ccd0a9ed06ff14dc6dcb779d9c4010f0
- SHA1 f362bc6df329aa899dc673a7d0fb247c67f7581c
- SHA512 2e700443ac51f2c86b706d0b0228052876cebe921d39ed4d01e894d7fd497471584621d5052adcd8b2c7ec7c251d18c8e1f8dad8b8fb61efc2550e3df43d8bff
- MD5 SHA1 SHA512
- Path C:\Program Files\Malwarebytes\Anti-Malware\mb4uns.exe
- Size 3.8MB
- SHA256 f1b04d72a0bbb6dd0e023a62e54acb969844b8ca5a248dfdb1b8ceb28a790e3a
- MD5 0df7afc3b0058c11d6df2d4058a76f2a
- SHA1 5fa955470136034cce73d5ec8a08f1a4148523d6
- SHA512 3e2f3ef2e9daa96363233e687254c4f42edabf0da7597cec530f65618acbac354131accfc45a5c5bae051f9c01f5ab6bf101aaf3ffa0e72140832f3e56117d49
- SSDEEP 49152:GaRGf+GDHxu61vKjxa1CPsFRuk3wwlgZKUxT2WHHF6c9OtutTe:GaAXHxu61SjE17FRflgDx2Wk
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe
- Size 22.9MB
- SHA256 13c1f1e82209fb53fe6f6634e4c1be5cc1934264ce98319a57f8d65ea9b9496c
- MD5 51e5cd7f99fa167536ccd23987db9c50
- SHA1 ddda1c59f6665051a0283fa09510518b3f023ea5
- SHA512 ac113e1ed89c9c60dc5c03c714ea31b59d50ea165aabb41599f2a7790211e3c38887ad0e14831ee3eb39e7006bc7ec97ca7a1452dcd567414d1696df4c6b23ea
- SSDEEP 393216:7U9dE43hILx0nFK4iiEtoeVC+ytIqd4K/F44e3QFYcKJAzUXLnR:qE4xILx0FTEtzytI9KtBU7R
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
- Size 8.8MB
- SHA256 4b89392fad1f160e020d5542cc4632e7577c074fc663fa7273d4c9ef36380a7f
- MD5 4392e40e8d2a501ee886e3423d1a537f
- SHA1 9e1b1c6e8b685d0f6436e9ce85e1a84331d370e3
- SHA512 b2bce98a037953c8cd70e3ca92bc03a924d003422e48f130296fb71df32a0c914ab010d3e4509616fb2bca62923331b7b11f80518b143e9e674c48e4424e29df
- SSDEEP 49152:/G75YzOhrMUMfdF0duWevUVM5y+FdC30Evcqubx0M9o+pth52iWGVYbEJN2Ug4VT:I6zOX+SFLZ5ToDs/iy80/pfEY4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Malwarebytes\Anti-Malware\offreg.dll
- Size 114KB
- SHA256 16c450a310edbea07f578f31368f168ec338011cd117406898593e86ebb83dae
- MD5 f782f049b0e8c13b21f8e10e705bd7e5
- SHA1 5c11f955e3983c50ea46b5d432c97c9148ac8e9f
- SHA512 eed29c42b14ff26a030f53d61d6dc8e3971e478dc7646b26189f14f16699b6bedc170c4bcc37efe2e8f3048bde37480033b49eaf1a4712b88464f5da0efc18f2
- SSDEEP 1536:qiFHo5qNN6RBMs4CRqU82r3kvy3ZuottZTBgmFcUNdfI9NMiIy7Q9bEfIBZ/2e:xff2BJ4CYNDo5Bg62Ivl
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.cat
- Size 10KB
- SHA256 a9dd01f84a075ea8d0b0968fd7a11720e49f019834f7d4fe80f50dacb12030aa
- MD5 f7c8e0339bd48b6fe8eca81ac3ba5ba5
- SHA1 1369bd4dcfa7709d8eed12fa76fdbebd39dd6bcc
- SHA512 c722510c40fbed32bcda3b5b69c590a9043e4e51f8e804f77f73eb8ea0cac0f4a587ef540f2773981839f04e44f48bbc8b5e8c03ded3f0cf637ed1e3172c8e07
- SSDEEP 192:T3p/yriJCSEXFBkyKuqwFWQFoWylybTseUfX01k9z3AnhDoM:zDsFRCFy/6fR9zU0M
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.inf
- Size 2KB
- SHA256 ff93773f55bf4a6a0242adf82276a8c95c0b244b9bc05e515c4e810c81a960e8
- MD5 d87c2f68057611e687bdb8cc6ebea5b8
- SHA1 27b1311d3b199e4c22772fa1b7ea556805775d37
- SHA512 4aa65b8911d8a2a0f9ef0ee6e934b94db0a9ad4c2ec543b5edcf21486be43f6ab1fda6617ea2cbb85eff230628c9fa8e7649da915d6de695803b28e55bef5819
- MD5 SHA1 SHA512
- Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.sys
- Size 233KB
- SHA256 3db4366ccb9d94062388000926c060e2524c7d3ee4b6b7c7cf06f909f747fc6c
- MD5 4b2cc2d3ebf42659ea5e6e63584e1b76
- SHA1 0042da8151f2e10a31ecceb60795eb428316e820
- SHA512 804d64d346b3dbb1ce3095a5d0fa7acc5da0bf832c458e557dac486559fe53144f15f08c444fea84a01471fd5981e68801a809b143c56b5b63e3e16de9db0d98
- SSDEEP 3072:H4czIC7UsK3MJNbwCfxrdy19MbMA2gtylc0jGYjNHLcUMfTCGTkpk/BzS6XYrh41:HXhf/RL4MylcGGYjVcjTCGVBfXi8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\farflt11.cat
- Size 10KB
- SHA256 0fedc4eaf11613bd44b76276542e3cabb36ce312fb37cf04b402741406b7c2cf
- MD5 cab9aa45b50d2419e3a772946d790d04
- SHA1 047a95827e31c5fd366e8e43f517b1b903ed8e8a
- SHA512 49a047a631d026dce5a302318f10c48de26e4788eb28fdedc3347d61f4696cd1fa2047bc2f64aee71fc5a6edc0a1ff026c66513784c68f1406d03b8a69447599
- SSDEEP 192:t2A73ylJCCEkFBkyKuqwFWQF3eKIjwX01k9z3A6JUFgBj3:txaBFRJ3HR9zlJcgl3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\farflt11.inf
- Size 2KB
- SHA256 6ef70c4c969b91775368b3c5a6d0dce4c5a5d59463e32b872474f0c50b59774a
- MD5 1b378aed3afa33a9d68845f94546a2f6
- SHA1 95b809a20490f689a2062637da54a8c65f791363
- SHA512 fe0706f48ae52a14936e372dc1406720baf21e018b12ad79727da892c498fc62af59efd08024ba257a94442270c1fe59859a81a2eb7be54be6c7a3cb76051808
- MD5 SHA1 SHA512
- Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\farflt11.sys
- Size 229KB
- SHA256 0b544b88164e64e3cdff31737a1e72baf855be114c2586ce16ffebf787d42593
- MD5 05c4546c48547386962794da5cbb5f09
- SHA1 b61ed60ea92c221ed5a966e9a23b7ab8bfd461af
- SHA512 b2446f22fd79db6ef3085e96305c3230ffa9dc8459caf2d4ecef33f8f94bb22bfd805b8a5f62e0eeab61e4b80f808f0790c0ce6e9222c0d2abaaa7ee32d9b145
- SSDEEP 6144:em6WpbLozHiMOSJoGos25RcQlUfEyNL58Mb2:ehS4zHiMOSJoGos25WYUfD5db2
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.cat
- Size 10KB
- SHA256 d2ff36638e2efbebf663186bbc59bb128ddfc1023bed2c20d4803495b410c6a8
- MD5 7ec33c052afd81a7eb453f3a4a581c15
- SHA1 b1589c853cc11e3842e89bab21b3b6c746ecae29
- SHA512 7b68f05947ee9b899b82283fc3bed115e2ac2ea1fd2ccc39c87dab2687321d247d25c4a2cf396063d7871957727ec85b40c45d373ac5a9edb181530fa4761526
- SSDEEP 192:M8+C2m/yGHJCSEXFBkyKuqwFWQF+pvvqowcLK+X01k9z3A2vVJLb:aQHsFR4de6R9z1bLb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.inf
- Size 3KB
- SHA256 47b7c516bb57c612de19f0ca865590af95b6e32bf873a0fef9e011b2c5b483d4
- MD5 5a9717e1385703e8f06b27aa10a69e87
- SHA1 84ee67a9167b5eb6560711b9871de98898ad07a5
- SHA512 dd3c7278c2c11ad15a55fae6d19b96dadd92f85b7f0c8ce934298258af00bb5c052a84a98499b8867b0f43704fb307c67d03692ca69dda4d814c6c17dd73df44
- MD5 SHA1 SHA512
- Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.sys
- Size 215KB
- SHA256 6116b30ab6f4bf5f0e8eca78bc67890e7aacc6c74fbb4a15a93af44bb34f2636
- MD5 2a0bea88ce233b8d841d56df26195e06
- SHA1 889af4a1f2b77423d5557c8ba7980e5d25e74647
- SHA512 c3d2620e3e1c19b63bacd578cbe55d52242dd01fc3ba5a90d0d001f8cab105a123959f0b18a8e6e71b4dc97d7995e832c8cd2d3693d808c8a81c98499cc63fd2
- SSDEEP 3072:9PeONor7R174vxlO0Hlm2aHSIBY49j9E85Vs6d4yrtxKr9M97CREsMn8lb0v2tHX:KIpNgSIBLZvmw7hCREjy0v2tz2qRR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Malwarebytes\Anti-Malware\srvversion.dat
- Size 10B
- SHA256 09a171434670bb0533a32a60122a00b94fe9b88012f65650aa495109a12a5055
- MD5 6c6c731bfb64e2ae7433b89cebf91c33
- SHA1 b06b73df3f226ed2e69808473116748e59241bac
- SHA512 aef850c4938e8551ffb15b873f1145845d13db9ef2694d53aa779212cd3562bab5733fcf9ddb199b50f0dab15fc3d34b55bfbf04f3b3d64308ff36fbb1b13ac3
- MD5 SHA1 SHA512
- Path C:\Program Files\Malwarebytes\Anti-Malware\uipkgver.dat
- Size 6B
- SHA256 cdbb9bc874d71e154c71b68b1fe959913d286036dac11e226e5620c919ba9708
- MD5 74c6677020fc6b6c867aab117078bf5f
- SHA1 8c46db37dc0b39eb963d4144539c8b591e122400
- SHA512 3f9db8d9bb25322f8d8e750750bf92dbe6ac63d686eced65cddfcd61178cf0e947118a491058414d4d2cbb4892e39815565669aee0dfdda23aece72d278292d0
- MD5 SHA1 SHA512
- Path C:\Program Files\Malwarebytes\Anti-Malware\version.dat
- Size 47B
- SHA256 d86e1c6ef5128f3a01449cfafaefba20756eb7c9459c7d3ffeb6cb28e08723ce
- MD5 7e0b892cb8ecadbaffa410d9cb510f5f
- SHA1 3c1142981533e38bd776f8dbc08014d7f9fc0e29
- SHA512 2b61050d1b23969c8f73d75b3692079f739f1c13ff47632dc1806998d1e8bd13993a86d4bbabbb53411e4bec621d01713dc667a94c021878c641a9b03c231be2
- MD5 SHA1 SHA512
- Path C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json
- Size 1KB
- SHA256 a6fda3b861282eb1a7b562df52701df171248b6cbbd55a724c154c22244b5af6
- MD5 5b333e4f4ac4c5fc44558c49f38a0d1a
- SHA1 392a1a46e37ed88458d0da5cadba46d7f495ed1d
- SHA512 0fc04204c0f4ea93f356e8a8badb706039667bd995fb265f33231b5ec1c0dde2bcc36aaafa8052bd4513a69594949a05d0f242390307ffd3f973243057e2390d
- MD5 SHA1 SHA512
- Path C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json
- Size 47KB
- SHA256 cf93851c4fa023288c81293843888c4691f9f21b76a4c408d68d1ab5ac0696cd
- MD5 ae0b34acf76a7e98092b30f99f48f012
- SHA1 358249ae4d12cc0dfa53a6100b7bb2f0403b3201
- SHA512 10368feab52e221816725e799f0a4c0543fa7759e5a72953235bde4752daaa74bd1ea6dabc056c30c4b1f76c493fcfff2a7fbf45f3866b443ea105e9ce3f4261
- SSDEEP 384:LriPalGB5AWiWq2mhzJUVVqxKS3xV2CjNrBa7gHOykEav:yUAHiWqn1UVVqx9U7gYEav
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json
- Size 66KB
- SHA256 176ac62457f5292ce0eb5bb3e311de624204c2c3c2fe598c1375732901fe82ed
- MD5 1fde24b4fa5d5d76bd4173729e7a39d6
- SHA1 36cb7e011c515b4b54ad2056f87e5a708e9dd078
- SHA512 685c8f1411793a9b29163bf6b06327035c21fead96074672ee7729afb859ddfae0bef05a34140a14613b03ebe7013c481493a5b68d8afe25827a68c7a887805d
- SSDEEP 384:8riPalGB5AWiWq2mhzJUVVqxKS3xV2CjNrBa7gHOykEajctcxPaF:5UAHiWqn1UVVqx9U7gYEaIKoF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json
- Size 66KB
- SHA256 997d0d2e40c06ff0c0261ac265fdb8ffb84bbdf512d092913bc0b6d5eb9ab1fc
- MD5 61c9287cb2d8cfa449e67f91b4a60d55
- SHA1 6a873d0a2945532a418c14b115165b4c7bb39604
- SHA512 ef4a58ae237c99396fb018305d8fdaca41ffc7042fa0815d489985354122f0e0d8a963ae88e7e0d6dec80441d8beed40b36a3f26ca69a746a81309a2184dd141
- SSDEEP 384:Aqcr1PalGB5AWiWq2mhzJUVVqxKS3xV2CjNrBa7gHOykEajctcxPaF:CUAHiWqn1UVVqx9U7gYEaIKoF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json
- Size 89KB
- SHA256 666904d5b35ef0b7d7a640d71d9075435510b3b4abfb37367799a0b911153783
- MD5 d4811ee5454eb0912ba83ec909946d23
- SHA1 176faf6dae752cdcf18520a86614b4b3d08eeb33
- SHA512 b38c3227216674f9bf33c04b2534e4916fb4cb340f882328317cad5d1523048de1121876288296b4d5ea71988c7c36e0b04a951f8f8628384d52c9affc8bee0f
- SSDEEP 384:hr1PalGB5AWiWq2mhzJUVVqxKS3xV2CjNrBa7gHOykEajctcxPa9H9utf4Rfo:DUAHiWqn1UVVqx9U7gYEaIKoz2f4Rfo
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\Malwarebytes\MBAMService\config\ArwControllerConfig.json
- Size 607B
- SHA256 514e867933b1f6f665150c748f42aa92aba476847d3f585a0a0a6dd30f129afc
- MD5 1f8ff5cf2a77475972d65115fd77b422
- SHA1 435e9894e46ae1df5f163b8545dd6287edcc82bf
- SHA512 a3880bdf89afe4a45becb6f26726f00afaa4c2bcebdb9fc819342c406c478fffa7397ee28b0ef3c7274d1e9e0d9dac3fd5925afd6e9af3de4efdcb4121f58310
- MD5 SHA1 SHA512
- Path C:\ProgramData\Malwarebytes\MBAMService\config\ArwControllerConfig.json
- Size 608B
- SHA256 468d12de634e385f650e1a6452971bfe70dfc7e92f17c4ad4b3acaa67220a033
- MD5 7fd4e343d6db6ce2282b1d6ec499514e
- SHA1 94774de1e9fa783efeb272e8357a53d8ed8b3a7c
- SHA512 c9f07a1727a8487fb1bb8149923e2fcad3f8b14fd7aaedebb04e59e23fb7120799aabeaa87d4ee85d975597c14a8dca4d34153b5228f07c19716b1461703a434
- MD5 SHA1 SHA512
- Path C:\ProgramData\Malwarebytes\MBAMService\config\CleanControllerConfig.json
- Size 847B
- SHA256 2faa339fe5cb1e98ae8364848acc6007bdb18d7b5050b4542b3b899ebdd3e0d8
- MD5 76eccb8acf705f8f7ad8177b430abb9c
- SHA1 1577c577332c5e8ec5fcb6cafcb74d1eda47c098
- SHA512 d50bfdf6ff38752003d389f16d88acef07aaa8fdb6e8a8dd6254739c945b55d8a689e940600ef0760aa354fd33f71ab46aa01b5d618a14b282e3cb3d6a624435
- MD5 SHA1 SHA512
- Path C:\ProgramData\Malwarebytes\MBAMService\config\CleanControllerConfig.json
- Size 846B
- SHA256 92da26da8727335ae9e19442ba838386c9f0be6d0de2d55c47946c5762fa876c
- MD5 53a6b45ab4e3f26f7559dc296d6cf193
- SHA1 6c44abfdf883b98567ccc1e0af6002a64b7fc3d4
- SHA512 6b569cc457edcb3785bd775dba63b696c1b144dd59f8398184f1ecc416efb7fd384fef640b867f6c8fa1074e136facc5911c685c991241b9b3f372bc08778239
- MD5 SHA1 SHA512
- Path C:\ProgramData\Malwarebytes\MBAMService\config\CloudConfig.json
- Size 827B
- SHA256 2d76e217f214ef802307db42c5856b8a9d5e55e8f3f16b28b5b4160ce856b4dd
- MD5 6a3765fc946ab0ce550f973d104cba2e
- SHA1 a60f9e70c66cd4047608fa0aeffaf247d9fa7da7
- SHA512 2e9b19fd8de89486568af201c914edace431afecac7934387cd3ada1c7ae5a10075d7d18dcab64cd158ec4cb725bf17689d26848f1cd0b7134539eeae1972282
- MD5 SHA1 SHA512
- Path C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json
- Size 15KB
- SHA256 d3755b684b90d7c572fc99e202cc315dde25ca9e8ac5d038e760cb6ab14da601
- MD5 92af0cbd5e453816c6c16b76ef58bb81
- SHA1 faaa4a8a54f1e1a8501e6c1ebece1b84408d2c7e
- SHA512 3d3322b18b881a6fdc5e2ccc62e3c445e5b9820aa8ef172cc7b94e1a1a7a8977a1336cc4a7b232f07e2d94771d8f9eede7bb3a53bdb10b05a16e665564197262
- SSDEEP 384:cmXrYFSnUBX0nXrg5HNwv65Mb26ahMbmNJWAJUKfVgH8BZ8ZhG:cmXrYFSnUBX0nXrg5HNwv65Mb26ahMb2
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json
- Size 16KB
- SHA256 6269d96945472f9baf117637748ca052ac4069b9d93aee6d322a464667b02a2f
- MD5 497fc45209307ea410da91a799f5e6aa
- SHA1 ac59f6591c85922616f2f2807e592d3e803ca398
- SHA512 4cc9241d0fb845728c6f33074d59bea835f91650b0b4eb50e086456fadbf145cfba95a7f85f9d71804bcc0bc48eaef042826abc35f656e132925b7fb6f5246cd
- SSDEEP 384:em2rYFSnUBX0nXrg5HNwv65Mb26ahMbmNJWAJUKfVgH8BZ8Z0z:em2rYFSnUBX0nXrg5HNwv65Mb26ahMbQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json
- Size 16KB
- SHA256 be530892005f827a6ed25c0c843ec603dcf9c6cde3df348eb8723ebd2310da24
- MD5 66074ab3994b6d8d87561e885c332247
- SHA1 3cca8ef9c8dd405b0ba03b6fb47181e5dda6c52f
- SHA512 8bcf8ea4d3709ea1aad19efb06dd16c8d5ddf8841f09f7a9f7d7b201b3dd3ac88883fe9e6533f42c0d846bb1c473d41a4b167f30746b631880abad62754f676f
- SSDEEP 384:em5rYFSnUBX0nXrg5HNwv65Mb26ahMbmNJWAJUKfVgH8BZ8Zei:em5rYFSnUBX0nXrg5HNwv65Mb26ahMbL
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json
- Size 16KB
- SHA256 3fbd759df9a7376f85dc2a9d95f243d789369b0d90585af5e07f43c3c16dfffd
- MD5 4e05c08c15e6bf9326c11e79b893e5b6
- SHA1 50920e5dd0ba096fbe56910067672585a3de893b
- SHA512 f2ed1890864893580ac2b8bad2bf69c8aa06043794d0402cb17b7bc074f3cd91da141c19ec24da480dc5d974f69ccf19dc9b8a73f6e4fc7de1639a611a0117f7
- SSDEEP 384:vmurYFSnUBX0nXrg5HNwv65Mb26ahMbmNJWAJUKfVgH8BZ8Zej:vmurYFSnUBX0nXrg5HNwv65Mb26ahMbG
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json
- Size 16KB
- SHA256 5b006ee7c85e91c200f6f5a13f69a4af1d9e6c034658a9ea9e92b2bb48605c81
- MD5 b093da080c9ffa115633e8bacf28d5ef
- SHA1 f9e06619a9d9a4f08233d47f0810cdea10ec9957
- SHA512 b0d821d535c5fca3960291bdbeb2d08bf94b9fda39e23a0dc9751d93c7a3d6046d14cbe29aca5dfbabd52e66e768f2f592fecd99950b3412d4e31dc464781d6e
- SSDEEP 384:6murYFSnUBX0nXrg5HNwv65Mb26ahMbmNJWAJUKfViH8BZ8Zej:6murYFSnUBX0nXrg5HNwv65Mb26ahMbM
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\Malwarebytes\MBAMService\config\MbamClientConfig.json
- Size 1KB
- SHA256 bca42b830e35f6f8c3e3a2e53ca089389d84f2b244d120dc80d78e3cb9fb2c3f
- MD5 3e897d491555158428db05d5de2b33cc
- SHA1 9ce3ea4d946bcf17db5a2e97def184d9360e9303
- SHA512 a4830017dc5eb6350e3ec9133c66a4803aa3603a6c4db7f04bf28564d93a422724f12400f4e5c653cbde4f72419baf6f4930b9c18b67f0d5de88c97cb8d3a932
- MD5 SHA1 SHA512
- Path C:\ProgramData\Malwarebytes\MBAMService\config\MbamClientConfig.json
- Size 10KB
- SHA256 28a169ed9a5507a3b43cc38d243f2aad2795b57cb0a1b347b25bbc4383fa436a
- MD5 761c4f5c88c89d4558ec03fd1c0d0495
- SHA1 1c976e1a57a5d60495680fdd26eddd65105dec60
- SHA512 a904d6fa80130e1241a68d1614403c2b4e7737e371c473db93a54b64afe4a8f4cc2c381d5870ce732f49291cfca83d7a155a057d798740ec282e42086ea3ce9e
- SSDEEP 192:7fEL8D0b2l4ozwxEWHA4yle1yxIxvxhxUxGx1xVZzc7/B4xxoNd2:Lu3z065jmYn/+Nd2
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\Malwarebytes\MBAMService\config\MbamClientConfig.json
- Size 10KB
- SHA256 c80601fab453fbd7580f53783fc5c42a2df2e52621ff4446aa5c89254ce46167
- MD5 a5b0eb7ef0f614715dac612d36dcd65f
- SHA1 9ae51fd66375e5c2660a7598410dc70927992529
- SHA512 0adbe88a4deed78e1aa5796053c5c80acb78639dfdad7680d5ac1e430c3eee386d4e6f1705f2fb1a045303f3e6f616addb00e37aaa4da3261b061e02cd7d77b2
- SSDEEP 192:JjfzUTcL0JyfPMHa5wHQtiBNtWN/KIvDGs07/BHeoNd2:1JKrNd2
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\Malwarebytes\MBAMService\config\MwacControllerConfig.json
- Size 1KB
- SHA256 6bf0f692477dda18264e12b8bed2f849b8a5dffcb32dde1d9a61ca038c9d44e6
- MD5 b25ac895650fa3480a42ede4ef76e36f
- SHA1 38e9fb9867230530c9bd82344d757f3cfa91470c
- SHA512 575a6f5a031597b82e961f77570d03767b32379aa445adf288022077318091af52b9c48e089d093d2cad96791635fde98305e8533c324514ae955cf493cd917c
- MD5 SHA1 SHA512
- Path C:\ProgramData\Malwarebytes\MBAMService\config\MwacControllerConfig.json
- Size 2KB
- SHA256 074ab5d88cb0a90b836ac6eb888a12631d407ec60f22fc3028fcb92e8a3d330c
- MD5 18bd47e321667cf978f77502d188fb34
- SHA1 40a85ca72a3bcfe3f33c4fd59093490505b3ea6f
- SHA512 1f12ee0c64be23edcdfd80ecbb69df6d5191300826cfad01db899fc8bf0dba6e9dde9fd2e31f3336fd91149f4a333a8995cfa0bd82628377fbf5d2caa65de79c
- MD5 SHA1 SHA512
- Path C:\ProgramData\Malwarebytes\MBAMService\config\PoliciesConfig.json
- Size 814B
- SHA256 91a76292ee7de8980bbf2e60674b7b6752afb52179aa9d34f5577cc5232f91d9
- MD5 d76a3329daf681741e644db00666f2b4
- SHA1 374ccb1815679f9e71ffe094505bf0812bfdaa47
- SHA512 32f8b3fce121ca68d3f201e7124ea559ad9c4d3b3a63c2dd897d7f1a75fd97c9ca0e6439e7172a2bec08c3094585299e9f003371278f70803b5aac61480dfe89
- MD5 SHA1 SHA512
- Path C:\ProgramData\Malwarebytes\MBAMService\config\RtpConfig.json
- Size 1KB
- SHA256 9d29138352f77d8a4dc409f5d88277e3f069923b8153089f8e3ee46473f3549c
- MD5 75f50ac6eb467cea514674ec04ffcca4
- SHA1 a4602ab7ebb2991c099d85bae7438dde9f22b28e
- SHA512 79a25cd162e97bf99ed209469056caae3b4ece7999e5f9f0569de14e4d211015371ec4569084920551386da3d4ee806b646cfe90054dc1bbe123b83b814b3115
- MD5 SHA1 SHA512
- Path C:\ProgramData\Malwarebytes\MBAMService\config\RtpConfig.json
- Size 1KB
- SHA256 bfb49b61929a9c780956b8c81a03c5bcd492d7fc246b3238afd3ecb01095828b
- MD5 158c9d912ef30ea63d6f0df76a9f79bc
- SHA1 7c46ee256c89591c583ae853a6a3d2c05d980c1a
- SHA512 5a1029d81fa772907145f09535ebb058e118670cb69d138b4dc5c54f8e734573264fc75c8b4606f7e2caa4bf7d63f13aa263e248039c1390169191d8e8ef0039
- MD5 SHA1 SHA512
- Path C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json
- Size 2KB
- SHA256 c8ae2468499c8cb08ae15725d9b0697cc2dbc2842be09ed875f25b2855c07dd4
- MD5 acd2d8625f71437a25e17d78188c03c4
- SHA1 da3cc04a95caa36cd66e89aeac8c214be1e4f61f
- SHA512 a47ae72bde08e6506570594e5c737d61d812cd3f442cecab7791cd1384dae6195bf8f96a4d2f28387fdcfd4c3f28f16f6dc442b99c48045c47e87b9c1ac883ca
- MD5 SHA1 SHA512
- Path C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json
- Size 4KB
- SHA256 a6b9e283531486b612da4d3be240e5fb4596c3708fb8ec81898e0a1184b3f213
- MD5 0b3463365e619fef7bc377dcd0d13eb6
- SHA1 066003c12a0ac326af3fc968849612dfbdebc425
- SHA512 f18df97a7592ef28b97e591166c86a0e245c71e56b518fb124b6896e1d388d427d660e0d080a2fb2e656bae0e8639af293dcd0861dda487f13772b3cac21fe54
- SSDEEP 48:VRtPVSfKuGQf9uEswkV8E1mduwNmqXKeWQX9OMEmAf3wsaA:BAfK5k9Bhkf1YzXKBs9pjAf3wsaA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json
- Size 7KB
- SHA256 84e12b9b68beb7c75164e0f5942a7753c18048761902854e6d71aeab49ec3cdf
- MD5 3d2ddd4936a3932a6d68d06def45ca1f
- SHA1 59dc6c3cebb16a598e621bef379c88903637b4e0
- SHA512 6cf9da999e44c44964bbf425b3b6ceee3e5c8654949cf8f1f98f8cbc05ec80460ef6262a535152ced9c8ca4f664537da52111f066f87ae5768d9ca1ecb2106f4
- SSDEEP 96:PAfK5k9Bhkf1YzXKBs9pjaw+QEZXKBs9pkAf3wsaA:PAi5uNzaBvRZaBagsR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json
- Size 4KB
- SHA256 acc4e02135ab8b731f30e6839d92cbfcfda80b1d33ea27d509b03358e0d6383a
- MD5 23fe6894c065268712d51eca9836ba3f
- SHA1 6de2eb58819b05e00fb162edad610effe8a9e781
- SHA512 72e70031bcf268732c1f654ea4891ba3fc4c713e80f2aca877cac133a97a9fd9f832d017cc3f34d6e864dea5c898f4392d63a87c45dec132165bd5650ddad724
- SSDEEP 48:jktPVSfKuGQf9uEswkV8E1mduwNmqXKeWQX9OMEmAf3wsaA:cAfK5k9Bhkf1YzXKBs9pjAf3wsaA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\Malwarebytes\MBAMService\config\SpConfigFile.json
- Size 11KB
- SHA256 539f280a5af2d314d2ed8300a8bfafedd6cb2664aa4e60abc3886aad9944bb79
- MD5 82b61bea6d3295b67dea2872d043cbb4
- SHA1 6d515ede2b36866d33b5277db8f39c086b897f4b
- SHA512 4c90b40cad8958b173adf63ab3b5b6e6871d2e4cd7af8cfd6a8e83c93e5b66efbd66cd7aa600cb1a89953446290e327a103544f527afca574737fcfb4e9aa3d8
- SSDEEP 192:W8+xwb8fkY/sDpS8t7SSdUCExUYS9oFfJ7MLPi5LnDjufzqoA+8xRj81offZJZQE:W8+xwb8fkY/sDY8t7SSdUCExUYS9oFft
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\Malwarebytes\MBAMService\config\SpConfigFile.json
- Size 11KB
- SHA256 97ca0a2dd398f5f3fce2d43c30326886101ae8f78ce630dbdf1ad5e064211f71
- MD5 13d4d521b131cdad101a9e7953aba2f8
- SHA1 6cca7dd682f61f6cc456fc079370d554a37d7875
- SHA512 735bf8f588a2819f3ab20276fd57155331a35f8ca34e7842520daa2c1d5d1a732a84b0d6f210730f2d676f3d922ff935d2d52af27d0e63c3b0ff37e503ebd34d
- SSDEEP 192:t8+xwb8fkY/sDpS8t7SSdUCExUYS9oFfJ7MLPi5LnDjufzqoA+8xRj81offZJZQE:t8+xwb8fkY/sDY8t7SSdUCExUYS9oFft
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json
- Size 1KB
- SHA256 b773ec5cca580611151d2d4481514ae557d475fcf164b56e18a14480cfc0c64a
- MD5 07f221516c5f9de3cbc3ec855a179dcf
- SHA1 c70d369dcb877ae9c6ebf4d13ca32687d95c7272
- SHA512 33dc2fc8c574e0380c2a84fddfa3eabef6fcb00ce0b237a66576d310d7e0281bac25e4e3e1165787e8c296fba1995e039d9fb4d0c66398e8fbe2712c74af2159
- MD5 SHA1 SHA512
- Path C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json
- Size 1KB
- SHA256 58a6e3a245f747b3501baa3e111083d4a17e1da9794421efcd9282dfc36f30bd
- MD5 1329bbcb511f27c17e90748474e256c7
- SHA1 d6090eac7006c90da0bae971569c3e33158a9562
- SHA512 86c2a143abce359c5078c87af3f7bed676c162d022f079188b42829328ec9d9e48b9e28da7561915c47c448c3165fb576ada5a44c9adffdd1427dfe2fa98cd2e
- MD5 SHA1 SHA512
- Path C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json
- Size 1KB
- SHA256 b68476fc85e126e21ad9d0187ae3acd33137e9a632765f8f0efcf64c19297a7c
- MD5 0ab3d8f6393f1b168bf787140ca43619
- SHA1 cb6b6980c3e8e819d91bc11a572a9d9d594373dd
- SHA512 488e56108c58a74d76791c0c123cc39a6c39109eb3234588d418db13ceb2ce4831b3baeb8d2aa8e74fcef37177d5b5f7237beb8c929ef07584130529e572741b
- MD5 SHA1 SHA512
- Path C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json
- Size 1KB
- SHA256 8f31681477a2f8b6cd520eb1751ccd78e379d33756aa4be76f550af1ce22f981
- MD5 05a1b181720582632a4319f3c5442193
- SHA1 74362710546141b0928e8390d98acb49736a445d
- SHA512 f20ffbdd8d7af1df0b9310c78c61af0cd0ef8599db36face557d843575defada5708261044ed798bc417fb85d2439c3ead1f7451ffbca2d9f1a52dc57d3c5990
- MD5 SHA1 SHA512
- Path C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json
- Size 1KB
- SHA256 0d1606c7a2aac1cabaec926f2d42e3729d7c4ca396c8cfb493ec690194f2769f
- MD5 5350acaa27e1739dc38103bd9f50194e
- SHA1 5f8e6740b676a06e061ff4f7040819946953225d
- SHA512 dffe3a5704f84a2dd8d228be4e2ea402a8aa9c67327ed018529c6c77c66dd61fd67a7794bf0aac13ca559adb0527b7c3cab595dfb637dab2289394db8b563b85
- MD5 SHA1 SHA512
- Path C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json.bak
- Size 1KB
- SHA256 b5259b49c9b3949cc00e411931b250fe414d39e78e4bddaffd5cf322e3b47071
- MD5 9ec03ba7e5d3f7abee992e0081d2c3bf
- SHA1 bbd1724cb2b94cc6b190e669b6d073484f531555
- SHA512 dcad2d87e7c6631df8d5a8b3cb23b29adc48012034ada43fb3ec75c43e111eb846e47df5425aaf764b5abc275f4825b1cddceca3057acf985b28cf2edc7c887d
- MD5 SHA1 SHA512
- Path C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json
- Size 1KB
- SHA256 d7c5d175a6c51f16670e76a5e2cfa96c81ddb14619d4dbf19253f4cb8317ebe7
- MD5 41c2896a92354915d6b9cf9b67adf534
- SHA1 b40b71cfe074a0e802b61c38fe2b02d0092976c4
- SHA512 a6ad5aab4622ac9688697ecccc13a028210895d026ed750308c372de70b90e31b98f7355556443256c427c982ba89daa82a87a11534b1ffb9928cf489a77f54b
- MD5 SHA1 SHA512
- Path C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json
- Size 1KB
- SHA256 814db07ee8ca1cdd7b5abbecbc50ac71eb68c39746de489feda28719d45bad5f
- MD5 db4aea63f98acc49aefe63885e9d1048
- SHA1 dffeb94b5c2b1063508d52050c431b1643fca01e
- SHA512 98eb7a4656fc9ac66ce4d5f6d04269b90754042b925b73621b4c7e0462564d14660e66124e86030537acf9e5420b9ca0ff0d78c12d251e5c03f212012ae91213
- MD5 SHA1 SHA512
- Path C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json
- Size 1KB
- SHA256 16c3a140dfaa8b1fb209dc7d141184c8f3d2a636826f8de57d89305e4f1c9c18
- MD5 3c5f21e39c7152a78d3d07db2ac02954
- SHA1 65220d8a5ab141daca9beff9ba98c2842ffc06c9
- SHA512 bb5b0d8b7abd792b11c15a5146d2a0e0bf9c2004f5b237e0a803ac7f92c94f4017c89246e007d8d3e68237e7321ec88b3d23ebbd391e46fdd7bc4605e3c297c9
- MD5 SHA1 SHA512
- Path C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json.bak
- Size 1KB
- SHA256 7191512f424584ee5b535aa06529aaa7d5c6825e1a346de9cc8333aab42c3a81
- MD5 eef0be08382ebb5120be477136014fa3
- SHA1 d9667757408b686271bd9a99b69061dd27299267
- SHA512 514a4020126a7e098201f09d4f58d4d40a49d649d4561d315d7489cc80de01e3a782c206ac30bfa9d53879d7fef7955d5acde6d40fe93d3068ef788ca432c677
- MD5 SHA1 SHA512
- Path C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json.bak
- Size 1KB
- SHA256 d7b337a077318fe27f6c1e03224d8770d536b510f449b7dc741324a80287f1a6
- MD5 e511ff874850464b08896058b340cf16
- SHA1 22c39258bc2ee34cfff4f0ff496b8048694553d0
- SHA512 d3bfb160482a48aff3177f86325149c594ad1bccbeaade6c4ad3ae1fdb3a11c38519bda4f050a7a782a1f3bfc5392eac119d100f0c20e15366198964393945a2
- MD5 SHA1 SHA512
- Path C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json.bak
- Size 1KB
- SHA256 dec1022793963e78f2f7a1f5f18a9f26166605e3f847a4222899a4191f97443b
- MD5 52b218495a07ba5ff9001ae0fe07062b
- SHA1 3f619eb4edacd654a4d22db45608618150d1da1c
- SHA512 ede52183a60bebaf27e6737881a395a6ca8b9133b000580bcf34b17548ee1a8eccceca89fa27b08ab52ccde6f07c6d301c579071a877fdddb20e0c8badc0461f
- MD5 SHA1 SHA512
- Path C:\ProgramData\Malwarebytes\MBAMService\lkg_db\Actions.dll
- Size 4.5MB
- SHA256 5582e488d79a39cb9309ae47a5aa5ecc5a1ea0c238b2b2d06c86232d6ce5547b
- MD5 f802ae578c7837e45a8bbdca7e957496
- SHA1 38754970ba2ef287b6fdf79827795b947a9b6b4d
- SHA512 9b097abeafe0d59ed9650f18e877b408eda63c7ec7c28741498f142b10000b2ea5d5f393361886ba98359169195f2aceeee45ff752aa3c334d0b0cc8b6811395
- SSDEEP 49152:f8UnelrSf38dCYiJZ05SFbc//zEizS/gK2e0TGkJBN+3zQc0kINedkdPF+A0JjSs:05T/bEaKzl0kI/z+Ac6sXKa
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\Malwarebytes\MBAMService\lkg_db\ig.exe
- Size 1.8MB
- SHA256 cd1e8db650a73bfbc124467737b96fe2080f27f27e031e1043ddc76a9844fb06
- MD5 5f4f4838ed0a41b4ae61b16cbdb7c41c
- SHA1 c9e300e9f5245d736d6fcc42dfb990b2639aac52
- SHA512 9bb1ac32b62fb1398616081574b03c0eac37377b4102641299202601f4881fe64c98111334f783d013b509f7eb36ec9b79a7b71bf07436632c280c1ae3142755
- SSDEEP 24576:7ipw8j0kcU71dHGvPKN8kP95bLS0pBm2L6y1szQGftwuTVHzw8mvI:7U0kcOnk88kPt7+zQUZw8mvI
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\Malwarebytes\MBAMService\lkg_db\sample.dll
- Size 528KB
- SHA256 bfd1e593eec056049ac2e52daddb635ae9e4047e6d81aa61df0496f6f634cb73
- MD5 a9341141dc8a9f27fa46758ed69980e6
- SHA1 220ecb05f5456b3d2b0b05f5cb6fda6197207563
- SHA512 528cab8c240154fde3c0a728fd4d0250648a105ca95355e5c674d37ee620ab74fa499c85cb7781ae676b93117560c3c1f4d4b9f6f341af958de3073c447f442b
- SSDEEP 12288:cYIAmy9w5vPkTEetmCqryujcqhL0HU5WhjW5A:cY/VJrqhLcB
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\Malwarebytes\MBAMService\pkgvers.dat
- Size 75B
- SHA256 61a2683fb8b42f1133bc05ef9f76d9a4af1cecf04e96badaa4857057dd5b02b6
- MD5 5d7335f7a29794b85217e9600da6917b
- SHA1 6b4bfae4708a9e2ce7de06d89b79731b4ad36e46
- SHA512 4efaa76ff9c84871d51014e0ef324746b61a94bbed7b3c88888a34a26b31be965089ae448094ef3067bc06a0ff089101d45c12301aa63346f1d7cd62478ce04b
- MD5 SHA1 SHA512
- Path C:\Windows\System32\CatRoot2\dberr.txt
- Size 2KB
- SHA256 9f0782daad737f9eaf6d004d9f569c3a3d363d9469734ec70a13abdf62a04c4f
- MD5 2c788b675a145a8f8a63a52a721dc928
- SHA1 a7b35ae424237cad1588c3eb2e56569677ec6fbd
- SHA512 663ad03e0ba9919f6a86a2d60abc9fdb388165f36ea3d4d2e3003f47abb16f4f264238cd1a6cd5e44e87cd1968ea84496527e40242f5219288061de1659a39cb
- MD5 SHA1 SHA512
- Path C:\Windows\Temp\MBInstallTempe394fbbf280b11ef96eeca658e39cca4\7z.dll
- Size 2.5MB
- SHA256 b2ff9dbf90cbd0c45cd7d95ce4892377ec7e92970e05f2e56b0ce93861190348
- MD5 a144e24209683e3cba6e29dab5764162
- SHA1 ab2112cce717bec8f5667721a072d790484095ec
- SHA512 2c823981b53b7eb7c1b726468d3b28c234c7e555aab35e759e88d38658566d267a20867f1cb18d96c830e7d53643629a9fa313eecee8b553703086fbb64cc984
- SSDEEP 49152:zdNyZQQ6uR3+YjqAVyEc/tKpa7KlZQcS+JzEDW41mINGn7HKWFhf6hfsJYwAJ0Le:XyFh2LET2W+hH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Temp\MBInstallTempe394fbbf280b11ef96eeca658e39cca4\ctlrpkg\mbae64.sys
- Size 154KB
- SHA256 321058a27d7462e55e39d253ad5d8b19a9acf754666400f82fe0542f33e733c6
- MD5 95515708f41a7e283d6725506f56f6f2
- SHA1 9afc20a19db3d2a75b6915d8d9af602c5218735e
- SHA512 d9230901adeecb13b1f92287abe9317cdac458348885b96ef6500960793a7586c76ae374df053be948a35b44abe934aa853975a6ccd3788f93909903cc718c08
- SSDEEP 3072:Gqj/Hk4JrlFTsH8J3PxHSIIc46/3Zf3xNPugxmIHts0v:Gq4GhFTscJfxHSIIuF3xXJDv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Temp\MBInstallTempe394fbbf280b11ef96eeca658e39cca4\dbclspkg\MBAMCoreV5.dll
- Size 6.3MB
- SHA256 fe5c67c1e19c1137a4d4b3928d8b37db1845ac6d4b3f13d7b4d4bf4b325e331a
- MD5 9bbcbee54b8adda7eb979322ee9c803a
- SHA1 82d1c65ae32210b6ec3df6c2dc5a395ea6b7a9ac
- SHA512 fc0637f2f55698775840720480bc65fd40911913a509f0fe70cd2653aa2bdfb0605e4db24283da56a83ed7d74eb5837d2eab876c3025a94606bdfa6715ce19d9
- SSDEEP 49152:jKaotfEPErtFYR2weOHXZ8omQ/JUMqbU26NHBFih4N8nqbsAYg8udPLhBWvyZ6hH:38fRMFM46nQsCNhBWy6Qa
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Temp\MBInstallTempe394fbbf280b11ef96eeca658e39cca4\servicepkg\MBAMService.exe
- Size 8.5MB
- SHA256 1541c57f87f24610dff7a77af7e932992ef574d16ef3c5e7007255776951ee3a
- MD5 31804b530a429b25e5763de3e7e5238b
- SHA1 4d8eb7342a2bad8318ac51a02b7b55f978178422
- SHA512 efb6d78ad79c6edd8378640d2e6082320936b20462279ace63b127602009b06cc7097c822706cdbdbf9603e33372bfb5c8492c0319030a687589def37ba3c416
- SSDEEP 49152:7uGA1SaSJVYApCLiHohVWUJU5BxgBueJRpydG2mJ5q/Pt6Y5b0JBVbq1EFYJurV0:aVqxo5bqaFYQgoxAmLW99
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Temp\MBInstallTempe394fbbf280b11ef96eeca658e39cca4\servicepkg\mbamelam.cat
- Size 10KB
- SHA256 3ed5a1668713ef80c2b5599b599f1434ad6648999f335cf69757ea3183c70c59
- MD5 60608328775d6acf03eaab38407e5b7c
- SHA1 9f63644893517286753f63ad6d01bc8bfacf79b1
- SHA512 9f65212121b8a5d1a0625c3baa14ef04a33b091d26f543324333e38dcdb903e02ccc4d009e22c2e85d2f61d954e0b994c2896e52f685003a6ef34758f8a650c7
- SSDEEP 192:2jijKjmjlydFvJCjvyyKwnsFWQFJFMFETTbbrmjX01k9z3AzsGpZH:OvornsFRnWFE3X+R9zusGpZH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Temp\MBInstallTempe394fbbf280b11ef96eeca658e39cca4\servicepkg\mbamelam.inf
- Size 2KB
- SHA256 793626d240fd8eefc81b78a57c8dfe12ea247889b6f07918e9fd32a7411aa1c3
- MD5 c481ad4dd1d91860335787aa61177932
- SHA1 81633414c5bf5832a8584fb0740bc09596b9b66d
- SHA512 d292e028936412f07264837d4a321ecfa2f5754d4048c8bcf774a0e076e535b361c411301558609d64c71c1ce9b19e6041efa44d201237a7010c553751e1e830
- MD5 SHA1 SHA512
- Path C:\Windows\Temp\MBInstallTempe394fbbf280b11ef96eeca658e39cca4\servicepkg\mbamelam.sys
- Size 20KB
- SHA256 b5619d758ae6a65c1663f065e53e6b68a00511e7d7accb3e07ed94bfd0b1ede0
- MD5 9e77c51e14fa9a323ee1635dc74ecc07
- SHA1 a78bde0bd73260ce7af9cdc441af9db54d1637c2
- SHA512 a12ccf92bead694f5d3cba7ff7e731a2f862198efc338efc7f33a882fe0eb7499fb3fb533538d0a823e80631a7ca162962fbdfd78e401e3255672910b7140186
- SSDEEP 384:HO/iZbhL/Uqqn2+s/+8gpUad+JR9zuspd:PtUR2h5adk9zuK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Temp\MBInstallTempe394fbbf280b11ef96eeca658e39cca4\servicepkg\mbshlext.dll
- Size 2.7MB
- SHA256 467de01d7cee7ec54166b80658ff22f9feebdb1c24eaf1629cf40e4124508064
- MD5 b7e5071b317550d93258f7e1e13e7b6f
- SHA1 2d08d78a5c29cf724bc523530d1a9014642bbc60
- SHA512 9c35293c95c1a9141740ac99315605964aa37c4a42d3a11cae9e5649ff1427a9480d3d5e7f763212cf13db3511c5ea3c84e68f95f0067fe6339a9d3fb7b27c54
- SSDEEP 49152:C55UfKzapI/i54HB+mKu5Oh5P0/nx+AoGuylyPz7Ch9qLAoBMl3o:0i58zp3+cQChAAoB43o
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Temp\MBInstallTempe394fbbf280b11ef96eeca658e39cca4\uipkg\QtQuick\Controls.2\HorizontalHeaderView.qml
- Size 1KB
- SHA256 1ef333b5fb4d8075973f312ef787237240b9f49f3f9185fb21202883f900e7d7
- MD5 d8c9674c0e9bddbd8aa59a9d343cf462
- SHA1 490aa022ac31ddce86d5b62f913b23fbb0de27c2
- SHA512 0b86ec673133f6400c38b79f9ba4f7b37ce5afdab1a2e34acbf75019e2590cc26b26d323ddc1567c91375053c9c8593be0615389db8eb1a8d1eb084ad4200b82
- MD5 SHA1 SHA512
- Path C:\Windows\Temp\MBInstallTempe394fbbf280b11ef96eeca658e39cca4\uipkg\QtQuick\Controls.2\Imagine\VerticalHeaderView.qml
- Size 1KB
- SHA256 489c02f8716e7a1de61834b3d8bbb61bce91ca4a33a6b62342b4c851d93e51e0
- MD5 829769b2741d92df3c5d837eee64f297
- SHA1 f61c91436ca3420c4e9b94833839fd9c14024b69
- SHA512 4061c271db37523b9dea9a9973226d91337e1809d4e7767e57ac938d35d77a302363ed92ab4be18c35ba589f528194ad71c93a8507449bf74dd035acf7cdb521
- MD5 SHA1 SHA512