Analysis

  • max time kernel
    595s
  • max time network
    597s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    09-08-2024 16:33

General

Malware Config

Extracted

Family

crimsonrat

C2

185.136.161.124

Signatures

  • CrimsonRAT main payload 1 IoCs
  • CrimsonRat

    Crimson RAT is a malware linked to a Pakistani-linked threat actor.

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Contacts a large (33792) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Downloads MZ/PE file
  • Drops file in Drivers directory 6 IoCs
  • Modifies RDP port number used by Windows 1 TTPs
  • Sets service image path in registry 2 TTPs 2 IoCs
  • Checks BIOS information in registry 2 TTPs 6 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

  • Executes dropped EXE 20 IoCs
  • Impair Defenses: Safe Mode Boot 1 TTPs 2 IoCs
  • Loads dropped DLL 64 IoCs
  • Obfuscated with Agile.Net obfuscator 1 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Boot or Logon Autostart Execution: Authentication Package 1 TTPs 2 IoCs

    Suspicious Windows Authentication Registry Modification.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 5 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 22 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 5 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 37 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 56 IoCs
  • Suspicious behavior: LoadsDriver 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 55 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3400
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/enginestein/Virus-Collection
        2⤵
        • Enumerates system info in registry
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:1888
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ff933499758,0x7ff933499768,0x7ff933499778
          3⤵
            PID:4356
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1508 --field-trial-handle=1784,i,8454385723111612801,7621028675372099301,131072 /prefetch:2
            3⤵
              PID:3816
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1780 --field-trial-handle=1784,i,8454385723111612801,7621028675372099301,131072 /prefetch:8
              3⤵
                PID:824
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2072 --field-trial-handle=1784,i,8454385723111612801,7621028675372099301,131072 /prefetch:8
                3⤵
                  PID:4788
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2896 --field-trial-handle=1784,i,8454385723111612801,7621028675372099301,131072 /prefetch:1
                  3⤵
                    PID:320
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2916 --field-trial-handle=1784,i,8454385723111612801,7621028675372099301,131072 /prefetch:1
                    3⤵
                      PID:3044
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4612 --field-trial-handle=1784,i,8454385723111612801,7621028675372099301,131072 /prefetch:8
                      3⤵
                        PID:1712
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4840 --field-trial-handle=1784,i,8454385723111612801,7621028675372099301,131072 /prefetch:8
                        3⤵
                          PID:4460
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4936 --field-trial-handle=1784,i,8454385723111612801,7621028675372099301,131072 /prefetch:1
                          3⤵
                            PID:3864
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4576 --field-trial-handle=1784,i,8454385723111612801,7621028675372099301,131072 /prefetch:1
                            3⤵
                              PID:3200
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4880 --field-trial-handle=1784,i,8454385723111612801,7621028675372099301,131072 /prefetch:1
                              3⤵
                                PID:3236
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5892 --field-trial-handle=1784,i,8454385723111612801,7621028675372099301,131072 /prefetch:8
                                3⤵
                                  PID:1008
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5660 --field-trial-handle=1784,i,8454385723111612801,7621028675372099301,131072 /prefetch:8
                                  3⤵
                                    PID:4036
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5616 --field-trial-handle=1784,i,8454385723111612801,7621028675372099301,131072 /prefetch:8
                                    3⤵
                                      PID:2700
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5756 --field-trial-handle=1784,i,8454385723111612801,7621028675372099301,131072 /prefetch:8
                                      3⤵
                                        PID:3560
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2964 --field-trial-handle=1784,i,8454385723111612801,7621028675372099301,131072 /prefetch:8
                                        3⤵
                                          PID:664
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5732 --field-trial-handle=1784,i,8454385723111612801,7621028675372099301,131072 /prefetch:8
                                          3⤵
                                            PID:1968
                                          • C:\Users\Admin\Downloads\MBSetup.exe
                                            "C:\Users\Admin\Downloads\MBSetup.exe"
                                            3⤵
                                            • Suspicious use of NtCreateUserProcessOtherParentProcess
                                            • Drops file in Drivers directory
                                            • Checks BIOS information in registry
                                            • Executes dropped EXE
                                            • Drops file in Program Files directory
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of FindShellTrayWindow
                                            • Suspicious use of SetWindowsHookEx
                                            PID:3524
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5336 --field-trial-handle=1784,i,8454385723111612801,7621028675372099301,131072 /prefetch:8
                                            3⤵
                                              PID:352
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1564 --field-trial-handle=1784,i,8454385723111612801,7621028675372099301,131072 /prefetch:2
                                              3⤵
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:6648
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=964 --field-trial-handle=1784,i,8454385723111612801,7621028675372099301,131072 /prefetch:8
                                              3⤵
                                                PID:7144
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5880 --field-trial-handle=1784,i,8454385723111612801,7621028675372099301,131072 /prefetch:8
                                                3⤵
                                                  PID:5484
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=4952 --field-trial-handle=1784,i,8454385723111612801,7621028675372099301,131072 /prefetch:1
                                                  3⤵
                                                    PID:4556
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3756 --field-trial-handle=1784,i,8454385723111612801,7621028675372099301,131072 /prefetch:8
                                                    3⤵
                                                      PID:7096
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=5268 --field-trial-handle=1784,i,8454385723111612801,7621028675372099301,131072 /prefetch:1
                                                      3⤵
                                                        PID:5684
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=4700 --field-trial-handle=1784,i,8454385723111612801,7621028675372099301,131072 /prefetch:1
                                                        3⤵
                                                          PID:4492
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3392 --field-trial-handle=1784,i,8454385723111612801,7621028675372099301,131072 /prefetch:8
                                                          3⤵
                                                            PID:3876
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4684 --field-trial-handle=1784,i,8454385723111612801,7621028675372099301,131072 /prefetch:8
                                                            3⤵
                                                              PID:4468
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6136 --field-trial-handle=1784,i,8454385723111612801,7621028675372099301,131072 /prefetch:8
                                                              3⤵
                                                                PID:7076
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5572 --field-trial-handle=1784,i,8454385723111612801,7621028675372099301,131072 /prefetch:8
                                                                3⤵
                                                                  PID:4816
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2888 --field-trial-handle=1784,i,8454385723111612801,7621028675372099301,131072 /prefetch:8
                                                                  3⤵
                                                                    PID:3908
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4744 --field-trial-handle=1784,i,8454385723111612801,7621028675372099301,131072 /prefetch:8
                                                                    3⤵
                                                                      PID:7096
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4760 --field-trial-handle=1784,i,8454385723111612801,7621028675372099301,131072 /prefetch:8
                                                                      3⤵
                                                                        PID:5224
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2032 --field-trial-handle=1784,i,8454385723111612801,7621028675372099301,131072 /prefetch:8
                                                                        3⤵
                                                                          PID:5988
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3000 --field-trial-handle=1784,i,8454385723111612801,7621028675372099301,131072 /prefetch:8
                                                                          3⤵
                                                                            PID:6884
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3752 --field-trial-handle=1784,i,8454385723111612801,7621028675372099301,131072 /prefetch:8
                                                                            3⤵
                                                                              PID:680
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4852 --field-trial-handle=1784,i,8454385723111612801,7621028675372099301,131072 /prefetch:8
                                                                              3⤵
                                                                                PID:6432
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4936 --field-trial-handle=1784,i,8454385723111612801,7621028675372099301,131072 /prefetch:8
                                                                                3⤵
                                                                                  PID:6584
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4660 --field-trial-handle=1784,i,8454385723111612801,7621028675372099301,131072 /prefetch:8
                                                                                  3⤵
                                                                                    PID:5648
                                                                                  • C:\Users\Admin\Downloads\Lokibot.exe
                                                                                    "C:\Users\Admin\Downloads\Lokibot.exe"
                                                                                    3⤵
                                                                                      PID:5432
                                                                                  • C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe
                                                                                    "C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe"
                                                                                    2⤵
                                                                                    • Executes dropped EXE
                                                                                    PID:7124
                                                                                    • C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe
                                                                                      "C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe"
                                                                                      3⤵
                                                                                      • Executes dropped EXE
                                                                                      PID:516
                                                                                  • C:\Program Files\7-Zip\7zG.exe
                                                                                    "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\02ca4397da55b3175aaa1ad2c99981e792f66151\" -spe -an -ai#7zMap6745:142:7zEvent20001
                                                                                    2⤵
                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                    PID:6032
                                                                                  • C:\Users\Admin\Downloads\02ca4397da55b3175aaa1ad2c99981e792f66151\02ca4397da55b3175aaa1ad2c99981e792f66151.exe
                                                                                    "C:\Users\Admin\Downloads\02ca4397da55b3175aaa1ad2c99981e792f66151\02ca4397da55b3175aaa1ad2c99981e792f66151.exe"
                                                                                    2⤵
                                                                                    • Executes dropped EXE
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    PID:5860
                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 5860 -s 1184
                                                                                      3⤵
                                                                                      • Program crash
                                                                                      PID:2164
                                                                                  • C:\Program Files\7-Zip\7zG.exe
                                                                                    "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\smb-id9dl67p\" -spe -an -ai#7zMap19879:86:7zEvent10446
                                                                                    2⤵
                                                                                      PID:3892
                                                                                    • C:\Program Files\7-Zip\7zG.exe
                                                                                      "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\5b2aa53001c0884222bebf931b8235e80cc798c46e3e28c5a4026ccd5590fabf\" -spe -an -ai#7zMap4346:190:7zEvent29148
                                                                                      2⤵
                                                                                        PID:1520
                                                                                      • C:\Program Files\7-Zip\7zG.exe
                                                                                        "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\149979213411fcac20f7cbc1a26e1521b80073aff05d4c0f967046ef5f23b13a\" -spe -an -ai#7zMap2245:190:7zEvent9225
                                                                                        2⤵
                                                                                          PID:2936
                                                                                        • C:\Users\Admin\Downloads\smb-id9dl67p\smb-id9dl67p.exe
                                                                                          "C:\Users\Admin\Downloads\smb-id9dl67p\smb-id9dl67p.exe"
                                                                                          2⤵
                                                                                          • Executes dropped EXE
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          PID:6636
                                                                                        • C:\Users\Admin\Downloads\149979213411fcac20f7cbc1a26e1521b80073aff05d4c0f967046ef5f23b13a\caca.exe
                                                                                          "C:\Users\Admin\Downloads\149979213411fcac20f7cbc1a26e1521b80073aff05d4c0f967046ef5f23b13a\caca.exe"
                                                                                          2⤵
                                                                                          • Executes dropped EXE
                                                                                          • Adds Run key to start application
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          PID:7064
                                                                                        • C:\Users\Admin\Downloads\5b2aa53001c0884222bebf931b8235e80cc798c46e3e28c5a4026ccd5590fabf\5b2aa53001c0884222bebf931b8235e80cc798c46e3e28c5a4026ccd5590fabf.exe
                                                                                          "C:\Users\Admin\Downloads\5b2aa53001c0884222bebf931b8235e80cc798c46e3e28c5a4026ccd5590fabf\5b2aa53001c0884222bebf931b8235e80cc798c46e3e28c5a4026ccd5590fabf.exe"
                                                                                          2⤵
                                                                                          • Executes dropped EXE
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          PID:5128
                                                                                        • C:\Program Files\7-Zip\7zG.exe
                                                                                          "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Paypal\" -spe -an -ai#7zMap24850:74:7zEvent19233
                                                                                          2⤵
                                                                                            PID:1508
                                                                                          • C:\Users\Admin\Downloads\CrimsonRAT.exe
                                                                                            "C:\Users\Admin\Downloads\CrimsonRAT.exe"
                                                                                            2⤵
                                                                                            • Executes dropped EXE
                                                                                            PID:3684
                                                                                            • C:\ProgramData\Hdlharas\dlrarhsiva.exe
                                                                                              "C:\ProgramData\Hdlharas\dlrarhsiva.exe"
                                                                                              3⤵
                                                                                              • Executes dropped EXE
                                                                                              PID:6016
                                                                                        • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                                                                          1⤵
                                                                                            PID:4296
                                                                                          • C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
                                                                                            "C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"
                                                                                            1⤵
                                                                                            • Drops file in Drivers directory
                                                                                            • Executes dropped EXE
                                                                                            • Impair Defenses: Safe Mode Boot
                                                                                            • Loads dropped DLL
                                                                                            • Enumerates connected drives
                                                                                            • Drops file in Program Files directory
                                                                                            • Modifies Internet Explorer settings
                                                                                            • Modifies data under HKEY_USERS
                                                                                            • Modifies system certificate store
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            PID:3428
                                                                                            • C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
                                                                                              "C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe" /installmbtun
                                                                                              2⤵
                                                                                              • Executes dropped EXE
                                                                                              • Loads dropped DLL
                                                                                              • Drops file in System32 directory
                                                                                              • Drops file in Program Files directory
                                                                                              • Drops file in Windows directory
                                                                                              PID:6900
                                                                                            • C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
                                                                                              "C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe" /Service /Protected
                                                                                              2⤵
                                                                                              • Drops file in Drivers directory
                                                                                              • Executes dropped EXE
                                                                                              • Drops file in Windows directory
                                                                                              • Modifies registry class
                                                                                              PID:5412
                                                                                          • \??\c:\windows\system32\svchost.exe
                                                                                            c:\windows\system32\svchost.exe -k dcomlaunch -s DeviceInstall
                                                                                            1⤵
                                                                                            • Checks SCSI registry key(s)
                                                                                            PID:5220
                                                                                            • C:\Windows\system32\DrvInst.exe
                                                                                              DrvInst.exe "4" "9" "C:\Program Files\Malwarebytes\Anti-Malware\mbtun\mbtun.inf" "9" "4ba9030c7" "0000000000000178" "Service-0x0-3e7$\Default" "000000000000017C" "208" "C:\Program Files\Malwarebytes\Anti-Malware\mbtun"
                                                                                              2⤵
                                                                                              • Drops file in System32 directory
                                                                                              • Drops file in Windows directory
                                                                                              • Checks SCSI registry key(s)
                                                                                              • Modifies data under HKEY_USERS
                                                                                              PID:5696
                                                                                          • C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
                                                                                            "C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"
                                                                                            1⤵
                                                                                            • Modifies WinLogon for persistence
                                                                                            • Drops file in Drivers directory
                                                                                            • Sets service image path in registry
                                                                                            • Checks BIOS information in registry
                                                                                            • Executes dropped EXE
                                                                                            • Loads dropped DLL
                                                                                            • Enumerates connected drives
                                                                                            • Boot or Logon Autostart Execution: Authentication Package
                                                                                            • Drops file in System32 directory
                                                                                            • Drops file in Program Files directory
                                                                                            • Checks processor information in registry
                                                                                            • Modifies Internet Explorer settings
                                                                                            • Modifies data under HKEY_USERS
                                                                                            • Modifies registry class
                                                                                            • Modifies system certificate store
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            PID:5516
                                                                                            • C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe
                                                                                              "C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe" nowindow
                                                                                              2⤵
                                                                                              • Executes dropped EXE
                                                                                              • Loads dropped DLL
                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                              • Suspicious use of SendNotifyMessage
                                                                                              PID:5276
                                                                                            • C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\updatrpkg\mbupdatrV5.exe
                                                                                              "C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\updatrpkg\mbupdatrV5.exe" "C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE" "C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\config\UpdateControllerConfig.json" "C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE" "C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\dbclsupdate\staging" /db:dbupdate /su:no
                                                                                              2⤵
                                                                                              • Checks BIOS information in registry
                                                                                              • Executes dropped EXE
                                                                                              • Modifies data under HKEY_USERS
                                                                                              PID:6968
                                                                                            • C:\Users\Admin\AppData\LocalLow\IGDump\sec\ig.exe
                                                                                              ig.exe secure
                                                                                              2⤵
                                                                                              • Executes dropped EXE
                                                                                              PID:7148
                                                                                            • C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exe
                                                                                              ig.exe reseed
                                                                                              2⤵
                                                                                              • Executes dropped EXE
                                                                                              PID:6828
                                                                                            • C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exe
                                                                                              ig.exe reseed
                                                                                              2⤵
                                                                                              • Executes dropped EXE
                                                                                              PID:6628
                                                                                            • C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exe
                                                                                              ig.exe reseed
                                                                                              2⤵
                                                                                              • Executes dropped EXE
                                                                                              PID:5888
                                                                                            • C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exe
                                                                                              ig.exe reseed
                                                                                              2⤵
                                                                                              • Executes dropped EXE
                                                                                              PID:7076
                                                                                          • C:\Windows\System32\rundll32.exe
                                                                                            C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                            1⤵
                                                                                              PID:4724

                                                                                            Network

                                                                                            MITRE ATT&CK Enterprise v15

                                                                                            Replay Monitor

                                                                                            Loading Replay Monitor...

                                                                                            Downloads

                                                                                            • C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\LicenseControllerImpl.dll

                                                                                              Filesize

                                                                                              4.8MB

                                                                                              MD5

                                                                                              1104d30bc3a2168af06974d91fe19b6c

                                                                                              SHA1

                                                                                              0adc46f39c7fe3b1632913baf6830e3eee65be49

                                                                                              SHA256

                                                                                              8fa8305650bd8ad0f28ba9e41a525334b8ed1fe58498c4318e95cf968607d992

                                                                                              SHA512

                                                                                              c55c8a71eecb2c8d2e74f2c735b308649046e7040b5934657c05f5c7c6c12c2d2d36c163c72888c69530d3730a185a46991b613c7dd78770034f40fd01663b26

                                                                                            • C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\PoliciesControllerImpl.dll

                                                                                              Filesize

                                                                                              4.2MB

                                                                                              MD5

                                                                                              03d6455dc6934a409082bf8d2ce119d5

                                                                                              SHA1

                                                                                              995963c33a268a7ed6408c2e6de1281e52091be2

                                                                                              SHA256

                                                                                              82ca2aec64fe151efd59a838c1845111bfb9f94ff277be3afae4e3f684ef3a62

                                                                                              SHA512

                                                                                              a0ff71bc01a11c9a95c1a0186a7bbfec9c3f84d7e600d0bca877934fa5f84053627bc59bb355f53ce9e3c9e4c6a841b8f5cb7436fe7f43b63426a8a851392c6d

                                                                                            • C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\UpdateControllerImpl.dll

                                                                                              Filesize

                                                                                              4.3MB

                                                                                              MD5

                                                                                              26e2306862a3e09489e224b8c7c08b4a

                                                                                              SHA1

                                                                                              31b054b957d27ea4b2e3270ebfe7cf62e32890f8

                                                                                              SHA256

                                                                                              c8aca420097260a96d04398a90f7c346f0b1abf94a44ffa539050e4dd06259f0

                                                                                              SHA512

                                                                                              604c980476b386d5efad2ed273a840fb92dc40bcbee78c9f2fe9d300437978c8b47b2d44e903b43c3b1127c276fbf58fd823342850e6d3effc038acb0f6b1202

                                                                                            • C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\pkgvers.dat

                                                                                              Filesize

                                                                                              75B

                                                                                              MD5

                                                                                              4ac45817bfe33ed7b6388765207a3652

                                                                                              SHA1

                                                                                              463a8e2b067688fe719da5a45e4fc6d6cc7cd2d9

                                                                                              SHA256

                                                                                              5f6a739feaee396c060669e8f0a0324188416cb69c4abbe04ca44ad5e9cb9bb1

                                                                                              SHA512

                                                                                              17d21f437fc4b12e1b5617a44d1e8ae17f35fb86e3255145c1103a4c7f7ada4c71342507d11664fb7d0ecdc5795a5e07412974c473cd84e42a50880b379c29c1

                                                                                            • C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\Global.nm

                                                                                              Filesize

                                                                                              335KB

                                                                                              MD5

                                                                                              81b7c8ee1ac2b622d935c45c665600bf

                                                                                              SHA1

                                                                                              ad682e480523b957b84ec274fbd16048a16ef8f7

                                                                                              SHA256

                                                                                              cde9770bec485d9b53b7c03df6ec98c21ab33ef66fe67efeb24029650a823ecd

                                                                                              SHA512

                                                                                              9789b6f45dbc13c6a6c91d9f1a0d4cf9d5344094e062e8d9374c9466b16f2120d8e11a9e24ad42239e4672a905f971dc93107eef3fa394c4f6ea75fe9085425d

                                                                                            • C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\Global.sr

                                                                                              Filesize

                                                                                              19.8MB

                                                                                              MD5

                                                                                              fdbb0074d699e1889cafdb04390424ce

                                                                                              SHA1

                                                                                              268c24f9f7420c3c37b971e3b31623bd058572dc

                                                                                              SHA256

                                                                                              66d0f04504acb9a135c2916e5a9baad3144a5483c554c920fa57c4e7fddd98d1

                                                                                              SHA512

                                                                                              c817f0fc31c31e199b7337cae798c6cfc8558479079a405c0ffddaae3025636e91804232394ae2460eb62735e48d297c08a78e5692d817f690312b89448f18d8

                                                                                            • C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\cfg.bin

                                                                                              Filesize

                                                                                              995B

                                                                                              MD5

                                                                                              a8e4820e175f7d9c0f37c4f63bdf44bc

                                                                                              SHA1

                                                                                              e0aa265a99ceb65255ead59d54ab2e044c7f63ef

                                                                                              SHA256

                                                                                              4c2d5ddb9c89842b4c0aa4289c62aa67d7480400b95b0bb9be5581576b680a6b

                                                                                              SHA512

                                                                                              68a717c19a8f3532ff8bf3fae6d28a081939618c0f49da8c2cb8c14a9b563cc8dfd3b22d1d0f0e3aec8bd79207f46f3ecb0c49f5caf4fee2d570a5d1917df0df

                                                                                            • C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\clean.mbdb

                                                                                              Filesize

                                                                                              14KB

                                                                                              MD5

                                                                                              0fecc503f6b761789491062e2f974eb3

                                                                                              SHA1

                                                                                              63cc081ef0ef49e91efea38771583634a2ef90e1

                                                                                              SHA256

                                                                                              413df9d71ec0c8b000f7168224db8eccbb8b148c259a23971d87bec58a683505

                                                                                              SHA512

                                                                                              b8cc9a9515b85d9e7378e73adbc19b36143f56800c5225d5796764cf4a97da3c850945845945eb4567564ecfcf2063c2aea925c1c684113d0c188cc4610b8f56

                                                                                            • C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\dbmanifest2.dat

                                                                                              Filesize

                                                                                              924B

                                                                                              MD5

                                                                                              53ad60cfcc1e417704b024ebb5b92874

                                                                                              SHA1

                                                                                              ce9cb043d18d4c113ba32e076316ad78af717de5

                                                                                              SHA256

                                                                                              60143e39a2feaca15b6dda6e835f8f719e8c274c694381c4156df728b1359ebf

                                                                                              SHA512

                                                                                              e2da6d00272e129170f17326787b051abc5f037aac868aee37f079f7370bafd7ac9f0bb4e29453fdd5241213cec9b1ba720b73051247ec841ea0a684462a6c2c

                                                                                            • C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\dynconfig.dat

                                                                                              Filesize

                                                                                              39KB

                                                                                              MD5

                                                                                              10f23e7c8c791b91c86cd966d67b7bc7

                                                                                              SHA1

                                                                                              3f596093b2bc33f7a2554818f8e41adbbd101961

                                                                                              SHA256

                                                                                              008254ca1f4d6415da89d01a4292911de6135b42833156720a841a22685765dc

                                                                                              SHA512

                                                                                              2d1b21371ada038323be412945994d030ee8a9007db072484724616c8597c6998a560bc28886ebf89e2c8919fb70d76c98338d88832351823027491c98d48118

                                                                                            • C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\exclusions.txt

                                                                                              Filesize

                                                                                              23KB

                                                                                              MD5

                                                                                              aef4eca7ee01bb1a146751c4d0510d2d

                                                                                              SHA1

                                                                                              5cf2273da41147126e5e1eabd3182f19304eea25

                                                                                              SHA256

                                                                                              9e87e4c9da3337c63b7f0e6ed0eb71696121c74e18a5da577215e18097715e2f

                                                                                              SHA512

                                                                                              d31d21e37b0048050b19600f8904354cff3f3ec8291c5a7a54267e14af9fb88dfb6d11e74a037cc0369ade8a8fb9b753861f3b3fb2219563e8ec359f66c042db

                                                                                            • C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\mbdigsig2.dat

                                                                                              Filesize

                                                                                              514B

                                                                                              MD5

                                                                                              3d1647a31d79c6dbf278d27c237e4511

                                                                                              SHA1

                                                                                              df1e3f19ed1dd6df8494a6f378d6a0db32745dc0

                                                                                              SHA256

                                                                                              a3d60979f0baafacb8e75e752b635d4c9641273b244ef70b55b888d3579e7da7

                                                                                              SHA512

                                                                                              874912ca704a6758fec15b0d91bd2ae40e53e8ac7e6d3cd14aef12aa6e4840ccc05a4a2d7b76a6ce7805f34149f962b8ad4a9260f66ff047208d3ba74a0c3710

                                                                                            • C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\prot.mbdb

                                                                                              Filesize

                                                                                              24B

                                                                                              MD5

                                                                                              546d9e30eadad8b22f5b3ffa875144bf

                                                                                              SHA1

                                                                                              3b323ffef009bfe0662c2bd30bb06af6dfc68e4d

                                                                                              SHA256

                                                                                              6089fbf0c0c1413f62e91dc9497bedc6d8a271e9dc761e20adc0dccf6f4a0c1f

                                                                                              SHA512

                                                                                              3478f5dcf7af549dd6fe48ad714604200de84a90120b16a32233b6d44fa7240f5f4e5fe803f54b86bbdfd10fa1bfdd88fb85eb6a78e23e426933f98d0a2565ec

                                                                                            • C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\rdefs.mbdb

                                                                                              Filesize

                                                                                              24B

                                                                                              MD5

                                                                                              2f7423ca7c6a0f1339980f3c8c7de9f8

                                                                                              SHA1

                                                                                              102c77faa28885354cfe6725d987bc23bc7108ba

                                                                                              SHA256

                                                                                              850a4ea37a0fd6f68bf95422d502b2d1257264eb90cc38c0a3b1b95aa375be55

                                                                                              SHA512

                                                                                              e922ac8a7a2cde6d387f8698207cf5efbd45b646986a090e3549d97a7d552dd74179bd7ac20b7d246ca49d340c4c168982c65b4749df760857810b2358e7eb69

                                                                                            • C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\rules.mbdb

                                                                                              Filesize

                                                                                              9.7MB

                                                                                              MD5

                                                                                              3b8cc56cc7ca6b34e25b557233907f5f

                                                                                              SHA1

                                                                                              dd4df0ef85c69745e14372c261de42d917d66bbe

                                                                                              SHA256

                                                                                              42f831b00a8bb8bb121967f05105622d08a5599096823f87d59e92df294083eb

                                                                                              SHA512

                                                                                              42651da6bcf84e52a6fb1acca33516c6c95e29696a3dfb233237343722f74404cb75c1f1396be8856a92f2395311c9a0234e8eeffcbaf36f3c744c958287b945

                                                                                            • C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\scan.mbdb

                                                                                              Filesize

                                                                                              824KB

                                                                                              MD5

                                                                                              541fb1cca4e91ec6b9b9d6979a7047ad

                                                                                              SHA1

                                                                                              5cb26850cf03f984ae5b7b2ef7ae4e534018ded1

                                                                                              SHA256

                                                                                              902badebe4aa53b703286eb6031b31d3b96f1cd8367463fc263a8881962a7175

                                                                                              SHA512

                                                                                              a16948b400213b2a6f59de0a30a3e1a31cca13768ffac0a49809d6f62be657fccef8c2735c3ea5de36c8d65de48a12d096427c6832415e0e633dd9147cbf0975

                                                                                            • C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\tids.mbdb

                                                                                              Filesize

                                                                                              167KB

                                                                                              MD5

                                                                                              49b8fae5d27a922ecbbfea6c4ad45df3

                                                                                              SHA1

                                                                                              dc07adc26a44dc8c62dc50b079cd5e6fa616f3f0

                                                                                              SHA256

                                                                                              05a406b47a2f089342e37f9384a613084bf6adc0f95437cc513bd8450583a6c2

                                                                                              SHA512

                                                                                              8aa1f9efb8fa1473ca0538520b39ae63e697b644ca722dc98db51dc2c39de9b6b542d0ea7ed3304abc295bd4ad24bf2ddb2f79f8e383a018ea5e017811545337

                                                                                            • C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\wprot2.mbdb

                                                                                              Filesize

                                                                                              23.7MB

                                                                                              MD5

                                                                                              076c97bd634dcbe48a043d1bde3222b9

                                                                                              SHA1

                                                                                              f48581008c596cb55632989d20706a776b3f2fc7

                                                                                              SHA256

                                                                                              b4541e81b42905363498b44df24f6dc8897b696b4d0aac13bf9c15b91718bcbe

                                                                                              SHA512

                                                                                              90be4cb5d0663dcbf999b2c6aa4eba24e069ebd56b1a34670d2c05bf82544f0ea118002cb97f5e3a287b5adab34f9c8cc49f39dffb446ad52978b76df49585fa

                                                                                            • C:\PROGRA~1\MALWAR~1\ANTI-M~1\mbtun\mbtun.cat

                                                                                              Filesize

                                                                                              10KB

                                                                                              MD5

                                                                                              8abff1fbf08d70c1681a9b20384dbbf9

                                                                                              SHA1

                                                                                              c9762e121e4f8a7ad931eee58ee60c8e9fc3ecb6

                                                                                              SHA256

                                                                                              9ceb410494b95397ec1f8fa505d071672bf61f81cc596b8eccd167a77893c658

                                                                                              SHA512

                                                                                              37998e0aee93ff47fe5b1636fce755966debe417a790e1aebd7674c86c1583feef04648a7bc79e4dedaabb731051f4f803932ac49ea0be05776c0f4d218b076f

                                                                                            • C:\PROGRA~1\MALWAR~1\ANTI-M~1\mbtun\mbtun.sys

                                                                                              Filesize

                                                                                              107KB

                                                                                              MD5

                                                                                              83d4fba999eb8b34047c38fabef60243

                                                                                              SHA1

                                                                                              25731b57e9968282610f337bc6d769aa26af4938

                                                                                              SHA256

                                                                                              6903e60784b9fa5d8b417f93f19665c59946a4de099bd1011ab36271b267261c

                                                                                              SHA512

                                                                                              47faab5fff3e3e2d2aea0a425444aa2e215f1d5bf97edee2a3bb773468e1092919036bcd5002357594b62519bf3a8980749d8d0f6402de0e73c2125d26e78f1e

                                                                                            • C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe

                                                                                              Filesize

                                                                                              8.6MB

                                                                                              MD5

                                                                                              4dc92b52e48b9a7e209307def43f0fa4

                                                                                              SHA1

                                                                                              ba0640d5afd2d5b07fdfca4d2a37a1208bda1b94

                                                                                              SHA256

                                                                                              461727e42566cd84e4161d5332131956041e02e3d81cfec07c22862fa4b6d3d4

                                                                                              SHA512

                                                                                              cb1b2f63befed99c26a5f4912f5e9e7a315f75414097e66a2c2768573425129d18245e515d2bf38e352eefd78d0e61407d43a09993edf0aec6e2ff7c296d0d8d

                                                                                            • C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe

                                                                                              Filesize

                                                                                              2.9MB

                                                                                              MD5

                                                                                              46f875f1fe3d6063b390e3a170c90e50

                                                                                              SHA1

                                                                                              62b901749a6e3964040f9af5ddb9a684936f6c30

                                                                                              SHA256

                                                                                              1cf9d3512efffaa2290c105ac8b7534026604067c9b533e7b7df2e017569a4ec

                                                                                              SHA512

                                                                                              fdfb348061158f8133380e9a94215f4bfc0f6ce643a129d623cb8034c49144f1489de56cd076da645478506d9fbddc7590fe3d643622210084b15fdf0d16b557

                                                                                            • C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe

                                                                                              Filesize

                                                                                              291KB

                                                                                              MD5

                                                                                              ff55b92da0100783e29683ba226a6a96

                                                                                              SHA1

                                                                                              29de03346703b4280a0d016bbb6b7da03487a4f9

                                                                                              SHA256

                                                                                              f36144ce786daa8de23831ca21dd0ea7c02afaafc7d20a8a4d3703918a16c162

                                                                                              SHA512

                                                                                              dd1ced0c037bfa7e82e8980ff8336e192cdad52246bccbb85332e9b0533e4adc991168cbd16aff7c37f5418162533d9fd93ab4cacf9d6538cced53b8fec63122

                                                                                            • C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.json

                                                                                              Filesize

                                                                                              621B

                                                                                              MD5

                                                                                              819563dc3657d1b3ac05e808b6bc19ff

                                                                                              SHA1

                                                                                              047e7990e92398c5e5df979caabd256aa13b4524

                                                                                              SHA256

                                                                                              27f1ffb90b68c920b53ad2eb1c4e90af940f117bfc8eaf083a58c32fd3ac0e0b

                                                                                              SHA512

                                                                                              671885cf826825f084a534ebab16f1a3d58d9709c1885e02e678a5b20e701dde776faa72130e3a8fa44bcbf9baa9df40080d1bb722e37dc7b41923c667514b31

                                                                                            • C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.json

                                                                                              Filesize

                                                                                              654B

                                                                                              MD5

                                                                                              5b042a4b7b2349e9d06f6b106735db1c

                                                                                              SHA1

                                                                                              fd69013da3bcfd055cbe614227baf6109f91fa47

                                                                                              SHA256

                                                                                              ec4e93ccac4e7985df8966cf882d34fb1402993fd19db04b4fcdd4f57c9170a1

                                                                                              SHA512

                                                                                              914aaf5839cb0647e87db44a3069403ddbb6a18f8bfb4d4589ed3f9f5ed898ad6bfa0361a268d6f02f217b84ee639d22d6eb81b4f40ed0a9af947ab98826557c

                                                                                            • C:\Program Files\Malwarebytes\Anti-Malware\ctlrvers.dat

                                                                                              Filesize

                                                                                              8B

                                                                                              MD5

                                                                                              08c0520c18431ff523091aaf8bb38fb9

                                                                                              SHA1

                                                                                              fd864c138b0cb68c361e754a463bc34a87fb3fd5

                                                                                              SHA256

                                                                                              7365b33553803ebbda706e612d72f0cb6c255fe4326454fc46e6b805d9af3b29

                                                                                              SHA512

                                                                                              b87dd80762dc8d7209947eba125a8a09dd3aef005910cc2da044615d906916b91cf1a475ea489222c809ca7170fc1b5c192b210c34cb4d4fdcbde2f2b49a45da

                                                                                            • C:\Program Files\Malwarebytes\Anti-Malware\expapply64.dll

                                                                                              Filesize

                                                                                              473KB

                                                                                              MD5

                                                                                              76a6c5124f8e0472dd9d78e5b554715b

                                                                                              SHA1

                                                                                              88ab77c04430441874354508fd79636bb94d8719

                                                                                              SHA256

                                                                                              d23706f8f1c3fa18e909fe028d612d56df7cd4f9ad0c3a2b521cb58e49f3925d

                                                                                              SHA512

                                                                                              35189cc2bf342e9c6e33fd036f19667398ac53c5583c9614db77fb54aadf9ac0d4b96a3e5f41ec7e8e7f3fe745ae71490bdcf0638d7410b12121e7a4312fae9e

                                                                                            • C:\Program Files\Malwarebytes\Anti-Malware\mb5uns.exe

                                                                                              Filesize

                                                                                              3.9MB

                                                                                              MD5

                                                                                              b672a064c3cfdf56ce0d6091edc19f36

                                                                                              SHA1

                                                                                              1d21d4ca7a265c3eafaae8b6121be0260252e473

                                                                                              SHA256

                                                                                              04fdd99a4e8ded496a99c9d3c8c0b6a9a9bde9c4187d07342260f63852ef6273

                                                                                              SHA512

                                                                                              53e6c4bd68a0cf36160b21d63e7a6152ca78f17c76ccee9e185c1cf3f5a254c05f401f91501ad3d6806d5085b1f58322e6b7ad483fb813b86cb8570519410680

                                                                                            • C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll

                                                                                              Filesize

                                                                                              2.7MB

                                                                                              MD5

                                                                                              b7e5071b317550d93258f7e1e13e7b6f

                                                                                              SHA1

                                                                                              2d08d78a5c29cf724bc523530d1a9014642bbc60

                                                                                              SHA256

                                                                                              467de01d7cee7ec54166b80658ff22f9feebdb1c24eaf1629cf40e4124508064

                                                                                              SHA512

                                                                                              9c35293c95c1a9141740ac99315605964aa37c4a42d3a11cae9e5649ff1427a9480d3d5e7f763212cf13db3511c5ea3c84e68f95f0067fe6339a9d3fb7b27c54

                                                                                            • C:\Program Files\Malwarebytes\Anti-Malware\mbtun.dll

                                                                                              Filesize

                                                                                              2.8MB

                                                                                              MD5

                                                                                              2bbf63f1dab335f5caf431dbd4f38494

                                                                                              SHA1

                                                                                              90f1d818ac8a4881bf770c1ff474f35cdaa4fcd0

                                                                                              SHA256

                                                                                              f21a980316bd4c57c70e00840ab76d9ad412092d7d2d6a2cff4f1311f7c05364

                                                                                              SHA512

                                                                                              ebb9834323329dc01ba2c87e5fad1083a4cb86f5ed761cb63299ac5336a9843a1aadd42fbed706797c2295117af1c00f96806422338352653c8e0255fecc2fd5

                                                                                            • C:\Program Files\Malwarebytes\Anti-Malware\mbtun\mbtun.inf

                                                                                              Filesize

                                                                                              1KB

                                                                                              MD5

                                                                                              5d1917024b228efbeab3c696e663873e

                                                                                              SHA1

                                                                                              cec5e88c2481d323ec366c18024d61a117f01b21

                                                                                              SHA256

                                                                                              4a350fc20834a579c5a58352b7a3aa02a454abbbd9eecd3cd6d2a14864a49cd8

                                                                                              SHA512

                                                                                              14b345f03284b8c1d97219e3dd1a3910c1e453f93f51753f417e643f50922e55c0e23aab1d437300e6c196c7017d7b7538de4850df74b3599e90f3941b40ab4a

                                                                                            • C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.cat

                                                                                              Filesize

                                                                                              10KB

                                                                                              MD5

                                                                                              ddb20ff5524a3a22a0eb1f3e863991a7

                                                                                              SHA1

                                                                                              260fbc1f268d426d46f3629e250c2afd0518ed24

                                                                                              SHA256

                                                                                              5fc1d0838af2d7f4030e160f6a548b10bf5ca03ea60ec55a09a9adbbb056639a

                                                                                              SHA512

                                                                                              7c6970e35395663f97e96d5bf7639a082e111fa368f22000d649da7a9c81c285ee84b6cf63a4fccb0990e5586e70e1b9efc15cf5e4d40946736ca51ec256e953

                                                                                            • C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.inf

                                                                                              Filesize

                                                                                              2KB

                                                                                              MD5

                                                                                              d87c2f68057611e687bdb8cc6ebea5b8

                                                                                              SHA1

                                                                                              27b1311d3b199e4c22772fa1b7ea556805775d37

                                                                                              SHA256

                                                                                              ff93773f55bf4a6a0242adf82276a8c95c0b244b9bc05e515c4e810c81a960e8

                                                                                              SHA512

                                                                                              4aa65b8911d8a2a0f9ef0ee6e934b94db0a9ad4c2ec543b5edcf21486be43f6ab1fda6617ea2cbb85eff230628c9fa8e7649da915d6de695803b28e55bef5819

                                                                                            • C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.sys

                                                                                              Filesize

                                                                                              233KB

                                                                                              MD5

                                                                                              246a1d7980f7d45c2456574ec3f32cbe

                                                                                              SHA1

                                                                                              c5fad4598c3698fdaa4aa42a74fb8fa170ffe413

                                                                                              SHA256

                                                                                              45948a1715f0420c66a22518a1a45a0f20463b342ce05d36c18b8c53b4d78147

                                                                                              SHA512

                                                                                              265e6da7c9eede8ea61f204b3524893cf9bd1ed11b338eb95c4a841428927cccbed02b7d8757a4153ce02863e8be830ea744981f800351b1e383e71ddaad36ad

                                                                                            • C:\Program Files\Malwarebytes\Anti-Malware\srvversion.dat

                                                                                              Filesize

                                                                                              9B

                                                                                              MD5

                                                                                              a58601a3ccc71c69736ff3f16e3faa50

                                                                                              SHA1

                                                                                              4ef363a438a28e0c966f055f89788c9292b8e091

                                                                                              SHA256

                                                                                              3edae4348be02e88de39aed7fce3aa4e781afb6b7728121777066ef9b9b17555

                                                                                              SHA512

                                                                                              d23ae01eb0824a7e1865f9a7389bac349373a90ded9e46937f331bb44aa4e9b275efd795b346270497fa67f2afb9624c8a088cf923e3029090ddda11c8ad6ca7

                                                                                            • C:\Program Files\Malwarebytes\Anti-Malware\version.dat

                                                                                              Filesize

                                                                                              47B

                                                                                              MD5

                                                                                              01c45fe527b291aa37976b8e60ed5698

                                                                                              SHA1

                                                                                              65d9a74fb09a2668e2967b1878b3847c0c6dbeb9

                                                                                              SHA256

                                                                                              72438fe753cb99081c50b2d8dc829fdb87b32c2c2f18bc5dca18a5d5fb818491

                                                                                              SHA512

                                                                                              d3219a50f254c26a4e030da34c675f21348a79f56360a378054df97f18b21c53043255aab7ee1fe64f9ee1e12060f69f79a9a1ce46f0f2c9fef6f294e9583740

                                                                                            • C:\ProgramData\Hdlharas\dlrarhsiva.exe

                                                                                              Filesize

                                                                                              9.1MB

                                                                                              MD5

                                                                                              64261d5f3b07671f15b7f10f2f78da3f

                                                                                              SHA1

                                                                                              d4f978177394024bb4d0e5b6b972a5f72f830181

                                                                                              SHA256

                                                                                              87f51b4632c5fbc351a59a234dfefef506d807f2c173aac23162b85d0d73c2ad

                                                                                              SHA512

                                                                                              3a9ff39e6bc7585b0b03f7327652e4c3b766563e8b183c25b6497e30956945add5684f1579862117e44c6bac2802601fc7c4d2a0daa1824f16c4da1fd6c9c91a

                                                                                            • C:\ProgramData\Hdlharas\mdkhm.zip

                                                                                              Filesize

                                                                                              56KB

                                                                                              MD5

                                                                                              b635f6f767e485c7e17833411d567712

                                                                                              SHA1

                                                                                              5a9cbdca7794aae308c44edfa7a1ff5b155e4aa8

                                                                                              SHA256

                                                                                              6838286fb88e9e4e68882601a13fa770f1b510a0a86389b6a29070a129bf2e5e

                                                                                              SHA512

                                                                                              551ba05bd44e66685f359802b35a8c9775792a12844906b4b53e1a000d56624c6db323754331c9f399072790991c1b256d9114a50fb78111652a1c973d2880af

                                                                                            • C:\ProgramData\Malwarebytes\MBAMService\ScanResults\da2bebea-566d-11ef-9f1e-524829b8d7a9.json

                                                                                              Filesize

                                                                                              49KB

                                                                                              MD5

                                                                                              687a4f78035fc3cc6a09d7e22a61d988

                                                                                              SHA1

                                                                                              0963c3ec381f77585ee6364df50e4540d7f2e6ad

                                                                                              SHA256

                                                                                              89e832f79b274b32487cd9720b2b6b3882ba50277cb772696a578dab0ff8b448

                                                                                              SHA512

                                                                                              f4f76ed5b903a9b0bf21e516e141c417e51a1fb059206d931d1e64b8d7253477afd478417c2dd88f7edd35a8d45556c396f38ffbbb03ec19707a2da8936bec33

                                                                                            • C:\ProgramData\Malwarebytes\MBAMService\ScanResults\da2bebea-566d-11ef-9f1e-524829b8d7a9.json

                                                                                              Filesize

                                                                                              49KB

                                                                                              MD5

                                                                                              55f33026d81c0383677b13e51583bac5

                                                                                              SHA1

                                                                                              3a2920a8d1dc47dc42d764422c814f76bc34fbac

                                                                                              SHA256

                                                                                              feba690a3867e2e2c7cd274de7bfc9503cda480dfc4839b613d41788eb35dffc

                                                                                              SHA512

                                                                                              6a7713469b0e5ad1d1509f0d1dcbcb37739cd7d85a5431e19ee44b581a1ca03524a4ca6135319608fa28a646477f4d26d3a34f9b6b727319a869cc269a46aca6

                                                                                            • C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json

                                                                                              Filesize

                                                                                              1KB

                                                                                              MD5

                                                                                              ba5ac7c6a969347923a4e6953c34d5ba

                                                                                              SHA1

                                                                                              70f561a412a79a2e0d5dabb210c405868d9621a4

                                                                                              SHA256

                                                                                              bd4210165806e9e771dcfc9930230e527b8c403fefe3b00452e78f8e2397342f

                                                                                              SHA512

                                                                                              bcee9042068cec2e32837742fba90b7e3e2a76010643978eed7aa300fa16647c9eb56e06a4542089b871283d8fef8ebc9a91eb4d020ea93a2963f4719491e99f

                                                                                            • C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json

                                                                                              Filesize

                                                                                              47KB

                                                                                              MD5

                                                                                              9c14445393611127333ba2e68fe10dc8

                                                                                              SHA1

                                                                                              eb1a3be0336b7f878370f5a6dcc6faafd12fb045

                                                                                              SHA256

                                                                                              addbe40e10a3b5bb6a8cbe8f0ecc41bbecb18d138c9e5358108922ef97458396

                                                                                              SHA512

                                                                                              c69e2f4f7b6f7ce2c6c6f90d5857be808a298d07a96b0221cf326039ac92b17cf4cf1b3eb9c6610952f63549153571b6c96584932be4341e0753501af6e87685

                                                                                            • C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json