Resubmissions
07/03/2025, 19:43
250307-yfp5pavye1 1007/03/2025, 19:34
250307-x958bswky3 1007/03/2025, 19:02
250307-xpxqfsvvbv 10Analysis
-
max time kernel
154s -
max time network
170s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
07/03/2025, 19:43
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe
Resource
win10v2004-20250217-en
Errors
General
-
Target
JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe
-
Size
1.2MB
-
MD5
58ef8399e896e60b181961292fb6d666
-
SHA1
d5b651f75234877814d8efabb6256fbc23c662ed
-
SHA256
6deff5735317a9b7addf8d9f8d3aeca1de68364e63b69037b2c916bcaee44003
-
SHA512
b9c4059148ff6ff96b376b69450a5234b4de8684ef41173601c24140da62a2b623f4117f5f483be478c9542be676cd705511d9540689b247cd44215b8c2f7b37
-
SSDEEP
24576:D6t9iwCQliK/JJDORRrQl9uM1aIcLkNC2brX5qXI8PP:Wt9iwJTDOPsrNcwNbwxP
Malware Config
Extracted
darkcomet
enzcrash
whatthe.no-ip.biz:1604
DC_MUTEX-F54S21D
-
InstallPath
winupdate.exe
-
gencode
=fgh�Num+Xi-
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
Windows Updater
Signatures
-
Blackshades
Blackshades is a remote access trojan with various capabilities.
-
Blackshades family
-
Blackshades payload 17 IoCs
resource yara_rule behavioral2/memory/1776-117-0x0000000000400000-0x0000000000474000-memory.dmp family_blackshades behavioral2/memory/4660-137-0x0000000000400000-0x0000000000474000-memory.dmp family_blackshades behavioral2/memory/4660-136-0x0000000000400000-0x0000000000474000-memory.dmp family_blackshades behavioral2/memory/4660-588-0x0000000000400000-0x0000000000474000-memory.dmp family_blackshades behavioral2/memory/4660-736-0x0000000000400000-0x0000000000474000-memory.dmp family_blackshades behavioral2/memory/4660-791-0x0000000000400000-0x0000000000474000-memory.dmp family_blackshades behavioral2/memory/4660-824-0x0000000000400000-0x0000000000474000-memory.dmp family_blackshades behavioral2/memory/4660-1012-0x0000000000400000-0x0000000000474000-memory.dmp family_blackshades behavioral2/memory/4660-3600-0x0000000000400000-0x0000000000474000-memory.dmp family_blackshades behavioral2/memory/4660-4034-0x0000000000400000-0x0000000000474000-memory.dmp family_blackshades behavioral2/memory/4660-5104-0x0000000000400000-0x0000000000474000-memory.dmp family_blackshades behavioral2/memory/4660-5190-0x0000000000400000-0x0000000000474000-memory.dmp family_blackshades behavioral2/memory/4660-5226-0x0000000000400000-0x0000000000474000-memory.dmp family_blackshades behavioral2/memory/4660-5273-0x0000000000400000-0x0000000000474000-memory.dmp family_blackshades behavioral2/memory/4660-5360-0x0000000000400000-0x0000000000474000-memory.dmp family_blackshades behavioral2/memory/4660-5486-0x0000000000400000-0x0000000000474000-memory.dmp family_blackshades behavioral2/memory/4660-5517-0x0000000000400000-0x0000000000474000-memory.dmp family_blackshades -
Darkcomet family
-
Hawkeye family
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\winupdate.exe" JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe -
Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile winupdate.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "1" winupdate.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" winupdate.exe -
Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" winupdate.exe -
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 1452 created 3556 1452 MBSetup.exe 56 -
Windows security bypass 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" winupdate.exe -
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run WINDOWSUPDATE.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\fredolin = "C:\\Users\\Admin\\AppData\\Roaming\\windowsupdate.exe" WINDOWSUPDATE.EXE -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5CFF3DC2-AEED-D5C9-ED8B-B1D0CEDCDABC} WINDOWSUPDATE.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5CFF3DC2-AEED-D5C9-ED8B-B1D0CEDCDABC}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\windowsupdate.exe" WINDOWSUPDATE.EXE Key created \REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{5CFF3DC2-AEED-D5C9-ED8B-B1D0CEDCDABC} WINDOWSUPDATE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{5CFF3DC2-AEED-D5C9-ED8B-B1D0CEDCDABC}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\windowsupdate.exe" WINDOWSUPDATE.EXE -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" winupdate.exe -
Disables Task Manager via registry modification
-
Downloads MZ/PE file 2 IoCs
flow pid Process 199 1452 MBSetup.exe 174 1512 chrome.exe -
Drops file in Drivers directory 10 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\mbamtestfile.dat MBSetup.exe File created C:\Windows\system32\DRIVERS\MbamElam.sys MBAMService.exe File created C:\Windows\system32\DRIVERS\mbamswissarmy.sys MBAMService.exe File created C:\Windows\system32\DRIVERS\mwac.sys MBAMService.exe File created C:\Windows\system32\DRIVERS\farflt.sys MBAMService.exe File opened for modification C:\Windows\SysWOW64\drivers\mbamtestfile.dat MBSetup.exe File created C:\Windows\system32\drivers\mbae64.sys MBAMInstallerService.exe File opened for modification C:\Windows\system32\DRIVERS\MbamElam.sys MBAMService.exe File created C:\Windows\system32\DRIVERS\MbamChameleon.sys MBAMService.exe File created C:\Windows\system32\DRIVERS\mbam.sys MBAMService.exe -
Modifies RDP port number used by Windows 1 TTPs
-
Sets service image path in registry 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MBAMSwissArmy\ImagePath = "\\SystemRoot\\System32\\Drivers\\mbamswissarmy.sys" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mbamchameleon\ImagePath = "\\SystemRoot\\System32\\Drivers\\MbamChameleon.sys" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MBAMProtection\ImagePath = "\\SystemRoot\\System32\\Drivers\\mbam.sys" MBAMService.exe -
Checks BIOS information in registry 2 TTPs 8 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate winupdate.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate MBSetup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion MBAMService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate mbupdatrV5.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion MBSetup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate MBAMService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion mbupdatrV5.exe -
Checks computer location settings 2 TTPs 5 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000\Control Panel\International\Geo\Nation winupdate.exe Key value queried \REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000\Control Panel\International\Geo\Nation WINUPDTR.EXE Key value queried \REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000\Control Panel\International\Geo\Nation Malwarebytes.exe Key value queried \REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000\Control Panel\International\Geo\Nation JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe Key value queried \REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000\Control Panel\International\Geo\Nation WINUPDTR.EXE -
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE 20 IoCs
pid Process 4660 WINDOWSUPDATE.EXE 4636 WINUPDTR.EXE 2584 winupdate.exe 2852 winupdate.exe 1776 WINDOWSUPDATE.EXE 2640 WINUPDTR.EXE 1452 MBSetup.exe 5868 MBAMInstallerService.exe 4640 MBVpnTunnelService.exe 5288 MBAMService.exe 5712 MBAMService.exe 5960 ig.exe 5572 ig.exe 3572 Malwarebytes.exe 3020 Malwarebytes.exe 5676 Malwarebytes.exe 4652 Malwarebytes.exe 6620 MBAMWsc.exe 6440 mbupdatrV5.exe 4208 ig.exe -
Impair Defenses: Safe Mode Boot 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\MBAMService MBAMInstallerService.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\MBAMService\ = "Service" MBAMInstallerService.exe -
Loads dropped DLL 64 IoCs
pid Process 5868 MBAMInstallerService.exe 5868 MBAMInstallerService.exe 5868 MBAMInstallerService.exe 4640 MBVpnTunnelService.exe 5712 MBAMService.exe 5712 MBAMService.exe 5712 MBAMService.exe 5712 MBAMService.exe 5712 MBAMService.exe 5712 MBAMService.exe 5712 MBAMService.exe 5712 MBAMService.exe 5712 MBAMService.exe 5712 MBAMService.exe 5712 MBAMService.exe 5712 MBAMService.exe 5712 MBAMService.exe 5712 MBAMService.exe 5712 MBAMService.exe 5712 MBAMService.exe 5712 MBAMService.exe 5712 MBAMService.exe 5712 MBAMService.exe 5712 MBAMService.exe 5712 MBAMService.exe 5712 MBAMService.exe 5712 MBAMService.exe 5712 MBAMService.exe 5712 MBAMService.exe 5712 MBAMService.exe 5712 MBAMService.exe 5712 MBAMService.exe 5712 MBAMService.exe 5712 MBAMService.exe 5868 MBAMInstallerService.exe 5712 MBAMService.exe 5868 MBAMInstallerService.exe 5712 MBAMService.exe 5712 MBAMService.exe 3572 Malwarebytes.exe 3572 Malwarebytes.exe 3572 Malwarebytes.exe 3572 Malwarebytes.exe 3572 Malwarebytes.exe 3572 Malwarebytes.exe 3572 Malwarebytes.exe 3572 Malwarebytes.exe 3572 Malwarebytes.exe 3572 Malwarebytes.exe 3572 Malwarebytes.exe 3572 Malwarebytes.exe 3572 Malwarebytes.exe 3572 Malwarebytes.exe 3572 Malwarebytes.exe 3572 Malwarebytes.exe 3572 Malwarebytes.exe 3572 Malwarebytes.exe 3572 Malwarebytes.exe 3572 Malwarebytes.exe 3572 Malwarebytes.exe 3572 Malwarebytes.exe 3572 Malwarebytes.exe 3572 Malwarebytes.exe 3572 Malwarebytes.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Windows security modification 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" winupdate.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\fredolin = "C:\\Users\\Admin\\AppData\\Roaming\\windowsupdate.exe" WINDOWSUPDATE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fredolin = "C:\\Users\\Admin\\AppData\\Roaming\\windowsupdate.exe" WINDOWSUPDATE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1479699283-3000499823-2337359760-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Updater = "C:\\Users\\Admin\\AppData\\Roaming\\winupdate.exe" JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: MBAMService.exe File opened (read-only) \??\R: MBAMService.exe File opened (read-only) \??\W: MBAMService.exe File opened (read-only) \??\Z: MBAMService.exe File opened (read-only) \??\L: MBAMInstallerService.exe File opened (read-only) \??\N: MBAMInstallerService.exe File opened (read-only) \??\S: MBAMInstallerService.exe File opened (read-only) \??\G: MBAMInstallerService.exe File opened (read-only) \??\A: MBAMService.exe File opened (read-only) \??\B: MBAMService.exe File opened (read-only) \??\U: MBAMService.exe File opened (read-only) \??\V: MBAMService.exe File opened (read-only) \??\Q: MBAMInstallerService.exe File opened (read-only) \??\E: MBAMService.exe File opened (read-only) \??\J: MBAMService.exe File opened (read-only) \??\M: MBAMService.exe File opened (read-only) \??\N: MBAMService.exe File opened (read-only) \??\T: MBAMInstallerService.exe File opened (read-only) \??\Z: MBAMInstallerService.exe File opened (read-only) \??\I: MBAMService.exe File opened (read-only) \??\J: MBAMInstallerService.exe File opened (read-only) \??\M: MBAMInstallerService.exe File opened (read-only) \??\P: MBAMInstallerService.exe File opened (read-only) \??\H: MBAMInstallerService.exe File opened (read-only) \??\K: MBAMService.exe File opened (read-only) \??\O: MBAMService.exe File opened (read-only) \??\T: MBAMService.exe File opened (read-only) \??\A: MBAMInstallerService.exe File opened (read-only) \??\O: MBAMInstallerService.exe File opened (read-only) \??\R: MBAMInstallerService.exe File opened (read-only) \??\U: MBAMInstallerService.exe File opened (read-only) \??\B: MBAMInstallerService.exe File opened (read-only) \??\H: MBAMService.exe File opened (read-only) \??\S: MBAMService.exe File opened (read-only) \??\X: MBAMService.exe File opened (read-only) \??\Y: MBAMService.exe File opened (read-only) \??\V: MBAMInstallerService.exe File opened (read-only) \??\W: MBAMInstallerService.exe File opened (read-only) \??\Y: MBAMInstallerService.exe File opened (read-only) \??\L: MBAMService.exe File opened (read-only) \??\E: MBAMInstallerService.exe File opened (read-only) \??\I: MBAMInstallerService.exe File opened (read-only) \??\K: MBAMInstallerService.exe File opened (read-only) \??\X: MBAMInstallerService.exe File opened (read-only) \??\P: MBAMService.exe File opened (read-only) \??\Q: MBAMService.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\System32\DriverStore\FileRepository\netrasa.inf_amd64_1bdf7a435cb3580d\netrasa.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netr7364.inf_amd64_310ee0bc0af86ba3\netr7364.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{d2b71dd9-ef4d-0545-ba20-789d45ee1e62}\mbtun.sys DrvInst.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\117308CCCD9C93758827D7CC85BB135E MBAMService.exe File created C:\Windows\System32\DriverStore\FileRepository\netvg63a.inf_amd64_9f5493180b1252cf\netvg63a.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netwtw08.inf_amd64_7c0c516fb22456cd\netwtw08.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netsstpa.inf_amd64_e76c5387d67e3fd6\netsstpa.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\kdnic.inf_amd64_6649425cdcae9b5f\kdnic.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\bthpan.inf_amd64_b06c3bc32f7db374\bthpan.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\usbncm.inf_amd64_9957a38c3d2283ed\usbncm.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netvchannel.inf_amd64_ba3e73aa330c95d6\netvchannel.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netl260a.inf_amd64_783312763f8749c7\netl260a.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\net7500-x64-n650f.inf_amd64_cc87c915f33d1c27\net7500-x64-n650f.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\nett4x64.inf_amd64_54eacac1858c78ab\nett4x64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netwtw06.inf_amd64_2edd50e7a54d503b\netwtw06.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netathrx.inf_amd64_220db23f5419ea8d\netathrx.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\mwlu97w8x64.inf_amd64_23bc3dc6d91eebdc\mwlu97w8x64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\msux64w10.inf_amd64_5aa81644af5957b3\msux64w10.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\net8185.inf_amd64_7a30f5a9441cd55b\net8185.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FA0E447C3E79584EC91182C66BBD2DB7 MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141 MBAMService.exe File created C:\Windows\System32\DriverStore\FileRepository\netmlx4eth63.inf_amd64_3809a4a3e7e07703\netmlx4eth63.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\net44amd.inf_amd64_450d4b1e35cc8e0d\net44amd.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netbxnda.inf_amd64_1fff3bc87a99b0f1\netbxnda.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netbc64.inf_amd64_b96cdf411c43c00c\netbc64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\Temp\{d2b71dd9-ef4d-0545-ba20-789d45ee1e62}\SETB5ED.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{d2b71dd9-ef4d-0545-ba20-789d45ee1e62}\SETB5FF.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\ndisimplatformmp.inf_amd64_8de1181bfd1f1628\ndisimplatformmp.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netmyk64.inf_amd64_1f949c30555f4111\netmyk64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\rtux64w10.inf_amd64_d6132e4c7fe2fac6\rtux64w10.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netl1c63x64.inf_amd64_4d6630ce07a4fb42\netl1c63x64.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_6E4F36431D86962EFD432400DF65AC90 MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\38D10539991D1B84467F968981C3969D_C92678066E2B4B4986BC7641EEC08637 MBAMService.exe File created C:\Windows\System32\DriverStore\FileRepository\netelx.inf_amd64_7812e4e45c4a5eb1\netelx.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netefe3e.inf_amd64_7830581a689ef40d\netefe3e.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{d2b71dd9-ef4d-0545-ba20-789d45ee1e62}\SETB5ED.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{d2b71dd9-ef4d-0545-ba20-789d45ee1e62}\mbtun.cat DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt MBAMService.exe File created C:\Windows\System32\DriverStore\Temp\{d2b71dd9-ef4d-0545-ba20-789d45ee1e62}\SETB5EE.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\netax88772.inf_amd64_5d1c92f42d958529\netax88772.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netwns64.inf_amd64_162bb49f925c6463\netwns64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netwtw04.inf_amd64_c8f5ae6576289a2d\netwtw04.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\rt640x64.inf_amd64_8984d8483eef476c\rt640x64.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB MBAMService.exe File created C:\Windows\System32\DriverStore\FileRepository\netmlx5.inf_amd64_101a408e6cb1d8f8\netmlx5.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\net1yx64.inf_amd64_8604d8a50804b9c1\net1yx64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\nete1e3e.inf_amd64_895623810c19146a\nete1e3e.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\rndiscmp.inf_amd64_81bff1eb756435c6\rndiscmp.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\net8187bv64.inf_amd64_bc859d32f3e2f0d5\net8187bv64.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3E3E9689537B6B136ECF210088069D55_EF6C9357BB54DDB629FD2D79F1594F95 MBAMService.exe File created C:\Windows\System32\DriverStore\FileRepository\netvf63a.inf_amd64_a090e6cfaf18cb5c\netvf63a.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netwbw02.inf_amd64_1c4077fa004e73b4\netwbw02.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netrtl64.inf_amd64_8e9c2368fe308df2\netrtl64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netwlv64.inf_amd64_0b9818131664d91e\netwlv64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netrtwlane.inf_amd64_20caba88bd7f0bb3\netrtwlane.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\mbtun.inf_amd64_add82795013a7c3b\mbtun.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\mbtun.inf_amd64_add82795013a7c3b\mbtun.cat DrvInst.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_466BAFE78D4077069B6C3828315C7C8D MBAMService.exe File created C:\Windows\System32\DriverStore\FileRepository\net8187se64.inf_amd64_99a4ca261f585f17\net8187se64.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\572BF21E454637C9F000BE1AF9B1E1A9 MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_466BAFE78D4077069B6C3828315C7C8D MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3E3E9689537B6B136ECF210088069D55_EF6C9357BB54DDB629FD2D79F1594F95 MBAMService.exe File created C:\Windows\System32\DriverStore\FileRepository\bcmdhd64.inf_amd64_e0bae6831f60ea5f\bcmdhd64.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{d2b71dd9-ef4d-0545-ba20-789d45ee1e62}\SETB5FF.tmp DrvInst.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3372 set thread context of 3200 3372 JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe 87 PID 2584 set thread context of 2852 2584 winupdate.exe 99 -
resource yara_rule behavioral2/files/0x000300000001e64b-12.dat upx behavioral2/memory/4660-21-0x0000000000400000-0x0000000000474000-memory.dmp upx behavioral2/memory/1776-105-0x0000000000400000-0x0000000000474000-memory.dmp upx behavioral2/memory/1776-117-0x0000000000400000-0x0000000000474000-memory.dmp upx behavioral2/memory/4660-137-0x0000000000400000-0x0000000000474000-memory.dmp upx behavioral2/memory/4660-136-0x0000000000400000-0x0000000000474000-memory.dmp upx behavioral2/memory/4660-588-0x0000000000400000-0x0000000000474000-memory.dmp upx behavioral2/memory/4660-736-0x0000000000400000-0x0000000000474000-memory.dmp upx behavioral2/memory/4660-791-0x0000000000400000-0x0000000000474000-memory.dmp upx behavioral2/memory/4660-824-0x0000000000400000-0x0000000000474000-memory.dmp upx behavioral2/memory/4660-1012-0x0000000000400000-0x0000000000474000-memory.dmp upx behavioral2/memory/4660-3600-0x0000000000400000-0x0000000000474000-memory.dmp upx behavioral2/memory/4660-4034-0x0000000000400000-0x0000000000474000-memory.dmp upx behavioral2/memory/4660-5104-0x0000000000400000-0x0000000000474000-memory.dmp upx behavioral2/memory/4660-5190-0x0000000000400000-0x0000000000474000-memory.dmp upx behavioral2/memory/4660-5226-0x0000000000400000-0x0000000000474000-memory.dmp upx behavioral2/memory/4660-5273-0x0000000000400000-0x0000000000474000-memory.dmp upx behavioral2/memory/4660-5360-0x0000000000400000-0x0000000000474000-memory.dmp upx behavioral2/memory/4660-5486-0x0000000000400000-0x0000000000474000-memory.dmp upx behavioral2/memory/4660-5517-0x0000000000400000-0x0000000000474000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\fr\PresentationCore.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\fr\PresentationFramework.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\pl\System.Windows.Forms.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\ru\UIAutomationTypes.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\a0f0d97bfb8c11efb7d2d6a26ba1faea MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\api-ms-win-core-sysinfo-l1-1-0.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.Net.ServicePoint.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.Reflection.Emit.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\System.Security.Cryptography.Xml.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\System.Windows.Forms.Primitives.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\mbae.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\assistant.deps.json MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\Swissarmy.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\hostfxr.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\api-ms-win-core-processthreads-l1-1-1.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\api-ms-win-core-timezone-l1-1-0.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.Collections.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.Xml.XPath.XDocument.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\pl\UIAutomationClient.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\tr\System.Windows.Controls.Ribbon.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\Microsoft.Extensions.DependencyInjection.Abstractions.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\api-ms-win-core-libraryloader-l1-1-0.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\api-ms-win-core-processenvironment-l1-1-0.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.Reflection.Primitives.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\de\WindowsFormsIntegration.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\pt-BR\System.Xaml.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\System.Security.Cryptography.ProtectedData.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\zh-Hans\System.Windows.Forms.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.Net.Requests.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\ja\System.Windows.Input.Manipulations.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\System.Windows.Input.Manipulations.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\zh-Hans\UIAutomationClientSideProviders.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.Dynamic.Runtime.dll MBAMInstallerService.exe File created C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\SdkDbUpdatrV5.dll MBAMService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\api-ms-win-core-namedpipe-l1-1-0.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\api-ms-win-crt-heap-l1-1-0.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\Microsoft.Win32.Registry.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\Microsoft.WindowsDesktop.App.deps.json MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\System.Windows.Controls.Ribbon.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\offreg.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\BrowserSDKDLLShim.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\Microsoft.Extensions.Caching.Memory.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\System.Printing.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\MbamPt.exe MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.sys MBAMService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\mscordaccore.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\es\PresentationUI.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\tr\System.Windows.Forms.Design.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\MbamUI.UICommon.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\System.ServiceProcess.ServiceController.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.Net.Quic.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.Private.CoreLib.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.Threading.Timer.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\ja\UIAutomationClientSideProviders.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\ja\WindowsBase.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\Microsoft.CSharp.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.IO.FileSystem.Primitives.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.Xml.XmlSerializer.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\ja\WindowsFormsIntegration.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\api-ms-win-crt-multibyte-l1-1-0.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\fr\System.Windows.Controls.Ribbon.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\ja\PresentationFramework.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\pt-BR\WindowsFormsIntegration.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.Reflection.TypeExtensions.dll MBAMInstallerService.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification C:\Windows\inf\oem3.inf DrvInst.exe File created C:\Windows\inf\oem3.inf DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log MBVpnTunnelService.exe File opened for modification C:\Windows\INF\setupapi.dev.log svchost.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 21 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WINDOWSUPDATE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MBSetup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WINDOWSUPDATE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WINUPDTR.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winupdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WINUPDTR.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winupdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe -
Checks SCSI registry key(s) 3 TTPs 26 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe -
Checks processor information in registry 2 TTPs 10 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString winupdate.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier winupdate.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier winupdate.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MBAMService.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 winupdate.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MBAMService.exe -
Delays execution with timeout.exe 2 IoCs
pid Process 2060 timeout.exe 4604 timeout.exe -
Enumerates system info in registry 2 TTPs 5 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier winupdate.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION MBAMInstallerService.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Malwarebytes.exe = "11000" MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION MBAMService.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\mbam.exe = "11000" MBAMService.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\mbamtray.exe = "11000" MBAMService.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0\Common MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\16.0\Common MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs MBAMService.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates mbupdatrV5.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA mbupdatrV5.exe Set value (str) \REGISTRY\USER\S-1-5-19\SOFTWARE\Malwarebytes\FirstRun = "false" MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates mbupdatrV5.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed MBAMService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MBAMWsc.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs mbupdatrV5.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MBAMWsc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT mbupdatrV5.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Malwarebytes MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0 MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA MBAMInstallerService.exe Set value (str) \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:\ MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\16.0\Common\Security MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs mbupdatrV5.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\16.0\Common\Security MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs mbupdatrV5.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\Software MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB30855D-36DF-41BD-9EEE-03BA7E8E70B7}\TypeLib\ = "{783B187E-360F-419C-B6DA-592892764A01}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0E64B3CF-7D56-4F76-8B9F-A6CD0D3393AE}\TypeLib\ = "{5709DEEB-F05E-4D5C-8DC4-3B0D924EE08F}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4BDE5F8-F8D4-4E50-937F-85E8382A9FEE} MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E8D2DC04-56F2-4F6F-8E11-8CB2BB337FCA} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2058A31F-5F59-4452-9204-03F588252FFC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{40D6E119-3897-41B3-AC5D-5FE6F088C97B}\TypeLib\Version = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F927AD37-BA5F-4B86-AE22-FE2371B12955}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{72F290D5-789C-4D8A-9EBE-63ECEA150373}\TypeLib\Version = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BEB52C40-FE75-4478-9040-66B25435CE72}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1EB774AC-23B7-4F52-A9F2-708D194F0C86}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{11D1E5E8-14E1-4B5B-AE1A-2678CB91E8E5}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F1C46F8-E697-4175-B240-CDE682A4BA2D}\Version MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7995CBA9-83E0-4F28-A50B-DFDE85EBCCD1}\TypeLib\Version = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BADF77CD-ECCE-4B36-88FF-6A2804FFE307}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4F3822FA-CCD5-4934-AB6D-3382B2F91DB9}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5CE94D34-A1E4-4FA8-BEDC-6A32683B85F5}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AFF1A83B-6C83-4342-8E68-1648DE06CB65}\1.0\FLAGS\ = "0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{81701AB9-0B9C-49FE-9C79-C3C4DCA91E7B}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{71AC94F2-D545-438F-9156-C231B7D94A56}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2DEBAD4E-3BAF-44F0-9150-BCCCC3801CF9}\TypeLib\Version = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{620A01DD-16D2-4A83-B02C-E29BE38B3029}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{620A01DD-16D2-4A83-B02C-E29BE38B3029}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0C4652FC-FA35-4394-A133-F68409776465}\ProxyStubClsid32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MBAMExt.MBAMShlExt.1\CLSID MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{11D1E5E8-14E1-4B5B-AE1A-2678CB91E8E5}\VersionIndependentProgID MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F6D29500-933C-447C-9D88-9D814AF73808} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BFC6C7E6-8475-4F9B-AC56-AD22BECF91C4}\ = "IMBAMServiceControllerEventsV2" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D51C573D-B305-4980-8DFF-076C1878CCFB}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8307A4A5-A025-438B-B23B-8EE38A453D54}\ProxyStubClsid32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8A574BA8-3535-41F9-AB73-FA93F8A7DC3B}\ProxyStubClsid32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{74630AE8-C170-4A8F-A90A-F42D63EFE1E8} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D5599B6B-FA0C-45B5-8309-853B003EA412}\Version\ = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DE6A4256-97CD-4DBB-9D4A-3054B0BB0F8B}\ = "ICloudControllerV6" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6A3E14F0-01F5-492E-AA97-3D880941D814}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{50538523-AA2F-40D3-9B58-DB51D5BD3D4A}\ = "_IMBAMServiceControllerEventsV3" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{61964EBA-D9C0-4834-B01C-A6133F432BB1}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{108E7F3D-FB06-4024-94FB-3B8E687587E4}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{44AC1571-055F-4CC8-B7D8-EA022C4CC112}\TypeLib\ = "{A82129F1-32E1-4D79-A39F-EBFEE53A70BF}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9704115C-F54E-4D64-8554-0CAF8BF33B1B} MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{01222402-A8AB-4183-8843-8ADBF0B11869} MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B1790AB-65B0-4F50-812F-7CC86FA94AF7} MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{566DC5CA-A3C4-4959-AB92-37606E12AAFF}\ProxyStubClsid32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0B14402F-4F35-443E-A34E-0F511098C644}\ProxyStubClsid32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E96FEF0-48F7-4ECB-B010-501044575477}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5CE94D34-A1E4-4FA8-BEDC-6A32683B85F5}\TypeLib\ = "{2446F405-83F0-460F-B837-F04540BB330C}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{ABC1D1AF-23ED-4483-BDA4-90BCC21DFBDB}\TypeLib\ = "{783B187E-360F-419C-B6DA-592892764A01}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2A0F9375-1809-45ED-AFE0-92852B971139}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F3968E6D-3FD5-4707-A5A8-4E8C3C042062}\TypeLib\Version = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BD9CB7A5-5C46-4799-A3A4-20FB128E58F1} MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{97EB7268-0D7B-43F6-9C11-337287F960DF}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7E96FEF0-48F7-4ECB-B010-501044575477}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{995A8F3B-6B5F-4773-898A-862D50142B4C}\TypeLib\Version = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{36BABBB6-6184-44EC-8109-76CBF522C9EF}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{226C1698-A075-4315-BB5D-9C164A96ACE7}\1.0\0 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BAFDF38F-72A8-4791-AACC-72EB8E09E460}\TypeLib\ = "{783B187E-360F-419C-B6DA-592892764A01}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3B42C782-9650-4EFF-9618-91118DF96061} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6B3DFEA6-6514-42CF-A091-C4DFFD9C2158}\TypeLib\ = "{5709DEEB-F05E-4D5C-8DC4-3B0D924EE08F}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4A9108FB-A377-47EC-96E3-3CB8B1FB7272}\ = "IExploitRecord" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D57ACF19-30E3-4B7E-BCDD-6EEB8E57AF27}\ = "ILicenseControllerV4" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MB.VPNController\CurVer\ = "MB.VPNController.1" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E298372C-5B10-42B4-B44C-7B85EA0722A3}\ProxyStubClsid32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{25321640-5EF1-4095-A0DA-30DE19699441} MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AFC6D7FD-62B9-4016-9674-53BAC603E9FC}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D4AC5360-A581-42A7-8DD6-D63A5C3AA7F1}\TypeLib\ = "{A23C190D-C714-42C7-BDBB-F4E1DE65AF27}" MBAMService.exe -
Modifies registry key 1 TTPs 4 IoCs
pid Process 3884 reg.exe 2640 reg.exe 4756 reg.exe 2540 reg.exe -
Modifies system certificate store 2 TTPs 24 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\2AD974A775F73CBDBBD8F5AC3A49255FA8FB1F8C MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E\Blob = 030000000100000014000000b51c067cee2b0c3df855ab2d92f4fe39d4e70f0e2000000001000000e1030000308203dd308202c5a003020102020100300d06092a864886f70d01010b050030818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a30818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bdedc103fcf68ffc02b16f5b9f48d99d79e2a2b703615618c347b6d7ca3d352e8943f7a1699bde8a1afd13209cb44977322956fdb9ec8cdd22fa72dc276197eef65a84ec6e19b9892cdc845bd574fb6b5fc589a51052894655f4b8751ce67fe454ae4bf85572570219f8177159eb1e280774c59d48be6cb4f4a4b0f364377992c0ec465e7fe16d534c62afcd1f0b63bb3a9dfbfc7900986174cf26824063f3b2726a190d99cad40e75cc37fb8b89c159f1627f5fb35f6530f8a7b74d765a1e765e34c0e89656998ab3f07fa4cdbddc32317c91cfe05f11f86baa495cd19994d1a2e3635b0976b55662e14b741d96d426d4080459d0980e0ee6defcc3ec1f90f10203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147c0c321fa7d9307fc47d68a362a8a1ceab075b27300d06092a864886f70d01010b050003820101001159fa254f036f94993b9a1f828539d47605945ee128936d625d09c2a0a8d4b07538f1346a9de49f8a862651e62cd1c62d6e95204a9201ecb88a677b31e2672e8c9503262e439d4a31f60eb50cbbb7e2377f22ba00a30e7b52fb6bbb3bc4d379514ecd90f4670719c83c467a0d017dc558e76de68530179a24c410e004f7e0f27fd4aa0aff421d37ed94e5645912207738d3323e3881759673fa688fb1cbce1fc5ecfa9c7ecf7eb1f1072db6fcbfcaa4bfd097054abcea18280290bd5478092171d3d17d1dd916b0a9613dd00a0022fcc77bcb0964450b3b4081f77d7c32f598ca588e7d2aee90597364f936745e25a1f566052e7f3915a92afb508b8e8569f4 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8DA7F965EC5EFC37910F1C6E59FDC1CC6A6EDE16 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8DA7F965EC5EFC37910F1C6E59FDC1CC6A6EDE16\Blob = 0300000001000000140000008da7f965ec5efc37910f1c6e59fdc1cc6a6ede162000000001000000450300003082034130820229a0030201020213066c9fcf99bf8c0a39e2f0788a43e696365bca300d06092a864886f70d01010b05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412031301e170d3135303532363030303030305a170d3338303131373030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f74204341203130820122300d06092a864886f70d01010105000382010f003082010a0282010100b2788071ca78d5e371af478050747d6ed8d78876f49968f7582160f97484012fac022d86d3a0437a4eb2a4d036ba01be8ddb48c80717364cf4ee8823c73eeb37f5b519f84968b0ded7b976381d619ea4fe8236a5e54a56e445e1f9fdb416fa74da9c9b35392ffab02050066c7ad080b2a6f9afec47198f503807dca2873958f8bad5a9f948673096ee94785e6f89a351c0308666a14566ba54eba3c391f948dcffd1e8302d7d2d747035d78824f79ec4596ebb738717f2324628b843fab71daacab4f29f240e2d4bf7715c5e69ffea9502cb388aae50386fdbfb2d621bc5c71e54e177e067c80f9c8723d63f40207f2080c4804c3e3b24268e04ae6c9ac8aa0d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604148418cc8534ecbc0c94942e08599cc7b2104e0a08300d06092a864886f70d01010b0500038201010098f2375a4190a11ac57651282036230eaee628bbaaf894ae48a4307f1bfc248d4bb4c8a197f6b6f17a70c85393cc0828e39825cf23a4f9de21d37c8509ad4e9a753ac20b6a897876444718656c8d418e3b7f9acbf4b5a750d7052c37e8034bade961a0026ef5f2f0c5b2ed5bb7dcfa945c779e13a57f52ad95f2f8933bde8b5c5bca5a525b60af14f74befa3fb9f40956d3154fc42d3c7461f23add90f48709ad9757871d1724334756e5759c2025c266029cf2319168e8843a5d4e4cb08fb231143e843297262a1a95d5e08d490aeb8d8ce14c2d055f286f6c49343776661c0b9e841d7977860036e4a72aea5d17dba109e866c1b8ab95933f8ebc490bef1b9 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\2AD974A775F73CBDBBD8F5AC3A49255FA8FB1F8C\Blob = 0300000001000000140000002ad974a775f73cbdbbd8f5ac3a49255fa8fb1f8c2000000001000000620400003082045e30820346a0030201020213077312380b9d6688a33b1ed9bf9ccda68e0e0f300d06092a864886f70d01010b05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412031301e170d3232303832333232323132385a170d3330303832333232323132385a303c310b3009060355040613025553310f300d060355040a1306416d617a6f6e311c301a06035504031313416d617a6f6e205253412032303438204d303130820122300d06092a864886f70d01010105000382010f003082010a0282010100eb712ca9cb1f8828923230af8a570f78b73725955587ac675c97d322c8daa214676b7cf067dae2032ab356125dc6b547f96708a7937a9592180fb4f9f910369a7f2f80b64fba134ec75d531ee0dd96330720d396bc12e4745042a1051373b54f9b4424fe2d7fedbc2285ec362133977506ce271882dce3d9c582078d5e26012626671fd93f13cf32ba6bad7864fcaaff0e023c07df9c0578728cfdea75b7032884dae86e078cd05085ef8154b2716eec6d62ef8f94c35ee9c4a4d091c02e249198caeeba258ed4f671b6fb5b6b38064837478d86dcf2ea06fb76377d9eff424e4d588293cfe271c278b17aab4b5b94378881e4d9af24aef872c565fb4bb451e70203010001a382015a3082015630120603551d130101ff040830060101ff020100300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030106082b06010505070302301d0603551d0e0416041481b80e638a891218e5fa3b3b50959fe6e5901385301f0603551d230418301680148418cc8534ecbc0c94942e08599cc7b2104e0a08307b06082b06010505070101046f306d302f06082b060105050730018623687474703a2f2f6f6373702e726f6f746361312e616d617a6f6e74727573742e636f6d303a06082b06010505073002862e687474703a2f2f6372742e726f6f746361312e616d617a6f6e74727573742e636f6d2f726f6f746361312e636572303f0603551d1f043830363034a032a030862e687474703a2f2f63726c2e726f6f746361312e616d617a6f6e74727573742e636f6d2f726f6f746361312e63726c30130603551d20040c300a3008060667810c010201300d06092a864886f70d01010b05000382010100ad00de0205232e063262b46bb19416e41140de2bfa59c135efe0aa8f2b41b9d1f38739001df23db5a7470c0606c691f3075702d4edbd17c1909abf4875a2074f30dd4a6a42b50d3d15c00ffe845bc63c99cc5752b1d86e12d59692934b94e507e88982086a7a34d49e64e13d876a92909a63a14bf88fb6ea34d305be20c2de06e28c9f738b9f4d3985cace19369d85c99ec9f8503fb67e88a1efca84068b50b40a5ca61c44f1fdc8614060f26125aa07f4c7c27375e40c0b428d04e55f4448995b7b898196a7889d4b0d62e804c4d7feb4e8b26dcaecc01cbc385b1ddf85ce5b7ae3494b6cb9a7ddf405b249ade1c5146bc2ccebcd7fd65869bac3207e7fb0b8 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 040000000100000010000000324a4bbbc863699bbe749ac6dd1d46240f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb658140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a190000000100000010000000fd960962ac6938e0d4b0769aa1a64e262000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2 MBAMService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 040000000100000010000000be954f16012122448ca8bc279602acf5140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a2030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa20f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e1900000001000000100000009f687581f7ef744ecfc12b9cee6238f12000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 MBAMService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa22000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\5A8CEF45D7A69859767A8C8B4496B578CF474B1A\Blob = 0300000001000000140000005a8cef45d7a69859767a8c8b4496b578cf474b1a2000000001000000450500003082054130820329a0030201020213066c9fd29635869f0a0fe58678f85b26bb8a37300d06092a864886f70d01010c05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412032301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f74204341203230820222300d06092a864886f70d01010105000382020f003082020a0282020100ad969f2d9c4a4c4a81795199ec8acb6b605113bc4d6d06fcb0088ddd19106ac7260c35d8c06f2084e994b19b8503c35bdb4ae8c8f89076d95b4fe34ce806364dcc9aac3d0c902b92d4061960ac374479858182ad5a37e00dcc9da64c5276ea439db704d150f655e0d5d2a64985e937e9ca7eae5c954d489a3fae205a6d8895d934b8521a4390b0bf6c05b9b678b7ead0e43a3c125362ff4af27bbe3505a91234e3f36474622c3d00495a28fe3244bb87dd652702713bda4af71fdacdf72155904f0fecae82e19f6bd945d3bbf05f87ed3c2c3986da3fdeec7255eb79a3addbdd7cb0ba1ccefcde4f3576cf0ff8781f6a36514627615be99ecff0a2557d7c258a6f2fb4c5cf842e2bfd0d51106cfb5f1bbc1b7ec5ae3b98013192ff0b57f49ab2b957e9abef0d76d1f0eef4ce86a7e06ee9b469a1df69f633c6692e97139ea587b057108137c953b3bb7ff692d19cd018f4926eda834fa663994ca5fb5eef21647a205f6c648515cb37e9620c0b2a16dc012e32da3e4bf59e3af6174094ef9e910886fabe63a85a33eccb744395f96c695236c7296ffc55035c1ffb9fbd47ebe74947950b4e89220949e0f5611ef1bf2e8a726e8059ff573af97532a34e5feced2862d94d73f2cc811760edcdebdcdba7cac57e02bdf2540854fdb42d092c17544a98d154e1516708d2ed6e7e6f3fd22d81592966cb903995111e7427feddebaf0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414b00cf04c30f405580248fd33e552af4b84e36652300d06092a864886f70d01010c05000382020100aaa8808f0e78a3e0a2d4cde6f5987a3bea0003b0970e93bc5aa8f62c8c7287a9b1fc7f73fd637178a58759cf30e10d10b2135a6d82f56ae6809fa0050b68e4476bc76adfb6fd773272e518fa09f4a0932c5dd28c75857665900c0379b7312363ad788309866884cafff9cf269a9279e7cd4bc5e761a717cbf3a91293936ba7e82f5392c46058b0cc0251185b858d625963b6adb4de9afb26f70027c05d55377499c9507fe3592e44e32c25eeec4c3277b49f1ae94b5d20c5dafd1c8716c643e8d4bb269a45705ea90b3753e2467b27fde046f289b7cc42b6cb28266ed9a5c93ac8411360f7508c15aeb26d1a151a5778e6922ad96590823f6c02afae123a27963604d71da28063a99bf1e5bab47c14b04ec9b11f745f38f651ea9bfa2ca211d4a92d271a45b1afb24e710dc05846d66906cb53cbb3fe6b41cd417e7d4c0f7c72797a59cd5e4a0eac9ba99873797cb4f4ccb9b8070cb2745cb8c76f88a190a7f4aaf9bf673af41a15621eb79fbe3db129af67a112f25810195303301bb81a89f69cbd97038ea309f31d8b21f1b4dfe41cd19f650206ea5cd613b384efa2a55c8c7729a768c06bae40d2a8b4eacdf08d4b389c199a1b2854b88990efca75813e1ef26424c718af4eff479e07f63565a4d30a56fff517646cefa822254993b6df0017da587e5deec51bb0d1d15f2110c7f9f3ba020a2707c5f1d6c7d3e0fb09606c MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F6108407D6F8BB67980CC2E244C2EBAE1CEF63BE MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 5c000000010000000400000000080000190000000100000010000000fd960962ac6938e0d4b0769aa1a64e26030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a1d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e76200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb65809000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e650040000000100000010000000324a4bbbc863699bbe749ac6dd1d46242000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\5A8CEF45D7A69859767A8C8B4496B578CF474B1A MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0D44DD8C3C8C1A1A58756481E90F2E2AFFB3D26E MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F6108407D6F8BB67980CC2E244C2EBAE1CEF63BE\Blob = 030000000100000014000000f6108407d6f8bb67980cc2e244c2ebae1cef63be2000000001000000f6010000308201f230820178a0030201020213066c9fd7c1bb104c2943e5717b7b2cc81ac10e300a06082a8648ce3d0403033039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412034301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f7420434120343076301006072a8648ce3d020106052b8104002203620004d2ab8a374fa3530dfec18a7b4ba87b464b63b062f62d1bdb087121d200e863bd9a27fbf0396e5dea3da5c981aaa35b2098455d16dbfde8106de39ce0e3bd5f8462f3706433a0cb242f70ba88a12aa075f881ae6206c481db396e29b01efa2e5ca3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414d3ecc73a656ecce1da769a56fb9cf3866d57e581300a06082a8648ce3d040303036800306502303a8b21f1bd7e11add0ef58962fd6eb9d7e908d2bcf6655c32ce328a9700a470ef0375912ff2d9994284e2a4f354d335a023100ea75004e3bc43a941291c958469d211372a7889c8ae44c4adb96d4ac8b6b6b49125333add7e4be24fcb50a76d4a5bc10 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\1C58A3A8518E8759BF075B76B750D4F2DF264FCD\Blob = 0300000001000000140000001c58a3a8518e8759bf075b76b750d4f2df264fcd2000000001000000c2040000308204be308203a6a003020102021006d8d904d5584346f68a2fa754227ec4300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3231303431343030303030305a170d3331303431333233353935395a304f310b300906035504061302555331153013060355040a130c446967694365727420496e633129302706035504031320446967694365727420544c53205253412053484132353620323032302043413130820122300d06092a864886f70d01010105000382010f003082010a0282010100c14bb3654770bcdd4f58dbec9cedc366e51f311354ad4a66461f2c0aec6407e52edcdcb90a20eddfe3c4d09e9aa97a1d8288e51156db1e9f58c251e72c340d2ed292e156cbf1795fb3bb87ca25037b9a52416610604f571349f0e8376783dfe7d34b674c2251a6df0e9910ed57517426e27dc7ca622e131b7f238825536fc13458008b84fff8bea75849227b96ada2889b15bca07cdfe951a8d5b0ed37e236b4824b62b5499aecc767d6e33ef5e3d6125e44f1bf71427d58840380b18101faf9ca32bbb48e278727c52b74d4a8d697dec364f9cace53a256bc78178e490329aefb494fa415b9cef25c19576d6b79a72ba2272013b5d03d40d321300793ea99f50203010001a38201823082017e30120603551d130101ff040830060101ff020100301d0603551d0e04160414b76ba2eaa8aa848c79eab4da0f98b2c59576b9f4301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030106082b06010505070302307606082b06010505070101046a3068302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304006082b060105050730028634687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274476c6f62616c526f6f7443412e63727430420603551d1f043b30393037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274476c6f62616c526f6f7443412e63726c303d0603551d2004363034300b06096086480186fd6c02013007060567810c01013008060667810c0102013008060667810c0102023008060667810c010203300d06092a864886f70d01010b050003820101008032ce5e0bdd6e5a0d0aafe1d684cbc08efa8570edda5db30cf72b7540fe850afaf33178b7704b1a8958ba80bdf36b1de97ecf0bba589c59d490d3fd6cfdd0986db771825bcf6d0b5a09d07bdec443d82aa4de9e41265fbb8f99cbddaee1a86f9f87fe74b71f1b20abb14fc6f5675d5d9b3ce9ff69f7616cd6d9f3fd36c6ab038876d24b2e7586e3fcd8557d26c21177df3e02b67cf3ab7b7a86366fb8f7d89371cf86df7330fa7babed2a59c842843b11171a52f3c90e147da25b7267ba71ed574766c5b8024a65345e8bd02a3c209c51994ce7529ef76b112b0d927e1de88aeb36164387ea2a63bf753febdec403bb0a3cf730efebaf4cfc8b3610733ef3a4 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A MBAMService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 5c0000000100000004000000001000001900000001000000100000009f687581f7ef744ecfc12b9cee6238f10f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa2140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a2040000000100000010000000be954f16012122448ca8bc279602acf52000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0D44DD8C3C8C1A1A58756481E90F2E2AFFB3D26E\Blob = 0300000001000000140000000d44dd8c3c8c1a1a58756481e90f2e2affb3d26e2000000001000000ba010000308201b63082015ba0030201020213066c9fd5749736663f3b0b9ad9e89e7603f24a300a06082a8648ce3d0403023039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412033301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f7420434120333059301306072a8648ce3d020106082a8648ce3d030107034200042997a7c6417fc00d9be8011b56c6f252a5ba2db212e8d22ed7fac9c5d8aa6d1f73813b3b986b397c33a5c54e868e8017686245577d44581db337e56708eb66dea3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414abb6dbd7069e37ac3086079170c79cc419b178c0300a06082a8648ce3d0403020349003046022100e08592a317b78df92b06a593ac1a98686172fae1a1d0fb1c7860a64399c5b8c40221009c02eff1949cb396f9ebc62af8b62cfe3a901416d78c6324481cdf307dd5683b MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\1C58A3A8518E8759BF075B76B750D4F2DF264FCD MBAMInstallerService.exe -
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc stream HTTP User-Agent header 277 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) 1 -
Suspicious behavior: EnumeratesProcesses 34 IoCs
pid Process 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 1452 MBSetup.exe 1452 MBSetup.exe 5868 MBAMInstallerService.exe 5868 MBAMInstallerService.exe 5868 MBAMInstallerService.exe 5868 MBAMInstallerService.exe 5868 MBAMInstallerService.exe 5868 MBAMInstallerService.exe 5868 MBAMInstallerService.exe 5868 MBAMInstallerService.exe 5868 MBAMInstallerService.exe 5868 MBAMInstallerService.exe 5868 MBAMInstallerService.exe 5868 MBAMInstallerService.exe 5868 MBAMInstallerService.exe 5868 MBAMInstallerService.exe 5868 MBAMInstallerService.exe 5868 MBAMInstallerService.exe 5868 MBAMInstallerService.exe 5868 MBAMInstallerService.exe 5712 MBAMService.exe 5712 MBAMService.exe 5712 MBAMService.exe 5712 MBAMService.exe 3020 Malwarebytes.exe 3020 Malwarebytes.exe 3020 Malwarebytes.exe 5712 MBAMService.exe 5712 MBAMService.exe 5712 MBAMService.exe 5712 MBAMService.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2852 winupdate.exe -
Suspicious behavior: LoadsDriver 16 IoCs
pid Process 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found 660 Process not Found -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs
pid Process 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3200 JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe Token: SeSecurityPrivilege 3200 JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe Token: SeTakeOwnershipPrivilege 3200 JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe Token: SeLoadDriverPrivilege 3200 JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe Token: SeSystemProfilePrivilege 3200 JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe Token: SeSystemtimePrivilege 3200 JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe Token: SeProfSingleProcessPrivilege 3200 JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe Token: SeIncBasePriorityPrivilege 3200 JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe Token: SeCreatePagefilePrivilege 3200 JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe Token: SeBackupPrivilege 3200 JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe Token: SeRestorePrivilege 3200 JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe Token: SeShutdownPrivilege 3200 JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe Token: SeDebugPrivilege 3200 JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe Token: SeSystemEnvironmentPrivilege 3200 JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe Token: SeChangeNotifyPrivilege 3200 JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe Token: SeRemoteShutdownPrivilege 3200 JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe Token: SeUndockPrivilege 3200 JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe Token: SeManageVolumePrivilege 3200 JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe Token: SeImpersonatePrivilege 3200 JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe Token: SeCreateGlobalPrivilege 3200 JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe Token: 33 3200 JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe Token: 34 3200 JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe Token: 35 3200 JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe Token: 36 3200 JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe Token: 1 4660 WINDOWSUPDATE.EXE Token: SeCreateTokenPrivilege 4660 WINDOWSUPDATE.EXE Token: SeAssignPrimaryTokenPrivilege 4660 WINDOWSUPDATE.EXE Token: SeLockMemoryPrivilege 4660 WINDOWSUPDATE.EXE Token: SeIncreaseQuotaPrivilege 4660 WINDOWSUPDATE.EXE Token: SeMachineAccountPrivilege 4660 WINDOWSUPDATE.EXE Token: SeTcbPrivilege 4660 WINDOWSUPDATE.EXE Token: SeSecurityPrivilege 4660 WINDOWSUPDATE.EXE Token: SeTakeOwnershipPrivilege 4660 WINDOWSUPDATE.EXE Token: SeLoadDriverPrivilege 4660 WINDOWSUPDATE.EXE Token: SeSystemProfilePrivilege 4660 WINDOWSUPDATE.EXE Token: SeSystemtimePrivilege 4660 WINDOWSUPDATE.EXE Token: SeProfSingleProcessPrivilege 4660 WINDOWSUPDATE.EXE Token: SeIncBasePriorityPrivilege 4660 WINDOWSUPDATE.EXE Token: SeCreatePagefilePrivilege 4660 WINDOWSUPDATE.EXE Token: SeCreatePermanentPrivilege 4660 WINDOWSUPDATE.EXE Token: SeBackupPrivilege 4660 WINDOWSUPDATE.EXE Token: SeRestorePrivilege 4660 WINDOWSUPDATE.EXE Token: SeShutdownPrivilege 4660 WINDOWSUPDATE.EXE Token: SeDebugPrivilege 4660 WINDOWSUPDATE.EXE Token: SeAuditPrivilege 4660 WINDOWSUPDATE.EXE Token: SeSystemEnvironmentPrivilege 4660 WINDOWSUPDATE.EXE Token: SeChangeNotifyPrivilege 4660 WINDOWSUPDATE.EXE Token: SeRemoteShutdownPrivilege 4660 WINDOWSUPDATE.EXE Token: SeUndockPrivilege 4660 WINDOWSUPDATE.EXE Token: SeSyncAgentPrivilege 4660 WINDOWSUPDATE.EXE Token: SeEnableDelegationPrivilege 4660 WINDOWSUPDATE.EXE Token: SeManageVolumePrivilege 4660 WINDOWSUPDATE.EXE Token: SeImpersonatePrivilege 4660 WINDOWSUPDATE.EXE Token: SeCreateGlobalPrivilege 4660 WINDOWSUPDATE.EXE Token: 31 4660 WINDOWSUPDATE.EXE Token: 32 4660 WINDOWSUPDATE.EXE Token: 33 4660 WINDOWSUPDATE.EXE Token: 34 4660 WINDOWSUPDATE.EXE Token: 35 4660 WINDOWSUPDATE.EXE Token: SeIncreaseQuotaPrivilege 2852 winupdate.exe Token: SeSecurityPrivilege 2852 winupdate.exe Token: SeTakeOwnershipPrivilege 2852 winupdate.exe Token: SeLoadDriverPrivilege 2852 winupdate.exe Token: SeSystemProfilePrivilege 2852 winupdate.exe -
Suspicious use of FindShellTrayWindow 54 IoCs
pid Process 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 1452 MBSetup.exe 3624 chrome.exe 3020 Malwarebytes.exe 3020 Malwarebytes.exe 3020 Malwarebytes.exe 3020 Malwarebytes.exe 3020 Malwarebytes.exe 3020 Malwarebytes.exe 3020 Malwarebytes.exe 3020 Malwarebytes.exe 3020 Malwarebytes.exe 3020 Malwarebytes.exe 3020 Malwarebytes.exe 3020 Malwarebytes.exe 3020 Malwarebytes.exe 3020 Malwarebytes.exe 3020 Malwarebytes.exe 3020 Malwarebytes.exe 3020 Malwarebytes.exe 3020 Malwarebytes.exe -
Suspicious use of SendNotifyMessage 37 IoCs
pid Process 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3624 chrome.exe 3020 Malwarebytes.exe 3020 Malwarebytes.exe 3020 Malwarebytes.exe 3020 Malwarebytes.exe 3020 Malwarebytes.exe 3020 Malwarebytes.exe 3020 Malwarebytes.exe 3020 Malwarebytes.exe 3020 Malwarebytes.exe 3020 Malwarebytes.exe 3020 Malwarebytes.exe 3020 Malwarebytes.exe 3020 Malwarebytes.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 4660 WINDOWSUPDATE.EXE 4660 WINDOWSUPDATE.EXE 1776 WINDOWSUPDATE.EXE 1776 WINDOWSUPDATE.EXE 2852 winupdate.exe 4660 WINDOWSUPDATE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3372 wrote to memory of 3200 3372 JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe 87 PID 3372 wrote to memory of 3200 3372 JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe 87 PID 3372 wrote to memory of 3200 3372 JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe 87 PID 3372 wrote to memory of 3200 3372 JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe 87 PID 3372 wrote to memory of 3200 3372 JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe 87 PID 3372 wrote to memory of 3200 3372 JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe 87 PID 3372 wrote to memory of 3200 3372 JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe 87 PID 3372 wrote to memory of 3200 3372 JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe 87 PID 3372 wrote to memory of 3200 3372 JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe 87 PID 3372 wrote to memory of 3200 3372 JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe 87 PID 3372 wrote to memory of 3200 3372 JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe 87 PID 3372 wrote to memory of 3200 3372 JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe 87 PID 3372 wrote to memory of 3200 3372 JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe 87 PID 3372 wrote to memory of 3200 3372 JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe 87 PID 3200 wrote to memory of 4660 3200 JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe 88 PID 3200 wrote to memory of 4660 3200 JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe 88 PID 3200 wrote to memory of 4660 3200 JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe 88 PID 3200 wrote to memory of 4636 3200 JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe 89 PID 3200 wrote to memory of 4636 3200 JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe 89 PID 3200 wrote to memory of 4636 3200 JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe 89 PID 4636 wrote to memory of 540 4636 WINUPDTR.EXE 90 PID 4636 wrote to memory of 540 4636 WINUPDTR.EXE 90 PID 4636 wrote to memory of 540 4636 WINUPDTR.EXE 90 PID 540 wrote to memory of 2060 540 cmd.exe 92 PID 540 wrote to memory of 2060 540 cmd.exe 92 PID 540 wrote to memory of 2060 540 cmd.exe 92 PID 3200 wrote to memory of 5024 3200 JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe 93 PID 3200 wrote to memory of 5024 3200 JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe 93 PID 3200 wrote to memory of 5024 3200 JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe 93 PID 3200 wrote to memory of 2584 3200 JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe 94 PID 3200 wrote to memory of 2584 3200 JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe 94 PID 3200 wrote to memory of 2584 3200 JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe 94 PID 2584 wrote to memory of 2852 2584 winupdate.exe 99 PID 2584 wrote to memory of 2852 2584 winupdate.exe 99 PID 2584 wrote to memory of 2852 2584 winupdate.exe 99 PID 2584 wrote to memory of 2852 2584 winupdate.exe 99 PID 2584 wrote to memory of 2852 2584 winupdate.exe 99 PID 2584 wrote to memory of 2852 2584 winupdate.exe 99 PID 2584 wrote to memory of 2852 2584 winupdate.exe 99 PID 2584 wrote to memory of 2852 2584 winupdate.exe 99 PID 2584 wrote to memory of 2852 2584 winupdate.exe 99 PID 2584 wrote to memory of 2852 2584 winupdate.exe 99 PID 2584 wrote to memory of 2852 2584 winupdate.exe 99 PID 2584 wrote to memory of 2852 2584 winupdate.exe 99 PID 2584 wrote to memory of 2852 2584 winupdate.exe 99 PID 2584 wrote to memory of 2852 2584 winupdate.exe 99 PID 2852 wrote to memory of 1988 2852 winupdate.exe 100 PID 2852 wrote to memory of 1988 2852 winupdate.exe 100 PID 2852 wrote to memory of 1988 2852 winupdate.exe 100 PID 2852 wrote to memory of 1776 2852 winupdate.exe 101 PID 2852 wrote to memory of 1776 2852 winupdate.exe 101 PID 2852 wrote to memory of 1776 2852 winupdate.exe 101 PID 2852 wrote to memory of 2640 2852 winupdate.exe 102 PID 2852 wrote to memory of 2640 2852 winupdate.exe 102 PID 2852 wrote to memory of 2640 2852 winupdate.exe 102 PID 2640 wrote to memory of 1216 2640 WINUPDTR.EXE 103 PID 2640 wrote to memory of 1216 2640 WINUPDTR.EXE 103 PID 2640 wrote to memory of 1216 2640 WINUPDTR.EXE 103 PID 1216 wrote to memory of 4604 1216 cmd.exe 105 PID 1216 wrote to memory of 4604 1216 cmd.exe 105 PID 1216 wrote to memory of 4604 1216 cmd.exe 105 PID 3624 wrote to memory of 4036 3624 chrome.exe 112 PID 3624 wrote to memory of 4036 3624 chrome.exe 112 PID 3624 wrote to memory of 3644 3624 chrome.exe 113 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion winupdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1" winupdate.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3556
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_58ef8399e896e60b181961292fb6d666.exe"3⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Users\Admin\AppData\Local\Temp\WINDOWSUPDATE.EXE"C:\Users\Admin\AppData\Local\Temp\WINDOWSUPDATE.EXE"4⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4660 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵
- System Location Discovery: System Language Discovery
PID:4552 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f6⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:3884
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\WINDOWSUPDATE.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\WINDOWSUPDATE.exe:*:Enabled:Windows Messanger" /f5⤵
- System Location Discovery: System Language Discovery
PID:2476 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\WINDOWSUPDATE.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\WINDOWSUPDATE.exe:*:Enabled:Windows Messanger" /f6⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2540
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵
- System Location Discovery: System Language Discovery
PID:740 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f6⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:4756
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\windowsupdate.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\windowsupdate.exe:*:Enabled:Windows Messanger" /f5⤵
- System Location Discovery: System Language Discovery
PID:1376 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\windowsupdate.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\windowsupdate.exe:*:Enabled:Windows Messanger" /f6⤵
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2640
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\WINUPDTR.EXE"C:\Users\Admin\AppData\Local\Temp\WINUPDTR.EXE"4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 5 && del C:\Users\Admin\AppData\Local\Temp\WINUPDTR.EXE5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Windows\SysWOW64\timeout.exetimeout 56⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2060
-
-
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"4⤵PID:5024
-
-
C:\Users\Admin\AppData\Roaming\winupdate.exe"C:\Users\Admin\AppData\Roaming\winupdate.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Users\Admin\AppData\Roaming\winupdate.exe"C:\Users\Admin\AppData\Roaming\winupdate.exe"5⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2852 -
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"6⤵PID:1988
-
-
C:\Users\Admin\AppData\Local\Temp\WINDOWSUPDATE.EXE"C:\Users\Admin\AppData\Local\Temp\WINDOWSUPDATE.EXE"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1776
-
-
C:\Users\Admin\AppData\Local\Temp\WINUPDTR.EXE"C:\Users\Admin\AppData\Local\Temp\WINUPDTR.EXE"6⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 5 && del C:\Users\Admin\AppData\Local\Temp\WINUPDTR.EXE7⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Windows\SysWOW64\timeout.exetimeout 58⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:4604
-
-
-
-
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffd8482cc40,0x7ffd8482cc4c,0x7ffd8482cc583⤵PID:4036
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1840,i,3913783707917315457,8910233052634459219,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=1832 /prefetch:23⤵PID:3644
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2156,i,3913783707917315457,8910233052634459219,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2184 /prefetch:33⤵
- Downloads MZ/PE file
PID:1512
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2296,i,3913783707917315457,8910233052634459219,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2488 /prefetch:83⤵PID:3312
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3076,i,3913783707917315457,8910233052634459219,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3180 /prefetch:13⤵PID:3016
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3220,i,3913783707917315457,8910233052634459219,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3204 /prefetch:13⤵PID:544
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3876,i,3913783707917315457,8910233052634459219,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4576 /prefetch:13⤵PID:3532
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4720,i,3913783707917315457,8910233052634459219,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4712 /prefetch:83⤵PID:4868
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4724,i,3913783707917315457,8910233052634459219,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4848 /prefetch:83⤵PID:4344
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4440,i,3913783707917315457,8910233052634459219,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4928 /prefetch:83⤵PID:2476
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4696,i,3913783707917315457,8910233052634459219,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4428 /prefetch:83⤵PID:740
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4940,i,3913783707917315457,8910233052634459219,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4748 /prefetch:83⤵PID:3616
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5344,i,3913783707917315457,8910233052634459219,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4836 /prefetch:83⤵PID:4872
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4436,i,3913783707917315457,8910233052634459219,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5456 /prefetch:83⤵PID:684
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4764,i,3913783707917315457,8910233052634459219,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5448 /prefetch:83⤵PID:4344
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5796,i,3913783707917315457,8910233052634459219,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5748 /prefetch:23⤵PID:5600
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=5896,i,3913783707917315457,8910233052634459219,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5920 /prefetch:13⤵PID:6104
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=3300,i,3913783707917315457,8910233052634459219,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3392 /prefetch:13⤵PID:5200
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=4048,i,3913783707917315457,8910233052634459219,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5512 /prefetch:83⤵PID:5744
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5876,i,3913783707917315457,8910233052634459219,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=6016 /prefetch:83⤵PID:5736
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5620,i,3913783707917315457,8910233052634459219,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5264 /prefetch:83⤵PID:5964
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5252,i,3913783707917315457,8910233052634459219,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5308 /prefetch:83⤵PID:5976
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5948,i,3913783707917315457,8910233052634459219,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5116 /prefetch:83⤵PID:2384
-
-
C:\Users\Admin\Downloads\MBSetup.exe"C:\Users\Admin\Downloads\MBSetup.exe"3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Downloads MZ/PE file
- Drops file in Drivers directory
- Checks BIOS information in registry
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:1452
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=4872,i,3913783707917315457,8910233052634459219,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5672 /prefetch:13⤵PID:1504
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --field-trial-handle=5320,i,3913783707917315457,8910233052634459219,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5264 /prefetch:13⤵PID:2476
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=6296,i,3913783707917315457,8910233052634459219,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=6256 /prefetch:83⤵PID:5136
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=6236,i,3913783707917315457,8910233052634459219,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=6116 /prefetch:83⤵PID:5284
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --field-trial-handle=5988,i,3913783707917315457,8910233052634459219,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5776 /prefetch:13⤵PID:772
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --field-trial-handle=3208,i,3913783707917315457,8910233052634459219,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5696 /prefetch:83⤵PID:216
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --field-trial-handle=5304,i,3913783707917315457,8910233052634459219,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=6056 /prefetch:13⤵PID:5284
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --field-trial-handle=240,i,3913783707917315457,8910233052634459219,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5276 /prefetch:13⤵PID:5220
-
-
-
C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe"C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3572 -
C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe"C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3020
-
-
-
C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe"C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe"2⤵
- Executes dropped EXE
PID:5676 -
C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe"C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe"3⤵
- Executes dropped EXE
PID:4652
-
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:4128
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:2516
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:5868 -
C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe" /installmbtun2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
PID:4640
-
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe" /Service /Protected2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Modifies registry class
PID:5288
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2c8 0x31c1⤵PID:5368
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:5336 -
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "9" "C:\Program Files\Malwarebytes\Anti-Malware\mbtun\mbtun.inf" "9" "4ba9030c7" "0000000000000154" "Service-0x0-3e7$\Default" "0000000000000140" "208" "C:\Program Files\Malwarebytes\Anti-Malware\mbtun"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:2652
-
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:5712 -
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:5960
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:5572
-
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMWsc.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMWsc.exe" /wac 0 /status on true /updatesubstatus none /scansubstatus none /settingssubstatus none2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:6620
-
-
C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\updatrpkg\mbupdatrV5.exe"C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\updatrpkg\mbupdatrV5.exe" "C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE" "C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\config\UpdateControllerConfig.json" "C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE" "C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\dbclsupdate\staging" /db:dbupdate /su:no2⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:6440
-
-
C:\Users\Admin\AppData\LocalLow\IGDump\X86_02\ig.exeig.exe timer 4000 17413767892.ext2⤵
- Executes dropped EXE
PID:4208
-
-
C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exeig.exe reseed2⤵PID:3104
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
5Active Setup
1Registry Run Keys / Startup Folder
3Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
5Active Setup
1Registry Run Keys / Startup Folder
3Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Component Object Model Hijacking
1Defense Evasion
Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
2Safe Mode Boot
1Modify Registry
13Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10KB
MD58abff1fbf08d70c1681a9b20384dbbf9
SHA1c9762e121e4f8a7ad931eee58ee60c8e9fc3ecb6
SHA2569ceb410494b95397ec1f8fa505d071672bf61f81cc596b8eccd167a77893c658
SHA51237998e0aee93ff47fe5b1636fce755966debe417a790e1aebd7674c86c1583feef04648a7bc79e4dedaabb731051f4f803932ac49ea0be05776c0f4d218b076f
-
Filesize
107KB
MD583d4fba999eb8b34047c38fabef60243
SHA125731b57e9968282610f337bc6d769aa26af4938
SHA2566903e60784b9fa5d8b417f93f19665c59946a4de099bd1011ab36271b267261c
SHA51247faab5fff3e3e2d2aea0a425444aa2e215f1d5bf97edee2a3bb773468e1092919036bcd5002357594b62519bf3a8980749d8d0f6402de0e73c2125d26e78f1e
-
Filesize
8.7MB
MD53084e61d7ec183685908bc90aefa32c6
SHA1302357c243a0d8db5d51fb0b995de85a5d12b278
SHA256486126c0d68a371e90f7c135ec46510dd53c1164f644c72be57716143af53eb6
SHA5127ef31dc0e2ad9ccbc936d0931462db2fdd17b88d06c6bd162c9f444bf7c1a77f5ef5afe18128398418b5d7447d049ab18eb97b0a3d6cf46ccc2393e0294d8c33
-
Filesize
2.7MB
MD5e04e61828c9fffcee59cd90ef155c90f
SHA17a97b65f11d2b3f30d8e2dde4c44bdf16f3d3b24
SHA25605d4d87f43646f7ca2e50520d8850e8808748a508c2761838d5fb92d66d6ce35
SHA51204792b998628cde88bc2601534678e55b2d6fde290496e5af08a2955a992ca3bb767bd025dca4373abc55141de8d270f62f628e51c887de54035bbee10379ce9
-
Filesize
291KB
MD574adfb1f3492af639732d896b84eb639
SHA1f22c35601ccfd35953760ba6c0d32409bdd941ce
SHA256e1a9fdcfaec9dd8e70054d706ff61325d427ce84fae71984036ea7d8e531d9ae
SHA51237fb397fa50a3396bdb7872e1279312b6c122a3dc6588e07bcee735a864f0ba93b687997fdc362c2ebfaef225c77b08d2c3a3168f5c17aa6ef79a636261d56fb
-
Filesize
621B
MD5aee69fdf889d8a703e711304ff81cada
SHA1bfdd270ec4f47943f958dc3f18d1046c7aa77fb8
SHA2560225709fec40da5bad97f46bc1317c088c158c2bd96920ed30d1ca4abfe150fa
SHA5123b966baddcce27fc6d75480961d9d3add823cc853f7a22f382f48d66c0d3d9b5ecf694a28c54f93474955f2d69a529d6f924b0c5ae7a9498aea1348e3aa9c312
-
Filesize
654B
MD5b04e5e88eb991aeac7ea16853256edb7
SHA1699cb0e7914801c0d9c0c582f72ac38810ff3555
SHA2561a30b635096e5a61c133fd4ea5cb25ff4a59d7ddb247ca975ecdbee7511ab86e
SHA512499940e3f0ce0f4c310089d83d32121351e33af1f7bbfb147c49944dc75ee602f55e175078107f6e65e05c6ae668e6e63f545ca8ce3360f27e38367002f9695c
-
Filesize
8B
MD544f850482fd540c6f723898a992cb593
SHA1937e77cf6f6c2a3d803588e9523a975402a18d94
SHA25699e6170cabc08fe64c3ed5e5b0f60dd016a31489fe512960ae1a2c5c8b004d48
SHA5125602ae0343eb9a8deb9a77f4fcff76f0d9320fe28d0fdeb9be78c5f4f1d62985c2e61ec3405c8fe3bb02e967eb3e76fdaba17eccdfec5e792a7a3948bded13d2
-
Filesize
2.2MB
MD5b39ba8b6310037ba2384ff6a46c282f1
SHA1d3a136aab0d951f65b579d22334f4dabbebdb4a4
SHA2563ecbcb6c57af4456111f5f104b8fb8a317cdb0f16e98412249f7a2d62bca584d
SHA512a8b98f47c30503029f2dc80398dacd5f8fc07db562d04c56b8c7902bebf11517223350c41850b81aca770ebc9e68fc365921bd6cce34b57b2c945f1c51b538b7
-
Filesize
3.0MB
MD5552132510df12c64a89517369f07d50c
SHA1f91981f5b5cdef2bdc53d9a715a47d7e56053d6f
SHA2563bfc8b26e3a44d2444837b2125fb5c94eb9901faf3d49a8a5de1e2089a6b50b1
SHA512c30a893fa36a056db5ecdb765bcc0fc41adb02696b22a30130737d8b1a9d020b30bc651d45c63ff73b621459eca3668aa51e4a71b01b00a499bffa941cd36930
-
Filesize
2.8MB
MD52bbf63f1dab335f5caf431dbd4f38494
SHA190f1d818ac8a4881bf770c1ff474f35cdaa4fcd0
SHA256f21a980316bd4c57c70e00840ab76d9ad412092d7d2d6a2cff4f1311f7c05364
SHA512ebb9834323329dc01ba2c87e5fad1083a4cb86f5ed761cb63299ac5336a9843a1aadd42fbed706797c2295117af1c00f96806422338352653c8e0255fecc2fd5
-
Filesize
1KB
MD55d1917024b228efbeab3c696e663873e
SHA1cec5e88c2481d323ec366c18024d61a117f01b21
SHA2564a350fc20834a579c5a58352b7a3aa02a454abbbd9eecd3cd6d2a14864a49cd8
SHA51214b345f03284b8c1d97219e3dd1a3910c1e453f93f51753f417e643f50922e55c0e23aab1d437300e6c196c7017d7b7538de4850df74b3599e90f3941b40ab4a
-
Filesize
113KB
MD52ccb84bed084f27ca22bdd1e170a6851
SHA116608b35c136813bb565fe9c916cb7b01f0b20af
SHA256a538caf4ac94708ddb4240d38b1b99914ca3e82283f0d8a2290be28fc05eaccb
SHA5120fd66d241bdebd0052f4972e85b42639e3c5a40affe23170b84bc4068dff8e84446898a77ebf7cc0bef97454abb788faccce508a68bc5e717980ef26d8436986
-
Filesize
10KB
MD5ddb20ff5524a3a22a0eb1f3e863991a7
SHA1260fbc1f268d426d46f3629e250c2afd0518ed24
SHA2565fc1d0838af2d7f4030e160f6a548b10bf5ca03ea60ec55a09a9adbbb056639a
SHA5127c6970e35395663f97e96d5bf7639a082e111fa368f22000d649da7a9c81c285ee84b6cf63a4fccb0990e5586e70e1b9efc15cf5e4d40946736ca51ec256e953
-
Filesize
2KB
MD5d87c2f68057611e687bdb8cc6ebea5b8
SHA127b1311d3b199e4c22772fa1b7ea556805775d37
SHA256ff93773f55bf4a6a0242adf82276a8c95c0b244b9bc05e515c4e810c81a960e8
SHA5124aa65b8911d8a2a0f9ef0ee6e934b94db0a9ad4c2ec543b5edcf21486be43f6ab1fda6617ea2cbb85eff230628c9fa8e7649da915d6de695803b28e55bef5819
-
Filesize
233KB
MD5246a1d7980f7d45c2456574ec3f32cbe
SHA1c5fad4598c3698fdaa4aa42a74fb8fa170ffe413
SHA25645948a1715f0420c66a22518a1a45a0f20463b342ce05d36c18b8c53b4d78147
SHA512265e6da7c9eede8ea61f204b3524893cf9bd1ed11b338eb95c4a841428927cccbed02b7d8757a4153ce02863e8be830ea744981f800351b1e383e71ddaad36ad
-
Filesize
11KB
MD5a4e1b3baef2bd08db952a4bc84a6a8ab
SHA136dbc7ce7f8015352e711aa485ba19a725c7926f
SHA25677af283bc5037f84246a69a41ede4eb8e8a00b776752ec69356f3722a060c91b
SHA5126bc5b00e614a5f1028a01aaa6aa38bc1941650aed6f9738fbf5b5d75d12fd1acbf7e90b42bbdc6ecf569444a14c9c4e422d5cd77a6c475ea89f4ab1284e65e55
-
Filesize
2KB
MD5358bb9bf66f2e514310dc22e4e3a4dc5
SHA187bfc1398e6756273eee909a0dfb4ef18b38d17c
SHA256ff51780a5a854b2c18f71ae426cb066a13723ef6155e24f4910137c9e8dfdc17
SHA512301ec5ec5c0813951843011f2204924240235494999136ea30a557cbf58146fc6043a8866b344fa7deb927d7c83d44e2aaf45adca7d221aba5d36715b9a63e09
-
Filesize
198KB
MD56dac02d06e9ac695dfb2e0d0aba9bd3d
SHA12d11078037a5288bbb831537601aac5509966467
SHA256c70e75264fa5ec083d31188f3e659b2dee0f09d81fe4849b91862f631d54dfc0
SHA512314ad60ff9f14abd37997be8095afdc15c3cbf52257c190b2997de0570a4cd1c15082b82b0a0f7188fcd4d4ec56723b00bd19b3a1bbcfdc791d0ecaa798e2e85
-
Filesize
64KB
MD5df6294ebabdd2abd54326506fed501ba
SHA1c079c9b5853278ebf3e1811232a50c85429daf26
SHA2562d56e4369bdfaa5aacc1b656c4e00d162c5096b4b6af6e2efe7b4993b80bc597
SHA5126967cb154c582955a51f44e2d61227645f0d6cb9c94179d9f51f16d24f6444685c9aea41a89625f3d6ff360a7bbeddd6a16582a25564ed41e2b89992d4ec516f
-
Filesize
11KB
MD5a32881b0be849d96da6b6bb6d7be8890
SHA15d10d9005ccdb722fce6c2b8ab29fca0dad60e36
SHA25645db7e4a12a3565dccc019f1337f71d58d1969841354cc6b6e867f43352c2615
SHA51238bb2887a3814ad64a7af6c327fdc37f7e086778f3bb7fdd0fad64914ffec868a7eb21b2af29912f1a711509f6f2f35e49cbb7638b3f48b1054a5684eed7d81b
-
Filesize
3KB
MD55a9717e1385703e8f06b27aa10a69e87
SHA184ee67a9167b5eb6560711b9871de98898ad07a5
SHA25647b7c516bb57c612de19f0ca865590af95b6e32bf873a0fef9e011b2c5b483d4
SHA512dd3c7278c2c11ad15a55fae6d19b96dadd92f85b7f0c8ce934298258af00bb5c052a84a98499b8867b0f43704fb307c67d03692ca69dda4d814c6c17dd73df44
-
Filesize
228KB
MD51258a8e1beab105aa96c93aa34dd9ef8
SHA1a435a462a0976135e2257b46e52b576fabac3d34
SHA256d86b9b20788b6bff70a1a4c4111b2ea33b9ec705cc6b8fe869362fc3899820a3
SHA5128feb56e3d5d67484c97f20348899673d1b8aafad35cd339bd6c459194fa0f0f9e07b0a7063615b010378a2788cd11ef9e3744253a24c8fcd0d960d0cada77546
-
Filesize
9B
MD59e5d32c87a4c96692e1dba76841e5097
SHA19a8e4fe3fb581a32b48b6f7ba5251bc3bb026548
SHA2564ed31aadd5843b7227a2b79e3b7385d0ce951e1d71377eb668d0686ed0b50c3d
SHA512d8242d52ca08bdaf207662ac2e24dc507e1a92d687d163426c085fbb841f159ce8e5ec04087909d94c69f04789b28acdd2c4e68829e995bedc87ac90960de9e4
-
Filesize
47B
MD52b5fd9fe1f2786c62ccf2b4328c001ac
SHA1f415e81f1854795a587f2f2077a740d932430fa5
SHA25608234e2f6c4e1d1b292908f5b22190f168e8ff8418d2a0f80446308065c64dca
SHA512bd13dd3259338fad79d6260abe3c7d31a9405e21cf7d50344ed1104b85b056edda8955dccfcbfed1cbb20b934e3f9655e8a1b928dc0769bb99edf5aaecfbafc3
-
Filesize
1KB
MD52ac4684638716a4eb8342bbbf4f75d3c
SHA13b28518b1d3fb7f2392197d161fc25a3553032da
SHA256e86228e53d74776d48fd61a56af7ea45b57bb992719fa80e0831faa854edb162
SHA5128ca6ee45eb54c5486334a2bb71c07df11aa26336e5bd3aa1d0daa162266628d5b172738dd0b2eb05062a3b66e0562d113192c7946a66483a570d69ff8cc2172f
-
Filesize
43KB
MD54e011e2b8999e874bab7ccfb2204a137
SHA1a6e5f5ba429b4f058ea74d52eed80e7958951efc
SHA25612cba976d3bc5f26e3b0af74c4bd2983eed9a7d3c4df170641a968e6fdd7d925
SHA51207548bd54560b170cf4dec86394c6176acd42347c54a8992effe24075e69a84fa4832171721acec44ea582eb7ff76404d4d6bdf33c2364568ef43897ce7a65ad
-
Filesize
1KB
MD5dc7a5cca76b0a4b8009aca1b10fe8217
SHA1d3477259902db5cede3d857913fad80706587749
SHA256223911583fabffa946712bd88ae9b25552e4f865d90f18b6d387577cfc99bf4c
SHA51201fcdd9e9d3bc015a48145c05b426172afbd054fc1db6a0592d6abde106811df2c7b660fe0cabbb7f5fb23d8df2a470444218a35e6343ed99d0db9e89f70ce5f
-
Filesize
47KB
MD57d93e61361c56b7e285e18d54a9b01e7
SHA1dbb89ed775ea177087c113ecc7acbb5a792ea451
SHA256be2042b8780da5057aa3348cc918ab0f1a930d3f2374cf0a440273b926356c56
SHA512d4f3c6d52a56c2dce7e66332feaa22ea5be4f2653ca4f9b1e53a4ebc1f1207136fdf1bd279c0760a1538b4ffd907e4ad085c0e43872d0ea25efb0eec01cf5032
-
Filesize
66KB
MD522fe0ddd63bfb466790058e147a22771
SHA1dd878ec14ba80b8ebe05eb06e783bf6dfc8e3c3f
SHA256319843ca59569489a4268b88d89746fa6ee0dbd6b648845dab1898e31cd57ecd
SHA512dfd63a8d7d2158440eee3b1be0cc1f2bc0d290b99f234949ad403c09b098f0a07b741f1fa5f9f50140abb565eac0df706094c436e6c5ea5a4cb8666fffe7325d
-
Filesize
66KB
MD5040395e2698f85f7b4bc198040c9f989
SHA15939bfa6f3922fc5236e55e9cf4b491fc28344bc
SHA256d78e505f0c0800c3d8b1f2c2554357bb3e028f25136fdd8ac9fff78cb2f664c9
SHA5121669372ce13590d6d22d8dfb4c390a84fc48d2303c44b80612dc3863fbf9e74b274f17c48b4039b9ece68616aab5dd032c6108f6d4942045142478da751ef5a4
-
Filesize
89KB
MD5bf8d7977860e147f2851e595dc695573
SHA12475f964ca523608fc9c5f7001a72073df557fb1
SHA256dc734634c94b071855ac5ca19258b39298720b78db8afcb47bd35b2b673a2706
SHA5124dc802b4485cebc906ff7879c23970365432b43f346f7557ee97cfaf997bc4739ae09214c93df0b6c015efd821a238cc0a5f157bb992f7813f51ca2d441e47d8
-
Filesize
795B
MD5a15f5cbe077a3597c90b6c0b17c5d101
SHA1760ffd3fb972c6bf01669eb1e25f36676058db15
SHA256c4878deed3d60eb735de9a646e46b4bd1f5a2977b4ef71d0af602ec9dd1a9cf9
SHA512ef0994e0e0f8eff437febdbb55dabc3157f4b5255e3047cc52cd9b9090845bac458ab54547267319222c709ecf10c9b1f404925238e09156469377e5c827b0b1
-
Filesize
796B
MD5d439cafe500f3d5b2cf18d6eb5252163
SHA167090e834c6c04b2a88b168c0e113ffae9a564f7
SHA256477521c5021c8782e77ff6a5b2e7be504e22ae3263407c20783548e88eeeba16
SHA512053a473e9388e3e40e7cb60439272ea3d24707e9ef938ea0388174842f2cb872444e00a063ff8ccdb92f34f45b6d02716aadebc5fcf7c2999a4c37746227ed47
-
Filesize
797B
MD563e466b05883fe7eb55fe57b52cecda7
SHA10e8ff98446322a3fa34e0c3682d062a5af74fc87
SHA256691b4e34ea5c0d54983af0eb0f333d59209c79d44fca295754bddfba0099a72b
SHA51246a2c0b3209ce6e963301ed0145322263232543bd475628ceecd4b3b84ea00fd6e2d0724a48971d8a87011a149cbca0575ef08bb45380225a6b3e2c9e28701a1
-
Filesize
847B
MD5db073fd83e4452d9f8f4d4b3e745a755
SHA1f0cada640144fde6ed735c012e03dc1de9e5ef5b
SHA256442507b3f2dad683e79e306957e0165e18c521ca4cb1f03934fae41184706cdd
SHA51247cd087a8d93a8ae0eff646afb64484b65dad3d9169f73a3d94c95bd3ca7b8b3763f66ece55feaf745b2a083e1cad13fc9a860d5bc97aac964fe3b4c8d1da012
-
Filesize
846B
MD5c7c5c2da7d231256eaaee200ba184b52
SHA182ac93b5597fd49fe97de8c4b46fef4642611c07
SHA2565be267d1990539205b969d55c7fce9e71719084d867f22495a2a06f9536eaa21
SHA512d50bdc57a6be01ac855a7121550a2bd1511239c7896aeb8263400d7689889fb78917b715f242633a7983050ec6316e7818ffc98e03a26d39a895d60eb7f8122d
-
Filesize
827B
MD5cd127570051258fd1f7d5df181ab4a80
SHA1c0e08d8ca214bee8b03b08d82249375e4e75d28a
SHA256e9589ecce52081278c5d383a8ed5424b5a0494118bdc555cc8695000b73e1a50
SHA5127c0123ab0254384ac939bae98e6dd9fdee9457c109aadd79c52288d4d2bed7b5211c115b86b0a33fe96da1dd4fc8b18da821264d3aa4e014fc9c96b2848a998d
-
Filesize
1KB
MD5aae8211738d81ebb378cccb1951a697d
SHA1f0f30b0e03dbc6a4a06dbdfdd4bb2107bfd1861f
SHA2565deb332983b8320607ade30efa092ba8e3feaea0efae23c88c4ca0d4a2900885
SHA5126be2947558574d56867fda218d9a627aa9074724b004354ec30ca277e65bbc9f44afcf4ef65014f7650ccb11e7d61c0e88a9d899e30867e5e30b5af819b4ea94
-
Filesize
2KB
MD5241ab054aa2d8006ae1130f441508a8f
SHA1778c927b02191687403a02f3f2560149c1a33fb6
SHA2568947788e750c1980066cc29a200b5d3ad351d7ddaa72bb14b7fa3b55f3cf3ecd
SHA512620d50ca69822e6275d7cdd8a21c5a653e2eb157f2293da76305d04f7b1db7f35cc16c00483d0df1f2ae9ae91baade1b013e7fa242cb2a192dc8c1f8fc720530
-
Filesize
11KB
MD503bbce7fca30919bd190a7224f5afa33
SHA18e32a962b81cab1a8394de8f501a260f23fd2ef3
SHA2560e8df2cab26990aafe3aa4ad8f3bfeb2cad049727ac990a412421cfb373355fd
SHA51201afdb1402c6dc3f8f9fe06eff74b561163dd014521315c02174b6f0f040eda3d5b87a57ae66ad47dd5505b8fbc097ece8ed63f27d260402285ddae056f0b2e9
-
Filesize
12KB
MD5d14e5a1749409f411da4f62e92780468
SHA105f8ad61f2136050e4e0111d514705bb9c27ac25
SHA2565a4fd6e7465c8c900d871753cea1727b66902c117dd91a92c90bb9e5ec851f10
SHA512a80b0d6ac65f4a2620a3fd57c6e2cd9e36c96d2c364743fa79a0a0e928deca3ccd04605d87f8f7c8d6201d8badb841d5ba8200daa6b81c1d7e8493a6b9554ae8
-
Filesize
12KB
MD519837ef12adbaeab9f652d64002cae99
SHA1bd8b5df64ba63ed97d1d06388b970ddeb97ca144
SHA2563b33819c98d8be844742e20029d4e805bab7490cdae836091589145bef48055c
SHA5129af888687836aeb462fc71af01be83890bc38b498133128d03e7087787baf9cd9bc412cb79b48fd4bdbc42c1b91ace82ae793be817f56d210c5630fdbacd97d2
-
Filesize
12KB
MD542be8d45a0c35e4239c4ebe4fa9b4cb5
SHA17e4af6de7a19df836e7fd0955b4e500436277b00
SHA256da2f954ca6aa92e6489dd820dd62ab7d4601e260de5d1a450d7ab2a7abcc86dd
SHA51233bfa74c4b860b546ff7155bb943bc8762a774001d5ed91a7fc5630ac7d911e80ba2089b06d3d4d2ce3928e07847295eef2ed050150b07e867664f453b7c613f
-
Filesize
1KB
MD551e9d3866b45cae26298d4174afbce02
SHA1f71ad298d6e48b2a9dc504eb4913e6230d3f7abe
SHA256fa52daf36754d895156f5cfe6ec4d935c32ef67248b5699720df4620ef46deea
SHA5127a7efb6a5fa822395a1aaad41389592f266303686f98948571b429584df11b47edf2d1d8fb3e5deb5d1694afa45994f45bd4941ff5d6f21f50d801e9a45390ed
-
Filesize
2KB
MD57f171ba3a396b326472ffb7e24a3fcff
SHA16f2a3b2714f0e1881262391d5863ad95df21e6a0
SHA2569ce82ccb5f19fd4790df13d91fd999707dd1e3c38fdfddbd88cc41e629df20c1
SHA51233c2420706cfe47bf354d0c496cc106e31c269a1e439e92f6f2e61a8098e96e0890dc3808b331ccd94144ed298ef43f29e5d0e4e1bced5099549514ee7280f12
-
Filesize
814B
MD53cf622b72e9f59f40bb91088a9c61dc2
SHA1541491bc9f5dbbee963af83d5003d857f8cc7542
SHA2567445e4365f5c931d7b8a5466de962d46a0e39ec7470871f60f48fbb359561b1d
SHA512d86f9cbc609965e369a230c53d753d4996dab1e8eebfe74bd95f70ec2ae0d5881e80b35b7326953e45c893164857585e217c1efa6630327c1653f02e6e716769
-
Filesize
816B
MD53cd5659ac102a287c0da9fce071525cb
SHA178ec8296df5e6f960c7659d79750855f8fa81cba
SHA25696d512ff2ff46b742ab7d98a9505b59b1eab2a897299e067ed75de95601a0b29
SHA512654dc2edff039340e2527f9fb429c61f3a847a46937f7a630093f05f8ce93b1cfcd2eee8fa132a43eb34b19046b25750eb5f542f2c586595599f9fe9af5fb112
-
Filesize
1KB
MD57dc958d74fbc52c59aa5943a8ce48aff
SHA1e50898546b2ed18d8357413aa6bdc7cc812b2118
SHA2566b2e052c706ad632a593508c3bf7c0b6499461b10fe9e19ba89b8e540bdad8bd
SHA5124deb4d2f496d850cc523eb696d39ab41ea1a13b2c9a5f3e813e535c35e71130d2e65f65c956d78bea0202b750cd1c202dac8a4d8fbba6afd3cfca1274b42cfff
-
Filesize
1KB
MD58b9ba4916faf00da4431ecc536ace639
SHA1e4266e1943681557090a58b117b2eda0f7a07ebb
SHA2565530b9bda346db2d403ed165cd52f8df92c33b3fe176f4cf6702f621e808f614
SHA51227e5b502d431321dab8447358185af3edd7c199b760568031e12a2bcfa50e66c28610ec4532d9a44102fa935d5559042b92956e399ccb94994d48698be950ed9
-
Filesize
1KB
MD52efedcde76e3cb8457f7dc30253e6a93
SHA1fa2539d1b9026f7bbe61787fe8fc08ce7617ae4a
SHA256ca338d591f9e63bf4917aba3f14d7b87dccff5c913e55ba2a460e34e2532fb51
SHA5128d12fdc2042d80385cd4c20e9eb09181f717822791d37e72ae374fe2ece31452ffb04c8d2df82c56689d7a2f646c206d16d1372e3e1bea60eb46d85a87c39522
-
Filesize
1KB
MD521f847539b89504ab3ba2a42c3162066
SHA131009b6bc524fd12c2c603cd8811cf52320519b2
SHA25682dc377a166508b846e50233573df07bb98a7eb3fd59ef8a3fb7728882344598
SHA51277af0a8bff32c9047bbd4bee02ed58ba89fedcaf3c59a018c4bafcf64f80c96862277c3bc876a7c4bf26d5832300df691250c51af1acc2c78a4bd3984cd7d57c
-
Filesize
1KB
MD54cc47828adc9c33017532a8bb8426f05
SHA1353912024c96983097b45d4fb20e9b4d6b169f08
SHA25667494abedd3676455f8e156f1e89b5664f9614b5903ec94f763f766b833a94e4
SHA512ffdb84c3dd7fe6f31a8c7953313cca8cd7b75d4c39d316449cf8f64fc71369d6274752adaa7963968e24fc781e77d5f136dfa3ad140f14f945d5ba8b9b887329
-
Filesize
1KB
MD5ef81f7472789fc65c9b9a0bd2962e6af
SHA192c0f77120766b60b7574292e864d6aa714fe4ad
SHA2561734c5e0ad6c8ccfe7e6d508b4e5e15239fe3b70222a9c622520e52c3a634ba2
SHA51224c82d20a586e5171dfb98df55aa5847bcb85f911e88e6be5e352c8261a838b16298d523139b9c9a07fcf32333abb996ffaa3cfc19b6680dd1b9232d78277afa
-
Filesize
1KB
MD51caef354181223d1e21d37ace35cc92a
SHA1a6cb00c57f6d5799c3e3d9f5bdbc870d4fa5d3ea
SHA2569b801768f84c0c83cd4c8b6f064442d8e5d90499338e5b45374d6357a3f51dc5
SHA512b736a96f803f364109896a36ba9335c80b28c5380ad2dd5bcbeda2497e7262eee8f159ae516133bbdf6e5c8e635d4df99c1bd988d28bee6ee8addebaf701b9b0
-
Filesize
1KB
MD540b4176404350956502b801db1c601ae
SHA1b09252758cbe52d3405715388ce38de5614079c8
SHA256078e0b4efe6ac93e1f3c08ff835834af7956174c98947ff31d28a6840e909286
SHA5121b53d6358f40f3a10b9b22a53e7e7e8762c5eb37b6ac9215390d7e5b58ef3116ab00bb2c30aa5c8ed42a0f275bf4370325fb3b9c01543791e259954206b45d9a
-
Filesize
2KB
MD59abd7df7a64445cef90a15bce053b704
SHA1c7ba2156fb89e69c82b9fff65077038af1442565
SHA25654187622e6f35fb2366b8602d0d687cfb17e3817ae454b7808befd5e152b2f87
SHA512921dce193aff2006d07a0e37f85aff95ec4c1c523d12891d2a4ae5a615df10e1d47125f0f9471cde1e0f01767183c2f6921b8de7726e3f7d77edcac47dd3a97e
-
Filesize
4KB
MD50e15aaa5df306d9d4cb1ebdae091521e
SHA161a5b76df6b0eaa4a88e3e7a6b2a6471f9ebd40c
SHA256321a99b968f5ea7821a2c8464858708d1cfd71c62c6df3b4003738491615371a
SHA5125ba1862fdbc77ad1f55a08f740be0bb34962d0809988ca7c342d596c9af7c3adcf686c458b169f813d9de9ae219dac8b722e5c84c6918b80f5be0a28c44ea41c
-
Filesize
7KB
MD546bc07e7bba3082b45d5a8520c438081
SHA1018d39928a5bf725d289bd8090060f381f97a8dd
SHA25635a05d95062e388b76bddc8a68df86768fc87b61545b80c706ac2483b4ded763
SHA512528dccd2c3a350dd4369cffa347f4db2de1012a3da9769f8ffb17bca6f53bab65b3b09a94543342437680211d91e43de4ba62d258d8b1fe6b6c0f976ed99cd33
-
Filesize
7KB
MD5ab765989a654369bf268ce34c8a3a5de
SHA19201ec41f384b46c95c83e9f92b78ee97c298649
SHA2568236ff0e1bd9d409e90409b9519780481bc174aa40d55b9db4529178421b966d
SHA5129007f638fcd212a7196cf2c47e8e734d23c0fc7e5c32d3c2e5bf499d78475ab9d2fc30ff0635cda67d7060b8bd548ebc02e32ccadf877257a97689d6c6095241
-
Filesize
7KB
MD585b808a66a1b5b15c9238ad6aabaae6a
SHA14400a5a9363b19c8946bcf516242656555eccbdd
SHA256a09995fd347d1aae6dd3fe7780270be82b19d18f9e2c36d21896b4b7fa23aa78
SHA512611d83b6f19844df531717d51830485320e63afcbdd0c860e8b91e1d55b9f8e2897dadbea71ac426d9ea4a4f0ee28b62961e099a1110a165fa5d9095c9bfae91
-
Filesize
7KB
MD5efda57871be560fd4ca24b668d14f209
SHA1d241c2243ef221421935b88272d3e7d9a0dfb905
SHA2566523ee659f11b797155aea18c7fd70ff570c4d6c69eae4d6106c0b0679905fd5
SHA512ae7f371d951e11ac344b22ad42a90975e70f6b1e07aa1ce4978e9b5c5f2d42b0f5fc55436c336bcad99c342de3d70e4db9de676c0c4ca0175fcd9e46f4620c38
-
Filesize
7KB
MD5e58200dc5411d9684da6deab9d86f0cf
SHA1a51268e7fb7096c8b8e76ce4df5e59355f2622dc
SHA2561cd929ab64a341c60c82c185de674f56528297d91058ce6ffbd05fa6fd4cf4c6
SHA5127911b8efcceea7061160b74737126bebd4d73b958ee2ec2bc0de9a144d19f3488abf08c03c15db1c79967740c3640fd7cd8c4f3791004953d0013403b29174e5
-
Filesize
11KB
MD5fcac3b71bf6db1b5509c0fad134cf2fa
SHA12892a1dc76e3f5bcf884aa2f8ec007a9411966b3
SHA25612abeee88729890e8dd9554ed3595221208c2493fb6839cc1a750ae4e4d0a2f0
SHA512c1d2460961eedcf24cb5a0bd8a3164e8ba91123e79a1eee79c6fe0ab1a1e0194febcff7f8d7b36da8ff4515825d0d4218586d10892699b1cbeeec43f7335df8d
-
Filesize
11KB
MD54206fd59be5f5cf8ab9606eb1d151cc6
SHA19ac96663408f1ce7cc1a03ff247c499df7950d09
SHA2561af9c65f7c2c7f45423d56b067f53a6beefd1778061cbe19d74fc96d05d0af2f
SHA512a759a435e3135fcd00aeb06528cd72a7bd9c95f32cf92af75cdf99cff5de948c3aa18399c713706c32b58ffc6b1996ad5e38799e53122142ed66635c7a895d59
-
Filesize
1KB
MD58c95903ee09920c65f7e8fe0813b9db2
SHA118463129421cd61e17f09f4af3f99e020a95ae56
SHA2565ea823bfa27b9517339e7dc80e8ae9e6f258c1dd4984fb44ecb8086adca07461
SHA5125a7a9bf6850af70780dc19aa190cf2d116d194f4d52d4fad04f2d05beacabe412d14db9d53931a1eed8d571e7ac1898c5660279e2741da8abb0e19050655d663
-
Filesize
1KB
MD5fc06e10a97a60fd6db5337c2be5f4de2
SHA1ced23c787428735ebeb0767bf3ee1cd6f281e3e9
SHA2563a0356310a7114e9f9cf4d65f52742e735d821eac77ddb9e79c4d59c31491080
SHA51245db9d7d2231504f148405ceeb15255e577086e385e7e5f8e4758f95cf9cf56d726adf6cb18de54d789aa50028707abfa00e128a9c9c3844d13270cdb27d27ce
-
Filesize
1KB
MD5e87c68d19eb110e07db5d152f97f2681
SHA12afc51899209bd6591131e57e92f4b32fdf16fb0
SHA256fd40a03ab8c66920e1f26f26742ce8619e27e3ac28075cf8acbd4977ee6c3ad7
SHA5126f5caac4db7ed09b3782c53278175f3e0eb5c4d5b8422b262461e8c357aef98f0aa3c57a14b91bd5d1b4600089297fa316415ac3a17f2c05db814107d99c0380
-
Filesize
1KB
MD5af5ae674b56ea7ed59a9dfe2f05f86c5
SHA1def5f83750ebd8e32e1bcc074023cab7705ad6c2
SHA256a0203908374961d9dce9902046f2841a5d87912bf419189b6acc0831ae866fdc
SHA512db1f828d791a26de42f3d7a739607f7fed5b10a44f7cd703b322c8346f93ce2bca7540c14e2a0a402f0a6de1852e3bdec73b53c31e5c9f0295ce515dc196edcb
-
Filesize
1KB
MD5adddc07584c48d602641f670ba91b9cd
SHA1baeb60cb826e307eb867bd24bf90ca9642b57eec
SHA2565e08a1009d6c5d003aa102fdce8a03e752278781b3eeec4f2365ca747f840896
SHA5124c511ca4c400f372d8bef84323489ae8efa0beece6696d0a6c4bb8ba2ea7c17ea9aed782d7557eec2bbaeda0179a2a7e84b35875b2d44626adcf29bce6d2ddcc
-
Filesize
1KB
MD52bc0d9fe4696f61b350d2cd8644f030b
SHA19c429e7ac574d5570ec220487a91f310851a799a
SHA2564e27a40467ceb6b5ef83a77ca04f7e67098c536ed1030c83c56c92e9f0e52f72
SHA512ca66e958fd33ed20f5118ffaab7e25d9034ce2f5d5f5912938b0a3c0b0f125984886cfefa23d27f57728b1790b63adc22ae681cb80fbd298da418c48107884fd
-
Filesize
1KB
MD589402881609cf2901e002b9810fc710c
SHA1bfff578daf2c8f6acf2a212347f28c0c465e122c
SHA256252bd2d03941b939f42cc25e580c2422e64eb6944314bd3d28bf52c31cf680eb
SHA51207d826fa6482b9d8a28060c9be32b3418992c1639df3a4f1f558231e46f45a4085d47181ae6789a112d63e1f1ad9e413107ef00938166a04f14f8cd7657b369b
-
Filesize
1KB
MD579a82776b769d5b7bc1fa4bb7ce2ca92
SHA1eb5daa6e350672206aab3a5c445d19bb6c76c83a
SHA256a087bf2c6849b8ceac53e19310c76c0a3e9a999147e8ad5e94d4279f83b5d8e3
SHA5127077c831c28757ecc2cacbde63ee9002a1b75ea993fcd568d552c0c9087a4d02978d98c15d71256ee7ac44bb41d432ae80608ad4c0b82d551810cba3f3cc2ff8
-
Filesize
1KB
MD51c9c581e7dd2960a5c5b0d60c796e99e
SHA1532f35b128ef72d7f1776a997c956962c28ec7df
SHA2560f2bb61baba0da0a3e5de283e207447727d4f19110a109afac29e7952dd2df9a
SHA512563060a2bbf9a4e538a87ef09935f80105af7f89ed4e6f9047632cea509e601fccb240f3efb2980f4858e55e2783e9f7f0b2f8e833d70a500373b01d4ce191f7
-
Filesize
1KB
MD5ce884ca7d367842bb85726289688573d
SHA1043f7a46471cd8c4739d0d648cb358795b82cf9d
SHA25684e523739926ddff502731b382004cc91a71f1541653d635cbce2919dd958341
SHA512bbe6e525b2b986d5a6937044e5930d6381e344c33a979b7b364fae6091e473f13747fe08d72412be22cbc81f382968e56de07463144f3d852bc9772ef61630de
-
Filesize
1KB
MD51541ec2c87fbb5c76a14aee4e7bfad00
SHA10941ab9b69630d632aec9cd7d0f6a00cbd35cd29
SHA256bfcb0805e6fb9e36d9fa727715539373306f2dbcfa701d9b982085159851f1bf
SHA5120051e6d57de6bf25a3945da1e725c754cb98297c4ced4cddef2034452ebcf00cd622caa744170671362fbafa818a8b161e6521811abfb99154bd739adebfcfb3
-
Filesize
1KB
MD5dac0a38e65671735ea4a41e27c0ae1a2
SHA16b8287bd1a73c81e98e2b5ec28f4cd2354044a41
SHA25660b992dc4c82c6d4e04f93661d23b94d65b976ddb2d895a811d340d7423de4f6
SHA5121686bba2a01b994c9439944194aa28f0de15fac0c213ef0fa2ff68dfbe870586e4c0dcd3a2e1d86402335398fe6cdd029757e94441b3a1c4cb0800348f4629d3
-
Filesize
125B
MD596b02e16d74f8603faaf739e55164652
SHA12dd2fa25e259d54ca8599d2b25a8cb5411a36e7a
SHA256faf828b8d7ccfb5abec33ea93b0a6285ff3f31f7ec5cb6141f930c8ef0f71b18
SHA512d8b0495509049cf2c8ff89f56a76777d4d3e41e08d56b0afaae3b351907453a70dce911563104f57fc96db874a5433ebe8c6003264ca2ca0f473c9c7376e7291
-
Filesize
4.5MB
MD5f802ae578c7837e45a8bbdca7e957496
SHA138754970ba2ef287b6fdf79827795b947a9b6b4d
SHA2565582e488d79a39cb9309ae47a5aa5ecc5a1ea0c238b2b2d06c86232d6ce5547b
SHA5129b097abeafe0d59ed9650f18e877b408eda63c7ec7c28741498f142b10000b2ea5d5f393361886ba98359169195f2aceeee45ff752aa3c334d0b0cc8b6811395
-
Filesize
5.4MB
MD5956b145931bec84ebc422b5d1d333c49
SHA19264cc2ae8c856f84f1d0888f67aea01cdc3e056
SHA256c726b443321a75311e22b53417556d60aa479bbd11deb2308f38b5ad6542d8d3
SHA512fb9632e708cdae81f4b8c0e39fed2309ef810ca3e7e1045cf51e358d7fdb5f77d4888e95bdd627bfa525a8014f4bd6e1fbc74a7d50e6a91a970021bf1491c57c
-
Filesize
338KB
MD5181d1b26db6ba77d5d6a3e135a1654bb
SHA1d44b405d83b0e3af82fabd21c2209a362dbedd62
SHA25639cb2bd1d43fd20d4c3f0fa7a4c69e18293abb1bdfd1e39941426f50b6d4be40
SHA5126ef62425dd0484a4b4665c9edde3ff3c40ebb06b9a7987cca2875306c941f8aa729dff5379f7ac2c08eecb61824d86b1da577acbc652cb16e3686ccf0439517d
-
Filesize
30.9MB
MD510498a72d9c7ea11f14f8bde2c7ba616
SHA1738f0705bf12affcfc24b7c591d44c1c3750f5aa
SHA256db41f81fcd048e6090ae8e0dd742244a301261dc7ad3428369c1701b026a2b15
SHA51284c7f2bd2a4d231fa124266e173fa69e8db0ba75261119eafa899da1e080c766687de5a6aefdeb3f88c369a6575263607e4c1544ba0f9626ac832b57a55ffbaf
-
Filesize
935B
MD5de80d1d2eea188b5d91173ad89c619cd
SHA197db4df41d09b4c5cdc50069b896445e91ae0010
SHA2562b68990875509200b2cf5df9f6bdfcda21516e629cab58951aac3be6a1dd470c
SHA5127a8f5f83552dbff21be515c66c66f72753305160606c22b9d8a552ab02943a2c4e371d17dce833020d2779c6d9fe184a1e9ef3d1b8285c77aeb17b2bba154b3f
-
Filesize
41KB
MD5321869028e8254c0b9869a68d357a71a
SHA1c6c0b8e327465bba477005edbe511419d40a4d26
SHA256ddde9e4b0c340dd2c33b388b59e495fa92e28009ceb7b294531abf17eb3aece0
SHA5125231f29149214cb19503f164ae355cf675cd233295f8823fc41bec3cea67e802e973ef195ab5f9aea298fa657918bad8a9cad630ff5b49b5eedcd13c662bbeae
-
Filesize
924B
MD596125a3c5c367bc9d90ba19f1c39fabd
SHA1ede4ab3dcd117cd41e6fb5dc8eeefdf13920025c
SHA2568ac1c089f3745b060962e877568940e6594ff5da8e1ac5771ef3c02a671e0dd4
SHA512f3105281b5186d0290743631cf592292534d1a74e19da23aea472b2231fd24b70d8dd0bb179f9686af8cea214de439e0a723554e5f129ed1362b64ff8b99b822
-
Filesize
39KB
MD510f23e7c8c791b91c86cd966d67b7bc7
SHA13f596093b2bc33f7a2554818f8e41adbbd101961
SHA256008254ca1f4d6415da89d01a4292911de6135b42833156720a841a22685765dc
SHA5122d1b21371ada038323be412945994d030ee8a9007db072484724616c8597c6998a560bc28886ebf89e2c8919fb70d76c98338d88832351823027491c98d48118
-
Filesize
23KB
MD5aef4eca7ee01bb1a146751c4d0510d2d
SHA15cf2273da41147126e5e1eabd3182f19304eea25
SHA2569e87e4c9da3337c63b7f0e6ed0eb71696121c74e18a5da577215e18097715e2f
SHA512d31d21e37b0048050b19600f8904354cff3f3ec8291c5a7a54267e14af9fb88dfb6d11e74a037cc0369ade8a8fb9b753861f3b3fb2219563e8ec359f66c042db
-
Filesize
1.8MB
MD53789224ec141ef0b7f4efd86ab0b17dc
SHA16960f2b651359577439bafe57fbbeac759b99037
SHA2562d563da1db554aca0a775f65e91bee1b928dc6c803430f73e997200d8cde8601
SHA5125640d157248f859c0b02b7754550b76cbcbdde0d25b91812b7d1d0c86cbd712faf95f9e8a559afc1b527e1daaa29e1c62b5ad5d536b7a52510eb2b72e4b12c40
-
Filesize
514B
MD58f778de7c8d55e4735efbc753be46014
SHA1f1d7413e57e7d1077b5a8168ab7a663db5224806
SHA256986608a8b5f4fcb382a194727af4ccd36a03b128e451e9f7803ec5298722af26
SHA5129474e47153ad5e596c6c26730ad6709554e68037c50d0b603a4a71027b8e19ea0b7387ce3b3592ac3c07d9ebe1e71dbc90a234b3928ca2c2eaf6af4337817fee
-
Filesize
24B
MD5546d9e30eadad8b22f5b3ffa875144bf
SHA13b323ffef009bfe0662c2bd30bb06af6dfc68e4d
SHA2566089fbf0c0c1413f62e91dc9497bedc6d8a271e9dc761e20adc0dccf6f4a0c1f
SHA5123478f5dcf7af549dd6fe48ad714604200de84a90120b16a32233b6d44fa7240f5f4e5fe803f54b86bbdfd10fa1bfdd88fb85eb6a78e23e426933f98d0a2565ec
-
Filesize
24B
MD52f7423ca7c6a0f1339980f3c8c7de9f8
SHA1102c77faa28885354cfe6725d987bc23bc7108ba
SHA256850a4ea37a0fd6f68bf95422d502b2d1257264eb90cc38c0a3b1b95aa375be55
SHA512e922ac8a7a2cde6d387f8698207cf5efbd45b646986a090e3549d97a7d552dd74179bd7ac20b7d246ca49d340c4c168982c65b4749df760857810b2358e7eb69
-
Filesize
10.5MB
MD5b30d5b9bc495bf34a57e3d67deeeaf26
SHA1ed2ccd27635eeef75239417d0c0b5d3265eed03d
SHA256782a5ea931729ef71dedfabe5b9778ef8275a3f96a7075e93edeb3f3372e4480
SHA5124f319c284399ec9ae31505a4850256d4f3289575778136b97ca51a436f1b1e8f5273da42632762a5e89059dff748626c67809f8598878591174a30f8f15396a0
-
Filesize
528KB
MD5066fe2077f9a8a997e40e2391565b61c
SHA159f12935d29cf60f51cb0893d1475d6a56ad5ed3
SHA256d9f1595366dcd8dcb7631935cd2ff301df82adde05ca5b9bd0dd4d43fab37e9e
SHA51291450387c549786ed15622bee96c50cd84b25fd109061854920aa510628cb7ee4b3213e1d3c1aad956f4d7c7bb96b519b5933d1c9fe612d37a1385cf51d8b906
-
Filesize
571KB
MD56ec2c8ddd84a54a64adefb6187fc84f0
SHA1c276e00b0b9abd96a8ae8ffcf624ea7f13c7bf18
SHA2562d7fcb5336d6c25e64bff75d063e1b9dd761ddb4fb2d727a966bd5019ab20c8f
SHA5122b79dd55814482621f21010873c6e4b2ea7b765f594cab2336f60ec1f27499e1ad069906621f48f1f6f4e93d9e738eff17061afc3cfd7680a0f54e77a7396e22
-
Filesize
148KB
MD5b486b3009e8e94514c6e62faf90a65df
SHA1d26e1ca5aad93bafcdbfb32d6e1950bc9c7c3bd7
SHA25657c9ca122e930da4d144f5da9695db9c17751ae0ddc38a869b7adcd5e7833121
SHA512af87d72169ff34f76a556e28c1e2a638c428ae6d10400da254eb08e1bc7b3410b9de512f4a40d19ba68ab4ec5e976ff0e8a99382489cc44db92b23fbd1527ddd
-
Filesize
19.9MB
MD50f3852fd5954352391c1d35ad3ace6be
SHA1de664edf3637884bd10e8cffb1012658ff5fd94e
SHA256432b4227fac6823ac81d04bd202b3a39dfde3c93e4cd3c4234eba00241e66c25
SHA512eca9f187a95a1198c04bc593447f3eb5b7a53c39492a31844442a77286f9b611c1aeebc9013bc12e280f169e3c647569b78945ec342bc2e68e2ad9b7ba60b3c7
-
Filesize
75B
MD5f8417c8f25c13c03fa0c0fed4cbb39f0
SHA1111c75111f70a4a5da3ae28048dfff5dac0a673d
SHA2567d80dca16853137c2b53fe4b8745d00c0789df99e1e124a3a118201522e4674b
SHA5128a3aacdbe41946cc03295db2f44e8a040bc451f75c4050a170ca9be1c94e83f613aa86ed2f8af7649eb68bcf2c98185eaa9bbc69d5653fc32613174f88a3a406
-
Filesize
2.6MB
MD54ae5b2843ac5a5380465cb735e1e7aa6
SHA196a885853139d84283bb912099979a5ff7639cf6
SHA256b2b67621405eadde60621fa1b3d3c4f06c2d6c700aef4da0bae6271895379856
SHA512e0022f64991945c332e4c9d470d69221584dfc59095e7149cd6ab1c9fb32a63a048e2d65fc294ec866a018e0a5dbff37907eead96453668d8a6f70e4432622a9
-
Filesize
5.9MB
MD5c41e65a4673b1a2d1e05914e4d246d35
SHA1bd2a5b575018c8a4c65058097c3f0ffc655593ad
SHA256aeb17935e9f412280f1f58b49ce02bdd4387d793541058acba0d15eb295b48eb
SHA512003914d45d02d155ac5b23de64e6ce491bda2335ca82fa9f059d90a5b792746c76d70bd2714b62898b56150dd228b44696679b9d22315368d326ed39109cfd66
-
Filesize
649B
MD559a5be8da2a9df6690d2ff8f9c192bec
SHA1d799da882401715b19cb465b06611de2b642c279
SHA2567923537b089d301ce86686f039ed4cd72e004e3e914597a5bc4887152283f7bd
SHA512bb236db680c624e1c39e9b29e1b84bbfa41b315b8376a85e6771e4935fcb263163b30fe4db1f368ae728cde6b084a516700fa8b06818330adc284da573221969
-
Filesize
864B
MD5a571d931b10b6c8a13ad7d7f9b1d8347
SHA14ca364d9a2fec11d02bd493599ed8ecdc98e593e
SHA2569934933eede0a9ed88711931719a0de16e289ae16db4c743cf0446fa08700b45
SHA51225d0653f2feaf5b6c1ca948d0981730d2e176cc3f28bb0104256673c18bd395eec347dfd39a87f8c63f62b0ccc2bef8924b59a17f33415e24451de64f4c34368
-
Filesize
1KB
MD53f7faf7279cfd60d7ec5f763c218a302
SHA113f3a8868ae72ea68a044ea3fd4c63c70f41027e
SHA256a66fb5115fb68ee6b66e517e80c9f5f26485f4de1aa4f8a02c122122ac46efd4
SHA512c685d54253461a45e47d7aad59ff8f2a54043a43b4366b73345c46ead40c5eb623d9a98a92787865ed1281964db8c73791ab987083aaf045c8e6e3aa7bbbc97d
-
Filesize
264KB
MD59ca408d983bab36dc76e5412e4c096f4
SHA15356bda778e2c1b9650682b3ad41156c191d05fb
SHA256e6ef63a3221c295a7bb7ce9d69239ff20ee8142fd00b209240fca96305a0a310
SHA512f2747f1f409572a7b79f26e219fedf9f0ef0c8e626567f0ac70b3b0253a446f04f372a474876006a018316ae0bce24a7f8be44ed0c516788ad67b47abf756822
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.89.1_0\_locales\en_CA\messages.json
Filesize851B
MD507ffbe5f24ca348723ff8c6c488abfb8
SHA16dc2851e39b2ee38f88cf5c35a90171dbea5b690
SHA2566895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c
SHA5127ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.89.1_0\dasherSettingSchema.json
Filesize854B
MD54ec1df2da46182103d2ffc3b92d20ca5
SHA1fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA2566c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
SHA512939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
-
Filesize
9KB
MD55c74a7d105a0b74ab23a94cb920e9543
SHA146f11ecb2fb80b2017cc562f832c281359790ec0
SHA2566372acde45651ff1ec8fc623bf444dfd91f2607b0b006c38620de1c440b33890
SHA512fe5c879d894e8959eeba636b3bc3e2808517f3059687f693a19d92c2b37c3b9544bfd3b2daaf36717b90158b8e5c9e5e4097210ea9d24071f3a3f439ae028135
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
1KB
MD5500765fea5b4d3a899fdee853241d530
SHA1b38416027b5067bd7273aa405beb7666b7febb9f
SHA256c9097bab3c010c437ea29f720a69a51762016d56991d54dbcba84b26d86c9caf
SHA512ca66fe92829f0c49e6a578e62675dfe97946b7ba24725102476bf7707e471769e79ff15c7e1088e11416c20b98c72bd15674fcf8ae0a1954ef9ff7269e9e5128
-
Filesize
356B
MD52994fb218e33504c676e819ffab720ba
SHA1e834450b9452298426ec20264643c7f0b18cffc3
SHA256844a3828f0ee8d491baf2c35291339a02510e887b8bc21589b36e0168381ffa7
SHA512e028ab4d7d5105e57846382fe279f2bc29d3018df1ba12fece0f266a4e4419d47738a09ed776dabcc93023a7097d3aea4b7e2ce8e3438f68406bd30a66a407c8
-
Filesize
2KB
MD52844a9e6cebd9eac4e9ac1e9b6112f80
SHA138265a98eb3c9f76633630b942e75a3bf7bae7ab
SHA25640861eab7e186b9d65009bc6706896262cb445efce072446e239acfce9e692cb
SHA512a7d725d1af883baf360b72529a221860a3a6ab47da4ff2301458d62e1c6ca6f8bbfd8af87d10ea6b0796ce73a30e95e6d276f3715d63bcb8c3f8c7a20f107c95
-
Filesize
1KB
MD5aaedc2543af9b629b2af47c57542fb9d
SHA1ace4c05c9b45ebdbc68be0d1d5c3a38e159ed421
SHA256bffa29ba5ad3254a558ce337867b226dda1dba5bf81b073901e21211a8bc8733
SHA512c2d2ed513d31d9c9b2a9080769e4d9a2133842b6dd04c22bf038e840ec59b8d5a79f01ed8911e434bffa90fd10a3129c4d6054bd8899c851c3e0f846ff5d38cc
-
Filesize
9KB
MD5a85212f713fedfc9e36b5b9ba8d01d5b
SHA1fc68236c306db25032f49d06e1ad03dae2c37b8a
SHA256f218c780b0e5e1c5e9caf221c439d009ffbdcd2b1c16291ccb1f57859e712713
SHA512a92e0bd22455e99a43a3737450f7978405b6ae9dc5b9d9f35d96cdec111e4297e5bf63d7e5313837873040ea6d024dffbda5740c426ecdc8f417d405692759c0
-
Filesize
9KB
MD53951a7ccb3d4efdee5f0c160f841fd2c
SHA18ab121cc40b6344f490a1c8a27e6abcff78d6917
SHA256425f9988d6940aaed2b5851d5214b1cef64d31c613fb28376bc21d35729b7142
SHA512c5ff5c056b5648debabb98ea8269e6f178fada904cf7a4bf3ab3d891ce1d72d25fb69a78f5a735165dbac6c0f47e2f983895714931b6db39b1442832410d2189
-
Filesize
10KB
MD57e1f06a9568fb8e5bb30b67b9505992e
SHA1d880a1011b79def6e24c1604027836ab204942be
SHA2562fcd8c75efae7e1f24e71450967cec3f8144c9e101ce8eb1dec18fd0408d4c5f
SHA512bf3d051149380e41a2f405874db2fe128dcb18dea881d38ff124788816552c9ffa9b2de4e4d3ef6ffd21631fa5720d61424576d737c0feb4e68663db0910f0d7
-
Filesize
9KB
MD575d20087ae10390893d79bc8459c61e7
SHA13b4511ec4996f50afaa4395d4c92d518415034e7
SHA2566ef35d87f523925cbbba159f2e3c7332ec283b25f6f06b4a7230dae7d27cb41b
SHA51272b0d1506b9d6686fa62ba2d03fb5e8d0d5a6271838ce2774994a46d89badcc9874875f04806706c6ac5670455586a002d6b83b9a7d24e1e2bd42eda8ba26a73
-
Filesize
10KB
MD596fbff33ebdd28547c79b25449bacc3c
SHA1381461c0634182a07ff8b0d8436ae3626f9c811d
SHA2561d863e23573a369ccaaabc4a2a1b38792eedc820e2f4420cc86c43272a5a7d13
SHA5127e0187b45fae1b83e10e9c25b21f6a46cd631105b2eaf20712dbfa4593ffa9f0570507b53b67d443c4f296a08dd2b2b29311fd209bd04e7ab1dd7b60c8eaa60e
-
Filesize
15KB
MD5274e58e97c65f00f0fce6b9f0e393437
SHA14affd7f549ddb2884ab68ee27af590ac0360bdf5
SHA25617c2c8f2268c13de35b8431873ead63b34b4b425be0ea8c124a2abd32286702f
SHA5128e480ff19f3578a81a95538c48fc121a0ebe2836a2ead3998cfe2bbbfcc0018b1af3a771d42dc6a6ee52a46c96c431c46301ee8305fea3a2d8cb851ddc613880
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize72B
MD5aafaf68b8057225b9d3dae80f7ee6567
SHA137ff678fc9de7e1fb1d37065b6ba4e3f7427fb0e
SHA2569121f1d9f8b4c5003bdd9f0c9d2cf2b42878fd90b93b14bc1ce7542022269a55
SHA512df77d3585e0b2f45823c37efa2e3d0859eeafe85c679cb0af5ab59274fe8d19d827646af2f89e616a47aee9a437fab10f2a1f9a45e7004d5a91d55509b686ac6
-
Filesize
246KB
MD5368e3c7263fc58b9e0ca6076248c0871
SHA101a989f332400aa78d8fa36e9ef3310c2e992fc2
SHA2563c311c2e58d4c1c7b071652aabb7a2e7eeeff41d18d4a1d9bfea29df975bfa82
SHA5125da678a588f63870ed617c78f4baea3f47d612fce019624e49c05c0e018f5d702db53bca38ac91cb9bf7f6dfccff5d8247163ddd50746ba5957c38512c818899
-
Filesize
246KB
MD5255ffc859de7ed5585472e5e6efb2e9f
SHA18d64db2a66eb64f268c92f537a72a7981e428127
SHA256a1ef99275f655d7e908cf7d7309984fbe56ff5dbda2a0c81942265aa9eba249f
SHA512c57924d1ac63da6518a8a2d31b61113430c0a448d2882043ba1586ce8a989493590049d69d443ed09dbf0eae16682022f8e2d267e88598b236446c50010c2374
-
Filesize
246KB
MD56280df50399614952aae1c1fce5c80b6
SHA1e299b957632e2ea35efdb5ef376324c738924293
SHA2562431b415dcce063706c813216fb02aab8c4b31270af90bbd28ecb440bb73315f
SHA512e54ff1beb03a718627dfb479fb783722745a65c777947d4cb7a291a2105d458f66d01086ece2d8e9955596c705c35c783b1e92850f733996b02056a122b1d1a0
-
Filesize
246KB
MD54bd222f53aa216181bc1a84416d020eb
SHA13c6583c058739aa6d05cc14713ee62eca23d6645
SHA256528f358892f8ac3ef640d49e7f74c04f4c0c69bb188e3bc0ae958fcecad1a26b
SHA51249d8bdbf83ce09b75174aa726207caa12a0d213c497813b8d90ced2c3beb619eca1c65f000967499651c3789452ff2e44b39849cf007b2822e8a622df8f8e175
-
Filesize
163KB
MD524e2f8699579dc971a255076c08e829f
SHA15b45b15f4993d3112083b73806415d5eb587b9ea
SHA2562a05046af890c5c4daa47277ccf630ac99228709ee489bd5517ba019fd0f5750
SHA512de76329069c601feb874159360a28e3106dca47c05b069cb4c1d25e80a6fe7a44e6fa756a83c9f4d7da0b1f27628e389aaa60e2db7ae29d5e6d47537acce4a84
-
Filesize
340KB
MD555642a17d2b2f4a3b0622380cbd7a398
SHA154a6f1c9d6f207af5dcea9557b420fade8a30f82
SHA256c8bb9bc16ff8cebc7ec50e94c4d6ee1c884c5bbe57c61b5dde520e953845fca0
SHA51283084e5595f4e5e226f4a924100b8f9d9707b15966aa54956a0169b84c1e852b55f82280f8f9014ec78ece6e151078aa51c4ae2e841f23a44b9c060ad24d0948
-
Filesize
711B
MD5558659936250e03cc14b60ebf648aa09
SHA132f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA2562445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
SHA5121632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
-
Filesize
150KB
MD5eae462c55eba847a1a8b58e58976b253
SHA14d7c9d59d6ae64eb852bd60b48c161125c820673
SHA256ebcda644bcfbd0c9300227bafde696e8923ddb004b4ee619d7873e8a12eae2ad
SHA512494481a98ab6c83b16b4e8d287d85ba66499501545da45458acc395da89955971cf2a14e83c2da041c79c580714b92b9409aa14017a16d0b80a7ff3d91bad2a3
-
Filesize
114KB
MD54dd07a122751ef8ccbfe3e08472eadb1
SHA1f464e924e948caf5ec5017b2cc0418f603a9c79a
SHA2568d44ab9149fb07384bdd677b529227726b608c726c57f1710f5c7f08f645bb54
SHA512f7a067cb8f844c8b0924006500e18a13026f120c2a7c9e5ff21fc7c1af80d6a3b9f537e3cb9d7c7975a3bd96ee4ab29c2df2198e6abd7b4328fb75af07c58e9c
-
Filesize
1.2MB
MD558ef8399e896e60b181961292fb6d666
SHA1d5b651f75234877814d8efabb6256fbc23c662ed
SHA2566deff5735317a9b7addf8d9f8d3aeca1de68364e63b69037b2c916bcaee44003
SHA512b9c4059148ff6ff96b376b69450a5234b4de8684ef41173601c24140da62a2b623f4117f5f483be478c9542be676cd705511d9540689b247cd44215b8c2f7b37
-
Filesize
2.7MB
MD51e17ceff00f18d129b514bd6b01d9e85
SHA1e2e5b38df2052b7ed3f95e3f0e2dabc079c64f29
SHA25664517ef6dd936d54c2ef6a6edad5e018cef9facd71693b9a94dceca2847fce6a
SHA51273ace5997c333a8c9d0279a77f51e335a724c39d7bd450b4aab9b162bd5eccc4d457536abab663ce539046e91e6e57a04814426c416418d077ef8320ad672b2d
-
Filesize
37KB
MD5d9fec63641c7580193b24837efcd950b
SHA1598b8653a5e6b3131ac3156163953b84d788a6ab
SHA256d38a97cc6d7ab337b6091c39fec8c08b3554d131ed4e8595a1ad4dfc1056d301
SHA512731ffb01c01a16fa9c1f2f453a56adad35c016487a8efac6dae97e3af22aa78e098ce2de273c79063894d19392956ae35f20ac15ad37305578b982e8617ddbd3
-
Filesize
37KB
MD55c235b6e593f2632b45d8885b459dc71
SHA115c7ef21ff5f55c7d4666097e13bcc15a28ec4b1
SHA2565393f7db340e0a4110ddfcbccece3e26098ee6ae745b6f03b91193e007cda735
SHA51273d6b94bf96e9099cf99c53c6958a8b5639a0ae5065b4bcd171c949b66679e9fe10555759aef296caa0dd9956d5432626ea2d9843a15e2c9413a0dd1a66cc51c
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAEBE581FCB73249406FC21094EA252E_BC0CE803EF41A748738619ED7838EEFC
Filesize5B
MD55bfa51f3a417b98e7443eca90fc94703
SHA18c015d80b8a23f780bdd215dc842b0f5551f63bd
SHA256bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128
SHA5124cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399
-
Filesize
78KB
MD58b5756ca12a24cf1529c40898ee06d67
SHA18da4e28e0e75f42dcae536b4280deef4202a6990
SHA25641b9dd1d972b84b01d6f8ff06c83437b0c59a8a7d3e230867d1d3eed4fd93072
SHA51291cba900cd92af2299bfec36ce582c04250fbd535f43a31af222bd00613c8cc2d05898a45b8d86355bfcae61d9a0b82c943cd98f6745a7cbca681cdf23a70a5b
-
Filesize
1.6MB
MD53430e2544637cebf8ba1f509ed5a27b1
SHA17e5bd7af223436081601413fb501b8bd20b67a1e
SHA256bb01c6fbb29590d6d144a9038c2a7736d6925a6dbd31889538af033e03e4f5fa
SHA51291c4eb3d341a8b30594ee4c08a638c3fb7f3a05248b459bcf07ca9f4c2a185959313a68741bdcec1d76014009875fa7cbfa47217fb45d57df3b9b1c580bc889d
-
C:\Windows\Temp\MBInstallTempa0f0d97dfb8c11efa3a3d6a26ba1faea\ctlrpkg\Malwarebytes_Assistant.runtimeconfig.json
Filesize372B
MD5d94cf983fba9ab1bb8a6cb3ad4a48f50
SHA104855d8b7a76b7ec74633043ef9986d4500ca63c
SHA2561eca0f0c70070aa83bb609e4b749b26dcb4409784326032726394722224a098a
SHA51209a9667d4f4622817116c8bc27d3d481d5d160380a2e19b8944bdd1271a83f718415ce5e6d66e82e36819e575ec1b55f19c45213e0013b877b8d61e6feb9d998
-
Filesize
154KB
MD595515708f41a7e283d6725506f56f6f2
SHA19afc20a19db3d2a75b6915d8d9af602c5218735e
SHA256321058a27d7462e55e39d253ad5d8b19a9acf754666400f82fe0542f33e733c6
SHA512d9230901adeecb13b1f92287abe9317cdac458348885b96ef6500960793a7586c76ae374df053be948a35b44abe934aa853975a6ccd3788f93909903cc718c08
-
Filesize
6.4MB
MD583f7a43943bfebfdd1064e48c568c1aa
SHA1538fca78e3eaa569967b2b5ea4f43f2e4219f7cb
SHA256b0b7780651f7d06eaa5a236f7a11d95c4035e87ca4e0d7e442c9aa32a45584aa
SHA512511a41484cccdeab4334dcc75018d6bcae39d81fc3394ab543da13c62a595fabb8e21c32e81757ee8dfffd096e089d27459c0ff54ff2bb4ea6de23671fba3d5c
-
C:\Windows\Temp\MBInstallTempa0f0d97dfb8c11efa3a3d6a26ba1faea\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.36\mscordaccore.dll
Filesize1.3MB
MD53050af9152d6bb255c4b6753821bc32c
SHA17a20c030a6473422607661ffa996e34a245b3e2d
SHA25697468531d7009e36c338b47fb19e0c6bf210f013610f413c852a4cc27e84b514
SHA512ad07c4b0bb995e80a1718d74992afdeb6c2c4f217e72f361691e2d04dae9be9cd8e55b50fd7172d73755b02b6105c00a3b67534ba9469d92f9e0fbaab8e8f1a9
-
Filesize
9.0MB
MD52ad48a7f9211bf407521e8fd571898f8
SHA1f9192adb5127e1e8c95f0f976509b7646e42e32f
SHA25681642eb2c8741c221b541521cf59686575d8fba12933590e03531fa6f923ba2f
SHA51248534464022eee44c6143e08d5734fdde9eb6c916e860b86bf62686d6c29139e456dbcd27e73413d6b2fd0c284acf0a4373be42d054b0a92b25512856b1545ed
-
Filesize
11KB
MD5bd4ceae54af081d6b1dd91ff584c5d61
SHA15ade462d66e042da58bb1447d1b31f1aad901b68
SHA25664416d564725416c6869ea951878a2734b1f6940b11f7961a897c45f0d8c6625
SHA51237e7abd312f694ee2c8ea54ecf50ed12c16684f1007c61d9a6d1d01cba958be511c5e4e11cd7393a5cd57349fda1c552bebca42962137e0d11695c195761ebb0
-
Filesize
2KB
MD55d8c05cc4f9b4304d57ea10b87f2dcf0
SHA12cabe3d39aa5ec16c54c7818284a2ee235d2ddbd
SHA256e26c2d3347e5f077da92713c9df3cd3eae438fb7e29810bd5c3afe567d2d3125
SHA51255bff23fee9852f229246b71721b3659c916079787935d400a97641449dfda752fc8fbf36f9ea3dc4028f05daeb9006a99660284a61aa5d5a466af0ee966c738
-
Filesize
21KB
MD58da81aa1f6b89ce1d2e216e3ea351c59
SHA14baf79cbade9a5584630a540e6368d547579fb12
SHA256ded569e249e590314d095f740c6b8934a5a797e4f3edbe0f78eac9d333f12a2a
SHA5126d611bbd9d480ef2defd745fd06c4ab86e181267cf689d9d0e124edbaf22fd30fbe2310879cc7bb6dde5bae72c4feea1d329cdecfbf101d95634f85dd0769119