Analysis
- geolocation tags
nanew-jerseynorth-americaunited-statesususa - user interaction
yes - max time kernel
147s - max time network
148s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260126-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20260126-enlocale:en-usos:windows10-ltsc_2021-x64system - submitted
20/04/2026, 12:20
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://WICAR.ORG
Resource
win10ltsc2021-20260126-en
windows10-ltsc_2021-x64
41 signatures
150 seconds
General
- Target http://WICAR.ORG
- Sample260420-ph4lesdy8x
Malware Config
Signatures
- Downloads MZ/PE file 2 IoCs
flow pid Process 449 2348 firefox.exe 475 3312 MBSetup.exe - Drops file in Drivers directory 9 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\mbamtestfile.dat MBSetup.exe File created C:\Windows\system32\DRIVERS\MbamElam.sys MBAMService.exe File created C:\Windows\system32\DRIVERS\mbamswissarmy.sys MBAMService.exe File created C:\Windows\system32\DRIVERS\MbamChameleon.sys MBAMService.exe File created C:\Windows\system32\DRIVERS\mwac.sys MBAMService.exe File created C:\Windows\system32\DRIVERS\farflt.sys MBAMService.exe File created C:\Windows\system32\DRIVERS\mbam.sys MBAMService.exe File opened for modification C:\Windows\SysWOW64\drivers\mbamtestfile.dat MBSetup.exe File created C:\Windows\system32\drivers\mbae.sys MBAMInstallerService.exe - Modifies RDP port number used by Windows 1 TTPs
- Patched UPX-packed file 1 IoCs
Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
resource yara_rule behavioral1/files/0x0007000000028512-3447.dat patched_upx - Sets service image path in registry 3 TTPs 4 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MBAMSwissArmy\ImagePath = "\\SystemRoot\\System32\\Drivers\\mbamswissarmy.sys" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mbamchameleon\ImagePath = "\\SystemRoot\\System32\\Drivers\\MbamChameleon.sys" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MBAMFarflt\ImagePath = "\\SystemRoot\\System32\\Drivers\\farflt.sys" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MBAMProtection\ImagePath = "\\SystemRoot\\System32\\Drivers\\mbam.sys" MBAMService.exe - Checks BIOS information in registry 2 TTPs 6 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion mbrescue.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate mbrescue.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion MBSetup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate MBSetup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion MBAMService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate MBAMService.exe - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 46 IoCs
pid Process 3312 MBSetup.exe 6472 MBAMInstallerService.exe 5476 MBVpnTunnelService.exe 6392 MBVpnTunnelService.exe 2288 MBAMService.exe 5552 MbamElam.sys 3508 MBAMService.exe 3480 mbamswissarmy.sys 1560 MbamChameleon.sys 3656 mbrescue.exe 4488 ig.exe 4364 ig.exe 7068 ig.exe 6612 ig.exe 6928 ig.exe 6944 ig.exe 6968 ig.exe 7060 ig.exe 7076 ig.exe 4376 ig.exe 1884 ig.exe 3940 ig.exe 3696 ig.exe 5232 ig.exe 3820 ig.exe 5824 ig.exe 6300 ig.exe 6920 ig.exe 3104 ig.exe 5044 ig.exe 6884 ig.exe 1672 ig.exe 6956 ig.exe 6788 ig.exe 6288 ig.exe 1428 ig.exe 6688 ig.exe 1660 ig.exe 6424 ig.exe 6436 ig.exe 6724 ig.exe 6720 ig.exe 4240 ig.exe 540 ig.exe 4264 ig.exe 2036 mbam.sys - Impair Defenses: Safe Mode Boot 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\MBAMService MBAMInstallerService.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\MBAMService\ = "Service" MBAMInstallerService.exe - Loads dropped DLL 39 IoCs
pid Process 6472 MBAMInstallerService.exe 6472 MBAMInstallerService.exe 5476 MBVpnTunnelService.exe 6392 MBVpnTunnelService.exe 6392 MBVpnTunnelService.exe 3508 MBAMService.exe 3508 MBAMService.exe 3508 MBAMService.exe 3508 MBAMService.exe 3508 MBAMService.exe 3508 MBAMService.exe 3508 MBAMService.exe 3508 MBAMService.exe 3508 MBAMService.exe 3508 MBAMService.exe 3508 MBAMService.exe 3508 MBAMService.exe 3508 MBAMService.exe 3508 MBAMService.exe 3508 MBAMService.exe 3508 MBAMService.exe 3508 MBAMService.exe 3508 MBAMService.exe 3508 MBAMService.exe 3508 MBAMService.exe 3508 MBAMService.exe 3508 MBAMService.exe 3508 MBAMService.exe 3508 MBAMService.exe 3508 MBAMService.exe 3508 MBAMService.exe 6472 MBAMInstallerService.exe 3508 MBAMService.exe 3508 MBAMService.exe 3508 MBAMService.exe 3508 MBAMService.exe 6472 MBAMInstallerService.exe 3508 MBAMService.exe 3508 MBAMService.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\V: MBAMService.exe File opened (read-only) \??\Z: MBAMService.exe File opened (read-only) \??\A: MBAMInstallerService.exe File opened (read-only) \??\D: MBAMInstallerService.exe File opened (read-only) \??\T: MBAMInstallerService.exe File opened (read-only) \??\X: MBAMInstallerService.exe File opened (read-only) \??\L: MBAMService.exe File opened (read-only) \??\Q: MBAMService.exe File opened (read-only) \??\W: MBAMService.exe File opened (read-only) \??\L: MBAMInstallerService.exe File opened (read-only) \??\K: MBAMService.exe File opened (read-only) \??\M: MBAMService.exe File opened (read-only) \??\O: MBAMService.exe File opened (read-only) \??\U: MBAMService.exe File opened (read-only) \??\Y: MBAMService.exe File opened (read-only) \??\K: MBAMInstallerService.exe File opened (read-only) \??\M: MBAMInstallerService.exe File opened (read-only) \??\O: MBAMInstallerService.exe File opened (read-only) \??\N: MBAMService.exe File opened (read-only) \??\G: MBAMInstallerService.exe File opened (read-only) \??\I: MBAMInstallerService.exe File opened (read-only) \??\Q: MBAMInstallerService.exe File opened (read-only) \??\R: MBAMInstallerService.exe File opened (read-only) \??\S: MBAMInstallerService.exe File opened (read-only) \??\W: MBAMInstallerService.exe File opened (read-only) \??\H: MBAMService.exe File opened (read-only) \??\S: MBAMService.exe File opened (read-only) \??\A: MBAMService.exe File opened (read-only) \??\I: MBAMService.exe File opened (read-only) \??\R: MBAMService.exe File opened (read-only) \??\H: MBAMInstallerService.exe File opened (read-only) \??\P: MBAMInstallerService.exe File opened (read-only) \??\Y: MBAMInstallerService.exe File opened (read-only) \??\Z: MBAMInstallerService.exe File opened (read-only) \??\G: MBAMService.exe File opened (read-only) \??\T: MBAMService.exe File opened (read-only) \??\N: MBAMInstallerService.exe File opened (read-only) \??\D: MBAMService.exe File opened (read-only) \??\P: MBAMService.exe File opened (read-only) \??\X: MBAMService.exe File opened (read-only) \??\B: MBAMInstallerService.exe File opened (read-only) \??\J: MBAMInstallerService.exe File opened (read-only) \??\U: MBAMInstallerService.exe File opened (read-only) \??\V: MBAMInstallerService.exe File opened (read-only) \??\B: MBAMService.exe File opened (read-only) \??\J: MBAMService.exe - ConfuserEx .NET packer 1 IoCs
Detects ConfuserEx .NET packer.
resource yara_rule behavioral1/files/0x0007000000028512-3447.dat ConfuserEx - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\System32\DriverStore\FileRepository\net1ic64.inf_amd64_5f033e913d34d111\net1ic64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netr28x.inf_amd64_5d63c7bcbf29107f\netr28x.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netwlv64.inf_amd64_0b9818131664d91e\netwlv64.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{a0151340-c764-994d-81c1-bd7eb5fc3135}\SET7AC5.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\netwbw02.inf_amd64_1c4077fa004e73b4\netwbw02.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netmyk64.inf_amd64_1f949c30555f4111\netmyk64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netwtw06.inf_amd64_2edd50e7a54d503b\netwtw06.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netjme.inf_amd64_752bf22f1598bb7e\netjme.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netelx.inf_amd64_7812e4e45c4a5eb1\netelx.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netrtwlane01.inf_amd64_b02695ef070d7a42\netrtwlane01.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netvg63a.inf_amd64_9f5493180b1252cf\netvg63a.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netwew01.inf_amd64_153e01d761813df2\netwew01.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netathrx.inf_amd64_220db23f5419ea8d\netathrx.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\msdri.inf_amd64_97bef65a8432edd4\msdri.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{a0151340-c764-994d-81c1-bd7eb5fc3135}\mbtun.cat DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt MBAMService.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{a0151340-c764-994d-81c1-bd7eb5fc3135}\mbtun.inf DrvInst.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C56C4404C4DEF0DC88E5FCD9F09CB2F1 MBAMService.exe File created C:\Windows\System32\DriverStore\FileRepository\nete1e3e.inf_amd64_895623810c19146a\nete1e3e.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netvwifimp.inf_amd64_ec11d0ad3c5b262a\netvwifimp.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netg664.inf_amd64_84cd7b2798e0a666\netg664.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\msux64w10.inf_amd64_5aa81644af5957b3\msux64w10.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netwtw08.inf_amd64_7c0c516fb22456cd\netwtw08.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netavpna.inf_amd64_f6f0831ba09dd9f5\netavpna.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netathr10x.inf_amd64_2691c4f95b80eb3b\netathr10x.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netrtwlanu.inf_amd64_1815bafd14dc59f0\netrtwlanu.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\net9500-x64-n650f.inf_amd64_e92c5a65e41993f9\net9500-x64-n650f.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netwtw04.inf_amd64_c8f5ae6576289a2d\netwtw04.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\c_net.inf_amd64_32a9ad23c1ecc42d\c_net.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\Temp\{a0151340-c764-994d-81c1-bd7eb5fc3135}\SET7AC6.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\wnetvsc.inf_amd64_222cdc9568e4557f\wnetvsc.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netwew00.inf_amd64_325c0bd6349ed81c\netwew00.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netimm.inf_amd64_8b2087393aaef952\netimm.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netr7364.inf_amd64_310ee0bc0af86ba3\netr7364.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netvchannel.inf_amd64_ba3e73aa330c95d6\netvchannel.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\e2xw10x64.inf_amd64_04c2ae40613a06ff\e2xw10x64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\bcmdhd64.inf_amd64_e0bae6831f60ea5f\bcmdhd64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\net7400-x64-n650.inf_amd64_557ce3b37c3e0e3b\net7400-x64-n650.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\usbncm.inf_amd64_9957a38c3d2283ed\usbncm.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_CF33567922C393BFB92DE8105C392BE5 MBAMService.exe File created C:\Windows\System32\DriverStore\FileRepository\netax88179_178a.inf_amd64_b6748bc8bb8ccf4d\netax88179_178a.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netr28ux.inf_amd64_d5996f2a9d9aa9e3\netr28ux.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\kdnic.inf_amd64_6649425cdcae9b5f\kdnic.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netl160a.inf_amd64_e4cbe375963a69e9\netl160a.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\net7800-x64-n650f.inf_amd64_178f1bdb49a6e2fd\net7800-x64-n650f.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\net819xp.inf_amd64_ff7a5dd4f9b1ceba\net819xp.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netbxnda.inf_amd64_1fff3bc87a99b0f1\netbxnda.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\ipoib6x.inf_amd64_ef71073a5867971f\ipoib6x.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\ndisimplatformmp.inf_amd64_8de1181bfd1f1628\ndisimplatformmp.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\net8192su64.inf_amd64_66c8bfc7a4b1feed\net8192su64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netk57a.inf_amd64_d823e3edc27ae17c\netk57a.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141 MBAMService.exe File created C:\Windows\System32\DriverStore\FileRepository\netwns64.inf_amd64_162bb49f925c6463\netwns64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\rndiscmp.inf_amd64_81bff1eb756435c6\rndiscmp.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netrndis.inf_amd64_02db5c384e07aa47\netrndis.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\Temp\{a0151340-c764-994d-81c1-bd7eb5fc3135}\SET7AC5.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\mbtun.inf_amd64_add82795013a7c3b\mbtun.cat DrvInst.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_CF33567922C393BFB92DE8105C392BE5 MBAMService.exe File created C:\Windows\System32\DriverStore\FileRepository\dc21x4vm.inf_amd64_3294fc34256dbb0e\dc21x4vm.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netmlx5.inf_amd64_101a408e6cb1d8f8\netmlx5.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netnvma.inf_amd64_7080f6b8ea1744fb\netnvma.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netrtl64.inf_amd64_8e9c2368fe308df2\netrtl64.PNF MBVpnTunnelService.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\Microsoft.WindowsDesktop.App.deps.json MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\pt-BR\UIAutomationTypes.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\zh-Hant\PresentationUI.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.sys MBAMService.exe File opened for modification C:\Program Files (x86)\mbamtestfile.dat MBSetup.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.IO.FileSystem.DriveInfo.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.Private.Uri.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\ja\System.Windows.Forms.Primitives.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\pl\UIAutomationClientSideProviders.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\tr\WindowsFormsIntegration.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\CloudControllerImpl.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.UI.Theme.Primitives.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.Diagnostics.Debug.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.Memory.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\Microsoft.VisualBasic.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\ru\UIAutomationClient.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\Microsoft.Extensions.Caching.Memory.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\Serilog.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\ru\System.Windows.Input.Manipulations.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\Prism.Wpf.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\MbamBgNativeMsg.exe MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\api-ms-win-crt-convert-l1-1-0.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\Microsoft.VisualBasic.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.IO.UnmanagedMemoryStream.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\de\UIAutomationTypes.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\fr\WindowsFormsIntegration.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\Microsoft.WindowsDesktop.App.runtimeconfig.json MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\tr\UIAutomationTypes.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\api-ms-win-core-interlocked-l1-1-0.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\ja\System.Windows.Forms.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\ko\UIAutomationProvider.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\ru\PresentationCore.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\MbamPt.exe MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\mbtun\mbtun.sys MBVpnTunnelService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\clretwrc.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.IO.FileSystem.Primitives.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\AEControllerImpl.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\Microsoft.Extensions.Logging.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\mbtun\mbtun.cat MBVpnTunnelService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\api-ms-win-core-datetime-l1-1-0.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\api-ms-win-core-localization-l1-2-0.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.Reflection.Emit.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\es\PresentationFramework.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\Microsoft.Xaml.Behaviors.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.Private.CoreLib.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.Text.Encodings.Web.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.Xml.XDocument.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\ucrtbase.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\mbamelam.inf MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\Microsoft.CSharp.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\de\System.Windows.Forms.Primitives.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\es\PresentationUI.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\zh-Hans\System.Xaml.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\MbamUI.Services.deps.json MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\sdk\farflt.cat MBAMService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\api-ms-win-core-heap-l1-1-0.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\zh-Hans\WindowsBase.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\Microsoft.Extensions.Logging.Abstractions.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\Microsoft.EntityFrameworkCore.Abstractions.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\Microsoft.EntityFrameworkCore.Relational.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\fr\Microsoft.VisualBasic.Forms.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\pl\System.Windows.Controls.Ribbon.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\vcruntime140_cor3.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\malwarebytes_assistant.exe MBAMInstallerService.exe - Drops file in Windows directory 22 IoCs
description ioc Process File created C:\Windows\inf\oem3.inf DrvInst.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4424_1072268427\manifest.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4424_386509159\LICENSE msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4424_386509159\manifest.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4424_558525759\v1FieldTypes.json msedge.exe File opened for modification C:\Windows\INF\setupapi.dev.log MBVpnTunnelService.exe File opened for modification C:\Windows\inf\oem3.inf DrvInst.exe File created C:\Windows\ELAMBKUP\MbamElam.sys MBAMService.exe File opened for modification C:\Windows\SystemTemp msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4424_1605662094\deny_domains.list msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4424_1605662094\deny_full_domains.list msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4424_1605662094\manifest.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4424_558525759\autofill_bypass_cache_forms.json msedge.exe File opened for modification C:\Windows\INF\setupapi.dev.log svchost.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4424_1072268427\data.txt msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4424_386509159\_metadata\verified_contents.json msedge.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4424_558525759\manifest.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4424_558525759\regex_patterns.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4424_386509159\keys.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4424_1605662094\deny_etld1_domains.list msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4424_558525759\edge_autofill_global_block_list.json msedge.exe - Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
description ioc Process File created C:\Users\Admin\Downloads\MBSetup.exe:Zone.Identifier firefox.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 1 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh MBVpnTunnelService.exe - Modifies trusted root certificate store through registry 1 TTPs 11 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa22000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F6108407D6F8BB67980CC2E244C2EBAE1CEF63BE\Blob = 030000000100000014000000f6108407d6f8bb67980cc2e244c2ebae1cef63be2000000001000000f6010000308201f230820178a0030201020213066c9fd7c1bb104c2943e5717b7b2cc81ac10e300a06082a8648ce3d0403033039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412034301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f7420434120343076301006072a8648ce3d020106052b8104002203620004d2ab8a374fa3530dfec18a7b4ba87b464b63b062f62d1bdb087121d200e863bd9a27fbf0396e5dea3da5c981aaa35b2098455d16dbfde8106de39ce0e3bd5f8462f3706433a0cb242f70ba88a12aa075f881ae6206c481db396e29b01efa2e5ca3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414d3ecc73a656ecce1da769a56fb9cf3866d57e581300a06082a8648ce3d040303036800306502303a8b21f1bd7e11add0ef58962fd6eb9d7e908d2bcf6655c32ce328a9700a470ef0375912ff2d9994284e2a4f354d335a023100ea75004e3bc43a941291c958469d211372a7889c8ae44c4adb96d4ac8b6b6b49125333add7e4be24fcb50a76d4a5bc10 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\2AD974A775F73CBDBBD8F5AC3A49255FA8FB1F8C\Blob = 0300000001000000140000002ad974a775f73cbdbbd8f5ac3a49255fa8fb1f8c2000000001000000620400003082045e30820346a0030201020213077312380b9d6688a33b1ed9bf9ccda68e0e0f300d06092a864886f70d01010b05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412031301e170d3232303832333232323132385a170d3330303832333232323132385a303c310b3009060355040613025553310f300d060355040a1306416d617a6f6e311c301a06035504031313416d617a6f6e205253412032303438204d303130820122300d06092a864886f70d01010105000382010f003082010a0282010100eb712ca9cb1f8828923230af8a570f78b73725955587ac675c97d322c8daa214676b7cf067dae2032ab356125dc6b547f96708a7937a9592180fb4f9f910369a7f2f80b64fba134ec75d531ee0dd96330720d396bc12e4745042a1051373b54f9b4424fe2d7fedbc2285ec362133977506ce271882dce3d9c582078d5e26012626671fd93f13cf32ba6bad7864fcaaff0e023c07df9c0578728cfdea75b7032884dae86e078cd05085ef8154b2716eec6d62ef8f94c35ee9c4a4d091c02e249198caeeba258ed4f671b6fb5b6b38064837478d86dcf2ea06fb76377d9eff424e4d588293cfe271c278b17aab4b5b94378881e4d9af24aef872c565fb4bb451e70203010001a382015a3082015630120603551d130101ff040830060101ff020100300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030106082b06010505070302301d0603551d0e0416041481b80e638a891218e5fa3b3b50959fe6e5901385301f0603551d230418301680148418cc8534ecbc0c94942e08599cc7b2104e0a08307b06082b06010505070101046f306d302f06082b060105050730018623687474703a2f2f6f6373702e726f6f746361312e616d617a6f6e74727573742e636f6d303a06082b06010505073002862e687474703a2f2f6372742e726f6f746361312e616d617a6f6e74727573742e636f6d2f726f6f746361312e636572303f0603551d1f043830363034a032a030862e687474703a2f2f63726c2e726f6f746361312e616d617a6f6e74727573742e636f6d2f726f6f746361312e63726c30130603551d20040c300a3008060667810c010201300d06092a864886f70d01010b05000382010100ad00de0205232e063262b46bb19416e41140de2bfa59c135efe0aa8f2b41b9d1f38739001df23db5a7470c0606c691f3075702d4edbd17c1909abf4875a2074f30dd4a6a42b50d3d15c00ffe845bc63c99cc5752b1d86e12d59692934b94e507e88982086a7a34d49e64e13d876a92909a63a14bf88fb6ea34d305be20c2de06e28c9f738b9f4d3985cace19369d85c99ec9f8503fb67e88a1efca84068b50b40a5ca61c44f1fdc8614060f26125aa07f4c7c27375e40c0b428d04e55f4448995b7b898196a7889d4b0d62e804c4d7feb4e8b26dcaecc01cbc385b1ddf85ce5b7ae3494b6cb9a7ddf405b249ade1c5146bc2ccebcd7fd65869bac3207e7fb0b8 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8DA7F965EC5EFC37910F1C6E59FDC1CC6A6EDE16\Blob = 0300000001000000140000008da7f965ec5efc37910f1c6e59fdc1cc6a6ede162000000001000000450300003082034130820229a0030201020213066c9fcf99bf8c0a39e2f0788a43e696365bca300d06092a864886f70d01010b05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412031301e170d3135303532363030303030305a170d3338303131373030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f74204341203130820122300d06092a864886f70d01010105000382010f003082010a0282010100b2788071ca78d5e371af478050747d6ed8d78876f49968f7582160f97484012fac022d86d3a0437a4eb2a4d036ba01be8ddb48c80717364cf4ee8823c73eeb37f5b519f84968b0ded7b976381d619ea4fe8236a5e54a56e445e1f9fdb416fa74da9c9b35392ffab02050066c7ad080b2a6f9afec47198f503807dca2873958f8bad5a9f948673096ee94785e6f89a351c0308666a14566ba54eba3c391f948dcffd1e8302d7d2d747035d78824f79ec4596ebb738717f2324628b843fab71daacab4f29f240e2d4bf7715c5e69ffea9502cb388aae50386fdbfb2d621bc5c71e54e177e067c80f9c8723d63f40207f2080c4804c3e3b24268e04ae6c9ac8aa0d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604148418cc8534ecbc0c94942e08599cc7b2104e0a08300d06092a864886f70d01010b0500038201010098f2375a4190a11ac57651282036230eaee628bbaaf894ae48a4307f1bfc248d4bb4c8a197f6b6f17a70c85393cc0828e39825cf23a4f9de21d37c8509ad4e9a753ac20b6a897876444718656c8d418e3b7f9acbf4b5a750d7052c37e8034bade961a0026ef5f2f0c5b2ed5bb7dcfa945c779e13a57f52ad95f2f8933bde8b5c5bca5a525b60af14f74befa3fb9f40956d3154fc42d3c7461f23add90f48709ad9757871d1724334756e5759c2025c266029cf2319168e8843a5d4e4cb08fb231143e843297262a1a95d5e08d490aeb8d8ce14c2d055f286f6c49343776661c0b9e841d7977860036e4a72aea5d17dba109e866c1b8ab95933f8ebc490bef1b9 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\5A8CEF45D7A69859767A8C8B4496B578CF474B1A\Blob = 0300000001000000140000005a8cef45d7a69859767a8c8b4496b578cf474b1a2000000001000000450500003082054130820329a0030201020213066c9fd29635869f0a0fe58678f85b26bb8a37300d06092a864886f70d01010c05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412032301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f74204341203230820222300d06092a864886f70d01010105000382020f003082020a0282020100ad969f2d9c4a4c4a81795199ec8acb6b605113bc4d6d06fcb0088ddd19106ac7260c35d8c06f2084e994b19b8503c35bdb4ae8c8f89076d95b4fe34ce806364dcc9aac3d0c902b92d4061960ac374479858182ad5a37e00dcc9da64c5276ea439db704d150f655e0d5d2a64985e937e9ca7eae5c954d489a3fae205a6d8895d934b8521a4390b0bf6c05b9b678b7ead0e43a3c125362ff4af27bbe3505a91234e3f36474622c3d00495a28fe3244bb87dd652702713bda4af71fdacdf72155904f0fecae82e19f6bd945d3bbf05f87ed3c2c3986da3fdeec7255eb79a3addbdd7cb0ba1ccefcde4f3576cf0ff8781f6a36514627615be99ecff0a2557d7c258a6f2fb4c5cf842e2bfd0d51106cfb5f1bbc1b7ec5ae3b98013192ff0b57f49ab2b957e9abef0d76d1f0eef4ce86a7e06ee9b469a1df69f633c6692e97139ea587b057108137c953b3bb7ff692d19cd018f4926eda834fa663994ca5fb5eef21647a205f6c648515cb37e9620c0b2a16dc012e32da3e4bf59e3af6174094ef9e910886fabe63a85a33eccb744395f96c695236c7296ffc55035c1ffb9fbd47ebe74947950b4e89220949e0f5611ef1bf2e8a726e8059ff573af97532a34e5feced2862d94d73f2cc811760edcdebdcdba7cac57e02bdf2540854fdb42d092c17544a98d154e1516708d2ed6e7e6f3fd22d81592966cb903995111e7427feddebaf0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414b00cf04c30f405580248fd33e552af4b84e36652300d06092a864886f70d01010c05000382020100aaa8808f0e78a3e0a2d4cde6f5987a3bea0003b0970e93bc5aa8f62c8c7287a9b1fc7f73fd637178a58759cf30e10d10b2135a6d82f56ae6809fa0050b68e4476bc76adfb6fd773272e518fa09f4a0932c5dd28c75857665900c0379b7312363ad788309866884cafff9cf269a9279e7cd4bc5e761a717cbf3a91293936ba7e82f5392c46058b0cc0251185b858d625963b6adb4de9afb26f70027c05d55377499c9507fe3592e44e32c25eeec4c3277b49f1ae94b5d20c5dafd1c8716c643e8d4bb269a45705ea90b3753e2467b27fde046f289b7cc42b6cb28266ed9a5c93ac8411360f7508c15aeb26d1a151a5778e6922ad96590823f6c02afae123a27963604d71da28063a99bf1e5bab47c14b04ec9b11f745f38f651ea9bfa2ca211d4a92d271a45b1afb24e710dc05846d66906cb53cbb3fe6b41cd417e7d4c0f7c72797a59cd5e4a0eac9ba99873797cb4f4ccb9b8070cb2745cb8c76f88a190a7f4aaf9bf673af41a15621eb79fbe3db129af67a112f25810195303301bb81a89f69cbd97038ea309f31d8b21f1b4dfe41cd19f650206ea5cd613b384efa2a55c8c7729a768c06bae40d2a8b4eacdf08d4b389c199a1b2854b88990efca75813e1ef26424c718af4eff479e07f63565a4d30a56fff517646cefa822254993b6df0017da587e5deec51bb0d1d15f2110c7f9f3ba020a2707c5f1d6c7d3e0fb09606c MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0D44DD8C3C8C1A1A58756481E90F2E2AFFB3D26E\Blob = 0300000001000000140000000d44dd8c3c8c1a1a58756481e90f2e2affb3d26e2000000001000000ba010000308201b63082015ba0030201020213066c9fd5749736663f3b0b9ad9e89e7603f24a300a06082a8648ce3d0403023039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412033301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f7420434120333059301306072a8648ce3d020106082a8648ce3d030107034200042997a7c6417fc00d9be8011b56c6f252a5ba2db212e8d22ed7fac9c5d8aa6d1f73813b3b986b397c33a5c54e868e8017686245577d44581db337e56708eb66dea3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414abb6dbd7069e37ac3086079170c79cc419b178c0300a06082a8648ce3d0403020349003046022100e08592a317b78df92b06a593ac1a98686172fae1a1d0fb1c7860a64399c5b8c40221009c02eff1949cb396f9ebc62af8b62cfe3a901416d78c6324481cdf307dd5683b MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\1C58A3A8518E8759BF075B76B750D4F2DF264FCD\Blob = 0300000001000000140000001c58a3a8518e8759bf075b76b750d4f2df264fcd2000000001000000c2040000308204be308203a6a003020102021006d8d904d5584346f68a2fa754227ec4300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3231303431343030303030305a170d3331303431333233353935395a304f310b300906035504061302555331153013060355040a130c446967694365727420496e633129302706035504031320446967694365727420544c53205253412053484132353620323032302043413130820122300d06092a864886f70d01010105000382010f003082010a0282010100c14bb3654770bcdd4f58dbec9cedc366e51f311354ad4a66461f2c0aec6407e52edcdcb90a20eddfe3c4d09e9aa97a1d8288e51156db1e9f58c251e72c340d2ed292e156cbf1795fb3bb87ca25037b9a52416610604f571349f0e8376783dfe7d34b674c2251a6df0e9910ed57517426e27dc7ca622e131b7f238825536fc13458008b84fff8bea75849227b96ada2889b15bca07cdfe951a8d5b0ed37e236b4824b62b5499aecc767d6e33ef5e3d6125e44f1bf71427d58840380b18101faf9ca32bbb48e278727c52b74d4a8d697dec364f9cace53a256bc78178e490329aefb494fa415b9cef25c19576d6b79a72ba2272013b5d03d40d321300793ea99f50203010001a38201823082017e30120603551d130101ff040830060101ff020100301d0603551d0e04160414b76ba2eaa8aa848c79eab4da0f98b2c59576b9f4301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030106082b06010505070302307606082b06010505070101046a3068302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304006082b060105050730028634687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274476c6f62616c526f6f7443412e63727430420603551d1f043b30393037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274476c6f62616c526f6f7443412e63726c303d0603551d2004363034300b06096086480186fd6c02013007060567810c01013008060667810c0102013008060667810c0102023008060667810c010203300d06092a864886f70d01010b050003820101008032ce5e0bdd6e5a0d0aafe1d684cbc08efa8570edda5db30cf72b7540fe850afaf33178b7704b1a8958ba80bdf36b1de97ecf0bba589c59d490d3fd6cfdd0986db771825bcf6d0b5a09d07bdec443d82aa4de9e41265fbb8f99cbddaee1a86f9f87fe74b71f1b20abb14fc6f5675d5d9b3ce9ff69f7616cd6d9f3fd36c6ab038876d24b2e7586e3fcd8557d26c21177df3e02b67cf3ab7b7a86366fb8f7d89371cf86df7330fa7babed2a59c842843b11171a52f3c90e147da25b7267ba71ed574766c5b8024a65345e8bd02a3c209c51994ce7529ef76b112b0d927e1de88aeb36164387ea2a63bf753febdec403bb0a3cf730efebaf4cfc8b3610733ef3a4 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E\Blob = 030000000100000014000000b51c067cee2b0c3df855ab2d92f4fe39d4e70f0e2000000001000000e1030000308203dd308202c5a003020102020100300d06092a864886f70d01010b050030818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a30818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bdedc103fcf68ffc02b16f5b9f48d99d79e2a2b703615618c347b6d7ca3d352e8943f7a1699bde8a1afd13209cb44977322956fdb9ec8cdd22fa72dc276197eef65a84ec6e19b9892cdc845bd574fb6b5fc589a51052894655f4b8751ce67fe454ae4bf85572570219f8177159eb1e280774c59d48be6cb4f4a4b0f364377992c0ec465e7fe16d534c62afcd1f0b63bb3a9dfbfc7900986174cf26824063f3b2726a190d99cad40e75cc37fb8b89c159f1627f5fb35f6530f8a7b74d765a1e765e34c0e89656998ab3f07fa4cdbddc32317c91cfe05f11f86baa495cd19994d1a2e3635b0976b55662e14b741d96d426d4080459d0980e0ee6defcc3ec1f90f10203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147c0c321fa7d9307fc47d68a362a8a1ceab075b27300d06092a864886f70d01010b050003820101001159fa254f036f94993b9a1f828539d47605945ee128936d625d09c2a0a8d4b07538f1346a9de49f8a862651e62cd1c62d6e95204a9201ecb88a677b31e2672e8c9503262e439d4a31f60eb50cbbb7e2377f22ba00a30e7b52fb6bbb3bc4d379514ecd90f4670719c83c467a0d017dc558e76de68530179a24c410e004f7e0f27fd4aa0aff421d37ed94e5645912207738d3323e3881759673fa688fb1cbce1fc5ecfa9c7ecf7eb1f1072db6fcbfcaa4bfd097054abcea18280290bd5478092171d3d17d1dd916b0a9613dd00a0022fcc77bcb0964450b3b4081f77d7c32f598ca588e7d2aee90597364f936745e25a1f566052e7f3915a92afb508b8e8569f4 MBAMInstallerService.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MBSetup.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 4888 msedge.exe - Checks SCSI registry key(s) 3 TTPs 26 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags svchost.exe - Checks processor information in registry 2 TTPs 30 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MBAMService.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MBAMService.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Malwarebytes.exe = "11000" MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION MBAMService.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\mbam.exe = "11000" MBAMService.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\mbamtray.exe = "11000" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION MBAMInstallerService.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople MBAMService.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C\Blob = 040000000100000010000000d91299e84355cd8d5a86795a0118b6e90300000001000000140000007b0f360b775f76c94a12ca48445aa2d2a875701c0f000000010000003000000065b1d4076a89ae273f57e6eeedecb3eae129b4168f76fa7671914cdf461d542255c59d9b85b916ae0ca6fc0fcf7a8e641400000001000000140000006837e0ebb63bf85f1186fbfe617b088865f44e425c000000010000000400000000100000180000000100000010000000ffac207997bb2cfe865570179ee037b9190000000100000010000000a344f71a7a52a76ee49b74b1d8816b152000000001000000b4060000308206b030820498a003020102021008ad40b260d29c4c9f5ecda9bd93aed9300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3231303432393030303030305a170d3336303432383233353935395a3069310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e3141303f060355040313384469676943657274205472757374656420473420436f6465205369676e696e6720525341343039362053484133383420323032312043413130820222300d06092a864886f70d01010105000382020f003082020a0282020100d5b42f42d028ad78b75dd539591bb18842f5338ceb3d819770c5bbc48526309fa48e68d85cf5eb342407e14b4fd37843f417d71edaf9d2d5671a524f0ea157fc8899c191cc81033e4d702464b38de2087d347d4c8057126b439a99f2c53b1ff2efcb475a13a64cb3012025f310d38bb2fb08f08ae09d09c065a7fa98804935873d5119e8902178452ea19f2ce118c21accc5ee93497042328ffbc6ea1cf3656891a24d4c8211485268de10bd14575de8181365c57fb24f852c48a4568435d6f92e9caa0015d137fe1a0694c27cc8ea1b32e6cac2f4a7a3030e74a5af39b6ab6012e3e8d6b9f731e1dcade418a0d8c1234747b3a10f6ea3ab6d9806831bb76a672dd2bd441a9210818fb03b09d7c79b325ac2ff6a60548b49c193ede1b45ce06feb26f98cd5b2f93810e6eace91f5bed3fb6f9361345cbc93452883362a66285fb073ce8b262506b283d45cf615194ced62e05e33f2e8e8ec0aa7b0032b91b23679bef7ad081e75a665ccbbe34850f377911afedb50a246c8615898f57c02163c8328ad3986ecd4b70d53d0f847e675308dec30937614a65b4b5d74614d3f129176debf58cb72102941f0d5c56d267668114113589adc262b01f4894d59db78cf814a3e40475fc98150738510232159608a6454c1cc211ae838197c661ccd78384530994fff634f4cbbaa0d0853417c583d47b3fab6ec8c320902cc6c3c0c56110203010001a38201593082015530120603551d130101ff040830060101ff020100301d0603551d0e041604146837e0ebb63bf85f1186fbfe617b088865f44e42301f0603551d23041830168014ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300e0603551d0f0101ff04040302018630130603551d25040c300a06082b06010505070303307706082b06010505070101046b3069302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304106082b060105050730028635687474703a2f2f636163657274732e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63727430430603551d1f043c303a3038a036a0348632687474703a2f2f63726c332e64696769636572742e636f6d2f446967694365727454727573746564526f6f7447342e63726c301c0603551d20041530133007060567810c01033008060667810c010401300d06092a864886f70d01010c050003820201003a23443d8d0876ee8fbc3a99d356e0021aa5f84834f32cb6e67466f79472b100caaf6c302713129e90449f4bfd9ea37c26d537bc3a5d486d95d53f49f427bb16814550fd9cbdb685e0767e3771cb22f75aaa90cff5936ae3eb20d1d55079889a8a8ac1b6bda148187edcd8801a111918cd61998156f6c9e376e7c4e41b5f43f83e94ff76393d9ed499cf4add28eb5f26a1955848d51afed7273ffd90d17686dd1cb0605cf30da8eee089a1bd39e1384eda6ebb369dfbe521535ac3cae96af1a23edb43b833c84f38149299f5ddce546dd95d02141f40337c03e295b2c221757352cb46d8c4341ca2a54b8dcd6f76372c853f1ace26e918be9007b0437f9588208270f0cccaeffd29355c1f893855f7378a8b09a1cb0be9311aff2e195c3971e1be9ca70a06d62667b792e64e5fde7aac49cf2ea47492addb3ca49c861fe3c1561b2b23ff8fb5ea887b706be6a0bafd3a3f45a6c4e81691528b41c048844b964dab4440e38df01528ceedf11856072a2f10c40c08643c338fae288c3ccb8f880b0dbf3bf4ce1e7b8eefb5ebcbb7f07713e6e7283fac12aea52f226c41f9825c1566cc6c0ecac586c3f626330c074ba0d307026a6a4030484b34a85120bbad1b8508e2590d6dca05502bea4a1c9ea5fda0a71f0674e7f2d65290fdaf854821f9573bb49c03ed8645f4b4616ebf68e2266086eac8afa9fe941de7631b3a8656784e MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates MBAMService.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134211612838725114" msedge.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Malwarebytes MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0\Common\Security MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\16.0 MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MBAMService.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Malwarebytes MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates MBAMService.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\16.0\Common\Security MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: MBAMInstallerService.exe Set value (str) \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:\ MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\16.0\Common MBAMInstallerService.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:\ MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols MBAMInstallerService.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{562B1FA7-13DE-40A1-8839-AB2C5FA3129C}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A10434E2-CAA7-48C4-9770-E9F215C51ECC}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A9D47FCC-ECEC-453C-9936-2CD0F16A8696}\TypeLib\ = "{FFB94DF8-FC15-411C-B443-E937085E2AC1}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AECF19A2-3EEE-40D9-910A-4B3448AEB407} MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8C842243-BDAD-4A93-B282-93E3FCBC1CA4}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C7BCC13C-47B9-4DC0-8FC6-B2A489EF60EF}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{118F4330-CAF5-4A54-ABB0-DC936669ED2F}\TypeLib\ = "{5709DEEB-F05E-4D5C-8DC4-3B0D924EE08F}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{53AE1078-790B-405A-AD2E-A7DB93FFC016}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{08927360-710B-483B-BEEC-17E51FF84AF9}\ = "_IRTPControllerEventsV6" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A9D47FCC-ECEC-453C-9936-2CD0F16A8696}\ProxyStubClsid32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B34A461-332D-479F-B8C4-7D168D650EBD}\ProxyStubClsid32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F641DDA1-271F-47C7-90C2-4327665959DF} MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B38EDC4F-A2CD-4F76-8607-F123FE4031D5} MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{08932AD2-C415-4DE8-821D-5AF7A5658483}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{24F9231B-265E-4C66-B10B-D438EF1EB510}\TypeLib\ = "{49F6AC60-2104-42C6-8F71-B3916D5AA732}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2846D47E-9B85-4836-B883-6A7B493E2D6A}\ProxyStubClsid32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7196E77C-8EA5-4824-92C9-BAE8671149FA}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A0EB1521-C843-47D5-88D2-5449A2F5F40B}\TypeLib\Version = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B243B0B7-0567-4DA5-B8E4-A4CE22A4F2B6}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5D448EF3-7261-4C0C-909C-6D56043C259D}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C0CEAFA7-4F65-418C-8A61-92B2048115EE}\TypeLib\ = "{F5BCAC7E-75E7-4971-B3F3-B197A510F495}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EA248A19-F84E-4407-ADD3-8563AFD81269}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{616E9BE3-358B-4C06-8AAB-0ACF8D089931}\ = "ISPControllerEventsV2" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{50538523-AA2F-40D3-9B58-DB51D5BD3D4A} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{10DAE713-FD88-4ADB-9406-04CB574D543C}\ = "IScanControllerV3" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DD67766C-A28D-44F3-A5D0-962965510B2D}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{44ACF635-5275-4730-95E5-03E4D192D8C8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DA5636E-CD8F-4F2D-9351-4270985E1EB3}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{56898B37-6187-4F81-B9C6-8DA97D31F396}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDCB7916-7DE8-44C8-BAF6-F1BBB3268456}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F415899A-1576-4C8B-BC9F-4854781F8A20}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B3B24818-1CC9-4825-96A9-1DB596E079C8}\ = "_ILogControllerEvents" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6ED2B0A1-984E-4A35-9B04-E0EBAFB2842A}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9704115C-F54E-4D64-8554-0CAF8BF33B1B} MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A993F934-6341-4D52-AB17-F93184A624E4} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2E3F70EF-D9BE-485F-A6F5-816DD0EDC757}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{59DBD1B8-A7BD-4322-998F-41B0D2516FA0}\1.0\0\win64\ = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\\13" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B9442AA1-AEB8-4FB4-B998-BFBC37BA8A99}\TypeLib\ = "{59DBD1B8-A7BD-4322-998F-41B0D2516FA0}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1C5B86F3-CEB8-44E3-9B83-6F6AF035E872}\ = "_IMBAMServiceControllerEventsV2" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7E777BB2-8526-437A-BBE2-42647DE2EC86}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DE351550-6C4E-4662-AD87-FEB0707F6C62}\ = "ILicenseControllerV16" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{985DFDFE-853A-48AE-93C1-E533391817D6}\TypeLib\Version = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B860FC17-5606-4F3A-8AE5-E1C139D8BDE3}\ProxyStubClsid32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{74630AE8-C170-4A8F-A90A-F42D63EFE1E8}\1.0\0 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A583D5DD-F005-4D17-B564-5B594BB58339}\TypeLib\ = "{0E2822AB-0447-4F28-AF4C-FFDB1E8595AE}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{08057A16-2479-49CE-BA58-1EA1FF95D95D}\TypeLib\ = "{6C5B978B-68C9-45C7-9D6E-0BA57A3C7EB2}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F36AD0D0-B5F0-4C69-AF08-603D177FEF0E}\VersionIndependentProgID MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{735BE2C0-5A9B-457A-A0A9-4B27FCED2817}\ = "IScanControllerV13" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{562B1FA7-13DE-40A1-8839-AB2C5FA3129C}\TypeLib\ = "{A82129F1-32E1-4D79-A39F-EBFEE53A70BF}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{44AC1571-055F-4CC8-B7D8-EA022C4CC112}\ = "ICleanControllerEventsV6" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{636AD0C8-854C-46A5-8442-E5EE74723B3C} MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36A65E46-6CC1-4CA2-B51E-F4DD8C993DDC}\Version MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8E001403-6F7A-4A1C-A78D-6AC20570ECBF}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB30855D-36DF-41BD-9EEE-03BA7E8E70B7}\TypeLib\ = "{783B187E-360F-419C-B6DA-592892764A01}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{89AE2EF4-3346-47C7-9DCF-ED3264527FDE}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{960F2BB5-E954-45C5-97DF-A770D9D8C24B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2A153977-1A37-4EF7-9226-9E128FA51AE1}\ProxyStubClsid32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BD9CB7A5-5C46-4799-A3A4-20FB128E58F1}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D4AC5360-A581-42A7-8DD6-D63A5C3AA7F1}\TypeLib\ = "{A23C190D-C714-42C7-BDBB-F4E1DE65AF27}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BEB52C40-FE75-4478-9040-66B25435CE72} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2650A9C4-A53C-4BEF-B766-7405B4D5562B}\ = "_IArwControllerEvents" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0E4540C9-F666-4664-851E-128A06EF5F03}\TypeLib\ = "{A82129F1-32E1-4D79-A39F-EBFEE53A70BF}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{96C7187E-6EC4-49BD-88C7-04A3A8A97CC5}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{55E4B8FB-921C-4751-8B2D-AE33BD7D0B74}\ = "_IMWACControllerEventsV6" MBAMService.exe - Modifies system certificate store 2 TTPs 11 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F6108407D6F8BB67980CC2E244C2EBAE1CEF63BE MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\1C58A3A8518E8759BF075B76B750D4F2DF264FCD MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\2AD974A775F73CBDBBD8F5AC3A49255FA8FB1F8C MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8DA7F965EC5EFC37910F1C6E59FDC1CC6A6EDE16 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\5A8CEF45D7A69859767A8C8B4496B578CF474B1A MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0D44DD8C3C8C1A1A58756481E90F2E2AFFB3D26E MBAMInstallerService.exe - NTFS ADS 2 IoCs
description ioc Process File created C:\Users\Admin\Downloads\MBSetup.exe:Zone.Identifier firefox.exe File created C:\Program Files\Malwarebytes\Anti-Malware\mbuns.exe\:Zone.Identifier:$DATA MBAMInstallerService.exe - Suspicious behavior: EnumeratesProcesses 38 IoCs
pid Process 3312 MBSetup.exe 3312 MBSetup.exe 6472 MBAMInstallerService.exe 6472 MBAMInstallerService.exe 6472 MBAMInstallerService.exe 6472 MBAMInstallerService.exe 6472 MBAMInstallerService.exe 6472 MBAMInstallerService.exe 6472 MBAMInstallerService.exe 6472 MBAMInstallerService.exe 6472 MBAMInstallerService.exe 6472 MBAMInstallerService.exe 6472 MBAMInstallerService.exe 6472 MBAMInstallerService.exe 6472 MBAMInstallerService.exe 6472 MBAMInstallerService.exe 6472 MBAMInstallerService.exe 6472 MBAMInstallerService.exe 6472 MBAMInstallerService.exe 6472 MBAMInstallerService.exe 6472 MBAMInstallerService.exe 6472 MBAMInstallerService.exe 6472 MBAMInstallerService.exe 6472 MBAMInstallerService.exe 6472 MBAMInstallerService.exe 6472 MBAMInstallerService.exe 6472 MBAMInstallerService.exe 6472 MBAMInstallerService.exe 6472 MBAMInstallerService.exe 6472 MBAMInstallerService.exe 6472 MBAMInstallerService.exe 6472 MBAMInstallerService.exe 3508 MBAMService.exe 3508 MBAMService.exe 6964 msedge.exe 6964 msedge.exe 3508 MBAMService.exe 3508 MBAMService.exe - Suspicious behavior: LoadsDriver 13 IoCs
pid Process 672 Process not Found 672 Process not Found 672 Process not Found 672 Process not Found 672 Process not Found 672 Process not Found 672 Process not Found 672 Process not Found 672 Process not Found 672 Process not Found 672 Process not Found 672 Process not Found 672 Process not Found - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2348 firefox.exe Token: SeDebugPrivilege 2348 firefox.exe Token: SeDebugPrivilege 6472 MBAMInstallerService.exe Token: SeDebugPrivilege 6472 MBAMInstallerService.exe Token: SeDebugPrivilege 6472 MBAMInstallerService.exe Token: SeDebugPrivilege 6472 MBAMInstallerService.exe Token: SeDebugPrivilege 6472 MBAMInstallerService.exe Token: SeDebugPrivilege 6472 MBAMInstallerService.exe Token: SeDebugPrivilege 6472 MBAMInstallerService.exe Token: SeDebugPrivilege 6472 MBAMInstallerService.exe Token: SeDebugPrivilege 6472 MBAMInstallerService.exe Token: SeDebugPrivilege 6472 MBAMInstallerService.exe Token: SeDebugPrivilege 6472 MBAMInstallerService.exe Token: SeDebugPrivilege 6472 MBAMInstallerService.exe Token: SeDebugPrivilege 6472 MBAMInstallerService.exe Token: SeDebugPrivilege 6472 MBAMInstallerService.exe Token: SeDebugPrivilege 6472 MBAMInstallerService.exe Token: SeDebugPrivilege 6472 MBAMInstallerService.exe Token: SeDebugPrivilege 6472 MBAMInstallerService.exe Token: SeDebugPrivilege 6472 MBAMInstallerService.exe Token: SeDebugPrivilege 6472 MBAMInstallerService.exe Token: SeDebugPrivilege 6472 MBAMInstallerService.exe Token: SeDebugPrivilege 6472 MBAMInstallerService.exe Token: SeDebugPrivilege 6472 MBAMInstallerService.exe Token: SeDebugPrivilege 6472 MBAMInstallerService.exe Token: SeDebugPrivilege 6472 MBAMInstallerService.exe Token: SeDebugPrivilege 6472 MBAMInstallerService.exe Token: SeDebugPrivilege 6472 MBAMInstallerService.exe Token: SeDebugPrivilege 6472 MBAMInstallerService.exe Token: SeDebugPrivilege 6472 MBAMInstallerService.exe Token: SeDebugPrivilege 6472 MBAMInstallerService.exe Token: SeDebugPrivilege 6472 MBAMInstallerService.exe Token: SeDebugPrivilege 6472 MBAMInstallerService.exe Token: SeDebugPrivilege 6472 MBAMInstallerService.exe Token: SeDebugPrivilege 6472 MBAMInstallerService.exe Token: SeDebugPrivilege 6472 MBAMInstallerService.exe Token: SeDebugPrivilege 6472 MBAMInstallerService.exe Token: SeDebugPrivilege 6472 MBAMInstallerService.exe Token: SeDebugPrivilege 6472 MBAMInstallerService.exe Token: SeDebugPrivilege 6472 MBAMInstallerService.exe Token: SeDebugPrivilege 6472 MBAMInstallerService.exe Token: SeDebugPrivilege 6472 MBAMInstallerService.exe Token: SeDebugPrivilege 6472 MBAMInstallerService.exe Token: SeDebugPrivilege 6472 MBAMInstallerService.exe Token: SeDebugPrivilege 6472 MBAMInstallerService.exe Token: SeDebugPrivilege 6472 MBAMInstallerService.exe Token: SeDebugPrivilege 6472 MBAMInstallerService.exe Token: SeDebugPrivilege 6472 MBAMInstallerService.exe Token: SeDebugPrivilege 6472 MBAMInstallerService.exe Token: SeDebugPrivilege 6472 MBAMInstallerService.exe Token: SeDebugPrivilege 6472 MBAMInstallerService.exe Token: SeDebugPrivilege 6472 MBAMInstallerService.exe Token: SeDebugPrivilege 6472 MBAMInstallerService.exe Token: SeDebugPrivilege 6472 MBAMInstallerService.exe Token: SeDebugPrivilege 6472 MBAMInstallerService.exe Token: SeDebugPrivilege 6472 MBAMInstallerService.exe Token: SeDebugPrivilege 6472 MBAMInstallerService.exe Token: SeDebugPrivilege 6472 MBAMInstallerService.exe Token: SeDebugPrivilege 6472 MBAMInstallerService.exe Token: SeDebugPrivilege 6472 MBAMInstallerService.exe Token: SeDebugPrivilege 6472 MBAMInstallerService.exe Token: SeDebugPrivilege 6472 MBAMInstallerService.exe Token: SeDebugPrivilege 6472 MBAMInstallerService.exe Token: SeDebugPrivilege 6472 MBAMInstallerService.exe - Suspicious use of FindShellTrayWindow 54 IoCs
pid Process 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 2348 firefox.exe 2348 firefox.exe 2348 firefox.exe 2348 firefox.exe 2348 firefox.exe 2348 firefox.exe 2348 firefox.exe 2348 firefox.exe 2348 firefox.exe 2348 firefox.exe 2348 firefox.exe 2348 firefox.exe 2348 firefox.exe 2348 firefox.exe 2348 firefox.exe 2348 firefox.exe 2348 firefox.exe 2348 firefox.exe 2348 firefox.exe 2348 firefox.exe 3312 MBSetup.exe - Suspicious use of SendNotifyMessage 44 IoCs
pid Process 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 4424 msedge.exe 2348 firefox.exe 2348 firefox.exe 2348 firefox.exe 2348 firefox.exe 2348 firefox.exe 2348 firefox.exe 2348 firefox.exe 2348 firefox.exe 2348 firefox.exe 2348 firefox.exe 2348 firefox.exe 2348 firefox.exe - Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 2348 firefox.exe 2348 firefox.exe 2348 firefox.exe 2348 firefox.exe 3312 MBSetup.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4424 wrote to memory of 4548 4424 msedge.exe 79 PID 4424 wrote to memory of 4888 4424 msedge.exe 80 PID 4424 wrote to memory of 4652 4424 msedge.exe 81 PID 4424 wrote to memory of 4652 4424 msedge.exe 81 PID 4424 wrote to memory of 4652 4424 msedge.exe 81 PID 4424 wrote to memory of 3628 4424 msedge.exe 82 PID 4424 wrote to memory of 3628 4424 msedge.exe 82 PID 4424 wrote to memory of 3328 4424 msedge.exe 83 PID 4424 wrote to memory of 5592 4424 msedge.exe 84 PID 4424 wrote to memory of 3328 4424 msedge.exe 83 PID 4424 wrote to memory of 3328 4424 msedge.exe 83 PID 4424 wrote to memory of 5592 4424 msedge.exe 84 PID 4424 wrote to memory of 5592 4424 msedge.exe 84 PID 4424 wrote to memory of 524 4424 msedge.exe 89 PID 4424 wrote to memory of 524 4424 msedge.exe 89 PID 4424 wrote to memory of 524 4424 msedge.exe 89 PID 4424 wrote to memory of 6100 4424 msedge.exe 90 PID 4424 wrote to memory of 6100 4424 msedge.exe 90 PID 4424 wrote to memory of 6100 4424 msedge.exe 90 PID 4424 wrote to memory of 5748 4424 msedge.exe 93 PID 4424 wrote to memory of 1932 4424 msedge.exe 94 PID 4424 wrote to memory of 5748 4424 msedge.exe 93 PID 4424 wrote to memory of 1932 4424 msedge.exe 94 PID 4424 wrote to memory of 1228 4424 msedge.exe 96 PID 4316 wrote to memory of 2348 4316 firefox.exe 105 PID 4316 wrote to memory of 2348 4316 firefox.exe 105 PID 2348 wrote to memory of 1068 2348 firefox.exe 106 PID 2348 wrote to memory of 1068 2348 firefox.exe 106 PID 2348 wrote to memory of 1068 2348 firefox.exe 106 PID 2348 wrote to memory of 2980 2348 firefox.exe 107 PID 2348 wrote to memory of 2980 2348 firefox.exe 107 PID 2348 wrote to memory of 2980 2348 firefox.exe 107 PID 2348 wrote to memory of 2980 2348 firefox.exe 107 PID 2348 wrote to memory of 4896 2348 firefox.exe 108 PID 2348 wrote to memory of 4896 2348 firefox.exe 108 PID 2348 wrote to memory of 4896 2348 firefox.exe 108 PID 2348 wrote to memory of 4896 2348 firefox.exe 108 PID 2348 wrote to memory of 4092 2348 firefox.exe 109 PID 2348 wrote to memory of 4092 2348 firefox.exe 109 PID 2348 wrote to memory of 4092 2348 firefox.exe 109 PID 2348 wrote to memory of 5392 2348 firefox.exe 110 PID 2348 wrote to memory of 5392 2348 firefox.exe 110 PID 2348 wrote to memory of 5392 2348 firefox.exe 110 PID 2348 wrote to memory of 5392 2348 firefox.exe 110 PID 2348 wrote to memory of 6520 2348 firefox.exe 111 PID 2348 wrote to memory of 6520 2348 firefox.exe 111 PID 2348 wrote to memory of 6520 2348 firefox.exe 111 PID 2348 wrote to memory of 6520 2348 firefox.exe 111 PID 2348 wrote to memory of 6572 2348 firefox.exe 112 PID 2348 wrote to memory of 6572 2348 firefox.exe 112 PID 2348 wrote to memory of 6572 2348 firefox.exe 112 PID 2348 wrote to memory of 6572 2348 firefox.exe 112 PID 2348 wrote to memory of 6600 2348 firefox.exe 113 PID 2348 wrote to memory of 6600 2348 firefox.exe 113 PID 2348 wrote to memory of 6600 2348 firefox.exe 113 PID 2348 wrote to memory of 6600 2348 firefox.exe 113 PID 2348 wrote to memory of 6608 2348 firefox.exe 114 PID 2348 wrote to memory of 6608 2348 firefox.exe 114 PID 2348 wrote to memory of 6608 2348 firefox.exe 114 PID 2348 wrote to memory of 6608 2348 firefox.exe 114 PID 2348 wrote to memory of 5260 2348 firefox.exe 117 PID 2348 wrote to memory of 5260 2348 firefox.exe 117 PID 2348 wrote to memory of 5260 2348 firefox.exe 117 PID 2348 wrote to memory of 5260 2348 firefox.exe 117 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://WICAR.ORG1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffd7c1ac188,0x7ffd7c1ac194,0x7ffd7c1ac1a02⤵PID:4548
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1936,i,1547098254875337630,6780550954618747031,524288 --field-trial-handle=2352,i,18114393149213397153,11551547930376718981,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:32⤵
- System Time Discovery
PID:4888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1756,i,4264635662114993414,11497066441363305302,262144 --field-trial-handle=2352,i,18114393149213397153,11551547930376718981,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:22⤵PID:4652
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2500,i,14983021696623115433,3594011356376851469,524288 --field-trial-handle=2352,i,18114393149213397153,11551547930376718981,262144 --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:82⤵PID:3628
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3396,i,1375492012159749606,16034108600953994249,2097152 --field-trial-handle=2352,i,18114393149213397153,11551547930376718981,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:12⤵PID:3328
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,5940180642815238504,3598289708725121800,2097152 --field-trial-handle=2352,i,18114393149213397153,11551547930376718981,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:12⤵PID:5592
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4988,i,17290627554352877565,16440550788515915608,2097152 --field-trial-handle=2352,i,18114393149213397153,11551547930376718981,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:12⤵PID:524
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3448,i,8238385137676732540,15590937453024640464,2097152 --field-trial-handle=2352,i,18114393149213397153,11551547930376718981,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:12⤵PID:6100
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,14604919449459858796,13883632236984657797,524288 --field-trial-handle=2352,i,18114393149213397153,11551547930376718981,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:82⤵PID:5748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3668,i,14412285752696497998,7595480366638488600,524288 --field-trial-handle=2352,i,18114393149213397153,11551547930376718981,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:82⤵PID:1932
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,10971653762856012912,14541477973980183913,524288 --field-trial-handle=2352,i,18114393149213397153,11551547930376718981,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:82⤵PID:3128
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,10971653762856012912,14541477973980183913,524288 --field-trial-handle=2352,i,18114393149213397153,11551547930376718981,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:82⤵PID:1228
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,3047331692012731362,15082124394274426277,524288 --field-trial-handle=2352,i,18114393149213397153,11551547930376718981,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:82⤵PID:6632
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5808,i,9941613981974611978,4756493550846243347,524288 --field-trial-handle=2352,i,18114393149213397153,11551547930376718981,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:82⤵PID:6640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,9985572431906150385,12837325087737731023,524288 --field-trial-handle=2352,i,18114393149213397153,11551547930376718981,262144 --variations-seed-version --mojo-platform-channel-handle=3956 /prefetch:82⤵PID:6644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,18013154599389986040,16526098413746975905,524288 --field-trial-handle=2352,i,18114393149213397153,11551547930376718981,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:82⤵PID:3304
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6452,i,13273933543223077589,13635518669242991643,524288 --field-trial-handle=2352,i,18114393149213397153,11551547930376718981,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:82⤵PID:6844
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,11270820680234171734,11092154518295082245,524288 --field-trial-handle=2352,i,18114393149213397153,11551547930376718981,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:82⤵PID:2716
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,7190330716292330593,2955323748073821891,524288 --field-trial-handle=2352,i,18114393149213397153,11551547930376718981,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:82⤵PID:6532
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5884,i,6656299917809467557,4370327542761384727,262144 --field-trial-handle=2352,i,18114393149213397153,11551547930376718981,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:6964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5668,i,15781032056945353049,7087322016143338936,524288 --field-trial-handle=2352,i,18114393149213397153,11551547930376718981,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:82⤵PID:5068
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:1604
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵PID:3736
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Downloads MZ/PE file
- Subvert Trust Controls: Mark-of-the-Web Bypass
- Checks processor information in registry
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1992 -prefsLen 27100 -prefMapHandle 1996 -prefMapSize 270279 -ipcHandle 2064 -initialChannelId {a3c90435-37e6-4c64-82d9-bdd0f59e4adb} -parentPid 2348 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2348" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu3⤵PID:1068
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2456 -prefsLen 27136 -prefMapHandle 2460 -prefMapSize 270279 -ipcHandle 2464 -initialChannelId {aad08348-93e3-4ee4-987c-3586cf911b78} -parentPid 2348 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2348" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket3⤵
- Checks processor information in registry
PID:2980
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3704 -prefsLen 27277 -prefMapHandle 3708 -prefMapSize 270279 -jsInitHandle 3712 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3720 -initialChannelId {b4ec0c87-9463-4ef9-8cbe-b7f821d4e6a3} -parentPid 2348 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2348" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab3⤵
- Checks processor information in registry
PID:4896
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3908 -prefsLen 27277 -prefMapHandle 3912 -prefMapSize 270279 -ipcHandle 3936 -initialChannelId {21424f7a-aca0-4650-8ae4-35ed776c3b00} -parentPid 2348 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2348" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd3⤵PID:4092
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4508 -prefsLen 34776 -prefMapHandle 4520 -prefMapSize 270279 -jsInitHandle 4528 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4532 -initialChannelId {895be894-1672-4fbc-b42a-eeaf5dfe2b6b} -parentPid 2348 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2348" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab3⤵
- Checks processor information in registry
PID:5392
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5088 -prefsLen 34906 -prefMapHandle 5100 -prefMapSize 270279 -ipcHandle 5108 -initialChannelId {dbd691a7-9440-412f-9b53-ce9fecf1f4bb} -parentPid 2348 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2348" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility3⤵
- Checks processor information in registry
PID:6520
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5208 -prefsLen 32793 -prefMapHandle 5212 -prefMapSize 270279 -jsInitHandle 5216 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5224 -initialChannelId {359b03bf-b405-4359-971e-e45edf7f0357} -parentPid 2348 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2348" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab3⤵
- Checks processor information in registry
PID:6572
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5580 -prefsLen 32952 -prefMapHandle 5584 -prefMapSize 270279 -jsInitHandle 5588 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5596 -initialChannelId {2684f826-ecc9-4952-a4f7-8c4f4469d4e0} -parentPid 2348 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2348" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab3⤵
- Checks processor information in registry
PID:6600
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5768 -prefsLen 32952 -prefMapHandle 5772 -prefMapSize 270279 -jsInitHandle 5776 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5784 -initialChannelId {9eeec132-b5a8-4c2e-bd11-6259a8ac7cd4} -parentPid 2348 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2348" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab3⤵
- Checks processor information in registry
PID:6608
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6480 -prefsLen 33071 -prefMapHandle 6496 -prefMapSize 270279 -jsInitHandle 6500 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6280 -initialChannelId {ee748900-95bc-4705-b213-fc87465861eb} -parentPid 2348 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2348" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab3⤵
- Checks processor information in registry
PID:5260
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6932 -prefsLen 36848 -prefMapHandle 2984 -prefMapSize 270279 -jsInitHandle 6676 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6872 -initialChannelId {006ff619-b95b-4fe2-bde8-087078a65fcd} -parentPid 2348 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2348" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab3⤵
- Checks processor information in registry
PID:2372
-
-
C:\Users\Admin\Downloads\MBSetup.exe"C:\Users\Admin\Downloads\MBSetup.exe"3⤵
- Downloads MZ/PE file
- Drops file in Drivers directory
- Checks BIOS information in registry
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3312
-
-
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- Modifies trusted root certificate store through registry
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies system certificate store
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6472 -
C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe" /installmbtun2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:5476
-
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe" /Service /Protected2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
PID:2288
-
-
C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Event Triggered Execution: Netsh Helper DLL
PID:6392
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:6700 -
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "9" "C:\Program Files\Malwarebytes\Anti-Malware\mbtun\mbtun.inf" "9" "4ba9030c7" "00000000000001CC" "Service-0x0-3e7$\Default" "00000000000001DC" "208" "C:\Program Files\Malwarebytes\Anti-Malware\mbtun"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:4100
-
-
C:\Windows\system32\DRIVERS\MbamElam.sysC:\Windows\system32\DRIVERS\MbamElam.sys1⤵
- Executes dropped EXE
PID:5552
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3508 -
C:\ProgramData\Malwarebytes\MBAMService\rmode\mbrescue.exe"C:\ProgramData\Malwarebytes\MBAMService\rmode\mbrescue.exe" /rescuemode "C:\Program Files\Malwarebytes\Anti-Malware" "C:\ProgramData\Malwarebytes\MBAMService"2⤵
- Checks BIOS information in registry
- Executes dropped EXE
PID:3656
-
-
C:\Program Files\Malwarebytes\Anti-Malware\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:4488
-
-
C:\Program Files\Malwarebytes\Anti-Malware\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:4364
-
-
C:\Program Files\Malwarebytes\Anti-Malware\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:7068
-
-
C:\Program Files\Malwarebytes\Anti-Malware\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:6612
-
-
C:\Program Files\Malwarebytes\Anti-Malware\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:6928
-
-
C:\Program Files\Malwarebytes\Anti-Malware\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:6944
-
-
C:\Program Files\Malwarebytes\Anti-Malware\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:6968
-
-
C:\Program Files\Malwarebytes\Anti-Malware\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:7060
-
-
C:\Program Files\Malwarebytes\Anti-Malware\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:7076
-
-
C:\Program Files\Malwarebytes\Anti-Malware\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:4376
-
-
C:\Program Files\Malwarebytes\Anti-Malware\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:1884
-
-
C:\Program Files\Malwarebytes\Anti-Malware\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:3940
-
-
C:\Program Files\Malwarebytes\Anti-Malware\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:3696
-
-
C:\Program Files\Malwarebytes\Anti-Malware\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:5232
-
-
C:\Program Files\Malwarebytes\Anti-Malware\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:3820
-
-
C:\Program Files\Malwarebytes\Anti-Malware\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:5824
-
-
C:\Program Files\Malwarebytes\Anti-Malware\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:6300
-
-
C:\Program Files\Malwarebytes\Anti-Malware\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:6920
-
-
C:\Program Files\Malwarebytes\Anti-Malware\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:3104
-
-
C:\Program Files\Malwarebytes\Anti-Malware\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:5044
-
-
C:\Program Files\Malwarebytes\Anti-Malware\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:6884
-
-
C:\Program Files\Malwarebytes\Anti-Malware\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:1672
-
-
C:\Program Files\Malwarebytes\Anti-Malware\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:6956
-
-
C:\Program Files\Malwarebytes\Anti-Malware\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:6788
-
-
C:\Program Files\Malwarebytes\Anti-Malware\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:6288
-
-
C:\Program Files\Malwarebytes\Anti-Malware\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:1428
-
-
C:\Program Files\Malwarebytes\Anti-Malware\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:6688
-
-
C:\Program Files\Malwarebytes\Anti-Malware\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:1660
-
-
C:\Program Files\Malwarebytes\Anti-Malware\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:6424
-
-
C:\Program Files\Malwarebytes\Anti-Malware\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:6436
-
-
C:\Program Files\Malwarebytes\Anti-Malware\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:6724
-
-
C:\Program Files\Malwarebytes\Anti-Malware\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:6720
-
-
C:\Program Files\Malwarebytes\Anti-Malware\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:4240
-
-
C:\Program Files\Malwarebytes\Anti-Malware\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:540
-
-
C:\Program Files\Malwarebytes\Anti-Malware\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:4264
-
-
C:\Windows\system32\DRIVERS\mbamswissarmy.sysC:\Windows\system32\DRIVERS\mbamswissarmy.sys1⤵
- Executes dropped EXE
PID:3480
-
C:\Windows\system32\DRIVERS\MbamChameleon.sysC:\Windows\system32\DRIVERS\MbamChameleon.sys1⤵
- Executes dropped EXE
PID:1560
-
C:\Windows\system32\DRIVERS\mbam.sysC:\Windows\system32\DRIVERS\mbam.sys1⤵
- Executes dropped EXE
PID:2036
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
2Component Object Model Hijacking
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
2Component Object Model Hijacking
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
1Safe Mode Boot
1Modify Registry
3Subvert Trust Controls
3Install Root Certificate
2SIP and Trust Provider Hijacking
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\PROGRA~1\MALWAR~1\ANTI-M~1\mbtun\mbtun.cat
- Size 10KB
- SHA256 9ceb410494b95397ec1f8fa505d071672bf61f81cc596b8eccd167a77893c658
- MD5 8abff1fbf08d70c1681a9b20384dbbf9
- SHA1 c9762e121e4f8a7ad931eee58ee60c8e9fc3ecb6
- SHA512 37998e0aee93ff47fe5b1636fce755966debe417a790e1aebd7674c86c1583feef04648a7bc79e4dedaabb731051f4f803932ac49ea0be05776c0f4d218b076f
- SSDEEP 192:gM6dynJCSEJOL7yKnUi8rFWQFIGjl8zjEswYt1FfRM/GX01k9z3AeOlFa:gqS4CFRWGjl8M8/fi/GR9z/OlFa
- TLSH T1B43208E1897D84C2ED87A87147E8E5977C3C1BCB2C5055A911ABF7600AA33C6E71853D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\PROGRA~1\MALWAR~1\ANTI-M~1\mbtun\mbtun.sys
- Size 107KB
- SHA256 6903e60784b9fa5d8b417f93f19665c59946a4de099bd1011ab36271b267261c
- MD5 83d4fba999eb8b34047c38fabef60243
- SHA1 25731b57e9968282610f337bc6d769aa26af4938
- SHA512 47faab5fff3e3e2d2aea0a425444aa2e215f1d5bf97edee2a3bb773468e1092919036bcd5002357594b62519bf3a8980749d8d0f6402de0e73c2125d26e78f1e
- SSDEEP 1536:k0h5S895dQOYJaryTmbMc6uqkZUcmSl47AjpdAyDCYJqUufIfmNn3VzwZ6Dh7Q9y:C895uOYJar1MLcmSlrSgC6Duls2t
- TLSH T174B36C9DA1783089DE42A6B482B98793EFB4357A2B1177BF01E1C1748F537C0DB29DA4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\7z.dll
- Size 1.6MB
- SHA256 623e628393bc4b8131c1f4302b195429dfa67e890d3325ceaa56940660052b1b
- MD5 4da585f081e096a43a574f4f4167947e
- SHA1 38c81c6deae0e6d35c64c060b26271413a176a49
- SHA512 0fe168bf1661691dbaa103e478dd7e46b476db094bf1938bf1ad12ddb8a8f371bf611ff504d2eb3ac319862444cc64a27ebee8735aa3752aa32a399b09427243
- SSDEEP 24576:a9raURTF/5pe2g5RpBDxSjv9IrqLwRpFEDbt7y0MVoAAlzi8pY:a9hP/5petvSjWZR8DxO0mo5M8pY
- TLSH T16F756D5BF67400A4D5D6C034C5276B1BEAB1B88B8330A7EF12D15A6B6F13BF19979320
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\AEControllerImpl.dll
- Size 4.9MB
- SHA256 f15b0afd904825c8e653fb305bf5248571566a9d59aac9d3202aad549d746e1a
- MD5 2821718912293886e9b97f75497b91a1
- SHA1 00db15cfc8b947e43ffa9116abfd5552bcac8d69
- SHA512 f3fe52dae9adccedc989734ec834d84cb22154751cbe0d7d8f9f51b00fcab920b8030743b1f81b1b9655b956b1532a69a62272d3b33da7b9a1abe598fb2f9784
- SSDEEP 49152:89QcNVHvFJa0GV9Tkq9HWsMyhXTnXRUHNNWjwJZ1yWBEsUXH7PWnE8q12VPvUbAL:y0XTnMmPsUXbPWNPvcYLUw
- TLSH T1E8368D16A7F401A8C8B6C23CCA578503D7B2BC154730DBDF16A4966A1FB3BE1563EB24
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\Actions.dll
- Size 6.1MB
- SHA256 d513f3a50ec070bbd74f78d27d79b6cb60aff48310283c74ebeb204aacf375a4
- MD5 923a9fe2404277f490bc959493f48e72
- SHA1 563c8dcc7adf7fcd2c706be7ac56ed79c52aacf9
- SHA512 5bdbe65ffd24380d423c3d2bef220e29c39622551edff942f643e79e50ea582439b9e7e91387ef020d44e2462721dda089a83566c76ba1287c2dd917e4fe4194
- SSDEEP 49152:v9x1737qVRJXwMb5WOXz2aXjAr0dcOyccpFZckK/xjDzBE+WjYFJWgP4FNJe5RRe:X97ELkwdchTNOAjYFsG4EGmzqZzhaa
- TLSH T196564B16A7E801A4E0B2C178EEF79103EAB27C255735CBDF0590525E0E73BE09A7BB15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\ActionsShim.dll
- Size 3.7MB
- SHA256 6c5047cb77ea843e8386ba2b26a8458e6255e2ab94d493e914620623723c6b32
- MD5 33617cde11d2bfcef47faf0d5ce3cef9
- SHA1 2439b5f0622cd539b6f6f2f87d78edba466299ed
- SHA512 ef909e5e6a695a0f2ae95621cf87795705b3d267ea7d1c82634faeff3a4e3b111f5f809cd9e7dbb71d588d6106e0b54c138364f99ba41c7c5d47cde9af1b753e
- SSDEEP 49152:SH0QptrM88LLHy9nqSk5n9BT1vAPZmbLMo7JTfYkwZdPHFszUlE3JqCx9R345GEm:ktro8k3booBovlE3JqCx9R345GEzul
- TLSH T16E068B17EB9540A8CC6AD23C855B8607D7B2BC25237097CF17B462AA1FB3BE1523E714
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\ArwControllerImpl.dll
- Size 5.5MB
- SHA256 ee9b161c4440fbb0166da9fc3ea0ee2977b212f83db46845eb6158eccb24b4fd
- MD5 ff1eaa176b0b42d31b7e1ad955d17161
- SHA1 deeedca3cd06a974cc07bed4dbb5a1374bb54615
- SHA512 a1e2c8733622ae8fcced29f1fe9332e37348285ac40ea76a42518cfc6248c3c88420d7e6c67cef1f06b8a6236b2deeaf8db4bc9c4adfa7690967a9cc2aa6f0f2
- SSDEEP 49152:yjXqdt61P6e9RZe/nZTqOLCIJAq/trSw7BaPR4M0zJP3HNrtlBJ/QBPDY8150Ghq:yTqdmPycqMwV7HlcDV5j0Xn5fic
- TLSH T16A468E1AB6E500A8D8B6C23CCA678513E7B2BC154731DBDF16A462691F73BE0473EB14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\BrowserSDKDLL.dll
- Size 7.0MB
- SHA256 c72e39709b26ac7577200a76515347ff11c0a9424cf61657762d657e7aecd974
- MD5 36b6cdd3677d6a079cd21768ffacbc7e
- SHA1 e525b6c778d7b59ef06300cc980f63bcf581a24a
- SHA512 e106563a21063eba244b536e67ececf2630415d5857af8aa67bedecabb39a87799324c3024bcf84487fbd9cfb76dc24b27ebb881734b4157a38b5c74d538ec3e
- SSDEEP 49152:8VF1SVg1db+wMSI0nW5xjpvypuDYpsD0VXZTWqls/e9uETWgjB+S/YfbWf2zv7je:s8TeZKT+X6S/Yf6fITlRChya9Fx
- TLSH T113768D17B6A400A9D8BBC17CCA578603EBB2BC06577097CF16A4966E1F73BE0563E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\BrowserSDKDLLShim.dll
- Size 3.7MB
- SHA256 f6d24605eb688e039e4509d184d974bb14c4c38528edad129d0653eadfea80f9
- MD5 889529ee7dadd23f11ed5b3fdd1f5b79
- SHA1 3e8a1bee4d28102aeb4c6f2eb94946282ffa7e12
- SHA512 bcd57045d516232828003b2b970b457138cebafbfbf2bf762199c291228b2cd674d8084190fee22f0adf047e8f2ac20644712313cfb5f90289a83fd6698995ec
- SSDEEP 49152:aHENZh/xwXNNnfFEXqGW3nILlpqCBS6+38Q/h0oYEaF6r+jep6Plw3zUoC02n:TOX/xPb/aomGIoIn
- TLSH T1E2067B17EB9500A8CC6AD23C856B8607D7B2BC25677097CF1AB462791FB3BE1123E714
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\CleanControllerImpl.dll
- Size 8.7MB
- SHA256 cfbd43f520ffb6cff2a806296f98af6dd0c9ae14c00780b7aa7414e1260576a4
- MD5 ca51c8d6e9bb382603f093671e829e6f
- SHA1 70ab67883bf8322de31fb291e8e3b2f6a4b3fa60
- SHA512 d0a23ef1365d48ca87d0cb30168fc5af50bf6a23de0b365170138c1f391ee75aed8a201dd27a5bf0936bfbeeffe4dff44378d150fa1d9ba4b5dda871caba32b4
- SSDEEP 98304:/wqlRKdBFXiDq7BIRIEdoPJGmoiAU/tGizZUlBcH:73KdBFQq7BHcoPJGmo3U/tfe8
- TLSH T152968E1676E400E8E4F6C278CE678503EBB2B8550731D7DF0690966A1F73BE19A3EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\CloudControllerImpl.dll
- Size 6.9MB
- SHA256 71b6312c8f6bd8e62c7f766ed56dea99f9daca0963039128ba11e4b6842b0922
- MD5 8a15daa8a9ea233265e4dbf5cf2cd9bf
- SHA1 08cd446e2148825fb3b6bce135758b264107284a
- SHA512 6741c89bfb611dc1790116c7ab6ddad5726c68aa22a53921281f0f8ceac6fe02b044b58992941cd3fe997f65880513b853303f70fb4c3496bc71b782ef54ab9b
- SSDEEP 98304:mMoK/6tfchVTu/EKdD3fcXJv9tzjfalW9h/PR:voK/6ZchVyEKdDPc5v9tag9/
- TLSH T160769E6BA6E400A8D8B7D13CCA578503DBB2B81553319BDF06A4967A1F73BE0573EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\LicenseControllerImpl.dll
- Size 7.1MB
- SHA256 0f429a38d88c8057d45e6e31cca2be835bb251efefe0a81b475e409773284272
- MD5 683993771dbfe5f785fbae7710407f58
- SHA1 53bda0355786405b672bc9c4ed4edab372a2ad27
- SHA512 4a2d27692e415061356c41bdb0f8b2736f1de8bae17fc656e09a417ed856e8c2fb191c8c65d4bb3eef539bb72af5af5e2fb31de2d9598246aceee5ae7c685f95
- SSDEEP 98304:JC4WIFDTBnuokflXrWd1ZTF9ptP3f27kG:JDWIVTBn5kdXrWd1Zh9ptPvqkG
- TLSH T1D8769E9AB6E400A8D8B6D13CCA678503D7B2B8154371DBDF06A4967E1F73BE0563EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
- Size 8.8MB
- SHA256 11cba7f877e23c3b449f8ae43c1e59468f6dcc6fa92fcf15241cef5425de8ae3
- MD5 fc71bd97d83d93550fabd552c7e166d1
- SHA1 a786440cd9655fcf68de4623c87ad301918cceed
- SHA512 63dd55fd33faf8a8560119abf4c0e6fffb5e1d620a2facf1f81a612f26b20eaac6b7aa0442bfe0730bebc9dd5a122ce1d60f9d238e37b2496d5246a31c62d3e5
- SSDEEP 98304:7u1fICg55JtkwP3rhReT007kxU+PZCN3RIYNS:72fICs5JttP3FR90761ZCN3R9NS
- TLSH T178969E17A2B900ECD4F6D178CA578A03E776780543B19BDF0790867A2F577E19E3AB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\MBAMShim.dll
- Size 4.3MB
- SHA256 ad85afc35525173e6413831230cb8a6038f0c1b531217ebde37c8b3f937ba405
- MD5 dbe8441f37d35bdcd20146d2569a615d
- SHA1 678e156b5fe795b0ab761ef2b3853dd76d1c80f0
- SHA512 030e828e1ef6d098363547201d04709db5062fde8af853a0833fd1f88166d7f11e60b405d01a03b455dbb29f2ab076c7312a0b6423e0999e52b4909145746f61
- SSDEEP 49152:NPUlLIf62uY/gI7+H/q62imf9NABkDxGTl7hISyePRRjUVfPDszUInVihKf:elLIfFz/gLAlxGR7bRRivvcf
- TLSH T1D0267C17A7E901A8D87AC23884A78603E7B3FC16177097CF0AA4567A1FB3BD1563E714
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
- Size 2.7MB
- SHA256 05d4d87f43646f7ca2e50520d8850e8808748a508c2761838d5fb92d66d6ce35
- MD5 e04e61828c9fffcee59cd90ef155c90f
- SHA1 7a97b65f11d2b3f30d8e2dde4c44bdf16f3d3b24
- SHA512 04792b998628cde88bc2601534678e55b2d6fde290496e5af08a2955a992ca3bb767bd025dca4373abc55141de8d270f62f628e51c887de54035bbee10379ce9
- SSDEEP 49152:honErk5go+mXYlAfm9iNPg9yBb9m84QcVIrn4PdPWU+wgE:POpmIcs4PUU+c
- TLSH T1BFD59E03A2EA41F9DDB7C23C8962D503E7B2B8051370ABDF06A4D5651FA36E15E3E724
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnel_mbtun.dll
- Size 4.2MB
- SHA256 ed2a9ae7540aee752bc3e676bc01bbe1d87a857b8348ed114724956fc431908a
- MD5 a2b3f1d39c4ba202f0bd07aaaf07aecb
- SHA1 b65a67197982ba71b9c892090dcadf1fc3048f00
- SHA512 4098a58e17c620e6864fb1d64661de6690568ec80cb384c911540affc8ae2beb481215a8a470ad36b27ff311040a6a07c7c163b84c65d5c21500034f34aac347
- SSDEEP 49152:VBPD6Io8w4LcTwEDRzTJoeM9YSxjQ5g+o9h6iO0oFjn2Q1Z0NwEIxb:/DG8VQkgRzSeMfn+ofU1d
- TLSH T181164B02F8B205B9F2BEF131C9A963217A31746503327B871F9195692A66FE47E3D313
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\MWACControllerImpl.dll
- Size 7.5MB
- SHA256 f9d91839db1b32107fb0a9f322c56d73b26de9949941ebe7b3ecc3074c641a08
- MD5 2d1de99e83484cb59129c3572a263cd5
- SHA1 caefe8e51ce0373db287c59d5c488a7328004b03
- SHA512 5459f044a3939b8ea31b1c39cfae0deb00bb408d6483a51decda931fdc75fd5bc509a971534435fc3814863dfdff501c021d63798ca96af5dec9c010106e9ce5
- SSDEEP 98304:UfNRxAA3YClB9taNu6qBiMLkow6aEC8t92Iy+30UxhAnxS:UfNRCAzlB9eu694kow67C8t9l930U0xS
- TLSH T114866C1AE7B940E4D8BAC238D967A613FA727C29873067CF0654575A0F73BE0963E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\PoliciesControllerImpl.dll
- Size 6.1MB
- SHA256 43b856bc86c2e1d5b6ec95a31d9ac5aac04d6f0bf50d05413b3f66e3d6271b5a
- MD5 80fb1072517626f69c79510d6910a70f
- SHA1 8f62a8e55dcf0f71e9a3f7f47133db39af6bc810
- SHA512 6cb0a963b4dbfe9e7d9351b61d82c13dbe6fb0e204510f20168964ef2681c07c9afb60b5dc0d619165c07ef4a1a50fb619eb250f79a8c02dcbd4fde60736fc8e
- SSDEEP 98304:ZPtcMdJUBukjJ4LUwO8XArit3AG7I1QewpypG:ZPfdJUwMJ4LUwO8writ37c1Ay4
- TLSH T1A1568C2BB6E400A9C8B6D13CCA578613E7B2B815177197CF06A4967A1F73BE05B3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\RTPControllerImpl.dll
- Size 6.4MB
- SHA256 457b85eedff75d9b289879941f217392a9f78fefa00128bebe1ce31845e313b6
- MD5 70327378ef8b840d6f7135a4d3bdebbd
- SHA1 d73ea52107c7debcb61e29ddd85df4a1fe81ba10
- SHA512 b529a3ede322b9507d0440a961003c83f6f219c4d9ddc86e26b65b88fef46fdea6e23b20051bcbea6f67ef6f013cca6e8128d0444dc690373b77d70891ca40e1
- SSDEEP 98304:TKCPj92rc5O9F8zLOl2VESn+whsEXl1hB:+CMc5gF8zLq2VEQQEXl1hB
- TLSH T187667C1AB6E800A8D4B6D2388A678513DBB3BC554731D7DF0660966E1F73BE0973EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\SPControllerImpl.dll
- Size 4.5MB
- SHA256 fe1dc49340095d3b8c30a1be99d9c95f06565f456d90771942db725b7d078f2e
- MD5 81be99c6cb25e22c643048753acc2952
- SHA1 851d246115a9d5c52390be7233f9eb84576ce504
- SHA512 90ad208f9bc8d684ec0060338062a5e28ef20a6914837a73eff554754377fb9e3827a5981ccfc62aec35f15a87c1fbb8e863b4aefaad1471e441e0d25ff0d098
- SSDEEP 49152:L7cVpTaL2jUwJjkwHrXv5Ims7cOo9k5kh3ml4OaBC1u0d5J1Y3VpMXJzg6VqJTCv:wUwJjFy7cVnZ1m5E3f6VOmBYznA3
- TLSH T100268D17AAE801ACD876D23889AB8603D7B2BC510770DBCF0674567A1FB3BE1563E714
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\ScanControllerImpl.dll
- Size 6.9MB
- SHA256 4a1bbc90ce4fc3da6e89b48b2fff9e6cd81116ddbd235618dfbce17f2c6a226f
- MD5 9237c872398fd9b234440c96651328ed
- SHA1 4d305ffcbab20a2ce4460b86aa5ac6328daaf1b8
- SHA512 32c312acb7091b8b4a36dae3c84e75e5bfc2835d267ae92d91e481d55250d95ba3032e5a2662335ded797366c1d6ec6c0dcc6bb62e02ab423b2c554c565e03aa
- SSDEEP 98304:YVFxexLKGNYG3aqsPMYlQ46epLlrmsNAJ5owtET09dU57zC1V21WBTPVg6Ph:YVFxexr5obT09dU57zKV2gTPVg6Ph
- TLSH T1AC768D16A2E401A4D4B7C238CAA78513DB73BC554731D7DF06A0967A1F73BE09A3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\SelfProtectionSdk.dll
- Size 4.6MB
- SHA256 8a1ac20aace10c4da9f354f16ba77491e227d50f5543fb93717604ba8cb3d37e
- MD5 ae6905f2206c662c7c3aac9cad4e8bdf
- SHA1 074ff28c60714b41ae6607c7a55557f83909ff7e
- SHA512 5ebcd2e42c385db88c2c0419f97c21830e45b42190632e2b84baf5745ec7de9c5de8d389ea47023740cd5cdfd67a653796c31ba152815caf11e046d0a5d9a469
- SSDEEP 49152:Iqx6Rb6nfkyP5jecO5O7x800p5BV127gfs3XzNLiSH7IEjwIPs9zUzC7NQhD/:g6kkp3nEfs31VH7PmupF/
- TLSH T1B8268D17A6E501A9C876C23899B78603EBB2BC1117709BCF0A6496792FB3BD1573F704
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\SelfProtectionShim.dll
- Size 4.0MB
- SHA256 c3bd866b37424affd1422c7bae48af4490c2c91a7f71a3d9f7df1a8c8bc5f1d3
- MD5 76ceaf22d05557f051192c60c1878fb9
- SHA1 e2d3a66004fb661ece7263fd51c7cbec04dc2e64
- SHA512 dfdfbd4d44fda0c7233152bac7ca065e7725aae59870f905a070205353e0ab42f392ed362e47beeabe862064a449527e713c1b8327f876751149a60b7447adc6
- SSDEEP 49152:0uI5ZhsE7DWU0PIsOe2Yj2pBU5F4zLY1fqvtfIYKl4kKUSZPJ0pzUPnTAcJjrZ:x+sEW0Q+Y1fN4TVlbAqN
- TLSH T18B168C17B7A940B8D866C23D85638603D7B2BC22077097CF16A466791FB3BE2573E718
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.json
- Size 621B
- SHA256 d1eeed5428cc19eadcd0a254eeb08d7cba088c52da8ab82bf26d0b3f0af37c0e
- MD5 08dc9207fae2e656cf546a1c5db3dce4
- SHA1 47bb1536ca59eb4c1d6e1f93f819623b847896dc
- SHA512 ebbb6b63646101fb48d6597f6ae27c636f03381b748a7fac7e1dfe86b8786d26bc62698f7df84a2fa6cb76084e0fd3728fbcb24bd3ea35240439c70b8fcc541a
- TLSH T170F0AC12A96F82F795B4078855640487FB30838E1210590FBBF8F690DEB7C399A92C44
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\Swissarmy.dll
- Size 3.7MB
- SHA256 d6b7da0f184b933f54dae4ec18df8cdcefe6b4b0850cbfea03c794c6a64a9de6
- MD5 8534491b85b0661b472342e565672261
- SHA1 b4b90df508d845a7eb0476612bed3e060621b642
- SHA512 da492a9ff7e95ba5fb9d4e6d9ee505bb036ddde361d666bd3fe38b1855724d9ca8da67417c2a1f93aff4312d4dff8049cbda47e2acc72900b8687e74469170fa
- SSDEEP 49152:/A+p/gJzSWZQGMfdOSpp+7LbfgMSaBaCpYXVOKRvPIWRdPDEzwzLu1N+IuqomIuH:/j1DwOOevPFREz4oF
- TLSH T12D069E1392D641BDEDB7C2788D57C503DBB2780903329BCF0A5096292FA3BE59A3E715
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\SwissarmyShim.dll
- Size 2.4MB
- SHA256 540f989efbf6f865b88cdce5277737a1947aaa006543bcd6b2a72440b85fb8dd
- MD5 2ac34694f42d73b8317eaae49972c0ba
- SHA1 08df62c5958ff62e664b0103352879dce1740128
- SHA512 3dead4a48dc84b6a3dea50d947cd78a61a6d872ec03af945309a54430f207cedece2f6d0423510024612352addcb2341bf5b22e7b045782e77f05d7f32574985
- SSDEEP 49152:lQmDoby8OpXiLI80nbqBc5SGpNBN+PmcY6SVI09dPHSEV66:buxmV6i/5SEN
- TLSH T1F9B59E07E3D641F9DDBAC2388963C51BD7B2B8191370ABDF06A092641FA37E1563D728
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\TelemetryControllerImpl.dll
- Size 7.3MB
- SHA256 2f2fff7f9011d369aeabe115adf065e62c19556258c4bfc2bf91ccce3c03da65
- MD5 612426353d51e285f01950566be51609
- SHA1 e09d909b6f2893e0f4a96896cf2067ffb883c25b
- SHA512 e55b78e87f831acc1877662f0592bbd6f49a6721a6545984ffda69b71792cf1184b8b0ff53ac8e8f9a44f4167fcbdbeb7b884f8b40f346a0eaf8c8437f3ba191
- SSDEEP 98304:c6ljoIiB4ts8xBdxDNQIWgpPRWOabbZtg1eJNw2Zl7e:c6loITts8PDNQIWg5RWlbbZt1O2Z1e
- TLSH T1DC769E5AB6A400E8D4B6D23CCA578513D7B2B8255331DBDF06E0967A1F73BE09A3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\UpdateControllerImpl.dll
- Size 4.5MB
- SHA256 c3cdae166d55e357360aa6399cdd753f0584dfffdcb2e514eeed630531ad87f6
- MD5 bd91b7b26aef4271f3b4603126e823fc
- SHA1 65e49b5e81ebeca8a22597c8f4ddbbf1fc8a8cee
- SHA512 3a84ed9f3c98787abbe7894389297859783b0f2b2602d42144a48aba73a7519af715a43945ca4bf0aac5bf7cc8b2db5e8163943845c1e6d645cd0fcd54e7c8b4
- SSDEEP 49152:G4UNjUD9vRECJJAuKXxSvZHL+FfP67YqC6ZHq84DBhZ8q/kXkEYtnPtZFqdyP/Tp:fNJLMrLZvk0vteYT9p4U
- TLSH T1AC269D17A6E900F9D8B7D23889978917E7B3B8110730DFDF1690866A1F637E05A3B724
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\VPNControllerImpl.dll
- Size 3.5MB
- SHA256 0ab61876b204c8eb1abba90cdf7fda5f5278cf33f8adf9476de2008c4879c0c6
- MD5 2078fda6f4feab0b1ef1d64a6bcd6c03
- SHA1 a6f0685396e38ee8a2d7aa2055b27369343c7a9d
- SHA512 6fe7b662b0050e79d7685554b21d81fbc088cf04b82c82bcdc584df5da217bee668a6b0a18a81b1ab795b2ae664363a5d4502a155e8e74be89280a63f5ed1f2b
- SSDEEP 49152:UQ201Ox3P4aF8LLfgIxEe+2QSACfAZh5hniPu63u/WtBocgWh1vhWMGcdP6a45uj:+4EQ9f4cDvhIa4/OwoZb
- TLSH T19CF59D17A3E500F5D8B6C23889AB8517DBB3B8154371DBDF0AB182591F73BE0563AB24
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll
- Size 3.1MB
- SHA256 8af36217efcc1b2a677accc77839ed3b67ddbfcabfa16caaa42c7e95796b940a
- MD5 d82467d25954c9fbaa91ca97e0de6834
- SHA1 d7da2b4f83acd0d2aaf55de2ae403fa6cc44bfc6
- SHA512 84a38b2d4a1b23439f4c6eca1fc148d618effd1444704f37e5812488877d15789b603944231281299ba332dbd0d3a0e51160c588c0adc1bf338675c62da45aa4
- SSDEEP 49152:zHsR0cmbmDszn14AcKLfC659mLVD+Bjmo+2g5rCdPWD8i51l3z:zHBpmj2Am0D8g3
- TLSH T169E54A227A9540ECF866A23864FB8502F6F27A05236097CB0558727D1EEB7F106BF7D4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\mbtun.dll
- Size 2.8MB
- SHA256 f21a980316bd4c57c70e00840ab76d9ad412092d7d2d6a2cff4f1311f7c05364
- MD5 2bbf63f1dab335f5caf431dbd4f38494
- SHA1 90f1d818ac8a4881bf770c1ff474f35cdaa4fcd0
- SHA512 ebb9834323329dc01ba2c87e5fad1083a4cb86f5ed761cb63299ac5336a9843a1aadd42fbed706797c2295117af1c00f96806422338352653c8e0255fecc2fd5
- SSDEEP 49152:xNrdEZjzdAj9fdc4fDrN1OxOh5PgqdnBq30yPFZP7KVxSL:bBzFRkshaZP2W
- TLSH T136D58C1AA7A800A8EEB6C27CC6578603D7F2B8151771ABDF02A456791F73BE1173E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\mbtun\mbtun.inf
- Size 1KB
- SHA256 4a350fc20834a579c5a58352b7a3aa02a454abbbd9eecd3cd6d2a14864a49cd8
- MD5 5d1917024b228efbeab3c696e663873e
- SHA1 cec5e88c2481d323ec366c18024d61a117f01b21
- SHA512 14b345f03284b8c1d97219e3dd1a3910c1e453f93f51753f417e643f50922e55c0e23aab1d437300e6c196c7017d7b7538de4850df74b3599e90f3941b40ab4a
- TLSH T1CB4140BD48D20AB83C673356671B69C27BDC220145C920ADB2DE8606C88EDDCB905EB9
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\offreg.dll
- Size 140KB
- SHA256 8e6c155a97666c8e6a3f9ea95bfc6f6e4f87beac53dd72164aba3ef33ff88db1
- MD5 1659738d57a15a0983f0373b2faaef45
- SHA1 efd4cd05ff6bd787a2ceabfd11daba1c0e475855
- SHA512 4f62cfe0579e1aeeeb30edd5f42a2b1880446dd1075be051e2e0189da5071f9866e5425ff85547486fd7d952a28efa4e784db0cfdc1fcc428b34eaa89c6a7654
- SSDEEP 1536:kXNnhdTcQOCr7LClg5lSYOurIt/0q9mrf0Xp2N7RibuQusR9YfIZRoU:cnXTcQ57LClMlSYA0q9mrf0XoNHFQZ3
- TLSH T111E39D5A73B420A6E8678678C569875BE776B162232087DF12E5C6B80F037CA7F3C345
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\pkgvers.dat
- Size 78B
- SHA256 8d8106bb60bcf5ce3ea2c7248fc1ff425eff7f6c40f94a278d20a1efb2e8c372
- MD5 0978b7fd1d762eb0d0120546a2c560f7
- SHA1 013819331ffa345c100990b50cfca1798a674773
- SHA512 6cc5ed15f57889fbda93b163e93de5d0aad659b6823bc4b6a6b61b59b527fd6dd6e9d6cdec13a70fb207396ac17e9af9cb7bf16fcb6b46a70ed4fac946005601
- TLSH T150A02431017D43403D1370F070F4F1341103CC541C400F0010D1C375513303431044D7
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.cat
- Size 11KB
- SHA256 a96e70795bb1f68016ae0b18d77f88aaf146d5f642974d26112bc89bcd496414
- MD5 391f464cdffbe67843ab70b5b2c49828
- SHA1 8ba6328dbe89ac0e29d81681952acbbbc09a25b1
- SHA512 358ac1dba4fe0d2dfd11f2178e10be19e085ddc78fbbb5323d98551176ed8cfc581f1512aec5b2dc2fca9324301024ecb02819bb3152788d1cbe7eaeaaa267d4
- SSDEEP 192:zK5I5WyaYcJCWE4ByKVb1FWQF8zKNbAw3WIX7X01k9z3AD5Mjjpw:5GLREopFRDOifX7R9zU5Mq
- TLSH T1353219E6952C60C2EDA36C6003D8E59B7C7D27CB5D40557A32EBF6680C623C9E73446E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.inf
- Size 2KB
- SHA256 ff93773f55bf4a6a0242adf82276a8c95c0b244b9bc05e515c4e810c81a960e8
- MD5 d87c2f68057611e687bdb8cc6ebea5b8
- SHA1 27b1311d3b199e4c22772fa1b7ea556805775d37
- SHA512 4aa65b8911d8a2a0f9ef0ee6e934b94db0a9ad4c2ec543b5edcf21486be43f6ab1fda6617ea2cbb85eff230628c9fa8e7649da915d6de695803b28e55bef5819
- TLSH T16541DED8A1D386BA6687B2D07E0741C3F6403A0049F7342872DE50D6C3E7A0F83B4BA9
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.sys
- Size 240KB
- SHA256 0cd62ce0cf56289cb0aa1e5330683704dc8e34c08a15407c9fdbc1948f5e12a3
- MD5 8817e3a16320ab5b04d7e05183bcbb6d
- SHA1 135288165990761d7c73ddff24758597722e9233
- SHA512 9e7fce8c85f7748b82dec4d3f3a967bceeb83f83dfdfc19e5824b5be96d7820da3b124b11ab72e224e9f188f9926aad9577e62a5e55e50d05bf5c3c2b1410c60
- SSDEEP 6144:Cnua/aI/vsqYHFtEPWv2S9NeJLBX0WOD7:CjSI3sqQqPuzehO
- TLSH T1CD346C46A3E43966F9B7C17D89A29002E772754A2B31CECF5370C42A2F5B7D0B93534A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\farflt.cat
- Size 11KB
- SHA256 bdb18a862b8712a76fac1f17eee1fd5c3ee326223d73582f2d2145a61928c9c5
- MD5 63e3e49d6ba44ce6efc1fc04b33c6134
- SHA1 3837d4bbc3f55a5e9a002ee8d433489e0f02d451
- SHA512 f583224ec623f5acd97906c1f6dea1be9c1cd26498ce3f7535e70385eb13822ef95b6b14385eb708be25d5992fc1f4ab213bf9375f0bb00e5cd4679983d088d3
- SSDEEP 192:dNUV7/y1axW7/lyKFFWQFpWWLo1TbuJABOX01k9z3AaWvUYgi:cHiZFRbW+GTYAsR9zrWvTgi
- TLSH T14F3208FA866C5182E9A7AC7047DCE5A77C3C67C75C40846A22E7FA540D937CAF71802E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\farflt.inf
- Size 2KB
- SHA256 c031327df2e0222fb1820e38786e4826a7fa06ad72b4d2a0e35d6a94c20e9044
- MD5 8155859a66fabfd034cb1f635ee84654
- SHA1 b371b79bba7a9d34fd71227bbd4847d0a6939111
- SHA512 863c4d36e07a972732f8c85351ab15ec40d1d389cb5a846417d4061a3b85841f14584b014fb7239eee7a26de7246f297be21abbcd4d9b307d7ad30e5f8c9511d
- TLSH T1E951FE98A3978570AE8B31546F077807B6163440E1F5354832ED84D9D389B2E9BF8BBF
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\farflt.sys
- Size 207KB
- SHA256 a6a6cd705aebf5f419580b3992ed26c82090360e402a2c387e4e25df0be6ae94
- MD5 8f9b8752e801c13c016be41a5dea6186
- SHA1 6eeec787d877cac735ed847e9b56b06a1bd8729c
- SHA512 3e7f87e30480d762f08a87b9605fd3199c861fb2b1da812e19eb921065a8e76e96ba3be061d2e83cf5b7c5698d1c91e3d28ff0f19efa9ad7bebbaed553c7a2d8
- SSDEEP 3072:ViKfygLa0HeqHLkG+CGXeBavMGrFRS+6sTURK5FSrFzjM9OGZfNnsrAAW:8uyBUeqHQ7SSwvsTURQi6wGZVnsrq
- TLSH T167247C5673E40CF4E877CAB9C566C107D7B2784A1721EACF023086661F677E1BA3A319
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.cat
- Size 11KB
- SHA256 2d07a0affd429ccd7ac6f4daf2d64fe7632e1ee8536d78af4ec1a0fc29b5169d
- MD5 faf1ba96de92d183b28abfae300f51db
- SHA1 2e2aed17bfcdc60888a1bec4bf74e6af9d87e8f2
- SHA512 5136bee60f77894e0a8daba0fe052336fad7d5bf9fec147a14a4bce96caaf25c5b43ff57a4e3850f90a6f19c9331e8298831f09d9f6d6e360efda381e281963b
- SSDEEP 192:55gQZg+gxgmWy6JCWW7/lyKFFWQFbbAw3WIX7X01k9z3ADBwQeKy:TO2RiZFRuifX7R9zUBwfKy
- TLSH T1D0322AE1896C51C2E9A36D6013E8E59B7C3C27C71D50856E21EBFB680D937C9E72443E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.inf
- Size 3KB
- SHA256 47b7c516bb57c612de19f0ca865590af95b6e32bf873a0fef9e011b2c5b483d4
- MD5 5a9717e1385703e8f06b27aa10a69e87
- SHA1 84ee67a9167b5eb6560711b9871de98898ad07a5
- SHA512 dd3c7278c2c11ad15a55fae6d19b96dadd92f85b7f0c8ce934298258af00bb5c052a84a98499b8867b0f43704fb307c67d03692ca69dda4d814c6c17dd73df44
- TLSH T1B95121A4AB93C570A68BB5526F033403F11538A0E0E97554B2DD81D9D389A4E26B4BBA
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_a329bacf3cb311f1b0e4c2f8023c3173\7z.dll
- Size 1.6MB
- SHA256 bb01c6fbb29590d6d144a9038c2a7736d6925a6dbd31889538af033e03e4f5fa
- MD5 3430e2544637cebf8ba1f509ed5a27b1
- SHA1 7e5bd7af223436081601413fb501b8bd20b67a1e
- SHA512 91c4eb3d341a8b30594ee4c08a638c3fb7f3a05248b459bcf07ca9f4c2a185959313a68741bdcec1d76014009875fa7cbfa47217fb45d57df3b9b1c580bc889d
- SSDEEP 24576:29raURTF/5pe2g5RpBDxSjv9IrqLwRpFEDbt7y0MVoAAlziG3B:29hP/5petvSjWZR8DxO0mo5MG3B
- TLSH T175756D5BF67400A4D5D6C034C5276B1BEAB1B88B8330A6EF12D15E6B6F13BF19979320
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_a329bacf3cb311f1b0e4c2f8023c3173\ctlrpkg\Assistant.runtimeconfig.json
- Size 372B
- SHA256 1eca0f0c70070aa83bb609e4b749b26dcb4409784326032726394722224a098a
- MD5 d94cf983fba9ab1bb8a6cb3ad4a48f50
- SHA1 04855d8b7a76b7ec74633043ef9986d4500ca63c
- SHA512 09a9667d4f4622817116c8bc27d3d481d5d160380a2e19b8944bdd1271a83f718415ce5e6d66e82e36819e575ec1b55f19c45213e0013b877b8d61e6feb9d998
- TLSH T1CEE02C7BCA10ACB315F52BBAC02AC282FE20232B00004D2A35FC180C2F3AAB30012F49
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_a329bacf3cb311f1b0e4c2f8023c3173\ctlrpkg\MBAMService.exe
- Size 10.9MB
- SHA256 9df37d99e5a01bd3eb9c103e70df6452749dd7a323a5005208d5d056a3881b1b
- MD5 f12e4b700087d28428322346409b626d
- SHA1 85650192ec5344d9be8ac378c3784df9497044fb
- SHA512 39ca7031c645f2dadfa0cde0ba8a4b6fbedf6239dfb41fe7d6f60d04d15c1ef7caa62a43fbf15bba0a0501cce6f3949608588051535e2f34066ec35827d20d95
- SSDEEP 98304:eVsatP3HqHwk/nXmDSBZldykiHYCoy/m6:eVdt6wk/nXmDSXldfoYCdm6
- TLSH T17AC6F606B7F951D8F5BAD674A977A52AEE32BC618B3083CF1150560B0F32ED48E39721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_a329bacf3cb311f1b0e4c2f8023c3173\ctlrpkg\mbae.sys
- Size 155KB
- SHA256 c990dd89b65d35d6c9b34e21c78d96e206ec3bcdd934716ee61ff79da0fa5251
- MD5 fc98ddab2223dc73b950622801b31554
- SHA1 997faaec1dfd18b9dd31e1c216440a28bc4cd612
- SHA512 da08860f8c3d8a9204d1480f33d21f2ab922db5cbbf7734527ed05477c2d9c184deaedb63196876c989c9ff6c1b45b5792661f5bce92212992a7cdb664a793e3
- SSDEEP 3072:hcj/Hk4/53QBvOP8JsUrLx1o6GwzfwKYdkXEnU/H0KBJT2:hc4wNQBvOEJvx1o6GwzfwZqEU/33C
- TLSH T1D3F36C52F3B400F5D8A6C679DB669213E6B2780D2721E7CF076085252F673E4BB39326
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_a329bacf3cb311f1b0e4c2f8023c3173\dbclspkg\MBAMCoreV5.dll
- Size 8.5MB
- SHA256 b13e2559d586be2f439b38610070078b818df891c2f13c77d2f743d0589235ad
- MD5 94d53a6aba2c98404f9199d6295a17b3
- SHA1 77bf99cf975eb35d0d76edac1bef8dadcb703edd
- SHA512 0faee9e835433dfc0933db8d9442f51f12a69f0921fa77973f4c0f04a67e377bbb13753d1730ec5dcf721fef855b8c61a8ae9cec92429ef33b384ebe09e3b718
- SSDEEP 98304:VQq/+cJnOxhczQ8HpKv2HNOd7WF/BVuQ1pw5vX:eqlnOozQ8HpKv2HN67WhBVuQ1p8f
- TLSH T17A967C1BA7A400ABD86AD37889EB4602F773B805537397CF1694A2361F67BD05E3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json
- Size 47KB
- SHA256 480066ce435ff4eff54a1be41b4043fd8280a83e9b41507909bc3bdca35dccb7
- MD5 c4d0fcad698c388e619ff027f34fe469
- SHA1 87189296399caad7c8e2d3f58dc23ba93acf5f3a
- SHA512 6269f6066c02028067f7d4756a3ea8d2adb92f4a01c8216fb7b6e700c9ba4be97909477117a0ab95c251187230a06ad79956169e4cfdb8a9a4763b341fe8212d
- SSDEEP 384:driPalGB5AWiWq2mhzJUVVqxKS3xV2CjNrBa7gHOykEaf:cUAHiWqn1UVVqx9U7gYEaf
- TLSH T1372382BBD9DC0D0B99712694A9B94607FB20036F10980C17BDBEA98DCFB751394C6F1A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json
- Size 66KB
- SHA256 57db0817417d9c5510f1202d69f0c67c6a689c3822dcbf0606bfdb1bc5ccbde3
- MD5 7e1038dce05efb8c8121329a103497d6
- SHA1 55d85c899ef1dc1ba6b7ead00d4e5c10778c5435
- SHA512 d21264bd8f19d14fb972f0cb32154e6abd656c6c33a5f54af6010b99ccf8630c3aaf54c64ce8db9c27b66eb307a25d2b87f8bd2df35781fe3bb73f98e6deb90b
- SSDEEP 384:xr1PalGB5AWiWq2mhzJUVVqxKS3xV2CjNrBa7gHOykEajctcxPad:zUAHiWqn1UVVqx9U7gYEaIKod
- TLSH T12163FB76D8DC4D5B857123A4AAB94603FB50036F51880C07BEBDEA8CCFB781695C6F1A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\ArwControllerConfig.json
- Size 1KB
- SHA256 f3e5be6e39d4e36b87b2f81954fd5118e802f7ebc2509994b46d984536e03f55
- MD5 936291a90b9b28daa9bc635f739eb20f
- SHA1 f1bd7cbdc4cdb8f283de8a09cc09c57b3e850adc
- SHA512 9ea680b663436768290078e7f120aee7f58fb35c80dac2e3c0776b8d1f3b82a10c3116d7f8ada34f06fed7d7c2ada708a9ece975a32dd28f7b7d9021bb34b847
- TLSH T1A811E151962018FFA5BCA005F8949293CFB057A56409083BF2FDF788ED7A57267C68D1
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json
- Size 12KB
- SHA256 a4d9a44f0ddc4f04889276ca4902bfe07a18d60a10cffc1b915560109fe133fb
- MD5 8887492a3c4de683234d7981af5e586d
- SHA1 b52f4fab2e635450c45f679864dfc161253defe6
- SHA512 3050f027560e638771a9d00f315ece0fda2a18ca191f70a856a8fdd87bec460ac34ee86f1f53005752be987beb783bceb230d0e1c2df7ea765f65bff724c9ddf
- SSDEEP 192:ycmf/FYgVMzhrgHTb0MAJUKfVgH8BZ8ZF1Px:RmlYgVMzhrgHTb0MAJUKfVgH8BZ8ZF15
- TLSH T12C426423D1B5AEBB66FC617661B40782F364C75F08410C07797CC88C4F7BD2A62C2AA9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json
- Size 12KB
- SHA256 935434965be1e233b95bab03e4d808b126cff5dbe39a462d6d7cb1e12592b8ff
- MD5 fcf84caa26f5c5178d146159791ed25c
- SHA1 fb584813b94ba1e5e97be6f6f4a2c023f25fd0eb
- SHA512 2bba005eedc65cb8602175f046b92d1d692052402f7b6a1f13c6e9fbb79fcb4a69c9c1b60539f617c55c72e09c6f31ea9a383c31aa49f7c925c9cc3b4b0c7cb0
- SSDEEP 192:l1Kxmf/FYgVMzhrgHTb0MAJUKfVgH8BZ8ZFYPx:+mlYgVMzhrgHTb0MAJUKfVgH8BZ8ZFY5
- TLSH T1FA426626D175EEBB66FC617661B40782F364C75F08414C07797CC48C4F7BD2A62C2AA9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\MwacControllerConfig.json
- Size 2KB
- SHA256 1f8b51231f1717df0d762f4959e71efdb8c073ad83682857babe9623eb44f076
- MD5 d200bcb28bd442a1514aab92fbc2eb73
- SHA1 bff4fe2fe17a9a49b0c3b79400f7fd711b18551c
- SHA512 299d238f4dc32203b27173c62868ff47a611d48a1beca848bcd52697582a09587570fa664833e7bc97dc08edbbce81360fd07a527709d6d3a44cb3b4ab0bcbda
- TLSH T1D3513732D5A85CFF19F85266ACA84252F651831F41680CA3FABCC56C4FBAC12200AF5F
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\RtpConfig.json
- Size 2KB
- SHA256 5b44f3af031fec60ad659f2e439c9fc2f28ab497c6e4e67b6ab66ec5d59b4e86
- MD5 b86ff00cebc0a23fd2e5397bcb16f034
- SHA1 84606a57ad2b18a49a8c7e04ebd29ed676d471db
- SHA512 4a0110c700b5331798fea524805b5c9fa41e5fd429ea9fc812170a087fd89e69046f536112419941907a7648ccb07e9e04f8d25437ab9ce8da2a71d29b64ce73
- TLSH T1585148216E40A87D4C79C1199C7C518ADB245B60160A187B32FEC83DCDBB6737BC5CC2
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json
- Size 5KB
- SHA256 1030a9f02d19f466076ff133cd4a9fe4788ed8db37a57c4b84d094ba9b38cba3
- MD5 a70efaa445868e8f4a366b8d701401a7
- SHA1 0519217395a41c2e476a8a1eb4d78ddd4eaf7705
- SHA512 ed58576a91f8723b80552797fdee7ce5dd2cdafbf26281bc0b3a3e0b3337776f0a433c5dcfa5373ac7ffc2758804fd331b636edafef7adeb0ff9c856b27707e2
- SSDEEP 48:LxT5JtUmVSfKuGQf92Es1kV8EMy8mduwfJ8qXKeWQX92MEnAf3wsaA:LZZOfK5k9Jykf8YRLXKBs9RsAf3wsaA
- TLSH T1EFC18D16D9105CFE18B8E25EDC288186EB3083972202186F75FD869C5FF76333686EE5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\SpConfigFile.json
- Size 11KB
- SHA256 8a42476365c548a39857fa27a3b617904746ec266a65c2f7b072d6ef56fa8c2c
- MD5 66beb5ec7645486397f25f5f899c0882
- SHA1 e64b3bc400e28f1f6a1b2bbd41ec8f33e18bf1f4
- SHA512 5b621c6aa0a6b51a0d059c0895292d2919a82cdfc683c54f84a98116b64363abc4ed90e2eca1d875ff81ddde8b69beda4ff6f1e270b9906f4fa916682e56f167
- SSDEEP 192:08+xwb8fkY/sDpS8t7SSdUCExUYS9oFfJ7MLPi5LnDjufzqoA+8xRj81offZJZte:08+xwb8fkY/sDY8t7SSdUCExUYS9oFfq
- TLSH T19042061FE0A84867887626901F7A95A2E334526BC1435C6775FCF12CCFB6483C49AF9E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json
- Size 1KB
- SHA256 b4db64da786149482b81e30ee30a593a2f8f7bb9aa9b18f05f079dd9b31d8cc8
- MD5 c5035a80053eedb6e54017356523922f
- SHA1 3a38dca78196a0c1a00463a32b8c01d99ed25826
- SHA512 a5bbe4798a742be91da3cf7a5a95fc2fecd64024f3b6867c7a48c24b1f33efdc1ff4693a339422d775699fa373f1057b0085efb0a909e4b72ea261cff08cb24b
- TLSH T1293133128A2845FF28FCD144D9B8871BE7A0531B61161C1FFAF8DA58DE3707233E2988
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json
- Size 1KB
- SHA256 053cb67c19135a2bbd2f55378857369c53b3f3c1361989a74f4e9d610e626de9
- MD5 304e0066be3765cca416492b1cf2e10d
- SHA1 7681a671cb8cbd556a76ce3d785ca597e2d99ba7
- SHA512 beb3c2016db3b545aff5190d4176a7d42b80241ab99f6f732ba3e0559362db4a3eb9fcb99ceb475345ec9f4ac60e333566c66cfbd32ddc07daab7adcecba0591
- TLSH T1523143124A2805FF29FDD154D9B8470BEAA0531B11161C2FBAFCDA58CF3707227E2999
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json
- Size 1KB
- SHA256 d4148ec6037254cd8b8e8e299f4ed54a37311bb4362267ccd2f96db06f79d97d
- MD5 48cfb7b5695453f63665dc9cf01e1668
- SHA1 1e10ab659d435e2f2b651d75e6cf2ee7ab4b0d47
- SHA512 4ecdd8707905d818a0abc170432f212a197f63ea775615b8c68efd7feb1a1732570fea6364db2827fc7e0dbf396a0c330abac9a60e3340a0e73c69947e7f9d90
- TLSH T154313712462845FF28F8D254C9B8870BFBA0531B11161C2FB6FCDA58CF3707227E1998
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json
- Size 1KB
- SHA256 eb3430749998b099c0a76a475cb62200210c4e02f2d544f67755386d6090e5ee
- MD5 b4e71daa687e683919dbb5efe49f08ff
- SHA1 9cd0c5c01bb2143ddc72d975a01b085f6ed2a948
- SHA512 54f22adb6aa71b73200ddb0f12be801f1dbddec8588cd17357ee4b6f1dd6735f3fb16400faced8cf39f15c55e9a999dc0d1e969cb8d32d2d22bfc659b5eff3bc
- TLSH T15331E4124A2845FF28F8D154D9B8470BE7A0531B11161C1FB6FCDA58CF3747227E1998
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json
- Size 1KB
- SHA256 e116b96daceea3cea67bfa7e2cb35579f4c5ee9d4490bee17a4b168f23d689b6
- MD5 8db641129d05404ff9740467d9da35ce
- SHA1 8f1cc129ca0fb74490903ba474865e1325b8f156
- SHA512 6cf28afd04b3576ba387345a2591315341082ed237177d642af1ca543bc1de4be282ce902a67d3861c13d4b33ad851f5f036f7ffb24c8f1f764ed14bd121e0d5
- TLSH T1063148228538C8BF12B5979DD9B48102E750839E66A05D6FB3FCD848DD73D742487A4D
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json
- Size 1KB
- SHA256 ae2a51c052920c22e754c51ec4266c6a6939d9fa615f341a8976da09ab159ba1
- MD5 eaf8dd47e8814ce7739ddc2b31161f16
- SHA1 c7c23e0784528e1f03ef45a829698c50c85997c0
- SHA512 d399c01529acef9bdfbabc59ab7ebe1285782bb9ba5c6dd0a2c9485e40c8806409fe0814614866ad7c36c3d27b0df8ee32b813e2c688dd0e6aa044e5c3357b37
- TLSH T195315623897988BF2279978DD9B48102E760438E26B09D6FB3FCD848DD73D742487A4D
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json
- Size 1KB
- SHA256 351180d8b17c5ce97f50ab0241c0fc14bc56d38cebb068af566effcb42243c2b
- MD5 5ed3a589c56de821fd3e706bbd2c1aff
- SHA1 ac96707984a64653eb0d14392ffa8ec146fb680b
- SHA512 1fd9ede802cf1550075fd9cd87da2f2a97395ca1d95a98df6d5a24ac84443638a15534cbbd0bdca994aa290fa4a13efe65086f1baac219956e6c5f9562b91734
- TLSH T15C3159228578C8BF22799B4DC8B48102E760439F66B0996FB3FCDC48DD739741187A4D
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json
- Size 1KB
- SHA256 1ca438a71c70c6448e61774a49c7c46a98665b225252bf2dba3f435816cd33aa
- MD5 6f3d6064b9b2d04ad929f1f0029d163f
- SHA1 9e7dd37b02b40ade79d16fb6d2c85dcbb6ec8d8f
- SHA512 1ef4c26450053a4c049a18948e5807e495fb033cb24ee1855b47cc5e1ead429512ded0e0828b65605d98b9cdaca64069e9a10f1c3b580e0425ec288d2bfbd43c
- TLSH T1EE3127228939C8FF2279978DD9B48102D760438F66B0996FB3FCD848DD739746187A4D
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\rmode\MBSetup.exe
- Size 2.7MB
- SHA256 35d1044acdc63acc6c68c3b93bf8b53b2c30e34aff414ea8c286096bfd7192a7
- MD5 64546eb5266798e7f0ad76235a1c7c75
- SHA1 83d993401a7f32cb392d9eb40bcfcca42ddb4311
- SHA512 15dce11f73b764742a7b1c168d631a647ab937d83b0e3ff035d6491c36db827d9c94f4e736e92e8bedbf75129dd34bfcf054baf9b1e401092bcb9f6606bc3a49
- SSDEEP 49152:sgZVSkzGQTsmL1yjEjwAeyfvE0Z3R0Tnxn1o2d5MQl4Z:JfGQTsmpGAeKtwnW2OZ
- TLSH T115D58E21B2918120E5F39370297EB7EA5B75BC256F76808F32DCB6390B725C09D35B26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\rmode\mbrescue.exe
- Size 7.7MB
- SHA256 6ee9f8b61ebe20e50f49b17f071fe60d9fdd2be6b344382ac04be8b39bc31484
- MD5 e90175af670add9098cd621cf8a62e3a
- SHA1 ad76dd5f1023d55797772e2622a41f863a9dd2ec
- SHA512 b08fc54b72168caff74b77a71bf6ef4ba6a5d4e3cc031331f53c2ca5b870d2e437c3e9b1bc565073744f71d8d5be434d2d1980d6562cce036fc86fddad2b208f
- SSDEEP 98304:7AcxaE/38sDPYToUd1aW6lIP0s5StGLJ2reT007kx:7+q8sDPY3d1aWiIPR5StGLcr9076
- TLSH T14E86AF57A7E800E8D8B6D13CCA968503EBB2BC5147319BDF06A4566A1F73BE05E3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 3bdd57139d99fb171187e241d0c03cde224f9c176dac9c20c60f28f29e64d27d
- MD5 45635e74a1cb997ad7b0c65562e1854b
- SHA1 410a8995e5f0ab9af3d7133e347ff08392ea8653
- SHA512 239eff3e5a6810ecf550fe74b8292209366c145d90efbf4293b3f4e3842c2b505baa3cc749e27b80454fe4c792925cdb299145af908b40e927282f7899be7372
- TLSH T1DBD0803C52B57C74C86EE57424157B0B7519D87756535F15187315FC0C4314015974EB
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 e61c9f908475582ec0a8eb3b5cf00399511c5e42d8f5f9e1bd10dee6c3382278
- MD5 00930effb53150b1c15782f203b6b229
- SHA1 f2d3a801df3b68ee8a225ab8aebfafbc557fe47c
- SHA512 baf5ecdc128b0737fee0d6a21544bc1de0f07159bd0b831936ace2f6b71df216792cbd6f9346d50bcb17ca955a247d1d414d019e9f3233553a84f8ae7ace1c7f
- TLSH T138D0C03812B13C34C85EE47024043B0B3619C47306534F1418B314FC0C4314008970EB
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 138f31f12d485b797b1929016f491d9deae8c2ed5cb21b3b8572af06d33963eb
- MD5 37fac86ba9924b56a2899a1caba67dad
- SHA1 7dc68a6e9973dd68fff2075c14fc075ae0fac31d
- SHA512 910d8e70d7a6cf7fb72663860f8d656ee844009c33563e3ade84eb0dbd4795f689cf9e4cc2d66acab59ed4a0b3dfa54b7c9e3b005cb641c3c3f680206443dd76
- TLSH T139E02BEAC820DC2719FC671860604746EB11034B2A41880F7F3C8108CFF523E4585D5C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 2KB
- SHA256 e0382be46ad0302e1d30ee586533bbf4432a02abeb1132a6e172693ed9894c08
- MD5 38a3afbe5f18853c499e946b17cefdf3
- SHA1 7d20e1bbf87ff6988ee26964fec71a047fd64b59
- SHA512 b812577bb626f7309e13c70686d2898820ff7d0620d8abfcae42eee89865ae124b857daf4a56705242b49c39f71a4067c0e9dd574cdce2f22422c7e943fb32b8
- TLSH T1C751A7D8E4ACB91BE7C44A7A2CD4545736B04833036B3FCEAEFC94BA4949ABD1201334
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe582bbe.TMP
- Size 2KB
- SHA256 53f7fe89cef9d731869a89cfb6c38bf70ba6b4878c83c937de7bd0039e012767
- MD5 6d3d885f0390a4eedcdb10bed12e8e6c
- SHA1 fe3ea54c089328f497611d798f45aa460ed5adc3
- SHA512 663f71b78c019edfddae1755c966e8844e248dba5dd20720934f9cccac17d8e7945bc127cf0ffbdbca7bb396ffdaa8987c444ae520e110e62acd08b8bafae3f1
- TLSH T11141B6C0D48C792BDBD547323C98646736F04037036B3BCEAE7DA5B04A49ABE1101374
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
- Size 106KB
- SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
- MD5 25dca813dd764f2197142ef84bc5ce66
- SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
- SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
- SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
- TLSH T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 6KB
- SHA256 d422bca553927403ab7b67e484ee12c6103fb0edd83f084c80435983b41bfff9
- MD5 2f885e86c6008917066a99024ef96f2c
- SHA1 d62df7688b248262ffd3320a2e0dd9c9dcd97bb9
- SHA512 9e61449976623304119cfc18d699d0297c032ab0d6aee621e33537f596be164b29ebf0bcf1199d49e6157336cd82bb0da9a8a1f62125c8798607206c3e22bb0f
- SSDEEP 192:D1vRUzRveJZaaEqP9xt9Dw77lcrKuARss8dj6Ei3ZC:D1vRUzRveJZaaEU9z9Dw77lcrKuARssm
- TLSH T1F6D16FF7D3ED852DD82192F0A618AE2BCE590955831C3E66C9E4AF0B63E2831D34165F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
- Size 40B
- SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
- MD5 20d4b8fa017a12a108c87f540836e250
- SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
- SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 16KB
- SHA256 836a2ccb03713b7a58cd97550a3eeef1eefb8b2aef357b99a23c64f250c3a118
- MD5 9cbb18aa35fd9bea751ae14f7eeb8fec
- SHA1 487bb94780219ebd4bc8fd58f671aec5963f4816
- SHA512 8875ce1d2862e513f5bb489f8f4494f991dafc8856c8328ec349449ac73141aaa3a4ea20ae530c2c99a2bb838e6a5777195b2cbe47198a1f9c72c0c13286fad0
- SSDEEP 384:sxZN+qer/fEsNemdAiq17QHb1C/ewryOI+:slBer/fYmdA8HbShL
- TLSH T18572F85AAA38997B8DD7D219F645BB53C6F9046392900E449EFC8A0C00D7BED6203C2F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 16KB
- SHA256 4cc79f74e52e8d87acb6e999dd26686a8e2943338d5b66b4846bdc781e92bac2
- MD5 ca5dd73e01b423c79961bd3b26b95e76
- SHA1 0e7d2f4ea62224b7d1d9fb894ddccc127fbefa78
- SHA512 e48f1a53fef49eba32070016e6eda583bae8df791b0aa776954ddd628c53272c18e24b3bd6d3697916127ebb9c6851aec319435dbf01bb40ce0fe2a0b4b4ef59
- SSDEEP 384:sxZN+jr/fEsqemdHiq17QHb1C/ewryQjh:slCr/fHmdH8HbSh/
- TLSH T1D672F956AA38997B8DDBD218F645BB53C7F5056392904E44AEFCCA0C04D7AED6203C2F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
- Size 35KB
- SHA256 281ae82bce5bb7af74c2ed7638ee3cbd55acab278bfc99e80e0c785ae57dc65e
- MD5 3186a6a1c39c6359d4a183c15833de1d
- SHA1 f9583f50ccc757bc0679e2242db0cf90192b86bc
- SHA512 674956876a71c98cc71120a90ffa271fe95e01bc3581a3cc9f5090ab1608d2ed8b577c8c68af0e94d8b52a7918f966a21be2dd0fbb5c528a4a276d039a5ee459
- SSDEEP 768:FAsxA8P7pLuL/tpWvIMLA8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOn4zLlusg5qroL:FAsxA8JE/tpWvIMLAu1jaDn4zLUx5BKQ
- TLSH T120F21C7B6C0CCB7E4F804E9CDD2ABE8A6DE801CB56D8895447FA940C03C66EB51175DB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
- Size 23KB
- SHA256 8986bc5d6f8c184a6f3cbdb0897373beadcf4b7245a7ab65e3380607400a84e1
- MD5 7b06455979d6123ddbda11d4d3dd989b
- SHA1 e62080c8473cbdd442a1a01ac1bbbc34f88f9ad6
- SHA512 8c6a1ae6da9c9a8049ac8a097437d32137495df2c59d0e6cbdb4f7b7fee8ceb908b49eb6a9a61850b4443d926f1ddc3d88d99d63299adfb9ca6b451f730b33b0
- SSDEEP 384:cnF65VzPbMf4xNR5BbslV4jFC8VOaUWWpC/WSY8B0Hs0XiXN2B+7lI3MoemWZmd0:cOhfN2B+7vnPtk3Fh9S
- TLSH T114B2792471BAC2113A7D3AC891D9BC27034230A27058F57B7FE940A64F67E181DFDAE9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
- Size 41B
- SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
- MD5 5af87dfd673ba2115e2fcf5cfdb727ab
- SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
- SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
- Size 233B
- SHA256 9528b7588904062cf79d90f246241ae159905b17667fa316dd9d0d34e145adda
- MD5 94e6b116eb1c6d625111ca4925588cf2
- SHA1 5fd96b7113111b16ab54dae85578fef2f9b25729
- SHA512 a297e46b34089e11f27c4600a493c9ca967c5b60361ccba03d939719e4f55469d240a5d40762df8643cd458bcbee418965463804fe932f4ffed234707b3182be
- TLSH T10FD0A7EE4731684AB730EED4B064668DA02B8D58DDC5CCB0DE15B0613178513D4128B4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
- Size 149B
- SHA256 d665cc8c227ad8c4fa322c02bcae317b923e47aa1754f45fcffa150bfbef404a
- MD5 1544bd4fab7fca8ede5c5ac8caa2faa8
- SHA1 82d5fe74135b429afade4822306b6a1701d1dc52
- SHA512 cfb08d464886e74668e6bc42515ae84a701290c17922fd18f26edcca6dfe02ba3681027ebd45cf031bbda49cf897395665e56371cc2ae0cefd2fe6bb12d9410b
- TLSH T1DAC08CEB0900544B8730EED860543B0DE10B814C8AC0C8B0E508800120398138402834
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt~RFe57ee38.TMP
- Size 156B
- SHA256 df4f0e285b7585d9d60f2eeae9424eed4f648c56185646e3a0762784ed0e0c04
- MD5 65f10afb7babe417f4c4d173be3bfbe9
- SHA1 149750d1d3defc232a6fb6324055605a05779eab
- SHA512 b6a882213005ec83eb7b1dc5cab7395ae1d0483d1225d29be115a62a0bd43e0931f6f07964e5dceef84ea4960422fdac9ce3ffd97899f283eaba2a984c38cbd6
- TLSH T1F5C08CAB091014478731AAD8E064374EE11F8C888EC0C8B0D50A71012039813C401934
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\IndexedDB\indexeddb.leveldb\MANIFEST-000001
- Size 23B
- SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
- MD5 3fd11ff447c1ee23538dc4d9724427a3
- SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
- SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d22db575-df1b-4e4d-91a7-7d1ae22aac40.tmp
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 26KB
- SHA256 861264d1b80896a4ab92ba9ecab96b22258373f8e16e75950d67e6d6482d94b9
- MD5 1f86f550222f3a7dbdc848a47b5a4218
- SHA1 ce819638da8f04ee55f0b507a4f3125a495d35f6
- SHA512 0c192c0f06fd851204d2ca0b796bb3ef36ff54d2d6b146f7fa3683fda2aacbe61b4cf86fed5ac0888eb804f764fbef168856683004335ce2d58d3c97e9bee532
- SSDEEP 384:nEiFavqMg3sNc8TUNTUlImkrq1/IVd9wfuYKviI4gIMT+/kX+VWi9My5aQzLNPk/:fFayv3LwgrbYKvznxT+Myxn2
- TLSH T176C25B36EC98DAA7ECE68FD9E74A7A03DEE001A3D58C4AD8DAD91D1D10D719D130BC12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 27KB
- SHA256 900d7e1f222cb0ef9c9a29b2e5b13e0d0f1d7d1fcff14c691b544d5bae2a8092
- MD5 06c6ea78158abb52996c01a60f954f35
- SHA1 48da775195c193d930510c9241957a86138fa9bd
- SHA512 770a945adaad5bb14e503568238ac0bde96ddf7e8b6541eedb5937ce927f0879d85ecd3757606090041e8637f92353a5f1c445d66b9b3179ef1ebfe81baccd05
- SSDEEP 384:n5iFavqMg3sNI8TUNTUlImkrq1/wmw9wfuYKviI4gIMX+u+hmakkX+VWi9My5aQc:QFayv3XwgEmYKvznxX+bmakMyxn2
- TLSH T12CC24C36DC98DAA7ECE68FD9E74A7A03DEE001A3D58C4AD4DAD91D1D00D71AD130BC22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 27KB
- SHA256 dff5f35a65a7203d286c73302000694421c4070c7bceb1a7c17e003bf3e7cc28
- MD5 696f76e71cc92b014ea324457dd2c33a
- SHA1 ab8ed1198fe81951586ffb5cefd5685e964c033c
- SHA512 5d6e5ae75eae48f5350321c340afcc5976064c2f532b20df8ca03ae5744435d1f90ba2e79f8c5c729128081833d44253a02a8a1e1620d7cdc16aab9aa16f6da5
- SSDEEP 384:n+iFJjccCs+Bt0S3g3sN88TUNTUlI4k7q1/luD9wfuYKviI4gIMX+u+hBakUmgRp:VFJccQA3Hwgj5YKvznxX+bBakLbK
- TLSH T11AC24A36D8A4DEABECE78FD8E31A7B43EEE00153958C59D4DAC91D1D008B29D130BC26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 27KB
- SHA256 1bd3b279c1bebc18147a4c97a8deb48ca234f0fa079fd5a375b3f046494fb156
- MD5 5acc726ce0e13381e8162a8a5720a2ee
- SHA1 4c11b9d69d58f7bb45ca7840147879906844c9e7
- SHA512 6aafcd02e3acc7a1a988fae8b8e012c2b0e5a2f689ee0b25738c495dc3277fcbbeb5bdb1a5a362f8b3136a6c09937ca107d55ddd22bd79f7fea0e199f8c876c7
- SSDEEP 384:nMiFRjccCs+Bt0S323sN88TUNTUlI4A7q1/EuD9wfuYKviI4gIMX+u+hBakUmgRp:3FhccQW3Hwgi5YKvznxX+bBakLbK
- TLSH T14BC24A36D8A4DEABECE78FD8A35A7B43EEE00053958C59D4DAC95D0D008B29D130BC26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 32KB
- SHA256 041c11c3f7ba9524731bbe45eda2a2bf64ef4cc3c747e969f533c2a7abae47a9
- MD5 d4493ac59eea1a8bdd42b8cb348cec6c
- SHA1 aadb0e0ed89718d86d997304f85e27ad173745ab
- SHA512 5c584f4e881d32a71e96a01d4d54e5195d3ef5b93bfd4f61f4cdf944f4871766959cabfae9192dc2e0066ab4a198a75cf6f05ed41acc53a9a8394662acf845bc
- SSDEEP 384:n2iFejccCs+Bt0S32y3sNLr8TUNTUlI4A7q1/zGD9TfVAYKviI4gIMX+u+hLakUX:dFIccQ53grwghgYKvznxX+bLakLbK
- TLSH T15DE2B2F598E78977E8AE4B97A33D6E429ABCC053B1484994FBC41D0CCC861BFD306816
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 27KB
- SHA256 d01e5a8c498f3bfa3af195dde41eac859ff97755af87874042ac941cb0869ff0
- MD5 ce3d76b1b8ca4312af688ea8939c8099
- SHA1 fc257198cc6426a34731d2b1c5973baf7d39f423
- SHA512 4ea81f6113bfaded807f1d205dfeaa1b29a2422376fd9d82ccdda72d4fc7fe4e7611fc10f0a0475a3eb3c43334d84e1e66603dd4583f62c0f1ebfa20313329a4
- SSDEEP 384:n+iFRjccCs+Bt0S323sN88TUNTUlI4A7q1/EuD9wfuYKviI4gIMX+u+hBakUmgRp:VFhccQW3Hwgi5YKvznxX+bBakLbK
- TLSH T189C24A36D8A4DEABECE78FD8A35A7B43EEE00053958C59D4DAC95D1D008B29D130BC26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 32KB
- SHA256 a68fe6af2089c7e3a1eea66f3dfd3220de9b8fb669436d7c47c10f595b6e5d38
- MD5 6db4604fbae76fa48ab3024b87043a29
- SHA1 a7e9222c20184073c23aa1a37f5158ec7347280c
- SHA512 82941d99384d234db51a9f7926c81448ff261fc151b795e0cbf7108c17530fe5c776ded4da642cb28373d518e20cb202e3c906128fa78dbb943495ecbd88972d
- SSDEEP 384:n2iFRjccCs+Bt0S32y3sN88TUNTUlI4A7q1/EGD9wfuYKviI4gIMX+u+huakUmgz:dFhccQ53Hwgi5YKvznxX+buakLbK
- TLSH T101E2B3F598E78977E8AE4B87A33D6E429ABCC053B5480994FBC41D0DCC861BFC306816
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
- Size 1KB
- SHA256 de9778f2f67789b5f786a3f64d962e77cb0848e529743f74aa065e6ba6705420
- MD5 ccdcceb100230f5b1648a035043fc9d3
- SHA1 b28ea8793bad3cb99783c76a34ca6479c67767dd
- SHA512 17f703e55a340ad6efd3c79bfc1be55a92440bb5781761c6f023703959dc2301e9e3509bbae3d107388bad78995ef9e8349d45fb81dfeab68eec69fee3fe2564
- TLSH T11C3142E09C3E2AD1E0BE0A2EA45738FC94DCC72BF464743D6858EE88427950E658543F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
- Size 1KB
- SHA256 e0381cfb88b688d9aa0cdfcfc0f77b0ef67fb6fab1523fbb9ac5d42756b0d0e6
- MD5 7b831dbd7cadf79345746429162eca85
- SHA1 81933dd9bf748dff98139b466557f6eda1a472e9
- SHA512 e5cf80f5c0a0f979242d7a957755181fbed94d1e6cf7c2157934b5026fbe651898cf9b4648d461c91c0621b59bd3fba9896c7ddbb09e56a388b0a9a4e3c5a001
- TLSH T1493162E09C3E36E1E4BE0E2EA45738FC94D8C237F468747D6858ED88423A50EA44543F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
- Size 1KB
- SHA256 ca75e522504f32aa7ce819f9c5077f7edf8cce7b3c4171edc64848bb50f4c079
- MD5 d4466c95776835c718ae0d720ac2efa6
- SHA1 2a182492c4c15f5a1965ee1188c2122dc12a37d2
- SHA512 f6b5cb8a230488210be896404701b1ec0cc1582de4fa018caaf3bfece05bab2618f809a9c35c2649631e1d0f5fb25967855ff18764ba527792e50b49f26c407f
- TLSH T1164151E09C3E3AD1E0BE0A6EB45B38FC94DCC726F464743D6858EE88427A50E658443F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
- Size 2KB
- SHA256 2552f55ce34c2bebab8f3c65633d5c6694d6cf8e354a956b4e8f278e67b33121
- MD5 2684e5bed7784298d5f67d3e4cb998be
- SHA1 74e090a175f1d841ddd79c4292da77d21df2acc7
- SHA512 32c76a8e02c187806a5e187a387e202458616412e44d9c40cc6c4e5fe57597ff9dda62750048ed1b2c10ecf15f0c84a1ee82f10bb51e01d5555cbad8ec7d4cc4
- TLSH T1AD4174E08C3D2AE1E0BE0A6FB45B38FC84DCD726F464343D6818ED98427A50E658543F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
- Size 2KB
- SHA256 f9831e39ac56a6eb44be8c6bde746707380c068f5341a7d63960a29ba6db06af
- MD5 0254769e88ec8dcd23381ab8abf79e46
- SHA1 9abd7d7a7fb112ab6842a29754da6cc4cefe1792
- SHA512 60796f25be7fa64660dbac35cb0f39721084e23c32ab87daa272dc2b854c46b946ca1849d9973b2a7e28266e148ab888563b3be94a77893bb77ef4bc96b11f97
- TLSH T118412B58AAFA1148B3B76F1A9BF6A86D487A78772F06D45E10110E4F0637B44CC62B37
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1r2x66wx.default-release\cache2\entries\386D22EAB36C3C5C3713F931E60D7F8CA78D773F
- Size 48KB
- SHA256 0d5449646c050d7f6191a3c8d5a1c7a90c8de474d2810750308ddc7fd5315dde
- MD5 3a82801167ad94fb0ca4d7a5fb8f5cb1
- SHA1 c7f75a684e07b2c5cbcf60dd39e9b4b1be97a03c
- SHA512 386313c49cf7d2b50231465c5a4a74780b96f87dc6de27c80e15805c03596f404ae502e809a20d328d4cf35aa71732c1caef84fab5be0390c16aa1b09c8312fa
- SSDEEP 1536:VcI/iEEEtXdFJj+0GPwHbP+w5rqkJhw2kBU:VZ/2wLt+0GY72wxhhd
- TLSH T1AF23F23B5F24A7058811B7B02640FBC87D183B23CFED54BE87189B9A0D98BF5646B1D9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1r2x66wx.default-release\cache2\entries\CD1C116DEEE8F4F97C1806976E10E7E2B349E486
- Size 13KB
- SHA256 72c574aba9b30ba823fce5cecbab3664b972a3f45a7148fedef957aef84343e2
- MD5 cf1d0b00810b5779d0f5c4b80ffbb750
- SHA1 7e15cb7fcfbbe697bbf515c3eb25a6b501086103
- SHA512 36b4845927e61a256c164e7253f8aafb2b1937bb75cbc4a319dd580b41dcdd79f475edd19451d03d049e63718f127a9f90e3767e6368899d5978b0130b24f5e2
- SSDEEP 384:HbaFrLiO024YhFuhw+5EL1pPsac4j0lpDII+y/W:7aAZYhFuK+5EB9sac4ID8Lp
- TLSH T106527E7EAF0138BA1A6BD194D8DD9214CE04E6BBEFE2D06605143854C78477CB8F64EE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 11KB
- SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
- MD5 25e8156b7f7ca8dad999ee2b93a32b71
- SHA1 db587e9e9559b433cee57435cb97a83963659430
- SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
- SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
- TLSH T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
- Size 502KB
- SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
- MD5 e690f995973164fe425f76589b1be2d9
- SHA1 e947c4dad203aab37a003194dddc7980c74fa712
- SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
- SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
- TLSH T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1r2x66wx.default-release\AlternateServices.bin
- Size 11KB
- SHA256 c2cd869d335b258923c14921fef48ff662a1d0dce02a3585590800599d88d44a
- MD5 3f2ca5956dc09dc2338367311ec8bdb2
- SHA1 7cc31e51d0e0b22194b43749cfaa6faf1c67fafd
- SHA512 f09781b54c859c9274416f4d2d87bcb8e13db4ebd603277339f3f0d4f323310638c9cb7aaefd6a84e521bac044717b4fe0f6851c537c75c151d8a3083848fd87
- SSDEEP 24:3uhMZzH91aO9Byk9xcO+lzzjm5q9F55A5ux9VvpU9Few9lK:T4UkGyO40I56uDBp2Q6s
- TLSH T19932B6F71B76E4B2F0928FB18098718CDC33172A55AD9185C76084E706C1FAA953FB68
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1r2x66wx.default-release\AlternateServices.bin
- Size 17KB
- SHA256 a7ef87129da739870dacc02637cd94cb2496d8fb324d75810b0902b236ef827d
- MD5 425c12dd704676ae8a355834e4caf030
- SHA1 505009073868103e6b80395d4751a2012f09ecc6
- SHA512 7feeebc857d3c641051d3a94a6d66fa406dc70469b66b3c4465a87776c23c2d8b67c2e34e0572f3c6c12a04173f114dda58ae0f202a89059c33e4fe4d4b62a37
- SSDEEP 96:SjUkGyO40I56uDBp2Q6sTDwDJgDFRuAX51:
- TLSH T1658296F75B76A5B2F0528FB18098718CDC33172A54AD8184872494F706C2BFAA53FB68
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1r2x66wx.default-release\AlternateServices.bin
- Size 25KB
- SHA256 0347ecbbac9902c00480e110ee324102beede65ad709558d8fccf0d915872f48
- MD5 1f00cd04eed7d982cf012f63320b67ed
- SHA1 a740712c9c297464c15554a44b39cf44d9baa170
- SHA512 7965cc767f0c68b9f1406d141721de5b9bcec0079dc38610139fa8a16f78fce433f4d9e2b5b9123a56f6fdab30ece15c2377f47bc8ca86c8544d792435c7b9fb
- SSDEEP 96:SjKGZZO40I56uDBp2Q6sTDwDJgDFRuAX51SQYW+OXl944QaIY/Rh:djY
- TLSH T19AB2CAF75BB6A5B1F0528FB04098758CDC33133A5498C5848B2488E707C67BAA57FF58
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1r2x66wx.default-release\datareporting\glean\db\data.safe.tmp
- Size 63KB
- SHA256 e5da739cf485d423038a80d3fdb864ca0f2a5d13599265f3c54dcbecd0534cf5
- MD5 01d20efea9ba9cbec45cd56b3bda49a3
- SHA1 5f5dc9613600460a3ca6ea10779d223558fdd26f
- SHA512 dd115473a769a8f9acc88e9ce1456ef75f7f578ab07ec56ce700e796d7e2134b12024a4178fce704127ac35113c6fc4af8fe9fade8689e3d9880fec577819ca6
- SSDEEP 1536:0JtklYugdYFqRMColn6RMgvlMxcHgnzKd1DV85:0DklY9VOCo0R6k6KLRk
- TLSH T17A53FF44EB1A543FD96802BA9DD61B007F78F8894A1A2FA7371C54786C873DC3D8E16E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1r2x66wx.default-release\datareporting\glean\db\data.safe.tmp
- Size 30KB
- SHA256 b7da8fce78648d9b42cb7eb4b11b8be594d12b2fe3215675b75d5e1a40719a7b
- MD5 7f92a68572f0da63c8b32ea6c54321ee
- SHA1 909517d31b431e3860c41cdde19f521a2ddf625d
- SHA512 4b36ce2b65bd48d85f58e46b82105382dd50de1b5d9f72d8241faa906397cd41006f9534a7756bce9c555d8fe405dff026ffd5e26775dbeaac2c5dfaf41f5bcc
- SSDEEP 768:gyo6FQVzyLSIGcmhuuBK+57czbZb8qpxbOPv:gyo6aVzqcBn9
- TLSH T185E20084FB2A953FD41512BBDCA507102F79B88658192F6B3A4C646C6C872DC3D9E07F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1r2x66wx.default-release\datareporting\glean\db\data.safe.tmp
- Size 6KB
- SHA256 0fa5208920f9e99b96966144202a7da78abb7a2bd622724cdeaceda881335cd3
- MD5 b6b863bc4849648571fd1a8ee4a77e48
- SHA1 1985babaf889df278930d2ec025e962d56b93d45
- SHA512 543b9f9b8fd3a8e4cfc232b5cc924d3fddbd01f43391b21065b2f3bea8ea75ea65c2832519bfee797bdce8e876a8497b03a0b89c2af32215d63327f17cab9069
- SSDEEP 192:U1d66Joz1zgCl6mSSdMOv5zbodZj0yjyI:ed66Joz1zgC1bRbodZj0yjF
- TLSH T130D1DF58E728853FD418027BDDA61B400F36389A9C4E7F2571EC641C2D972DD768E17E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1r2x66wx.default-release\datareporting\glean\db\data.safe.tmp
- Size 5KB
- SHA256 9582cbbf79fa92a9974b47545a7bb7a931a2d6b61f944799aa244612f0fe55f9
- MD5 33f312d8697a7be7f3f587257a3fa987
- SHA1 920892b0c3a8f50ca8a1b72abe9c6e90f1e53c90
- SHA512 4470c3c34be77d628472e1b4264719e1c405309a20e0333563104cc7b9f527000813b12fe8e87dbccd66f17dacdc5cedec72a62752fbb77e2a92fe61f069807e
- SSDEEP 96:clSdF95/7bkW6BrcEj0yUR6bWZ+Fq2FgFfFAF4/dd66Joz1zgClKtmSSd/U:2Ov5zboBbj0yjyb1d66Joz1zgCl6mSSd
- TLSH T1ECC1BD68E728853FD448023BCDA61B400F36385A985E7F2672EC641C3D972DEB68D17E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1r2x66wx.default-release\datareporting\glean\db\data.safe.tmp
- Size 7KB
- SHA256 d5b72cf7835b98c337b4f644d119fec6134664591f60e051d15bf75286065464
- MD5 8c78e1519a73c4fa73a5b6545dfd4ca9
- SHA1 55e47dd533ba67a47e7ede23f55d56d95e103f94
- SHA512 f580227a03409e4ce87fb4d00516e3399c410e97950c4e074cceb9868b9bb49a8d39da878c7548ee764c0743a6f37d9f74af728ed9419c41dd93127feb932c4a
- SSDEEP 192:V1d66Joz1zgCl6mSSdeOv5zboAQZj0yjwg:Td66Joz1zgC1bLbodZj0yj
- TLSH T19FE12268E628867FD408037BDCA61F414F39385A9C4E3F25759CA41C2D472EE768E1BE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1r2x66wx.default-release\datareporting\glean\events\events
- Size 5KB
- SHA256 40c57c79d4ed8567adad859fd7369fa8fdfb4ee49df5f110d3252211957db3d2
- MD5 f7bba21348f1777fb74eb955128a032e
- SHA1 082db3b930a4ad7b28f9267d10ccea3f9e7606ec
- SHA512 e04dca66a0da63d742c4f164bfb1f0fc1f2b709cb018838772a511f223f31217a2a81c59c675560a2a22fd60c00071d98915929bc4976ec413570e493f97a890
- SSDEEP 96:OK/sO/RQ8P51HxXNU44k5kHcS4De0Xqgg:OKFPjHxXNUtsXqH
- TLSH T142B1101D25B91CBE79DBD2A9B44103CD93C9470B90CB2C834DEBCE49CC4AA9A325F579
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1r2x66wx.default-release\datareporting\glean\events\events
- Size 1KB
- SHA256 82e6a938c2c1ce74ee863e744967ff136dd3a29feb4ec9bdafae677a3553199a
- MD5 0533f457ef6e878dfa57b66371719f49
- SHA1 2913c0bf99a7f9686170debf627c5e3453b9228a
- SHA512 661b70d6e6419be8dbd8958f6bffba96be48baad56a5b5926e757a22dd8fd8d72b33b233260bae7d40ec581f6e7bfe4743d550beca8b932266397948caa4cc8f
- TLSH T13811575C3EF94EAAA8CBE2A8708102CE93514A1F04CB1C434E12DF8CCD84FD9362A43D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1r2x66wx.default-release\datareporting\glean\pending_pings\397b246a-e5f6-4df5-af94-91a4aa2ff82c
- Size 886B
- SHA256 6c5333b34483afb0ecf0624bf3b91d7c27a72b2a37e31b779d1da269a8e8a3ac
- MD5 c45b2319014d2072af9ae4dcca10eaf4
- SHA1 e7e59e61901f095eb57b3e9d2f6397be78e4c411
- SHA512 295c64433fd36e29ec49b039972be5ec40440d1a3f6ec775efae639df2a789cdc3f90c52282dc5cb3f6f8be3b88d77d805806f525e5db3cc602cfaf880923f31
- TLSH T11911C451C674B5B2DD68938B95907F834BB4742380CA49247E648E1C4DE961DF356607
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1r2x66wx.default-release\datareporting\glean\pending_pings\4ccdc8ed-389b-4767-ac77-884bcb7a3f25
- Size 235B
- SHA256 449805c03427047e6315af2f2b609dcff23c8066df02a8a64951dcc2e78ca82d
- MD5 0b87c143b4642064e95772eeba02633a
- SHA1 24670d348823ce9a27538676ca5abd011aefd5da
- SHA512 d113932dd33cd284adad817eb8e302715830096a19026a12f975d03bbdcb22b3a9f34837895ad5a9b4ebeb2705f81d82f1db560d099e05e63b2e75e54faae3b1
- TLSH T150D09785249927AD48100F07F0B06ACB30954C339460B820C662C038EAFC9C5815280B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1r2x66wx.default-release\datareporting\glean\pending_pings\4dbc1f94-6553-470c-a143-e79e988336d7
- Size 17KB
- SHA256 b414090c004c087bb7bc884a3c7a65b09416d436a89f5317147a7277995e0457
- MD5 eb0ff0865cc977b820540d0ae5dea551
- SHA1 f43a9256aa610784d770609ae6f913b295ad7af1
- SHA512 24c877f7ce28a56ea5c234381f00c144b2e3cef1f7985179f8a16366761cb175a48b7b1112aefc2792a5218ab949c23bc5eb32c0b946fcc7c82ef946a16a9294
- SSDEEP 384:waz2rkKS2ydGRpd6VvsUy2qfgOJsdjgKkgE:wJuNyhoOJsdjxm
- TLSH T16B82B856686045BA8351E3A894AEBFC3E5F528CF4C418FC9DBF0BD085DDA09E132794B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1r2x66wx.default-release\datareporting\glean\pending_pings\5d2af9a0-ff7a-4e59-a385-13373239656b
- Size 883B
- SHA256 cf4e954b5e0db042c44eee28a5a0148f9cb47936468efa3709ffd644d3bbb59d
- MD5 dcd9a93cbce24051143935268f6df952
- SHA1 bf273c7a348b741ac005170601ec08ecadebab9c
- SHA512 b234e3379d8ede9941076acee87b90cc5be965ddce751844c827bbbab9526ab599837da22e5513661a002f25800ddf73224091ecd0cff60d2e4e12ebae3d6944
- TLSH T11A112751D674F8B3CD6CD28BC9517B4247B8782380CA85243DB45D080DBE62DA3D6607
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1r2x66wx.default-release\datareporting\glean\pending_pings\68f11c25-4d77-4419-a1cf-58fa0e6907b5
- Size 19KB
- SHA256 1cef323da9ab36ecb15a0247386434b359c1c27324dabb71754eee483063fb44
- MD5 9cc24317e16cff46287fc67a88d4e36d
- SHA1 eb258584e2d25c35c2ffe5f07506e109a4327200
- SHA512 d07d531897f30887cacd6562a71401a9c83ad4fd8fcec4ea58a4c3c0daf7bc5f435d55aef5913a72747602372ce4bf6f1728b094ffc0d078bd52c262c26f16d9
- SSDEEP 384:X2T6N8tSmPKpn0IyfWYP5wJw0EbbL/4fbm4pWIAqN/105K:Xe6N8tSmPKpn0IyfWYPuJw0EbX/2bm4V
- TLSH T13692E8FDCD1240473E65E51AF2EAADAB2057193109CDC3DD29FE083A2AD6DBB1527324
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1r2x66wx.default-release\datareporting\glean\pending_pings\b88dc0ae-3904-479b-9d8a-3aaf22b38f5a
- Size 235B
- SHA256 bc65cdbe0ead184ef1c98c5b2198cc7723dbfd38c062eb20051ff8e648c01ecb
- MD5 370e20de40f8625b262aa6af19a88a36
- SHA1 181dc5c3116eb55fd2f2e1d54153f8a39a5644fd
- SHA512 0f1b7e2ea790a484793e1ab9399bc47a9079e866f9ea2b9f7039f6b1a7b4bceec61d7270b0d816a377b36c88a5b2fafea3a9fb56b726909cefabb5f36f78dbc9
- TLSH T18DD097C028A8672D08170F1BF4A069C230868D33117C6810C56200348AFEBC9425180A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1r2x66wx.default-release\datareporting\glean\pending_pings\ee5a9154-8dae-477c-83d7-7b8b0ae6b3cd
- Size 2KB
- SHA256 f6f0a4b126c8c5dc16ce03c5cd60c62cd0dc16be7edf7799cc9ee6cced173313
- MD5 5ef37f02ff93ada9dad2df9031540788
- SHA1 a2c23600379810610ea3f40844618097f04fccef
- SHA512 b3ce113b329fbfd28b9aa3d2e8be84c43f3e89f2f09286bba0318d47ccb0d326ed5e9dd880925a39d76adf729f9c7c07a8bc9ab4e73b620d4bcf74bafea10997
- TLSH T1C24134AC76785CBB9CCEF59E918137CD93A4890300C62C936E51DF0CCD9276D336A81A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1r2x66wx.default-release\extensions.json
- Size 16KB
- SHA256 baba085abfab0afcc499f72b9c3d095012cbfe4824bdd5c3172a95637fa51470
- MD5 a02730b6dce9af944afcc1e80030e851
- SHA1 c095f7cfa15478c6495cbca589c177a2a4df90cc
- SHA512 de26f2020697ff948b0f1650f12f67c71bad5d52b02a4a0764945fd13aa4aca8599f82e7a121b91a968fd58bc6d24bf5fd7c442635d0b0fa7bd862c70e814df5
- SSDEEP 384:xkI4v4UmldvlS8dhWqQ94zB96odL4H3L4PFL4H+L4HXL4HvB4hI:CI4gRfNXY4r6q4b4d4k47454G
- TLSH T13072521545049EB8298E979BAA367E01C37D433B60845C78F4DD8FC842FB5B902FB66B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1r2x66wx.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
- Size 1.1MB
- SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
- MD5 626073e8dcf656ac4130e3283c51cbba
- SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
- SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
- SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
- TLSH T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1r2x66wx.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
- Size 116B
- SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
- MD5 ae29912407dfadf0d683982d4fb57293
- SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
- SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
- TLSH T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1r2x66wx.default-release\gmp-widevinecdm\4.10.2934.0\manifest.json
- Size 1001B
- SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
- MD5 580786a5ec9eb650dde3e0e75db8588a
- SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
- SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
- TLSH T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1r2x66wx.default-release\gmp-widevinecdm\4.10.2934.0\widevinecdm.dll
- Size 18.9MB
- SHA256 875a76af5b19622842c9b37fe77dce10ee83f27adbdcfcde9c814d4e1226d023
- MD5 15fa9ea03f6f451d587b1dabb2f7b036
- SHA1 a1a5cf60b693f732931f8e7512627d2840023dee
- SHA512 8d5e5aa0a116bb09dd492b6b59bcd9458ded013e6b52a31dd36e81313c3f2d9ea01d5bf3ec4b0f2593633a5313705af773a4e7245d6cfd96f231332db26d75ae
- SSDEEP 393216:uD9xOHbGD+l8Vm148M/i5hE4/junbj0OjLFI/USFUzUqr1d4Pg4C5/:tGD+l8VmuZ/S24/junfSFwUqYg4A
- TLSH T13717E149E36310E8E80E89F446AADA72D4743C4E03369BEF17D4BB3559727C06A79F06
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1r2x66wx.default-release\prefs-1.js
- Size 12KB
- SHA256 aed06d08f36868ceab7c797e83799c248d07fa2b5c8a637d9229ad6fb3696bb8
- MD5 57d8f5b7562c7c05d0caa91f6688bc73
- SHA1 8cfa137835836be628c370225fa1dfd1a1521fd8
- SHA512 481889a311c3a927f9479ec6207b45422e77c5b872a77e7f8aa65ee1cad0227ce591054aa74cc52afaf65839c4a0746731337e65b9265d9724861e1fc28543ad
- SSDEEP 192:WdCROfFuE4MlGUSSRLRt4EmBw8OH+JMN7QO:kRRt43wwckO
- TLSH T19B429B385144CB7F34B3727DAC2949E05965022BB6FFBCD702F99881084CF2585EAAE7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1r2x66wx.default-release\prefs-1.js
- Size 8KB
- SHA256 c540d49dfb9afe10b397539beb21f2d5d9289032e0779d6146a59b9fb70c8a92
- MD5 0fce1fcb79791078de9c9cc0e02a5f37
- SHA1 1964e8c7d687d50881fe79c03bead6c467cbfb0d
- SHA512 e0c348cbdfe25e38a0452292e02c5c98fe3d93192b61f50df0cdefc4b22c143b7657f85393a55d667c2303768171219bfd31fef47f474802087e30d28381147f
- SSDEEP 96:xH8VTUx/qGqOfFuE4MNbzScGUSSl7dv9j6nqWRgqDeBw88zeY8L4cn0XM9GS:WNROfFuE4MlGUSSuRtSBw88aUO
- TLSH T1A502EE789148CF6F74B276BCAC684C719A72023BB6BF68C751B95884050CF3445FA6EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1r2x66wx.default-release\prefs.js
- Size 6KB
- SHA256 5e588c8c7b129e9bfb962c9afa8356fa2f07f8c5b2dce5a13d6c77801c2bd596
- MD5 8bc179c5a2db80d49a885cb26f23f117
- SHA1 d9c9253bfb489475c6e9abbeed5a0b4282119a34
- SHA512 5252d2befd9f126f6ffa6762c0ae5b250a960008ff05361cced0083e3d4de41ed9264bc0fdfb3c85b63cb7499c38c4b6418f98e62c9946f033177ac0b4c6e22f
- SSDEEP 96:xH8UTUx/qGqOfpKtnp1zSSqSSl7dv9jJnqHWDoBw88P8L4cn0XRA:WkROfpCp3qSSEW8Bw889+
- TLSH T10DE11F7891188F6F74B67BACAC688C319AB2013BBABF68C750B55484054CF3841F96E7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1r2x66wx.default-release\prefs.js
- Size 7KB
- SHA256 b2376fcd06d07ac87dd3a288dd8001096e8c85cedc213f367bd6c5c5f4a8cf48
- MD5 908d091e532ad57a636237d630397ebf
- SHA1 7018be6ce2720b643246b833e6fdc949d7c0277f
- SHA512 c92140a3f60395da9f9940829a4363002cfff63d80868255ab216fd6f351aed28ae791612f21665ebe34422e1621dc6893fff9c08578c2f716833f2c4835b92e
- SSDEEP 96:xH8UTUx/qGqOfp4MNbzScGUSSl7dv9j6nqHWDoBw88P8L4cn0XR9GS:WkROfp4MlGUSSPW8Bw8899
- TLSH T15DE10F7895088B7F74B677ACAC688C319AB2013BBABF68C750B554C4054CF3445FA6EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1r2x66wx.default-release\prefs.js
- Size 6KB
- SHA256 3d2c8b13736e226a8f5fb07037bfc96408d1c2404dc66a1e3c74a3aa5ee8de84
- MD5 08c80d79d30ed20ad34d6924605e81a4
- SHA1 362c6b9a24f03daec0c8bd47f4d22f851652879f
- SHA512 afcd415d922bcf590aef3056b61669be10976406077f62d520d7bed7093c9258050609970025d0c60a9baa17d45f3068ef359947988025f6cb3f975fa5bbc0bd
- SSDEEP 96:xH8UTUx/qGqOfp4M1zScGUSSl7dv9jJnqHWDoBw88P8L4cn0XRA:WkROfp4MRGUSSEW8Bw889+
- TLSH T109E12F7895088B7F74B677ACAC688C319AB2013BBBBF68C750B95484054CF3445F96EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1r2x66wx.default-release\sessionstore-backups\recovery.baklz4
- Size 3KB
- SHA256 9393814e36ea665d27243df0118ac73db5f9ee2d33ea667cb61a5aa87fac002a
- MD5 ade4882a0e89923334e2e950091e9482
- SHA1 dddc477d0e865bcfea480bf5b363eea2f7c7e73c
- SHA512 b94207f9ca23f0f2be37f09e4f67548bf89477e757b37532d7b4c16d7d6e8b006b20827aeecafda8278e7974ad4d72bc3384f2bdf9c9fa524d40d003d56d92e4
- TLSH T1AB816CB6D91D3C82ECF8B9AE20E144E3DF7F10001BE6D49DA1121137848B6C627D4579
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1r2x66wx.default-release\sessionstore-backups\recovery.baklz4
- Size 4KB
- SHA256 92016152b33a474afb9a40696f091af674b5de795072e14723d5c76815a1c9f5
- MD5 e72b8d4cd75e8654fd0712b3192968c9
- SHA1 2772bf8f7d04d8d9cb4d511bd5c09a5383a58983
- SHA512 04e3b376a3a9866c9e785fb808d9c13c1fed435144fedfeda115e0c55a77657039cb7f8d24ae47f76eafe4f31e6ab833cf0686a7b5b7a531b84175adb679244d
- SSDEEP 96:Y2h3UbaMtFu9/58EMJF7caMZk0zf8W8Q73goS2FgpX:YA3zMtFubRgFfMZkcxL5A
- TLSH T1B1916D53ED18688BECB8B17510F289A3DBFFC04097E6E8D8B184157280473875E9C762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1r2x66wx.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- Size 3.2MB
- SHA256 b1ee63811a3adb86d3b11938edc18ad2a4549f5d81fd964c67a506f7454583ad
- MD5 35fc050d79df133629aaaa371a9ab9eb
- SHA1 49b15d7ece8899a519159e952aa1d76334c01ea5
- SHA512 3d7b6b65f5b588e8ea0cb195499dbaaf144c3f62bc7eb6918599adb5fdc1eea1d4fb98121f48ef72f68bf47dc1161f6c1041bb99a686e8203a56b1a0a99ee4bb
- SSDEEP 24576:UJfiIxyeiWW2b6EBbXyrWOpDh9gBjA4plrZjo:UJfmXWJ6GXyrWKDh9+jA4HrZj
- TLSH T158F53BF820D2B357F3418033A64593EB21AFD00C6467DE044BA956E895B9CEF9E05B7E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\MBSetup.exe
- Size 2.7MB
- SHA256 0b9465643cd2609856e7ebdebc34296670a2b388c2bcf6e5ee0b59430c97bf41
- MD5 c12892ce63fe1ece5eb0b551019f0b9a
- SHA1 1c8e0ef2c2af8a6cc7763e87a3db307cf231df6d
- SHA512 d9a09154eb67f64190eef474bf70430591e3248bae751529cd37d41acc5bf15f4f6ad3be3e52ea887eba6d30380d272b9b9d7ea899af1056c941b3de7e0ce855
- SSDEEP 49152:bUgNqjSWr+s3E5C4tAwAeyfvE0Z3R0Tnxn1o2d581Kj:b/6SWr+s3yC4AeKtwnW2Ei
- TLSH T1F2D58E31B2918120E5F39370297EB7EA5B75BC256F76408F32D8B6390B725C09D35B26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\CatRoot2\dberr.txt
- Size 48KB
- SHA256 c033728aa08e08d2ebf0ded24c49598bc7d2eabc588f2d7f28e52494abe22eca
- MD5 ac771c10287f2fdc2fbbd66b85081d35
- SHA1 a47165d877550ce1d2e4c12c508d33a0af0eee50
- SHA512 7729035cb037cc5c34f9e847d6742c479b469266fa85ac242f34bebd51a21e6bf37b867d3b5cdda4cebbbce4f8afb303e337700ad0baf7dd21d37db76932367f
- SSDEEP 768:8tiV3ARN344BwWlSecIrmIwWYdls0K+5G8A7:8tiV363nBwWlSecIrOWYdls0K+5Gt
- TLSH T13123474956DC8528D5F60D722667EE71C59B96CAB30B3EF930FC62149C82B043FBA05E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\CatRoot2\dberr.txt
- Size 48KB
- SHA256 e5614fea07cb1f9219482edf57b2efdb4715309161aff31e08f7dc6146f4c460
- MD5 f2cba8e90ff3ffd90d3b0204a24cad01
- SHA1 dbfb020f156a5fa43cf2be0dc27c973811eb5cc3
- SHA512 6ae85f018f47491ac8aa63c787f85aa5b86712c3acdabe63e646a1b451bbc878675985bf13ab74ce94e1f72f81fbf7d9ac4768f3448524fe723d8ee95224d819
- SSDEEP 768:8tiV3ARN344BwWlSecIrmIwWYdls0K+5G8AC:8tiV363nBwWlSecIrOWYdls0K+5Go
- TLSH T16E23474956DC8528D5F60D722667EE71C59B96CAB30B3EF930FC62149C82B043FBA05E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\catroot2\dberr.txt
- Size 48KB
- SHA256 9ba99eefaf1ff2218aa181102668c1b023722c0655f6b47eb833f420d2242641
- MD5 3e8a3fafc97bb7dddb1efaf94169b78b
- SHA1 8de32e7dbe297db89247734197a0aacacc3b7424
- SHA512 bdfbf074b87c198ae110b74d471413247717c88b500586c1c77fa2e266484f5025ce38d6ff22acfa7c80ab90f9e6fde352bbe23e5296d276eac09cbc2e97ebe4
- SSDEEP 768:8tiV3ARN344BwWlSecIrmIwWYdls0K+5G8AJ:8tiV363nBwWlSecIrOWYdls0K+5G7
- TLSH T1A023474956DC8528D5F60D722667EE71C59B96CAB30B3EF930FC62149C82B043FBA05E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\drivers\MbamChameleon.sys
- Size 230KB
- SHA256 5081c4af92fad9feb2731238732557ff647b5d067a81d36d77e08f9312f89f4b
- MD5 a91e0fe724cf0f744a66df2ab672941d
- SHA1 e92afd1832b98e17d02e4c66d3f3dbe4ca24cb97
- SHA512 842a14e1239d1123cd48f1f918fe7045fc537db45d835f1331d55e60d68b82eef97636e0f02a7b6f0b57687c56c1f34028fc28752b2dd48d002a57ef98751c49
- SSDEEP 3072:4fO133rwbPD4gVVJdkHAbSi++2Y81zmNPochh86qK4JZ75C1dPHXO6ivf3Jj8go0:Bs9kHAbS4fNPXk6qpC1dPjUfJjP
- TLSH T152347D4AD2E41DAAF9B7C27A8E969542E77334091B31DACF1370842A1F677B0F53530A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\drivers\MbamElam.sys
- Size 21KB
- SHA256 ded569e249e590314d095f740c6b8934a5a797e4f3edbe0f78eac9d333f12a2a
- MD5 8da81aa1f6b89ce1d2e216e3ea351c59
- SHA1 4baf79cbade9a5584630a540e6368d547579fb12
- SHA512 6d611bbd9d480ef2defd745fd06c4ab86e181267cf689d9d0e124edbaf22fd30fbe2310879cc7bb6dde5bae72c4feea1d329cdecfbf101d95634f85dd0769119
- SSDEEP 192:C7IlO/ZnEc+PbYv6/i0RtPH920QvVUKjnegqdsW++w/y1wVWQ4uW/+O68RwX01kd:wIlO/i8ChLIxUKjnev6+Twc69R9zING
- TLSH T108A23B6549780283F6BBC570C7E4C927BD38F39677408AEB0591E5681DA37C2AB3192D
- MD5 SHA1 SHA512 SSDEEP TLSH