Overview
overview
10Static
static
3Malwarebyt...al.zip
windows10-2004-x64
1Malwarebyt...al.zip
windows11-ltsc_2024-x64
1Malwarebyt...up.exe
windows10-2004-x64
10Malwarebyt...up.exe
windows11-ltsc_2024-x64
8Malwarebyt...tch.7z
windows10-2004-x64
8Malwarebyt...tch.7z
windows11-ltsc_2024-x64
8Patch_MB_5.x.exe
windows10-2004-x64
8Patch_MB_5.x.exe
windows11-ltsc_2024-x64
8Malwarebyt....x.exe
windows10-2004-x64
8Malwarebyt....x.exe
windows11-ltsc_2024-x64
8Analysis
- user interaction
yes - max time kernel
257s - max time network
295s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
05/09/2026, 19:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Malwarebytes Premium 5.1.1.106 Multilingual.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
Malwarebytes Premium 5.1.1.106 Multilingual.zip
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
Malwarebytes Premium 5.1.1.106 Multilingual/MBSetup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
43 signatures
150 seconds
Behavioral task
behavioral4
Sample
Malwarebytes Premium 5.1.1.106 Multilingual/MBSetup.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
Behavioral task
behavioral5
Sample
Malwarebytes Premium 5.1.1.106 Multilingual/Patch.7z
Resource
win10v2004-20260513-en
windows10-2004-x64
38 signatures
150 seconds
Behavioral task
behavioral6
Sample
Malwarebytes Premium 5.1.1.106 Multilingual/Patch.7z
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
Behavioral task
behavioral7
Sample
Patch_MB_5.x.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
37 signatures
150 seconds
Behavioral task
behavioral8
Sample
Patch_MB_5.x.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
38 signatures
150 seconds
Behavioral task
behavioral9
Sample
Malwarebytes Premium 5.1.1.106 Multilingual/Patch/Patch_MB_5.x.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
37 signatures
150 seconds
Behavioral task
behavioral10
Sample
Malwarebytes Premium 5.1.1.106 Multilingual/Patch/Patch_MB_5.x.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
37 signatures
150 seconds
General
- Target Malwarebytes Premium 5.1.1.106 Multilingual/MBSetup.exe
- Size 290.1MB
- Sample260905-ymmcdaytb1
- SHA256 e3168b1cbdc4709dae53d4dee1c45aa7916cdf12998d84bc7b275d5d28832ba1
- MD5 8f98e1ad523e10c72f04a787bf2df6f0
- SHA1 e2d0b2c6b2609b9cfb7eaac6d35b5c0b6c627db4
- SHA512 140be3b084e2e6dccaf60b144605fd025fc59b5549df0752934715f8fc043aaf345a03eda1a511682390e4208e583e5dbead8cf527310a02350438626bb76d21
- SSDEEP 6291456:4m9f3dcwLz3zPG3hqdud7epJXN20DnMf3dc82JxqCtIIO0AE5:9xtciDrG3Uc67XNZDnEtc82JxRRtA+
- TLSH T1BEE83312B3A641B4E4B281348A6E9757C6B97C174B7186CF13807A3D1F337E59E3AB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 3032 created 3268 3032 MBSetup.exe 56 - Drops file in Drivers directory 8 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\mbamtestfile.dat MBSetup.exe File created C:\Windows\system32\drivers\mbae64.sys MBAMInstallerService.exe File created C:\Windows\system32\DRIVERS\MbamElam.sys MBAMService.exe File created C:\Windows\system32\DRIVERS\mbamswissarmy.sys MBAMService.exe File created C:\Windows\system32\DRIVERS\MbamChameleon.sys MBAMService.exe File opened for modification C:\Windows\System32\drivers\etc\hosts cmd.exe File opened for modification C:\Windows\system32\DRIVERS\MbamElam.sys MBAMService.exe File opened for modification C:\Windows\System32\drivers\etc\hosts attrib.exe - Modifies RDP port number used by Windows 1 TTPs
- Sets service image path in registry 3 TTPs 2 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MBAMSwissArmy\ImagePath = "\\SystemRoot\\System32\\Drivers\\mbamswissarmy.sys" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mbamchameleon\ImagePath = "\\SystemRoot\\System32\\Drivers\\MbamChameleon.sys" MBAMService.exe - Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate MBAMService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion MBSetup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate MBSetup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion MBAMService.exe - Impair Defenses: Safe Mode Boot 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\MBAMService MBAMInstallerService.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\MBAMService\ = "Service" MBAMInstallerService.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: MBAMInstallerService.exe File opened (read-only) \??\T: MBAMInstallerService.exe File opened (read-only) \??\I: MBAMService.exe File opened (read-only) \??\K: MBAMService.exe File opened (read-only) \??\Y: MBAMService.exe File opened (read-only) \??\L: MBAMInstallerService.exe File opened (read-only) \??\N: MBAMInstallerService.exe File opened (read-only) \??\W: MBAMService.exe File opened (read-only) \??\R: MBAMInstallerService.exe File opened (read-only) \??\S: MBAMInstallerService.exe File opened (read-only) \??\V: MBAMInstallerService.exe File opened (read-only) \??\R: MBAMService.exe File opened (read-only) \??\B: MBAMInstallerService.exe File opened (read-only) \??\E: MBAMInstallerService.exe File opened (read-only) \??\H: MBAMInstallerService.exe File opened (read-only) \??\E: MBAMService.exe File opened (read-only) \??\Q: MBAMService.exe File opened (read-only) \??\U: MBAMService.exe File opened (read-only) \??\V: MBAMService.exe File opened (read-only) \??\U: MBAMInstallerService.exe File opened (read-only) \??\Z: MBAMInstallerService.exe File opened (read-only) \??\G: MBAMService.exe File opened (read-only) \??\J: MBAMService.exe File opened (read-only) \??\M: MBAMService.exe File opened (read-only) \??\N: MBAMService.exe File opened (read-only) \??\O: MBAMService.exe File opened (read-only) \??\P: MBAMService.exe File opened (read-only) \??\A: MBAMInstallerService.exe File opened (read-only) \??\W: MBAMInstallerService.exe File opened (read-only) \??\B: MBAMService.exe File opened (read-only) \??\H: MBAMService.exe File opened (read-only) \??\L: MBAMService.exe File opened (read-only) \??\G: MBAMInstallerService.exe File opened (read-only) \??\I: MBAMInstallerService.exe File opened (read-only) \??\K: MBAMInstallerService.exe File opened (read-only) \??\P: MBAMInstallerService.exe File opened (read-only) \??\X: MBAMInstallerService.exe File opened (read-only) \??\S: MBAMService.exe File opened (read-only) \??\M: MBAMInstallerService.exe File opened (read-only) \??\Y: MBAMInstallerService.exe File opened (read-only) \??\A: MBAMService.exe File opened (read-only) \??\T: MBAMService.exe File opened (read-only) \??\X: MBAMService.exe File opened (read-only) \??\Z: MBAMService.exe File opened (read-only) \??\J: MBAMInstallerService.exe File opened (read-only) \??\O: MBAMInstallerService.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation Malwarebytes.exe -
pid Process 5100 powershell.exe 2300 powershell.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\System32\DriverStore\FileRepository\net9500-x64-n650f.inf_amd64_e92c5a65e41993f9\net9500-x64-n650f.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netvf63a.inf_amd64_a090e6cfaf18cb5c\netvf63a.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netnvm64.inf_amd64_35bbbe80dec15683\netnvm64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netwns64.inf_amd64_162bb49f925c6463\netwns64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\net8192se64.inf_amd64_167684f9283b4eca\net8192se64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netrtwlane.inf_amd64_20caba88bd7f0bb3\netrtwlane.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netvwifimp.inf_amd64_ec11d0ad3c5b262a\netvwifimp.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netk57a.inf_amd64_d823e3edc27ae17c\netk57a.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\usbnet.inf_amd64_9e6bb7a4b7338267\usbnet.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\bcmdhd64.inf_amd64_e0bae6831f60ea5f\bcmdhd64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netv1x64.inf_amd64_30040c3eb9d7ade4\netv1x64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\net44amd.inf_amd64_450d4b1e35cc8e0d\net44amd.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netefe3e.inf_amd64_7830581a689ef40d\netefe3e.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netrndis.inf_amd64_be4ba6237d385e2e\netrndis.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\rt640x64.inf_amd64_8984d8483eef476c\rt640x64.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{98d89663-eecb-6b46-82b3-1cf011c08afc}\mbtun.cat DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\netr28x.inf_amd64_5d63c7bcbf29107f\netr28x.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netrtwlane01.inf_amd64_b02695ef070d7a42\netrtwlane01.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netrtwlane_13.inf_amd64_992f4f46e65f30d4\netrtwlane_13.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\bcmwdidhdpcie.inf_amd64_977dcc915465b0e9\bcmwdidhdpcie.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netrtwlans.inf_amd64_97cd1a72c2a7829c\netrtwlans.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\net7400-x64-n650.inf_amd64_557ce3b37c3e0e3b\net7400-x64-n650.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\Temp\{98d89663-eecb-6b46-82b3-1cf011c08afc}\SETDCAA.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{98d89663-eecb-6b46-82b3-1cf011c08afc}\mbtun.inf DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\netelx.inf_amd64_7812e4e45c4a5eb1\netelx.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netl1e64.inf_amd64_8d5ca5ab1472fc44\netl1e64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\net7800-x64-n650f.inf_amd64_178f1bdb49a6e2fd\net7800-x64-n650f.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\net8192su64.inf_amd64_66c8bfc7a4b1feed\net8192su64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netbc64.inf_amd64_b96cdf411c43c00c\netbc64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\Temp\{98d89663-eecb-6b46-82b3-1cf011c08afc}\SETDCAB.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\mbtun.inf_amd64_add82795013a7c3b\mbtun.cat DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt MBAMService.exe File created C:\Windows\System32\DriverStore\FileRepository\netwmbclass.inf_amd64_dba6eeaf0544a4e0\netwmbclass.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\usbncm.inf_amd64_9957a38c3d2283ed\usbncm.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{98d89663-eecb-6b46-82b3-1cf011c08afc}\SETDCAB.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\mbtun.inf_amd64_add82795013a7c3b\mbtun.sys DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\netl160a.inf_amd64_e4cbe375963a69e9\netl160a.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netmlx5.inf_amd64_101a408e6cb1d8f8\netmlx5.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netjme.inf_amd64_752bf22f1598bb7e\netjme.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netl260a.inf_amd64_783312763f8749c7\netl260a.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\ipoib6x.inf_amd64_ef71073a5867971f\ipoib6x.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netwbw02.inf_amd64_1c4077fa004e73b4\netwbw02.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netbxnda.inf_amd64_1fff3bc87a99b0f1\netbxnda.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\mwlu97w8x64.inf_amd64_23bc3dc6d91eebdc\mwlu97w8x64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netathr10x.inf_amd64_2691c4f95b80eb3b\netathr10x.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\msdri.inf_amd64_97bef65a8432edd4\msdri.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netg664.inf_amd64_84cd7b2798e0a666\netg664.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\net1ic64.inf_amd64_5f033e913d34d111\net1ic64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netbc63a.inf_amd64_7ba6c9cea77dd549\netbc63a.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netrasa.inf_amd64_1bdf7a435cb3580d\netrasa.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netwtw08.inf_amd64_7c0c516fb22456cd\netwtw08.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\rtux64w10.inf_amd64_d6132e4c7fe2fac6\rtux64w10.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netr7364.inf_amd64_310ee0bc0af86ba3\netr7364.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{98d89663-eecb-6b46-82b3-1cf011c08afc} DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\msux64w10.inf_amd64_5aa81644af5957b3\msux64w10.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netax88772.inf_amd64_5d1c92f42d958529\netax88772.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netax88179_178a.inf_amd64_b6748bc8bb8ccf4d\netax88179_178a.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\e2xw10x64.inf_amd64_04c2ae40613a06ff\e2xw10x64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\net819xp.inf_amd64_ff7a5dd4f9b1ceba\net819xp.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\nete1e3e.inf_amd64_895623810c19146a\nete1e3e.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netavpna.inf_amd64_f6f0831ba09dd9f5\netavpna.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\net8187se64.inf_amd64_99a4ca261f585f17\net8187se64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\net1yx64.inf_amd64_8604d8a50804b9c1\net1yx64.PNF MBVpnTunnelService.exe - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\7-Zip\Lang\mn.txt 7z2201.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.25\System.Diagnostics.Process.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.25\System.Memory.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.25\System.Web.HttpUtility.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\WindowsBase.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.25\PresentationFramework.Aero.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hant\System.Windows.Forms.Design.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\ig.exe MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.25\coreclr.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.Serialization.Json.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.25\it\Microsoft.VisualBasic.Forms.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.25\tr\UIAutomationClientSideProviders.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\Prism.DryIoc.Wpf.dll MBAMInstallerService.exe File created C:\Program Files (x86)\7-Zip\Lang\ja.txt 7z2201.exe File created C:\Program Files (x86)\7-Zip\Lang\zh-cn.txt 7z2201.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.25\es\WindowsFormsIntegration.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.25\PresentationUI.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\ReachFramework.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\ArwControllerImpl.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.25\System.IO.Compression.Brotli.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.25\System.Xml.XPath.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\malwarebytes_assistant.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\mb5uns.exe MBAMInstallerService.exe File created C:\Program Files (x86)\7-Zip\Lang\ar.txt 7z2201.exe File created C:\Program Files (x86)\7-Zip\Lang\lv.txt 7z2201.exe File opened for modification C:\Program Files (x86)\7-Zip\Lang\sw.txt 7z2201.exe File created C:\Program Files (x86)\7-Zip\Lang\zh-tw.txt 7z2201.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.CompilerServices.VisualC.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\UIAutomationTypes.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\CleanControllerImpl.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\VPNControllerImpl.dll MBAMInstallerService.exe File created C:\Program Files (x86)\7-Zip\Lang\uz-cyrl.txt 7z2201.exe File opened for modification C:\Program Files (x86)\7-Zip\Lang\zh-cn.txt 7z2201.exe File opened for modification C:\Program Files\Malwarebytes\Anti-Malware\serviceconfig.json.bak rs.tmp File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.25\Microsoft.DiaSymReader.Native.amd64.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.25\System.Net.WebSockets.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.25\es\System.Xaml.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\System.Windows.Controls.Ribbon.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\WindowsFormsIntegration.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.UI.Theme.Dark.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\MbamBgNativeMsg.exe MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.sys MBAMService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.25\System.Diagnostics.StackTrace.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.25\System.Reflection.Metadata.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.25\de\System.Windows.Input.Manipulations.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\PresentationFramework.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.25\UIAutomationTypes.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hant\System.Windows.Forms.resources.dll MBAMInstallerService.exe File opened for modification C:\Program Files (x86)\7-Zip\Lang\cs.txt 7z2201.exe File created C:\Program Files (x86)\7-Zip\Lang\el.txt 7z2201.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.25\clretwrc.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.25\createdump.exe MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.25\System.Net.Primitives.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\ReachFramework.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\System.Windows.Forms.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hant\PresentationCore.resources.dll MBAMInstallerService.exe File created C:\Program Files (x86)\7-Zip\Lang\et.txt 7z2201.exe File opened for modification C:\Program Files (x86)\7-Zip\Lang\ko.txt 7z2201.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.25\System.Reflection.TypeExtensions.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\System.Windows.Forms.Design.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.25\es\UIAutomationProvider.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\System.Windows.Forms.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\UIAutomationClientSideProviders.resources.dll MBAMInstallerService.exe - Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.dev.log MBVpnTunnelService.exe File opened for modification C:\Windows\INF\setupapi.dev.log svchost.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\inf\oem3.inf DrvInst.exe File created C:\Windows\inf\oem3.inf DrvInst.exe - Executes dropped EXE 18 IoCs
pid Process 5184 MBAMInstallerService.exe 1656 MBVpnTunnelService.exe 4428 MBVpnTunnelService.exe 2528 MBAMService.exe 720 MbamElam.sys 4852 MBAMService.exe 3516 MBAMService.exe 3904 mbamswissarmy.sys 4876 MbamChameleon.sys 4964 Malwarebytes.exe 4412 7z2201.exe 3880 7z.exe 3944 7z.exe 4648 rs.exe 3172 rs.tmp 5116 mb5uns.exe 6064 Malwarebytes.exe 2980 Malwarebytes.exe - Loads dropped DLL 57 IoCs
pid Process 5184 MBAMInstallerService.exe 5184 MBAMInstallerService.exe 5184 MBAMInstallerService.exe 1656 MBVpnTunnelService.exe 4428 MBVpnTunnelService.exe 4428 MBVpnTunnelService.exe 3516 MBAMService.exe 3516 MBAMService.exe 3516 MBAMService.exe 3516 MBAMService.exe 3516 MBAMService.exe 3516 MBAMService.exe 3516 MBAMService.exe 3516 MBAMService.exe 3516 MBAMService.exe 3516 MBAMService.exe 3516 MBAMService.exe 3516 MBAMService.exe 3516 MBAMService.exe 3516 MBAMService.exe 3516 MBAMService.exe 3516 MBAMService.exe 3516 MBAMService.exe 3516 MBAMService.exe 3516 MBAMService.exe 3516 MBAMService.exe 3516 MBAMService.exe 3516 MBAMService.exe 3516 MBAMService.exe 3516 MBAMService.exe 3516 MBAMService.exe 3516 MBAMService.exe 3516 MBAMService.exe 4964 Malwarebytes.exe 4964 Malwarebytes.exe 4964 Malwarebytes.exe 4964 Malwarebytes.exe 4964 Malwarebytes.exe 4964 Malwarebytes.exe 4964 Malwarebytes.exe 4964 Malwarebytes.exe 3268 Explorer.EXE 3880 7z.exe 3944 7z.exe 3172 rs.tmp 3172 rs.tmp 3172 rs.tmp 6064 Malwarebytes.exe 6064 Malwarebytes.exe 6064 Malwarebytes.exe 6064 Malwarebytes.exe 6064 Malwarebytes.exe 2980 Malwarebytes.exe 2980 Malwarebytes.exe 2980 Malwarebytes.exe 2980 Malwarebytes.exe 2980 Malwarebytes.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 1 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh MBVpnTunnelService.exe - Executes a command shell one-liner 1 TTPs 6 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4264 cmd.exe 6068 cmd.exe 1504 cmd.exe 3228 cmd.exe 5688 cmd.exe 5656 cmd.exe - Modifies trusted root certificate store through registry 1 TTPs 11 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8DA7F965EC5EFC37910F1C6E59FDC1CC6A6EDE16\Blob = 0300000001000000140000008da7f965ec5efc37910f1c6e59fdc1cc6a6ede162000000001000000450300003082034130820229a0030201020213066c9fcf99bf8c0a39e2f0788a43e696365bca300d06092a864886f70d01010b05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412031301e170d3135303532363030303030305a170d3338303131373030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f74204341203130820122300d06092a864886f70d01010105000382010f003082010a0282010100b2788071ca78d5e371af478050747d6ed8d78876f49968f7582160f97484012fac022d86d3a0437a4eb2a4d036ba01be8ddb48c80717364cf4ee8823c73eeb37f5b519f84968b0ded7b976381d619ea4fe8236a5e54a56e445e1f9fdb416fa74da9c9b35392ffab02050066c7ad080b2a6f9afec47198f503807dca2873958f8bad5a9f948673096ee94785e6f89a351c0308666a14566ba54eba3c391f948dcffd1e8302d7d2d747035d78824f79ec4596ebb738717f2324628b843fab71daacab4f29f240e2d4bf7715c5e69ffea9502cb388aae50386fdbfb2d621bc5c71e54e177e067c80f9c8723d63f40207f2080c4804c3e3b24268e04ae6c9ac8aa0d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604148418cc8534ecbc0c94942e08599cc7b2104e0a08300d06092a864886f70d01010b0500038201010098f2375a4190a11ac57651282036230eaee628bbaaf894ae48a4307f1bfc248d4bb4c8a197f6b6f17a70c85393cc0828e39825cf23a4f9de21d37c8509ad4e9a753ac20b6a897876444718656c8d418e3b7f9acbf4b5a750d7052c37e8034bade961a0026ef5f2f0c5b2ed5bb7dcfa945c779e13a57f52ad95f2f8933bde8b5c5bca5a525b60af14f74befa3fb9f40956d3154fc42d3c7461f23add90f48709ad9757871d1724334756e5759c2025c266029cf2319168e8843a5d4e4cb08fb231143e843297262a1a95d5e08d490aeb8d8ce14c2d055f286f6c49343776661c0b9e841d7977860036e4a72aea5d17dba109e866c1b8ab95933f8ebc490bef1b9 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\5A8CEF45D7A69859767A8C8B4496B578CF474B1A\Blob = 0300000001000000140000005a8cef45d7a69859767a8c8b4496b578cf474b1a2000000001000000450500003082054130820329a0030201020213066c9fd29635869f0a0fe58678f85b26bb8a37300d06092a864886f70d01010c05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412032301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f74204341203230820222300d06092a864886f70d01010105000382020f003082020a0282020100ad969f2d9c4a4c4a81795199ec8acb6b605113bc4d6d06fcb0088ddd19106ac7260c35d8c06f2084e994b19b8503c35bdb4ae8c8f89076d95b4fe34ce806364dcc9aac3d0c902b92d4061960ac374479858182ad5a37e00dcc9da64c5276ea439db704d150f655e0d5d2a64985e937e9ca7eae5c954d489a3fae205a6d8895d934b8521a4390b0bf6c05b9b678b7ead0e43a3c125362ff4af27bbe3505a91234e3f36474622c3d00495a28fe3244bb87dd652702713bda4af71fdacdf72155904f0fecae82e19f6bd945d3bbf05f87ed3c2c3986da3fdeec7255eb79a3addbdd7cb0ba1ccefcde4f3576cf0ff8781f6a36514627615be99ecff0a2557d7c258a6f2fb4c5cf842e2bfd0d51106cfb5f1bbc1b7ec5ae3b98013192ff0b57f49ab2b957e9abef0d76d1f0eef4ce86a7e06ee9b469a1df69f633c6692e97139ea587b057108137c953b3bb7ff692d19cd018f4926eda834fa663994ca5fb5eef21647a205f6c648515cb37e9620c0b2a16dc012e32da3e4bf59e3af6174094ef9e910886fabe63a85a33eccb744395f96c695236c7296ffc55035c1ffb9fbd47ebe74947950b4e89220949e0f5611ef1bf2e8a726e8059ff573af97532a34e5feced2862d94d73f2cc811760edcdebdcdba7cac57e02bdf2540854fdb42d092c17544a98d154e1516708d2ed6e7e6f3fd22d81592966cb903995111e7427feddebaf0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414b00cf04c30f405580248fd33e552af4b84e36652300d06092a864886f70d01010c05000382020100aaa8808f0e78a3e0a2d4cde6f5987a3bea0003b0970e93bc5aa8f62c8c7287a9b1fc7f73fd637178a58759cf30e10d10b2135a6d82f56ae6809fa0050b68e4476bc76adfb6fd773272e518fa09f4a0932c5dd28c75857665900c0379b7312363ad788309866884cafff9cf269a9279e7cd4bc5e761a717cbf3a91293936ba7e82f5392c46058b0cc0251185b858d625963b6adb4de9afb26f70027c05d55377499c9507fe3592e44e32c25eeec4c3277b49f1ae94b5d20c5dafd1c8716c643e8d4bb269a45705ea90b3753e2467b27fde046f289b7cc42b6cb28266ed9a5c93ac8411360f7508c15aeb26d1a151a5778e6922ad96590823f6c02afae123a27963604d71da28063a99bf1e5bab47c14b04ec9b11f745f38f651ea9bfa2ca211d4a92d271a45b1afb24e710dc05846d66906cb53cbb3fe6b41cd417e7d4c0f7c72797a59cd5e4a0eac9ba99873797cb4f4ccb9b8070cb2745cb8c76f88a190a7f4aaf9bf673af41a15621eb79fbe3db129af67a112f25810195303301bb81a89f69cbd97038ea309f31d8b21f1b4dfe41cd19f650206ea5cd613b384efa2a55c8c7729a768c06bae40d2a8b4eacdf08d4b389c199a1b2854b88990efca75813e1ef26424c718af4eff479e07f63565a4d30a56fff517646cefa822254993b6df0017da587e5deec51bb0d1d15f2110c7f9f3ba020a2707c5f1d6c7d3e0fb09606c MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0D44DD8C3C8C1A1A58756481E90F2E2AFFB3D26E\Blob = 0300000001000000140000000d44dd8c3c8c1a1a58756481e90f2e2affb3d26e2000000001000000ba010000308201b63082015ba0030201020213066c9fd5749736663f3b0b9ad9e89e7603f24a300a06082a8648ce3d0403023039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412033301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f7420434120333059301306072a8648ce3d020106082a8648ce3d030107034200042997a7c6417fc00d9be8011b56c6f252a5ba2db212e8d22ed7fac9c5d8aa6d1f73813b3b986b397c33a5c54e868e8017686245577d44581db337e56708eb66dea3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414abb6dbd7069e37ac3086079170c79cc419b178c0300a06082a8648ce3d0403020349003046022100e08592a317b78df92b06a593ac1a98686172fae1a1d0fb1c7860a64399c5b8c40221009c02eff1949cb396f9ebc62af8b62cfe3a901416d78c6324481cdf307dd5683b MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\1C58A3A8518E8759BF075B76B750D4F2DF264FCD\Blob = 0300000001000000140000001c58a3a8518e8759bf075b76b750d4f2df264fcd2000000001000000c2040000308204be308203a6a003020102021006d8d904d5584346f68a2fa754227ec4300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3231303431343030303030305a170d3331303431333233353935395a304f310b300906035504061302555331153013060355040a130c446967694365727420496e633129302706035504031320446967694365727420544c53205253412053484132353620323032302043413130820122300d06092a864886f70d01010105000382010f003082010a0282010100c14bb3654770bcdd4f58dbec9cedc366e51f311354ad4a66461f2c0aec6407e52edcdcb90a20eddfe3c4d09e9aa97a1d8288e51156db1e9f58c251e72c340d2ed292e156cbf1795fb3bb87ca25037b9a52416610604f571349f0e8376783dfe7d34b674c2251a6df0e9910ed57517426e27dc7ca622e131b7f238825536fc13458008b84fff8bea75849227b96ada2889b15bca07cdfe951a8d5b0ed37e236b4824b62b5499aecc767d6e33ef5e3d6125e44f1bf71427d58840380b18101faf9ca32bbb48e278727c52b74d4a8d697dec364f9cace53a256bc78178e490329aefb494fa415b9cef25c19576d6b79a72ba2272013b5d03d40d321300793ea99f50203010001a38201823082017e30120603551d130101ff040830060101ff020100301d0603551d0e04160414b76ba2eaa8aa848c79eab4da0f98b2c59576b9f4301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030106082b06010505070302307606082b06010505070101046a3068302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304006082b060105050730028634687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274476c6f62616c526f6f7443412e63727430420603551d1f043b30393037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274476c6f62616c526f6f7443412e63726c303d0603551d2004363034300b06096086480186fd6c02013007060567810c01013008060667810c0102013008060667810c0102023008060667810c010203300d06092a864886f70d01010b050003820101008032ce5e0bdd6e5a0d0aafe1d684cbc08efa8570edda5db30cf72b7540fe850afaf33178b7704b1a8958ba80bdf36b1de97ecf0bba589c59d490d3fd6cfdd0986db771825bcf6d0b5a09d07bdec443d82aa4de9e41265fbb8f99cbddaee1a86f9f87fe74b71f1b20abb14fc6f5675d5d9b3ce9ff69f7616cd6d9f3fd36c6ab038876d24b2e7586e3fcd8557d26c21177df3e02b67cf3ab7b7a86366fb8f7d89371cf86df7330fa7babed2a59c842843b11171a52f3c90e147da25b7267ba71ed574766c5b8024a65345e8bd02a3c209c51994ce7529ef76b112b0d927e1de88aeb36164387ea2a63bf753febdec403bb0a3cf730efebaf4cfc8b3610733ef3a4 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\2AD974A775F73CBDBBD8F5AC3A49255FA8FB1F8C\Blob = 0300000001000000140000002ad974a775f73cbdbbd8f5ac3a49255fa8fb1f8c2000000001000000620400003082045e30820346a0030201020213077312380b9d6688a33b1ed9bf9ccda68e0e0f300d06092a864886f70d01010b05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412031301e170d3232303832333232323132385a170d3330303832333232323132385a303c310b3009060355040613025553310f300d060355040a1306416d617a6f6e311c301a06035504031313416d617a6f6e205253412032303438204d303130820122300d06092a864886f70d01010105000382010f003082010a0282010100eb712ca9cb1f8828923230af8a570f78b73725955587ac675c97d322c8daa214676b7cf067dae2032ab356125dc6b547f96708a7937a9592180fb4f9f910369a7f2f80b64fba134ec75d531ee0dd96330720d396bc12e4745042a1051373b54f9b4424fe2d7fedbc2285ec362133977506ce271882dce3d9c582078d5e26012626671fd93f13cf32ba6bad7864fcaaff0e023c07df9c0578728cfdea75b7032884dae86e078cd05085ef8154b2716eec6d62ef8f94c35ee9c4a4d091c02e249198caeeba258ed4f671b6fb5b6b38064837478d86dcf2ea06fb76377d9eff424e4d588293cfe271c278b17aab4b5b94378881e4d9af24aef872c565fb4bb451e70203010001a382015a3082015630120603551d130101ff040830060101ff020100300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030106082b06010505070302301d0603551d0e0416041481b80e638a891218e5fa3b3b50959fe6e5901385301f0603551d230418301680148418cc8534ecbc0c94942e08599cc7b2104e0a08307b06082b06010505070101046f306d302f06082b060105050730018623687474703a2f2f6f6373702e726f6f746361312e616d617a6f6e74727573742e636f6d303a06082b06010505073002862e687474703a2f2f6372742e726f6f746361312e616d617a6f6e74727573742e636f6d2f726f6f746361312e636572303f0603551d1f043830363034a032a030862e687474703a2f2f63726c2e726f6f746361312e616d617a6f6e74727573742e636f6d2f726f6f746361312e63726c30130603551d20040c300a3008060667810c010201300d06092a864886f70d01010b05000382010100ad00de0205232e063262b46bb19416e41140de2bfa59c135efe0aa8f2b41b9d1f38739001df23db5a7470c0606c691f3075702d4edbd17c1909abf4875a2074f30dd4a6a42b50d3d15c00ffe845bc63c99cc5752b1d86e12d59692934b94e507e88982086a7a34d49e64e13d876a92909a63a14bf88fb6ea34d305be20c2de06e28c9f738b9f4d3985cace19369d85c99ec9f8503fb67e88a1efca84068b50b40a5ca61c44f1fdc8614060f26125aa07f4c7c27375e40c0b428d04e55f4448995b7b898196a7889d4b0d62e804c4d7feb4e8b26dcaecc01cbc385b1ddf85ce5b7ae3494b6cb9a7ddf405b249ade1c5146bc2ccebcd7fd65869bac3207e7fb0b8 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E\Blob = 030000000100000014000000b51c067cee2b0c3df855ab2d92f4fe39d4e70f0e2000000001000000e1030000308203dd308202c5a003020102020100300d06092a864886f70d01010b050030818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a30818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bdedc103fcf68ffc02b16f5b9f48d99d79e2a2b703615618c347b6d7ca3d352e8943f7a1699bde8a1afd13209cb44977322956fdb9ec8cdd22fa72dc276197eef65a84ec6e19b9892cdc845bd574fb6b5fc589a51052894655f4b8751ce67fe454ae4bf85572570219f8177159eb1e280774c59d48be6cb4f4a4b0f364377992c0ec465e7fe16d534c62afcd1f0b63bb3a9dfbfc7900986174cf26824063f3b2726a190d99cad40e75cc37fb8b89c159f1627f5fb35f6530f8a7b74d765a1e765e34c0e89656998ab3f07fa4cdbddc32317c91cfe05f11f86baa495cd19994d1a2e3635b0976b55662e14b741d96d426d4080459d0980e0ee6defcc3ec1f90f10203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147c0c321fa7d9307fc47d68a362a8a1ceab075b27300d06092a864886f70d01010b050003820101001159fa254f036f94993b9a1f828539d47605945ee128936d625d09c2a0a8d4b07538f1346a9de49f8a862651e62cd1c62d6e95204a9201ecb88a677b31e2672e8c9503262e439d4a31f60eb50cbbb7e2377f22ba00a30e7b52fb6bbb3bc4d379514ecd90f4670719c83c467a0d017dc558e76de68530179a24c410e004f7e0f27fd4aa0aff421d37ed94e5645912207738d3323e3881759673fa688fb1cbce1fc5ecfa9c7ecf7eb1f1072db6fcbfcaa4bfd097054abcea18280290bd5478092171d3d17d1dd916b0a9613dd00a0022fcc77bcb0964450b3b4081f77d7c32f598ca588e7d2aee90597364f936745e25a1f566052e7f3915a92afb508b8e8569f4 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa22000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F6108407D6F8BB67980CC2E244C2EBAE1CEF63BE\Blob = 030000000100000014000000f6108407d6f8bb67980cc2e244c2ebae1cef63be2000000001000000f6010000308201f230820178a0030201020213066c9fd7c1bb104c2943e5717b7b2cc81ac10e300a06082a8648ce3d0403033039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412034301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f7420434120343076301006072a8648ce3d020106052b8104002203620004d2ab8a374fa3530dfec18a7b4ba87b464b63b062f62d1bdb087121d200e863bd9a27fbf0396e5dea3da5c981aaa35b2098455d16dbfde8106de39ce0e3bd5f8462f3706433a0cb242f70ba88a12aa075f881ae6206c481db396e29b01efa2e5ca3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414d3ecc73a656ecce1da769a56fb9cf3866d57e581300a06082a8648ce3d040303036800306502303a8b21f1bd7e11add0ef58962fd6eb9d7e908d2bcf6655c32ce328a9700a470ef0375912ff2d9994284e2a4f354d335a023100ea75004e3bc43a941291c958469d211372a7889c8ae44c4adb96d4ac8b6b6b49125333add7e4be24fcb50a76d4a5bc10 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e MBAMInstallerService.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rs.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mb5uns.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MBSetup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7z2201.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7z.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7z.exe - System Time Discovery 1 TTPs 2 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 1980 chrome.exe 4412 msedge.exe - Inno Setup is an open-source installation builder for Windows applications. 2 IoCs
Inno Setup installer
resource yara_rule behavioral3/memory/4648-3699-0x0000000000400000-0x0000000000445000-memory.dmp innosetup behavioral3/memory/4648-3807-0x0000000000400000-0x0000000000445000-memory.dmp innosetup - Checks SCSI registry key(s) 3 TTPs 26 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID DrvInst.exe - Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MBAMService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MBAMService.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Delays execution with timeout.exe 9 IoCs
pid Process 4416 timeout.exe 952 timeout.exe 4688 timeout.exe 2476 timeout.exe 4444 timeout.exe 4456 timeout.exe 3888 timeout.exe 5196 timeout.exe 7044 timeout.exe - Enumerates system info in registry 2 TTPs 5 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION MBAMInstallerService.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Malwarebytes.exe = "11000" MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION MBAMService.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\mbam.exe = "11000" MBAMService.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\mbamtray.exe = "11000" MBAMService.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\16.0 MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0\Common\Security MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT MBAMInstallerService.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:\ MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\15.0\Common\Security MBAMInstallerService.exe Set value (str) \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:\ MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\15.0 MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs MBAMService.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:\ MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Malwarebytes MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\15.0 MBAMInstallerService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MBAMService.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:\ MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134331121628563909" chrome.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates MBAMInstallerService.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Malwarebytes\FirstRun = "false" MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs MBAMService.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols MBAMInstallerService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0\Common MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Set value (str) \REGISTRY\USER\S-1-5-19\SOFTWARE\Malwarebytes\FirstRun = "false" MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\16.0\Common MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\15.0\Common MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\15.0\Common MBAMInstallerService.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4412646D-16F5-4F3C-8348-0744CDEBCCBF}\TypeLib\ = "{59DBD1B8-A7BD-4322-998F-41B0D2516FA0}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FFBD938D-3ABA-4895-97EF-5A0BDF7AC07D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C367B540-CEF4-4271-8395-0C28F0FDADDA}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0C4652FC-FA35-4394-A133-F68409776465}\TypeLib\ = "{6C5B978B-68C9-45C7-9D6E-0BA57A3C7EB2}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E1AC7139-D1FF-4DE9-84A4-92E2B47F5D2A}\ = "RTPController Class" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7AEBAD20-B80A-427D-B7D5-D2983291132E} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2A0F9375-1809-45ED-AFE0-92852B971139}\TypeLib\ = "{5709DEEB-F05E-4D5C-8DC4-3B0D924EE08F}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A0EB1521-C843-47D5-88D2-5449A2F5F40B}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{74630AE8-C170-4A8F-A90A-F42D63EFE1E8} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{59DBD1B8-A7BD-4322-998F-41B0D2516FA0}\1.0\FLAGS\ = "0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9F798C4B-4059-46F9-A0FE-F6B1664ADE96}\ = "IMWACControllerV7" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0AB5C774-8EB7-4C1B-9BBB-5AC3E2C291DD}\TypeLib\ = "{49F6AC60-2104-42C6-8F71-B3916D5AA732}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D4AC5360-A581-42A7-8DD6-D63A5C3AA7F1} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2846D47E-9B85-4836-B883-6A7B493E2D6A}\TypeLib\ = "{FFB94DF8-FC15-411C-B443-E937085E2AC1}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{638A43D2-5475-424B-87B8-042109D7768F}\TypeLib\ = "{74630AE8-C170-4A8F-A90A-F42D63EFE1E8}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FCB473CB-B8B5-44A7-A3E0-D83AF05350DF}\TypeLib\ = "{74630AE8-C170-4A8F-A90A-F42D63EFE1E8}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FD6673C7-8E52-46EE-80B8-58F3FB6AA036} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0C4652FC-FA35-4394-A133-F68409776465}\TypeLib\Version = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{ECDAC35E-72BB-4856-97E1-226BA47C62C5}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BADF77CD-ECCE-4B36-88FF-6A2804FFE307}\TypeLib\Version = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{63A6AB57-4679-4529-B78D-143547B22799} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FA484BC6-E101-4A87-AAF3-B468B3F2C6BB}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3A34647B-D9A8-40D9-B563-F9461E98030E}\TypeLib\ = "{74630AE8-C170-4A8F-A90A-F42D63EFE1E8}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MB.CloudController\CurVer MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{748A86D4-7EDF-41EF-A1EF-9582643B1C9F}\ = "IScanParametersV11" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DE6A4256-97CD-4DBB-9D4A-3054B0BB0F8B}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D57ACF19-30E3-4B7E-BCDD-6EEB8E57AF27}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{83D0C30B-ECF4-40C5-80EC-21BB47F898A9}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6B2CCE9B-6446-450F-9C9D-542CD9FA6677}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2846D47E-9B85-4836-B883-6A7B493E2D6A}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MB.CloudController\ = "CloudController Class" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{76AD4430-9C5C-4FC2-A15F-4E16ACD735AC}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0070F531-5D6B-4302-ACA0-6920E95D9A31}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6696D5DD-4143-482C-ABF4-3B215CF3DBFC}\TypeLib\ = "{332AFEBA-9341-4CEC-8EA6-DB155A99DF63}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{62A3C5F3-503F-4205-A044-5EA683BEDABE} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5BA2811A-EE5B-44DF-81CD-C75BB11A82D4}\ = "IAEControllerEventsV4" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B9442AA1-AEB8-4FB4-B998-BFBC37BA8A99} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{50538523-AA2F-40D3-9B58-DB51D5BD3D4A}\ = "_IMBAMServiceControllerEventsV3" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{40D6E119-3897-41B3-AC5D-5FE6F088C97B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1E3F0FEC-3E40-4137-8C7D-090AFA9B6C5E} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B42C0E8E-5C9D-46B7-AAED-2294C6566DC0}\TypeLib\Version = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{566DC5CA-A3C4-4959-AB92-37606E12AAFF}\ProxyStubClsid32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7EF16D72-5906-4045-86BC-16826F6212FE}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{00A73BC0-754E-44E1-B190-D59E187A5EA1}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0468FE5A-FFDA-4F57-83F5-79116160E9B8}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E03FDF96-969E-4700-844D-7F754F1657EF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E03FDF96-969E-4700-844D-7F754F1657EF}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F1C46F8-E697-4175-B240-CDE682A4BA2D}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{376BE474-56D4-4177-BB4E-5610156F36C8}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E230930A-6CC2-4B9D-8CE1-03F86A8EDA05} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3B42C782-9650-4EFF-9618-91118DF96061}\TypeLib\ = "{5709DEEB-F05E-4D5C-8DC4-3B0D924EE08F}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8307A4A5-A025-438B-B23B-8EE38A453D54}\TypeLib\Version = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6C5B978B-68C9-45C7-9D6E-0BA57A3C7EB2}\1.0\0\win64 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57CE581A-0CB6-4266-9CA0-19364C90A0B3}\ProgID MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{015FAC74-0374-494A-A02D-316D562C0FCE}\ProxyStubClsid32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{376BE474-56D4-4177-BB4E-5610156F36C8}\ProgID MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EF7DFB76-BA49-4191-8B62-0AC3571C56D7}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B471ACFB-E67A-4BE9-A328-F6A906DDDEAA}\ = "INormalScanParameters" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{983849D5-BFE9-43E9-A9A0-CBAFBC917F39}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3BD2053F-99D1-4C2B-8B45-635183A8F0BF} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B5186B66-AE3D-4EC4-B9F5-67EC478625BE}\TypeLib\Version = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D4AC5360-A581-42A7-8DD6-D63A5C3AA7F1}\ProxyStubClsid32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7196E77C-8EA5-4824-92C9-BAE8671149FA} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MB.AEController.1\ = "AEController Class" MBAMService.exe - Modifies system certificate store 2 TTPs 11 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8DA7F965EC5EFC37910F1C6E59FDC1CC6A6EDE16 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\5A8CEF45D7A69859767A8C8B4496B578CF474B1A MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F6108407D6F8BB67980CC2E244C2EBAE1CEF63BE MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0D44DD8C3C8C1A1A58756481E90F2E2AFFB3D26E MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\1C58A3A8518E8759BF075B76B750D4F2DF264FCD MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\2AD974A775F73CBDBBD8F5AC3A49255FA8FB1F8C MBAMInstallerService.exe - Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc stream HTTP User-Agent header 63 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) 1 - Suspicious behavior: EnumeratesProcesses 50 IoCs
pid Process 3032 MBSetup.exe 3032 MBSetup.exe 5184 MBAMInstallerService.exe 5184 MBAMInstallerService.exe 5184 MBAMInstallerService.exe 5184 MBAMInstallerService.exe 5184 MBAMInstallerService.exe 5184 MBAMInstallerService.exe 5184 MBAMInstallerService.exe 5184 MBAMInstallerService.exe 3516 MBAMService.exe 3516 MBAMService.exe 3516 MBAMService.exe 3516 MBAMService.exe 3516 MBAMService.exe 3516 MBAMService.exe 3516 MBAMService.exe 3516 MBAMService.exe 3516 MBAMService.exe 3516 MBAMService.exe 3516 MBAMService.exe 3516 MBAMService.exe 4964 Malwarebytes.exe 4964 Malwarebytes.exe 3516 MBAMService.exe 3516 MBAMService.exe 3516 MBAMService.exe 3516 MBAMService.exe 3516 MBAMService.exe 3516 MBAMService.exe 3516 MBAMService.exe 3516 MBAMService.exe 3516 MBAMService.exe 3516 MBAMService.exe 4540 chrome.exe 4540 chrome.exe 3516 MBAMService.exe 3516 MBAMService.exe 5100 powershell.exe 5100 powershell.exe 5100 powershell.exe 2300 powershell.exe 2300 powershell.exe 2300 powershell.exe 2300 powershell.exe 2300 powershell.exe 5116 mb5uns.exe 5116 mb5uns.exe 4540 chrome.exe 4540 chrome.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 656 Process not Found 656 Process not Found - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4540 chrome.exe 4540 chrome.exe 4540 chrome.exe 4540 chrome.exe 4540 chrome.exe 4540 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAuditPrivilege 4764 svchost.exe Token: SeSecurityPrivilege 4764 svchost.exe Token: 33 2528 MBAMService.exe Token: SeIncBasePriorityPrivilege 2528 MBAMService.exe Token: 33 4852 MBAMService.exe Token: SeIncBasePriorityPrivilege 4852 MBAMService.exe Token: 33 3516 MBAMService.exe Token: SeIncBasePriorityPrivilege 3516 MBAMService.exe Token: SeBackupPrivilege 3516 MBAMService.exe Token: SeRestorePrivilege 3516 MBAMService.exe Token: SeTakeOwnershipPrivilege 3516 MBAMService.exe Token: SeDebugPrivilege 3516 MBAMService.exe Token: SeBackupPrivilege 3516 MBAMService.exe Token: SeRestorePrivilege 3516 MBAMService.exe Token: SeTakeOwnershipPrivilege 3516 MBAMService.exe Token: SeTcbPrivilege 3516 MBAMService.exe Token: SeTcbPrivilege 3516 MBAMService.exe Token: SeSecurityPrivilege 3516 MBAMService.exe Token: SeDebugPrivilege 3516 MBAMService.exe Token: SeDebugPrivilege 3516 MBAMService.exe Token: SeDebugPrivilege 3516 MBAMService.exe Token: SeDebugPrivilege 3516 MBAMService.exe Token: SeDebugPrivilege 3516 MBAMService.exe Token: SeDebugPrivilege 3516 MBAMService.exe Token: SeDebugPrivilege 3516 MBAMService.exe Token: SeDebugPrivilege 3516 MBAMService.exe Token: SeDebugPrivilege 3516 MBAMService.exe Token: SeDebugPrivilege 3516 MBAMService.exe Token: SeDebugPrivilege 3516 MBAMService.exe Token: SeDebugPrivilege 3516 MBAMService.exe Token: SeDebugPrivilege 3516 MBAMService.exe Token: SeDebugPrivilege 3516 MBAMService.exe Token: SeDebugPrivilege 3516 MBAMService.exe Token: SeDebugPrivilege 3516 MBAMService.exe Token: SeDebugPrivilege 3516 MBAMService.exe Token: SeDebugPrivilege 3516 MBAMService.exe Token: SeDebugPrivilege 3516 MBAMService.exe Token: SeDebugPrivilege 3516 MBAMService.exe Token: SeDebugPrivilege 3516 MBAMService.exe Token: SeDebugPrivilege 3516 MBAMService.exe Token: SeDebugPrivilege 3516 MBAMService.exe Token: SeDebugPrivilege 3516 MBAMService.exe Token: SeDebugPrivilege 3516 MBAMService.exe Token: SeDebugPrivilege 3516 MBAMService.exe Token: SeDebugPrivilege 3516 MBAMService.exe Token: SeDebugPrivilege 3516 MBAMService.exe Token: SeDebugPrivilege 3516 MBAMService.exe Token: SeDebugPrivilege 3516 MBAMService.exe Token: SeDebugPrivilege 3516 MBAMService.exe Token: SeDebugPrivilege 3516 MBAMService.exe Token: SeDebugPrivilege 3516 MBAMService.exe Token: SeDebugPrivilege 3516 MBAMService.exe Token: SeDebugPrivilege 3516 MBAMService.exe Token: SeDebugPrivilege 3516 MBAMService.exe Token: SeDebugPrivilege 3516 MBAMService.exe Token: SeDebugPrivilege 3516 MBAMService.exe Token: SeDebugPrivilege 3516 MBAMService.exe Token: SeDebugPrivilege 3516 MBAMService.exe Token: SeDebugPrivilege 3516 MBAMService.exe Token: SeDebugPrivilege 3516 MBAMService.exe Token: SeDebugPrivilege 3516 MBAMService.exe Token: SeDebugPrivilege 3516 MBAMService.exe Token: SeDebugPrivilege 3516 MBAMService.exe Token: SeDebugPrivilege 3516 MBAMService.exe - Suspicious use of FindShellTrayWindow 42 IoCs
pid Process 3032 MBSetup.exe 4964 Malwarebytes.exe 4964 Malwarebytes.exe 4964 Malwarebytes.exe 4540 chrome.exe 4540 chrome.exe 4540 chrome.exe 4540 chrome.exe 4540 chrome.exe 4540 chrome.exe 4540 chrome.exe 4540 chrome.exe 4540 chrome.exe 4540 chrome.exe 4540 chrome.exe 4540 chrome.exe 4540 chrome.exe 4540 chrome.exe 4540 chrome.exe 4540 chrome.exe 4540 chrome.exe 4540 chrome.exe 4540 chrome.exe 4540 chrome.exe 4540 chrome.exe 4540 chrome.exe 4540 chrome.exe 4540 chrome.exe 4540 chrome.exe 4540 chrome.exe 4540 chrome.exe 4540 chrome.exe 4540 chrome.exe 4540 chrome.exe 4540 chrome.exe 4540 chrome.exe 4540 chrome.exe 4540 chrome.exe 4964 Malwarebytes.exe 4964 Malwarebytes.exe 5116 mb5uns.exe 3172 rs.tmp - Suspicious use of SendNotifyMessage 35 IoCs
pid Process 4964 Malwarebytes.exe 4964 Malwarebytes.exe 4964 Malwarebytes.exe 4540 chrome.exe 4540 chrome.exe 4540 chrome.exe 4540 chrome.exe 4540 chrome.exe 4540 chrome.exe 4540 chrome.exe 4540 chrome.exe 4540 chrome.exe 4540 chrome.exe 4540 chrome.exe 4540 chrome.exe 4540 chrome.exe 4540 chrome.exe 4540 chrome.exe 4540 chrome.exe 4540 chrome.exe 4540 chrome.exe 4540 chrome.exe 4540 chrome.exe 4540 chrome.exe 4540 chrome.exe 4540 chrome.exe 4540 chrome.exe 4540 chrome.exe 4540 chrome.exe 4540 chrome.exe 4540 chrome.exe 4540 chrome.exe 4540 chrome.exe 4540 chrome.exe 4540 chrome.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2984 Patch_MB_5.x.exe 4412 7z2201.exe 3880 7z.exe 3944 7z.exe - Suspicious use of WriteProcessMemory 59 IoCs
description pid Process procid_target PID 5184 wrote to memory of 1656 5184 MBAMInstallerService.exe 98 PID 4764 wrote to memory of 5960 4764 svchost.exe 103 PID 5184 wrote to memory of 2528 5184 MBAMInstallerService.exe 104 PID 3516 wrote to memory of 4964 3516 MBAMService.exe 118 PID 4540 wrote to memory of 4348 4540 chrome.exe 123 PID 4540 wrote to memory of 556 4540 chrome.exe 124 PID 4540 wrote to memory of 556 4540 chrome.exe 124 PID 4540 wrote to memory of 1980 4540 chrome.exe 125 PID 4540 wrote to memory of 5528 4540 chrome.exe 127 PID 4540 wrote to memory of 5528 4540 chrome.exe 127 PID 4540 wrote to memory of 4428 4540 chrome.exe 128 PID 4540 wrote to memory of 4428 4540 chrome.exe 128 PID 4540 wrote to memory of 4680 4540 chrome.exe 129 PID 4540 wrote to memory of 4680 4540 chrome.exe 129 PID 4540 wrote to memory of 5760 4540 chrome.exe 130 PID 4540 wrote to memory of 5760 4540 chrome.exe 130 PID 4540 wrote to memory of 5920 4540 chrome.exe 132 PID 4540 wrote to memory of 5920 4540 chrome.exe 132 PID 4540 wrote to memory of 1868 4540 chrome.exe 133 PID 4540 wrote to memory of 5320 4540 chrome.exe 137 PID 4540 wrote to memory of 5320 4540 chrome.exe 137 PID 4540 wrote to memory of 1820 4540 chrome.exe 138 PID 4540 wrote to memory of 1820 4540 chrome.exe 138 PID 4540 wrote to memory of 412 4540 chrome.exe 146 PID 4540 wrote to memory of 5444 4540 chrome.exe 147 PID 4540 wrote to memory of 2576 4540 chrome.exe 148 PID 2984 wrote to memory of 3228 2984 Patch_MB_5.x.exe 150 PID 3228 wrote to memory of 4412 3228 cmd.exe 152 PID 3228 wrote to memory of 1776 3228 cmd.exe 153 PID 3228 wrote to memory of 5688 3228 cmd.exe 154 PID 5688 wrote to memory of 4984 5688 cmd.exe 155 PID 3228 wrote to memory of 5656 3228 cmd.exe 156 PID 5656 wrote to memory of 4456 5656 cmd.exe 157 PID 3228 wrote to memory of 4264 3228 cmd.exe 158 PID 3228 wrote to memory of 3880 3228 cmd.exe 160 PID 4264 wrote to memory of 2008 4264 cmd.exe 161 PID 3228 wrote to memory of 3944 3228 cmd.exe 162 PID 4264 wrote to memory of 2668 4264 cmd.exe 163 PID 4264 wrote to memory of 5556 4264 cmd.exe 164 PID 4264 wrote to memory of 6068 4264 cmd.exe 165 PID 4264 wrote to memory of 1504 4264 cmd.exe 166 PID 1504 wrote to memory of 2648 1504 cmd.exe 167 PID 1504 wrote to memory of 4980 1504 cmd.exe 168 PID 4264 wrote to memory of 2476 4264 cmd.exe 169 PID 3228 wrote to memory of 5100 3228 cmd.exe 170 PID 3228 wrote to memory of 2300 3228 cmd.exe 171 PID 2300 wrote to memory of 4648 2300 powershell.exe 172 PID 4648 wrote to memory of 3172 4648 rs.exe 173 PID 3172 wrote to memory of 5116 3172 rs.tmp 175 PID 4264 wrote to memory of 4444 4264 cmd.exe 177 PID 3032 wrote to memory of 6064 3032 MBSetup.exe 178 PID 6064 wrote to memory of 2980 6064 Malwarebytes.exe 180 PID 4264 wrote to memory of 4456 4264 cmd.exe 182 PID 4264 wrote to memory of 3888 4264 cmd.exe 183 PID 4264 wrote to memory of 4416 4264 cmd.exe 184 PID 4264 wrote to memory of 952 4264 cmd.exe 185 PID 5116 wrote to memory of 1164 5116 mb5uns.exe 186 PID 1164 wrote to memory of 1704 1164 msedge.exe 187 PID 4264 wrote to memory of 5196 4264 cmd.exe 188 - Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 1776 attrib.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Loads dropped DLL
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\Malwarebytes Premium 5.1.1.106 Multilingual\MBSetup.exe"C:\Users\Admin\AppData\Local\Temp\Malwarebytes Premium 5.1.1.106 Multilingual\MBSetup.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Checks BIOS information in registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3032
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffcfe38c728,0x7ffcfe38c734,0x7ffcfe38c7403⤵PID:4348
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1760,i,10476058173557667129,8137582823102212833,262144 --field-trial-handle=1920,i,4438789835856998442,13280919162870396950,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1916 /prefetch:23⤵PID:556
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2224,i,2371987573779856047,15854522714512138242,524288 --field-trial-handle=1920,i,4438789835856998442,13280919162870396950,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2272 /prefetch:33⤵
- System Time Discovery
PID:1980
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2424,i,3699051208177641932,2666445263841948080,524288 --field-trial-handle=1920,i,4438789835856998442,13280919162870396950,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2440 /prefetch:83⤵PID:5528
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3248,i,8025305874135667673,13099467370868021482,2097152 --field-trial-handle=1920,i,4438789835856998442,13280919162870396950,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3260 /prefetch:13⤵PID:4428
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3272,i,16275114055942226763,3540609684704491268,2097152 --field-trial-handle=1920,i,4438789835856998442,13280919162870396950,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3292 /prefetch:13⤵PID:4680
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4440,i,4496752844663656469,13282635099169410480,2097152 --field-trial-handle=1920,i,4438789835856998442,13280919162870396950,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4456 /prefetch:23⤵PID:5760
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4716,i,8691154062675918658,9989213489802870327,2097152 --field-trial-handle=1920,i,4438789835856998442,13280919162870396950,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4768 /prefetch:13⤵PID:5920
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5508,i,4890578992319955060,11063827464450675374,524288 --field-trial-handle=1920,i,4438789835856998442,13280919162870396950,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5516 /prefetch:83⤵PID:1868
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5944,i,2667508596390328298,15967880433433543154,2097152 --field-trial-handle=1920,i,4438789835856998442,13280919162870396950,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5816 /prefetch:13⤵PID:5320
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3932,i,8480969753407997632,14575755383456940393,2097152 --field-trial-handle=1920,i,4438789835856998442,13280919162870396950,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5964 /prefetch:13⤵PID:1820
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=240,i,2274172951075321686,11853356099346755945,524288 --field-trial-handle=1920,i,4438789835856998442,13280919162870396950,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5844 /prefetch:83⤵PID:412
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5768,i,7508349454638546296,449266935443175890,524288 --field-trial-handle=1920,i,4438789835856998442,13280919162870396950,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5936 /prefetch:83⤵PID:5444
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5516,i,4689734588274833593,12409072284403757835,524288 --field-trial-handle=1920,i,4438789835856998442,13280919162870396950,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5804 /prefetch:83⤵PID:2576
-
-
-
C:\Users\Admin\AppData\Local\Temp\Malwarebytes Premium 5.1.1.106 Multilingual\Patch\Patch_MB_5.x.exe"C:\Users\Admin\AppData\Local\Temp\Malwarebytes Premium 5.1.1.106 Multilingual\Patch\Patch_MB_5.x.exe"2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Windows\SYSTEM32\cmd.execmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\85WRU7O1.bat" "C:\Users\Admin\AppData\Local\Temp\Malwarebytes Premium 5.1.1.106 Multilingual\Patch\Patch_MB_5.x.exe" "3⤵
- Drops file in Drivers directory
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\qbE5C2E99.95\7z2201.exe"C:\Users\Admin\AppData\Local\Temp\qbE5C2E99.95\7z2201.exe" /S4⤵
- Drops file in Program Files directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4412
-
-
C:\Windows\system32\attrib.exeattrib -r C:\Windows\System32\drivers\etc\hosts4⤵
- Drops file in Drivers directory
- Views/modifies file attributes
PID:1776
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c findstr "keystone" "C:\Windows\System32\drivers\etc\hosts"4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5688 -
C:\Windows\system32\findstr.exefindstr "keystone" "C:\Windows\System32\drivers\etc\hosts"5⤵PID:4984
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c findstr "holocron" "C:\Windows\System32\drivers\etc\hosts"4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5656 -
C:\Windows\system32\findstr.exefindstr "holocron" "C:\Windows\System32\drivers\etc\hosts"5⤵PID:4456
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\pb.cmd"4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Windows\system32\mode.commode con:cols=86 lines=365⤵PID:2008
-
-
C:\Windows\system32\chcp.comchcp 650015⤵PID:2668
-
-
C:\Windows\system32\mode.commode 70,45⤵PID:5556
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c copy/Z "C:\Users\Admin\AppData\Local\Temp\pb.cmd" nul5⤵
- Executes a command shell one-liner
PID:6068
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c echo prompt $H|cmd5⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo prompt $H"6⤵PID:2648
-
-
C:\Windows\system32\cmd.execmd6⤵PID:4980
-
-
-
C:\Windows\system32\timeout.exetimeout.exe 55⤵
- Delays execution with timeout.exe
PID:2476
-
-
C:\Windows\system32\timeout.exetimeout.exe 55⤵
- Delays execution with timeout.exe
PID:4444
-
-
C:\Windows\system32\timeout.exetimeout.exe 55⤵
- Delays execution with timeout.exe
PID:4456
-
-
C:\Windows\system32\timeout.exetimeout.exe 55⤵
- Delays execution with timeout.exe
PID:3888
-
-
C:\Windows\system32\timeout.exetimeout.exe 55⤵
- Delays execution with timeout.exe
PID:4416
-
-
C:\Windows\system32\timeout.exetimeout.exe 55⤵
- Delays execution with timeout.exe
PID:952
-
-
C:\Windows\system32\timeout.exetimeout.exe 55⤵
- Delays execution with timeout.exe
PID:5196
-
-
C:\Windows\system32\timeout.exetimeout.exe 55⤵
- Delays execution with timeout.exe
PID:7044
-
-
C:\Windows\system32\timeout.exetimeout.exe 55⤵
- Delays execution with timeout.exe
PID:4688
-
-
-
C:\Program Files (x86)\7-Zip\7z.exe"C:\Program Files (x86)\7-Zip\7z.exe" x "C:\Users\Admin\AppData\Local\Temp\qbE5C2E99.95\ck.7z" -o"C:\ProgramData" -pDFGkjgdfkjghfdjg7y7fyhdkghdfg -y4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3880
-
-
C:\Program Files (x86)\7-Zip\7z.exe"C:\Program Files (x86)\7-Zip\7z.exe" x "C:\Users\Admin\AppData\Local\Temp\qbE5C2E99.95\rs.7z" -o"C:\Users\Admin\AppData\Local\Temp" -phfgdhgGDFGdfhmjdfh5gf6fdk7hjdf -y4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3944
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell start-process -FilePath 'C:\Program Files\Malwarebytes\Anti-Malware\unins000.exe' -ArgumentList '/VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-' -NoNewWindow -Wait4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:5100
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell start-process -FilePath 'C:\Users\Admin\AppData\Local\Temp\rs.exe' -ArgumentList '/VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-' -NoNewWindow -Wait4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\rs.exe"C:\Users\Admin\AppData\Local\Temp\rs.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\is-TTG7M.tmp\rs.tmp"C:\Users\Admin\AppData\Local\Temp\is-TTG7M.tmp\rs.tmp" /SL5="$30352,63820596,239616,C:\Users\Admin\AppData\Local\Temp\rs.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-6⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Program Files\Malwarebytes\Anti-Malware\mb5uns.exe/VERYSILENT /NORESTART /LOG7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://support.malwarebytes.com/hc/en-us/articles/360038522234-Repair-Malwarebytes-for-Windows-with-the-Malwarebytes-Support-Tool8⤵
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2ec,0x7ffce64fc188,0x7ffce64fc194,0x7ffce64fc1a09⤵PID:1704
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1960,i,12937526077949695519,13996857508462594599,524288 --field-trial-handle=2620,i,2102127994191936927,14033246175018223479,262144 --variations-seed-version --mojo-platform-channel-handle=2684 /prefetch:39⤵
- System Time Discovery
PID:4412
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,3437316398507897914,1093213152583740801,262144 --field-trial-handle=2620,i,2102127994191936927,14033246175018223479,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:29⤵PID:5748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2240,i,13855116745458341319,11558707246050097401,524288 --field-trial-handle=2620,i,2102127994191936927,14033246175018223479,262144 --variations-seed-version --mojo-platform-channel-handle=2692 /prefetch:89⤵PID:6052
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,10093917723797312505,8329519130323431897,2097152 --field-trial-handle=2620,i,2102127994191936927,14033246175018223479,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:19⤵PID:5596
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,10179022143668993844,13490380946945487678,2097152 --field-trial-handle=2620,i,2102127994191936927,14033246175018223479,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:19⤵PID:2580
-
-
-
-
-
-
-
-
-
C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe"C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:6064 -
C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe"C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2980
-
-
-
C:\Users\Admin\AppData\Local\Temp\MBAMInstallerService.exe"C:\Users\Admin\AppData\Local\Temp\MBAMInstallerService.exe"1⤵
- Drops file in Drivers directory
- Impair Defenses: Safe Mode Boot
- Enumerates connected drives
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Modifies trusted root certificate store through registry
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5184 -
C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe" /installmbtun2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Executes dropped EXE
- Loads dropped DLL
PID:1656
-
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe" /Service /Protected2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2528
-
-
C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Event Triggered Execution: Netsh Helper DLL
PID:4428
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "9" "C:\Program Files\Malwarebytes\Anti-Malware\mbtun\mbtun.inf" "9" "4ba9030c7" "000000000000014C" "Service-0x0-3e7$\Default" "0000000000000158" "208" "C:\Program Files\Malwarebytes\Anti-Malware\mbtun"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:5960
-
-
C:\Windows\system32\DRIVERS\MbamElam.sysC:\Windows\system32\DRIVERS\MbamElam.sys1⤵
- Executes dropped EXE
PID:720
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4852
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Checks BIOS information in registry
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe"C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe" nowindow2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4964
-
-
C:\Windows\system32\DRIVERS\mbamswissarmy.sysC:\Windows\system32\DRIVERS\mbamswissarmy.sys1⤵
- Executes dropped EXE
PID:3904
-
C:\Windows\system32\DRIVERS\MbamChameleon.sysC:\Windows\system32\DRIVERS\MbamChameleon.sys1⤵
- Executes dropped EXE
PID:4876
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:4444
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:1460
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2164
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:2092
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
2Component Object Model Hijacking
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
2Component Object Model Hijacking
1Netsh Helper DLL
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
1Safe Mode Boot
1Modify Registry
3Subvert Trust Controls
2Install Root Certificate
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\CloudControllerImpl.dll
- Size 4.8MB
- SHA256 a27dae06ba8167d879cc0efeb23204658f1cf9df804090f4b348f9aebdca1ca0
- MD5 a785b3947cb4264e3a5db8b58e4fce68
- SHA1 e852bb05af61ba992d6d9346d7dd71b898a2e823
- SHA512 74600edc8b216a4d718aa4650918db28b9fb29dfa2e85f44d68a24a645769dd758f2f6a3cda9cd9650886fe416d2ea7302d3b3644d0300543b6255f742be8041
- SSDEEP 49152:5XjPevMdZbBclzoXPMI8Z0oE162O69z+fHceOzruczm72PqYm8Rlvgb+i9gRBIzP:s0omD+fHcdzbQzowtrNhmk7B
- TLSH T194368C17A6E500F9D8F6D138CE978503E7B2B8154331DFDF06A0866A1F67BE0563AB24
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\LicenseControllerImpl.dll
- Size 4.8MB
- SHA256 c69d31c3cc78f71633e983cc58c8240957e48dfe4466b4ae0b7bfeb19e5279e7
- MD5 8eba86fc89c9a8b1abf84e5b8f1fdcce
- SHA1 3471646cbe8c33ab08609acd341ad806b0fbd1d6
- SHA512 bd07ae2ae034e15d55f49c93af9630049c82021a2c689d3a9973e6516a039fe65311b16d7297b9c98158ff4fc60afbdc548ea7452ba6102e42ae00a1c3cc2d6f
- SSDEEP 49152:03yBexYKzoGG878alLjU5GM6bGQLP7zZAFkqcEzcvBLULftVPeZTF3uEyPbGxyz2:IRzos78/Kp9ULft6IGxo/RIR
- TLSH T121368D17A2F500A5D8F6D238CDA78413DBB2B8154731DFDF0690966E1F63BE05A3AB24
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\PoliciesControllerImpl.dll
- Size 4.2MB
- SHA256 8d502eb7c1f76cc5210029b011f52a6f4d86dca1dad91dc5fecb5870d2e9182b
- MD5 2c3a623bc7035ff473ba7118afe1b1eb
- SHA1 fc63dc1ed60a79bc6d4c69d2c7aad5b8d0999421
- SHA512 33bf3593dad88e0ad123105e42f41e51fef6282e96524be9bac212856f654c229e931fc25fa06048125b94a8cea49d2c09a0bda4c2bb4ba03b6d2036bc64244f
- SSDEEP 49152:bQbh+BnQCImbMogKJ2D17GK9q89ZK12sRGGSFCBhJOUD3vlNgJrt8PsZtKUZmyPJ:m85I/jd8EBuJOevlNgBtwFI39t+xg
- TLSH T1E4168D0796E900FCD8B6D27C89A78917D7B2B8150370DBCF0690966A1FA37E15A3F724
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\UpdateControllerImpl.dll
- Size 4.3MB
- SHA256 473c650642dfa1765a6240755ff81fd022fe71aedaa81ad0326049c9a0aa258d
- MD5 4cef0ff57d7fab55da344fec9ab2252d
- SHA1 2778ad4f249caf8532c6c7caf5e892085ba094ed
- SHA512 6633901686495dea9c7e0f5d6e03bc1b3a23589ab4348e4e5f2d166b7ad51440922358e1cc2dec218b1a384d4007ac3727da4be750802c04ecd1d0dda132ddde
- SSDEEP 49152:ouLyl2W5Jc9e6rXIsqCDiSnmx/EWAwLEd4Sw8stGnaolOYg0808fGOh5PQyiDjww:rm532flLcwjwo1VBbA
- TLSH T139268D16ABA800A5E9B7C139C5A78603E7B2B8555B31DBDF0650563E0F337E16A3F720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\pkgvers.dat
- Size 75B
- SHA256 bbc783a8fd1d76b8944768e85c995040d6e36827c12c28cc48cf571347271cfb
- MD5 776977d11768325daea04ce67dfd5215
- SHA1 a1eda0524e4fabd4078419cea19126f1062d78d1
- SHA512 86a8ab218914f883901817017dade756524bdaf6c11fc8c828e50592c8a2131739099440d4b20b585109c1d8de943857ac4c26ed6f79cfead9bf4f69cc492340
- TLSH T1EEA02220830CC3000823F0F3A0F022F8300BECE02E820B8002E38E230203023300C8FB
- MD5 SHA1 SHA512 TLSH
- Path C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\Global.sr
- Size 17.3MB
- SHA256 b004c6e635d9a387e8c54710e75b8a694ba2dd6d6eb5090de7f000a457da35f4
- MD5 be0045f058ed0a2a0e6b18fcb365cc7a
- SHA1 e7591be15e9343f8aefcfd460ed97cfb3a0dacc9
- SHA512 d50c572656c7f45e1171ca9038d41a56dbf4d0bcd024151e90ebae8d3c9f88ee376518a6fda63b19d8e8ea16e245145608ed25c82a6f6d8c317bfaa756a2cb47
- SSDEEP 196608:nNj/yEs8WkITpbYKGl66Kx3HgTbWxdDJCu5J2G5l3lWYjWUUcsrHCwk46bSg+fvN:nNbJIdbjG/KEWxlEujr5Xx1U3HybSJci
- TLSH T13807016276CD7A9BF146E83F8705E5768183BC663A27C491FAD20B1FC42DD809F61B42
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\clean.mbdb
- Size 11KB
- SHA256 51abf51fe306b63cc5dd18088c9a2ad29de56e0c777fccce2765a10938365767
- MD5 919c1051a5c3ee641414c9e49022898a
- SHA1 e44ebd3ea0f125c14ea296c48db2deb8aef07c22
- SHA512 4112378c223cf7bedf460dce26b61d651c2af21c31098667670bf973110c36239f770b2a35b72cb9d39de1e93153c3d0944e40f410a39eb4357036ec250fdea5
- SSDEEP 192:9TgKzwjztxtjGYj9ySZanqK/jd5qfHOLzc3skSqBMdzJWEJ7kRYkLZbjUMngF036:Z8jztxxBH0/jHq203skJYQEJYakpjU6m
- TLSH T1A732BF47A119C6A26BB7ABD5902D665333EB1D5C8353B2B34B89E47F6FC0D20A03C099
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\dbmanifest2.dat
- Size 924B
- SHA256 86d4173132a933e50c0d2cb449ad028a572314a467c427ed31d12870668e864f
- MD5 0ceb02cb3ad24a34747883f8e982e257
- SHA1 2f985f1c1520ae28c5555aa6b18511600548c452
- SHA512 902727a70aa494cda5ff27e13f9ba916a4b9986858ca76dc21b91a9016f0e76a941aa2cc48168153c1f6f8bc51002203b07458ff7200e7b393f7dd5cdd741f99
- TLSH T1601188D1D075D1821B1DEBDDE034015B4137CDEBB62497D9681D58C86A06A3C14180CD
- MD5 SHA1 SHA512 TLSH
- Path C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\dynconfig.dat
- Size 39KB
- SHA256 008254ca1f4d6415da89d01a4292911de6135b42833156720a841a22685765dc
- MD5 10f23e7c8c791b91c86cd966d67b7bc7
- SHA1 3f596093b2bc33f7a2554818f8e41adbbd101961
- SHA512 2d1b21371ada038323be412945994d030ee8a9007db072484724616c8597c6998a560bc28886ebf89e2c8919fb70d76c98338d88832351823027491c98d48118
- SSDEEP 384:jNOT68xDvtG9ObE7L8u8sXNVkIfvs4FRj:ay8u8KVkIXsWRj
- TLSH T15603A21266FA1001B1B36588AEF28570DB2B74D965399EBF00C5464A4BEEE40BC53FF7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\exclusions.txt
- Size 23KB
- SHA256 9e87e4c9da3337c63b7f0e6ed0eb71696121c74e18a5da577215e18097715e2f
- MD5 aef4eca7ee01bb1a146751c4d0510d2d
- SHA1 5cf2273da41147126e5e1eabd3182f19304eea25
- SHA512 d31d21e37b0048050b19600f8904354cff3f3ec8291c5a7a54267e14af9fb88dfb6d11e74a037cc0369ade8a8fb9b753861f3b3fb2219563e8ec359f66c042db
- SSDEEP 384:OpHJUPIIawosLqVqmv4EHUtVbUQIKiKn6p+C+vNCMSP+TyHS7ivS/6:mYmsGfvSp/6pzgH4cyH9E6
- TLSH T1B5B2D73A1CBD123751B4C6AACFD58877F640E1A7316A183A64D7874987CBE4329C31BE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\mbdigsig2.dat
- Size 514B
- SHA256 f92ac7d94557e7a33bcf40f46795df202b1dac7593f5267ac6e552fb9469d3c7
- MD5 defa38cc9cde3dcd8bf089b48c5e51fa
- SHA1 590322c2f89bc59cff93ee8789a65845ee1ca58d
- SHA512 9443249743d915e61ee551a906d6009ed7ffdecedfafd415563b2b2c6f498481ce7a7f0731481b7ff14b304f21c24ff34213f3db7e4470b07b1d14d9e9315292
- TLSH T1CAF00EF909AB4230049751BFD13B2BE08C7A287BD8876EC77E1303A50641D63165E406
- MD5 SHA1 SHA512 TLSH
- Path C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\prot.mbdb
- Size 24B
- SHA256 6089fbf0c0c1413f62e91dc9497bedc6d8a271e9dc761e20adc0dccf6f4a0c1f
- MD5 546d9e30eadad8b22f5b3ffa875144bf
- SHA1 3b323ffef009bfe0662c2bd30bb06af6dfc68e4d
- SHA512 3478f5dcf7af549dd6fe48ad714604200de84a90120b16a32233b6d44fa7240f5f4e5fe803f54b86bbdfd10fa1bfdd88fb85eb6a78e23e426933f98d0a2565ec
- MD5 SHA1 SHA512
- Path C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\rdefs.mbdb
- Size 24B
- SHA256 850a4ea37a0fd6f68bf95422d502b2d1257264eb90cc38c0a3b1b95aa375be55
- MD5 2f7423ca7c6a0f1339980f3c8c7de9f8
- SHA1 102c77faa28885354cfe6725d987bc23bc7108ba
- SHA512 e922ac8a7a2cde6d387f8698207cf5efbd45b646986a090e3549d97a7d552dd74179bd7ac20b7d246ca49d340c4c168982c65b4749df760857810b2358e7eb69
- MD5 SHA1 SHA512
- Path C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\rules.mbdb
- Size 9.2MB
- SHA256 55bd5d4c9d23771ac1b1b313be230ba88ca658d3c12afa8bfd7eb7cd4af26438
- MD5 e7a565f4e3aa9a1d49e62c9b36e04de3
- SHA1 b50fb029f9d8f562df3cc6357c78322b58322c02
- SHA512 b3b2a3988defc6a3b06e709621642d757ad776e5d4a2e39bd8eb2b3bcf69ad25c30f4d8ada51b2aecaf9aff6e0702fae379a6e5159a57401f196225a18500855
- SSDEEP 196608:hGvh2YQh92ijYlZaKFGa3zCSrLBm8wD+fyvCaA1ns/ptco/WuwzYG0vd:hnlcijYiaDPI8LaRACauG8d
- TLSH T151A6332156B3B3E62B5334AD0951CC651B2E31F3270AD5D320B48D96B2EA7FB6B31D21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\scan.mbdb
- Size 939KB
- SHA256 05aa89e4895d05eb5682cbb0f6086552685a60a62d85c6b09f4efae9ae68d19b
- MD5 4702c2808144aaa87d969c708b15474a
- SHA1 269ddeeac8e3ddd5ee9cb1ef26a7c53b106c322b
- SHA512 de312c03f1afed4324f0b531eee093ca0c44614323e1e37ea012e85ea6dfde8f2106172f1c6e25ddc1182c46215e1a1a03ef9f562a8ff67d643675f2c791eb3a
- SSDEEP 24576:xPxLtPGGub45MvyKkbnP8XQ+57HS68VU63ai1K:xxpPG1mMvyKkbP8Q+Qy6O
- TLSH T1B6253398A628999DC3851EBD0B8BD130D5ED188D0CC5DBF5E444BD30EB7E840D49EAEE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\tids.mbdb
- Size 170KB
- SHA256 d77afeb7ebbf5439e7dd033ee795f38bd0864442ed19e743c08a781bf018afee
- MD5 25c8e3284f3172e678c2b3f7e4fc27a4
- SHA1 2ec84c4bc2499dc75ec32afaffcf07c27449f099
- SHA512 5c698e6f184c0a6596cadf3a7df8116c2941b9566b0aa4aa74d6d8122d447a2dcd2497f0e61c0af50ae4be7ac7921246b79cadf08254c6a2efdae30f21a9e0fa
- SSDEEP 3072:B3W+CRivsohVZo0MxuJWs+wA2wWd0Cc3XHwFh6ljC48FUFyc0NorgxvMHEdnSzHa:Csvdhvo0M1jIwWdEgFglO48CFHlQkHoj
- TLSH T1D90412F8E97DC676953626D040B90188AB1FC5BE0746EAB212FFB1BF207A41197EC351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\PROGRA~1\MALWAR~1\ANTI-M~1\mbtun\mbtun.cat
- Size 10KB
- SHA256 9ceb410494b95397ec1f8fa505d071672bf61f81cc596b8eccd167a77893c658
- MD5 8abff1fbf08d70c1681a9b20384dbbf9
- SHA1 c9762e121e4f8a7ad931eee58ee60c8e9fc3ecb6
- SHA512 37998e0aee93ff47fe5b1636fce755966debe417a790e1aebd7674c86c1583feef04648a7bc79e4dedaabb731051f4f803932ac49ea0be05776c0f4d218b076f
- SSDEEP 192:gM6dynJCSEJOL7yKnUi8rFWQFIGjl8zjEswYt1FfRM/GX01k9z3AeOlFa:gqS4CFRWGjl8M8/fi/GR9z/OlFa
- TLSH T1B43208E1897D84C2ED87A87147E8E5977C3C1BCB2C5055A911ABF7600AA33C6E71853D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\PROGRA~1\MALWAR~1\ANTI-M~1\mbtun\mbtun.sys
- Size 107KB
- SHA256 6903e60784b9fa5d8b417f93f19665c59946a4de099bd1011ab36271b267261c
- MD5 83d4fba999eb8b34047c38fabef60243
- SHA1 25731b57e9968282610f337bc6d769aa26af4938
- SHA512 47faab5fff3e3e2d2aea0a425444aa2e215f1d5bf97edee2a3bb773468e1092919036bcd5002357594b62519bf3a8980749d8d0f6402de0e73c2125d26e78f1e
- SSDEEP 1536:k0h5S895dQOYJaryTmbMc6uqkZUcmSl47AjpdAyDCYJqUufIfmNn3VzwZ6Dh7Q9y:C895uOYJar1MLcmSlrSgC6Duls2t
- TLSH T174B36C9DA1783089DE42A6B482B98793EFB4357A2B1177BF01E1C1748F537C0DB29DA4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\7z.dll
- Size 1.7MB
- SHA256 77a4eb913e5bc068fe1479f6da9bd2b31303b6d23c7e353dde2984fa373273f2
- MD5 b9bab3b367c53472908741b774fce358
- SHA1 987e358915e7bb78491a65073189642f88d0d823
- SHA512 60b3858901df2ad51db7efde8673fd17c529c09029247d6bfb6565031d53d00b1d554ba558b0440a00c961204b0bb812d0f9ceef16a7fc1934f6b1a5efa91745
- SSDEEP 24576:oLB2ycglUr6G8epqFMyn9w44NBdzHq5FmBq7Wk2zjt:gB2GUr1882ANBdzHq5B7WlF
- TLSH T12B854B6BF6788260D0B7C075C5D2AB96EEB134868B3096C752859B3D2F17BF6C539320
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\Languages\lang_es.qm
- Size 256KB
- SHA256 9e8a6672431aa5b805091c3e08f89417b7ba9ab931a031f3ff9641efccc6ed3f
- MD5 09a3995806569a7d3fdb05e54ea815ac
- SHA1 f6ea0bd03ef8d01fe92a63c750586b86ccdf7253
- SHA512 0d76fe4b70225bbb2bcbf6734ae0a238a9b5b93eb53c6ed5feee30674c5dab79deb0b222100cf27bb8a1035832c3be153e900fe6a6703829a133126a57a76144
- SSDEEP 3072:NX51vUguKiiQ6bDYLDCIGHgY0HYofoNZPwCZFZc/fQXEvKKMcYtQM:NX51skbD85Y0PfoNZPwCZFg4UGtQM
- TLSH T1A644DE9123FC624AF6F36F79A97A56549F7B7C96B838C01E0320616D0870E44DE7A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
- Size 2.9MB
- SHA256 1cf9d3512efffaa2290c105ac8b7534026604067c9b533e7b7df2e017569a4ec
- MD5 46f875f1fe3d6063b390e3a170c90e50
- SHA1 62b901749a6e3964040f9af5ddb9a684936f6c30
- SHA512 fdfb348061158f8133380e9a94215f4bfc0f6ce643a129d623cb8034c49144f1489de56cd076da645478506d9fbddc7590fe3d643622210084b15fdf0d16b557
- SSDEEP 49152:bDOOqxekIwZbn005yZL8BFi0fXpn3pL/+9hBZhOh5PSXNPigdyPpQul+Lupy0X:Qdn5et0CWQu3pyK
- TLSH T1C3E58D06A7A801E8EDB7C23C89528603E7B2B81917729BDF06A4557A1F337F15E3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnel_mbtun.dll
- Size 4.2MB
- SHA256 15d3d5e7cfba1d3361919242e32acd95d635ecbb07051b624022722e8b9ec20e
- MD5 a312df601eb0372302d70ac532310abe
- SHA1 7e5debc669bc44693b4eecc53c65ccce0018b368
- SHA512 f594ffcc38732786826fb8d99f4d38141fe79a59dc5e635ddf6df38e1d9bf184319bfc91b1e42b6caa124c755212e4a01a4f1c0c19641d3ece8b9c16b7a68b40
- SSDEEP 49152:sBPD6Io8w4LcTwEDRzTJoeM9YSxjQ5g+o9h6iO0oFjn2Q1Z0NwEIxZ:yDG8VQkgRzSeMfn+ofU13
- TLSH T1C0264B02F8B205B9F2BEF131C9A963217A31749503327B871F9195692A66FE47E3D313
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe
- Size 288KB
- SHA256 5001ed0abe6bd6852b555e8d58399d8f5689f7d3d479406aef3a8276844ad26c
- MD5 7f75a35582a1a104fb1a1a9745d82b46
- SHA1 88a3a082b2c3998187cd1c1af2a99282589c7e00
- SHA512 42c821707df68a8827e251761a88a11eb5ddda07ae1a074ccbb139f77b2c0e559af18c97522313be4322c7910fa2e8750c3164e9bfbad09a4f8c212147667e46
- SSDEEP 3072:cczkitvo4BpYN/6mBPry8TXROLdW5m4mURh9OOG40klaPOQzj5qXx3s:cA4NCmBPry/N2VOOVOOej86
- TLSH T1DE543847A2A811B8DDE7A2388D928B46F776385647F346CF235052BA1F72FD0AE35311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.json
- Size 621B
- SHA256 db57ee3c133578e20eabd88c124a2d8f835b836779cdb4779bcc26ac791f48f1
- MD5 abda935e89b88e41869b9a77b734a895
- SHA1 8ea987ec7c20c24c57cf49c1fdd83e009954e091
- SHA512 0d72acf0db431265343ce3f551975d7a0329a132c38856c8252be2651988b68a4290d6e49ae1c160eaaa1c21e505b7ca680c18cb40835839dfb8b220abf91c03
- TLSH T12EF0AC12AA6F81F745B10BC899A405C7F624938E12015A0FB7F4F680EEF2C299B83C84
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.json
- Size 654B
- SHA256 40346b249ace064aea585f7fea1c3e3bdf1b4011dc7ad958d901b033245c11c4
- MD5 76ba816a54aa80e98603739bbd28eeaa
- SHA1 0dd7a794d4e2ca4b81d3cd52e30704991c8f9a64
- SHA512 14e664bb5fb092580e61a2d0d8d79c8b348dfaa8adda69085f92aba22e8e7ffc8bfaa8fd3d74ade90333fa074838170df4e9e084c4985afa89bd49f2467d70d8
- TLSH T1FFF0DD23AA1F42F70D7147C801A801C3F634938E0211591FBBF4E690CDF2D299AD2C84
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\TelemetryControllerImpl.dll
- Size 5.1MB
- SHA256 2d81dd719f227543c2c31f95c7cdc529882b07e720f79993afdc3013520eb4c6
- MD5 eb3aaf1e947c77a54216c825ccd9ed60
- SHA1 2a1be7a9d36b2fbd18dfbd85b4f9e60bb03f03bb
- SHA512 0ff8f8f63a444b6664430b6d1956e8d874fb62f01e17fab5824762f267b15a8d62cb898c96afc40e3a377d84b4f041a5f4d95b6ce6146777a1f2db4500ef79bc
- SSDEEP 49152:9B59hqnNy2buK6dAZo2+bYCqtIl1INURTrq4kAXdr6pakwI4z1B3jUrnFUeBXtWz:d9naZoXngGdnjU7FUkt0ikMz2d20
- TLSH T1C2468D5BA2E500E5D8F6C238DA578407D7B278584331DBEF06D0966A1F677E09E3EB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\ctlrvers.dat
- Size 8B
- SHA256 e37c7d95e4d6098828d506864294c20b606d8f58c10c26bb418e2b60ec711951
- MD5 4af55ebda90ab46188cec5c1273b42c6
- SHA1 5b2b75c1d7b7a7f9040057b6084cb18cfc068585
- SHA512 c21c26b7c946270c5708578ed277e96f553e6ba02530873fab3de198fb58ba469a84583db05b71f5d0103c4f123eee80a7857d753abf1c97d1bc1d7c368ad774
- MD5 SHA1 SHA512
- Path C:\Program Files\Malwarebytes\Anti-Malware\mb5uns.exe
- Size 3.8MB
- SHA256 807379fdd7315c29bc1e96ed224285ac5ae0226bdfa5318642eaed6bb0ca3191
- MD5 eaac9032a5151ea0d7b74ae4bab32b35
- SHA1 f2c1f886868f6b9f78aeda8cf95df5051239c1ef
- SHA512 91fc6c387ee270372c401aa27aa399c5f6091dbcf1e94058c88e5edb473a7876c9de632cff5a4d6479a2a9bdcfb499c8ac6cdd3bd954b04db89685ccde0661db
- SSDEEP 49152:15PigeXnpHEw1zKhYOPCP1/j2T37gZKUxT2cHF6c9OtutC:1UpHb1+hDPS/j4gDx2B
- TLSH T18006BF02F7828170E9D69135287EA77E4E3ABD28AB21C5D773D03E7548312D16E3E768
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll
- Size 2.7MB
- SHA256 467de01d7cee7ec54166b80658ff22f9feebdb1c24eaf1629cf40e4124508064
- MD5 b7e5071b317550d93258f7e1e13e7b6f
- SHA1 2d08d78a5c29cf724bc523530d1a9014642bbc60
- SHA512 9c35293c95c1a9141740ac99315605964aa37c4a42d3a11cae9e5649ff1427a9480d3d5e7f763212cf13db3511c5ea3c84e68f95f0067fe6339a9d3fb7b27c54
- SSDEEP 49152:C55UfKzapI/i54HB+mKu5Oh5P0/nx+AoGuylyPz7Ch9qLAoBMl3o:0i58zp3+cQChAAoB43o
- TLSH T160D51825BB6404D8F9A6E138A5EB4502E3F1BA152361ABCF0558367C1EBB7F1127F6C0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\mbtun.dll
- Size 2.8MB
- SHA256 f21a980316bd4c57c70e00840ab76d9ad412092d7d2d6a2cff4f1311f7c05364
- MD5 2bbf63f1dab335f5caf431dbd4f38494
- SHA1 90f1d818ac8a4881bf770c1ff474f35cdaa4fcd0
- SHA512 ebb9834323329dc01ba2c87e5fad1083a4cb86f5ed761cb63299ac5336a9843a1aadd42fbed706797c2295117af1c00f96806422338352653c8e0255fecc2fd5
- SSDEEP 49152:xNrdEZjzdAj9fdc4fDrN1OxOh5PgqdnBq30yPFZP7KVxSL:bBzFRkshaZP2W
- TLSH T136D58C1AA7A800A8EEB6C27CC6578603D7F2B8151771ABDF02A456791F73BE1173E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\mbtun\mbtun.inf
- Size 1KB
- SHA256 4a350fc20834a579c5a58352b7a3aa02a454abbbd9eecd3cd6d2a14864a49cd8
- MD5 5d1917024b228efbeab3c696e663873e
- SHA1 cec5e88c2481d323ec366c18024d61a117f01b21
- SHA512 14b345f03284b8c1d97219e3dd1a3910c1e453f93f51753f417e643f50922e55c0e23aab1d437300e6c196c7017d7b7538de4850df74b3599e90f3941b40ab4a
- TLSH T1CB4140BD48D20AB83C673356671B69C27BDC220145C920ADB2DE8606C88EDDCB905EB9
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\offreg.dll
- Size 114KB
- SHA256 16c450a310edbea07f578f31368f168ec338011cd117406898593e86ebb83dae
- MD5 f782f049b0e8c13b21f8e10e705bd7e5
- SHA1 5c11f955e3983c50ea46b5d432c97c9148ac8e9f
- SHA512 eed29c42b14ff26a030f53d61d6dc8e3971e478dc7646b26189f14f16699b6bedc170c4bcc37efe2e8f3048bde37480033b49eaf1a4712b88464f5da0efc18f2
- SSDEEP 1536:qiFHo5qNN6RBMs4CRqU82r3kvy3ZuottZTBgmFcUNdfI9NMiIy7Q9bEfIBZ/2e:xff2BJ4CYNDo5Bg62Ivl
- TLSH T16CB38E1AB75820A2ED5B8A7483998657F378791213106BCF01F6C7BA1F4BBC57E3A341
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\srvversion.dat
- Size 9B
- SHA256 1d30fe6b0bd710b5a669b6b1c8928b2e04386c63f685371f67cc83c38a048655
- MD5 c4b35a1ce68bc060eb6b842c7ca3b310
- SHA1 0a52d15e79ecceec39c227f4f437300bd386fdba
- SHA512 f29b3372c79e5080306cbeeca4f9c24652b9b8e3b136c85d4609e82f27575007a0c6c9ff871f6f7269ec9eb23bc331c0e8efb69f183ddfec22f1cefe69f6cc52
- MD5 SHA1 SHA512
- Path C:\Program Files\Malwarebytes\Anti-Malware\suhlpr.dll
- Size 3.0MB
- SHA256 2cbba30b1ab1713a9320c18f9bb0c396f89fdba9ccb89f34dd9a12de2c81f405
- MD5 b55493d2b5f93a41c51811448ccd6975
- SHA1 584dc786acbb05e09062b98a7d976c9da17aa3a4
- SHA512 e8f1aa0efa5c7fc3cfe6063c2600d70db1c7cb399b11f443c2575d054b531b856987ca19e9a4ba63161270046ac4dfe85e5675af0f49b722af0071629c0eb8d1
- SSDEEP 49152:/NyWlILtXhz84aHIchjhzohLUAQ0NP6P2yZ1SFTL4y/9jw5Q:FyWlILtXx8voCjBohxkPY
- TLSH T1EBE59F12B382C172FEDE0171653A9B7E44397E244735C8CFA7901E7998312E2663B76B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\version.dat
- Size 47B
- SHA256 22f869e93172574aea6300d4ba690f8a9a9fe43850c8163bfdf05bc8c379477e
- MD5 e12cabb016917a32197ccf79b39ea659
- SHA1 76e72656b353cb4aa8b636900aab6575e2883005
- SHA512 0ec35dd4c96cd728e9d3729b089bfd87823a3a884bdd721422beda6d0dd6c2bb9338ab40217388027cf11883d8e7fc427b1ed98e94cc340c073e497712522988
- MD5 SHA1 SHA512
- Path C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json
- Size 47KB
- SHA256 03ce2fcef1d7499e4089902ca2ddc7d684a64f14f7ff49c49fd64751f38fc091
- MD5 613b207d550b860ba2a1a2cd60b3e275
- SHA1 3df4b48575bdc5ca2070850ddc18582c89bd37f2
- SHA512 3e4bf20e1ca3ffabb3d06203736d95cc23afa619e752c0f849df3215d70484f4b6c630d3917f794da325231cdec329e4e00dfac2fed86d47f81322404d3a306b
- SSDEEP 384:EriPalGB5AWiWq2mhzJUVVqxKS3xV2CjNrBa7gHOykEav:RUAHiWqn1UVVqx9U7gYEav
- TLSH T1652382BBD9DD0D0B99712294A9794607FB20036F10980C17BEBEA98DCFB751394C6F1A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json
- Size 66KB
- SHA256 0a30031e03aafa258ef40cac21034e2ba04d2db6b0f9dd737baca9296ed7c905
- MD5 2f247e0b0ec048b1238d75ff7c5cd519
- SHA1 3231aaeeb1befe93c012e768e913d5385d8e5d58
- SHA512 46b83f8e951f0ad51fa101e2aa028c272256c09ce4e9cd4666063b5d6489e80d277ad449f5fa036af0bc15cf486d68b9583b6ab9d30c4370a91f6bc608a20ded
- SSDEEP 384:friPalGB5AWiWq2mhzJUVVqxKS3xV2CjNrBa7gHOykEajctcxPaF:WUAHiWqn1UVVqx9U7gYEaIKoF
- TLSH T12D63FB76D8DC4D5B857123A4AAB94603FB50036F51880C07BEBDEA8CCFB781695C6F1A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json
- Size 66KB
- SHA256 a2d881ee498f9c081340e4f0974ff4b3d5ee5ca90cc9e784cf8dec698ce6a16b
- MD5 065aacd9794a35369ded82915b4fd364
- SHA1 65ad3800d189d9e2dba2a92d152df0808f85e9d7
- SHA512 a9dac7a69d7c1d0b39fb17139d09bc9e36e6052180a23c686ae5bbc19215db25b03513764b4015c3adb7008081bd297943b4b272791cdc4d1d07227c258e48ac
- SSDEEP 384:kdr1PalGB5AWiWq2mhzJUVVqxKS3xV2CjNrBa7gHOykEajctcxPaF:kvUAHiWqn1UVVqx9U7gYEaIKoF
- TLSH T1C063FB76D8DC4D5B857123A4AAB94603FB50036F51880C07BEBDEA8CCFB781695C6F1A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\ArwControllerConfig.json
- Size 607B
- SHA256 deb26c15089fcdd8a4fd13537835584603a7fdf00343799b64732d7a0cf6f161
- MD5 82da31f6cef5719012e88b070e10aa7a
- SHA1 eaf7a5b5e9ca9fa6ef5e1836cd009a3ad99cf1d4
- SHA512 0730cf2c4221916aa4a035e4d37ebfc956a68dd0f396e360554b30c3d3e2045bbc538a2414b49476aa16e40d534e095f89b816de701d0ed9b4ad68fa7e8603dd
- TLSH T143F06251C57924FFD5BDD808E9A88493D7904B66A1010C27F6FCF394BD3A4312683CE5
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\CleanControllerConfig.json
- Size 847B
- SHA256 27b471966dddac70c4f7072d24b828ddd3c7a34099cc3562c325d8f25f44230d
- MD5 a4e66f76b971625b3fae924d63a3c0a7
- SHA1 a4122f5805630df0eeaa3c87a83d67d6a5400e29
- SHA512 da394a1c4de30442905a6d6eb59b656ae722a4399fa4e341509cc125b66d0d723f7808c2f1101372cfa3534ec9182a2629d7d58e29967f29272c656e1939a320
- TLSH T1AE012B74C401647E54B8634E88B6D581C350470A28944C57FEBCCA9CEE77436B42BE99
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\CleanControllerConfig.json
- Size 846B
- SHA256 49acea3d45e6fd4d1cc84a6c543ca426742f6e2752de1c3a31ce0913db984098
- MD5 cf5f289c6393ad48a50c0807ef83a249
- SHA1 679805a3eaf9b4123adcbc93be2f2640561e488b
- SHA512 e76955a3f202d9237504b6b64cac8cb02d75e703b323a0a70a541529257664c71b870a8fa8d0e44e002229214f00ddc969885083117fb7dfe5391a5a7c643589
- TLSH T159010874840224BE54B8634E88B6D581C350430628504C9BBEBCC59CDE77937B02BE99
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\CloudConfig.json
- Size 825B
- SHA256 d643abc5b3c4af3c0e12cb189325afb1b476adff252a32f09a2ed1aedd84eb29
- MD5 4565002699ed69930d6acf472987e6f4
- SHA1 1bd632fbe83d29ca9666f19f74416384462242e4
- SHA512 7612b1ededfee5115194be1f70ec2186de1a9a46dab74982553d5548c39e0b0a794bed8e37c61cccfcce61fd8b451b4f55a5bebb82abbd63848f9c71e486a5de
- TLSH T13101A117922179BA90FE261D5F2E9686C338A2531481082B7174C5CCCFBBA2A5017A0F
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\CloudConfig.json
- Size 1KB
- SHA256 eaba2e8c120e1c9ebcd06bb7ce009318b886e6b4bf883bf108f8bb997057805a
- MD5 b361d5f97551443c7e4900e78a0a9088
- SHA1 3b3f2b3cd8f161e0c987db9068b7383cd1d32c78
- SHA512 2cba4fc36117215c55959c37eadd2a876ebc59871a6db12237a870dddf959afbc52b24286ce283fe445b33fc29d717c7cf0500359fc77c2e45089133104cbbd8
- TLSH T185219F07923639BA91FD260CAE699B47D374835714C1086775BCC58CDF7AA1A4043B0F
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json
- Size 11KB
- SHA256 c1a15e709f435e3f4c35aebbf6582631128e806e1cfc1391978dfba478f71d81
- MD5 df6ea3e009d6a0e73ecf6e60987cd0c2
- SHA1 9de5c4dda397d17c69c7a49210147d1a94531065
- SHA512 59c443c8e59793451a4db62799abdf6f684bb94923cb717062b5163f9043e159bb3ef49cb79ed765366304745b7ab085148e241cd8e42779fe5335498468d6f0
- SSDEEP 192:/Smf/FYgVMzhrgHTb0MAJUKfVgH8BZ8ZE/G:6mlYgVMzhrgHTb0MAJUKfVgH8BZ8ZE/G
- TLSH T126323326D1B5DEBB66FC627661B40782F364CB6F08410C47797CC48C4F7BD1A62C2AA9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json
- Size 11KB
- SHA256 a383c6907a38f1678738def3012f6fa1c409cf07896017e90b30ccc40c501cde
- MD5 4b76f6fcefd0409e7fbdbdca16ab7213
- SHA1 e128698ba8032def90b9acf1df14b47ecc711564
- SHA512 c53a8aad6cdacafd040f7d8f8dca81181c6fbfce5d0100c465974b400c6b3f79e8559faf20bcede89a2b9b527bd3fe4accbfeaa61b2b2ad2d407b74d59d29f9e
- SSDEEP 192:RcEmv/FYgVMzhrgHTb0MAJUKfVgH8BZ8ZEEz:Rnm1YgVMzhrgHTb0MAJUKfVgH8BZ8ZEu
- TLSH T159325826D1B1EEBB66FC613762B40782F364D76F08404C47797CC48C4F7BD1A6282AA9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json
- Size 11KB
- SHA256 451609e9ca07e184d0c9a2b30402ca2201e91a9e7296a7521de184edce25e4f2
- MD5 2e079d33ff1a77c3cad6c6ae9e127370
- SHA1 7edcd115a22992fe1bde4ea6e5a5be6485667cb5
- SHA512 1d5e8d647b46dfb3911c4915cd5280b364ccc9ce93b13dd7ec7f5c4ed363cc883a6bba78072fa85a8fd854fcd33d0c5c2a8abc323094ae51aeb8b90eae9bcc69
- SSDEEP 192:fEmy/FYgVMzhrgHTb0MAJUKfVgH8BZ8ZEVI:8mgYgVMzhrgHTb0MAJUKfVgH8BZ8ZEVI
- TLSH T17B324726D1B1EEBB66FC617762B50782F364D76F08400C47797CC48C4F7BD1A62826A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json
- Size 11KB
- SHA256 5679864e9d16a0463f3076009022cb8e8d53f29dbf2dad1ce1745005239bfc50
- MD5 8ee573b82d855a777bce867530f8c35b
- SHA1 cf3a188c3324bb5fe2354d357fce93fd10b8441d
- SHA512 bab2610dcbb64e4fe11198e5a13f22f29e2295e0d2805199590875e86ae92313c8ec29f6853a3a1856404ae300c169b7e323bcd3d7d3668c7c3f82624e12be9b
- SSDEEP 192:zEmU/FYgVMzhrgHTb0MAJUKfVgH8BZ8ZEm6:AmGYgVMzhrgHTb0MAJUKfVgH8BZ8ZEm6
- TLSH T121325726D1B1EEBB66FC613761B50782F364D76F08410C07797CC48C4F7BD2A6282AA9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\MwacControllerConfig.json
- Size 1KB
- SHA256 c02263fc53f75de964319f6eaa066acb9c92ce67e423c44753bc9b9965602fb5
- MD5 6ef58fcfb6402b830350ba7581be2d49
- SHA1 b4cee0753754a4d0982b8694790e0fab46e1069c
- SHA512 b0f6b64da0fd1bd85ceb08d08921f8f60bf5201d6019dad79ba3d431b748e0fb5b1ba17832517432c3fdd211bb731be141861fabab833454bdf1e2eaff33eac7
- TLSH T168410832D5685DBF1DF412A77D994252F641971F416808A3FABCC96C5FB6C12200AF1F
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\MwacControllerConfig.json
- Size 2KB
- SHA256 f2145b14261e93da075783191104e410af6482930faf2e57d641b309c4663220
- MD5 b8ffb06f11bc48a39cd7011b853e94e9
- SHA1 1aa9c790852817c29e0b48dcd53cebfb7c3b40a7
- SHA512 e150e962803d600d3da4a514126b0e385f607eec18cfa6c89318cbfc5792fa2d631e5d28c93660a02c877b3d6b50efa913264f57247863d34ecf7670f69529ab
- TLSH T1D5415B32D5686DFF09F85266AC984252F651931F41640CA3FABCC56C4FB6C22200AF5F
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\PoliciesConfig.json
- Size 814B
- SHA256 cc04f979c1974868a281bdebf3cedd32e24cee0fc2755e0aa02d6eff1a24a503
- MD5 033b6db0435c40e4ffd51c738dd60ae5
- SHA1 67139fd78fa6e068ae3ef03d8777b30f9670d2a8
- SHA512 9b5bd13abee08224e7dafd5db0a9751558ad74f18a2b4eef1fb545bf0d4f4e196adbb42c26c94488b849b52327bef4e6aa9657906dbf34c2d6323c5f9e62c396
- TLSH T17101476AA84090FE253D81688137D8C1F352874A34191C2FB7FAEA0DEDB793B3186D85
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\PoliciesConfig.json
- Size 814B
- SHA256 2f7f5bd806a63b48d05a64b3d37fc0a65859351ac1963679b96be6ed64a83c95
- MD5 3845676b37863f14e116fff216a4665f
- SHA1 a6951560f47462fc7e8accd2e2079b0b2866db16
- SHA512 95e6c76317196a64f3c2229213aea427a4bc6daa834a34345c3de18990c0f0d6fe2c82ca2ea1c97f37a4f974bdfd5f6418b8d00cacfe85283a0ff0eeff8715bd
- TLSH T16B014726984080FE297D5268813BE8C1F351871A34191C2FB7F9EA0DEDB693B218598A
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\RtpConfig.json
- Size 1KB
- SHA256 668ca5dffc180639ced90337aa36d6409849c655752d0b69ff9b41dd5bc3c7d7
- MD5 ee5c0b4c6d3800697719c07aa5443fe4
- SHA1 e4a9e940191b10d947f5f9f44f859b37dc93e047
- SHA512 29df3428a9a6d74d74c6442c3a10263e3593da59ca96443281670c1b3c8a54b09ef0db2f49c7dc1e2362250050631446935b88a6996afd71c70591b0e0973b02
- TLSH T18621B121AA41B4BE08B9C1048D3DA18ADB305B59220A087B76FEC92DDDB76733B81DD5
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json
- Size 2KB
- SHA256 05374c5b8afba101949ea3efdbc4baafc02c5f2429fdeb938920380799ae4a47
- MD5 f7ed1a56e1a2404d059e469d0a75d980
- SHA1 6a487a7fbb5ed81d780b4f55a410e5c47319a18b
- SHA512 c965d5046f9a7cec54cd45d1cd83c6afe0a15c184ae62dbc4255d217fa68d17b052a498799f50198e963a6a0637b403b7ada4e2f472182688ef0b0d5d591c76f
- TLSH T1DA415912E5015CFE19B8E14EDC288186F73083972601086BB2FEC69C6FB35377686EE5
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json
- Size 4KB
- SHA256 1d98761b4312df941d53bdb77f88dfb1520ba5c9d3bc4eb865a3ad81e480ade6
- MD5 22fd512b1598e5485e744a873b40daab
- SHA1 339abc07d5d35555a297272d54ec3585e5afb2b7
- SHA512 83f1fc655cc3a3a225e3d2b375775c6b1458e06fc8cd3e02e28e88bc1cfd4ed7fadf84e0f565970bb24a6d42aeec5c64e8005a4b55cb49201e20ad4cfc461aa5
- SSDEEP 48:i+RtPVSfKuGQf9uEswkV8EmHmduwh8qXKeWQX9OMEmAf3wsaA:i8AfK5k9BhkfmHYtXKBs9pjAf3wsaA
- TLSH T100A13912D9105CFE19F8A25EDC2881CAFB3183976205086FB6FD859C5FB35332686EE5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\SpConfigFile.json
- Size 11KB
- SHA256 c743b8524a615dac6dbd40c6c9cd619dd8a2984b519c8dca55f0451595260338
- MD5 3e835fe0b666b2e6e953188234852522
- SHA1 50066379ce0d25c40f85971d038b90845631bdb6
- SHA512 fa90a541435d9538b86045f60231d3de44a7d13b4d0466e44651850c250dfe71507d5c4d24a8655aa773417f781bf4073d915e44a3e82e916d580838a66f7f35
- SSDEEP 192:T8+xwb8fkY/sDpS8t7SSdUCExUYS9oFfJ7MLPi5LnDjufzqoA+8xRj81offZJZQE:T8+xwb8fkY/sDY8t7SSdUCExUYS9oFft
- TLSH T14F32071EE0A84867887726901F7A95A2E334526BC1435C6775FCF12CCFB6483C49AF9E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json
- Size 1KB
- SHA256 3df0a97344fb05e6cc678a9a000eebf8f45cc6fca759616cd3ad4da06ba63f0f
- MD5 c1e469c7d30b56c208b83338a2465ed9
- SHA1 0d268b46bab91b5ce19058f4524629048e776ce1
- SHA512 91cf682298edc1132d3e3afdca261bf40a86a080e78c951c8b823bc7ff2e3131559a4835dc822de5647f0cecb4d22e70b68552ee0816a86fa3c24e1c46903bdc
- TLSH T188210012892840FF28FCD188C9B8471AE7A0931B51510C0FFBFCDA98CE3707627E1999
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json
- Size 1KB
- SHA256 05f349c5e96cc94e6c00dbc3b9fab4bde06c5b14f244bf576157123f07de8b2a
- MD5 3f6f89318a635151dca2fda380f5d4e6
- SHA1 73e4ac743170e71b4b1648769a6210315270a196
- SHA512 6bbe588270c0f804e5e9a67da949fdd657c4cac4b1a0b3a4fa4892cd208921d2d1541f0a28d7cba6280a6623ef0175ce3def22341116eaf45ca51588dffe3328
- TLSH T153210312892944FF29F8D188C9B8431AE7A0531F51110C1FFAF8DA98DE3B06637E1999
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json
- Size 1KB
- SHA256 b541947f699d7dfffb236514453a9afd449b415f55649c168f579e6603d07979
- MD5 9e62e8d1436038edca43eba3daa14f2f
- SHA1 bdd5cb9b2d7333f348cbb399dca3c6501b2e8cf1
- SHA512 d21969cd0823bbc5fad2e593e3cdf1f64f8c7693e0397bdf445a4991cd4c719efde34a523699855824208e8cf228f831ceaffe1f8246b47aadd463c1635bc2c1
- TLSH T17731F312892841FF29F8D198C9B8471AE7A0531B51550C0BFAFCDA58CF770772BE1999
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json
- Size 1KB
- SHA256 60141535a5ab5526bcc9ac4b958db9ab3502cc640de87978cc4082c8636f40f9
- MD5 03fdc82b890aaa7ae2b93f115a7454fa
- SHA1 1160f4f5af53c26d4b12afd810fa15accb8b7e07
- SHA512 ba674cb918f62c4223a361b49071d465dfb70cf2889f6cac4b342e0217bcf973d3a13151b7dfae674b6f0a6d5d6c6edc15e7ab75254b8015d8581b3db8212057
- TLSH T1482135228929D8BF12B5978DC9B48001E760839F6660896FB3FCD848DDB3D782487A4D
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json
- Size 1KB
- SHA256 d7cb1b715c66cf01c5054f605d00107238260296eb8ec53bef92a9648a20399b
- MD5 948fa2e4a0507eb649c191102446af88
- SHA1 78b55dba7b0f1c3917bd5c54fd2b9c575f8df2dd
- SHA512 730e69509f9c5e6bf3b6e205e7fd66a2e34c6770e077c8c34d215bb5096585872286cba80819b5125f2236aeef2ce201f4bbcba82b233876881c446cec24c970
- TLSH T1472126228528D8BF11B5978D99B44001E750938F6670496FB3F8DC44DDB39751487A4D
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json
- Size 1KB
- SHA256 4da1f2f6ea9006260da232edb1daddea1c10857093fa7013e74a3231d7ed0bc6
- MD5 258ad1399a0c986a2177bb685d0de600
- SHA1 14f48d9eaf277c5cbae254dcfffa473a4b1d4d8c
- SHA512 63ccd80916cbc8deb3af4a183673c396438587e273e721d4afd49a1c181dfd05d9e5e72e8edc991787995164878fccc0092c4f0e357e3c89c009f8abf37391d0
- TLSH T1532137224A29D8BF11B5969D89B84102E750838F6660496FB3FCD848DD73974208BA4D
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json
- Size 1KB
- SHA256 7b87214533245ee08a26c2bd772373c5a8629b44f3f768d0e85bcb275e75fc85
- MD5 2925b9a13b2850d8d97af7600ac6803c
- SHA1 0fc8aa6d604c3d3f2ba1b067e07219597f7a77a3
- SHA512 22dbc5e3d63bdaa91f0bcd1ff4fcbc5f15c4d0cc844835654625849ce677fe8fbedeb38761e84c1ca6b07ff5bb8b387c2def76a8b400da9e2adc02db4e8caf7c
- TLSH T1A2214722452CC8BF11B59B8DD9B88111E750839F66608D6FB3F8D848CDB397424CBA4D
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json
- Size 1KB
- SHA256 abc275c0238837a3e2266414d1f06f0bb9b3d0bedc6f69ac6fbed65a896510d4
- MD5 5cea0b4d278c1ce39c915c3c52863420
- SHA1 5d429112d23e347214361f7a4d35bb383a552ff3
- SHA512 9e16e65b44861336b0eefdb66c9f0375b0632179ac3570d19331097c9fc9e77b5d07707ce5acf883c66375cd9b6f30d2d9784daaef4bcd650124b7c819a61fdb
- TLSH T1BC3149235A39D8BF11B5974DC9788102E760538F6670896FB3FCD844DD739782487A8D
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json
- Size 1KB
- SHA256 b99567158ac43e7bba3f879a29e53d5da6266ebe13b462dd258cd3f96f8aaa40
- MD5 ad9f7132ae8060af43d1a66b80cdcf62
- SHA1 77cb13e510033afe4f006a3162d4cc3f0662ddc9
- SHA512 973fe287341d1ab761e232bb950264384f84133c69b166c9ec4be1a76bfbd4283d256dcf406f1d85720620c70fc3cb91962f439cc5bc7e91411fefcfaaf6555c
- TLSH T161315A224539C8BF21B5969DC9B88001E760539F6670896F73FCD848DD7397464C768D
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json
- Size 1KB
- SHA256 05e08e00a3ff3caf14339bc617f9923bb6a8f9f35883c3741ec1d6bb75a8f655
- MD5 d2a270e43239c8018b61bd35e74e36aa
- SHA1 73f7d5bc782caa97df9f5d6faf342694715e5277
- SHA512 b1d160fa2c1dd4413738aa5889bf82c68bb4165273a2f5b08e1e7a093125c8eb16ea18028e70b8f7128396c11afc85b34711d6eedc4374280f116b360b886c0a
- TLSH T136314C235938C8BF22B5964D99B88101E760938F5270892F73FDD888DD7397424C7A8D
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json
- Size 1KB
- SHA256 d67fa0640db7fcbab5534b14806819c2775d7fa354cb4b63ae6d028c4e81a0b1
- MD5 a1a3dfa9d7d5799228bd68abf6079f84
- SHA1 84fe1c828686066eda57a0aa6e530c87837a57f0
- SHA512 af468ce1e0703d4b88cb4f7c8f0337d5b52c582beb0157aef1fea0c0750f6d80f7790a261570abef8b1a35dabe4993a26382af05d834113ff0f76f80c652fb61
- TLSH T1323149224628D8BF12B5975DC9788002E760539F6670896FB3FCD888DD7397824C7A8D
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json
- Size 1KB
- SHA256 6df39eefa9e6b47522e875d21312b88144e164cb1b89aea14b6cf305e4f2afc0
- MD5 aad62e568ea4bc0773d6c4f7aa2a6440
- SHA1 0398db8f1bbf4b49c5e304c095401e3a12a37110
- SHA512 59c9ddba1d24c16e2081c42661c7dfd0aa2b6e02283c6b929ffe47bf2cc7c2c51e717eb3cb241c8fd2c3557a226dfe533e08826997eb89c1a18a2bf09bd24b48
- TLSH T1683149238A29C8BF11B59B4DC9784142E760538F6270896F73F9D848DD7397864C7A8D
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\VPNControllerConfig.json
- Size 1KB
- SHA256 0ae967ae6fa9b1704895598a3eb15b92ab9a9d20f7659a8932867fe460ca8e20
- MD5 2777acc6b7a3dcf567d8a4da750528ea
- SHA1 05367bc5e8f86e7e89c78f5a06091914234a7b2f
- SHA512 1fb95edc972993fd771f3a17e16ec4a1151fd4db654d6faae67f3f2b047ed9e471d99feb7d3d12322d211d5ef5d6c8b716672d16d035f358d4b72b4702331102
- TLSH T199216A62709010F6693D4A9B6D7D5200F2B0230F16DD8F46BBBCE000CDB7698A160F9A
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\VPNControllerConfig.json
- Size 1KB
- SHA256 c700345374dfb1758c04dd14f5aa19f8398f061bab55fa430657bd5f5d8134a6
- MD5 8a5204e1abaab749aa9931e1d0ac80ab
- SHA1 d13fc859627d709892884bae67288995a1e634c0
- SHA512 02aff08914b10e901e04f206ebbfe11b4db21ca78d2815ca1ac4a259df8887852610f99392794602a676aa63fda0d882985909de25b44926354727c6374a589e
- TLSH T17C215B36B09010F6697D5A9B6C7C8201F670130F11DD8F45BFBCE054CEB6698A164F9A
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\VPNServerListConfig.json
- Size 125B
- SHA256 103ad5383c9bd2318d6073dac821458de7de31ceaa3669e1592bacdcfdd7f7a4
- MD5 e34c276689199cfa1ed846bb7699c258
- SHA1 13afea5d2fa16c40bb77faf6a36e26bd68a25d7b
- SHA512 3c52678b05aee62da7174d7546c8e11c7773c2ded95259adde40759d26009018c5cc17e9ce97b1aeda50a6eeec5c6116f91572939e13819cafe2b6af878d2f38
- TLSH T160B02B84001085380232530009810401C3A0B3817008485D7319DCDFC72001510A2F19
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\lkg_db\Actions.dll
- Size 4.5MB
- SHA256 c4002339b58bc493ae3540bafe1b2ca0a70bba0f853e29f60e0f6a1680fa9a24
- MD5 20d70c6e04dbf14c01ab2d756e97854f
- SHA1 f172c8b8c0e87d2a9ab064513dce004d16d03e0d
- SHA512 13e073cd4b3d53c6d9fdda671a55962266b5c0a18abcb5774092c35f0d0bf2c5d0d9802d8955d32cceb166821634bfc067dac7809c9ade143cf3a3b497743b36
- SSDEEP 49152:tzBxfafNoYk03h1UjDIbeNqj+wdCzkrJuSu1BrtGgfBsAGxQ1ZbvdPd2uqaSpeOj:1rbNqFxlpxyn2upOZ
- TLSH T1CE263906A7E902A4E4B2C574EEF39403DBB278315735CBDF0191524E0E63BE19A77B26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\lkg_db\BrowserSDKDLL.dll
- Size 5.4MB
- SHA256 60c8c024ff020f04fcccec10ee78872bb1e6985463d6370c6af095761d88b860
- MD5 a3fe79081a59d493c01b5c1139babdc9
- SHA1 1505cb4053bcd9b55c40227ad6b62a2457cebbdf
- SHA512 22310a585edb36050ff20356cd9eb5129cdae3ffea2ccd7a54d9652dbd336d7f402ed119dc59ae3250b93bad40e75983184256c0bb239cff049bbb983f487bdc
- SSDEEP 49152:wyLEnIYGoPW0X0lfzc+Spd3hdC0qdcz+UbDa+El4+LorSojkoy7HJBQCdfvxYffA:tYdbZmczU+ypLha/S8JQ
- TLSH T199469D1772E900F9D8BBC1788A5B9507EBB3B805077097DF05A0926A1F77BE14A3E724
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\lkg_db\Global.nm
- Size 334KB
- SHA256 e8e39bed0172d5b4db307a44bbbc1d105986f6e881e19d67e47e9a5ae478990d
- MD5 05af547ff845cd7b62a1945df05c8920
- SHA1 ff456aa931c003ab3be1a055ef06fc324da918ab
- SHA512 b67e7998a517391d33293f41764849fc5ca0743e03a01e157d4f4fb743d912eaebd678897f98566d17401bbd3e07e54e48fdd6b6a5a12dd319c60c62df684da4
- SSDEEP 6144:ShGoLNRdpPTzHC76NidE/XTKNwcc99Pa5H5k0q42TSV8BMl4GUHfl7lo0tdhY2C3:ShGkNRdpPTzHC76NidE/XTKNwcc99Pa3
- TLSH T1F6748BD167AE2354F5B2EFB41BA0DA25597A6CA2EF00DB99D302185B153DE50CB30F23
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\lkg_db\cfg.bin
- Size 1KB
- SHA256 82ce153386ccf9c8f52cf5bc1ed1bf175538ff1e367c52458f2245c387573844
- MD5 9e955265e30b5c0ce0cf667b6faa1b9e
- SHA1 9663452dc45620af1469c5a773346a03ce91ebc5
- SHA512 35a75e83ebf7934a65d8241249e0816ee7a07b21bd671ae1327a2fe2aa09dbbb3cb478194a3390976bf3b29d5bb3a7b1a22626549ccfe8836ea78953591c1367
- TLSH T12C1183420AED29B3D45E13F9DA4E3E638CA2B601E30A9DA00EC3823359E4417181C031
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\lkg_db\ig.exe
- Size 1.8MB
- SHA256 73df768292a90e52fcbc5dedc51f8091083fb6042f4413d69afeace1cb0ba509
- MD5 bbb352dbbf17f6fc29cd86bc1d80a417
- SHA1 1c83c920ae75d0f6e8634804e508e9156f565148
- SHA512 12242406306d9808afb3c9d9d590867f4d116a765d0ec761436b4e272ce456b0b72a5687856d1b6672980faf4246721d297b0520821d5fcb81d7eaa86775ee5f
- SSDEEP 24576:7/pw8j0kcU71dHGvPKN8kP95bLS0pBm2L6y1szQGftwuTVHzw8mvkJ:7T0kcOnk88kPt7+zQUZw8mvkJ
- TLSH T14395D820BAB6414FDB9916B82EBCAF9D22AC69490B6059C3738C975D0CF11D344FB376
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\lkg_db\sample.dll
- Size 528KB
- SHA256 22047c6efd6906c64ebb45bf08632220aa82c03d1fe21b79502b0cb7b67b32c2
- MD5 746df014f6869285e5545505d5fec062
- SHA1 52d5f0232b78c0d8746a29e75f80a2b436f38b69
- SHA512 58e7a0051cff72168ec56072339b2a4961a9bc12600a6fe4dd3c01f0aa8b7d22e3d79d72c7ee9a622508e4052eb7c82d047063659c23b34bf93eff7124619848
- SSDEEP 12288:oYIAmy9w5vPkTEetmCqryujcqhL0HU5WhjW5w:oY/VJrqhLcZ
- TLSH T193B45C00A761C01CF4F701FA97BA969DA8387970773C94CB61E1E98A1A649E5FC37B13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 05504f8d4b0c92165ef02104153891ed09a652aaa6d814ade22b684baa840e6f
- MD5 01e160b73260ee61979370778c403056
- SHA1 3973438dc9bd50e9e571caf20cf72d7eaafa38f5
- SHA512 3b825d6ece9159b8e71fbcf20cf683f87c13d088a2c7057340db57ecf500753905f1ec6e90c83415e7d742d915a2b28b3c4fa964a13ac2ac58420055a469da91
- TLSH T1C6E02BAAC962DC370CFD071D5054074AF65423073740498F3A3D951A4F7563B8797C5C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 792B
- SHA256 101756481e0c2a7d7293c649d75c1236eebd3488a639e9f4f8296a36eb9c6cdd
- MD5 e96a1273def51d8f04f3c2a92b97451f
- SHA1 b0223aec0594053fac1a2666b8f403fed7a5d6e0
- SHA512 2770b4b44bc1830b1172b41738bbce19c0ace40c6596bc8f6a005c032aee04759190389d5b0b832036750772130c92e944c72f6232362f545bd4470a79991f7b
- TLSH T17B012803A20B6107CFFC367155B525D540384599EBCD19AD47C1C4EC74A92B18D8C5FA
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 6KB
- SHA256 01300ed40760e0ead61b215a6c55ba65a8d4d16418566b4b77f9b8f76cc37d99
- MD5 cc44f6fc7d176dbcdfdd8c1a6cc0d1ac
- SHA1 1b5237f26540d6327a528a406fa8dcfc97c2dc97
- SHA512 665fc2f7a4f335e368da14a63c7bac01086f65fa4e906e86464bbecf02216850d3fd31b4ec58b57ea9530bb68dbc7e13b83b9b556e036c6e71d0127155a8fc38
- SSDEEP 192:DJ2Vys/NniJIJ+aaQGy6SqAFCAHaPDvcfP3NP/DTK:DJ2Is/NniJIJ+aaQGy6SqAFCAHa70fvU
- TLSH T1A6D1BCF7C7D8C56DC91156F49B216F1FCE2A0A18431C3C26C8E8AE5B93E2471E25538E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 9b2dceff268243b8f067f5670fb09c4149b30329518e2bcbb1f9e55e3727fc84
- MD5 d3fdc2421f80c15d5078dffb00bcb678
- SHA1 f116b177b0d0ca54b9bc7a7e363d905696dcc8e9
- SHA512 a51e3dac9233a19abab05004a5efb9d21c60f72094bab467c0bd9728019d3fd73054c06b1b3448cfd849cd52bcfd8d19f93a54332cec4c8e00befe4075110b20
- SSDEEP 192:XRicBz5kozCFQEv71hpAPRp2FWX92Hsb+WNn2s4j52+uYkwLaMaVyIsnAUgtaJ:XRimz5DzFgBhUX/Qw1K2Iraj8
- TLSH T1C252D66FA920797B6CD6C21AFD227B57D7F5102121E22EC4EAFC892C05D79CC622741B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 c54836683d23f9fee57c69a9d42002f448a01bbb5b6b38437c5fcac9744adcc4
- MD5 97aacfb3977979cfbf9d8a6c4d36d689
- SHA1 28c462804fa985bea43aac67e658ae60025ec226
- SHA512 ac229055b177234c91f43061b9900ff41ba000713f4120fbf08cb18c16d47d484d5415a198c6f1896335d53e2a7e2f4dc407a06b90151f49d9994124c8990d05
- SSDEEP 384:+wjKJ7KxkXqKf/pUZNCgVLH2HfgslU697pLuLcSjwxXODKh+ErU3wZJHG/A1YTPB:+0KJ7KxkXqKf/pUZNCgVLH2HfgsG697U
- TLSH T192720A676C488E770F94C68CEC177F4FADB5024B65E9886483FA982903D5BCF11462EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 1adf74d794db7f0e84ed578a4182959183d4cb10c485f20427fd7b59e4a86b42
- MD5 38ebaf336f373f71a6623469ee6b3232
- SHA1 71e252829b959914995629362289e14f1aec1023
- SHA512 22381bdf8677d2156d7ce83baae3ff9bcbf7e852d39b27c2986fe64699d0a1b85b1e03522b6f7a309c13ae21bef28e7e0c8eda240f611b5b0edb33bdcc896907
- TLSH T121B01211C1019242C88207B0114224C873199F10E60E270143E0AD22C9252618025150
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5c06be.TMP
- Size 96B
- SHA256 dc078831756eb9bd0fd39c19e81b01c3f7b09c3be1f5082f26e52587bdfb44a2
- MD5 21c6c833d6e43b1c5720ccab9bbb4a0f
- SHA1 b9a523c09bbfd1d0f327b59b524b58b4b787b6ea
- SHA512 bd1f2915aa5613ef4d5dab07a0571a67724d0987b6c595b35510b3dd95bdbee1c69fa1b3797050026aa207bf7dd7510d3169ba7a5017b352050cd2179eb22c08
- TLSH T101B02282C0023203C08303B0308880CC3020CF33C203020382E00B22EC2823002300A0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
- Size 96B
- SHA256 07713ead8e08999a47073420a627c1c20900bf28ab0696b6678362beab9490d2
- MD5 baee34711ad9c1e56f0aaa7f83225e7c
- SHA1 e964cc17363f9eecb706f0f996cab111de8a6f6c
- SHA512 c14cdffce820540c4246e8e3fd12ef4af86f5681cb0dfa0bc03d6a7b08009f3799d25df79c96f009810a221bbe0155adf45a00bc49f0169914233b4d77cfcbf2
- TLSH T1A5B022C080800C82E300033280C003A33F322CA03383083BFCE3C0C2C030B808EE0200
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 5766c545b42a0a4055f75ffd2c531dbf02aa00ccf76fe2dcaebd274ed4c46f22
- MD5 8084feed911dbd87113ca6fe41e2b6ac
- SHA1 aaecb02cbb822e683aed15cf48edb83d0cab4ec9
- SHA512 e3effffd497d8aece47c23120db962427714c23596830e46498967805faac31bf4e28f2ca77f20396a431344bfb773d415a8b309776311c0fe55983d62eb375f
- SSDEEP 3072:7Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:im7Rkm1tYpBeh2BAo3
- TLSH T197C312275E71E9375D79AB4EB08E0B1F1EF14AA6C930DE92C8D85A0437EA7CC1A05934
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 240KB
- SHA256 5bb78d213e2022dcaa1895bb6b99e027d76c7174b0d45d608395ac54e118f5b1
- MD5 c876c4f92f8fbd9f0866f4bfa637f5d5
- SHA1 877ebb7e86479773c62db79ccd7e484667db3999
- SHA512 9e3b4d2b2b8e6a8d967d31f8c11dbcb21eefde2ef776e7d341597bd0b175b0fd22d15b311a156b31869de0bc711716107f3cee2916c6adbcef2045d87cdce552
- SSDEEP 6144:XgyHdua++A6CsEoU/+Zn26tbt+m7Rkm1tYpBeh2BAow:JHllCjWZNZ9oBGcAow
- TLSH T1F93423639DA49C36AD5DA3ED344E464E5EF209E3E908A1E0C4D19A44B7FEFCD1809E70
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 303KB
- SHA256 552b99650efe0db858f8f02ca71e0dbdff0aea9fddbd07cc7c0a77d6c2e8b8fe
- MD5 f130c19ec81e0c7bb335f9e229fc7583
- SHA1 f2d762b3a407eb6d18829b5891e2a4cce8d0d41e
- SHA512 abad9ce9588778cb9ab18af84eaa5062de0feea0b75047a3fac5b7d5bbae804d5dba1b5ab256ecbd34668981f8a201a2cde5cca1f6fd0c654319b959164bd0c3
- SSDEEP 6144:B4Jkd7O58gyHdua++A6CsEoU/+Zn26tbt+m7Rkm1tYpBeh2BAow:aJktOcHllCjWZNZ9oBGcAow
- TLSH T1036423D79C409C3A6958E79C240E5A0E4EF216F3DA44E4F5D8C09A49F3DAFD90C09E71
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 240KB
- SHA256 e83226a0323d9050a1cde7cbe2192bcfc5184a92d0afabe6ec7664c2141f0fd3
- MD5 6738e360462b3c2a1f3ce1bda02b6fd2
- SHA1 87416173a37c32c9b25865359a8ecf97253bd9b5
- SHA512 d62c4ec8674a0dcbeb1415f6d60946cc34744947c0f46c26d0b8df56f61d6cfe24284561eba7bc249e27ce364f70f05001818659ddb936f4550a4bcc4d81dd35
- SSDEEP 6144:igyHdua++A6CsEoU/+Zn26tbt+m7Rkm1tYpBeh2BAow:MHllCjWZNZ9oBGcAow
- TLSH T1C43423639DA49C36AD5DA3ED344E460E5EF209E3E90891E0C5D19A48B7FEFCD1809E70
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
- MD5 81f1d957977f2d73471366011b7128bf
- SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
- SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
- TLSH T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
- MD5 b031933009b03b3dcfc6f363760f83dd
- SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
- SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
- TLSH T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
- Size 40B
- SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
- MD5 20d4b8fa017a12a108c87f540836e250
- SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
- SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 25KB
- SHA256 61cbb1d7b9d121a5ba042faa3a89ded8deacbba40e6c893d545064afd777ba6d
- MD5 07345cc148db1bd10614de2eb7f9acbf
- SHA1 e0b36259a5a6ae23f2e4ec9ea6a1a34cc94e884b
- SHA512 a3bcb0b5ba9097983b5d2bf0f73697dfd7213cfad935c243b814fb84f2ad4e6df09af5041c6d8f017a7bbb861416677f7a61ea8af39e45b5ada96dc43c9458e5
- SSDEEP 384:npoiF9CcmyWCs3sNQ8TUNTUlIm2QckCr9On5phifGGY6sx8rxxe4KV8p0lHrty/O:pzFccps31wgbkUInFGYBCxxI8p0V7
- TLSH T18DC25A32E858DDBBFCD74B99B74A3A47DEE01163898C9AE4D6D91D0D008719D170B826
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 25KB
- SHA256 74bf2cc80c8f3eb074ffeb19bb462b1de1824594755f4511d515b53455d2ca9e
- MD5 885511ce130d57cf3a7b46ec6d4d1ca1
- SHA1 008cb0f048949afe5d51a5508cabb67d4f987805
- SHA512 8d20584d5b77615b8bf58762dbcb0f67e93de472538c70913dd91046cfeaa2111787c6d9124f3f7ea2a78eba4f00eb568e2ba8555a16825e114c00c3b247d4dc
- SSDEEP 384:npviF9CcmyWCs3sNj8TUNTUlIm2QckCr9lHKphifGGY6sKopwe4KV8p0lHrty/7a:p6Fccps3CwgbkU1kFGYaZI8p0V7
- TLSH T18DB25C36EC58D9BBEDE74F89B74E7A07DEE0112785989AE4CAD81D0D00971DC470BC26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_exad0dml.4qc.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-3BJKN.tmp\mb-header100.bmp
- Size 7KB
- SHA256 db72101e43020be81ff304f50cf593497d66073be946502c16bcd64e7b2adcc3
- MD5 4f8b110e37a818130310f0c34ec90dc5
- SHA1 3bef6199fa0ba4c7b98d9c6a6c5a29c52ef9f3b1
- SHA512 d998b6f09e8750f8f99491e2c2dcbb0cec4a65f8154d795ca070eb131a4f88a30116715b67d1904a0b774e77d0b3ffdb994d10de5688e47f1e2901b10202402b
- SSDEEP 48:Lsifv2TaUS9f+MH3BkCASthRG7NHzfent1On9c/by:Q++OUS9mMXdh3Onuj
- TLSH T104F1C931A790452AFA1E627066D6ED3832780D39D4D7B4F7B4ED9DB3FB212110517523
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\CatRoot2\dberr.txt
- Size 37KB
- SHA256 458db51a0aceec87b6e58ef59c9b32d23ac7c613b8af7a002a17948db64a0b17
- MD5 5e1ae9ed1f1a5a9a26c286a7aedf5659
- SHA1 14b401d38efbb439e91cee3d6ac83e19bdddb113
- SHA512 314fec457f308c041fab0aacfe2252a6809ff9d0d64ede674a63e27464c8179b8a66d6e7904744a8c3b27f92737c25470dcca08b70d86506cc8a9cb28a9204d6
- SSDEEP 768:n6e9lze3CCnLtdvoip4G+z0ha2ErzmmYB2Erd:n6e9c3CCnLtdvoip9Bha2ErzmmYB2Ep
- TLSH T1FF035A0865D8C818C5F50A66276FDE71C57BE5C6B30B0EE570BCA754A9C2B042EFA09F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\drivers\mbamswissarmy.sys
- Size 233KB
- SHA256 3db4366ccb9d94062388000926c060e2524c7d3ee4b6b7c7cf06f909f747fc6c
- MD5 4b2cc2d3ebf42659ea5e6e63584e1b76
- SHA1 0042da8151f2e10a31ecceb60795eb428316e820
- SHA512 804d64d346b3dbb1ce3095a5d0fa7acc5da0bf832c458e557dac486559fe53144f15f08c444fea84a01471fd5981e68801a809b143c56b5b63e3e16de9db0d98
- SSDEEP 3072:H4czIC7UsK3MJNbwCfxrdy19MbMA2gtylc0jGYjNHLcUMfTCGTkpk/BzS6XYrh41:HXhf/RL4MylcGGYjVcjTCGVBfXi8
- TLSH T1AE347C46E3E46966F9B7867889E6D142E77271462B30CACF5370C4292F177E0F93930A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\MBInstallTemp6f22c388a96411f184da5e09a530fe4d\7z.dll
- Size 1.6MB
- SHA256 6e223b275b84d948cc5ae1f161f0bfff2adb34de04634c84d7dbe9305a4998d5
- MD5 ab8f0c1a37c0df5c8924aab509db42c9
- SHA1 53dba959124e6d740829bda2360e851bcb85cce8
- SHA512 ff8a26e8fd5a08c74e5ba93a564e0d3cd932754e7f06993a365bfad06670497889e69ec45bfba1378040b72f82d468e79682beba2439937bb29d2a41da940d4a
- SSDEEP 24576:LLB2ycglUr6G8epqFMyn9w44NBdzHq5FmBq7Wk2zjd:3B2GUr1882ANBdzHq5B7Wl1
- TLSH T137854A6BF6748260D0B7C075C5D2AB96EEB134868B3096C752859B3D2F17BF6C939320
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\MBInstallTemp6f22c388a96411f184da5e09a530fe4d\ctlrpkg\Malwarebytes_Assistant.runtimeconfig.json
- Size 372B
- SHA256 1eca0f0c70070aa83bb609e4b749b26dcb4409784326032726394722224a098a
- MD5 d94cf983fba9ab1bb8a6cb3ad4a48f50
- SHA1 04855d8b7a76b7ec74633043ef9986d4500ca63c
- SHA512 09a9667d4f4622817116c8bc27d3d481d5d160380a2e19b8944bdd1271a83f718415ce5e6d66e82e36819e575ec1b55f19c45213e0013b877b8d61e6feb9d998
- TLSH T1CEE02C7BCA10ACB315F52BBAC02AC282FE20232B00004D2A35FC180C2F3AAB30012F49
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\MBInstallTemp6f22c388a96411f184da5e09a530fe4d\ctlrpkg\mbae64.sys
- Size 154KB
- SHA256 321058a27d7462e55e39d253ad5d8b19a9acf754666400f82fe0542f33e733c6
- MD5 95515708f41a7e283d6725506f56f6f2
- SHA1 9afc20a19db3d2a75b6915d8d9af602c5218735e
- SHA512 d9230901adeecb13b1f92287abe9317cdac458348885b96ef6500960793a7586c76ae374df053be948a35b44abe934aa853975a6ccd3788f93909903cc718c08
- SSDEEP 3072:Gqj/Hk4JrlFTsH8J3PxHSIIc46/3Zf3xNPugxmIHts0v:Gq4GhFTscJfxHSIIuF3xXJDv
- TLSH T193F36C52F3B410F5D866C979CA665213E6B2784E2320EBCF077189252F573E4BB39326
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\MBInstallTemp6f22c388a96411f184da5e09a530fe4d\dbclspkg\MBAMCoreV5.dll
- Size 6.7MB
- SHA256 3b8fdecc7155bbb62b1d76aa30f06bf079924bc794cf700f5d51ade13444d049
- MD5 b2763acfd7ac2ce596a4f3a930dd2a3f
- SHA1 ac18df54e4b64268e93b6e0af650d6cd8fe60274
- SHA512 40b9f4bd1dc10034a5b18d3c0d2447a98aa6e4655d5d43b22aae83720e9eda8f818cf7febc0e8d0cd3b3f051805407a6112b66eb4fddd49ae2ca882a1aaa57b3
- SSDEEP 98304:UPxTXttZarMzMk4PEcxZ3M6GdPiwjQDZ:UP1XbZawzMk4PEcT33sjQDZ
- TLSH T1E6665C0BA7A901ABD87AD33889DB8602F7B3B814177397DF0655623A1F277E05E39710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\MBInstallTemp6f22c388a96411f184da5e09a530fe4d\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.25\mscordaccore.dll
- Size 1.3MB
- SHA256 14f351c5fba0f9e7199f921a93db8463276fe47a94668c84292eebfd76557d85
- MD5 c174eda52e913580d505fb0541e513b2
- SHA1 952808236e912716fd73f66c2f9f8cffb171ae9f
- SHA512 a5af4ac7a57fa4f942ecfa4fddeac5e4143c1cbb819ddb23e98cade821f7964b0e9de97aeb48c4a01c42e2a206d1c6ba97f7d1e84d2498a5ca1e8760849f4fb8
- SSDEEP 24576:H7yAyF3hfSuGGi1uzXQZs1PokJRxw9vzUNilx+He6qIvhQ8:HkxfPwMQZsdbJrw9vQNilxxgvhH
- TLSH T134554A5AD6BC4499CDAAD1F9C507491FE7B13801037067EF4AE08B192F3BBE56AB9310
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\MBInstallTemp6f22c388a96411f184da5e09a530fe4d\servicepkg\MBAMService.exe
- Size 8.5MB
- SHA256 a84747e773dbc0a1c740bf6d531a147e37d4619ff260664bfca9947aca68c2b7
- MD5 1cf215acd0ff47d93dd5c503f7f096b5
- SHA1 cc905a2fa8caed90b1c53e84f2afa608296ae284
- SHA512 b26a267ce87123cbba59720d868f0ada8b2c9af56593473608e07811a0dc97537a961c5154e26a2a001e1b3a49545ddccdc86a5a4ab7867a1881df953762bdb0
- SSDEEP 49152:6/2rVz5mdktAbJBxZTCrioxPWhD3jYc97zeru9Sr+x7l4Bgye9ko+T1uQV94Vfxy:/LtKshQbd99ko01uEazaQHFQFh
- TLSH T1EC96B406A7F951E4F5B6D6B4A977662AEE32BC618B3093CF1150560B0F32FD48D38722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\MBInstallTemp6f22c388a96411f184da5e09a530fe4d\servicepkg\mbamelam.cat
- Size 10KB
- SHA256 3ed5a1668713ef80c2b5599b599f1434ad6648999f335cf69757ea3183c70c59
- MD5 60608328775d6acf03eaab38407e5b7c
- SHA1 9f63644893517286753f63ad6d01bc8bfacf79b1
- SHA512 9f65212121b8a5d1a0625c3baa14ef04a33b091d26f543324333e38dcdb903e02ccc4d009e22c2e85d2f61d954e0b994c2896e52f685003a6ef34758f8a650c7
- SSDEEP 192:2jijKjmjlydFvJCjvyyKwnsFWQFJFMFETTbbrmjX01k9z3AzsGpZH:OvornsFRnWFE3X+R9zusGpZH
- TLSH T1933207E25A2C90C3EDA36DA053E8E5A77C7E27CB1C40806D31ABF2591D937C5E71846E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\MBInstallTemp6f22c388a96411f184da5e09a530fe4d\servicepkg\mbamelam.inf
- Size 2KB
- SHA256 793626d240fd8eefc81b78a57c8dfe12ea247889b6f07918e9fd32a7411aa1c3
- MD5 c481ad4dd1d91860335787aa61177932
- SHA1 81633414c5bf5832a8584fb0740bc09596b9b66d
- SHA512 d292e028936412f07264837d4a321ecfa2f5754d4048c8bcf774a0e076e535b361c411301558609d64c71c1ce9b19e6041efa44d201237a7010c553751e1e830
- TLSH T1A1410355AA578BB4257B31B82D472883BE2412205065784032DDC8C99B7CF1C93757AB
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\MBInstallTemp6f22c388a96411f184da5e09a530fe4d\servicepkg\mbamelam.sys
- Size 20KB
- SHA256 b5619d758ae6a65c1663f065e53e6b68a00511e7d7accb3e07ed94bfd0b1ede0
- MD5 9e77c51e14fa9a323ee1635dc74ecc07
- SHA1 a78bde0bd73260ce7af9cdc441af9db54d1637c2
- SHA512 a12ccf92bead694f5d3cba7ff7e731a2f862198efc338efc7f33a882fe0eb7499fb3fb533538d0a823e80631a7ca162962fbdfd78e401e3255672910b7140186
- SSDEEP 384:HO/iZbhL/Uqqn2+s/+8gpUad+JR9zuspd:PtUR2h5adk9zuK
- TLSH T1F4A23A9656B80183EABBD97047E5C527BD38F39777408AEF01A1E1241DA3BC1AB3193D
- MD5 SHA1 SHA512 SSDEEP TLSH