918a02c8513e819b011ea79ffb5f0a87ddcf1ab108a37efd5959c350fe0e68e4

Analysis

user interaction
yes
max time kernel
129s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/09/2026, 03:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MBSetup-1.1.exe
Size 2.8MB
Sample260907-d6vsmsxhnd
SHA256 918a02c8513e819b011ea79ffb5f0a87ddcf1ab108a37efd5959c350fe0e68e4
MD5 fd8c36692bc17fd3e19e9a6c841395ac
SHA1 0127245fd627f9f1e2ef222675a9c77ee6366be5
SHA512 63c0fe6a3d384e7817871a9ff7f06170c9e7573970263d95c419da26eab08a3d4f49c05db340be93dfa22c37229ff67cff7985f52feec63174d7f18053ae1353
SSDEEP 49152:DixAMxent7Lv7ywAeyfvE0Z3R0vnxn1o2d5PF0xu:GGMxentvnAeKtEnW2XF
TLSH
T18DD59E3172918120D5B3D270297EABEB5B79BC256F76408F32DCB6390B725C09D74B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery persistence privilege_escalation spyware stealer trojan

Malware Config

Signatures

Drops file in Drivers directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\drivers\mbamtestfile.dat	MBSetup-1.1.exe
File created	C:\Windows\SysWOW64\drivers\mbamtestfile.dat	MBSetup-1.1.exe
File created	C:\Windows\system32\drivers\mbae.sys	MBAMInstallerService.exe
File created	C:\Windows\system32\DRIVERS\MbamElam.sys	MBAMService.exe
File opened for modification	C:\Windows\system32\DRIVERS\MbamElam.sys	MBAMService.exe

Patched UPX-packed file 1 IoCs

Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.

resource	yara_rule
behavioral1/files/0x00070000000248ac-2248.dat	patched_upx

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	MBAMService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	MBAMService.exe

Impair Defenses: Safe Mode Boot 1 TTPs 2 IoCs

defense_evasion

Safe Mode Boot

T1562.009

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\MBAMService	MBAMInstallerService.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\MBAMService\ = "Service"	MBAMInstallerService.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
23	3896	MBSetup-1.1.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	MBAMService.exe
File opened (read-only)	\??\G:	MBAMService.exe
File opened (read-only)	\??\P:	MBAMService.exe
File opened (read-only)	\??\Q:	MBAMService.exe
File opened (read-only)	\??\R:	MBAMService.exe
File opened (read-only)	\??\T:	MBAMService.exe
File opened (read-only)	\??\V:	MBAMService.exe
File opened (read-only)	\??\B:	MBAMService.exe
File opened (read-only)	\??\K:	MBAMService.exe
File opened (read-only)	\??\M:	MBAMService.exe
File opened (read-only)	\??\N:	MBAMService.exe
File opened (read-only)	\??\X:	MBAMService.exe
File opened (read-only)	\??\I:	MBAMService.exe
File opened (read-only)	\??\L:	MBAMService.exe
File opened (read-only)	\??\O:	MBAMService.exe
File opened (read-only)	\??\W:	MBAMService.exe
File opened (read-only)	\??\Z:	MBAMService.exe
File opened (read-only)	\??\A:	MBAMService.exe
File opened (read-only)	\??\H:	MBAMService.exe
File opened (read-only)	\??\J:	MBAMService.exe
File opened (read-only)	\??\S:	MBAMService.exe
File opened (read-only)	\??\U:	MBAMService.exe
File opened (read-only)	\??\Y:	MBAMService.exe

ConfuserEx .NET packer 1 IoCs

Detects ConfuserEx .NET packer.

resource	yara_rule
behavioral1/files/0x00070000000248ac-2248.dat	ConfuserEx

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\net7800-x64-n650f.inf_amd64_178f1bdb49a6e2fd\net7800-x64-n650f.PNF	MBVpnTunnelService.exe
File created	C:\Windows\System32\DriverStore\FileRepository\nete1g3e.inf_amd64_af58b4e19562a3f9\nete1g3e.PNF	MBVpnTunnelService.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netrasa.inf_amd64_1bdf7a435cb3580d\netrasa.PNF	MBVpnTunnelService.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netwew00.inf_amd64_325c0bd6349ed81c\netwew00.PNF	MBVpnTunnelService.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netwew01.inf_amd64_153e01d761813df2\netwew01.PNF	MBVpnTunnelService.exe
File created	C:\Windows\System32\DriverStore\FileRepository\rtux64w10.inf_amd64_d6132e4c7fe2fac6\rtux64w10.PNF	MBVpnTunnelService.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mrvlpcie8897.inf_amd64_07fc330c5a5730ca\mrvlpcie8897.PNF	MBVpnTunnelService.exe
File created	C:\Windows\System32\DriverStore\Temp\{94cbc0b2-ebc2-b34e-9e07-5d46b04682f4}\SET108C.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\bcmdhd64.inf_amd64_e0bae6831f60ea5f\bcmdhd64.PNF	MBVpnTunnelService.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netbc63a.inf_amd64_7ba6c9cea77dd549\netbc63a.PNF	MBVpnTunnelService.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netnvm64.inf_amd64_35bbbe80dec15683\netnvm64.PNF	MBVpnTunnelService.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netwsw00.inf_amd64_24d55504ae3587aa\netwsw00.PNF	MBVpnTunnelService.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wnetvsc.inf_amd64_9a5b429abc465278\wnetvsc.PNF	MBVpnTunnelService.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netwlv64.inf_amd64_0b9818131664d91e\netwlv64.PNF	MBVpnTunnelService.exe
File created	C:\Windows\System32\DriverStore\FileRepository\rndiscmp.inf_amd64_81bff1eb756435c6\rndiscmp.PNF	MBVpnTunnelService.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netsstpa.inf_amd64_e76c5387d67e3fd6\netsstpa.PNF	MBVpnTunnelService.exe
File created	C:\Windows\System32\DriverStore\FileRepository\dc21x4vm.inf_amd64_3294fc34256dbb0e\dc21x4vm.PNF	MBVpnTunnelService.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netnvma.inf_amd64_7080f6b8ea1744fb\netnvma.PNF	MBVpnTunnelService.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netxex64.inf_amd64_ede00b448bfe8099\netxex64.PNF	MBVpnTunnelService.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netwns64.inf_amd64_162bb49f925c6463\netwns64.PNF	MBVpnTunnelService.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netax88772.inf_amd64_5d1c92f42d958529\netax88772.PNF	MBVpnTunnelService.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net8187se64.inf_amd64_99a4ca261f585f17\net8187se64.PNF	MBVpnTunnelService.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net8192su64.inf_amd64_66c8bfc7a4b1feed\net8192su64.PNF	MBVpnTunnelService.exe
File created	C:\Windows\System32\DriverStore\FileRepository\kdnic.inf_amd64_6649425cdcae9b5f\kdnic.PNF	MBVpnTunnelService.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netelx.inf_amd64_7812e4e45c4a5eb1\netelx.PNF	MBVpnTunnelService.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net7500-x64-n650f.inf_amd64_cc87c915f33d1c27\net7500-x64-n650f.PNF	MBVpnTunnelService.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net44amd.inf_amd64_450d4b1e35cc8e0d\net44amd.PNF	MBVpnTunnelService.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net8192se64.inf_amd64_167684f9283b4eca\net8192se64.PNF	MBVpnTunnelService.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netvwifimp.inf_amd64_ec11d0ad3c5b262a\netvwifimp.PNF	MBVpnTunnelService.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netg664.inf_amd64_84cd7b2798e0a666\netg664.PNF	MBVpnTunnelService.exe
File created	C:\Windows\System32\DriverStore\FileRepository\athw8x.inf_amd64_55014eff4ceefbdf\athw8x.PNF	MBVpnTunnelService.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netbc64.inf_amd64_b96cdf411c43c00c\netbc64.PNF	MBVpnTunnelService.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netwtw08.inf_amd64_7c0c516fb22456cd\netwtw08.PNF	MBVpnTunnelService.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ykinx64.inf_amd64_0bbd8466b526ef26\ykinx64.PNF	MBVpnTunnelService.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net9500-x64-n650f.inf_amd64_e92c5a65e41993f9\net9500-x64-n650f.PNF	MBVpnTunnelService.exe
File created	C:\Windows\System32\DriverStore\FileRepository\e2xw10x64.inf_amd64_04c2ae40613a06ff\e2xw10x64.PNF	MBVpnTunnelService.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netavpna.inf_amd64_f6f0831ba09dd9f5\netavpna.PNF	MBVpnTunnelService.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netathr10x.inf_amd64_2691c4f95b80eb3b\netathr10x.PNF	MBVpnTunnelService.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_net.inf_amd64_32a9ad23c1ecc42d\c_net.PNF	MBVpnTunnelService.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netrtwlane.inf_amd64_20caba88bd7f0bb3\netrtwlane.PNF	MBVpnTunnelService.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netwmbclass.inf_amd64_dba6eeaf0544a4e0\netwmbclass.PNF	MBVpnTunnelService.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netl160a.inf_amd64_e4cbe375963a69e9\netl160a.PNF	MBVpnTunnelService.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netl1e64.inf_amd64_8d5ca5ab1472fc44\netl1e64.PNF	MBVpnTunnelService.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ndisimplatformmp.inf_amd64_8de1181bfd1f1628\ndisimplatformmp.PNF	MBVpnTunnelService.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netvg63a.inf_amd64_9f5493180b1252cf\netvg63a.PNF	MBVpnTunnelService.exe
File created	C:\Windows\System32\DriverStore\FileRepository\rt640x64.inf_amd64_8984d8483eef476c\rt640x64.PNF	MBVpnTunnelService.exe
File created	C:\Windows\System32\DriverStore\FileRepository\bthpan.inf_amd64_b06c3bc32f7db374\bthpan.PNF	MBVpnTunnelService.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netk57a.inf_amd64_d823e3edc27ae17c\netk57a.PNF	MBVpnTunnelService.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netbxnda.inf_amd64_1fff3bc87a99b0f1\netbxnda.PNF	MBVpnTunnelService.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{94cbc0b2-ebc2-b34e-9e07-5d46b04682f4}\mbtun.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{94cbc0b2-ebc2-b34e-9e07-5d46b04682f4}\SET108E.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{94cbc0b2-ebc2-b34e-9e07-5d46b04682f4}\mbtun.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\mbtun.inf_amd64_add82795013a7c3b\mbtun.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	MBAMService.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netl260a.inf_amd64_783312763f8749c7\netl260a.PNF	MBVpnTunnelService.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netv1x64.inf_amd64_30040c3eb9d7ade4\netv1x64.PNF	MBVpnTunnelService.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net819xp.inf_amd64_ff7a5dd4f9b1ceba\net819xp.PNF	MBVpnTunnelService.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netwbw02.inf_amd64_1c4077fa004e73b4\netwbw02.PNF	MBVpnTunnelService.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netwtw02.inf_amd64_42e02bae858d0fbd\netwtw02.PNF	MBVpnTunnelService.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netathrx.inf_amd64_220db23f5419ea8d\netathrx.PNF	MBVpnTunnelService.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netrtwlanu.inf_amd64_1815bafd14dc59f0\netrtwlanu.PNF	MBVpnTunnelService.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netmlx4eth63.inf_amd64_3809a4a3e7e07703\netmlx4eth63.PNF	MBVpnTunnelService.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net1yx64.inf_amd64_8604d8a50804b9c1\net1yx64.PNF	MBVpnTunnelService.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netrtl64.inf_amd64_8e9c2368fe308df2\netrtl64.PNF	MBVpnTunnelService.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Malwarebytes\Anti-Malware\UpdateControllerImpl.dll	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.Linq.Parallel.dll	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.Security.SecureString.dll	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\tr\Microsoft.VisualBasic.Forms.resources.dll	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\zh-Hant\WindowsFormsIntegration.resources.dll	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\pt-BR\PresentationCore.resources.dll	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\MbamUI.Core.dll	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\Microsoft.Extensions.DependencyInjection.dll	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.Linq.dll	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.Reflection.DispatchProxy.dll	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.Runtime.InteropServices.RuntimeInformation.dll	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\de\PresentationCore.resources.dll	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\pl\UIAutomationTypes.resources.dll	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\ru\UIAutomationProvider.resources.dll	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\mbtun\mbtun.sys	MBVpnTunnelService.exe
File opened for modification	C:\Program Files\Malwarebytes\Anti-Malware\mbuns.exe	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.IO.Compression.Brotli.dll	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.ValueTuple.dll	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\ja\System.Windows.Forms.Primitives.resources.dll	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\System.Windows.Forms.dll	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\WindowsFormsIntegration.dll	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\.version	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.IO.Compression.FileSystem.dll	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\D3DCompiler_47_cor3.dll	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.Reflection.Extensions.dll	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.Interop.Activation.dll	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\System.Diagnostics.EventLog.dll	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.Security.Cryptography.Primitives.dll	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.Xml.Linq.dll	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\PresentationFramework-SystemXmlLinq.dll	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\System.Security.Cryptography.Pkcs.dll	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\System.Security.Cryptography.Xml.dll	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\tr\System.Windows.Input.Manipulations.resources.dll	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\ScanControllerImpl.dll	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.IO.UnmanagedMemoryStream.dll	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\cs\WindowsBase.resources.dll	MBAMInstallerService.exe
File opened for modification	C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.json.bak	MBAMService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.IO.FileSystem.Primitives.dll	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.Net.NetworkInformation.dll	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.Text.Encoding.CodePages.dll	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.Threading.Thread.dll	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\System.Drawing.dll	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\System.Windows.Forms.Primitives.dll	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\zh-Hans\PresentationUI.resources.dll	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\SPControllerImpl.dll	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\ru\WindowsBase.resources.dll	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\System.Windows.Extensions.dll	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\tr\System.Windows.Forms.Primitives.resources.dll	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\MBAMWsc.exe	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\Microsoft.Extensions.Caching.Abstractions.dll	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\Duende.IdentityModel.dll	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\de\UIAutomationClientSideProviders.resources.dll	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\es\WindowsBase.resources.dll	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\fr\System.Windows.Forms.Primitives.resources.dll	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\ja\UIAutomationClientSideProviders.resources.dll	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\tr\UIAutomationProvider.resources.dll	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\mb5uns.exe	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\Microsoft.Xaml.Behaviors.dll	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.Security.Principal.dll	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\it\System.Xaml.resources.dll	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\ja\System.Xaml.resources.dll	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\ja\UIAutomationClient.resources.dll	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\ko\System.Windows.Forms.resources.dll	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\pt-BR\System.Windows.Forms.Primitives.resources.dll	MBAMInstallerService.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	MBVpnTunnelService.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe

Executes dropped EXE 7 IoCs

pid	Process
4828	MBAMInstallerService.exe
4864	MBVpnTunnelService.exe
5476	MBVpnTunnelService.exe
5716	MBAMService.exe
5996	MbamElam.sys
6056	MBAMService.exe
6104	MBAMService.exe

Loads dropped DLL 20 IoCs

pid	Process
4828	MBAMInstallerService.exe
4828	MBAMInstallerService.exe
4864	MBVpnTunnelService.exe
5476	MBVpnTunnelService.exe
5476	MBVpnTunnelService.exe
6104	MBAMService.exe
6104	MBAMService.exe
6104	MBAMService.exe
6104	MBAMService.exe
6104	MBAMService.exe
6104	MBAMService.exe
6104	MBAMService.exe
6104	MBAMService.exe
6104	MBAMService.exe
6104	MBAMService.exe
6104	MBAMService.exe
6104	MBAMService.exe
6104	MBAMService.exe
6104	MBAMService.exe
6104	MBAMService.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 1 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	MBVpnTunnelService.exe

Modifies trusted root certificate store through registry 1 TTPs 11 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\5A8CEF45D7A69859767A8C8B4496B578CF474B1A\Blob = 0300000001000000140000005a8cef45d7a69859767a8c8b4496b578cf474b1a2000000001000000450500003082054130820329a0030201020213066c9fd29635869f0a0fe58678f85b26bb8a37300d06092a864886f70d01010c05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412032301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f74204341203230820222300d06092a864886f70d01010105000382020f003082020a0282020100ad969f2d9c4a4c4a81795199ec8acb6b605113bc4d6d06fcb0088ddd19106ac7260c35d8c06f2084e994b19b8503c35bdb4ae8c8f89076d95b4fe34ce806364dcc9aac3d0c902b92d4061960ac374479858182ad5a37e00dcc9da64c5276ea439db704d150f655e0d5d2a64985e937e9ca7eae5c954d489a3fae205a6d8895d934b8521a4390b0bf6c05b9b678b7ead0e43a3c125362ff4af27bbe3505a91234e3f36474622c3d00495a28fe3244bb87dd652702713bda4af71fdacdf72155904f0fecae82e19f6bd945d3bbf05f87ed3c2c3986da3fdeec7255eb79a3addbdd7cb0ba1ccefcde4f3576cf0ff8781f6a36514627615be99ecff0a2557d7c258a6f2fb4c5cf842e2bfd0d51106cfb5f1bbc1b7ec5ae3b98013192ff0b57f49ab2b957e9abef0d76d1f0eef4ce86a7e06ee9b469a1df69f633c6692e97139ea587b057108137c953b3bb7ff692d19cd018f4926eda834fa663994ca5fb5eef21647a205f6c648515cb37e9620c0b2a16dc012e32da3e4bf59e3af6174094ef9e910886fabe63a85a33eccb744395f96c695236c7296ffc55035c1ffb9fbd47ebe74947950b4e89220949e0f5611ef1bf2e8a726e8059ff573af97532a34e5feced2862d94d73f2cc811760edcdebdcdba7cac57e02bdf2540854fdb42d092c17544a98d154e1516708d2ed6e7e6f3fd22d81592966cb903995111e7427feddebaf0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414b00cf04c30f405580248fd33e552af4b84e36652300d06092a864886f70d01010c05000382020100aaa8808f0e78a3e0a2d4cde6f5987a3bea0003b0970e93bc5aa8f62c8c7287a9b1fc7f73fd637178a58759cf30e10d10b2135a6d82f56ae6809fa0050b68e4476bc76adfb6fd773272e518fa09f4a0932c5dd28c75857665900c0379b7312363ad788309866884cafff9cf269a9279e7cd4bc5e761a717cbf3a91293936ba7e82f5392c46058b0cc0251185b858d625963b6adb4de9afb26f70027c05d55377499c9507fe3592e44e32c25eeec4c3277b49f1ae94b5d20c5dafd1c8716c643e8d4bb269a45705ea90b3753e2467b27fde046f289b7cc42b6cb28266ed9a5c93ac8411360f7508c15aeb26d1a151a5778e6922ad96590823f6c02afae123a27963604d71da28063a99bf1e5bab47c14b04ec9b11f745f38f651ea9bfa2ca211d4a92d271a45b1afb24e710dc05846d66906cb53cbb3fe6b41cd417e7d4c0f7c72797a59cd5e4a0eac9ba99873797cb4f4ccb9b8070cb2745cb8c76f88a190a7f4aaf9bf673af41a15621eb79fbe3db129af67a112f25810195303301bb81a89f69cbd97038ea309f31d8b21f1b4dfe41cd19f650206ea5cd613b384efa2a55c8c7729a768c06bae40d2a8b4eacdf08d4b389c199a1b2854b88990efca75813e1ef26424c718af4eff479e07f63565a4d30a56fff517646cefa822254993b6df0017da587e5deec51bb0d1d15f2110c7f9f3ba020a2707c5f1d6c7d3e0fb09606c	MBAMInstallerService.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0D44DD8C3C8C1A1A58756481E90F2E2AFFB3D26E\Blob = 0300000001000000140000000d44dd8c3c8c1a1a58756481e90f2e2affb3d26e2000000001000000ba010000308201b63082015ba0030201020213066c9fd5749736663f3b0b9ad9e89e7603f24a300a06082a8648ce3d0403023039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412033301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f7420434120333059301306072a8648ce3d020106082a8648ce3d030107034200042997a7c6417fc00d9be8011b56c6f252a5ba2db212e8d22ed7fac9c5d8aa6d1f73813b3b986b397c33a5c54e868e8017686245577d44581db337e56708eb66dea3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414abb6dbd7069e37ac3086079170c79cc419b178c0300a06082a8648ce3d0403020349003046022100e08592a317b78df92b06a593ac1a98686172fae1a1d0fb1c7860a64399c5b8c40221009c02eff1949cb396f9ebc62af8b62cfe3a901416d78c6324481cdf307dd5683b	MBAMInstallerService.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F6108407D6F8BB67980CC2E244C2EBAE1CEF63BE\Blob = 030000000100000014000000f6108407d6f8bb67980cc2e244c2ebae1cef63be2000000001000000f6010000308201f230820178a0030201020213066c9fd7c1bb104c2943e5717b7b2cc81ac10e300a06082a8648ce3d0403033039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412034301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f7420434120343076301006072a8648ce3d020106052b8104002203620004d2ab8a374fa3530dfec18a7b4ba87b464b63b062f62d1bdb087121d200e863bd9a27fbf0396e5dea3da5c981aaa35b2098455d16dbfde8106de39ce0e3bd5f8462f3706433a0cb242f70ba88a12aa075f881ae6206c481db396e29b01efa2e5ca3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414d3ecc73a656ecce1da769a56fb9cf3866d57e581300a06082a8648ce3d040303036800306502303a8b21f1bd7e11add0ef58962fd6eb9d7e908d2bcf6655c32ce328a9700a470ef0375912ff2d9994284e2a4f354d335a023100ea75004e3bc43a941291c958469d211372a7889c8ae44c4adb96d4ac8b6b6b49125333add7e4be24fcb50a76d4a5bc10	MBAMInstallerService.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	MBAMInstallerService.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	MBAMInstallerService.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa22000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2	MBAMInstallerService.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	MBAMInstallerService.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8DA7F965EC5EFC37910F1C6E59FDC1CC6A6EDE16\Blob = 0300000001000000140000008da7f965ec5efc37910f1c6e59fdc1cc6a6ede162000000001000000450300003082034130820229a0030201020213066c9fcf99bf8c0a39e2f0788a43e696365bca300d06092a864886f70d01010b05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412031301e170d3135303532363030303030305a170d3338303131373030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f74204341203130820122300d06092a864886f70d01010105000382010f003082010a0282010100b2788071ca78d5e371af478050747d6ed8d78876f49968f7582160f97484012fac022d86d3a0437a4eb2a4d036ba01be8ddb48c80717364cf4ee8823c73eeb37f5b519f84968b0ded7b976381d619ea4fe8236a5e54a56e445e1f9fdb416fa74da9c9b35392ffab02050066c7ad080b2a6f9afec47198f503807dca2873958f8bad5a9f948673096ee94785e6f89a351c0308666a14566ba54eba3c391f948dcffd1e8302d7d2d747035d78824f79ec4596ebb738717f2324628b843fab71daacab4f29f240e2d4bf7715c5e69ffea9502cb388aae50386fdbfb2d621bc5c71e54e177e067c80f9c8723d63f40207f2080c4804c3e3b24268e04ae6c9ac8aa0d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604148418cc8534ecbc0c94942e08599cc7b2104e0a08300d06092a864886f70d01010b0500038201010098f2375a4190a11ac57651282036230eaee628bbaaf894ae48a4307f1bfc248d4bb4c8a197f6b6f17a70c85393cc0828e39825cf23a4f9de21d37c8509ad4e9a753ac20b6a897876444718656c8d418e3b7f9acbf4b5a750d7052c37e8034bade961a0026ef5f2f0c5b2ed5bb7dcfa945c779e13a57f52ad95f2f8933bde8b5c5bca5a525b60af14f74befa3fb9f40956d3154fc42d3c7461f23add90f48709ad9757871d1724334756e5759c2025c266029cf2319168e8843a5d4e4cb08fb231143e843297262a1a95d5e08d490aeb8d8ce14c2d055f286f6c49343776661c0b9e841d7977860036e4a72aea5d17dba109e866c1b8ab95933f8ebc490bef1b9	MBAMInstallerService.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\1C58A3A8518E8759BF075B76B750D4F2DF264FCD\Blob = 0300000001000000140000001c58a3a8518e8759bf075b76b750d4f2df264fcd2000000001000000c2040000308204be308203a6a003020102021006d8d904d5584346f68a2fa754227ec4300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3231303431343030303030305a170d3331303431333233353935395a304f310b300906035504061302555331153013060355040a130c446967694365727420496e633129302706035504031320446967694365727420544c53205253412053484132353620323032302043413130820122300d06092a864886f70d01010105000382010f003082010a0282010100c14bb3654770bcdd4f58dbec9cedc366e51f311354ad4a66461f2c0aec6407e52edcdcb90a20eddfe3c4d09e9aa97a1d8288e51156db1e9f58c251e72c340d2ed292e156cbf1795fb3bb87ca25037b9a52416610604f571349f0e8376783dfe7d34b674c2251a6df0e9910ed57517426e27dc7ca622e131b7f238825536fc13458008b84fff8bea75849227b96ada2889b15bca07cdfe951a8d5b0ed37e236b4824b62b5499aecc767d6e33ef5e3d6125e44f1bf71427d58840380b18101faf9ca32bbb48e278727c52b74d4a8d697dec364f9cace53a256bc78178e490329aefb494fa415b9cef25c19576d6b79a72ba2272013b5d03d40d321300793ea99f50203010001a38201823082017e30120603551d130101ff040830060101ff020100301d0603551d0e04160414b76ba2eaa8aa848c79eab4da0f98b2c59576b9f4301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030106082b06010505070302307606082b06010505070101046a3068302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304006082b060105050730028634687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274476c6f62616c526f6f7443412e63727430420603551d1f043b30393037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274476c6f62616c526f6f7443412e63726c303d0603551d2004363034300b06096086480186fd6c02013007060567810c01013008060667810c0102013008060667810c0102023008060667810c010203300d06092a864886f70d01010b050003820101008032ce5e0bdd6e5a0d0aafe1d684cbc08efa8570edda5db30cf72b7540fe850afaf33178b7704b1a8958ba80bdf36b1de97ecf0bba589c59d490d3fd6cfdd0986db771825bcf6d0b5a09d07bdec443d82aa4de9e41265fbb8f99cbddaee1a86f9f87fe74b71f1b20abb14fc6f5675d5d9b3ce9ff69f7616cd6d9f3fd36c6ab038876d24b2e7586e3fcd8557d26c21177df3e02b67cf3ab7b7a86366fb8f7d89371cf86df7330fa7babed2a59c842843b11171a52f3c90e147da25b7267ba71ed574766c5b8024a65345e8bd02a3c209c51994ce7529ef76b112b0d927e1de88aeb36164387ea2a63bf753febdec403bb0a3cf730efebaf4cfc8b3610733ef3a4	MBAMInstallerService.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\2AD974A775F73CBDBBD8F5AC3A49255FA8FB1F8C\Blob = 0300000001000000140000002ad974a775f73cbdbbd8f5ac3a49255fa8fb1f8c2000000001000000620400003082045e30820346a0030201020213077312380b9d6688a33b1ed9bf9ccda68e0e0f300d06092a864886f70d01010b05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412031301e170d3232303832333232323132385a170d3330303832333232323132385a303c310b3009060355040613025553310f300d060355040a1306416d617a6f6e311c301a06035504031313416d617a6f6e205253412032303438204d303130820122300d06092a864886f70d01010105000382010f003082010a0282010100eb712ca9cb1f8828923230af8a570f78b73725955587ac675c97d322c8daa214676b7cf067dae2032ab356125dc6b547f96708a7937a9592180fb4f9f910369a7f2f80b64fba134ec75d531ee0dd96330720d396bc12e4745042a1051373b54f9b4424fe2d7fedbc2285ec362133977506ce271882dce3d9c582078d5e26012626671fd93f13cf32ba6bad7864fcaaff0e023c07df9c0578728cfdea75b7032884dae86e078cd05085ef8154b2716eec6d62ef8f94c35ee9c4a4d091c02e249198caeeba258ed4f671b6fb5b6b38064837478d86dcf2ea06fb76377d9eff424e4d588293cfe271c278b17aab4b5b94378881e4d9af24aef872c565fb4bb451e70203010001a382015a3082015630120603551d130101ff040830060101ff020100300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030106082b06010505070302301d0603551d0e0416041481b80e638a891218e5fa3b3b50959fe6e5901385301f0603551d230418301680148418cc8534ecbc0c94942e08599cc7b2104e0a08307b06082b06010505070101046f306d302f06082b060105050730018623687474703a2f2f6f6373702e726f6f746361312e616d617a6f6e74727573742e636f6d303a06082b06010505073002862e687474703a2f2f6372742e726f6f746361312e616d617a6f6e74727573742e636f6d2f726f6f746361312e636572303f0603551d1f043830363034a032a030862e687474703a2f2f63726c2e726f6f746361312e616d617a6f6e74727573742e636f6d2f726f6f746361312e63726c30130603551d20040c300a3008060667810c010201300d06092a864886f70d01010b05000382010100ad00de0205232e063262b46bb19416e41140de2bfa59c135efe0aa8f2b41b9d1f38739001df23db5a7470c0606c691f3075702d4edbd17c1909abf4875a2074f30dd4a6a42b50d3d15c00ffe845bc63c99cc5752b1d86e12d59692934b94e507e88982086a7a34d49e64e13d876a92909a63a14bf88fb6ea34d305be20c2de06e28c9f738b9f4d3985cace19369d85c99ec9f8503fb67e88a1efca84068b50b40a5ca61c44f1fdc8614060f26125aa07f4c7c27375e40c0b428d04e55f4448995b7b898196a7889d4b0d62e804c4d7feb4e8b26dcaecc01cbc385b1ddf85ce5b7ae3494b6cb9a7ddf405b249ade1c5146bc2ccebcd7fd65869bac3207e7fb0b8	MBAMInstallerService.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E\Blob = 030000000100000014000000b51c067cee2b0c3df855ab2d92f4fe39d4e70f0e2000000001000000e1030000308203dd308202c5a003020102020100300d06092a864886f70d01010b050030818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a30818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bdedc103fcf68ffc02b16f5b9f48d99d79e2a2b703615618c347b6d7ca3d352e8943f7a1699bde8a1afd13209cb44977322956fdb9ec8cdd22fa72dc276197eef65a84ec6e19b9892cdc845bd574fb6b5fc589a51052894655f4b8751ce67fe454ae4bf85572570219f8177159eb1e280774c59d48be6cb4f4a4b0f364377992c0ec465e7fe16d534c62afcd1f0b63bb3a9dfbfc7900986174cf26824063f3b2726a190d99cad40e75cc37fb8b89c159f1627f5fb35f6530f8a7b74d765a1e765e34c0e89656998ab3f07fa4cdbddc32317c91cfe05f11f86baa495cd19994d1a2e3635b0976b55662e14b741d96d426d4080459d0980e0ee6defcc3ec1f90f10203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147c0c321fa7d9307fc47d68a362a8a1ceab075b27300d06092a864886f70d01010b050003820101001159fa254f036f94993b9a1f828539d47605945ee128936d625d09c2a0a8d4b07538f1346a9de49f8a862651e62cd1c62d6e95204a9201ecb88a677b31e2672e8c9503262e439d4a31f60eb50cbbb7e2377f22ba00a30e7b52fb6bbb3bc4d379514ecd90f4670719c83c467a0d017dc558e76de68530179a24c410e004f7e0f27fd4aa0aff421d37ed94e5645912207738d3323e3881759673fa688fb1cbce1fc5ecfa9c7ecf7eb1f1072db6fcbfcaa4bfd097054abcea18280290bd5478092171d3d17d1dd916b0a9613dd00a0022fcc77bcb0964450b3b4081f77d7c32f598ca588e7d2aee90597364f936745e25a1f566052e7f3915a92afb508b8e8569f4	MBAMInstallerService.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MBSetup-1.1.exe

Checks SCSI registry key(s) 3 TTPs 26 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	DrvInst.exe

Modifies Internet Explorer settings 1 TTPs 5 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\mbam.exe = "11000"	MBAMService.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\mbamtray.exe = "11000"	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	MBAMInstallerService.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Malwarebytes.exe = "11000"	MBAMInstallerService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	MBAMService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:	MBAMInstallerService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	MBAMInstallerService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\16.0	MBAMInstallerService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	MBAMService.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols	MBAMInstallerService.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications	MBAMInstallerService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	MBAMInstallerService.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft	MBAMInstallerService.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\15.0	MBAMInstallerService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Malwarebytes	MBAMInstallerService.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies	MBAMInstallerService.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:\	MBAMInstallerService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:\	MBAMInstallerService.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office	MBAMInstallerService.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\15.0\Common\Security	MBAMInstallerService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications	MBAMInstallerService.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft	MBAMInstallerService.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:	MBAMInstallerService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Malwarebytes\FirstRun = "false"	MBAMInstallerService.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\15.0	MBAMInstallerService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:	MBAMInstallerService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\16.0\Common	MBAMInstallerService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols	MBAMInstallerService.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:	MBAMInstallerService.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols	MBAMInstallerService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:	MBAMInstallerService.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\15.0\Common	MBAMInstallerService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications	MBAMInstallerService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	MBAMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MBAMInstallerService.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\15.0\Common\Security	MBAMInstallerService.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\16.0	MBAMInstallerService.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:	MBAMInstallerService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	MBAMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	MBAMInstallerService.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Malwarebytes\FirstRun = "false"	MBAMInstallerService.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\16.0\Common	MBAMInstallerService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0	MBAMInstallerService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0\Common\Security	MBAMInstallerService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MBAMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	MBAMInstallerService.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Policies	MBAMInstallerService.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DE351550-6C4E-4662-AD87-FEB0707F6C62}	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{36F3C7D7-BCB1-4359-AB71-0CB816FE3D38}\ = "ISPControllerV6"	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F3FEC974-11DF-4785-B55F-381C482A81F4}\ = "IVPNControllerV5"	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EC676D1E-2E9E-4876-834C-7AF2BCA2E885}\ = "IMBAMExplorerCommand"	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAD7766B-F8F3-4944-AFE6-5D667E535709}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E3D4AC2-A9AE-478A-91EE-79C35D3CA8C7}\ProxyStubClsid32	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9185897A-76F4-4083-A02C-5FFC2A51F6D4}\TypeLib\ = "{A82129F1-32E1-4D79-A39F-EBFEE53A70BF}"	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CFFF19F6-ECFE-446D-ACAD-8DC525DA2563}\ProxyStubClsid32	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6724C143-DE69-4A93-80ED-19B75DD2AA99}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1C5B86F3-CEB8-44E3-9B83-6F6AF035E872}\ProxyStubClsid32	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31A02CB9-6064-4A3B-BCB4-A329528D4648}\ = "IMBAMServiceController"	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{106E3995-72F9-458A-A317-9AFF9E45A1F0}\TypeLib	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{56898B37-6187-4F81-B9C6-8DA97D31F396}\TypeLib	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{226C1698-A075-4315-BB5D-9C164A96ACE7}\1.0\HELPDIR	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C5201562-332D-4385-87E7-2BB41B1694AA}\ = "_ILicenseControllerEvents"	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BE6DEC4E-1BDE-49DA-AFDD-D979539A9A0D}\TypeLib	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2E3F70EF-D9BE-485F-A6F5-816DD0EDC757}\TypeLib\ = "{FFB94DF8-FC15-411C-B443-E937085E2AC1}"	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F641DDA1-271F-47C7-90C2-4327665959DF}\TypeLib\ = "{5709DEEB-F05E-4D5C-8DC4-3B0D924EE08F}"	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{172ABF99-1426-47CA-895B-092E23728E8A}\TypeLib\Version = "1.0"	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C292FC1E-6930-404E-B7C6-2CBDA9CCF54B}\TypeLib	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2446F405-83F0-460F-B837-F04540BB330C}\1.0\0\win64	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAB53395-8218-47FF-91B7-144994C0AD83}\TypeLib	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0070F531-5D6B-4302-ACA0-6920E95D9A31}	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BB344FF5-ACAE-4B90-AD24-DEFD41159C56}\ProxyStubClsid32	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{17BE78EE-B40A-4B9E-835F-38EC62F9D479}\TypeLib\ = "{5709DEEB-F05E-4D5C-8DC4-3B0D924EE08F}"	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1097B101-1FF8-4DD8-A6C1-6C39FB2EA5D6}\TypeLib\Version = "1.0"	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{94E6A9DF-4AAB-48E7-8A94-65CA2481D1F6}\TypeLib\Version = "1.0"	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F5BCAC7E-75E7-4971-B3F3-B197A510F495}\1.0\FLAGS	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DE6A4256-97CD-4DBB-9D4A-3054B0BB0F8B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E90361FE-F6B5-43E8-99F7-1BD40500981F}	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A9AE95CF-6463-415A-94AC-F895D0962D30}\TypeLib	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{118F4330-CAF5-4A54-ABB0-DC936669ED2F}\TypeLib	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{ECDAC35E-72BB-4856-97E1-226BA47C62C5}\TypeLib\ = "{5709DEEB-F05E-4D5C-8DC4-3B0D924EE08F}"	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EC4BC952-9520-462B-BD5C-4E2C9200B3C9}\TypeLib\Version = "1.0"	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6EC225D5-FD37-4F9B-B80F-09FAE36103AE}\ProxyStubClsid32	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5A7F7475-8272-40DE-A4FA-A98C38BDB458}\ProxyStubClsid32	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{50538523-AA2F-40D3-9B58-DB51D5BD3D4A}	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{36BABBB6-6184-44EC-8109-76CBF522C9EF}\ = "_IScanControllerEventsV13"	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0C30B7D9-82A1-4068-8A5B-F4C7D5EF75A3}\TypeLib\ = "{5709DEEB-F05E-4D5C-8DC4-3B0D924EE08F}"	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5B9F1C8B-1E3B-4FBA-9C8A-7B0E6DCD9C9E}\ = "_ITelemetryControllerEventsV3"	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{09FAE0FE-2897-496A-9FD2-39C86556F1D2}\ = "ILicenseControllerV13"	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A993F934-6341-4D52-AB17-F93184A624E4}	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{995A8F3B-6B5F-4773-898A-862D50142B4C}\TypeLib\Version = "1.0"	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7995CBA9-83E0-4F28-A50B-DFDE85EBCCD1}\TypeLib	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F5BCAC7E-75E7-4971-B3F3-B197A510F495}	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EABA01A8-8468-430A-9D6E-4C9F1CE22C88}	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB54E87D-D7DB-400E-AFF1-0182D7378E0F}\TypeLib	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{63A6AB57-4679-4529-B78D-143547B22799}\ = "_ICleanControllerEventsV2"	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{44AC1571-055F-4CC8-B7D8-EA022C4CC112}\ = "ICleanControllerEventsV6"	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{09FAE0FE-2897-496A-9FD2-39C86556F1D2}\TypeLib\ = "{332AFEBA-9341-4CEC-8EA6-DB155A99DF63}"	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DE351550-6C4E-4662-AD87-FEB0707F6C62}\ProxyStubClsid32	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{71B13605-3569-4F4A-B971-08FF179A3A60}\TypeLib\ = "{5709DEEB-F05E-4D5C-8DC4-3B0D924EE08F}"	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3C0ECFDC-317D-406B-ADF5-C0E8217E244F}\TypeLib	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DC97FF29-5CE2-4897-8175-94672057E02D}\TypeLib\Version = "1.0"	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2FB37514-21FA-4B2C-94DA-1562126E9F5F}\ProxyStubClsid32	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{10024D75-0830-473C-8C23-0649487FCCF1}\ = "IRTPControllerV21"	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1A173904-D20F-4872-93D5-CBC1336AE0D6}\TypeLib	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D4215DAB-7574-44DE-8BE9-78CC62597C95}\ProxyStubClsid32	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{78E69E6F-EC12-4B84-8431-1D68572C7A61}\TypeLib	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F12E228B-821D-4093-B2E0-7F3E169A925A}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{993A5C11-A9B8-41E9-9088-C5182B1F279A}\TypeLib\ = "{226C1698-A075-4315-BB5D-9C164A96ACE7}"	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FFB9BE53-8FE4-4B61-9C25-18E5B4B202E8}\TypeLib	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0070F531-5D6B-4302-ACA0-6920E95D9A31}\ = "_IPoliciesControllerEventsV3"	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D372F21-E6DA-4B82-881A-79F6CA6B6AE1}\Version	MBAMService.exe

Modifies system certificate store 2 TTPs 11 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	MBAMInstallerService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0D44DD8C3C8C1A1A58756481E90F2E2AFFB3D26E	MBAMInstallerService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F6108407D6F8BB67980CC2E244C2EBAE1CEF63BE	MBAMInstallerService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\2AD974A775F73CBDBBD8F5AC3A49255FA8FB1F8C	MBAMInstallerService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E	MBAMInstallerService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8DA7F965EC5EFC37910F1C6E59FDC1CC6A6EDE16	MBAMInstallerService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\5A8CEF45D7A69859767A8C8B4496B578CF474B1A	MBAMInstallerService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\1C58A3A8518E8759BF075B76B750D4F2DF264FCD	MBAMInstallerService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474	MBAMInstallerService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A	MBAMInstallerService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2	MBAMInstallerService.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
3896	MBSetup-1.1.exe
3896	MBSetup-1.1.exe
4828	MBAMInstallerService.exe
4828	MBAMInstallerService.exe
4828	MBAMInstallerService.exe
4828	MBAMInstallerService.exe
4828	MBAMInstallerService.exe
4828	MBAMInstallerService.exe
4828	MBAMInstallerService.exe
4828	MBAMInstallerService.exe
4828	MBAMInstallerService.exe
4828	MBAMInstallerService.exe
4828	MBAMInstallerService.exe
4828	MBAMInstallerService.exe
4828	MBAMInstallerService.exe
4828	MBAMInstallerService.exe
4828	MBAMInstallerService.exe
4828	MBAMInstallerService.exe
4828	MBAMInstallerService.exe
4828	MBAMInstallerService.exe
4828	MBAMInstallerService.exe
4828	MBAMInstallerService.exe
4828	MBAMInstallerService.exe
4828	MBAMInstallerService.exe
4828	MBAMInstallerService.exe
4828	MBAMInstallerService.exe
4828	MBAMInstallerService.exe
4828	MBAMInstallerService.exe
4828	MBAMInstallerService.exe
4828	MBAMInstallerService.exe
4828	MBAMInstallerService.exe
4828	MBAMInstallerService.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4828	MBAMInstallerService.exe
Token: SeDebugPrivilege	4828	MBAMInstallerService.exe
Token: SeDebugPrivilege	4828	MBAMInstallerService.exe
Token: SeDebugPrivilege	4828	MBAMInstallerService.exe
Token: SeDebugPrivilege	4828	MBAMInstallerService.exe
Token: SeDebugPrivilege	4828	MBAMInstallerService.exe
Token: SeDebugPrivilege	4828	MBAMInstallerService.exe
Token: SeDebugPrivilege	4828	MBAMInstallerService.exe
Token: SeDebugPrivilege	4828	MBAMInstallerService.exe
Token: SeDebugPrivilege	4828	MBAMInstallerService.exe
Token: SeDebugPrivilege	4828	MBAMInstallerService.exe
Token: SeDebugPrivilege	4828	MBAMInstallerService.exe
Token: SeDebugPrivilege	4828	MBAMInstallerService.exe
Token: SeDebugPrivilege	4828	MBAMInstallerService.exe
Token: SeDebugPrivilege	4828	MBAMInstallerService.exe
Token: SeDebugPrivilege	4828	MBAMInstallerService.exe
Token: SeDebugPrivilege	4828	MBAMInstallerService.exe
Token: SeDebugPrivilege	4828	MBAMInstallerService.exe
Token: SeDebugPrivilege	4828	MBAMInstallerService.exe
Token: SeDebugPrivilege	4828	MBAMInstallerService.exe
Token: SeDebugPrivilege	4828	MBAMInstallerService.exe
Token: SeDebugPrivilege	4828	MBAMInstallerService.exe
Token: SeDebugPrivilege	4828	MBAMInstallerService.exe
Token: SeDebugPrivilege	4828	MBAMInstallerService.exe
Token: SeDebugPrivilege	4828	MBAMInstallerService.exe
Token: SeDebugPrivilege	4828	MBAMInstallerService.exe
Token: SeDebugPrivilege	4828	MBAMInstallerService.exe
Token: SeDebugPrivilege	4828	MBAMInstallerService.exe
Token: SeDebugPrivilege	4828	MBAMInstallerService.exe
Token: SeDebugPrivilege	4828	MBAMInstallerService.exe
Token: SeDebugPrivilege	4828	MBAMInstallerService.exe
Token: SeDebugPrivilege	4828	MBAMInstallerService.exe
Token: SeDebugPrivilege	4828	MBAMInstallerService.exe
Token: SeDebugPrivilege	4828	MBAMInstallerService.exe
Token: SeDebugPrivilege	4828	MBAMInstallerService.exe
Token: SeDebugPrivilege	4828	MBAMInstallerService.exe
Token: SeDebugPrivilege	4828	MBAMInstallerService.exe
Token: SeDebugPrivilege	4828	MBAMInstallerService.exe
Token: SeDebugPrivilege	4828	MBAMInstallerService.exe
Token: SeDebugPrivilege	4828	MBAMInstallerService.exe
Token: SeDebugPrivilege	4828	MBAMInstallerService.exe
Token: SeDebugPrivilege	4828	MBAMInstallerService.exe
Token: SeDebugPrivilege	4828	MBAMInstallerService.exe
Token: SeDebugPrivilege	4828	MBAMInstallerService.exe
Token: SeDebugPrivilege	4828	MBAMInstallerService.exe
Token: SeDebugPrivilege	4828	MBAMInstallerService.exe
Token: SeDebugPrivilege	4828	MBAMInstallerService.exe
Token: SeDebugPrivilege	4828	MBAMInstallerService.exe
Token: SeDebugPrivilege	4828	MBAMInstallerService.exe
Token: SeDebugPrivilege	4828	MBAMInstallerService.exe
Token: SeDebugPrivilege	4828	MBAMInstallerService.exe
Token: SeDebugPrivilege	4828	MBAMInstallerService.exe
Token: SeDebugPrivilege	4828	MBAMInstallerService.exe
Token: SeDebugPrivilege	4828	MBAMInstallerService.exe
Token: SeDebugPrivilege	4828	MBAMInstallerService.exe
Token: SeDebugPrivilege	4828	MBAMInstallerService.exe
Token: SeDebugPrivilege	4828	MBAMInstallerService.exe
Token: SeDebugPrivilege	4828	MBAMInstallerService.exe
Token: SeDebugPrivilege	4828	MBAMInstallerService.exe
Token: SeDebugPrivilege	4828	MBAMInstallerService.exe
Token: SeDebugPrivilege	4828	MBAMInstallerService.exe
Token: SeDebugPrivilege	4828	MBAMInstallerService.exe
Token: SeDebugPrivilege	4828	MBAMInstallerService.exe
Token: SeDebugPrivilege	4828	MBAMInstallerService.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3896	MBSetup-1.1.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4828 wrote to memory of 4864	4828	MBAMInstallerService.exe	104
PID 5132 wrote to memory of 5300	5132	svchost.exe	109
PID 4828 wrote to memory of 5716	4828	MBAMInstallerService.exe	112

C:\Users\Admin\AppData\Local\Temp\MBSetup-1.1.exe
"C:\Users\Admin\AppData\Local\Temp\MBSetup-1.1.exe"
1⤵
- Drops file in Drivers directory
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:3896

C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
"C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"
1⤵
- Drops file in Drivers directory
- Impair Defenses: Safe Mode Boot
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Modifies trusted root certificate store through registry
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4828
- C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
  "C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe" /installmbtun
  2⤵
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4864
- C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
  "C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe" /Service /Protected
  2⤵
  - Drops file in Drivers directory
  - Drops file in System32 directory
  - Executes dropped EXE
  - Modifies registry class
  PID:5716

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:5132
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "9" "C:\Program Files\Malwarebytes\Anti-Malware\mbtun\mbtun.inf" "9" "4ba9030c7" "0000000000000144" "Service-0x0-3e7$\Default" "000000000000015C" "208" "C:\Program Files\Malwarebytes\Anti-Malware\mbtun"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:5300

C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
"C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Event Triggered Execution: Netsh Helper DLL
PID:5476

C:\Windows\system32\DRIVERS\MbamElam.sys
C:\Windows\system32\DRIVERS\MbamElam.sys
1⤵
- Executes dropped EXE
PID:5996

C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
"C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"
1⤵
- Executes dropped EXE
PID:6056

C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
"C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"
1⤵
- Checks BIOS information in registry
- Enumerates connected drives
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
PID:6104
- C:\ProgramData\Malwarebytes\MBAMService\rmode\mbrescue.exe
  "C:\ProgramData\Malwarebytes\MBAMService\rmode\mbrescue.exe" /rescuemode "C:\Program Files\Malwarebytes\Anti-Malware" "C:\ProgramData\Malwarebytes\MBAMService"
  2⤵
  PID:5280

C:\Windows\system32\DRIVERS\mbamswissarmy.sys
C:\Windows\system32\DRIVERS\mbamswissarmy.sys
1⤵
PID:6928

C:\Windows\system32\DRIVERS\MbamChameleon.sys
C:\Windows\system32\DRIVERS\MbamChameleon.sys
1⤵
PID:1100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Safe Mode Boot

T1562.009

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mbtun.cat

Path C:\PROGRA~1\MALWAR~1\ANTI-M~1\mbtun\mbtun.cat
Size 10KB
SHA256 9ceb410494b95397ec1f8fa505d071672bf61f81cc596b8eccd167a77893c658
MD5 8abff1fbf08d70c1681a9b20384dbbf9
SHA1 c9762e121e4f8a7ad931eee58ee60c8e9fc3ecb6
SHA512 37998e0aee93ff47fe5b1636fce755966debe417a790e1aebd7674c86c1583feef04648a7bc79e4dedaabb731051f4f803932ac49ea0be05776c0f4d218b076f
SSDEEP 192:gM6dynJCSEJOL7yKnUi8rFWQFIGjl8zjEswYt1FfRM/GX01k9z3AeOlFa:gqS4CFRWGjl8M8/fi/GR9z/OlFa
TLSH
T1B43208E1897D84C2ED87A87147E8E5977C3C1BCB2C5055A911ABF7600AA33C6E71853D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mbtun.sys

Path C:\PROGRA~1\MALWAR~1\ANTI-M~1\mbtun\mbtun.sys
Size 107KB
SHA256 6903e60784b9fa5d8b417f93f19665c59946a4de099bd1011ab36271b267261c
MD5 83d4fba999eb8b34047c38fabef60243
SHA1 25731b57e9968282610f337bc6d769aa26af4938
SHA512 47faab5fff3e3e2d2aea0a425444aa2e215f1d5bf97edee2a3bb773468e1092919036bcd5002357594b62519bf3a8980749d8d0f6402de0e73c2125d26e78f1e
SSDEEP 1536:k0h5S895dQOYJaryTmbMc6uqkZUcmSl47AjpdAyDCYJqUufIfmNn3VzwZ6Dh7Q9y:C895uOYJar1MLcmSlrSgC6Duls2t
TLSH
T174B36C9DA1783089DE42A6B482B98793EFB4357A2B1177BF01E1C1748F537C0DB29DA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MBAMCore.dll

Path C:\Program Files\Malwarebytes\Anti-Malware\MBAMCore.dll
Size 8.7MB
SHA256 5b35d150a5d2c693511760b49f906b4e8df6efecccf982a1ed7c92ab12d0181d
MD5 991565c0e20a215749b11fb363cf1b8f
SHA1 cfa4f84063bb45a15bc35a68be030f980e2e10ce
SHA512 a49035a6f9016d02581cba7d4f1183749603675412a60eaa7ff100c1b31313f264a9b261509359f66288308631ce2843feb49d7406b2926a87cef7a7fb8b92dd
SSDEEP 196608:o8/hF3iDgwZqmtTKr1QaFCMoJeidiCvQC:o8/hpiDgwZqmtTKr1hDEeidiCvQC
TLSH
T127966B2BA7A400AFD87AD37889EB4502F673B811537397CB16A8A1361F637D49E3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MBAMInstallerService.exe

Path C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
Size 9.3MB
SHA256 5befd103ca4bf84732cc2fbf5b3a8638ce62df5730a8ffe5e72165a930cb65cc
MD5 fb92ee025519ad6015c3a64e8cbba01e
SHA1 84fbb0b3a41ca18d520dbd758a40fe77e7788747
SHA512 088b9716732eb7b70fadad061ba65d3541448a8c0acddbcf29a37f171a789b1b1f3313b2382477b994ca6c80656a83a3efb49d81cc7cf1e5075e0456f0c9ca1a
SSDEEP 196608:AJO/84dGZ2eFhuvgXTAc3ek9076DPZ+C9XD:Uv4dGZ2eruvgjAvk2Cz
TLSH
T1ADA69E17A2E801E8D4F7D1388A578A13E7B2B84543B197DF07A0557A1F63BE19E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MBAMWsc.exe

Path C:\Program Files\Malwarebytes\Anti-Malware\MBAMWsc.exe
Size 4.2MB
SHA256 7878a9b10903b8c0def49015deefd48a3ea0e46c0f5ac9ae755336994e020152
MD5 acbb82943fe0d5f1c5df74b1a7dccd2f
SHA1 c41e38f59eff5e40a6a47b14be44520dcd6d405a
SHA512 7092748502f06bf05df19bd2d4d5857f161a35a9b2e3a72645eaacffacae7a8dad10ab41ad3b80d3a63ff0773b6c818edf3769ce6b1f61b01cc92edfb755dfc5
SSDEEP 49152:dK5b4+V1qsR86LMFRbbX8DREqUaP7bBfnuF0JRlnPkokPmsBLdS4BPQRzU/81fge:i86kyaHF0JRlMhBpMyok3M
TLSH
T1C6166B06B6A540ECD866C239A47A8503E7F2B811273097CF066853761FF7AD21EBE7D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MBVpnTunnelService.exe

Path C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
Size 4.1MB
SHA256 a67f94a3014d93b9b91f0c8427c81cc18cb13239a114d91c51f993702e60a580
MD5 88138b3ddd9b2800ea155743aa26fe87
SHA1 0b45bd01e388bf4821a3caa09e78033588f66667
SHA512 4f2f2f04c1b3c1d55731d7dc55fa3ee09385b8f77084e79ebde5252242008eb3362beb9b50b3ea8934acc471dcef67763f20d5268f6cb18bfb98926e4189c3b3
SSDEEP 49152:0JxO5tmuSoHE4RtMMoLPqf/nkMq1BmwlxMOqSv6bi36i6X43jtPQ6zU+5pAqIPIS:8Y5tY4RMk6lxMObN6/tbH
TLSH
T188168D57A7A901E8D8A6C23CC4678603E7B2BC151770A7CF0664627A1FB3AD25F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ServiceConfig.json

Path C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.json
Size 621B
SHA256 d0d9331f24a3c5e202096c21b91f769ff6cc15c78b5ef011e74de0a610855263
MD5 a0558b135d1d45246184a58f56f489af
SHA1 12945afb5a9eb463a878f0d4fbe1eca231dddafa
SHA512 7f5cb704871e0f3d971f13da246d3943fe069c2fa59ec7713de5243665883d027127731d28c5ba7726a8a894f25ed206b25c9c84df12096f59f1261a2d961e72
TLSH
T173F0A252995F41F75574078845A405C7F624939D02005D0FB7F4F690DEF2C389EC2C84
MD5 SHA1 SHA512 TLSH

Submit Download

ServiceConfig.json

Path C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.json
Size 784B
SHA256 7e85e0911c21eefee9a4e83ab30edc1b087dc8bf78847738f30d4c7fafa23023
MD5 7cde3bb88949b94a36e7c90b1fae502c
SHA1 ea1785493add16fdfc8b1955e2c9f0b4d9508df3
SHA512 d9f6989fe554dad7df75c27e844c7287a2437f5fad6118839a960a53d4900edda212259ea13dbb68653031c9e656e9f4297f99642b2e2eb5bfa8a1dcaf261599
TLSH
T19F012C068A2F82BBA5B4035A846404C6F378E30D1101080FB7F8EA92DDBBC2522C2C48
MD5 SHA1 SHA512 TLSH

Submit Download

malwarebytes_assistant.runtimeconfig.json

Path C:\Program Files\Malwarebytes\Anti-Malware\malwarebytes_assistant.runtimeconfig.json
Size 615B
SHA256 61fca252e8e336706f4c153c16100b7b621f9092ed09bb6959e406ab5bb21e85
MD5 389f208d959c5ff4ee9c0e4dbbc31ecc
SHA1 32243920d3687a1b8af307a3ae140103ec08f222
SHA512 86dce7141f4fe9fd938f8b5be78d9e9d9885365d7ea7d4d3cb0674ea63a9201f4f0e02ceef47819b9d596a2e397fa68c78e9dfd15acf804ff93fca0f55b1997b
TLSH
T1C5F08B29CA106CB718B8337ED125C083EA30133B10002C56B4FC080C7F775B62221F96
MD5 SHA1 SHA512 TLSH

Submit Download

mbtun.dll

Path C:\Program Files\Malwarebytes\Anti-Malware\mbtun.dll
Size 2.8MB
SHA256 f21a980316bd4c57c70e00840ab76d9ad412092d7d2d6a2cff4f1311f7c05364
MD5 2bbf63f1dab335f5caf431dbd4f38494
SHA1 90f1d818ac8a4881bf770c1ff474f35cdaa4fcd0
SHA512 ebb9834323329dc01ba2c87e5fad1083a4cb86f5ed761cb63299ac5336a9843a1aadd42fbed706797c2295117af1c00f96806422338352653c8e0255fecc2fd5
SSDEEP 49152:xNrdEZjzdAj9fdc4fDrN1OxOh5PgqdnBq30yPFZP7KVxSL:bBzFRkshaZP2W
TLSH
T136D58C1AA7A800A8EEB6C27CC6578603D7F2B8151771ABDF02A456791F73BE1173E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mbtun.inf

Path C:\Program Files\Malwarebytes\Anti-Malware\mbtun\mbtun.inf
Size 1KB
SHA256 4a350fc20834a579c5a58352b7a3aa02a454abbbd9eecd3cd6d2a14864a49cd8
MD5 5d1917024b228efbeab3c696e663873e
SHA1 cec5e88c2481d323ec366c18024d61a117f01b21
SHA512 14b345f03284b8c1d97219e3dd1a3910c1e453f93f51753f417e643f50922e55c0e23aab1d437300e6c196c7017d7b7538de4850df74b3599e90f3941b40ab4a
TLSH
T1CB4140BD48D20AB83C673356671B69C27BDC220145C920ADB2DE8606C88EDDCB905EB9
MD5 SHA1 SHA512 TLSH

Submit Download

pkgvers.dat

Path C:\Program Files\Malwarebytes\Anti-Malware\pkgvers.dat
Size 78B
SHA256 3191c198f1d1b9dc97e6c9a97b5f22f03379d84085b10f8a1f92b0f7e9f4edb0
MD5 ef22765c45940ed3ebbd11c9aecfb3a3
SHA1 2a84357d44bd29345b98ac4ea764ccc7380e0118
SHA512 e2d4207382607e837d73e1796d8dec1ec165b89aea5cfdf7772e803df971653a38ce609f0d06a98e1a8a32142c9f458043c89e37b68df3d33600ab492e8ebc39
TLSH
T1E2A01230400C52007C9561F07073445420179C1834100B0162948121062201026D4246
MD5 SHA1 SHA512 TLSH

Submit Download

MBAMSwissArmy.cat

Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.cat
Size 11KB
SHA256 33dbca74f9364b66974d987b20505fd9298707f42fa8d2f636d8362e470b410e
MD5 92ece2e13283144da6dd4e0a1b6ab04a
SHA1 cd0acbb0fee1fa9f41b82b7dacd6405e07beadf5
SHA512 0f1e79c6be4d29566f5e8263fe78c61e3ee1b04b16bcc1c0aa165b715c08b91ba7a82690d8c92fafa6a9cb4918e27ec459630480c2a00fcedd72f4b5ccf32076
SSDEEP 192:UsCI5WyAJCWW7/lyKFFWQFRZUHWX01k9z3AV0bk:L0RiZFRjZjR9zOj
TLSH
T14A3229E2852C55C1EDA3ACA043A8E5573C3D27CB1D1048B962DBF7680DA33C9E73856E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MBAMSwissArmy.inf

Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.inf
Size 2KB
SHA256 ff93773f55bf4a6a0242adf82276a8c95c0b244b9bc05e515c4e810c81a960e8
MD5 d87c2f68057611e687bdb8cc6ebea5b8
SHA1 27b1311d3b199e4c22772fa1b7ea556805775d37
SHA512 4aa65b8911d8a2a0f9ef0ee6e934b94db0a9ad4c2ec543b5edcf21486be43f6ab1fda6617ea2cbb85eff230628c9fa8e7649da915d6de695803b28e55bef5819
TLSH
T16541DED8A1D386BA6687B2D07E0741C3F6403A0049F7342872DE50D6C3E7A0F83B4BA9
MD5 SHA1 SHA512 TLSH

Submit Download

MBAMSwissArmy.sys

Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.sys
Size 240KB
SHA256 6d2c9a01f953d206abbbd8c2ba5a00b78ad8f6bcddba6db810f2d6f562ddbd8a
MD5 953f871a91ac057d2d748646065fc2dd
SHA1 ef6eb7900e194555bc9dc4b4eca377f5aee9f7e2
SHA512 dc4caf64effe29e719d85823ac9ded93bd723ccefa4662420303c700968db608c9c0cdb4412373ffba49c9672359f4594dab50863cc6c10e8bb4d3b5fd00573c
SSDEEP 3072:rM98OZY4B+FY1GeX7dxNRV634KOMuFZWaOJRN4KoXkM0dsFTgUzFkzSzpJW4d1sa:rkLelYsCdbRDF7WaeRN4dT0U6r4dxt
TLSH
T1FB346D06E2E47A66F9B7827D89A69102E77271452B31CECF5370C1292F1B7E0F93534A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

srvversion.dat

Path C:\Program Files\Malwarebytes\Anti-Malware\srvversion.dat
Size 9B
SHA256 9ab03fafd27c815e4885b50ed92dc2d541173d04611c8271f1dca8dcbe4b9972
MD5 742be0c873e2e1cf9ecad6b7e67bc181
SHA1 5216f52ef384c7a033ae6a20a879999c747e7159
SHA512 2daad017005350a4622531e34c27b21d5877bb89c3bc3478a04fd71552c0df97bc353a20bd589fcd1f9fbed502136ce03261f43a259c4b3f50c96947dcb4daaa
MD5 SHA1 SHA512

Submit Download

7z.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\7z.dll
Size 1.6MB
SHA256 37fa780bc230081691a105a3c1aed525ceec10ac1e64c1d1867137ce75e1b668
MD5 05331236220c141ecbb04475e584f54d
SHA1 782a2059612b599480468575f3af07079592f8aa
SHA512 981d9d48c71e9b10bdae7a19e6afb489080fc14616728d8b89e87191322694029f19b9c1927336a6da5fe396e057c04cbef5d38d3e5a7e7a4e57ccb617423445
SSDEEP 24576:1MLDS/eBHA6c6CWUN4mAq2pBDht5VHif44E2zq9xRjMUskEQHpvb96y0tzuh5z8Q:KLDVRCzfCtTHpNXEQHpR6yoihSGQ0
TLSH
T10D756C5BF67400A4D1D6C134C517AB1BE6B1B84B8720E7EF02E59A6B6F13BF19939320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\7z.dll
Size 1.6MB
SHA256 623e628393bc4b8131c1f4302b195429dfa67e890d3325ceaa56940660052b1b
MD5 4da585f081e096a43a574f4f4167947e
SHA1 38c81c6deae0e6d35c64c060b26271413a176a49
SHA512 0fe168bf1661691dbaa103e478dd7e46b476db094bf1938bf1ad12ddb8a8f371bf611ff504d2eb3ac319862444cc64a27ebee8735aa3752aa32a399b09427243
SSDEEP 24576:a9raURTF/5pe2g5RpBDxSjv9IrqLwRpFEDbt7y0MVoAAlzi8pY:a9hP/5petvSjWZR8DxO0mo5M8pY
TLSH
T16F756D5BF67400A4D5D6C034C5276B1BEAB1B88B8330A7EF12D15A6B6F13BF19979320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AEControllerImpl.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\AEControllerImpl.dll
Size 4.9MB
SHA256 878239e138180492b8e703203db1eeda5da1a88b7897c16e7323bb506ef28dfe
MD5 e4f9ffbfd7c3c8b641ebbbdcfe6399e8
SHA1 8ee46b184bb37a8f24001eebe120796fa46935f2
SHA512 8f68576a20a8a3b6e7125733862583bcb4fe137392392acb4e3b826450cb4b656815a3be7b44174bd3fef3a0f4722079eded587d8c0f2ac3680d67384cdbb317
SSDEEP 49152:y3QcNVHvFJa0GV9Tkq9HWsMyhXTnXRUHNNWjwJZ1yWBEsUXH7PWnE8q12VPvUbA:q0XTnMmPsUXbPWNPvcYLX
TLSH
T152368D16A7F401A8C8B6C23CCA578503D7B2BC154730DBDF16A4966A1FB3BE1563EB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ActionsShim.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\ActionsShim.dll
Size 3.7MB
SHA256 6c5047cb77ea843e8386ba2b26a8458e6255e2ab94d493e914620623723c6b32
MD5 33617cde11d2bfcef47faf0d5ce3cef9
SHA1 2439b5f0622cd539b6f6f2f87d78edba466299ed
SHA512 ef909e5e6a695a0f2ae95621cf87795705b3d267ea7d1c82634faeff3a4e3b111f5f809cd9e7dbb71d588d6106e0b54c138364f99ba41c7c5d47cde9af1b753e
SSDEEP 49152:SH0QptrM88LLHy9nqSk5n9BT1vAPZmbLMo7JTfYkwZdPHFszUlE3JqCx9R345GEm:ktro8k3booBovlE3JqCx9R345GEzul
TLSH
T16E068B17EB9540A8CC6AD23C855B8607D7B2BC25237097CF17B462AA1FB3BE1523E714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArwControllerImpl.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\ArwControllerImpl.dll
Size 5.6MB
SHA256 a1904889632fce5fece6dbecda5e237423d571652350f24c8724bdeb3a30228a
MD5 40f500da8c204e5e9a89fdd8dfae4ff6
SHA1 3a407e01769f582116a34c3b874dd5b534734072
SHA512 5a1888e523b39f1590c05236f502c2f5c0ab4a9384737294fdfa0c8b0870d851e2cb927b71112a8828c67c9017209e8b4fa66fca262d5f8d9a11ec481c946d46
SSDEEP 49152:rjEQxZvdSVum8H2EMBNi3IcKpFd5wKqW1c7h/med5BNhlA+KjTscJ0Kzp+i7JtmC:rYQxjspzwJxE+6Tv+iVg64Iky
TLSH
T160468E1AB7D500A8D4B6C238CA578513E7B2BC554331DBDF06A4A6AA1F73BE0473EB14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArwLib.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\ArwLib.dll
Size 7.2MB
SHA256 16f57da0a45e18b8a0bae9cccc78724bd1276c8ff35fbb52b9cb5a9b895efe0a
MD5 f9cb96484801bb1b48488172aa0f17e5
SHA1 e531037a38bfec323c50f0cdf90117c8834c69be
SHA512 ed6c65a3f96eb5b93aae5179e51819e7dd20294f38948390f3d6f63ae811e792d565384149621ca5edbaa97a3c41a553d2ff33776f1a18c3b12c67dd5cafbbba
SSDEEP 98304:QbSGwhdIwHLn3FEG7E2IfkxO2p/sfDLfXjbrwFLcarNPa1xg:MKXIwr3FED2IfEO2p/Cbrwptug
TLSH
T12A769D16A2E400B9D8B6D278CA678513E7B3BC151331D7CF06A0966E2F73BE1563E724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Assistant.deps.json

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\Assistant.deps.json
Size 15KB
SHA256 142801c54d7eea029ab4495424cdc5e8b134c02369f68a558f6c7c5f01f5d8b2
MD5 087f352c77284c42df5c50fe46bbc374
SHA1 35651b65ff2f0671e17d187a0f855bbe9d145151
SHA512 508079c40ba9b8d7854873ead5bea101e4273d0218c08c705f26e978dae2a32a81e27b3148162054e34aa7ab0d556c4897395ac6c004bdc85a4ac52d51d71d67
SSDEEP 96:XsKy03qXNHxVwTA3G8EnqimkKqTxecaFh4QUP5nyn6TQBcSVy9/O1ap75LGQ9gpS:XdxGcaFKQUPdycyWChCYdA81Ej
TLSH
T19B62C925E8946E770972BBB1B8354281F639132F7004284E79FC285D8FB7F5AA096F35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Assistant.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\Assistant.dll
Size 158KB
SHA256 850e98a0b899fe365d17d003f0fd8662d3161c05aa19f545fbc6fd304672624f
MD5 7f105f70c28f84a9ca19794347b4d37f
SHA1 e3a4ce2ea8960584874a3e653e98084f6fe0f454
SHA512 f9c2922a44adcb649b26d8555a36163b62713b34d079d042212897f357e53ee30717a575ca9af7b792040e813c5b432bebf4c5aff8571051a7d73e033edeb831
SSDEEP 1536:vvJYsjMZol8fgH/7RiRiqEduLuha93fIkPi:vvJYal8a/MHSt
TLSH
T1F7F36C8797948072DFDA4A386DE0D7DA3B346E461CD3495AB354B1FC2EB2FD21E04226
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Assistant.exe

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\Assistant.exe
Size 301KB
SHA256 3e09f9676ba5444aefda822c32b11607a8341703eff0c9f1c8956dfd0adb18b2
MD5 067a47c7d505b7ed82f405e576b15ac4
SHA1 93df7525271f097d549da4f0a578676e3b558034
SHA512 02ccfcb2209c380885328be96b7c66f7ec573d2d76af8069c605944b0dec11899335429422e1f61940749a7c70e931ddcc8c6bd7a9321fe9c4060ce7c3c62eb8
SSDEEP 3072:WXwANETcQt1Onb5RHrfqDQXFn4dPPYseJwmZf2jT6lb+aPODHe3Ai:slxnlRLfyQXN42D0IlOS3j
TLSH
T112644B03969850BAEDE6D638CD918B41F732785A4BF366CB13505ABA1F76FD05E38302
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BrowserSDKDLLShim.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\BrowserSDKDLLShim.dll
Size 3.7MB
SHA256 f6d24605eb688e039e4509d184d974bb14c4c38528edad129d0653eadfea80f9
MD5 889529ee7dadd23f11ed5b3fdd1f5b79
SHA1 3e8a1bee4d28102aeb4c6f2eb94946282ffa7e12
SHA512 bcd57045d516232828003b2b970b457138cebafbfbf2bf762199c291228b2cd674d8084190fee22f0adf047e8f2ac20644712313cfb5f90289a83fd6698995ec
SSDEEP 49152:aHENZh/xwXNNnfFEXqGW3nILlpqCBS6+38Q/h0oYEaF6r+jep6Plw3zUoC02n:TOX/xPb/aomGIoIn
TLSH
T1E2067B17EB9500A8CC6AD23C856B8607D7B2BC25677097CF1AB462791FB3BE1123E714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CleanControllerImpl.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\CleanControllerImpl.dll
Size 8.7MB
SHA256 da31dae7f2286e8bd66a59e59380d597e406af8842ca33f04ef92b49806d9ee7
MD5 d50c130eb3d3b76efe30be4db9a5f48b
SHA1 9ebb74d01b920645440e8ab601f4e3cb97fe3fec
SHA512 bae355a621c95830d425c15b5dd6ede85add7cbd31a6d54509cee4d8e06588ca23448d1209b3cfadcae2de77d2871459221f9089b4969ad9cf1b37dcbe257e8a
SSDEEP 98304:pigALXb/G64adJw0XDYGG7B+UN58ntwx4h8:wb/l4adFTYGGN+E8ntac8
TLSH
T11C969E1A76E400E8E4F6D178CE678413DB72B8550731D7DF06A0966A1F73BE09A3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CloudControllerImpl.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\CloudControllerImpl.dll
Size 6.9MB
SHA256 c1af072bd24fe47e5f2cd71faa900c7a1dd16520d3735f9cc8df40d671b5e9b7
MD5 43cb480992b8419e0e2938e8897590f8
SHA1 e8c69764ce3d6627956bc88b598b99b0143dbd87
SHA512 f6d974086da91d5da49015ef82e4d0494c3bef77829fa4c7438fdf8e0fa06520f682609dfa42a0dd06fded7ae113543a9284467514486f2b514e2d6e94f0d231
SSDEEP 98304:lTUvUuVCKfYls1zPJ2KxJRttlMA+4sS3GK:evUGCKfn1zPJ2KnRttOTm3GK
TLSH
T163769E5BA6E400A8D8B7C17CCE578503EBB2B81543719BDF06A4967A1F73BE0563EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DryIoc.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\DryIoc.dll
Size 597KB
SHA256 8950581d24fb58d832b7254e9461a7f2244e3a275738b716cbb940ee8b4f9471
MD5 62beb45fc36e7b058b513ae542fd4327
SHA1 cd3f88ba5b4ba06e08119449b25f2f6df77ec3e4
SHA512 7eaa19220cb6b05498b0d6a6f8b48beccf24616433880284ef2ea86b12511746cd517496bad6f4470c39bd76548640903b91ae38669ec1c07d0ef84b9c6703c9
SSDEEP 12288:l0pb1qj47g2Gzp3+bszwrO8Zakh8Zfnr600DssPUbUhDPz9:lqEL2SJMZbxHhLz9
TLSH
T119D48D0533EC461AC6FFE673793529165BF5E413A8ABE78F158884F818EAB115E403B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Duende.IdentityModel.OidcClient.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\Duende.IdentityModel.OidcClient.dll
Size 165KB
SHA256 4a1d85c65ecb6612f38bdaff83939cf68b1500e9f5607349097887ce5acc2a01
MD5 6b11275b4032fecbc54dcad7fd84ac72
SHA1 18bc3c5e0bb6d0e71bedfff7e251171b55b1d0f7
SHA512 531de8914221d733ec064c3a5cf0f4b4b6d3c614f057134ca7c57f3ef7fde939bde3a4447b8bdb04ca24ce960be7212d4c7ae09b2f259f23c1b7b825b3908d21
SSDEEP 3072:dR8wizSvYrIgF6ApyaljQi4xBzZGhbMyB9E3as:do+vYLDoxVZGLHO
TLSH
T1ECF33C6577EC8312CA9F7F78F550A52565759E03BE81EEC80E487CFE09263C23909B1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Duende.IdentityModel.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\Duende.IdentityModel.dll
Size 250KB
SHA256 54aa81fb4f2aba7addded28d66a863b1dee66de8988adc99846dec4e0b219ab9
MD5 bb4273733bc5e810866d79ae62a996ca
SHA1 36c0d552d13bea20fa20078ca783c2aa1d2c8efc
SHA512 f77aaf885eb95a23fbf9853e9b236819c70c2d29799eba50df8ebf01721ea7980894fafafd4b7ebaee0d17e2d460d48a0e8cf3cbc557342a7c3934f5c9e4fae8
SSDEEP 6144:XBCOgXPwr6V8Hhm2ZTKR9bzIdbN2mCFMhqPDhadW:xCOgXPwr6V8Hhm2ZO3b5Dhad
TLSH
T115445C0263F48617F3EF6F3AF574A5218577BD467A00EA8E4D447DEC1922B80BA15B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LicenseControllerImpl.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\LicenseControllerImpl.dll
Size 7.1MB
SHA256 223dd68b4fc42d3451d7631a56bf261517e400da2b9536969b7eda80b28a0e93
MD5 d91ed54c2e16f0c2d883dbcdd0b3c513
SHA1 e5116a0fd899ccefc5e7375100b6fee90107c293
SHA512 44b036566fde88317ccb90a3173464c96c547b61da73e1e65cfdbbd2bbe8df96d7425088cb7322c8c1e5cc6abdcc47ab76e41834f8e5cfa0ae07fadde35c5c5c
SSDEEP 98304:qWth0pN471WY8eAolIft4ooTU5tgrJDFfv/8k:qU034715FAolIV76U5twtFfv/b
TLSH
T137769F6AA7E400ACD4B6D27CCA578503D7B2B8054371DBDF06A4967A1F73BE0963EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MBAMCrashHandler.exe

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\MBAMCrashHandler.exe
Size 890KB
SHA256 164932ea0ead0fc1d660b075913244fe7ca7322c725cdb0903ae4cf217b19a64
MD5 498178f914ec446f77c3c03637ef8889
SHA1 e865fb47b565b146b05d1bbaa8d79b1e37f71e34
SHA512 a93d02495be1f921f062fadcd65ac5ffb7ef2254707160f34832452ffc7c06a34784b7435afee645f253de6802a5a19d9c3cd38d3b9bdcb309e8c1a335b26cbc
SSDEEP 24576:m+JgyhxA4n0eEmZ7HF6ULsOmSxNVl2uCdRP8a2hi6:msgyhx30b87F6ULsOmSxNVl2uCdR0a2f
TLSH
T140157C1A777C00F9D0B7D179CA46AA07E6B2740B03B05BDB13A147963F276D49E3AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MBAMService.exe

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\MBAMService.exe
Size 11.1MB
SHA256 f15590ceaf07889e9bd1997128e1466efa94c8b1c93a5c36a78b934ebb65ee48
MD5 b4abe513213fd6c3c64fda4977a8a924
SHA1 856ce67e2e25fbfa0cb4ebe6de4844587f0b5914
SHA512 de7804b69b6beb3775a3e1a6f7cc617d5c7b3bae30691996d3badc5fdf688789076d40faa5ba28c7608353cf2f5267820ce96b7ba2eced56ce04bc68ff47a6ba
SSDEEP 49152:6VISTe6fDzl3ZhU7lUnNW8lDclx7UKmA2XAcshxIsgQCIbRpJlTsotXkZB+08d9Y:wISK4XPniHxIiZ31p/xPKuxfJIpvd
TLSH
T1ADC6E606A7F951D8F5BBD674A977662AEE32BC618B3083CF1150560B0F32ED48E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MBAMShim.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\MBAMShim.dll
Size 4.3MB
SHA256 dcc714dd199d9768faa0ca212e63efe63caa8aeb4cb11487fa389ff59f6cf98d
MD5 5be75744f4065e88aeda92344b999ada
SHA1 48347bd7c99adf4e1c8407c0f56b2017ef8e5525
SHA512 53cba40ed9450dc83c8fc6e522b567884c1a7b858f708930f164fb5eaafb4d6972625eeb35b7d5d01d754f7c7af7727ecf08efb37de6541ec637021fa06c6613
SSDEEP 49152:+6s9rQzE4CYJQEw34L4lvXYsFFXBulqfCbLqmsc/6ZeFYpA8aIJammPsQzUOu+/x:rs9rVzYJGrsSCbvyg8aeTO/Z2JgH3
TLSH
T138267D17ABE801A8D87AC23885A78603E7B3BC16077097CF1A64557A1FB3BD15A3F714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MBVpnTunnel_mbtun.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\MBVpnTunnel_mbtun.dll
Size 4.2MB
SHA256 0b764892f7f32d385684411e647f69f428067180aa28315d71668d3ab25b335e
MD5 ca4f7f1ffd364bdb46dbbb8bd1319125
SHA1 a2d8a1a3401a93da3303376e37e6ae36e08c693d
SHA512 522a23be06d466db16e9abe89897e8562ef1fab483285c37c5ff43468e084a91ea78892ea9225c2da589e440e84034d23b0236af99182ed6d1eb118b4e0dc273
SSDEEP 49152:lBPD6Io8w4LcTwEDRzTJoeM9YSxjQ5g+o9h6iO0oFjn2Q1Z0NwEIx6:PDG8VQkgRzSeMfn+ofU1M
TLSH
T1C8164B02F8B205B9F2BEF131C9A963217A31749503327B871F9195692A66FE47E3D313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MBVpnTunnel_wireguard.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\MBVpnTunnel_wireguard.dll
Size 2.9MB
SHA256 998086c9be8d1e7bb8ec63e907c834dd315849cb78de4da8cdb5702e03eb79ad
MD5 2b25add11147543409d55d85d1662e06
SHA1 37ced9f532ef0bb743305d4b58095d49ae8e382b
SHA512 4bf32d77cb9617ddaf835cc7fed41f590e343a7c567474353e75ae80c5820efa6a5b443143b6fbecfd8cd9df77ba4356c19cf65d47d73c408091ec4041ea30a7
SSDEEP 49152:OiZVz3arb/TUvO90dL3BmAFd4A64nsfJNraOc3jxJpr7ZEN7DS25+NkzZGALgFtt:OK30c3jxrw5HZId7W
TLSH
T199D53903B89584B4C5AAD230896B92977B317C890B3163D73B50BBF92F72BD45E78364
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MWACControllerImpl.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\MWACControllerImpl.dll
Size 7.7MB
SHA256 d981db88d37713943b3d96e484acb6116175bb30df786a18caf8aef08ae44b35
MD5 99e4b77b699c48ed0d75c6545581c3c3
SHA1 746f0fbcb55d016ec60db757513642ae39bfffaf
SHA512 544974caae3144ae4deaf00383a1a40e8ff5bae991bf2a6c1bbee1ada390308c2a01c444f7a26136af3a52dde09bc5fc3334691c3f27f5798b97853ca3f75304
SSDEEP 196608:xcn2G6iJppqOxwdZ4QnstlBvFvtfimS6I:a2BiJpIOxwT4QuBNvtfimS6I
TLSH
T1FE866B1AE7B940E4D8B6C23C99676617FAB2BC198330A7CF0654975A0F73BE0953E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Malwarebytes.Interop.Activation.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\Malwarebytes.Interop.Activation.dll
Size 36KB
SHA256 f5a9e3587fcf855046d8b08e86ed61105f2f330a1c9021461446c137ed3b9ac5
MD5 2db24fdb7584378e27e5a023ce1c4221
SHA1 f4c59cc128a4c79b1a6b450a81f5c2f9ed7e6b9a
SHA512 0e1fcd125a839f5a85ecd96e432ece37a62a13af579153b375fd6ec57b605689bcbb46e7f3d0a93e0e1235ddedf4965b0d9b2f4826d7d7eaada79a15a4efe7b5
SSDEEP 768:SI9HlxK1JN2bwUUcXk6xf1mlrjE7W3b/bF+Y7N2Ip4O6xf1mlrjE71:l9HlS2bwUBfIfmADh7Q9HfIfm1
TLSH
T1A5036DDA9A349003EF97AF7163E4DA83FD39A7C36845C56718AAD18408CB3C4E35626D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Malwarebytes.Protection.Interop.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\Malwarebytes.Protection.Interop.dll
Size 2.5MB
SHA256 1c598177dffdc0588968bcc909642b42607c33f3c0058f9ae2a6f91a996eb111
MD5 79507948df53d09d503664b250d320a0
SHA1 a2bad1306041cb895ec021d783f2244ee5763662
SHA512 2ef3542213e779fc5461ff8090b1534352bcaeb2ba33e26f7ee22adf91d02131dcfbc523213df7b449793235e8f44e6bc3f1e6b9aa38e7d6ebe435c6849f273d
SSDEEP 49152:tIJHNNsKCHSDZqQgHJmCOxQhAB27W+AhD+bbzWCCi8MI1v:CJHNNDCHSDZqQgHJmCOxQhAB27W+AhDh
TLSH
T106C53E2671B4AF3EDAFD01BEA5678F380761EBC07206EF17554C29480FD1ADA3D4A921
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Malwarebytes.UI.Controls.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\Malwarebytes.UI.Controls.dll
Size 32KB
SHA256 4c3d97304af4e091ee4ed390f2c75deb04de900ab404bc41e529a0c5bbbd04c9
MD5 1cab5dc89a3c6e8aa69ee3a709e92f84
SHA1 a8781531ac1700ee363f91995ca5269c3ef4846e
SHA512 1b03c710f2d4bc754d74e09838c26444f244585b1dca8d84c76dd1ab0cff4f08aa368eb4595042ece1a71c339b44aaeaa2397aa85f8ffde507124d25704e3ddc
SSDEEP 768:RQgoN5YiRifT5ALY6mM6m0fXT2Ip40GTxf1ml6Z+7EtNgU:RQrT7Ri16mM6m0va9vfIL+P
TLSH
T1EEE26CD78AB84403EE57DE31F1E8DA97BD38B7D36C91C1DA2069C1910B463C1A3A926C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Malwarebytes.UI.Style.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\Malwarebytes.UI.Style.dll
Size 108KB
SHA256 ba1e626a9b6a3d7c967d00ae31b7a758edb0ac23d8332939f044710d8e6288a9
MD5 a3478b0ba3b8948726bb37e82ee224de
SHA1 122dad2b5a9b8e689f73405cc4cd8f420944134f
SHA512 8a44270495ba7a2cf136cd618efb48b45d4fb60a85927eb4d9761ff8822ea852e9b1a1eafd77a6f0b4ec382330b835ab38872b4a09250d930f5e0f95c7ed32e8
SSDEEP 1536:xVuxwXvVh3gIrjyhryRlMAMZHcEzpr7Ri86mM6m0va9ufIk02:xVuxwXvVh3gIrj/HHMHcEVrtoU
TLSH
T138B307546A550CB0EB134EB6ADDBCE0C3D3145AA00E1C86521DF8CDF6EC9B8186A977F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Malwarebytes.UI.Theme.Dark.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\Malwarebytes.UI.Theme.Dark.dll
Size 55KB
SHA256 e0b84c137d3cef1dd43fc3572d359373b1614ab8aa0f5091f58120bfd3fc1c53
MD5 ba57abe6bc54c2a30a83372a1e5712fa
SHA1 5dc310260a243e4ca26d25c09f152b22727a12c2
SHA512 d940e2ccd2ef2d84b84be43765d88738136268892206a4f65182cce1c72fc4b15009ad11ab76b24bcd575cc6c1c06c5f3d7e82d9163f862e4a981082e081509c
SSDEEP 768:wIZlzpsplPN8n7RF1f5YiRiY5ALIN6mM6m0fXT2Ip4pTxf1ml9dHejL:f/1R7RikN6mM6m0va9bfIbHev
TLSH
T1BD43C755E5894827EF675830BCFE74826F3511B49403BE4FABAF627006D034F1AEE626
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Malwarebytes.UI.Theme.Light.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\Malwarebytes.UI.Theme.Light.dll
Size 55KB
SHA256 d2d177294181c0bc81baef93502e603eb1fdcff51b074a1f068c38003f1c0502
MD5 231f26bf96e205bf339693ad3d30f0c5
SHA1 24bf339765d5477e147e0e3320f1acc1e261689a
SHA512 18b59759d24e579376fe2f067ff23688ae36363334191c0639a3d8bae071d7662738129490042c6164a7286fa800b0591e91ee7302f811f6f9ef369fc30be33a
SSDEEP 768:nEfnxB+jbhXrzV+5YiRisGy5ALR6mM6m0fXT2Ip4PPTxf1ml9dHWjL:3XnV07Rij6mM6m0va9P1fIbHWv
TLSH
T10743B496E5894827EF235831BCF974827F3511A48403BE4FABAF6770069134F1AEE625
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Malwarebytes.UI.Theme.Primitives.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\Malwarebytes.UI.Theme.Primitives.dll
Size 2.1MB
SHA256 7a543d38cb51c1fae0e41297c50247f7558aae0e879f7d6762b2349193ad992f
MD5 2d99f557950980a71f4fd6c03b6c148a
SHA1 bdafdcda30a295aa2fcee118212dadf6129b550c
SHA512 39617ee745fb102e2131f6494f9eccf065ef576f64fca4bde72b9f57f5b4aa526d76efea1d838529d5438f6f2bd329f256e3309960c88601de2d6a6cb9108308
SSDEEP 24576:4R7Lmv3ser0IruI+dktHly2fuBLwf+ogKTAWrrBcUg0A7PEjRr8Diyr:qc+4H42GBLwf+oFTAWrrBcUg0EEf0
TLSH
T1DEA58D02F302A719CD827E387D7DD3BD5B71F8197E1A961B74C5AF2488CA4809C59BAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Malwarebytes.deps.json

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\Malwarebytes.deps.json
Size 53KB
SHA256 9b3ee87c7fcafa52715471b334b177c9bc092af88f92e3e9cef60d0ed59c6f50
MD5 44b666302580d889bc1b2baa384dcc96
SHA1 380058c17256cb6358ac92209d4f0228c4c6fab9
SHA512 d4661516892483191544c031f1eef23673737c5c76adf7d4d5c35417cb1fc57d4d05e7d7a9a81d7e188de3288af017104c3b3a3b42e1623c43b81b2838b5d03d
SSDEEP 384:XWWGyitlXt1XBcbuQT4J7VjFneQmiVmAH1nmhwtjenRQhtRbb+CKxoiYoI3c4sOb:Xh4/Xt1XcuQT4JYQh+x9pH9Y
TLSH
T197339C25D4545E7B4572F7B2A9790581F62A132FA0046C8E78FC285C8FF3F9A509AF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Malwarebytes.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\Malwarebytes.dll
Size 10.9MB
SHA256 667ec6bdc7cb4a6e012bb11adcf6f0e0c19c449aaebee3fc66a63b70b8c9d962
MD5 78120a1afa6e437309c18a6679dfc183
SHA1 2c294a98c7e250bd4690163ec1aad943a605c79f
SHA512 fb4b9ae4bfa0956960f34f1ef1ec5c49d2258ab4ec23c72f8590640c8e48e9b1fdb10dcf39cb03ef318a5f76a792bf0de6446c6e3a23799cdd383b22d4869d84
SSDEEP 98304:f1LKn9cO0nfScO3injmZGva7Uq2UausPdo8qh9dykOf3QkpQuNNZzRc2kotVmCPV:f1mcO0nFK1ZCfbaXOf3fp6LmwDC
TLSH
T159B6E1152BBC4E38C9D70BB1A82203059575B59626E2873D93CE1C3EBCD5F058E29B6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Malwarebytes.exe

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\Malwarebytes.exe
Size 304KB
SHA256 f668f511118090e7ab4ccdd32bf497dbb5fd5572d2bd1e1f94ba340024cad192
MD5 abd66a6a23efae650e079f744b34c469
SHA1 1b10afd7490801f2e4d7fa49a1bd92e7a4da9922
SHA512 67af9986407f4b9907ed788583eaf39fcee4c3807fa913af2787a8550ca761d2437d61b5662195e30e03e063be6342da045852fa342b123a6bfc4f57ea1350dd
SSDEEP 3072:UXwANETcQt1Onb5RHrfqDQXFn4dPPYseJwmZf2jT67b2aPOgvj50Qbj:SlxnlRLfyQXN42D0GtOSj3P
TLSH
T176644B03969850BAEDE6D638CD918B41FB3278564BF366CB13505ABA1F72FD05E39302
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Malwarebytes.runtimeconfig.json

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\Malwarebytes.runtimeconfig.json
Size 732B
SHA256 3f60cdd7ad6efb453058c7d80dcad1ef76bf5db28fd548fb6f9714b409e4a181
MD5 5bfe910e05d660bafacad9e7769c940b
SHA1 fffa577eed91f3e25b5c1a1824a4dc758628845c
SHA512 7d47cbe8d7799213636773b36cb6ca8efa22d8f1fa1b125355e7804b022280572a7b647608f39e71ecbc480e244e2bcaa59f27d9c16a3751953629fbd15ca7e0
TLSH
T115014979CA106CB718B9327BD525D483EA34133B10046C56B5FD090C7F7B6BA2232F96
MD5 SHA1 SHA512 TLSH

Submit Download

Malwarebytes_Assistant.deps.json

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\Malwarebytes_Assistant.deps.json
Size 15KB
SHA256 1b09f0c9e44f8e257c69035e14f73cb9c90ed44f93e41c2d8cf72e10c581e8bd
MD5 2dc73102efb1c93aa00b9584bef4f0c0
SHA1 6c230fdd49f2942a7e50f2e954c5882d7547fafa
SHA512 5b38a9cad6760df27832068ec01a492e582132713ba84184d2cb955fecc6529856dd4b5979142612f4a8b65a64df2b9b923baab40e8120c833e09c3673c53078
SSDEEP 96:XGKy03qXNHxVwTA3G8EnqimkKqTxecaFh4QUP5nyn6TvBcSVy9/O1ap75LGQ9gpS:X3xGcaFKQUPdycRWChCYdA81Ej
TLSH
T1DC62C925E8946E770A72BBB1B8354241F639132F7004284E79FC285D8FB7F5AA086F35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Malwarebytes_Assistant.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\Malwarebytes_Assistant.dll
Size 162KB
SHA256 0791c093347db3d7e4813ff975a340f03e997bb594b8f522f77e559b7d4e3b5c
MD5 0f92207f99e5fa3ef78712999b42918a
SHA1 9f41df0db3d37938fe28296ba44c516838183436
SHA512 51d811f596b92d334eaf00b2bae44f4ed19409e08c58c89838cf3c967a16c9275c61041c6745b4d06ebdc643f6a657541db9152375c375a3f5a2bdb08a63e5eb
SSDEEP 1536:13acObGLZolcQA3Q7RiThuLuha9+fILI5D:1ib8alcDQcaQ
TLSH
T111F35C87A7948071DFDA89386DF0C7DA37347E4A1CE38A5A634475FC2AB2FD15A04326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Malwarebytes_Assistant.exe

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\Malwarebytes_Assistant.exe
Size 301KB
SHA256 11301918df9c1b21ff45c00705c11c43dbd61165ae7eaac68b7982b6f7d49182
MD5 fd2dcfae7f6027316a80921188dc9937
SHA1 957534c02a673d78f9dbfadf94e29d20c4f0737c
SHA512 e2af3407c542c38838d606a4de263a50906492fad367b06b42ce80f07d268822eff1a42b4d001f956d1f231c768f990805cf0b5a3483c0adc2f027c58366bd0c
SSDEEP 3072:yXwANETcQt1Onb5RHrfqDQXFn4dPPYseJwmZf2jT6ebzaPOfTq2k:YlxnlRLfyQXN42D0rWOGX
TLSH
T1F9644B03A65850BAEDE6D638CD918B41F73278594BF366CB13505ABA1F76FD05E38302
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MbamBgNativeMsg.exe

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\MbamBgNativeMsg.exe
Size 4.3MB
SHA256 470a0254bc323f229dfba24e3ab3eb0c23a3491f5acc4e90e45d8095cfdca639
MD5 2ed6711266267105c7ed7dfe534c6870
SHA1 8690eee718918e1ff6a12551e6f2c6f64ec9884c
SHA512 5fc7c53aa8cf226cc9c4caab3f801e2422e2fbbfca7d8aa88af6a2455f61e5e0948a37b5c476cf14677cbea1a6d81412a1411d2fc12d58a8c5a8288c44a06fc3
SSDEEP 49152:av1K0RN+6ZgxovIWYmrbm3UJ6GVB9i1WMetWVNUe4On5x82kAPyczUUbnnr6YYRO:AfZgMmEHi1VeB4w/Sr6YYRZQ7
TLSH
T11D268D17A79801E8D876C238C55A8613E7B2BC1607708BCF06A4567A2FB3AE54F3F754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MbamUI.Core.deps.json

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\MbamUI.Core.deps.json
Size 7KB
SHA256 277f6cf41d3b52bfc8428aa03b0a9e24df958405720a0279086f1a6043c48f4c
MD5 2268d25559c8f511542fb4521825b404
SHA1 8c365afea9fea4ab678ee9fbe5a805447fedd135
SHA512 717ed8750f9e244057e770ebfa8a06fef72676e0f0acbbfeb3e640e0a4539de45ab51fc19e431edb235a72b18a40e7ddb6c5772b16a31e863efe989ca98859f5
SSDEEP 96:Xb5e03qXNHxVwTA3G8EnqimC4QhSo75LGQ9gpGc6bXpzXaTgNj+FPhCYwpUVCk86:Xb7qQhSRhCYhV
TLSH
T1CBF1CA21E8986F370976B7B1B87A4151FA39132B70042C4E79FC280C8FB6F9A5096F35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MbamUI.Core.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\MbamUI.Core.dll
Size 177KB
SHA256 7345e3a3d80560a874c0b9f0a5ca1a9482d0c342cc29f060482bee0b1659988f
MD5 aa664978302d1ed9312484aa05079f70
SHA1 107967ab09a12007fa1d7d8f0e10d900f63b820b
SHA512 b674e9addd86d709b1ba71873621e4c810a136e4e51b2ed0e0cf1e7c0fbc6213c1f649f181931b12cc737550be5e53e87e500970bd45be0cf50d68db86065d41
SSDEEP 3072:eOq3dkaP8nS+886vctPXob79GlPRNIqMyGqxmHyP87xA:P5aUsctPYb79G1ReDomHIOa
TLSH
T1E904390267F80645FAFF1F79B8B661158E72FE5A2C21D66D0691508D0A73B80EE6073F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MbamUI.Data.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\MbamUI.Data.dll
Size 1.6MB
SHA256 6ac14363684776ed011e446bc7fa1e52f22b5ee984ae932d7c2c141bd1782e77
MD5 c922da43568ce737e2eec072c545f656
SHA1 baac9d839298345f12a46cd9325d85d621d57795
SHA512 eaca6ae66fa3a9af3198a262ef370f0bb6c672f51af36a14439709018a090bfd5b00b907027d7b0e41973561fb50a610e7a2e319df062f1f5602a5b3faaa5512
SSDEEP 6144:Yz5X+vpPHsEtOVByDqRnm6kSkQdimFbzHMmLeFs9OII0YNW/fm/f5b:YEpPHsaOGDqhk63st733sf+N
TLSH
T1BD85B17077886632C4D4DC6B0E4559B8CA31EF93EDCCBA8DA017B0F92274A56D46BED0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MbamUI.Services.deps.json

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\MbamUI.Services.deps.json
Size 14KB
SHA256 327a3bc05874809f26ea87d355782fd4307afc55ddd02febba77c63f4db93be7
MD5 36c3b9eec35e56d2a2fa597c326e827e
SHA1 7da8c90611f7c1d7781d6bfb089f7009b082aa67
SHA512 20f5289974f8551f173eb61db0596d220e807dd5ddb2be38868b67ab1063107568b799e8aecdc27e68e6a4255d63706da0abc0bc270fed07fd32ffbc1c2929e3
SSDEEP 96:X9yn6TuKy03qXNHxVwTA3G8EnqimkKqTxecN4QhP5JBcSVy9/O1ap75LGQ9gpGc5:X9ycvxGceQhPFWChCYdA8IEd
TLSH
T10562A925E8946E770972BBB1B8394241F639132F7004284E79FC284D8FB7F5AA096F35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MbamUI.Services.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\MbamUI.Services.dll
Size 3.6MB
SHA256 1287461e457e424ab87ce5abb9240f48eeb73f26e77dfeb6a358815c1ac1d17b
MD5 031a395db1fe43ac1e09ee968b05d6b0
SHA1 87788dc872495e18c092a2cf7de2997f96d75e04
SHA512 005dc9c9bf882a399fbe3b3d1c8d1c084ab5607e15cfb1540ddff66e82369967b85d322f1307e17de83cff00e7ffc30fa1ac431252ae3db28f2e4952f99065f7
SSDEEP 24576:gfIXqA1aYMnhmDEtCdj1DV25/AbqUtGo7S0dsoOHJZuho0Cud:ggXqg2nSj4w3aBooboo0CQ
TLSH
T16C066A203BE92159E1F75377ED7085096A76FAED2A31C20C09D8447E19E2B88CF76763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MbamUI.Tray.deps.json

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\MbamUI.Tray.deps.json
Size 14KB
SHA256 ee28fc2fdec2d2ddb25e436a88d17ce25a92900a1f608c6fbdcb766735da2b2d
MD5 98fa7874f147c999d6bccb0e6975176b
SHA1 32f1cfbd24ad880b794bb3d186dd4b8faf1da321
SHA512 3370abb6bac74a31adcde1b7af8f385a0ee467411628a50c8bf2f5658358dda429c79664798e12dae38a0098bd351fdc41c0a227775e7262fd140fa0f58047a6
SSDEEP 96:XzKy03qXNHxVwTA3G8EnqimkKqTxecN4QhP5nyn6ThBcSVy9/O1ap75LGQ9gpGcX:XuxGceQhPdyczWChCYdA8IEj
TLSH
T12762A925E8946E770972BBF2B8350241F639532F6004284E79FC284D8FB7F5AA096F35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MbamUI.Tray.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\MbamUI.Tray.dll
Size 191KB
SHA256 6361d3a98b7ec08235600e50d4d02f37215036743a05f55fb6fc500652286f8c
MD5 f3f55b0fd82c24acc4bcdeeee4596683
SHA1 454fce1a30e61178bf1cc15872bb224d137b13b3
SHA512 d6395b96d030534ee33347a9eb84d594229775e411a595a1c0d8f5bbaa2e1baadf4ebd44742ae9f04108d2e7c43ca4a8d345accf6a5fe561f46bd3e79e525b00
SSDEEP 3072:bRjYYshnHrCfQtSrIQJmoQDF1G3AWb4B0BNb6j5JN6:WtlCf1rBJmoQDF1GwWu8NGjY
TLSH
T10D141683ABD88962FA9E797B685741AD8B36EA531B33D26D34C45C7C0977F884F02107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MdXaml.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\MdXaml.dll
Size 183KB
SHA256 14739c2c3a43c763e89fa343d7e59aa8e2a9d3bd32a8a7149741d1dcb829717e
MD5 00ac57acbd4c7ea233f4791160070000
SHA1 acfc3da4ab6aa588704d9235172a20670e57cc0e
SHA512 8745f1afe692279ebe89e649d1b4d86b3e3230ccf078d82ec16386a54b9c567d2db573b32e57954dd72b684225c2109507bb07b1c90b95bbe71b385b8e7e16b9
SSDEEP 3072:tLmHpg9WcY1Xw8bkt+akcNfU0L4mauTK5CTgSx:YWfj7t3HLLFaOKm
TLSH
T156041A0253D88A21F2AF0934E520E8A5DB3353AB1236CA457BDD75AF1F7B3910167B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Data.Sqlite.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\Microsoft.Data.Sqlite.dll
Size 173KB
SHA256 4ffa9156ebb9332bc53196cde2e62997447ad046629216be555e07d5d65f6c19
MD5 803fb44bcf3e488c9fbaac4933d729bb
SHA1 2f9d613cc53944e912ede7a1214d87554e30394f
SHA512 569041a3b05cf1bd548ff2c767a48d4c30c9be9a3e11c4407714d1ae1928f817d1a15cdc08fed40c0fbbda78ee3ac4f9ad443be43744647507bc7f6caefb8afd
SSDEEP 3072:5Po1U7KHI/FRmHsGP8vrzqWLvVtly65GBSilr7DSILSAQSIgdG8CmST:9omLmHsGPKGWhrZ543Iv8Ch
TLSH
T16B0449B4135C6543C7FFCE32B0B96C820734AA4BD5D2D74BAE40E5B93923745AE8129E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.EntityFrameworkCore.Abstractions.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\Microsoft.EntityFrameworkCore.Abstractions.dll
Size 33KB
SHA256 c29df8f2db22e129bb6929130d98aa612b570a5ebab9842a11e809796cf03448
MD5 5e000060b3a6a847d27f892b4f0f9c12
SHA1 ef4f660221e458f6ae38127769f66f924581b3a3
SHA512 28337074f48d61d9c11c4dd30eebacff52b0bbe5470aef7a0a07b2c336adf0ede76c7aa5742c457a6f8459528b8b5140775f7d6d6eb6e282942ceb30ac2b1f73
SSDEEP 768:/eLi5XHQQd3Sksb55OkbzouC+MV2bQEF/9zR:WMXdtw5BbzS+U28EDzR
TLSH
T1DFF25C52639C9333DAFF1A76F570A5812836F7863811DA7A4A44F08D18637C0AA70B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.EntityFrameworkCore.Relational.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\Microsoft.EntityFrameworkCore.Relational.dll
Size 2.1MB
SHA256 687f84616b0a58de7ba0c20d14b4fe38871d79161f2de5bb3f48d171c292a0db
MD5 6d842b431b91328b5c703ec7e721c3f4
SHA1 1a5617d2e2c79fa20b43aa7eaf3d0aacf5ddb6ed
SHA512 04cb1f53504f1fa4860b5bc984ebf7054e8ee99c1512efca461c01c74f63e493d81ff7a5ffe56c98a09a27a6f3c8d170fc194e7fcc4c88f7f6c5c1acd689f5d1
SSDEEP 24576:yfWlkbXVTUH5pnb05u3bLbeIdvDLbncb9WOEJ89F7T+IyTS6oNzvP/vTXqXFti7F:ypEJ89F7TgS6oZkSNPeFC/U6
TLSH
T1C0A55B45B3B8BE62E1BF5336E025844473F6E846A352EB5A240CBAFE2C537411D41B7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.EntityFrameworkCore.Sqlite.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\Microsoft.EntityFrameworkCore.Sqlite.dll
Size 304KB
SHA256 623bc03297fcefc658a9e251d1e75c12d7365b80a3ebcfecd3e31d5a6e7feead
MD5 3ded14093905c1f26692be0c0ec2305d
SHA1 aa249a469baecbff645d9cb6c6b7577ac30c2f6f
SHA512 68eb5848dee8ce008e90d317611fda792f2b10e4e19c03f0e5453f214e501cb2bf1f81755a29ad7a185ac4cd5cbc0c3af78c554425fcd5183d7b8bfd8f60c423
SSDEEP 3072:y614aDpdB36A912H5mQtTLvf8u4tcLR8BlNt+kNpQo2NxGG6tHmXiVstgbx3h+0q:yg4aFjPf26o81tzpv2GGdyBCjKcwJnQ
TLSH
T1C5646B4133FC9326D5FF8736B074C14883FCE9178499DB4E2C94A5EB2EE23415A29A67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.EntityFrameworkCore.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\Microsoft.EntityFrameworkCore.dll
Size 2.7MB
SHA256 6750a0c56a1d557d7590728d4d7378f6e1ec65cb96e59489023cdc9fd139f6ca
MD5 4522635c0a768a1968fc0c606384aec4
SHA1 b1a5d4ec3016894c5c73ca1ca80304dab0144634
SHA512 6362209e1e9f8f1eda70b01609ce617987d10a422730bb5f3559a2ac4d2c970e4bba6d4c03406f52e50262b8f0627f6df2bcd4408a0a496be69392994ec2e388
SSDEEP 24576:cH7ch/JrNY4K49OX6HDkMqdGO+nDGBHUefp2c1boCLFtrNBIdu633Do9R/42iQ9Q:qcqRYkMqdGO+lWm2/NW+hmqulzEY
TLSH
T192D55B55F3EC5F26C4BFC736B078054093FFE8941372DB075084AABA39A37524AC96A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Caching.Abstractions.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\Microsoft.Extensions.Caching.Abstractions.dll
Size 36KB
SHA256 46697030a421c60e4a1eecb295fe14513a562bb2e5d7e0ac878f4934e56bb50b
MD5 ccc8814b69e63f0c87dac4da0d9dd1bb
SHA1 1a2f71bf9b77e83084fad125161735148703fa2b
SHA512 e7413110fb79901fad3c4cecd2701f760f7962ee52c00e566a965babf1d0a805827efe499ea8d2eb455f12ea6bf3cd1cfe988d5fb53d70d77004bba3dfccedb0
SSDEEP 768:/BPRm3g7qLxnMLsLNRP0iNeAr+KIeOt83ZW26/9ze:5PkxMoLAiNeAr+Kst83ZW2Eze
TLSH
T12F035B048764C363DDFE2BBABDE581C60A36E64A6412E71A5C8CF4DD0D03788DBB1766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Caching.Memory.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\Microsoft.Extensions.Caching.Memory.dll
Size 46KB
SHA256 f108fc79cd1b69eb4d0f8a45d198c5fb99ace430dbec65380854a559a248d6a9
MD5 6346b4d17d67e59c82aa743b572ba255
SHA1 0e6ccc1c528501562cd17d878525de1be6e69fcc
SHA512 4620967e627981f0c758e6fae1ec10a3564ff6612b538d21be6167fbb4c1545d7ed65abf392086b41f02cc62260d190ff6c21ac59f78e9549c601f70527bcddc
SSDEEP 768:LZWKkP6xlhFOQjkEL3ZAcueHPsXeHrjZ9zf62K:9lanm3OTwsXebzfW
TLSH
T1FB234A00576C4327DFFE1BB8EAB0A5511B7A87977811FB691CCEB1995CA37C0861223B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Configuration.Abstractions.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\Microsoft.Extensions.Configuration.Abstractions.dll
Size 27KB
SHA256 c295e6c3384ed61e4fea0fc43479aadedf81a60c9c97d3dbdb9247f562e0846f
MD5 59a088e0efed74aedb4d38b18cb81dca
SHA1 80c85b3e2654e9a98ae49ceb0c074d9b43352b02
SHA512 e869a3512828477ee8a5fb163d008e50cd516cbd121bbb5873a4434a9200612470edcd7204749dc13cfb7e9e0d3ee9ab323e7b4a3194e3d5b7d17a7a447750ea
SSDEEP 384:TJ5rtAUhkfuUIh0cUarO9vaTG/dwSzRjz67MFTFUjTWsjSNWRlNaADSki+R9zGDp:15KUhFFh0cU6Qp6cO9zkR
TLSH
T10DD24B1683AC9323CCBB2E75E9A1C4562E35D397A801EE5A64DDF0094DA37C45722B3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.DependencyInjection.Abstractions.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\Microsoft.Extensions.DependencyInjection.Abstractions.dll
Size 64KB
SHA256 ca708422782fb25819941a16a057ea96d6d18b037e7e5cbfdf340b7a04362b57
MD5 ae5e45ed689ecd9ca584e517dec04437
SHA1 a03538d460b2cd255477500b364d9e463afe05c2
SHA512 0ec0ddb7f15cda3e02039de26d1730d6ac4383a384ad56fda8398ec6cf33d9489add536e78e76f6a6f33590895f9da60e2d6b98aa437607c6533e9b80d26152c
SSDEEP 1536:PFuu+NbA5+iU5t53Ueb4I+MkT/sEyWzekwmgzT:Ph4ttkDsb6omg3
TLSH
T10C532B6837F9E613DBBE4A3137E642C1AB78AF036001F70F254A92F50597BC949909B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.DependencyInjection.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\Microsoft.Extensions.DependencyInjection.dll
Size 93KB
SHA256 47f8175d34e9087d3858644803c558cb9cf52b29bffda796f65c1c527d1b6a22
MD5 691d122172e70a956be0ed59b935a8a9
SHA1 13db5e854cfe3805bb518b501c438ea394b5683b
SHA512 995afb87da135e03386bd5d0072bc93a8c99372ec963a566d304161ba9521a4735d88e9048e5b9bd07a25da410c54a1165e0392aceb292410be6c8f5c48308f0
SSDEEP 1536:txemzdEwSsliCvUFoN93dJrutpF5nRN46zIQ:txqsl2FoNBrutdj46/
TLSH
T1F2935C7513FC9B26E9DF0A74A87542404B79FA9A3402E35D0EC4E06D1EA3FC54B6226B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.DependencyModel.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\Microsoft.Extensions.DependencyModel.dll
Size 82KB
SHA256 8dadc004effa669d9caf231019413e469d58632eadb9dacf56aad07d8bac82a3
MD5 52ec978e8277e966277939d57630fd6d
SHA1 547f659d6e20d7f13120fb52413a2db7fecd428e
SHA512 43fffe70d25e79c45a5cb018e03565718aeaf910231c270cd87bb9806ba410c7afee2bc54911b80553ed7898e6a61e46636ced974139e2aba5158d24d951d3a0
SSDEEP 1536:iuCEshm8cqNUMP/9T3vM8Gkvv0P2OK4bYMgzU:L5lbOj/9TfL7vCfsMgI
TLSH
T15C836C01A7EC9713EAEF1BB578B5A05907B2F65B6013FB5C6D4D609A0907BC04720AF7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Logging.Abstractions.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\Microsoft.Extensions.Logging.Abstractions.dll
Size 65KB
SHA256 ec244a2db19dffe90cd299fa4b0691456ced342a078b4a93cf3726a9b431e9ac
MD5 ce9485a33686f5b71a44b578c1f62a83
SHA1 08c936106235dc9a3c30f817896f947354460b4c
SHA512 fbd2b2bb5b83a280fe16e51d48dab44f9708ba224ae854e8510790cf0eebbfb23056009d8d5347f05c04fb4e2d16ee110f497ad7f243646e6ad78927fcc6b1e1
SSDEEP 1536:jc7Vs2LEzbPQV1b66atnqmY8bf24LNU/XhQ6zIhQ:j2PBV1b/OqRY0q6t
TLSH
T1AC636C1197DC4733CB7F4EB6E82196524B35C5473103E7676CCCE1697827BD8AA202BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Logging.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\Microsoft.Extensions.Logging.dll
Size 50KB
SHA256 74d8fd2d7997fc638474e2bd79916458a30481e6a6925b50e7e96b4b852031c3
MD5 8ab959f2310c6f8a3ecf2de3cecb978c
SHA1 f989f82c587621c85856ba0266759e6a848f4e98
SHA512 aef718d5e732e7c9a6dc98e54e03d7cc91f72b5fbe738bc9d1d1a8001fc1fdc9e7247fada6be660b58f4532f172855e3108110b91d3ead49aad03266a6eddd87
SSDEEP 768:OVY+gXlZrIb5IilZcLfQQ1rERWp8gFT7Gf0lJa2s9zwH:OVY+yf25IiDcTZ1rEgz60lJDkzwH
TLSH
T1D0334A5183EC9366E5EE5E38F9E0D8555B3AD74B6002EB865ECCF0B428B37D0462067B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Options.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\Microsoft.Extensions.Options.dll
Size 63KB
SHA256 644350f8c2404d4479b97a250edb29585e5fafec1b6ce8486ae600c5015fd7fb
MD5 cd3547864f8b6753525e759948a8901e
SHA1 121a0634920dd0edab6403f9aedd675bb77ab74f
SHA512 55128005f5d095b0f977f0a1f8814cb1f7dbcbde8b14f791f392387f605e7bc0e20ce96de65ee6f7c23c6c6930f2df6390f3ebacab81af9ba76059a4e5d869e9
SSDEEP 768:JxLQqsUmClAD59d05JD/GQtbOZZn6SqaDiNax4PTcFBLCx5NLdW7NDpfbrr9zP70:TLExCmD7dvQtgZtqTyekE5mB9fXBzA
TLSH
T13A536D014B5C9762CEEF4A71F458C1F11A36C36BB54BB32A96CCE2A81DE73909FA1531
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Primitives.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\Microsoft.Extensions.Primitives.dll
Size 43KB
SHA256 a0794c3bab2d7e0c848f0dffb3b9aa4b43ce07dc0abd122ebb7bf6dc79452ec4
MD5 0665c2fcf8856e8790488ad7caa2c00f
SHA1 5e7f4cc30b5a252cfdc016eadf69d3b181013d36
SHA512 3d3f4595d5ea34e2b691b05fd540b8c92bb84b1d30706a10e375166cc3fe70228f7f68425e4dd9d814fa0669ed10ec61fe30c0cd43c705054f3a20da20cdc260
SSDEEP 768:EipZy7/jRFQLfvJ4dBayaIb/Olz1OkytW58cZM7uisK1KPp2Kfr//9zT8B:nMjjcLfnjimp1OkytVc67uisK162eNzG
TLSH
T113135C41A3AC8333CEFE5E32B4E4D155063897AA7552FB5B96C8E0A45D633C05B3263B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Xaml.Behaviors.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\Microsoft.Xaml.Behaviors.dll
Size 142KB
SHA256 0493049febb4be74bdf669ad7fa754941c2754fe33421e230a8f14c8fd06c8c4
MD5 a10c6f9556dfccca0db08b9ef2e86c4b
SHA1 e34dedf472f32ac21306e5673d34dd2ec0deac15
SHA512 8128bc268c5a62cec0eaf3bcb22b93e017f2a1d60808476a1c437ebdb6494ebfe898ac24dfbd620b525ed9b26bf81a8b7ebcfea26dabbeaf18fbf5538aa160e1
SSDEEP 3072:+XQg6pDJRt4v4VMvlat1dLXTrGmAJ5ryjTT:YQD1JRtigRGG
TLSH
T198E34B6053FC8A5ED7FF1634E0B061158671EB9BB933DB0D5E84D2AE04A338266127B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MwacLib.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\MwacLib.dll
Size 6.4MB
SHA256 c0e4af50c345e4b677f817888d4d6421d64a1602c9f0ce1af8dd6364b6a93207
MD5 8de8ff44c6cc661d925bd6fde04d16bf
SHA1 b65c6e23f97d5c3c7c313f73cad71efa0ff4c1b8
SHA512 a462a83716965bcbf03714fe91af0427e9130be634043126f7aa5e0edf3ea72dc4020125d303e8d155eb651287f7842bac6bdb397dccddd5598c67ae67a6bc2d
SSDEEP 98304:g3tDsK3c2Vv7vyPfRTTBPMHyPsG4bEujmV:wDsK3c2x7vgfR3BPMHhG4bEujmV
TLSH
T14E669D16B7E400A8D8BAD238CA678113EBF2F851173197DF0665967A1F73BE0963E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PoliciesControllerImpl.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\PoliciesControllerImpl.dll
Size 6.1MB
SHA256 cd1e8f98551fb69d3d47837c09fea35be358dd7c27104afb7f1938a7fadbb2c5
MD5 436a5828103f6874dda5ca0b32e8e8ec
SHA1 7a5346221f40349881a65df91014114b1644c8f8
SHA512 a4ce868855d83ad112b528a4969e5a5f79a115eb92f9e3ef1f05eb09f7f39c099abb162bbf2024b298af715560d81d9f08c2457109d7b2b33c04dff9789dbd05
SSDEEP 98304:at69nEVAZKwY4Lka7NrGWeG0qwtEQ9VsAwbB:aAnEVmKv4Lka7NrGWJ0qwtP749
TLSH
T1C8569D1BA6E800A8D8B6D13CCA978513E7B2BC15177197CF06A4967A1F73BE05B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Prism.Container.Extensions.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\Prism.Container.Extensions.dll
Size 20KB
SHA256 85a55b97f20431fcf6d33634de6a86d7c6d441be413c728e19dda8b0aef72e92
MD5 7c761ce50753f23707b12774d6191482
SHA1 2a6367003777f077c2b0969e0454bc4de7b0757a
SHA512 cc0dc04d17316a816553bac6092f124310c3fcb3c131ee9421bc6581710493233e7004d07bc097a9caa818d3b0c1320135d6562794d9520c207fbe6dd2f4f559
SSDEEP 384:h8z2AKJxYjp8LXg0uHPF+jCZSZmZPSUPo2/VlhC9:h8z2AoYN3vF+jqSUPoAlhC9
TLSH
T1D5922B528BA44373EDBB8F35BDF592105A30FF41AC60CE6A069CD0C9CEE2B5445B463A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Prism.DryIoc.Wpf.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\Prism.DryIoc.Wpf.dll
Size 26KB
SHA256 ad1666c83f2554b09396386fcec856f9b3068b9bc2a29f13c08d3ce0c23d7d4f
MD5 bd3f6009fc2b6a04bb3401c0158a2868
SHA1 62aeb021c1fd18dd4bee4e3c6947571738582819
SHA512 83e4ed6ff4351056c2003d776cb15916f280f1cd3aa4c6ae6e4cf982c0b69e21c1ad3c08d0ee4b3fbf7861f9b231f5ddb8735a037ee7beb76c1ac485fe49450d
SSDEEP 384:j6Xd47wSthuCfI0xlid20I3W7xrgfScZSZmZPtU91C/SyIpMehV:8d4sAuCfDxd16ZQSYtG1npKehV
TLSH
T1D5C24B51CFE01536DEBB4F7E78F051015E70F746BC52C6AF819880A41EA3BA11A9077E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Prism.Wpf.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\Prism.Wpf.dll
Size 132KB
SHA256 c3b44b118486a5d74d696c14853e5306ec893dadd0be8ea6f404edae8c66f2d3
MD5 7a103c5bde44976ad0627443af2e1a4b
SHA1 55e4bb694cca644846bd4a39782d76d9b4996480
SHA512 8ca0142f855f776cd610c5e9e6ed46bae8d980deff2a8916c8fb4356d516d1f0d9b8c0114f456740402f1de1ea55c5eb4f797bb04f00196c7a647fe212e50836
SSDEEP 3072:ifxD31bs6W5SVEcJ8+s8ggRwfEQwwzOfzH3mgQ:ift31RVVRs8g5wwzOfz0
TLSH
T1CDD35B2923FC876BDBFF4A39F57440018FB2FE472062E75A5944E4AC285374196923BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Prism.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\Prism.dll
Size 89KB
SHA256 92090c9c3c5195149885be91aa469b85d2cba9a215cb3bfb65e93945f33d852b
MD5 0877a419afc7306cfa2d301e314f0548
SHA1 ba76afb78636546c5dd73162bba7a98ae3b34724
SHA512 5e3ac30005f4fdee8f85d2a632415bef7a9722add4cfc59745da9a41e87cf79e5c62a0c2fb52b79381495be94f7b7d0ec3a455f0f112e7b0bdaf63d6b46c6bd1
SSDEEP 1536:eH8fhOdBanbA/0soPhaECCcCxGVSCC+5rgnCnS+6j+DZORL0SSeVEEkqYyg1H:G8Z8MbwaCCcCxGVSCCFCnS+94LNSCYR
TLSH
T116935C1063EC4B23DAFF5F78B97410450BB6FA436522EB5E594CA1A80C63BD049A53FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QRCoder.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\QRCoder.dll
Size 228KB
SHA256 66fb6ad172bd24d21220743f13797840cad9f67e5c01b6fafa3f5bb3995e4e3d
MD5 a8320ec5cd9c6b27791b4dd203f19b79
SHA1 a7377a027037dfcf5f89c82b3a6982a0daa6192c
SHA512 bc19ce0888084ab202840e148af257bf959ec559acf049e4c528cf8ac44a7ff2740082ec0abc7fc6e726a50167542eb5359158f88144d1a3f04d4814f74b259c
SSDEEP 3072:ubtYdT8Wa/cOnjtzdG0PRUQYw8n+6nMovphLwQfldIkP5NxBVWrDAoBgDvsJotQk:ubC8WqTbK5ntLPIk1nWrDAagYi
TLSH
T199349D6967FCDA02E6BF6F35E8B050118732BAA26D36D74F198CD4AC15A3BC049407B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RTPControllerImpl.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\RTPControllerImpl.dll
Size 6.4MB
SHA256 09d45d66c5d222b95a118b4e4cfeb8a5d9cfa272f6d3cdbd0b35331b93dd3629
MD5 7e1c3793ff944f952e606b0e7f7906fd
SHA1 59b41d2fa23e56bbc2ac3e1ff73c95601f7d20a5
SHA512 72b375250750de27ff37c3f949454fa3b2620b220e58f55c981534671593a409a579c752f0b78461b2ff0116d667d37f02c2815a49201b0de5d0cc516800477b
SSDEEP 49152:hp7PBnIk+k10z3X/iMgbNj+WyrtJ1MhgJkIzhX3K9JLYM5suBwKvQsVmPt97BqMe:T4SuM5b9BdbTY4lzgtSCG+qW0rOUsC6S
TLSH
T1CA668D1676E800A8D4B6D238CA678513DBB2BC594731D7DF06A0926E1F73BE05B3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SPControllerImpl.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\SPControllerImpl.dll
Size 4.5MB
SHA256 6563c8273b0285bb2db5df55c8a707b76ed9215739b78ea4e2f954ee1025ef12
MD5 efaf9a951675b1d23cf37e6f0cb9a02b
SHA1 ec1edd6046df2d78f26a708db865c16065bc5021
SHA512 9a43c424313d610c9bc133bb35d7ed3b7bf424c66b8820483a103aa41d3628fb609c26d5ab1399f7b6bb43ae962b03307cc32fb5a5a4d434934b5be0bf98c793
SSDEEP 49152:JRNwUFTWIls1ThDYENU+QTRzmKVuPSfgSdBF5Mufa3j9LIJv24rBPZROnwPi5zUR:XlQBFQT8v6GufOJVuBPzyKR
TLSH
T1B1268D17AAE801ACD876D23C89AB8603D7B2BC61437097CF0674567A1FB3BE1563E714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SQLitePCLRaw.batteries_v2.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\SQLitePCLRaw.batteries_v2.dll
Size 32KB
SHA256 85a9b8c4fc25811f16e1ef96df2b55da36789b534b9011898915e65e4063694c
MD5 98e7d5788dd7d7ad5b467253a609de9f
SHA1 7551498129f578dfbc1c1ce52ea5c22e17da69f6
SHA512 902d023bf554cd1000c1b7947bbf85bb5913db5e845c3597e402bb0bb6f8741cf21d981a017e4c612a866366659f9e0d5e37efd8fb27ebbdd433b8e235663c51
SSDEEP 768:Qr5YiRi8L5AL+6R5d6R5/XT2Ip4ZTxf1mlIJw3l4:QV7Ri8TuLuha9rfIke+
TLSH
T1A4E27CDB4A685407EE17DE31B1E4DEA3FD38B7D398A0C597204AD1804E423C6B79927D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SQLitePCLRaw.core.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\SQLitePCLRaw.core.dll
Size 77KB
SHA256 5d95f67163aae6615a086ec64093809cfa48e99f3f07777afaf638372106ed7e
MD5 1de112b7c4a9f22e008406cc7f55c942
SHA1 f4be312e1670ba0106c2ec63896c900482259111
SHA512 379dba8aed0973977c9e4366c9791bff4d7c5cbba2a50982ba459f87fa90590f397f5d761a695996f404ce1ad808baa1cf2114fb6b9da1c9f80c1f91c86ad837
SSDEEP 1536:gAFy5WiUx1PaDJqq4qLN1JirPi1HLsKO7RiQuLuha9wcfILc59r:g/pji2POlFM
TLSH
T1A3735A7583958E1AF9CE9030B0BB40D6BA70D21AA7F7CB63B590D0B019723CB56751BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SQLitePCLRaw.provider.e_sqlcipher.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\SQLitePCLRaw.provider.e_sqlcipher.dll
Size 63KB
SHA256 d3c04b04833ca2c38cf28084ba12ba393e4cf26beb461f6fbab84a12de70dec8
MD5 1bf16c89aad40086256e396634d230c1
SHA1 19477bc4a2d1aae36b947b6fef71342be4d6077a
SHA512 d9f5cd916d3de778b8c618a33aa4652dd88490b021fedcb5884027c47cf061da51a642f24aa2b638b7c4f55b33a8a9b8b3558e3f6b480c8b800de2d922a42a73
SSDEEP 1536:HD35VJMRjNUQ2QuX2YTn7Pe/x9hE431TyS7Ribq0uLuha9sfILD5t:HNajoR72lBYSrf
TLSH
T132533BD6874E0A22F69D4A3278735E8AA178E3C2FF725313A553C3385D633C59B942B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SQLitePCLRaw.provider.e_sqlite3.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\SQLitePCLRaw.provider.e_sqlite3.dll
Size 63KB
SHA256 ebc92b99aa731dfccb3cd5b4a4214cb7ad20cc0ecb34c8864e6bf3f8899b63af
MD5 2420be5eb006f6278aebfe6ba7b221bb
SHA1 1762a192cb8802d2a9128d1563608f66ab4db7e9
SHA512 9db795211eac1aa7c86050250dc6d3a5db3b5e4488958f21712539e61e143cb2a8f5f3857b786b825df13afed55c2bb9d43bdc5fdc5d7737ec3ead0d2d948fb9
SSDEEP 1536:kLOVCntPI/3ebE43FTth7RiAp6uLuha9tfILP57:k3tQeBHhcd
TLSH
T1A2533AD6874F2A25F69D0B32B8B35E86A178E392FF325713A552C335DD623804F842B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScanControllerImpl.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\ScanControllerImpl.dll
Size 7.0MB
SHA256 6f012a9fdf1a27900205de7680d602d150d1a1f0e725b5d674eabcc0cf557822
MD5 160cec311ed75da3c715b44b093a0129
SHA1 355f22fb8c2b51e8f5ea9f22800e6163e969b621
SHA512 4c55a78106325c385c93afbf98150aad79cdc0e4dffe9a7f9b7ee2d943fcd907a6fc9e221336803c1fd710a52c1b8c531fca034aebb487638874b5c4ce757fcd
SSDEEP 98304:o+0gMLgaT5/IxbQf7RKjhMFYfNCGw4CbRyblGCBX8Qb+RipaRyYjr7bHytq:o+0gMLgjG3Y+RipaRyA7jytq
TLSH
T163768E5672E400A8D4B7D238CAA78513DB73BC554731DBDF06A0966A1F73BE08A3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SelfProtectionSdk.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\SelfProtectionSdk.dll
Size 4.6MB
SHA256 09b8ea52a6950390fa1f96720f0c7b4c527631b24d27466e5f9e5952701dbc0b
MD5 9466bdc77270fafe1849911257d1b2f9
SHA1 4b6f98d87da1b31cb788f202617f567e200473cb
SHA512 de9d02a89e20fde5777bc591c647871689cd9f0ed07d5aa3b483accac897eeef536ebc56d732349c0ce6eea233e117fbcf131e83877d66281424772aa8b4a7cc
SSDEEP 49152:VvVNraNCw9Vjvu1DPcFFiIju4Bn241fvX9MDwKDKGMsWOVRtPGWzU03LcZdkZH4e:Bw9UqIivGDcsWoO5xZdkU+3
TLSH
T1AD268D17A6E601A8D876C23889B78603E7B2BC1147709BCF0A6496792FB3BD1573F714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SelfProtectionShim.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\SelfProtectionShim.dll
Size 4.0MB
SHA256 ccb4ce36aa0887ed1017abd15b1019f31a8fe2c1afc55a6a063d94142d7483c2
MD5 d1d035f3ad7cc27a29e0e80186571c4b
SHA1 37a42f712a8e847f8d575613b47962c0f3c28f3a
SHA512 f37523a83d0a41ef128b8d731599e26be3dfdb868c6e0f9068e5318f038cd59d72700beab772814d4d2ebc69657d3173bd3c596461473a25cfe9b10306733e82
SSDEEP 49152:8EWWy/r6DbXWDWVZ76nXsLLeLWRBKI8GUfdgTyQWVp1CLrNSJPCqwzUyLWm:3fXWsDY3dgTWC3dSNm
TLSH
T17F168D17B7E841B8D866C23D85638603E7B2BC2107709BCF16A466791FB3BE2563E714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sentry.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\Sentry.dll
Size 835KB
SHA256 9d4755583b971d282747bd9c024a4cbc46262573465095a383341b55cc5efb72
MD5 72dd440c2862913e7b2b1b0df97f1afd
SHA1 09a08d6791ef59b6c6a0d99a3510af73bdf260b4
SHA512 974668870c4288cd257ae1c72b6f4b11e77faf1fe00ec518f18cc5ffad79de9f983ba0328159e06320bfce1bebff7bd67a06ca18d28da55d15deefe3bfb146f6
SSDEEP 12288:9viEDdBXBL8cTitI9PrTiU5OrTYT0ffg+ZO2gehC:9K8HTH62OoQo+ZO2ggC
TLSH
T128055A4127F8D73AD4AFAB30E87855580FF6FB1AA566E74F0608A0AD3D973418E40763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Serilog.Extensions.Logging.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\Serilog.Extensions.Logging.dll
Size 55KB
SHA256 9d020da3c58f600868e08f912833550ed240976da0804a787d2a1b95fd4c4c93
MD5 dbec3ee927277dbf881d26687086f32f
SHA1 4d213f43de5bbb9baffbce709e924073949f6516
SHA512 4d310bdc02668b38d5c1341b2e45b92c0d5a1db400462a431415d7e7e0f08e9bb954f3976e14fcb5a13170446251365b4ae24a94315591939dcf20b1aca5c233
SSDEEP 1536:R3dvmGCZDFPTwYP7RiWzOuLuha9nfILO5Db:RnkDFPTHPxz8s
TLSH
T12F438E42676C5722DECF9F31B0E4CA92BB35D3A37821D6853898E2904D6338167B527F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Serilog.Sinks.File.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\Serilog.Sinks.File.dll
Size 63KB
SHA256 7485cfb8ecc209d2369343eee308d199879ee0faa68f3398e14efdbdf80f3f90
MD5 bd67f2870730fc11ed06627f47dcf245
SHA1 6dbc730b0fa4aee1ebf4536c54f68232362f5c68
SHA512 9961c119900419ea3b6745cc6636cbd35c17f3fef8c1e8aee2a73ef5275fb3716ded2364438797c262c4851311f21019297480c64a049fbb08df4d2e906c50ef
SSDEEP 768:PrOrAAt9tu4wjf82XdrHdDQ7cRAPUWvXPomsA6BT5YiRiPm5AL536R5d6R5/XT2e:P0Dt41dC7cRbVBd7RiruLuha9afILe53
TLSH
T113537E96A7EC0317EEDF5F38B4F0D9532B35F7E3A821D68E209482944C62B81175536B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Serilog.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\Serilog.dll
Size 186KB
SHA256 f6081bd5cc5c9a5c2fa6ad0311a3ddfe3e42de842678b65abcafc51c5ec842d5
MD5 77777fc43a18f02f20da0c7882098b1d
SHA1 1c67c166ad31964dcaac1042861806abbe3a79ec
SHA512 1bfb8f45929e0033e12e1f2a7fc86cfd40ae97a610317caeb639e8360c36d642284ea3ac14514b2388459e194d166a3d11786598a2f56b519e55ffcd4a0a4a74
SSDEEP 3072:3ojNje2ueNclPk+lbsdAz/SnSpnf6G9Hk3xvVbXyMc6f9MXU4JVCnewB:3ohje2ueNclPJlbsAzSixHW1Ti7G
TLSH
T102147D2A73EC4A76DADE5B7DB0A091442B31FA5BD427F7CE680CA5F80913F855A40327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Swissarmy.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\Swissarmy.dll
Size 5.3MB
SHA256 9ad52208d95d536dd1dd77c9bd118c7ab0fffc795a4f0875fa608544d30bb931
MD5 60d217257971f73714b8c5e398d461dc
SHA1 9906053f88d7a409e8ba874aa9f66e5ead73c961
SHA512 8eb3304e904af5847c6b2cab99d1d3690b5b239fbe85467d164ed29a714f029ec163f467a7bebcc80e156e0d291436306145a2ae68766613f5a6b30f316b0250
SSDEEP 49152:5LG8qKNFeojCOg33h8pRdPSDIGRmqiZBmdWZyKYbHkEAoXvEPj8QF9yllBpP9aze:Zfex8pCIQbWZ0kd8xTdNhIcPz
TLSH
T1E3469D17A6D500ADD8B7C278C99B8603D7B3B81553319BCF1A64522A2FB3BE2573E701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SwissarmyShim.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\SwissarmyShim.dll
Size 3.8MB
SHA256 7b7bef24ae682aed60edf136ef817d60b7b1a02e3ad3f86c7b820cc502e4edce
MD5 07a16e004bdc32df788c0f7144526105
SHA1 de6cb075bc813f25aea014eba71b1127299da2e5
SHA512 c0f2db7f9dc6b7e5575f4a7b5b5d60aa032777e3a9994b534651317326e4ae6721527422d9001fac8cf4280fc7876dd8e1f321a7ee65e3394417982b0373687f
SSDEEP 49152:s5AWJyZyVe6ZGVE96H+KLNjU1BWIaDLwOx/AJJKFS7JkC3zly0IPLRzUgT9dmR:bUemgTTwOCJJRDqyg3
TLSH
T100067B17E79940A8CCAAC23C85978607D7B2BC127770A7CF16B466691FB3BE1123E714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Diagnostics.EventLog.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\System.Diagnostics.EventLog.dll
Size 172KB
SHA256 9177c5434d2872741cf7a80e000c52166fed8930d07ab154c6a4d476d01a9aaa
MD5 74de4396506a13ba8bcbbe9d445e53ee
SHA1 0fef9f1f91de802006f20c019c9d1a2899df0843
SHA512 42a00206c4f43ac589aaec7d06045959cf47fd58caef55d91801e88010c454fccf6451a525a8a80f7ee4eaa1813cd7b832f975f494f11802c7622bb4ba552adc
SSDEEP 3072:XhV2mZAS5h+Jp6l6XPSlzOR5KkORMuPYHgDCaTd7brDHbh7oN+r65k1+EK8IFxQX:XGa2tPgDCaTd7bvl7o+25k1udSOk
TLSH
T151045B3873E84B0EE7FE1F38F4B160194736B5A6693BE36D458498ED0563BC09A20767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.DirectoryServices.AccountManagement.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\System.DirectoryServices.AccountManagement.dll
Size 297KB
SHA256 721a82b65516782f57f7fbf4c9940c016f8c1a209d5fed553b5044c45485b8fd
MD5 1f873950cc7f0b618f60b2480af0cb2b
SHA1 f19815525e195507a3b0ac715f8436e0ef77f4ef
SHA512 9941dac5b23bf3370743086ce0f30ae0ddd7aab414c2892d9ecdce2da0124a3b13cbd395435e9751f7720bff82d685ae39c9c737a65049fa2a7e6667165d7eae
SSDEEP 6144:B2iefgF6OdLKeKSxviFfK9qTLXR3TN7XkA1KydWI+:BJUOdLuK4TLXR3T5m
TLSH
T1F754291033E80A49E2FF2775A4B014159B79BB57A9AAEF1C0D7314EE0873B81DA60777
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.DirectoryServices.Protocols.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\System.DirectoryServices.Protocols.dll
Size 178KB
SHA256 fc0f22cc109a429b68d3d83fa48067166452942c25a7acb9870bd78a801cd8e8
MD5 2006d42ec419f880c98bbbbb17f086a8
SHA1 a865ba0595fcff5e045dbebd0f699f52fbb13ebc
SHA512 354b95400724606e10507031669b847291c801d1503b0d72442db95f7b4d904347ee7f8584dc5c278736dd067d69009109c7e8c40ed47c536b9405e75a6d7cae
SSDEEP 3072:l9THCcJnTPM7fqVCPecdwTPKu5RmX2wvCln1yZimWunuk/cD8IUt60ZeKFTpH4g:DTJsdwTPKu5I2wvClnlmWu9IJ0ZeKFZ
TLSH
T1D1043B1433FC0B1DEAFF1B74E9B051208A35B946BA3AE72D164544EE1CA3B809762777
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.ServiceProcess.ServiceController.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\System.ServiceProcess.ServiceController.dll
Size 90KB
SHA256 3961824bc760e2e5433c8bec08f85bb4c391ef545a1bed524bcc8cd4217852bc
MD5 2263fef1a310e9a813067536845bdee1
SHA1 29bc27e783ba51124e0e5baa81f03faadee69da5
SHA512 0e11d70d9cffa8c9ecd07d28669307793a77fb96c6ef17a6be9289973718ad91ce08ca654675bf5137de281c432066ed85388ef479b314948457d8eeb10bef74
SSDEEP 1536:8FHy6KWI+phJXYuk0wN7QvxG1TbUcWxaN0pg1bGgz2:8wII+pPof0wN7Qvx+uxaNP16gi
TLSH
T15E93F70163FC076AEAFB1F747CB161520A35BD46A935EB3D15C8419E0AF2B848A34777
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TelemetryControllerImpl.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\TelemetryControllerImpl.dll
Size 7.4MB
SHA256 f38d5b96f2184a5a9da4a7ebe2bf8f1c7c0474a608b7ddb47ae47c95dc1739f6
MD5 163e03d469fc6c880cde9ad420efb088
SHA1 f255082961a5786964a10be914e806ca9e4cc574
SHA512 7c055aa5a4eb27c4b24f3ab163613005f865171c6080079a89496b70d54dc29107b7773ca98d918eb5ab8a8ff46834b42f1fb2f829fe82f2d372ed88269b4387
SSDEEP 98304:3Kr9jjAMHN3r9MyrdgA3TmoBKJOPfantuV9BUMJ8zjgpOS:kvAOr9MKguTmoBKJ4ynt6B8zjgl
TLSH
T15C769E5AB6A800E8D8B6D23CDA578513D7B3B8155331D7DF0AA0967A1F73BE0463EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UpdateControllerImpl.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\UpdateControllerImpl.dll
Size 4.5MB
SHA256 a5afbc290f4d9c9f2adb96c54af150459e871c990c5b9ff094e4b6c565a6d662
MD5 151ebc1d4359f883637a951b715d064b
SHA1 11a536916ac913746eeb78bb8179dbf777170f9a
SHA512 f5094172710739ca2a3317d3b35df75e4f6bba3f231ce58e2438636cb2cf617a531c17b13070cd3811aafbb01259e5da9b78d59bb81bd05c61177049f205da12
SSDEEP 49152:19aTwIfa16M16xKdOiB72OFFhZ6mqKRdxaBdxYo0b7Mct8P+ZQFHyPv8ZhnBW8:1dEGJ4x+boctG08ZF
TLSH
T1EA269D17A6E900F8D8B7D278C9A78917D7B3B8150370DFCF16A086691F637E05A3A724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VPNControllerImpl.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\VPNControllerImpl.dll
Size 3.5MB
SHA256 9b2b33a5c58a3e95423f5f3cf4d0c53b27ae4a399c72de90aaebb6b6e000b17a
MD5 93bc933c0188b182424b8ab87fc7e635
SHA1 783d97877ad1344a49e4c61f7c65f2c9ee2be63a
SHA512 3fabebe19ba4d28ef2eda395c2c8c0f256a89959d215529b7226162a940d3ae75edea78083f1f614205da5915d3bdb5c8bcbdea80479180e9a9ab81916bd8215
SSDEEP 49152:lUh1BFqcsDLEh7i2Tlu1fVPicc27eYv3OhJBwzn5QOZFFRPtdPSnZnZwCAMxM:YvKRziO5nwnZGCAMxM
TLSH
T1C5F59D1763E600F5D8B6C23889AB8517DBB3B8150371DBDF0AB096691F737E0563AB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ddshelper.bin

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\ddshelper.bin
Size 1KB
SHA256 99198c557b03b24dbf40724c62c12c8c039447afedfd109e20061288963d9454
MD5 bdf8a750ae5ff4858b88f1a0f729e4b1
SHA1 f27c3c54473eb6787614a137af1f9a34e67d2816
SHA512 187a178c872369032f2e4beefb9000cfa7ed97de184495ac06cefeaa4deb77d5ebac008685bced49203840bafed719a0097d3f32708989ca96acbab51812ce2d
TLSH
T106118C84C7A838424CE0AC06CBA0F42A0E45709717B65A4C96B6C669C1AD13C0CECFF9
MD5 SHA1 SHA512 TLSH

Submit Download

ddshelper.exe

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\ddshelper.exe
Size 253KB
SHA256 d2257e7643128166f46a88da45ab9c38b7c23d0d727551dbd9f780a43f4abd11
MD5 10bc07abd8ebae1c977a9b2f32b8c788
SHA1 55bbf844af546c27289cdb53fe9f05a31678d410
SHA512 6ba48d29073b49cc0c3acb775dee91b8532fc75f0b41b8a84a40ceb8a4f84a8ea918beb3b9f27dfb368480c4893c749979e1721895d27bdfc6e686f16e8eec1d
SSDEEP 6144:jC+kTECKVL+F97/2uXWbXCoReuENID4eH:j/kTIVL+L7+UYXlROIDD
TLSH
T1A0447C1473A108FAE967C631CD92CA13E27378514B34E99F436086729F37781AE3976E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e_sqlcipher.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\e_sqlcipher.dll
Size 1.8MB
SHA256 89a32e6e7d87061e7d026e6eea4bbd5e7146b544b044c7382e5df8d1ef58b294
MD5 7895b679e6d5a0c1d110e9d63485006d
SHA1 826fb994a82950fb2d2685116ec0aaa50b823721
SHA512 b0b10798c7ad5b9fa6cd6e86b194fea11049dbfcf9d3a17627e2ae773163c8924ea520a9153630d4503be9a154599b3c4601d061b9fbe5cae910d07a58488a09
SSDEEP 24576:mvKRx/vwkwBaPd71Oy+jTr0vsJhXVu6fITQvipJUasZBGoWsXCEwnP:m6N+a1O3BJrATci43qsfwP
TLSH
T16A957D0BB2B900ACD9A782B8C517970BDBF1B4151764ABDB159086652F23FF61F7A330
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e_sqlite3.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\e_sqlite3.dll
Size 1.8MB
SHA256 c47b69544ed54a1c34ff0e7dc47764bdc7aa72b92f3af3e89fb1516969d7fe19
MD5 a0ced78ac43ef74621e8fe7f168b50c4
SHA1 a863ccbde7031448a6580fb0f4b478247dc6ce1f
SHA512 21fe833d85c7681761ed05b652ccea14975a9b47ae0c5b1f09b7e7e2c1b38a58f2e31920997fc7385cc7c7485f835208b883b5ed1733084484aed8e24da7d422
SSDEEP 24576:p0QT9LAXxkXe4hCk8tmg82mhJhHE6+YPk1Ic1J+6K/H+gmnBaTpmIzgz7QThB5wJ:pF9LAKCk8tTEHE3YcviCaTpmvHQThB5G
TLSH
T1FA858D4BA2B900ACD8A7D2B8C517570BD7F274151724ABDB15908AA52F23FF61F7A330
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mb5uns.deps.json

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\mb5uns.deps.json
Size 2KB
SHA256 dbbc5441a58be6084057667a83cafc0af9b3377061a9bda4cfd4fca3b651fc01
MD5 8cc0eec65565f747598512e2bdbedd23
SHA1 65694b215256cd84a6d213a1e3caf047a4838ed6
SHA512 39fc7cd6556f10467f52db40a295ec21bea0aa8b384c2fa8dd5567596ec90004a0603abe380887915628634f5bc624aa8db10cd05e71310d756a6a1907f6ec9a
TLSH
T1AE51BA18F6946B7742B2B7A4A87E4541F63503372004248A7CFE245C4F76BEBA096F35
MD5 SHA1 SHA512 TLSH

Submit Download

mb5uns.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\mb5uns.dll
Size 1.2MB
SHA256 c1fc011f00bd5aa486d93dbcd33ff536b0d1d9b2f24db3eb3042168ad9c5da97
MD5 3becd0f741e2d29ffd8ae4975de5b2d9
SHA1 12edc4bd1d473039987af718f13486ac0b721d9f
SHA512 a2726ecf6da8426e954d210ae7f990eb1a5d0bf5b43da1169fac04bd63159bd7d34b34a5bdbc5e07ce615c718aad5aef6b7e0622cc850a0e3af77f86d2ce2895
SSDEEP 12288:JRBKyu2f4D8825SUdyTYwCSP36iQuHAw5baV:Jy2f4AjyswCSP36T
TLSH
T1B3556B00E641A658C9EAB2707C7CE37D19B4EC2DFCAA611674E5BB3115F4D00AC69BBC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mb5uns.exe

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\mb5uns.exe
Size 326KB
SHA256 bfbdad2fadd16d6546b02a4439b047d1ef54acb5dafa906a2cf6f0b1a349ae08
MD5 af995e84c43ed7a54561ff72f632d28b
SHA1 df59937abe70e42238ce7e0597c6449d0ec431ef
SHA512 e0726dc450a4a59d0c0e401acfa3567bf9316b2edc4a9b1166b658a5609ba269e672137e07aae5e0ea504be4ddf0f7dc740ef9a0e095c05589a07a5fd5c19c3a
SSDEEP 3072:rXwANETcQt1Onb5RHrfqDQXFn4dPPYseJwmZf2jT63b9lFYmHl5rbxBTXY1:LlxnlRLfyQXN42D0ahYmFTi
TLSH
T1A3644CA3A56841DDD4BA96318E929910B7B13C7D8BF162CF87E075690F72BC06E3E305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mb5uns.runtimeconfig.json

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\mb5uns.runtimeconfig.json
Size 623B
SHA256 4afc3f604abeed8ce727030cbd0445cf645e9d4990b7913156e80db61e468146
MD5 eadd0705db4200aca40973a1559ea6eb
SHA1 ca23fae378ee2f47d10aa704faa96c1ef41d055b
SHA512 5f82da8e1bc2f131d6f9a071b1dc8ab901d1f789ccd5482440e4e23ef5c802edc06f042cbfd9aee3006ee526fcd53b5a8c5af1b7a927d90f785a7e4833f3d1d5
TLSH
T171F0F679CA106CBB18B9327ED529C582EA34532B10041D56B5FD081C6F775B51222F96
MD5 SHA1 SHA512 TLSH

Submit Download

mbae-api-na.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\mbae-api-na.dll
Size 723KB
SHA256 6aee09c65a2f22658a8a74459df2b9df5c81c5ec7d853e496794ef6f52ed8924
MD5 53d9f6d408d43a8b9f080b87ac0df146
SHA1 1e6c7befb2c68efc87508c705cf72427cdf45370
SHA512 b4db12bf61ddcf16ff14ea245865b2aa0d71efba17fcfd36d64d47707f6f497170f19235dc8bf69e3961d8072743f27cdc343f228f331d6f27c41ea07be11b7d
SSDEEP 12288:LFvU1Pr3pBWtftHAmoLdkm9c5Wn2VqK/Zny2E3vFn+hPraFnPFN:ZvUtKtJAmsdjc50iHoZ7
TLSH
T14BF40819A3AD02A8EA77C536B663A223FF7334541B70BE8B5E108E395F31760963C751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mbae.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\mbae.dll
Size 1.4MB
SHA256 523a8858117a691eb787348186d038b31cc0e59a9c2defdea11eb0a8fc7f6eec
MD5 e62f405a7682e88d79a1cc8893659043
SHA1 b247dba0bc8ecfaed96019750a9333eafd167b87
SHA512 df98d764a78687e78f0725c9d9a0e486eac619d8d2399a51bd04d44b37539939f5dd51121bf18581bf77cfbe521d4ca34c63f6029cd97bc9d615a525fc25eac4
SSDEEP 24576:WpCY6hJZtbAblApkstSIzNvvaY8wPH+/yRsxGwfCZLKDDgWn1mdsHHH:fYQRrVzN6zZyRsHCZLsJnQdsH
TLSH
T10D657D20B6D5C239E49E02B0A97CEB6F153D7B240B2495DBF2D81E6D2E345D36A34B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mbae.sys

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\mbae.sys
Size 155KB
SHA256 c990dd89b65d35d6c9b34e21c78d96e206ec3bcdd934716ee61ff79da0fa5251
MD5 fc98ddab2223dc73b950622801b31554
SHA1 997faaec1dfd18b9dd31e1c216440a28bc4cd612
SHA512 da08860f8c3d8a9204d1480f33d21f2ab922db5cbbf7734527ed05477c2d9c184deaedb63196876c989c9ff6c1b45b5792661f5bce92212992a7cdb664a793e3
SSDEEP 3072:hcj/Hk4/53QBvOP8JsUrLx1o6GwzfwKYdkXEnU/H0KBJT2:hc4wNQBvOEJvx1o6GwzfwZqEU/33C
TLSH
T1D3F36C52F3B400F5D8A6C679DB669213E6B2780D2721E7CF076085252F673E4BB39326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mbae64.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\mbae64.dll
Size 1.7MB
SHA256 bd25a747e6aaf00678eb705cafa894897241695ddc176b0993904d280a882054
MD5 a60cb38f8d1407db3521adbd7ef30fb5
SHA1 56c5a3348b5bc0fc6892bfd6720bac213a9ca9b7
SHA512 e1d1ee3de6960c74dfa3a44a454bf2872fbc9fca9ec075a66647856fc56b6f2be5816bbcd45b87a702b337c73306c2515ad1e02f18ebd8ba9a2a0275cc86842d
SSDEEP 24576:67QoNWQ11lqWiTLFlRDqgGEQ7rfEPQGWHWe+idhDcEU:6soNX1jqWELDRDnIljHWIdqEU
TLSH
T1DD855B06B7A940E8D0B7C1388967A76BE6B174550F30A7DB66508B1DEF23BE04E3D361
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mbamelam.cat

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\mbamelam.cat
Size 11KB
SHA256 64416d564725416c6869ea951878a2734b1f6940b11f7961a897c45f0d8c6625
MD5 bd4ceae54af081d6b1dd91ff584c5d61
SHA1 5ade462d66e042da58bb1447d1b31f1aad901b68
SHA512 37e7abd312f694ee2c8ea54ecf50ed12c16684f1007c61d9a6d1d01cba958be511c5e4e11cd7393a5cd57349fda1c552bebca42962137e0d11695c195761ebb0
SSDEEP 192:oBxybp/yRpJCSEbhLxyKR/2FWQFdbiI/Ex6RMySX01k9z3AgEhrZg:oLp+eFRvmoMR9zJug
TLSH
T11A320AE58A6C5083DCA7AC6087E8E5D77C3D67C71D00987921DAFB5409933CAFB2816D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mbamelam.inf

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\mbamelam.inf
Size 2KB
SHA256 e26c2d3347e5f077da92713c9df3cd3eae438fb7e29810bd5c3afe567d2d3125
MD5 5d8c05cc4f9b4304d57ea10b87f2dcf0
SHA1 2cabe3d39aa5ec16c54c7818284a2ee235d2ddbd
SHA512 55bff23fee9852f229246b71721b3659c916079787935d400a97641449dfda752fc8fbf36f9ea3dc4028f05daeb9006a99660284a61aa5d5a466af0ee966c738
TLSH
T164410454AA538BB8697B35B81E472883BF5412205076384032DEC8C99B6DF0C93757AB
MD5 SHA1 SHA512 TLSH

Submit Download

mbamelam.sys

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\mbamelam.sys
Size 21KB
SHA256 ded569e249e590314d095f740c6b8934a5a797e4f3edbe0f78eac9d333f12a2a
MD5 8da81aa1f6b89ce1d2e216e3ea351c59
SHA1 4baf79cbade9a5584630a540e6368d547579fb12
SHA512 6d611bbd9d480ef2defd745fd06c4ab86e181267cf689d9d0e124edbaf22fd30fbe2310879cc7bb6dde5bae72c4feea1d329cdecfbf101d95634f85dd0769119
SSDEEP 192:C7IlO/ZnEc+PbYv6/i0RtPH920QvVUKjnegqdsW++w/y1wVWQ4uW/+O68RwX01kd:wIlO/i8ChLIxUKjnev6+Twc69R9zING
TLSH
T108A23B6549780283F6BBC570C7E4C927BD38F39677408AEB0591E5681DA37C2AB3192D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mbampt.exe

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\mbampt.exe
Size 33KB
SHA256 d0d9ca61272bf503b2b49c20c36c34f9ea84238088f86067a0ed913f40f5ccc5
MD5 c9aa483eb726f9c2fdf006fa7db3ae28
SHA1 83d19b5a0137dcff87f4aff8ac10d5e270446637
SHA512 26460e8d81bf8388cc3a469bb2b8a7fcf1ed666ae56a80d8d42f6b297dc918c0feea4efa3a8935dc43501f561aedc2715e120b78bc744a39c014627296c0a07d
SSDEEP 768:oHKf5YiRiSn5ALbQh5hwwxu2Ip4TTxf1mlRaXJrCeG:XR7RiSTh5hzf9xfIYFc
TLSH
T175E27CD68A745802EE17AE70B0E8DA57BD78B7D36990C5D7306AD1810F423C1B7AC16D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mbamsisdk.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\mbamsisdk.dll
Size 12.7MB
SHA256 0778cc030a9e8b7cd66950bf492554842ffb64d8e01b145c2dd9551c9239a78a
MD5 10a694b956d9999531d9a21be1c4f2d8
SHA1 3ac8fd5ae83ab8c42ac335a8d59ffb730628c11b
SHA512 10b8f7c76d30e6dd83c360712eefb36d71b285a507944438d0b4d0645b01c74f2b12d8892a73ba5ee60b67081602a88b3ef1343d011a23fc958e7733c7a14c0a
SSDEEP 196608:3LYxLLbdfBrYViPou2HocTCG/K5GLv7DuJHSWSbAZlyX2pD:38xLLbdfBrYVi96uG/raJHSWSbAZlyGh
TLSH
T17CD6AE17BBD540B9D8BAC23885A78627DBB2BC114730D7CF06A4566A1FB3BE0563E314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mbcut.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\mbcut.dll
Size 4.2MB
SHA256 cc9b2f7379351f5cb246fcab1823962716c3b90dce252292f3c7fabf718a0c23
MD5 e10fde737021eab76462e4f0fcd6548d
SHA1 e24fad860352bedd64aabced856404ab09ca94ab
SHA512 333ae97d9238d925e6fc3dd254d93f3a90dcd7a694e3a8487b20d257e9371070641d576970a17a27dab4f97780039f1867d90dc80365318a7ccb1fe0b196edc9
SSDEEP 49152:LsIdWtjIxvFfomKYsEwpmUeT0MSD1TX8jmxB5sVvXsuY2AYuSHyp4DZePe1zU/6n:LsWGqfrKYepmnIvqvXTAKWydzkT0d
TLSH
T153167C17ABA501A8D8BAC23885778603D7B2BC1147709BCF16A0667A1FB3BE1573F714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mbshlext.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\mbshlext.dll
Size 3.1MB
SHA256 8af36217efcc1b2a677accc77839ed3b67ddbfcabfa16caaa42c7e95796b940a
MD5 d82467d25954c9fbaa91ca97e0de6834
SHA1 d7da2b4f83acd0d2aaf55de2ae403fa6cc44bfc6
SHA512 84a38b2d4a1b23439f4c6eca1fc148d618effd1444704f37e5812488877d15789b603944231281299ba332dbd0d3a0e51160c588c0adc1bf338675c62da45aa4
SSDEEP 49152:zHsR0cmbmDszn14AcKLfC659mLVD+Bjmo+2g5rCdPWD8i51l3z:zHBpmj2Am0D8g3
TLSH
T169E54A227A9540ECF866A23864FB8502F6F27A05236097CB0558727D1EEB7F106BF7D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mbuns.exe

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\mbuns.exe
Size 2.8MB
SHA256 17774de56e1a797c8bc65ce34df447ca5672667593cb4949ca4fcba60286dc39
MD5 3d088b6f584c14f22b8418c7781cb397
SHA1 50514bbc6dd253d3a622a2bd22c8e37330ced2f2
SHA512 81047da42f8b9a6120e55b65ad7a71e34558bd36abef255626f329e38d58810990766c8deb72bb13d12c8fedb7816dfb29a3e87cb320da1a0011fe08720733c0
SSDEEP 49152:RZbqCBYy8XtNnM2wAeyfvE0Z3R0vnxn1o2d5XQ5:rOCBYy8XtUAeKtEnW2fk
TLSH
T1ABD59E31B2D18120D1B3D270297EB7EA5B75BC256F76408F32D8BA390B725C09D75B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

offreg.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\offreg.dll
Size 140KB
SHA256 8e6c155a97666c8e6a3f9ea95bfc6f6e4f87beac53dd72164aba3ef33ff88db1
MD5 1659738d57a15a0983f0373b2faaef45
SHA1 efd4cd05ff6bd787a2ceabfd11daba1c0e475855
SHA512 4f62cfe0579e1aeeeb30edd5f42a2b1880446dd1075be051e2e0189da5071f9866e5425ff85547486fd7d952a28efa4e784db0cfdc1fcc428b34eaa89c6a7654
SSDEEP 1536:kXNnhdTcQOCr7LClg5lSYOurIt/0q9mrf0Xp2N7RibuQusR9YfIZRoU:cnXTcQ57LClMlSYA0q9mrf0XoNHFQZ3
TLSH
T111E39D5A73B420A6E8678678C569875BE776B162232087DF12E5C6B80F037CA7F3C345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rtp.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\rtp.dll
Size 4.7MB
SHA256 097e0ed92d8be255eb954014efd0a54a3a20de5fc50b2c7b82157a6a2007d081
MD5 4a3be7431ce88b1dad9e3b60ffa61c96
SHA1 a95bfc07f66de2b917a5ec58e21dfae4fc2f30c4
SHA512 e901e431adf6b0d32eecdf1328c6b5905ce8cc72186162c178d1d1a07efc60832b73f0f7586c3d8a816b30ffdd02bc3d44d8aa4025e728edbb68dac21b960034
SSDEEP 49152:ClsD4iHitygEQR6sn+MK/1mWB93Fq/p1/M9CYh8EXywoDdWJKPCWzU3hzd0vzyAP:/HiDAFMpy9ByZE5Po
TLSH
T1DD368D17AAEA00ACC876D23885779503EBB2BC1547709BCF0A6456692FB3BD2573F314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sentrynativesdk.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\sentrynativesdk.dll
Size 596KB
SHA256 6e6096dabfe6b34c3e6ccba49cef544b7be6158e34168f819f8cac1b3645d4d0
MD5 efba4bdd511e95708c555984bd21c2bc
SHA1 dbb823e9530ae40249db0bb8b85492ad1574e8b4
SHA512 058110541c3cff39a0a3c136b6eaeb01896e04bf192d7138e0cd680203fd7b0d05b056d90fd0956ae537329de5c6ff1c666704c568b73554fbe4e56bbbcc8c8c
SSDEEP 12288:m5Hiqt9csEXkXfE/gv9DL+2/xzEdqwuKyCCGBazBWXsCjTls:m5Cqth3fZL+oxzuqwBCWazBWcCjps
TLSH
T1D8D47C5A76A803B8E07BD238C9934907E6B2780607719BCF03A057A76F27BD55B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

version.dat

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\version.dat
Size 10B
SHA256 4437e45fb7a59131f13d6dcedb778bc101fc08cca16448e4d81809383dff57e3
MD5 31513893e531ae442d371097a245e844
SHA1 418d4d1aacfd171df916bfe6ee39cd2f47e41889
SHA512 923b55076f83fb7df98ac4d4b260c7365086a8c444b26a5929b900c490fec7d754f1993849274af2666fed75d0c533537283b67d16c937cc55b4af6f9c254ef6
MD5 SHA1 SHA512

Submit Download

wireguard.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\ctlrpkg\wireguard.dll
Size 1.3MB
SHA256 d2ad6ce25634776f5067fd9d5750a5e3d2add1adde98eb1f56a2df194d0e9cbb
MD5 bafa63cbef47269e12392eb29ff87070
SHA1 a5814b3548010dd3e3413835bdc0590f726346f6
SHA512 95290f78b4bf8d98e64c4c5280ac334bdda56265fd88370d7ba2caec93c776a13c33105fbd1c9f9bb8189d769415b95ca5dfe74f7276065e619eecee5dc07e76
SSDEEP 12288:DUenDNpq9bKeKqM7cyOcN7kWCEKI2ExcN7kWOpPD:9pqFKew1N7VCEvcN7VOlD
TLSH
T1C055AE41B2491B94D4A283FDC9E68175A67ABC145B20CAFF0034F2686F73FEE9476E11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ActionsV5.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\dbclspkg\ActionsV5.dll
Size 6.1MB
SHA256 f2dc3b02c39cc92b945ebffc0be675251e93de87158eaf47bfeb5c3231488173
MD5 d2ddd6f0a411ecd5023812336c7c386f
SHA1 7eac246c6bb316814439d9e124d8371f27bb647a
SHA512 6c2b3b4f4802670a1e461c6035a9ea32eafd653e7d5c9352b92fb0e27e3e1f5de178f02fa6875ea75d247f1545065e35f8f1d27105912ba7c19dafb24b535602
SSDEEP 49152:7msy+BT0cuT6iMx6RqDX1aldmjrHPykS7WbQMB4wpZ4fKBj+Ae+Ysyg1cqW1wyT5:trTQNPYrHqe3le+jyTwyvbKIf/j
TLSH
T15C564B16A7E802A4E0B2C178EEF79103DBB27C255735CBDF0190525E0E73BE19A7AB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BrowserSDKDLLV5.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\dbclspkg\BrowserSDKDLLV5.dll
Size 7.0MB
SHA256 c72e39709b26ac7577200a76515347ff11c0a9424cf61657762d657e7aecd974
MD5 36b6cdd3677d6a079cd21768ffacbc7e
SHA1 e525b6c778d7b59ef06300cc980f63bcf581a24a
SHA512 e106563a21063eba244b536e67ececf2630415d5857af8aa67bedecabb39a87799324c3024bcf84487fbd9cfb76dc24b27ebb881734b4157a38b5c74d538ec3e
SSDEEP 49152:8VF1SVg1db+wMSI0nW5xjpvypuDYpsD0VXZTWqls/e9uETWgjB+S/YfbWf2zv7je:s8TeZKT+X6S/Yf6fITlRChya9Fx
TLSH
T113768D17B6A400A9D8BBC17CCA578603EBB2BC06577097CF16A4966E1F73BE0563E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Global.nm

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\dbclspkg\Global.nm
Size 349KB
SHA256 eb356dff7855221f5e5c65986757625f0305dd2e664c9f1ac67de98d76c1a18d
MD5 d2a42ecd65f3f0c13dda27d116d2b8c1
SHA1 5af10dab9fea56db95bd4071f3dfb9dc4826f5bd
SHA512 19f25a8ea0ab028a928ee2563a40132af4ec789ad291d93a10a3d0396572161db925096be0a815cf702b6da2025cce63942f5ac46d7adf5fc04fa238c58c93fa
SSDEEP 6144:Jhbwrwj6aYsFylzad2VmYmWVT+Tz7IjmwIunxaQIBE4+gtwJ27Ntk5bivoTthyeC:JhbEwj6aYsFylzad2VmYmWVT+Tz7Ijmh
TLSH
T1DA748BD167AE2354F5B2EFB41BA0DA25597A6CA2EF00DB99D302145B193DE50CB30F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Global.sr

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\dbclspkg\Global.sr
Size 21.2MB
SHA256 df80051a71e07d2f415ae60fea40f0631869b76fbb1eff08c8f53e55f397cf2d
MD5 ab62754ef5ff2ae9c7b4b92ce35d1b4a
SHA1 135da2aef03ec3446ec072aeef755923dab78ea5
SHA512 f4bf22d4235fec9aa7c56d9cbbd83d733d930d70887ac018f64d1f7f9db6d5566dae8d4e97425e2c2b26b3dcd6536408f4ef07330e01ea105a783a91a51178be
SSDEEP 393216:1rTz1Lj9cvXmxQN16Gxl/qg79WgoOv+zK:RTz1P+vX8QtBEK
TLSH
T10D272327FECA2ABBE825D7BB468E8F754243E76119138505FFF0069EC24C9559F29302
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cfg.bin

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\dbclspkg\cfg.bin
Size 2KB
SHA256 a4d54bff6782b5e7cc3d59ce8ac7f1d9a80fd5eb045d0fe8ff3ffa110f609e73
MD5 4529d759488cc5e9a3c2ec5c1fcb65ff
SHA1 9e11b3342ce26ac669189b9cd9d742d84724f245
SHA512 8e61360af311bccfdc257a9ee1b60b4bf111cab7c10234863a3b5d85e4847d1e7b63280c9dcce60a52ba7626914ad81230e33756e175e1a1948613fd6e2b2978
TLSH
T19E512B153F508B70C1377A79D71B463DDBAF451921021DA752D7678AE8F58BE2C33444
MD5 SHA1 SHA512 TLSH

Submit Download

clean.mbdb

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\dbclspkg\clean.mbdb
Size 21KB
SHA256 e3d0ba41ca3ad9ce8140880cccf27498f4d44629e7eca40f0c478e266c919a9a
MD5 55d281d846022bac2206c4d38238c70d
SHA1 be5e66132db268dbac6777dc3a0e0faf546a4938
SHA512 3a0caf265c5b494a659ecb64f30631b8254f0a3918801d67512146828f1bce0826160532d2855d54e8462ea7be341a5047c995fe01acb13466988a02bb728bfd
SSDEEP 384:9/4jpjXLsTusvRXBUSiUntKZ9BUfdi690fBiZvFGj3+1+G1KArOte6:9/OLsTPZXHtSUO8G+1+aKArO
TLSH
T141A2E13E53D0AE2B01A0F2DA7D7282638B1E296A43E57EE980C619C0159C6CC1A56DA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbmanifest2.dat

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\dbclspkg\dbmanifest2.dat
Size 924B
SHA256 8ac2d18ee234fff31be7142e2aa3091b9d9bdcefa2db88cf146e046db85eaf7c
MD5 8a182172dcc6d4de3e998dd0836c3a43
SHA1 05cadc7bedfd05ebddcdc6430d8f08f4624347e1
SHA512 71393b1dba17ec05c640f3719e075b7ade84c32e638573bd58b09d3934c0ca7971e06443a4a9139179b264eeffa9e04082c0ff7b1bfbcf0772b819bf8fdc85ab
TLSH
T15B1154A2C56320EB053FE669641412EBC5B6C1E76AA956D5783658C4A90462C11384AB
MD5 SHA1 SHA512 TLSH

Submit Download

dynconfig.dat

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\dbclspkg\dynconfig.dat
Size 39KB
SHA256 008254ca1f4d6415da89d01a4292911de6135b42833156720a841a22685765dc
MD5 10f23e7c8c791b91c86cd966d67b7bc7
SHA1 3f596093b2bc33f7a2554818f8e41adbbd101961
SHA512 2d1b21371ada038323be412945994d030ee8a9007db072484724616c8597c6998a560bc28886ebf89e2c8919fb70d76c98338d88832351823027491c98d48118
SSDEEP 384:jNOT68xDvtG9ObE7L8u8sXNVkIfvs4FRj:ay8u8KVkIXsWRj
TLSH
T15603A21266FA1001B1B36588AEF28570DB2B74D965399EBF00C5464A4BEEE40BC53FF7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

exclusions.txt

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\dbclspkg\exclusions.txt
Size 23KB
SHA256 9e87e4c9da3337c63b7f0e6ed0eb71696121c74e18a5da577215e18097715e2f
MD5 aef4eca7ee01bb1a146751c4d0510d2d
SHA1 5cf2273da41147126e5e1eabd3182f19304eea25
SHA512 d31d21e37b0048050b19600f8904354cff3f3ec8291c5a7a54267e14af9fb88dfb6d11e74a037cc0369ade8a8fb9b753861f3b3fb2219563e8ec359f66c042db
SSDEEP 384:OpHJUPIIawosLqVqmv4EHUtVbUQIKiKn6p+C+vNCMSP+TyHS7ivS/6:mYmsGfvSp/6pzgH4cyH9E6
TLSH
T1B5B2D73A1CBD123751B4C6AACFD58877F640E1A7316A183A64D7874987CBE4329C31BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igV5.exe

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\dbclspkg\igV5.exe
Size 1.8MB
SHA256 c3913062dc7cd67b009244db4acd7a265fc2116515adb7d7a4c77bfa50c44433
MD5 92c4c71a33a6596c62235bd604d992ce
SHA1 f802dfc22086e266f09d0bdd0974d8462968eeb8
SHA512 6161d49ea09f7df30d328d50ef9436da0e44dc493b5dd96522e5c3a1db940e5e083d0fbe0f140b3cbf0d5586dfeb5a6514ceb379bea54ea5f5fef51d9df1c268
SSDEEP 24576:2Vpw8j0kcU71dHGvPKN8kP95bLS0pBm2L6y1szQGfthuTVHzw8mvP:2l0kcOnk88kPt7+zQFZw8mvP
TLSH
T1AD95D820BAB6414FDB9916B82EBCAF9D22AC69490B6059C3738C975D0CF11D344FB376
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mbdigsig2.dat

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\dbclspkg\mbdigsig2.dat
Size 514B
SHA256 00f9a0ec6ec4f75e5614820b704fd0b6eb900057c763228be4e00c5cadd035c1
MD5 62c3b8bbcd69c016dec3f05af2654cb0
SHA1 3da99baacaa6bd4431b6e531ac971eccf6d3f25f
SHA512 5b1bb94ec9dbf93048056f4f2f8bd2e7b8dfe09d06934962b3f8074ef995129a1c6b02504f389c6cbc1482df9b828f0ee92a60236195c883c2a6090e9daa2934
TLSH
T12DF0C928801945DFB64022E36B5A8DAA62526F220EF4CA5220D4F49229BB6A41E55A6A
MD5 SHA1 SHA512 TLSH

Submit Download

prot.mbdb

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\dbclspkg\prot.mbdb
Size 24B
SHA256 6089fbf0c0c1413f62e91dc9497bedc6d8a271e9dc761e20adc0dccf6f4a0c1f
MD5 546d9e30eadad8b22f5b3ffa875144bf
SHA1 3b323ffef009bfe0662c2bd30bb06af6dfc68e4d
SHA512 3478f5dcf7af549dd6fe48ad714604200de84a90120b16a32233b6d44fa7240f5f4e5fe803f54b86bbdfd10fa1bfdd88fb85eb6a78e23e426933f98d0a2565ec
MD5 SHA1 SHA512

Submit Download

rdefs.mbdb

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\dbclspkg\rdefs.mbdb
Size 24B
SHA256 850a4ea37a0fd6f68bf95422d502b2d1257264eb90cc38c0a3b1b95aa375be55
MD5 2f7423ca7c6a0f1339980f3c8c7de9f8
SHA1 102c77faa28885354cfe6725d987bc23bc7108ba
SHA512 e922ac8a7a2cde6d387f8698207cf5efbd45b646986a090e3549d97a7d552dd74179bd7ac20b7d246ca49d340c4c168982c65b4749df760857810b2358e7eb69
MD5 SHA1 SHA512

Submit Download

rules.mbdb

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\dbclspkg\rules.mbdb
Size 6.6MB
SHA256 2776bac1a1bdccd83caa5efd529ad98f294ac4ba53ed1628defc571106f152c5
MD5 2a9a056cb73d70a4f64a140d790b4e6e
SHA1 c1f07465c568225011ffb2ae7cc2d53ad979eda1
SHA512 b59584e516fc09c55461c967c78a629c194bef10782f8898d80189bcb935372e8dad14ef0998836cd99a3d597405507e05a11ed8f50ba63dd0cb57555d3550a0
SSDEEP 196608:oWl8MIxyfGtMlkXiTxDCtv6q5vEbUdZVRaD8MkMUR:oWlnIxycMXTxDCtv6qrn
TLSH
T1506633C694E794B60A554DC1C722E0531F17AAEBFC8A2968C3E077C933AE01935FC5A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sampleV5.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\dbclspkg\sampleV5.dll
Size 524KB
SHA256 39a320c044c974edcdd2315bef5235a260b930246143b540a06788fcf8c4c8b2
MD5 799bcd767a3939bc662c810c012245fb
SHA1 87163ef105c87eb5953f3f9170eac0616113b79f
SHA512 6db6b2af657c875a1838f02aa7109233093efbe80d014eaf5768aea0b81e79ced6aaa272371b46da5ded2846d65bb25a4bcb8de1f338f4dc00c9e772fb582db5
SSDEEP 12288:YYIAmy9w5vPkTEetmCqryujcqhL0HU5WhjW5/oL:YY/VJrqhLczL
TLSH
T1CAB45C00A761C01CF4F701FA97BA969DA9387970773CD4CB61E1E98A1A609E5EC37B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scan.mbdb

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\dbclspkg\scan.mbdb
Size 410KB
SHA256 7e934529ebfd1faf68d00252b08da1c4fd157b0ea2d468f6f8a80b8dcc71eafb
MD5 6f1576ac9ca3c0ff8c70aa4ca5ca8d99
SHA1 aae5ee0223b0f4f9e40d7662e497f174d75e6109
SHA512 dbc3744329919d5a39aee2ab0558821717a95bc8c3ed71aaec0ab402d8951261d6f390a1c8533df51d67eb534680a542fe846ba1c9544a426ff49b8967489aba
SSDEEP 6144:LTDZhj6/soaQxSlcf16cUvQmgSsyAjoiMKfRT5O+B/pJoveQAv223FR2MakYp2kz:fDZhW/6kJQTK9om/pRQ4p/5aZgpTpmH
TLSH
T19A94230F07D54BFA3350E6529BB99D13E04CA898D48958F3CD35478E4EC8A2547EFCA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tids.mbdb

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\dbclspkg\tids.mbdb
Size 134KB
SHA256 7a0161d30a3fe574e555046cb4202b08bd67235ef7cb537ea8833043405b41ce
MD5 d26c468247a8ed5e0a98138f8061d662
SHA1 c90db93c63e685dd140c66c56eb8d987f4d7cd74
SHA512 f12f0a7342161b72b3648a7f44c295e3676d3fd503d591dc7395ae1bf9ef4c0d1574b0c7faebfede2b01bc83791ff7ddad04badaab23c5bc1f27acac184ae24b
SSDEEP 3072:22NEzZPd4OOnj7s3clMdcCxeDO36JQC5Y0NJWP09yR/APqb6E:22NsZ3caj6J//760q/Rd
TLSH
T121D3122ABD4CD81BDD949731417C621039F811463A762AF80ACDB5869F4AEF7306DECE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

version.dat

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\dbclspkg\version.dat
Size 48B
SHA256 6fb9dace83ebb04f81ddc596d2bb8a61881a2b24ab300821455941e8eb6e4106
MD5 bd39caffa83f63da5f4510486a2e2b43
SHA1 35cc5968799609de3536a578f2238092c5067bd7
SHA512 88c8b19299968f48b2c91bebeae52d0636e9b4352d6b14861818fcb62275e0e0bb90e66452471d4d3b865359f52308e4b30657fa9b62fd93b0445da86c96e0a3
MD5 SHA1 SHA512

Submit Download

wprot2.mbdb

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\dbclspkg\wprot2.mbdb
Size 21.4MB
SHA256 946c696e304345bf14a59225245a43d00fc0a060f520dddfa9740e2329c70575
MD5 4c0f13bcf217de843381f2bc126ccb37
SHA1 1aa5d92a26bc2dc292f91e43d803237bcf0aa6c0
SHA512 5fc0820b2acba625517490062c816181697c5927d7843851ab9af38baf62e2e1371120d411683d96cd504c761a59723a77a6e795613b8c749a805fe38ff9eb07
SSDEEP 393216:gMt6o+tmk68BkGpxQH6o92fmo1UKz32JzizQz0AXkPlS:gdlxZ461mo1U0HzQ2w
TLSH
T163372227FC15E116CBB6503A1ECAD4E613723B8480628F46B2486B31FD7587D7B2A1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.version

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_8bf8b0bdaa6d11f1bd6cc69b2ea1b5b9\dotnetpkgtmp\shared\Microsoft.NETCore.App\10.0.8\.version
Size 50B
SHA256 42559a4970a981aa61f3ed59ad44d05214fcc5eb97c35d06a88102a0b747a45f
MD5 9072ad106b74f3900d25ae80843c8a24
SHA1 b664a23dea5a5591c21fe0f4a9b5f344079d94d1
SHA512 ea866258bbcccc0951f95367f3309db65d437ad27eb6fcbdfe12e08b9f76265050d6216091b89f0dc92db66b24f8238c8d6cc98ce49e6c3bb6b051ee037e56a2
TLSH
T1309004444445D47315D3313453015154F00C5D3C5D34CC11D05F707CC4D705CC55C301
MD5 SHA1 SHA512 TLSH

Submit Download

AeConfig.json

Path C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json
Size 66KB
SHA256 e4cb0fd236587990228f9e1c7a8c0c9ffb27cc7c90112defd1e68484a9690813
MD5 a034b660cb60872f255f73569900e0dc
SHA1 14b2ac003971c23793b59a87e10f8c284fec7b78
SHA512 cdffbc5f20b28f0e676da812a3fa86e713c9a87e3997498c2e4ed16f13e362087dc6f8a494a09da1ee03ebed789007a157c53a5e998032158cb3783e2026ab80
SSDEEP 384:sriPalGB5AWiWq2mhzJUVVqxKS3xV2CjNrBa7gHOykEajctcxPad:JUAHiWqn1UVVqx9U7gYEaIKod
TLSH
T17763FB76D8DC4D5B857123A4AAB94607FB50036F51880C07BEBDEA8CCFB781295C6F1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AeConfig.json

Path C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json
Size 66KB
SHA256 c28104d2e226a534ce741b73f0ed2e13b8b4549881962d8ab489a75ad1c44d26
MD5 1e9e7993be8b82a35598c8c5396ba953
SHA1 29ccd4a128ee5548457c7c6bfdf91a99aaa65535
SHA512 075afa79db9c3defb91bca6634e62da25b9b5f16a86542485080c437d9438f08f7ba191225564fd05cdb113df0056c5b06e99efc057847cd2929aa54d33bcf68
SSDEEP 384:Cr1PalGB5AWiWq2mhzJUVVqxKS3xV2CjNrBa7gHOykEajctcxPad:IUAHiWqn1UVVqx9U7gYEaIKod
TLSH
T11A63FB76D8DC4D5B857123A4AAB94603FB50036F51880C07BEBDEA8CCFB781695C6F1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AeConfig.json.bak

Path C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json.bak
Size 47KB
SHA256 e8c6970bae2943108f4fdf3a84d888224aa93b378299d76085fa4d1224b380ae
MD5 d746a9d5a40e12a0f5c1f92c19a0f64c
SHA1 e5ee8a45adf804b4fcdce5bd90988cdb14761224
SHA512 05ae53421539b36cabb53716b8ad560b030924f087731b962bbf7449400fdd28e403b0d0d48b15f48c1bede2d5013032aed38b2dbf159875c82efccabdfb31e2
SSDEEP 384:FriPalGB5AWiWq2mhzJUVVqxKS3xV2CjNrBa7gHOykEaf:UUAHiWqn1UVVqx9U7gYEaf
TLSH
T1082382BBD9DC0D0B99712294A9B94607FB20036F10980C17BDBEA98DCFB755394C6F1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArwControllerConfig.json

Path C:\ProgramData\Malwarebytes\MBAMService\config\ArwControllerConfig.json
Size 1KB
SHA256 e66ea4141c53fabb00ed3890b2c53906c8b0f5e96649b61c7819949fad4ca6a4
MD5 a147e97cd6eeb85126c962ac00b3ac7c
SHA1 d892f94645995e1077f3d46e8ef72ec34f4f32b0
SHA512 a3c841c33ec125e6d7ae6c0a6e59ab355f1df6794b34e7f4dd5bf62af29cace9e902f7b5c19d9538e0fde57a3a543e9205a2c458c1beb70bb4b4f02a65602381
TLSH
T1042126528A2419FFA5FCA005E8949293CFB047652508083BF2FCF748ED7967263C6CD1
MD5 SHA1 SHA512 TLSH

Submit Download

CleanControllerConfig.json

Path C:\ProgramData\Malwarebytes\MBAMService\config\CleanControllerConfig.json
Size 949B
SHA256 4a25bb7a118c1971402e0f0d96e5f06dc14abb87be1d151b18420f3b1492ca2d
MD5 93e45f8837d2f7db881cace95e578406
SHA1 46faf7fff9c93aa49558c753a5d4a2205491be44
SHA512 0fb8d20f60c98ec9a2440fbf712a92205ff523f49c4a7d6aeb8d8506333fc18a91cc3b3b54972afaaf4acd04e06efefc3f789b6f6c39cd3ea9427e7add76f17b
TLSH
T14C113674C40264BE54B9634E89F9E582D790530A28544C8BFEBCC99CEE73437B02BDDA
MD5 SHA1 SHA512 TLSH

Submit Download

CloudConfig.json

Path C:\ProgramData\Malwarebytes\MBAMService\config\CloudConfig.json
Size 1KB
SHA256 f98a4c2fe9e897d460c3a68d34f9f217b56f4402a518e16cbb07554447c59616
MD5 ae4d0abea594305a95a0b148b7734726
SHA1 1a80b37516f386e66296943fa151d5a0cecb9769
SHA512 2ea8bde0acd5f9a5a8fac3aa7d507c1250020a680638ea0166b19bcc2e98de14c51d09374509bb37e3f0c13506a8019623344c320a0d9abeca9a0c2c62f182f3
TLSH
T1001190179636ADFAA0BD261C5F6E9786C33897131885086B7270C9CCCF7AB169007A0F
MD5 SHA1 SHA512 TLSH

Submit Download

LicenseConfig.json

Path C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json
Size 12KB
SHA256 5fd5111580e1b14a9455bcd96f19bcb148faf490874ebe8a5ed9f2c3fd5a1345
MD5 7be085fc00895e936a9799e2fb87f6ca
SHA1 2368823d95571124f6cb2b2af70342b74b2669fb
SHA512 44aeada24153443cafdc0d12cb084086d8284c4fa681957ee9661eebfaa03a428ba1a37af60420fdaf7660b4e261153ea92de87eedb486c07c747f3577694e5b
SSDEEP 192:LYDmf/FYgVMzhrgHTb0MAJUKfVgH8BZ8ZFBPs:SmlYgVMzhrgHTb0MAJUKfVgH8BZ8ZFBE
TLSH
T14A425426D1B5DEBB66FD617661B40B82F364C75F08410C07797CC88C4F7BD2A62C2AA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LicenseConfig.json

Path C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json
Size 12KB
SHA256 c2f5de67cd4d3ceb76fcc2744587e772764e49bb988cd306a7690cad23d777c2
MD5 27d6113e901b9484232ed6085af99db2
SHA1 086a26758fc05e4960dd47ea93a4277b132482dd
SHA512 0ecca375536d6d582d2479ef334f9a6e48e88585406bbdb33974fc9fb8f812b45ac8351fbede39785047f82941b2d60448f6fe927998678ee470eef066c0bb9b
SSDEEP 384:XBmlYgVMzhrgHTb0MAJUKfVgH8BZ8ZFxTE:RmlYgVMzhrgHTb0MAJUKfVgH8BZ8ZFxo
TLSH
T164426522D1B5DEBB66FD617661B40B82F364C75F08414C07797CC88C4F7BD2A62C2AA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LicenseConfig.json

Path C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json
Size 12KB
SHA256 5f79b2d8655b5a3284edcf40e930ee0c742e5c1c6c9a834f4ea07451c8d8f84e
MD5 309a6b2cd21ff3517b62d5d090e29241
SHA1 4010fd0feba243a86696aeb1fc91b447ddd15627
SHA512 9a8e8f02302c300e32dcc6d98d68f0e17b89b49074e7f453cf6f1c38d6a6a36b2e0f0671e0d1328d57b679076ed4b9c6880bf09d231adb4921793d47c8031c4e
SSDEEP 384:bimlYgVMzhrgHTb0MAJUKfVgH8BZ8ZFOWE:bimlYgVMzhrgHTb0MAJUKfVgH8BZ8ZFO
TLSH
T1A2427526D1B5DEBB66FD613661B40782F364C76F08410C07797CC88C4F7BD2A62C2AA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LicenseConfig.json

Path C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json
Size 12KB
SHA256 d28217b126ed401ae16586bc4c92c73a21c43d4fc4be1217d9f209950e530fdb
MD5 c9921c1f72615ba8ca94d9707544e758
SHA1 279a3b5b5d64650be9950ab32d3727d2b456cb82
SHA512 411712a3e54838b02f169f70928712c3b83c217a84f975902c0d2611bb3c34dbc3e5cd8d5266718543874997fd99827ca57d102c7d5056861d31b26480d0c979
SSDEEP 384:BimjYgVMzhrgHTb0MAJUKfVgH8BZ8ZFWtq:BimjYgVMzhrgHTb0MAJUKfVgH8BZ8ZFt
TLSH
T1E4427722D175DEBB66FD617661B40B82F364C75F08410C07797CC88C4F7BD2A62C2AA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LicenseConfig.json

Path C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json
Size 12KB
SHA256 ecbb4637c0d52d33721938f7e6352c21468e2921b1b651e3e3b3b994dd3fb330
MD5 9db7f173796fd6bf2e0fdec70aa7f6f3
SHA1 30f5d32375611060fe3eec5cf4e3d08a0f4b012f
SHA512 6c69f05b85b0f9d199c5c2097a8563b123c990133829f2fe2aca077a71c1fb15e8924c3304e27bc9962f1f91b7557a3bd7afa21d7e81ef13d17f4f10292fce4b
SSDEEP 384:cimZYgVMzhrgHTb0MAJUKfVgH8BZ8ZFL9g:cimZYgVMzhrgHTb0MAJUKfVgH8BZ8ZFu
TLSH
T194427722D1759EBB66FD617662B40B82F364C75F08414C07797CC48C4F7BD2A62C2AA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LicenseConfig.json.bak

Path C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json.bak
Size 12KB
SHA256 5d0da8b5da84db79b6e3d657a73f145a7d6448d10bcebd8b6d6f73c2d9967a6f
MD5 965a4f72895e04b4e28889e9ec5efa70
SHA1 5a1c17dda6db4dd810c01063865be59c0e4314da
SHA512 32c37031ce30b8464cf258aa3628aa051a3ef9a064f11723dd151facbd6f2e69cb4b3a96ace1faa6ff59ebf0898e7c1796996e68c38c87e3a8bddec693d67727
SSDEEP 384:YimQYgVMzhrgHTb0MAJUKfVgH8BZ8ZFWBZ:YimQYgVMzhrgHTb0MAJUKfVgH8BZ8ZFQ
TLSH
T1AB427622D175DEBB66FD627662B40B82F364C75F08410C17797CC48C4F7BD2A62C2AA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MwacControllerConfig.json

Path C:\ProgramData\Malwarebytes\MBAMService\config\MwacControllerConfig.json
Size 2KB
SHA256 73c76c225ef0c65bf392853496ac762fd55dfa760139e53254b7c7f3fa26bfbb
MD5 782c324d92122a4666d8234291032644
SHA1 e6d60672a3ff55fb37a3c80779d506a332e7a2c2
SHA512 a922df20a6c1cbe8376392516e7ec952588269318dd4fd73d31115567740017bcd3f84d8e7231a027cb441489f9078cecb88cf7445e11431ead2b095989fc0bb
TLSH
T1FD512532D9A86CBF19F452667C984252F641871F425808A3FABCD97C9FF6C12200AF5F
MD5 SHA1 SHA512 TLSH

Submit Download

MwacControllerConfig.json.bak

Path C:\ProgramData\Malwarebytes\MBAMService\config\MwacControllerConfig.json.bak
Size 2KB
SHA256 46d2a52992c3c8af40c3639e85a892411db20dc81713ed145c64f649c107b149
MD5 99396276c84191286294da86f590d728
SHA1 5d4a35959b7e99cd1eaf7dcbc0a462fb3d27709b
SHA512 31644b12872a1459c518667e22d998fb560c59da0f85d9dd059610390fb27997491678890dfa7619a08d58d4269c6d7db94fb64a62c26e2d1e12b9fd16cab106
TLSH
T170513932D5686CBF19F85266AC684252F651871F41580CA3BABCC97C5FF7C12210AF5F
MD5 SHA1 SHA512 TLSH

Submit Download

PoliciesConfig.json

Path C:\ProgramData\Malwarebytes\MBAMService\config\PoliciesConfig.json
Size 814B
SHA256 a2c890e3ae7387fcd578c0ecbb8543adf3d4c3bdc9a5cec0fba327541d9b2425
MD5 98d61464bd24e69c22851405e9bbd188
SHA1 2608b9af475640ba5362e129792f657ae75e7286
SHA512 381db0384b8fdbbacb3286fe80dc88f86d3c3bf9267e6acc76f9a2d3512615e6ce3210d53761890db92ae2901e415579c89bce987f45689011aca16988f696d4
TLSH
T13D014726984084FD297C4168813BD4C1F351875A34190C2FB7FAEA0EEDB793B2185986
MD5 SHA1 SHA512 TLSH

Submit Download

RtpConfig.json

Path C:\ProgramData\Malwarebytes\MBAMService\config\RtpConfig.json
Size 2KB
SHA256 e1399d592d2967ba4c47d878aa016611d37059590ee789548fd0aac700ff581d
MD5 d74d9244c3c3af101255ffa898440306
SHA1 6603fb9b47cff7755e75eb903b83b060286d903d
SHA512 35dd2db26b91fede18e0166cb22d44243a066d44ac96315fa9eeeaac70c10bc082e368f93730f9285f5d4f5bb44e19ef82a4e4b7c52fba9876c82170db8a4a9f
TLSH
T1D35117219B40B47D4CB9C2599C78518ADB245B65160A08BB71FEC83DCDBB6737BC5CC2
MD5 SHA1 SHA512 TLSH

Submit Download

ScanConfig.json

Path C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json
Size 3KB
SHA256 1f68eba79c331c8b1f10bd53bde6f3844df46c87a6a9be579827e70bd47e08b5
MD5 aaeb454e7bec10d93a53f4f7b9c5e153
SHA1 140d8c7d8302058f84184f2cec8338fdacec9610
SHA512 236db3f2695878ae3a11efc302bbf7e0cd886f3f13f83882b336396682c71bbcb82c330839dd0f532018ff9bda27893ae5cc4084e3e76c9a67094aebab23a657
TLSH
T1EE618C16D61059FE08B8E25EDC248186EB2087971502087FB1FDC55C9FF76337685EE6
MD5 SHA1 SHA512 TLSH

Submit Download

ScanConfig.json

Path C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json
Size 5KB
SHA256 a5f08f36061f84a3e1028568464479c764da838211529a0bac41b832728e7fb2
MD5 123d8dc20e5027aa4b4e63159d433e61
SHA1 2a5dd4780fc46d9277518e3fa7c5f8d7238f1292
SHA512 4a1bd874525e41615f1c315a476a569d1a961ce31b3ecb9e56e51f685168b74048018a7fc7c9793f9c7aa3c4d392f6fcfd69e17d0f4146bb4644336e51d09177
SSDEEP 48:U/w3/2T5JtpmNmVSfKuGQf92Es1kV8EBtmduw268qXKeWQX92MEnAf3wsaA:iweZyfK5k9JykfLYEyXKBs9RsAf3wsaA
TLSH
T1CFC17C16D9105CFE18B8E25EDC28818AEB2083972206187FB5FD855C5FF76333686EE5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SpConfigFile.json

Path C:\ProgramData\Malwarebytes\MBAMService\config\SpConfigFile.json
Size 12KB
SHA256 024e71ff926abbcf25742908aaa432cfaa2a6c3c28eeb50b1d7de7833bb1d27e
MD5 c51497f94e46e0bd22f4a37e9064f04d
SHA1 adb2f9d8bf2ba93dfa342d756b0c3b8434e894a6
SHA512 bcad8713a691e057b5704227edfb3ac4e6553d0cf2b2e015f6743880f2aed954197bee95ed2256b52689205ac6ec39ecebb0cea5efc4a8aaba8c9d024e61573d
SSDEEP 384:V8+xwb8fkY/sDY8t7SSdUCExUYS9oFfJ7MLPi5LnDjufzqoA+8xRj81offZJZtXJ:IXDK
TLSH
T14D52161EE0A84867887726901F7A95A2E334526BC1435C6775FCB12CCFBB483C496F9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TelemCtrlConfig.json

Path C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json
Size 1KB
SHA256 2820b3e7b54b262fb2bfaf04549a4362ae0fbd5350abdf571cb4a9203c56bbd8
MD5 43931008d5e4995486de44872903e16f
SHA1 909452d1458efada092e3650d83aa315549d0254
SHA512 4407f901ee5c639298138f67d99e61774e54348c6af8aa37164dc064b71bfd15d33e3cb6ff9103c255f946aea7ca4ca6d192cc75152b7390caaa31a05938c4b0
TLSH
T1B431E0128A2841FF28FDD148C9B88717E7A0531B21161C1FFAF8DA58DE7707237E1A98
MD5 SHA1 SHA512 TLSH

Submit Download

TelemCtrlConfig.json

Path C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json
Size 1KB
SHA256 2a134d186768b2659b531a4ce9231f58e67724aeb2080a6da0a0414d9666da7c
MD5 4ada4b970ce88601964dd755f4792ab8
SHA1 e806727b46acadcbdf8fe22fe267775609b4be54
SHA512 dbffb2e3f70618f3fdb6ffb15d8680ed15a6ecf26a639392df3f347bf477f3a3a22d89fbc58af6820d708611cc9a2260a506efad04e33172797404d4c9c655ce
TLSH
T10A31F1128A2845FF28FCD154C9B88B1BE7A0531B21161C1FFAF8DA58DE7703227A1999
MD5 SHA1 SHA512 TLSH

Submit Download

TelemCtrlConfig.json

Path C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json
Size 1KB
SHA256 c0489aa2182bea9fa0b1ff8d6fb177855c76c4950ff0b4c022674f279baa7f0e
MD5 2e77083c590a04b4d5cab7bedf071caf
SHA1 1fb655b3a69cfb45e46faea9fe4bc291b4b1f234
SHA512 f5680b673ba395b3c19487a37752343d2a12322d5cc008fff33a2c4ec3a44e7e2026a2c225dd19940ea1289bfe7f8659b36b7cb0d942b73f23de9a77aa6a6e04
TLSH
T1433102128A2845FF28FCD144D9B88717E7A0531B61161C1FBAF8DE58DD7707237E1A89
MD5 SHA1 SHA512 TLSH

Submit Download

TelemCtrlConfig.json

Path C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json
Size 1KB
SHA256 8e9a7ff598fbb81eadd5085a760b56ad43990cd294b6264f770f89cdf6d3f71d
MD5 b9524bf18d86974ad592b6bfbf229dd9
SHA1 34bb64625d245c680990f05014b2362ca6e3062d
SHA512 c7f866a3a683236db2a7d4f1bcaa7beb6aa193130ff242e42833887818722f471c837ac778a8c197d70385cd6427d404cf415d4ebeae8ce61b58a73aeb80de53
TLSH
T16B31E3128A2845FF28FCD194C9B88716E7A0531B21161C1BB6FCDA58DF7703236A1A89
MD5 SHA1 SHA512 TLSH

Submit Download

UpdateControllerConfig.json

Path C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json
Size 1KB
SHA256 ce75950e43b0231dd6cd5e8d1c1a07d56174454d5ab67dd956866a0c163ec065
MD5 4f9438ae529557b37cc9a336ae8b7a8e
SHA1 c7bc201c964713444e477235ddac462470a7b5bb
SHA512 83d470e15bbfb4e03e9e90b5326dc18c3b6d1dc865048712ec9d359d0223e69a0dce66b15c21c5f07b0022ac60a9439b47e558e762f0ff1130dee9a68925cc5e
TLSH
T1263159238939C8BF2276965DD8B88142D760538F62708D2FB3F8DD48DD739746487A8D
MD5 SHA1 SHA512 TLSH

Submit Download

UpdateControllerConfig.json

Path C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json
Size 1KB
SHA256 89a17970b66cf17453931cc56d745158c63596c78bc9d4a23195fe8bfdbe200a
MD5 b345a5f952de73cb6832fe2340fba7f9
SHA1 7e19437ec261877c30b6f32f8adba55be1fc58bd
SHA512 41f097557b281d7de5550787819bc959e071ba550936ff80fb1a1ffcd858d2daed62a0e801afdb652e7d120210b81c6e0acef54d64a2e4d09c643fcfc8d55d01
TLSH
T1123159228938C8BF2175975DD8B48142D760938F62608D6FB3FCD848DD739746487A8D
MD5 SHA1 SHA512 TLSH

Submit Download

VPNControllerConfig.json

Path C:\ProgramData\Malwarebytes\MBAMService\config\VPNControllerConfig.json
Size 1KB
SHA256 b13b5f67991205d1e48d16c875a0bb8016e54d714c3e1b5a9d0748ff6b77e774
MD5 8bdcb04fe9974832a55a0468415582c3
SHA1 d0036f4510e6862167ef32ec350c624bb7da045f
SHA512 6af9cef45d21d6728dc22c477b3c0358b22252d4696eb091681cb6849bff3418d6226c07e25f46b94d19a7ee7f29f6cf1e30bbee94bd4fe5fa58958a1458910f
TLSH
T147216836B0A010F96A7D9A9B6C7C8240F370530F11DA8F42BFBCE014CEB3594A164F9A
MD5 SHA1 SHA512 TLSH

Submit Download

VPNControllerConfig.json

Path C:\ProgramData\Malwarebytes\MBAMService\config\VPNControllerConfig.json
Size 1KB
SHA256 f3a27b322d1eb4a6495992dba27390ff8edd262266df357a4fb9c19be523e803
MD5 b9c59b85a6af6d9c74057625b8664c98
SHA1 3ac5a2a8f01040730cdf09d9a5a622f86ebf1168
SHA512 46c64773f2de76034d9ff704f81d54f52fae932e96eb79571ae27619e63253571721cfe00b86d8d5ec7d1bfe3395db2ac22bccd0ed788a6d3075f5476d5cff50
TLSH
T10F217F32B09010F56A7D9A9B6C7D4201F370534F12DA8B42BFBCE014CEB3594A161F9A
MD5 SHA1 SHA512 TLSH

Submit Download

VPNServerListConfig.json

Path C:\ProgramData\Malwarebytes\MBAMService\config\VPNServerListConfig.json
Size 125B
SHA256 6e1795c39c8a248bdb15a810613038d8f595d98c63781f1da484663961e28d3a
MD5 11624665a1b469d023e96dbe7674c71b
SHA1 32a20abe92a41829f619bfa0f935dae938bdccde
SHA512 15ea1d9c7440604486fc725120801972f3cbe66c564f6e8931bb16e70ffb3a6e1f72fa40971ed8f5b0728fef9c451eaa61431c30a425f6730189013ec75b40b3
TLSH
T118B092A820656A76A3F7974A4D854141D7A0B296A088840DB62C82EAEA70AA24156F7A
MD5 SHA1 SHA512 TLSH

Submit Download

mbrescue.exe

Path C:\ProgramData\Malwarebytes\MBAMService\rmode\mbrescue.exe
Size 7.7MB
SHA256 477919ecb586d6ef4a06793417c2ae3126c51a51cf9445d901e90e3627e7143b
MD5 ce8ca947e3162da157d1878d4cfec382
SHA1 6f574aa206ba5e9d7469450780c4238cdd5112e8
SHA512 4233bbde636d039ea3295e3b2066f56ea5a23e0431a5e675c967c60bbfa4f518f01eb90ac271da56a192671b925b3e14d3a25f1da4a8412983b4973565dff299
SSDEEP 98304:akpowZa6gr/YzKrEAi9bESWCt+z3zweCeT007kxK:aFwZa62YW4AQbLWCtej1C9076K
TLSH
T1D586AE57A3E800E8D8B6D13CCA978503EBB2B85147719BDF06A4566A1F73AE05F3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dberr.txt

Path C:\Windows\System32\CatRoot2\dberr.txt
Size 37KB
SHA256 2d23ccb233b1e62b21e84ce2e66a5950896d011930f2ea7932513d2e4754abcf
MD5 80703a95dff98949b29ebc92c8760b1e
SHA1 b2b0e922f451bfc41e5e2fbd72b888860d0ee467
SHA512 361423bffdb49b09e8f998f6055306a3a6d089e65ab64d2ba75b61586b4b48332a91f9e01323e9acada3688d29e7485a7f17a6c3827a62229131235ddf4efa51
SSDEEP 768:hdovkB5Zw6aPIIGt2c4eptJCuPIFY50/0hY/k2:hdovqZw6aPIIGt2c3VCuPIFY50/0hY1
TLSH
T189036E0952D88818C9F50D623A7BDE72C57BD5C6B70B1EE970ACA314D9C2B042FBA45F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dberr.txt

Path C:\Windows\System32\catroot2\dberr.txt
Size 37KB
SHA256 236c05613295c8cd94dceddad6a9df9f8355fbdd17443bd09879f5eb5276577f
MD5 1d5e2e8488cb3808a81974dff6304822
SHA1 e18bfbe6bb0fd163e7ee0c3226ea72fd8c97c386
SHA512 a949a620d120bd0e492dde5648c25f691c1e87539a4527fe788b508737aaa53daf5d4908cd08c434dc55dbeab22df6d1d61318f53e1d5f8c388d86ad22e26371
SSDEEP 768:hdovkB5Zw6aPIIGt2c4eptJCuPIFY50/0hY/k+:hdovqZw6aPIIGt2c3VCuPIFY50/0hYx
TLSH
T154035E0952D88818C9F50D623A7BDE72C57BD5C6B70B1EE970ACA314D9C2B042FBA45F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/6104-3262-0x0000019517A40000-0x0000019517DED000-memory.dmp

Download

memory/6104-3261-0x0000019517430000-0x0000019517A3E000-memory.dmp

Download