Windows Analysis Report
MBSetup.exe

EXE planting / hijacking vulnerabilities found

Bitcoin Miner

Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION Malwarebytes.exe	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION mbam.exe
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION mbamtray.exe

Compliance

Source: C:\Users\user\Desktop\MBSetup.exe

EXE: cmd.exe

Found installer window with terms and condition text

Uses 32bit PE files

Source: MBSetup.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\MBSetup.exe

Window detected: Malwarebytes Setup WizardInstall now to clean and protect your computer for good&Install<a>Advanced options</a>By installing or using this product you agree to its <a>End User License Agreement</a> and <a>Privacy Policy</a>.

Creates a directory in C:\Program Files

Source: C:\Users\user\Desktop\MBSetup.exe	Directory created: C:\Program Files\Malwarebytes	Jump to behavior
Source: C:\Users\user\Desktop\MBSetup.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware	Jump to behavior
Source: C:\Users\user\Desktop\MBSetup.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\604834ce-d89f-4e94-a75c-9c4d5b683f67	Jump to behavior
Source: C:\Users\user\Desktop\MBSetup.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\1a8fa819fc8a11ee9711ecf4bbea1588	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\1a8fa81afc8a11ee9c96ecf4bbea1588	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\mbuns.exe	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\hostfxr.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\.version	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-console-l1-1-0.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-console-l1-2-0.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-datetime-l1-1-0.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-debug-l1-1-0.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-errorhandling-l1-1-0.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-fibers-l1-1-0.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-file-l1-1-0.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-file-l1-2-0.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-file-l2-1-0.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-handle-l1-1-0.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-heap-l1-1-0.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-interlocked-l1-1-0.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-libraryloader-l1-1-0.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-localization-l1-2-0.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-memory-l1-1-0.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-namedpipe-l1-1-0.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-processenvironment-l1-1-0.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-processthreads-l1-1-0.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-processthreads-l1-1-1.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-profile-l1-1-0.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-rtlsupport-l1-1-0.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-string-l1-1-0.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-synch-l1-1-0.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-sysinfo-l1-1-0.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-timezone-l1-1-0.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-util-l1-1-0.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-conio-l1-1-0.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-convert-l1-1-0.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-environment-l1-1-0.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-heap-l1-1-0.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-locale-l1-1-0.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-math-l1-1-0.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-multibyte-l1-1-0.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-private-l1-1-0.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-process-l1-1-0.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-runtime-l1-1-0.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-stdio-l1-1-0.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-string-l1-1-0.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-time-l1-1-0.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-utility-l1-1-0.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\clretwrc.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\clrjit.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\coreclr.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\createdump.exe	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\dbgshim.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\hostpolicy.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\Microsoft.CSharp.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\Microsoft.DiaSymReader.Native.amd64.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\Microsoft.NETCore.App.deps.json	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\Microsoft.NETCore.App.runtimeconfig.json	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\Microsoft.VisualBasic.Core.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\Microsoft.VisualBasic.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\Microsoft.Win32.Primitives.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\Microsoft.Win32.Registry.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\mscordaccore.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\mscordaccore_amd64_amd64_6.0.2824.12007.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\mscordbi.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\mscorlib.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\mscorrc.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\msquic.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\netstandard.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.AppContext.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Buffers.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Collections.Concurrent.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Collections.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Collections.Immutable.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Collections.NonGeneric.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Collections.Specialized.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.ComponentModel.Annotations.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.ComponentModel.DataAnnotations.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.ComponentModel.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.ComponentModel.EventBasedAsync.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.ComponentModel.Primitives.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.ComponentModel.TypeConverter.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Configuration.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Console.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Core.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Data.Common.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Data.DataSetExtensions.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Data.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Diagnostics.Contracts.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Diagnostics.Debug.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Diagnostics.DiagnosticSource.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Diagnostics.FileVersionInfo.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Diagnostics.Process.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Diagnostics.StackTrace.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Diagnostics.TextWriterTraceListener.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Diagnostics.Tools.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Diagnostics.TraceSource.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Diagnostics.Tracing.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Drawing.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Drawing.Primitives.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Dynamic.Runtime.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Formats.Asn1.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Globalization.Calendars.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Globalization.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Globalization.Extensions.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.IO.Compression.Brotli.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.IO.Compression.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.IO.Compression.FileSystem.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.IO.Compression.Native.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.IO.Compression.ZipFile.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.IO.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.IO.FileSystem.AccessControl.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.IO.FileSystem.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.IO.FileSystem.DriveInfo.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.IO.FileSystem.Primitives.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.IO.FileSystem.Watcher.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.IO.IsolatedStorage.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.IO.MemoryMappedFiles.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.IO.Pipes.AccessControl.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.IO.Pipes.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.IO.UnmanagedMemoryStream.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Linq.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Linq.Expressions.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Linq.Parallel.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Linq.Queryable.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Memory.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Net.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Net.Http.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Net.Http.Json.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Net.HttpListener.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Net.Mail.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Net.NameResolution.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Net.NetworkInformation.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Net.Ping.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Net.Primitives.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Net.Quic.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Net.Requests.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Net.Security.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Net.ServicePoint.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Net.Sockets.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Net.WebClient.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Net.WebHeaderCollection.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Net.WebProxy.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Net.WebSockets.Client.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Net.WebSockets.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Numerics.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Numerics.Vectors.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.ObjectModel.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Private.CoreLib.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Private.DataContractSerialization.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Private.Uri.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Private.Xml.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Private.Xml.Linq.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Reflection.DispatchProxy.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Reflection.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Reflection.Emit.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Reflection.Emit.ILGeneration.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Reflection.Emit.Lightweight.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Reflection.Extensions.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Reflection.Metadata.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Reflection.Primitives.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Reflection.TypeExtensions.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Resources.Reader.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Resources.ResourceManager.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Resources.Writer.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.CompilerServices.Unsafe.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.CompilerServices.VisualC.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.Extensions.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.Handles.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.InteropServices.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.InteropServices.RuntimeInformation.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.Intrinsics.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.Loader.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.Numerics.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.Serialization.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.Serialization.Formatters.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.Serialization.Json.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.Serialization.Primitives.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.Serialization.Xml.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Security.AccessControl.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Security.Claims.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Security.Cryptography.Algorithms.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Security.Cryptography.Cng.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Security.Cryptography.Csp.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Security.Cryptography.Encoding.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Security.Cryptography.OpenSsl.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Security.Cryptography.Primitives.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Security.Cryptography.X509Certificates.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Security.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Security.Principal.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Security.Principal.Windows.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Security.SecureString.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.ServiceModel.Web.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.ServiceProcess.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Text.Encoding.CodePages.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Text.Encoding.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Text.Encoding.Extensions.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Text.Encodings.Web.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Text.Json.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Text.RegularExpressions.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Threading.Channels.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Threading.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Threading.Overlapped.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Threading.Tasks.Dataflow.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Threading.Tasks.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Threading.Tasks.Extensions.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Threading.Tasks.Parallel.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Threading.Thread.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Threading.ThreadPool.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Threading.Timer.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Transactions.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Transactions.Local.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.ValueTuple.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Web.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Web.HttpUtility.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Windows.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Xml.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Xml.Linq.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Xml.ReaderWriter.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Xml.Serialization.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Xml.XDocument.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Xml.XmlDocument.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Xml.XmlSerializer.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Xml.XPath.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Xml.XPath.XDocument.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\ucrtbase.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\WindowsBase.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\Accessibility.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\cs	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\Microsoft.VisualBasic.Forms.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\PresentationCore.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\PresentationFramework.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\PresentationUI.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\ReachFramework.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\System.Windows.Controls.Ribbon.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\System.Windows.Forms.Design.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\System.Windows.Forms.Primitives.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\System.Windows.Forms.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\System.Windows.Input.Manipulations.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\System.Xaml.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\UIAutomationClient.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\UIAutomationClientSideProviders.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\UIAutomationProvider.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\UIAutomationTypes.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\WindowsBase.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\WindowsFormsIntegration.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\D3DCompiler_47_cor3.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\de	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\de\Microsoft.VisualBasic.Forms.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\de\PresentationCore.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\de\PresentationFramework.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\de\PresentationUI.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\de\ReachFramework.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\de\System.Windows.Controls.Ribbon.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\de\System.Windows.Forms.Design.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\de\System.Windows.Forms.Primitives.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\de\System.Windows.Forms.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\de\System.Windows.Input.Manipulations.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\de\System.Xaml.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\de\UIAutomationClient.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\de\UIAutomationClientSideProviders.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\de\UIAutomationProvider.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\de\UIAutomationTypes.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\de\WindowsBase.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\de\WindowsFormsIntegration.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\DirectWriteForwarder.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\es	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\es\Microsoft.VisualBasic.Forms.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\es\PresentationCore.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\es\PresentationFramework.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\es\PresentationUI.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\es\ReachFramework.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\es\System.Windows.Controls.Ribbon.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\es\System.Windows.Forms.Design.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\es\System.Windows.Forms.Primitives.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\es\System.Windows.Forms.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\es\System.Windows.Input.Manipulations.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\es\System.Xaml.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\es\UIAutomationClient.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\es\UIAutomationClientSideProviders.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\es\UIAutomationProvider.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\es\UIAutomationTypes.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\es\WindowsBase.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\es\WindowsFormsIntegration.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\fr	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\mbtun
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\mbtun\mbtun.sys
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\mbtun\mbtun.inf
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\mbtun\mbtun.cat
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\sdk
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.sys
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.inf
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.cat
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.tmf
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.sys
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.inf
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.cat
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.tmf

Creates a software uninstall entry

Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1

Creates install or setup log file

Source: C:\Users\user\Desktop\MBSetup.exe

File created: C:\Users\user\AppData\Local\Temp\mbsetup.log

PE / OLE file has a valid certificate

Source: MBSetup.exe

Static PE information: certificate valid

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: MBSetup.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Binary contains paths to debug symbols

Source:	Binary string: e:\jenkins\workspace\N_MBTunDriver\bin\x64\WinR_Release\mbtun.pdb source: MBVpnTunnelService.exe, 00000005.00000003.2284751755.0000018753023000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000008.00000003.2428356278.0000027072D00000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000008.00000003.2425307600.0000027072CA9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: d:\jenkins\workspace\N_inserr\bin\Win32\Release\inserr.pdb source: MBAMInstallerService.exe, 00000002.00000000.1845634681.00007FF783E9F000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: d:\jenkins\workspace\N_MBVpn_MBTunInstaller\bin\x64\Release\mbtun.pdb source: MBVpnTunnelService.exe, 00000005.00000003.2284751755.0000018753023000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: e:\jenkins\workspace\N_MBTunDriver\bin\x64\Win7_Release\mbtun.pdb source: MBVpnTunnelService.exe, 00000005.00000003.2284751755.0000018753023000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: d:\jenkins\workspace\N_Elam_Kernel\bin\x64\Win7_Release\MbamElam.pdb source: MBAMInstallerService.exe, 00000002.00000003.2023088147.0000015EF50AE000.00000004.00001000.00020000.00000000.sdmp, MBAMInstallerService.exe, 00000002.00000003.2097374584.0000015EF47E0000.00000004.00001000.00020000.00000000.sdmp, MBAMInstallerService.exe, 00000002.00000003.2097629214.0000015EF4FE0000.00000004.00001000.00020000.00000000.sdmp, MBAMInstallerService.exe, 00000002.00000003.2022178107.0000015EF47E0000.00000004.00001000.00020000.00000000.sdmp, MBAMService.exe, 00000009.00000003.2452465973.00000264B4280000.00000004.00000020.00020000.00000000.sdmp, MBAMService.exe, 00000009.00000003.2452838840.00000264B4280000.00000004.00000020.00020000.00000000.sdmp, MBAMService.exe, 00000009.00000003.2446597783.00000264B4284000.00000004.00000020.00020000.00000000.sdmp, MBAMService.exe, 00000009.00000003.2453426133.00000264B4280000.00000004.00000020.00020000.00000000.sdmp, MBAMService.exe, 00000009.00000002.2454379553.00000264B4280000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: d:\jenkins\workspace\N_MBVpnTunnel\bin\x64\Release\MBVpnTunnelService.pdb source: MBVpnTunnelService.exe, 00000005.00000000.2282427452.00007FF751687000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: D:\Jenkins\workspace\N_MBAMService\bin\x64\Release\MBAMService.pdb~ source: MBAMInstallerService.exe, 00000002.00000003.2023088147.0000015EF50AE000.00000004.00001000.00020000.00000000.sdmp, MBAMService.exe, 00000009.00000002.2455239360.00007FF7E274F000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: D:\Jenkins\workspace\N_7zip_vs2022\7z2301-src\CPP\7zip\Bundles\Format7zF\x64\7z.pdb source: MBAMInstallerService.exe, 00000002.00000003.2024376899.0000015EF4A66000.00000004.00000020.00020000.00000000.sdmp, MBAMInstallerService.exe, 00000002.00000003.2018209780.0000015EF46AB000.00000004.00000020.00020000.00000000.sdmp, MBAMInstallerService.exe, 00000002.00000000.1845634681.00007FF783E9F000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: C:\Projects\MBAE\MBAENA\src\mbae-sys\MadCodeHook-MBDriver\MBMCHDrv\bin\x64\release\mbae64.pdb source: MBAMInstallerService.exe, 00000002.00000003.2097374584.0000015EF47E0000.00000004.00001000.00020000.00000000.sdmp, MBAMInstallerService.exe, 00000002.00000003.2097629214.0000015EF4FE0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\Jenkins\workspace\N_MB5_InstallerService\bin\x64\Release\MBAMIService.pdb source: MBAMInstallerService.exe, 00000002.00000000.1845438065.00007FF783D34000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: C:\Jenkins\workspace\MBAM-Windows\A_MB5_MBSetup\bin\Win32\Release\MBSetup.pdb source: MBSetup.exe, 00000000.00000000.1650375405.0000000000809000.00000002.00000001.01000000.00000003.sdmp
Source:	Binary string: D:\Jenkins\workspace\N_MBAMService\bin\x64\Release\MBAMService.pdb source: MBAMInstallerService.exe, 00000002.00000003.2023088147.0000015EF50AE000.00000004.00001000.00020000.00000000.sdmp, MBAMService.exe, 00000009.00000002.2455239360.00007FF7E274F000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: C:\Users\Jason A. Donenfeld\Projects\wireguard-nt\Release\arm64\setupapihost.pdb source: MBAMInstallerService.exe, 00000002.00000003.2097374584.0000015EF47E0000.00000004.00001000.00020000.00000000.sdmp, MBAMInstallerService.exe, 00000002.00000003.2097629214.0000015EF4FE0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\Jenkins\workspace\N_MB5_InstallerService\bin\x64\Release\MBAMIService.pdbS source: MBAMInstallerService.exe, 00000002.00000000.1845438065.00007FF783D34000.00000002.00000001.01000000.0000000A.sdmp

Spreading

Checks for available system drives (often done to infect USB drives)

Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	File opened: z:
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	File opened: x:
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	File opened: v:
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	File opened: t:
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	File opened: r:
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	File opened: p:
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	File opened: n:
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	File opened: l:
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	File opened: j:
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	File opened: h:
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	File opened: f:
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	File opened: b:
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	File opened: y:
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	File opened: w:
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	File opened: u:
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	File opened: s:
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	File opened: q:
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	File opened: o:
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	File opened: m:
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	File opened: k:
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	File opened: i:
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	File opened: g:
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	File opened: e:
Source: C:\Windows\System32\svchost.exe	File opened: c:
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	File opened: a:

Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	Code function: 5_2_00007FF7514B3BA2 FindFirstFileW,FindClose,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,GetLastError,GetLastError,LoadLibraryW,GetLastError,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,		5_2_00007FF7514B3BA2
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	Code function: 5_2_00007FF751513EC0 FindFirstFileW,GetLastError,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,		5_2_00007FF751513EC0

Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File opened: C:\Windows\TEMP\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\ArwControllerImpl.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File opened: C:\Windows\TEMP\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\7z.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File opened: C:\Windows\TEMP\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\7z.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File opened: C:\Windows\TEMP\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File opened: C:\Windows\TEMP\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\ActionsShim.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File opened: C:\Windows\TEMP\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\AEControllerImpl.dll	Jump to behavior

Software Vulnerabilities

Source: firefox.exe

Memory has grown: Private usage: 1MB later: 353MB

Networking

Enables network access during safeboot for specific services

Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe

Registry value created: NULL Service

Yara detected Generic Downloader

Source: Yara match	File source: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.dll, type: DROPPED
Source: Yara match	File source: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\netstandard.dll, type: DROPPED
Source: Yara match	File source: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Net.dll, type: DROPPED

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 34.117.237.239 34.117.237.239
Source: Joe Sandbox View	IP Address: 34.117.188.166 34.117.188.166
Source: Joe Sandbox View	IP Address: 3.163.101.87 3.163.101.87
Source: Joe Sandbox View	IP Address: 23.216.73.151 23.216.73.151

Yara detected PsExec sysinternal tool

Source: Yara match

File source: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\AEControllerImpl.dll, type: DROPPED

Source: MBVpnTunnelService.exe, 00000005.00000003.2284751755.0000018753023000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCodeSigningCA-1.crt0
Source: MBAMInstallerService.exe, 00000002.00000003.2097374584.0000015EF47E0000.00000004.00001000.00020000.00000000.sdmp, MBAMInstallerService.exe, 00000002.00000003.2097629214.0000015EF4FE0000.00000004.00001000.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2284751755.0000018753023000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: MBAMInstallerService.exe, 00000002.00000003.2097374584.0000015EF47E0000.00000004.00001000.00020000.00000000.sdmp, MBAMInstallerService.exe, 00000002.00000003.2097629214.0000015EF4FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
Source: drvinst.exe, 00000008.00000002.2434287955.0000027072C58000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000008.00000003.2432411808.0000027072C58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: MBAMInstallerService.exe, 00000002.00000003.2097374584.0000015EF47E0000.00000004.00001000.00020000.00000000.sdmp, MBAMInstallerService.exe, 00000002.00000003.2097629214.0000015EF4FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
Source: MBAMInstallerService.exe, 00000002.00000003.2097374584.0000015EF47E0000.00000004.00001000.00020000.00000000.sdmp, MBAMInstallerService.exe, 00000002.00000003.2097629214.0000015EF4FE0000.00000004.00001000.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2284751755.0000018753023000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: MBAMInstallerService.exe, 00000002.00000003.2024376899.0000015EF4A66000.00000004.00000020.00020000.00000000.sdmp, MBAMInstallerService.exe, 00000002.00000003.2023088147.0000015EF50AE000.00000004.00001000.00020000.00000000.sdmp, MBAMInstallerService.exe, 00000002.00000000.1845634681.00007FF784256000.00000002.00000001.01000000.0000000A.sdmp, MBAMInstallerService.exe, 00000002.00000003.2018209780.0000015EF46AB000.00000004.00000020.00020000.00000000.sdmp, MBAMInstallerService.exe, 00000002.00000000.1845634681.00007FF783E9F000.00000002.00000001.01000000.0000000A.sdmp, MBAMInstallerService.exe, 00000002.00000003.2022178107.0000015EF47E0000.00000004.00001000.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2284751755.0000018753023000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000008.00000003.2428356278.0000027072D00000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000008.00000003.2425307600.0000027072CA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: drvinst.exe, 00000008.00000002.2434287955.0000027072CA5000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000008.00000003.2432411808.0000027072CA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: drvinst.exe, 00000008.00000002.2434287955.0000027072CA5000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000008.00000003.2432411808.0000027072CA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: MBAMInstallerService.exe, 00000002.00000003.2024376899.0000015EF4A66000.00000004.00000020.00020000.00000000.sdmp, MBAMInstallerService.exe, 00000002.00000003.2023088147.0000015EF50AE000.00000004.00001000.00020000.00000000.sdmp, MBAMInstallerService.exe, 00000002.00000000.1845634681.00007FF784256000.00000002.00000001.01000000.0000000A.sdmp, MBAMInstallerService.exe, 00000002.00000003.2018209780.0000015EF46AB000.00000004.00000020.00020000.00000000.sdmp, MBAMInstallerService.exe, 00000002.00000000.1845634681.00007FF783E9F000.00000002.00000001.01000000.0000000A.sdmp, MBAMInstallerService.exe, 00000002.00000003.2022178107.0000015EF47E0000.00000004.00001000.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2284751755.0000018753023000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000008.00000003.2428356278.0000027072D00000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000008.00000003.2425307600.0000027072CA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoRSACodeSigningCA2.crl0t
Source: MBVpnTunnelService.exe, 00000005.00000003.2284751755.0000018753023000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: MBAMInstallerService.exe, 00000002.00000003.2097374584.0000015EF47E0000.00000004.00001000.00020000.00000000.sdmp, MBAMInstallerService.exe, 00000002.00000003.2097629214.0000015EF4FE0000.00000004.00001000.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2284751755.0000018753023000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: drvinst.exe, 00000008.00000002.2434287955.0000027072C58000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000008.00000003.2432411808.0000027072C58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: MBAMInstallerService.exe, 00000002.00000003.2097374584.0000015EF47E0000.00000004.00001000.00020000.00000000.sdmp, MBAMInstallerService.exe, 00000002.00000003.2097629214.0000015EF4FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: MBAMInstallerService.exe, 00000002.00000003.2097374584.0000015EF47E0000.00000004.00001000.00020000.00000000.sdmp, MBAMInstallerService.exe, 00000002.00000003.2097629214.0000015EF4FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/EVCodeSigningSHA2-g1.crl07
Source: MBVpnTunnelService.exe, 00000005.00000003.2284751755.0000018753023000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/assured-cs-g1.crl00
Source: MBAMInstallerService.exe, 00000002.00000003.2097374584.0000015EF47E0000.00000004.00001000.00020000.00000000.sdmp, MBAMInstallerService.exe, 00000002.00000003.2097629214.0000015EF4FE0000.00000004.00001000.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2284751755.0000018753023000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: MBVpnTunnelService.exe, 00000005.00000003.2284751755.0000018753023000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: MBAMInstallerService.exe, 00000002.00000003.2097374584.0000015EF47E0000.00000004.00001000.00020000.00000000.sdmp, MBAMInstallerService.exe, 00000002.00000003.2097629214.0000015EF4FE0000.00000004.00001000.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2284751755.0000018753023000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: MBAMInstallerService.exe, 00000002.00000003.2097374584.0000015EF47E0000.00000004.00001000.00020000.00000000.sdmp, MBAMInstallerService.exe, 00000002.00000003.2097629214.0000015EF4FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: MBAMInstallerService.exe, 00000002.00000003.2097374584.0000015EF47E0000.00000004.00001000.00020000.00000000.sdmp, MBAMInstallerService.exe, 00000002.00000003.2097629214.0000015EF4FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/EVCodeSigningSHA2-g1.crl0K
Source: MBVpnTunnelService.exe, 00000005.00000003.2284751755.0000018753023000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/assured-cs-g1.crl0L
Source: MBAMInstallerService.exe, 00000002.00000003.2097374584.0000015EF47E0000.00000004.00001000.00020000.00000000.sdmp, MBAMInstallerService.exe, 00000002.00000003.2097629214.0000015EF4FE0000.00000004.00001000.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2284751755.0000018753023000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: drvinst.exe, 00000008.00000002.2434287955.0000027072CA5000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000008.00000003.2432411808.0000027072CA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: MBAMInstallerService.exe, 00000002.00000003.2024376899.0000015EF4A66000.00000004.00000020.00020000.00000000.sdmp, MBAMInstallerService.exe, 00000002.00000003.2023088147.0000015EF50AE000.00000004.00001000.00020000.00000000.sdmp, MBAMInstallerService.exe, 00000002.00000000.1845634681.00007FF784256000.00000002.00000001.01000000.0000000A.sdmp, MBAMInstallerService.exe, 00000002.00000003.2018209780.0000015EF46AB000.00000004.00000020.00020000.00000000.sdmp, MBAMInstallerService.exe, 00000002.00000000.1845634681.00007FF783E9F000.00000002.00000001.01000000.0000000A.sdmp, MBAMInstallerService.exe, 00000002.00000003.2022178107.0000015EF47E0000.00000004.00001000.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2284751755.0000018753023000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000008.00000003.2428356278.0000027072D00000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000008.00000003.2425307600.0000027072CA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoRSACodeSigningCA2.crt0#
Source: MBAMInstallerService.exe, 00000002.00000003.2024376899.0000015EF4A66000.00000004.00000020.00020000.00000000.sdmp, MBAMInstallerService.exe, 00000002.00000003.2023088147.0000015EF50AE000.00000004.00001000.00020000.00000000.sdmp, MBAMInstallerService.exe, 00000002.00000000.1845634681.00007FF784256000.00000002.00000001.01000000.0000000A.sdmp, MBAMInstallerService.exe, 00000002.00000003.2018209780.0000015EF46AB000.00000004.00000020.00020000.00000000.sdmp, MBAMInstallerService.exe, 00000002.00000000.1845634681.00007FF783E9F000.00000002.00000001.01000000.0000000A.sdmp, MBAMInstallerService.exe, 00000002.00000003.2022178107.0000015EF47E0000.00000004.00001000.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2284751755.0000018753023000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000008.00000003.2428356278.0000027072D00000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000008.00000003.2425307600.0000027072CA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: drvinst.exe, 00000008.00000002.2434287955.0000027072C58000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000008.00000003.2432411808.0000027072C58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: MBAMInstallerService.exe, 00000002.00000003.2097374584.0000015EF47E0000.00000004.00001000.00020000.00000000.sdmp, MBAMInstallerService.exe, 00000002.00000003.2097629214.0000015EF4FE0000.00000004.00001000.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2284751755.0000018753023000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: MBAMInstallerService.exe, 00000002.00000003.2097374584.0000015EF47E0000.00000004.00001000.00020000.00000000.sdmp, MBAMInstallerService.exe, 00000002.00000003.2097629214.0000015EF4FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0H
Source: MBAMInstallerService.exe, 00000002.00000003.2097374584.0000015EF47E0000.00000004.00001000.00020000.00000000.sdmp, MBAMInstallerService.exe, 00000002.00000003.2097629214.0000015EF4FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0I
Source: MBVpnTunnelService.exe, 00000005.00000003.2284751755.0000018753023000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0L
Source: MBAMInstallerService.exe, 00000002.00000003.2097374584.0000015EF47E0000.00000004.00001000.00020000.00000000.sdmp, MBAMInstallerService.exe, 00000002.00000003.2097629214.0000015EF4FE0000.00000004.00001000.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2284751755.0000018753023000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: drvinst.exe, 00000008.00000002.2434287955.0000027072CA5000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000008.00000003.2432411808.0000027072CA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: MBAMInstallerService.exe, 00000002.00000003.2024376899.0000015EF4A66000.00000004.00000020.00020000.00000000.sdmp, MBAMInstallerService.exe, 00000002.00000003.2023088147.0000015EF50AE000.00000004.00001000.00020000.00000000.sdmp, MBAMInstallerService.exe, 00000002.00000000.1845634681.00007FF784256000.00000002.00000001.01000000.0000000A.sdmp, MBAMInstallerService.exe, 00000002.00000003.2018209780.0000015EF46AB000.00000004.00000020.00020000.00000000.sdmp, MBAMInstallerService.exe, 00000002.00000000.1845634681.00007FF783E9F000.00000002.00000001.01000000.0000000A.sdmp, MBAMInstallerService.exe, 00000002.00000003.2022178107.0000015EF47E0000.00000004.00001000.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2284751755.0000018753023000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000008.00000003.2428356278.0000027072D00000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000008.00000003.2425307600.0000027072CA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: MBSetup.exe, 00000000.00000000.1650493980.0000000000861000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.adr.org/Forms
Source: MBSetup.exe, 00000000.00000000.1650493980.0000000000861000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.adr.org/Rules
Source: MBSetup.exe, 00000000.00000000.1650493980.0000000000861000.00000002.00000001.01000000.00000003.sdmp, MBSetup.exe, 00000000.00000003.1651236201.0000000002659000.00000004.00000020.00020000.00000000.sdmp, MBSetup.exe, 00000000.00000003.1651265227.000000000265A000.00000004.00000020.00020000.00000000.sdmp, MBSetup.exe, 00000000.00000003.1676201400.000000000283A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: MBAMInstallerService.exe, 00000002.00000000.1845438065.00007FF783D34000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://www.appinf.com/features/enable-partial-reads
Source: MBAMInstallerService.exe, 00000002.00000000.1845438065.00007FF783D34000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://www.appinf.com/features/enable-partial-readshttp://www.appinf.com/properties/bla-maximum-ampl
Source: MBAMInstallerService.exe, 00000002.00000000.1845438065.00007FF783D34000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://www.appinf.com/features/no-whitespace-in-element-content
Source: MBAMInstallerService.exe, 00000002.00000000.1845438065.00007FF783D34000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://www.appinf.com/features/no-whitespace-in-element-contenthttp://xml.org/sax/features/validatio
Source: MBAMInstallerService.exe, 00000002.00000000.1845438065.00007FF783D34000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://www.appinf.com/properties/bla-activation-threshold
Source: MBAMInstallerService.exe, 00000002.00000000.1845438065.00007FF783D34000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://www.appinf.com/properties/bla-maximum-amplification
Source: MBAMInstallerService.exe, 00000002.00000003.2097374584.0000015EF47E0000.00000004.00001000.00020000.00000000.sdmp, MBAMInstallerService.exe, 00000002.00000003.2097629214.0000015EF4FE0000.00000004.00001000.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2284751755.0000018753023000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: MBAMInstallerService.exe, 00000002.00000003.2097374584.0000015EF47E0000.00000004.00001000.00020000.00000000.sdmp, MBAMInstallerService.exe, 00000002.00000003.2097629214.0000015EF4FE0000.00000004.00001000.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2284751755.0000018753023000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: MBSetup.exe, 00000000.00000000.1650493980.0000000000861000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.google.com/policies/privacy
Source: MBSetup.exe, 00000000.00000000.1650493980.0000000000861000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.malwarebytes.com
Source: MBSetup.exe, 00000000.00000000.1650493980.0000000000861000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.malwarebytes.com/legal
Source: drvinst.exe, 00000008.00000003.2432411808.0000027072CCC000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000008.00000002.2434287955.0000027072CCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.h_
Source: MBAMInstallerService.exe, 00000002.00000000.1845438065.00007FF783D34000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://xml.org/sax/features/external-general-entities
Source: MBAMInstallerService.exe, 00000002.00000000.1845438065.00007FF783D34000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://xml.org/sax/features/external-parameter-entities
Source: MBAMInstallerService.exe, 00000002.00000000.1845438065.00007FF783D34000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://xml.org/sax/features/namespace-prefixes
Source: MBAMInstallerService.exe, 00000002.00000000.1845438065.00007FF783D34000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://xml.org/sax/features/namespaces
Source: MBAMInstallerService.exe, 00000002.00000000.1845438065.00007FF783D34000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://xml.org/sax/features/string-interning
Source: MBAMInstallerService.exe, 00000002.00000000.1845438065.00007FF783D34000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://xml.org/sax/features/validation
Source: MBAMInstallerService.exe, 00000002.00000000.1845438065.00007FF783D34000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://xml.org/sax/properties/declaration-handler
Source: MBAMInstallerService.exe, 00000002.00000000.1845438065.00007FF783D34000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://xml.org/sax/properties/lexical-handler
Source: MBAMInstallerService.exe, 00000002.00000003.1901984347.0000015EF3C37000.00000004.00000020.00020000.00000000.sdmp, MBAMInstallerService.exe, 00000002.00000003.1864398090.0000015EF3C37000.00000004.00000020.00020000.00000000.sdmp, MBAMInstallerService.exe, 00000002.00000003.1943216300.0000015EF3C37000.00000004.00000020.00020000.00000000.sdmp, MBAMInstallerService.exe, 00000002.00000003.2008507733.0000015EF3C37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ark.mwbsys.com/
Source: MBAMInstallerService.exe, 00000002.00000003.1943216300.0000015EF3C37000.00000004.00000020.00020000.00000000.sdmp, MBAMInstallerService.exe, 00000002.00000003.2008507733.0000015EF3C37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ark.mwbsys.com/3/N
Source: MBSetup.exe, 00000000.00000003.2622235015.0000000000B0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ark.mwbsys.com/8
Source: MBSetup.exe, 00000000.00000003.2445362612.0000000000AD2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ark.mwbsys.com/LPsd
Source: MBSetup.exe, 00000000.00000003.2622235015.0000000000B0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ark.mwbsys.com/bgext8
Source: MBSetup.exe, 00000000.00000003.2622235015.0000000000B0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ark.mwbsys.com/bgextce
Source: MBAMInstallerService.exe, 00000002.00000003.2008357187.0000015EF3C43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ark.mwbsys.com/mb.dotnetruntime.win.x64/release
Source: MBAMInstallerService.exe, 00000002.00000003.1901984347.0000015EF3C37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ark.mwbsys.com/mbam-c.ctlr.64bitv5/release#R-
Source: MBAMInstallerService.exe, 00000002.00000003.1943053820.0000015EF3C43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ark.mwbsys.com/mbam-c.dbcls.64bitv5/release
Source: MBSetup.exe, 00000000.00000003.2445362612.0000000000B0F000.00000004.00000020.00020000.00000000.sdmp, MBSetup.exe, 00000000.00000003.2622235015.0000000000B0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ark.mwbsys.com/mbam-c.isvc.64bitv5/release
Source: MBSetup.exe, 00000000.00000003.2445362612.0000000000B0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ark.mwbsys.com/mbam-c.isvc.64bitv5/release1
Source: MBAMInstallerService.exe, 00000002.00000003.2008507733.0000015EF3C37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ark.mwbsys.com/q.
Source: MBAMInstallerService.exe, 00000002.00000003.2008450880.0000015EF3BFF000.00000004.00000020.00020000.00000000.sdmp, MBAMInstallerService.exe, 00000002.00000003.1901746615.0000015EF3BFF000.00000004.00000020.00020000.00000000.sdmp, MBAMInstallerService.exe, 00000002.00000003.1864398090.0000015EF3BFF000.00000004.00000020.00020000.00000000.sdmp, MBAMInstallerService.exe, 00000002.00000003.1943161971.0000015EF3BFF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ark.mwbsys.com:443/mbam-c.svc.64bitv5/release
Source: MBSetup.exe, 00000000.00000000.1650493980.0000000000861000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://aws.amazon.com/compliance/
Source: MBAMInstallerService.exe, 00000002.00000000.1845438065.00007FF783D34000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://block.malwarebytes.com
Source: MBAMInstallerService.exe, 00000002.00000000.1845438065.00007FF783D34000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://block.malwarebytes.comallowlistsbgCloudTimeoutblocklistsblockpagebrowserOnlyProtectiondomain
Source: MBSetup.exe, 00000000.00000000.1650493980.0000000000861000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://br.malwarebytes.com/privacy/
Source: MBSetup.exe, 00000000.00000000.1650493980.0000000000861000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://cdn.cookielaw.org/consent/9530a107-0af8-4204-a2c2-217efb78222b.js
Source: MBSetup.exe, 00000000.00000000.1650493980.0000000000861000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://cdn.jsdelivr.net/npm/slick-carousel
Source: MBSetup.exe, 00000000.00000003.2622235015.0000000000AEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.mwbsys.com/
Source: MBAMInstallerService.exe, 00000002.00000003.2008450880.0000015EF3BFF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.mwbsys.com/packages/mb.dotnetruntime.win.x64/5/b/9/c/5b9c2c0ca079ea2f33181a1ef938ca40/51
Source: MBSetup.exe, 00000000.00000003.2622235015.0000000000AEA000.00000004.00000020.00020000.00000000.sdmp, MBSetup.exe, 00000000.00000003.2622235015.0000000000AB9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.mwbsys.com/packages/mbam-c.bgext.32bit/d/6/9/0/d69098824cb3f15eba951cc1848bcc85/11feade3
Source: MBAMInstallerService.exe, 00000002.00000003.1901984347.0000015EF3C37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.mwbsys.com/packages/mbam-c.ctlr.64bitv5/9/e/f/5/9ef598bb4c2426f4b31baebf99fce838/e8691b7
Source: MBAMInstallerService.exe, 00000002.00000003.1943053820.0000015EF3C43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.mwbsys.com/packages/mbam-c.dbcls.64bitv5/7/0/3/c/703c717289fea89d7b39642c7b8bc66e/8a445d
Source: MBSetup.exe, 00000000.00000003.2444345366.0000000000AAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.mwbsys.com/packages/mbam-c.isvc.64bitv5/c/c/9/1/cc91fbc5e424154388afbe808de25ff6/102f6bc
Source: MBAMInstallerService.exe, 00000002.00000000.1845438065.00007FF783D34000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://cdn.mwbsys.com/packages/mbam-c.sevenzip.32bit/0/e/8/7/0e872772dae952c6da648cb5914b4304/91bef
Source: MBAMInstallerService.exe, 00000002.00000003.1864398090.0000015EF3C42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.mwbsys.com/packages/mbam-c.svc.64bitv5/9/2/7/d/927d42fa5b00a0bda8e9604e74f25979/0b804105
Source: MBAMInstallerService.exe, 00000002.00000003.2008507733.0000015EF3C37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.mwbsys.com:443/packages/mb.dotnetruntime.win.x64/5/b/9/c/5b9c2c0ca079ea2f33181a1ef938ca4
Source: MBSetup.exe, 00000000.00000003.2444931439.0000000004C67000.00000004.00000020.00020000.00000000.sdmp, MBSetup.exe, 00000000.00000003.1844874753.0000000004C65000.00000004.00000020.00020000.00000000.sdmp, MBSetup.exe, 00000000.00000003.1844715993.0000000004C64000.00000004.00000020.00020000.00000000.sdmp, MBSetup.exe, 00000000.00000003.1843077591.0000000004C64000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.mwbsys.com:443/packages/mbam-c.isvc.64bitv5/c/c/9/1/cc91fbc5e424154388afbe808de25ff6/102
Source: MBSetup.exe, 00000000.00000000.1650493980.0000000000861000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/slick-carousel/1.6.0/slick-theme.css
Source: MBSetup.exe, 00000000.00000000.1650493980.0000000000861000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/slick-carousel/1.6.0/slick.css
Source: MBSetup.exe, 00000000.00000000.1650493980.0000000000861000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://code.jquery.com/jquery-3.3.1.min.js
Source: MBSetup.exe, 00000000.00000000.1650493980.0000000000861000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://de.malwarebytes.com/privacy/
Source: MBSetup.exe, 00000000.00000000.1650493980.0000000000861000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://es.malwarebytes.com/privacy/
Source: MBSetup.exe, 00000000.00000000.1650493980.0000000000861000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://fr.malwarebytes.com/privacy/
Source: MBSetup.exe, 00000000.00000000.1650493980.0000000000861000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://it.malwarebytes.com/privacy/
Source: MBAMService.exe, 0000000A.00000003.2468398420.000002160A785000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://links.malwarebytes.com
Source: MBSetup.exe, 00000000.00000000.1650375405.0000000000809000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://links.malwarebytes.com/link/uninstalled?days_since_install=launching
Source: MBSetup.exe, 00000000.00000000.1650375405.0000000000809000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://links.malwarebytes.com/support/mb/windows/security-other-avhttps://links.malwarebytes.com/su
Source: MBAMService.exe, 0000000A.00000003.2468398420.000002160A785000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://links.malwarebytes.comYI
Source: MBAMService.exe, 0000000A.00000003.2468398420.000002160A785000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://links.malwarebytes.comfi
Source: MBAMInstallerService.exe, 00000002.00000000.1845438065.00007FF783D34000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://links.malwarebytes.comnohttps://subscribe-staging.mwbsys.comacctOwnerFirstNameacctOwnerLastN
Source: MBAMInstallerService.exe, 00000002.00000000.1845634681.00007FF783E9F000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://malwarebytes.com/support
Source: MBAMInstallerService.exe, 00000002.00000000.1845634681.00007FF783E9F000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://malwarebytes.com/supportstring
Source: MBAMService.exe, 00000009.00000003.2452838840.00000264B427B000.00000004.00000020.00020000.00000000.sdmp, MBAMService.exe, 00000009.00000002.2454379553.00000264B427B000.00000004.00000020.00020000.00000000.sdmp, MBAMService.exe, 00000009.00000003.2453426133.00000264B427B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://msdn.micros
Source: MBSetup.exe, 00000000.00000000.1650493980.0000000000861000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://nl.malwarebytes.com/privacy/
Source: MBSetup.exe, 00000000.00000000.1650493980.0000000000861000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://pl.malwarebytes.com/privacy/
Source: MBSetup.exe, 00000000.00000000.1650493980.0000000000861000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://preferences-mgr.truste.com/
Source: MBSetup.exe, 00000000.00000000.1650493980.0000000000861000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://pt.malwarebytes.com/privacy/
Source: MBSetup.exe, 00000000.00000000.1650493980.0000000000861000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://ru.malwarebytes.com/privacy/
Source: MBAMInstallerService.exe, 00000002.00000003.2024376899.0000015EF4A66000.00000004.00000020.00020000.00000000.sdmp, MBAMInstallerService.exe, 00000002.00000003.2023088147.0000015EF50AE000.00000004.00001000.00020000.00000000.sdmp, MBAMInstallerService.exe, 00000002.00000000.1845634681.00007FF784256000.00000002.00000001.01000000.0000000A.sdmp, MBAMInstallerService.exe, 00000002.00000003.2018209780.0000015EF46AB000.00000004.00000020.00020000.00000000.sdmp, MBAMInstallerService.exe, 00000002.00000000.1845634681.00007FF783E9F000.00000002.00000001.01000000.0000000A.sdmp, MBAMInstallerService.exe, 00000002.00000003.2022178107.0000015EF47E0000.00000004.00001000.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2284751755.0000018753023000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000008.00000003.2428356278.0000027072D00000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000008.00000003.2425307600.0000027072CA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: MBAMInstallerService.exe, 00000002.00000000.1845438065.00007FF783D34000.00000002.00000001.01000000.0000000A.sdmp, MBAMService.exe, 0000000A.00000003.2468740901.000002160A797000.00000004.00000020.00020000.00000000.sdmp, MBAMService.exe, 0000000A.00000003.2468398420.000002160A785000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://subscribe-staging.mwbsys.com
Source: MBSetup.exe, 00000000.00000000.1650375405.0000000000809000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.malwarebytes.com/hc/en-us/articles/360039142934-Installation-troubleshooting-for-Mal
Source: MBAMInstallerService.exe, 00000002.00000003.2097374584.0000015EF47E0000.00000004.00001000.00020000.00000000.sdmp, MBAMInstallerService.exe, 00000002.00000003.2097629214.0000015EF4FE0000.00000004.00001000.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2284751755.0000018753023000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: MBSetup.exe, 00000000.00000000.1650493980.0000000000861000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.google.com/policies/privacy
Source: MBSetup.exe, 00000000.00000000.1650493980.0000000000861000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.jamsadr.com/eu-us-privacy-shield.
Source: MBSetup.exe, 00000000.00000000.1650493980.0000000000861000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.malwarebytes.com/eula/
Source: MBSetup.exe, 00000000.00000000.1650493980.0000000000861000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.malwarebytes.com/eula/services-agreement/
Source: MBSetup.exe, 00000000.00000000.1650493980.0000000000861000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.malwarebytes.com/images/mb-logo-2.png
Source: MBSetup.exe, 00000000.00000000.1650493980.0000000000861000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.malwarebytes.com/images/share/Malwarebytes-homepage-share.jpg
Source: MBSetup.exe, 00000000.00000000.1650493980.0000000000861000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.malwarebytes.com/images/uploads/2020/07/30233020/EULA_Chart-2.png
Source: MBSetup.exe, 00000000.00000000.1650493980.0000000000861000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.malwarebytes.com/js/mess.js
Source: MBSetup.exe, 00000000.00000000.1650375405.0000000000809000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.malwarebytes.com/legal/privacy-policyopenhttps://www.malwarebytes.com/eula/MBAM-Crelease
Source: MBSetup.exe, 00000000.00000000.1650493980.0000000000861000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.malwarebytes.com/privacy/
Source: MBSetup.exe, 00000000.00000000.1650493980.0000000000861000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.malwarebytes.com/support/lifecycle/
Source: MBSetup.exe, 00000000.00000000.1650493980.0000000000861000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.privacyshield.gov/article?id=How-to-Submit-a-Complaint
Source: MBSetup.exe, 00000000.00000000.1650493980.0000000000861000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.privacyshield.gov/list
Source: MBAMInstallerService.exe, 00000002.00000003.2097374584.0000015EF47E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.wireguard.com/D
Source: MBAMInstallerService.exe, 00000002.00000003.2097374584.0000015EF47E0000.00000004.00001000.00020000.00000000.sdmp, MBAMInstallerService.exe, 00000002.00000003.2097629214.0000015EF4FE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.wireguard.net/D
Source: MBSetup.exe, 00000000.00000000.1650493980.0000000000861000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.youronlinechoices.eu/

E-Banking Fraud

Drops certificate files (DER)

Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\servicepkg\mbamelam.cat	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{edf7d8d8-304a-1448-a26a-bba0a7428f74}\mbtun.cat (copy)	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\mbamelam.cat	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Program Files\Malwarebytes\Anti-Malware\mbtun\mbtun.cat	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	File created: C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.cat	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{edf7d8d8-304a-1448-a26a-bba0a7428f74}\SETA714.tmp	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dbclspkg\starfieldrootcag2_new.cer	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dbclspkg\MBUpdate.cat	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	File created: C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.cat	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\servicepkg\starfieldrootcag2_new.crt	Jump to dropped file

Spam, unwanted Advertisements and Ransom Demands

Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe

Code function: 5_2_00007FF7514F7870 BCryptOpenAlgorithmProvider,BCryptDestroyKey,BCryptCloseAlgorithmProvider,BCryptImportKeyPair,BCryptVerifySignature,BCryptDestroyKey,

5_2_00007FF7514F7870

System Summary

Creates driver files

Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe

File created: C:\Windows\TEMP\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\servicepkg\mbamelam.sys

Creates files inside the driver directory

Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe

File created: C:\Windows\System32\DriverStore\FileRepository\netelx.inf_amd64_7812e4e45c4a5eb1\netelx.PNF

Creates files inside the system directory

Source: C:\Users\user\Desktop\MBSetup.exe	File created: C:\Windows\SysWOW64\drivers\mbamtestfile.dat	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\netelx.inf_amd64_7812e4e45c4a5eb1\netelx.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\usbnet.inf_amd64_9e6bb7a4b7338267\usbnet.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\netax88179_178a.inf_amd64_b6748bc8bb8ccf4d\netax88179_178a.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\netvchannel.inf_amd64_ba3e73aa330c95d6\netvchannel.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\netr28x.inf_amd64_5d63c7bcbf29107f\netr28x.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\ykinx64.inf_amd64_0bbd8466b526ef26\ykinx64.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\netwmbclass.inf_amd64_dba6eeaf0544a4e0\netwmbclass.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\netrtwlane01.inf_amd64_b02695ef070d7a42\netrtwlane01.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\netl160a.inf_amd64_e4cbe375963a69e9\netl160a.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\netl260a.inf_amd64_783312763f8749c7\netl260a.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\net1ic64.inf_amd64_5f033e913d34d111\net1ic64.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\netl1e64.inf_amd64_8d5ca5ab1472fc44\netl1e64.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\dc21x4vm.inf_amd64_3294fc34256dbb0e\dc21x4vm.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\net7500-x64-n650f.inf_amd64_cc87c915f33d1c27\net7500-x64-n650f.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\ipoib6x.inf_amd64_ef71073a5867971f\ipoib6x.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\net9500-x64-n650f.inf_amd64_e92c5a65e41993f9\net9500-x64-n650f.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\net7800-x64-n650f.inf_amd64_178f1bdb49a6e2fd\net7800-x64-n650f.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\e2xw10x64.inf_amd64_04c2ae40613a06ff\e2xw10x64.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\ndisimplatformmp.inf_amd64_8de1181bfd1f1628\ndisimplatformmp.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\bcmdhd64.inf_amd64_e0bae6831f60ea5f\bcmdhd64.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\netmlx5.inf_amd64_101a408e6cb1d8f8\netmlx5.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\netv1x64.inf_amd64_30040c3eb9d7ade4\netv1x64.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\nett4x64.inf_amd64_54eacac1858c78ab\nett4x64.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\net819xp.inf_amd64_ff7a5dd4f9b1ceba\net819xp.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\net1yx64.inf_amd64_8604d8a50804b9c1\net1yx64.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\netbc63a.inf_amd64_7ba6c9cea77dd549\netbc63a.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\nete1e3e.inf_amd64_895623810c19146a\nete1e3e.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\nete1g3e.inf_amd64_af58b4e19562a3f9\nete1g3e.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\net44amd.inf_amd64_450d4b1e35cc8e0d\net44amd.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\netvf63a.inf_amd64_a090e6cfaf18cb5c\netvf63a.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\netvg63a.inf_amd64_9f5493180b1252cf\netvg63a.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\netrasa.inf_amd64_1bdf7a435cb3580d\netrasa.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\netwbw02.inf_amd64_1c4077fa004e73b4\netwbw02.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\netnvma.inf_amd64_7080f6b8ea1744fb\netnvma.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\netwew00.inf_amd64_325c0bd6349ed81c\netwew00.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\netwew01.inf_amd64_153e01d761813df2\netwew01.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\netloop.inf_amd64_762588e32974f9e8\netloop.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\netnvm64.inf_amd64_35bbbe80dec15683\netnvm64.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\netmyk64.inf_amd64_1f949c30555f4111\netmyk64.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\netrtl64.inf_amd64_8e9c2368fe308df2\netrtl64.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\netxex64.inf_amd64_ede00b448bfe8099\netxex64.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\netwsw00.inf_amd64_24d55504ae3587aa\netwsw00.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\netwns64.inf_amd64_162bb49f925c6463\netwns64.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\wnetvsc.inf_amd64_268e58b44338d192\wnetvsc.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\netwlv64.inf_amd64_0b9818131664d91e\netwlv64.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\netrtwlane_13.inf_amd64_992f4f46e65f30d4\netrtwlane_13.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\netwtw02.inf_amd64_42e02bae858d0fbd\netwtw02.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\netwtw04.inf_amd64_c8f5ae6576289a2d\netwtw04.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\netwtw06.inf_amd64_2edd50e7a54d503b\netwtw06.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\netefe3e.inf_amd64_7830581a689ef40d\netefe3e.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\msux64w10.inf_amd64_5aa81644af5957b3\msux64w10.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\netr28ux.inf_amd64_d5996f2a9d9aa9e3\netr28ux.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\netwtw08.inf_amd64_7c0c516fb22456cd\netwtw08.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\rtux64w10.inf_amd64_d6132e4c7fe2fac6\rtux64w10.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\netax88772.inf_amd64_5d1c92f42d958529\netax88772.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\bcmwdidhdpcie.inf_amd64_977dcc915465b0e9\bcmwdidhdpcie.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\netbxnda.inf_amd64_1fff3bc87a99b0f1\netbxnda.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\netavpna.inf_amd64_f6f0831ba09dd9f5\netavpna.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\net8192se64.inf_amd64_167684f9283b4eca\net8192se64.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\rndiscmp.inf_amd64_81bff1eb756435c6\rndiscmp.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\net8187se64.inf_amd64_99a4ca261f585f17\net8187se64.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\net8187bv64.inf_amd64_bc859d32f3e2f0d5\net8187bv64.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\netrndis.inf_amd64_be4ba6237d385e2e\netrndis.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\net8192su64.inf_amd64_66c8bfc7a4b1feed\net8192su64.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\netathrx.inf_amd64_220db23f5419ea8d\netathrx.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\netsstpa.inf_amd64_e76c5387d67e3fd6\netsstpa.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\rtwlanu_oldic.inf_amd64_1a82423cc076e882\rtwlanu_oldic.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\netl1c63x64.inf_amd64_4d6630ce07a4fb42\netl1c63x64.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\mwlu97w8x64.inf_amd64_23bc3dc6d91eebdc\mwlu97w8x64.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\netathr10x.inf_amd64_2691c4f95b80eb3b\netathr10x.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\kdnic.inf_amd64_6649425cdcae9b5f\kdnic.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\c_net.inf_amd64_32a9ad23c1ecc42d\c_net.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\net8185.inf_amd64_7a30f5a9441cd55b\net8185.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\msdri.inf_amd64_97bef65a8432edd4\msdri.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\wceisvista.inf_amd64_07ad61d07466a58a\wceisvista.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\mrvlpcie8897.inf_amd64_07fc330c5a5730ca\mrvlpcie8897.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\netrtwlane.inf_amd64_20caba88bd7f0bb3\netrtwlane.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\netvwifimp.inf_amd64_ec11d0ad3c5b262a\netvwifimp.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\netg664.inf_amd64_84cd7b2798e0a666\netg664.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\netrtwlans.inf_amd64_97cd1a72c2a7829c\netrtwlans.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\netrtwlanu.inf_amd64_1815bafd14dc59f0\netrtwlanu.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\netvwwanmp.inf_amd64_f9e30429669d7fff\netvwwanmp.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\net7400-x64-n650.inf_amd64_557ce3b37c3e0e3b\net7400-x64-n650.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\rt640x64.inf_amd64_8984d8483eef476c\rt640x64.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\athw8x.inf_amd64_55014eff4ceefbdf\athw8x.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\b57nd60a.inf_amd64_77a731ab08be20a5\b57nd60a.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\netbc64.inf_amd64_b96cdf411c43c00c\netbc64.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\netmlx4eth63.inf_amd64_3809a4a3e7e07703\netmlx4eth63.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\bthpan.inf_amd64_b06c3bc32f7db374\bthpan.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\netk57a.inf_amd64_d823e3edc27ae17c\netk57a.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\netjme.inf_amd64_752bf22f1598bb7e\netjme.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\usbncm.inf_amd64_9957a38c3d2283ed\usbncm.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\netimm.inf_amd64_8b2087393aaef952\netimm.PNF
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Windows\System32\DriverStore\FileRepository\netr7364.inf_amd64_310ee0bc0af86ba3\netr7364.PNF
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\FileRepository\mbtun.inf_amd64_add82795013a7c3b
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\drvstore.tmp
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\inf\oem4.inf
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	File created: C:\Windows\system32\DRIVERS\MbamElam.sys
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	File created: C:\Windows\ELAMBKUP\MbamElam.sys
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	File created: C:\Windows\system32\DRIVERS\mbamswissarmy.sys
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	File created: C:\Windows\system32\DRIVERS\MbamChameleon.sys
Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Deletes files inside the Windows folder

Source: C:\Users\user\Desktop\MBSetup.exe

File deleted: C:\Windows\SysWOW64\drivers\mbamtestfile.dat

Detected potential crypto function

Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	Code function: 5_2_00007FF75165DAF4	5_2_00007FF75165DAF4
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	Code function: 5_2_00007FF7514F5210	5_2_00007FF7514F5210
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	Code function: 5_2_00007FF7514F21B0	5_2_00007FF7514F21B0
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	Code function: 5_2_00007FF7514B3BA2	5_2_00007FF7514B3BA2
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	Code function: 5_2_00007FF7514FABC0	5_2_00007FF7514FABC0
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	Code function: 5_2_00007FF7514F9E00	5_2_00007FF7514F9E00
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	Code function: 5_2_00007FF7514F0070	5_2_00007FF7514F0070
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	Code function: 5_2_00007FF7514B5860	5_2_00007FF7514B5860
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	Code function: 5_2_00007FF7514C0AE0	5_2_00007FF7514C0AE0
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	Code function: 5_2_00007FF751665468	5_2_00007FF751665468
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	Code function: 5_2_00007FF7514C5440	5_2_00007FF7514C5440
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	Code function: 5_2_00007FF751556C30	5_2_00007FF751556C30
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	Code function: 5_2_00007FF751661B5C	5_2_00007FF751661B5C
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	Code function: 5_2_00007FF7514CF3C0	5_2_00007FF7514CF3C0
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	Code function: 5_2_00007FF7514C03B7	5_2_00007FF7514C03B7
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	Code function: 5_2_00007FF7514B8E30	5_2_00007FF7514B8E30
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	Code function: 5_2_00007FF7514CF640	5_2_00007FF7514CF640
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	Code function: 5_2_00007FF7514C3560	5_2_00007FF7514C3560
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	Code function: 5_2_00007FF75165E5D8	5_2_00007FF75165E5D8
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	Code function: 5_2_00007FF7514B2090	5_2_00007FF7514B2090
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	Code function: 5_2_00007FF751662838	5_2_00007FF751662838
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	Code function: 5_2_00007FF7514D08E0	5_2_00007FF7514D08E0
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	Code function: 5_2_00007FF75164BF78	5_2_00007FF75164BF78
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	Code function: 5_2_00007FF75163D7B0	5_2_00007FF75163D7B0

Enables security privileges

Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe

Process token adjusted: Security

Found potential string decryption / allocating functions

Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	Code function: String function: 00007FF7514B3570 appears 99 times
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	Code function: String function: 00007FF7514B3630 appears 49 times

PE file contains executable resources (Code or Archives)

Source: MBSetup.exe	Static PE information: Resource name: RT_STRING type: 0420 Alliant virtual executable not stripped
Source: MBAMInstallerService.exe.0.dr	Static PE information: Resource name: BINARY type: 7-zip archive data, version 0.4
Source: MBAMInstallerService.exe.0.dr	Static PE information: Resource name: RESOURCEFILE type: PE32 executable (GUI) Intel 80386, for MS Windows
Source: MBAMInstallerService.exe.0.dr	Static PE information: Resource name: RESOURCEFILE type: PE32+ executable (DLL) (GUI) x86-64, for MS Windows

PE file does not import any functions

Source: api-ms-win-core-heap-l1-1-0.dll.2.dr	Static PE information: No import functions for PE file found
Source: System.Xml.XPath.XDocument.dll.2.dr	Static PE information: No import functions for PE file found
Source: System.Web.HttpUtility.dll.2.dr	Static PE information: No import functions for PE file found

Uses 32bit PE files

Source: MBSetup.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: sus38.troj.evad.winEXE@37/761@0/25

Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe

Code function: 5_2_00007FF751506470 GetCurrentThread,OpenThreadToken,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,CloseHandle,AdjustTokenPrivileges,CloseHandle,

5_2_00007FF751506470

Source: C:\Users\user\Desktop\MBSetup.exe

File created: C:\Program Files (x86)\mbamtestfile.dat

Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe

File created: C:\Users\Public\Desktop\Malwarebytes.lnk

Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Mutant created: \Sessions\1\BaseNamedObjects\MalwarebytesDbIntegrityMonitor
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Mutant created: NULL
Source: C:\Users\user\Desktop\MBSetup.exe	Mutant created: \Sessions\1\BaseNamedObjects\C__Users_user_Desktop_MBSetup.exe
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3896:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7932:120:WilError_03

Source: C:\Users\user\Desktop\MBSetup.exe

File created: C:\Users\user\AppData\Local\Temp\mbsetup.log

Source: MBSetup.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\MBSetup.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT processorID FROM win32_processor
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT processorID FROM win32_processor
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT processorID FROM win32_processor
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT processorID FROM win32_processor
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT processorID FROM win32_processor

Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe

File read: C:\Program Files\desktop.ini

Source: C:\Users\user\Desktop\MBSetup.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: MBVpnTunnelService.exe	String found in binary or memory: /installmbtun
Source: MBVpnTunnelService.exe	String found in binary or memory: /installmbtunlegacy

Source: unknown	Process created: C:\Users\user\Desktop\MBSetup.exe "C:\Users\user\Desktop\MBSetup.exe"
Source: unknown	Process created: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe "C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Process created: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe "C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe" /installmbtun
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\drvinst.exe DrvInst.exe "4" "9" "C:\Program Files\Malwarebytes\Anti-Malware\mbtun\mbtun.inf" "9" "4ba9030c7" "0000000000000158" "Service-0x0-3e7$\Default" "0000000000000168" "208" "C:\Program Files\Malwarebytes\Anti-Malware\mbtun"
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Process created: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe "C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe" /Service /Protected
Source: unknown	Process created: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe "C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Process created: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe "C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe" nowindow
Source: C:\Users\user\Desktop\MBSetup.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C timeout /t 1 & "C:\Program Files\Mozilla Firefox\firefox.exe" -install -extension "C:\Users\user\AppData\Local\Temp\{242af0bb-db11-4734-b7a0-61cb8a9b20fb}.xpi"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -install -extension "C:\Users\user\AppData\Local\Temp\{242af0bb-db11-4734-b7a0-61cb8a9b20fb}.xpi"
Source: unknown	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -install -extension C:\Users\user\AppData\Local\Temp\{242af0bb-db11-4734-b7a0-61cb8a9b20fb}.xpi --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -install -extension C:\Users\user\AppData\Local\Temp\{242af0bb-db11-4734-b7a0-61cb8a9b20fb}.xpi
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2308 -parentBuildID 20230927232528 -prefsHandle 2244 -prefMapHandle 2236 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d6a919bd-c3c7-4ef4-a914-d79422c03b0c} 2948 "\\.\pipe\gecko-crash-server-pipe.2948" 13b7a26d310 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1484 -parentBuildID 20230927232528 -prefsHandle 1172 -prefMapHandle 4036 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {98e93150-a637-4ba5-a6bb-da042e33bf31} 2948 "\\.\pipe\gecko-crash-server-pipe.2948" 13b0a834310 rdd
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5232 -parentBuildID 20230927232528 -sandboxingKind 0 -prefsHandle 5272 -prefMapHandle 5244 -prefsLen 33043 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2eae8c4e-3b3b-4929-bb0e-9deade986469} 2948 "\\.\pipe\gecko-crash-server-pipe.2948" 13b126ed110 utility
Source: C:\Users\user\Desktop\MBSetup.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C timeout /t 1 & "C:\Program Files\Mozilla Firefox\firefox.exe" -install -extension "C:\Users\user\AppData\Local\Temp\{242af0bb-db11-4734-b7a0-61cb8a9b20fb}.xpi"	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Process created: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe "C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe" /installmbtun	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Process created: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe "C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe" /Service /Protected	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\drvinst.exe DrvInst.exe "4" "9" "C:\Program Files\Malwarebytes\Anti-Malware\mbtun\mbtun.inf" "9" "4ba9030c7" "0000000000000158" "Service-0x0-3e7$\Default" "0000000000000168" "208" "C:\Program Files\Malwarebytes\Anti-Malware\mbtun"
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Process created: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe "C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe" nowindow
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -install -extension "C:\Users\user\AppData\Local\Temp\{242af0bb-db11-4734-b7a0-61cb8a9b20fb}.xpi"
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -install -extension C:\Users\user\AppData\Local\Temp\{242af0bb-db11-4734-b7a0-61cb8a9b20fb}.xpi
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2308 -parentBuildID 20230927232528 -prefsHandle 2244 -prefMapHandle 2236 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d6a919bd-c3c7-4ef4-a914-d79422c03b0c} 2948 "\\.\pipe\gecko-crash-server-pipe.2948" 13b7a26d310 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1484 -parentBuildID 20230927232528 -prefsHandle 1172 -prefMapHandle 4036 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {98e93150-a637-4ba5-a6bb-da042e33bf31} 2948 "\\.\pipe\gecko-crash-server-pipe.2948" 13b0a834310 rdd
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5232 -parentBuildID 20230927232528 -sandboxingKind 0 -prefsHandle 5272 -prefMapHandle 5244 -prefsLen 33043 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2eae8c4e-3b3b-4929-bb0e-9deade986469} 2948 "\\.\pipe\gecko-crash-server-pipe.2948" 13b126ed110 utility
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\MBSetup.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MBSetup.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\MBSetup.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MBSetup.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\MBSetup.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MBSetup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\MBSetup.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MBSetup.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MBSetup.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\MBSetup.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\MBSetup.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\MBSetup.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\MBSetup.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\MBSetup.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MBSetup.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\MBSetup.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\MBSetup.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\MBSetup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\MBSetup.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MBSetup.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\MBSetup.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\MBSetup.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\MBSetup.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MBSetup.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\MBSetup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\MBSetup.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\MBSetup.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MBSetup.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MBSetup.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MBSetup.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\MBSetup.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\MBSetup.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\MBSetup.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\MBSetup.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MBSetup.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\MBSetup.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\MBSetup.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\MBSetup.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\MBSetup.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\MBSetup.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\MBSetup.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\MBSetup.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\MBSetup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\MBSetup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\MBSetup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\MBSetup.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\MBSetup.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\MBSetup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\MBSetup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\MBSetup.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\MBSetup.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\MBSetup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Section loaded: authz.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Section loaded: devrtl.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Section loaded: dsreg.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Section loaded: lpk.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	Section loaded: apphelp.dll
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	Section loaded: mpr.dll
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	Section loaded: netapi32.dll
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	Section loaded: sfc.dll
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	Section loaded: version.dll
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	Section loaded: authz.dll
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	Section loaded: netutils.dll
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	Section loaded: sfc_os.dll
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	Section loaded: msasn1.dll
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	Section loaded: msi.dll
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	Section loaded: devobj.dll
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	Section loaded: devrtl.dll
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	Section loaded: drvstore.dll
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	Section loaded: spinf.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpnpmgr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: devrtl.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: devrtl.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: drvstore.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cabinet.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: gpapi.dll
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Section loaded: apphelp.dll
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Section loaded: mpr.dll
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Section loaded: powrprof.dll
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Section loaded: userenv.dll
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Section loaded: netapi32.dll
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Section loaded: sfc.dll
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Section loaded: version.dll
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Section loaded: authz.dll
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Section loaded: netutils.dll
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Section loaded: sfc_os.dll
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Section loaded: umpdc.dll
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Section loaded: msasn1.dll
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Section loaded: devrtl.dll
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Section loaded: spinf.dll
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Section loaded: drvstore.dll
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Section loaded: ntmarta.dll
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Section loaded: cryptbase.dll
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Section loaded: uxtheme.dll
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Section loaded: icu.dll
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Section loaded: dwrite.dll
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Section loaded: windows.storage.dll
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Section loaded: wldp.dll
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Section loaded: profapi.dll
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Section loaded: sxs.dll
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Section loaded: wlanapi.dll
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Section loaded: winnsi.dll
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Section loaded: dnsapi.dll
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Section loaded: dhcpcsvc.dll
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Section loaded: winhttp.dll
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Section loaded: wscapi.dll
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Section loaded: urlmon.dll
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Section loaded: iertutil.dll
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Section loaded: srvcli.dll
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Section loaded: netutils.dll
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Section loaded: mswsock.dll
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Section loaded: wshunix.dll
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Section loaded: winrnr.dll
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Section loaded: nlaapi.dll
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Section loaded: wshbth.dll
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Section loaded: devobj.dll
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Section loaded: pnrpnsp.dll
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Section loaded: napinsp.dll
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Section loaded: rasadhlp.dll
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Section loaded: sspicli.dll
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Section loaded: schannel.dll
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Section loaded: mskeyprotect.dll
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Section loaded: ntasn1.dll
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Section loaded: ncrypt.dll
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Section loaded: ncryptsslp.dll
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Section loaded: msasn1.dll
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Section loaded: cryptsp.dll
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Section loaded: rsaenh.dll
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Section loaded: cryptbase.dll
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Section loaded: gpapi.dll
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Section loaded: windowscodecs.dll
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Section loaded: textshaping.dll
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: version.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll

Source: C:\Users\user\Desktop\MBSetup.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Found GUI installer (many successful clicks)

Source: C:\Users\user\Desktop\MBSetup.exe	Automated click: Install
Source: C:\Users\user\Desktop\MBSetup.exe	Automated click: Install
Source: C:\Users\user\Desktop\MBSetup.exe	Automated click: Next
Source: C:\Users\user\Desktop\MBSetup.exe	Automated click: Install
Source: C:\Users\user\Desktop\MBSetup.exe	Automated click: Next
Source: C:\Users\user\Desktop\MBSetup.exe	Automated click: Install
Source: C:\Users\user\Desktop\MBSetup.exe	Automated click: Next
Source: C:\Users\user\Desktop\MBSetup.exe	Automated click: Install
Source: C:\Users\user\Desktop\MBSetup.exe	Automated click: Next
Source: C:\Users\user\Desktop\MBSetup.exe	Automated click: Install
Source: C:\Users\user\Desktop\MBSetup.exe	Automated click: Next
Source: C:\Users\user\Desktop\MBSetup.exe	Automated click: Install
Source: C:\Users\user\Desktop\MBSetup.exe	Automated click: Next
Source: C:\Users\user\Desktop\MBSetup.exe	Automated click: Install
Source: C:\Users\user\Desktop\MBSetup.exe	Automated click: Next
Source: C:\Users\user\Desktop\MBSetup.exe	Automated click: Install
Source: C:\Users\user\Desktop\MBSetup.exe	Automated click: Next
Source: C:\Users\user\Desktop\MBSetup.exe	Automated click: Install
Source: C:\Users\user\Desktop\MBSetup.exe	Automated click: Next
Source: C:\Users\user\Desktop\MBSetup.exe	Automated click: Install
Source: C:\Users\user\Desktop\MBSetup.exe	Automated click: Next
Source: C:\Users\user\Desktop\MBSetup.exe	Automated click: Install
Source: C:\Users\user\Desktop\MBSetup.exe	Automated click: Next
Source: C:\Users\user\Desktop\MBSetup.exe	Automated click: Install
Source: C:\Users\user\Desktop\MBSetup.exe	Automated click: Next
Source: C:\Users\user\Desktop\MBSetup.exe	Automated click: Install
Source: C:\Users\user\Desktop\MBSetup.exe	Automated click: Next
Source: C:\Users\user\Desktop\MBSetup.exe	Automated click: Install
Source: C:\Users\user\Desktop\MBSetup.exe	Automated click: Next
Source: C:\Users\user\Desktop\MBSetup.exe	Automated click: Install
Source: C:\Users\user\Desktop\MBSetup.exe	Automated click: Next
Source: C:\Users\user\Desktop\MBSetup.exe	Automated click: Install
Source: C:\Users\user\Desktop\MBSetup.exe	Automated click: Next
Source: C:\Users\user\Desktop\MBSetup.exe	Automated click: Install
Source: C:\Users\user\Desktop\MBSetup.exe	Automated click: Next
Source: C:\Users\user\Desktop\MBSetup.exe	Automated click: Install
Source: C:\Users\user\Desktop\MBSetup.exe	Automated click: Next
Source: C:\Users\user\Desktop\MBSetup.exe	Automated click: Install

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Found installer window with terms and condition text

Source: C:\Users\user\Desktop\MBSetup.exe

Uses Microsoft Silverlight

Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe

File opened: C:\Windows\TEMP\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\mscorrc.dll

Checks if Microsoft Office is installed

Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Microsoft\Office

Creates a directory in C:\Program Files

Source: C:\Users\user\Desktop\MBSetup.exe	Directory created: C:\Program Files\Malwarebytes	Jump to behavior
Source: C:\Users\user\Desktop\MBSetup.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware	Jump to behavior
Source: C:\Users\user\Desktop\MBSetup.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\604834ce-d89f-4e94-a75c-9c4d5b683f67	Jump to behavior
Source: C:\Users\user\Desktop\MBSetup.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\1a8fa819fc8a11ee9711ecf4bbea1588	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\1a8fa81afc8a11ee9c96ecf4bbea1588	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\mbuns.exe	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\hostfxr.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\.version	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-console-l1-1-0.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-console-l1-2-0.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-datetime-l1-1-0.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-debug-l1-1-0.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-errorhandling-l1-1-0.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-fibers-l1-1-0.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-file-l1-1-0.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-file-l1-2-0.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-file-l2-1-0.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-handle-l1-1-0.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-heap-l1-1-0.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-interlocked-l1-1-0.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-libraryloader-l1-1-0.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-localization-l1-2-0.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-memory-l1-1-0.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-namedpipe-l1-1-0.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-processenvironment-l1-1-0.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-processthreads-l1-1-0.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-processthreads-l1-1-1.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-profile-l1-1-0.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-rtlsupport-l1-1-0.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-string-l1-1-0.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-synch-l1-1-0.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-sysinfo-l1-1-0.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-timezone-l1-1-0.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-util-l1-1-0.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-conio-l1-1-0.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-convert-l1-1-0.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-environment-l1-1-0.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-heap-l1-1-0.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-locale-l1-1-0.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-math-l1-1-0.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-multibyte-l1-1-0.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-private-l1-1-0.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-process-l1-1-0.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-runtime-l1-1-0.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-stdio-l1-1-0.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-string-l1-1-0.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-time-l1-1-0.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-utility-l1-1-0.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\clretwrc.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\clrjit.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\coreclr.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\createdump.exe	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\dbgshim.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\hostpolicy.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\Microsoft.CSharp.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\Microsoft.DiaSymReader.Native.amd64.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\Microsoft.NETCore.App.deps.json	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\Microsoft.NETCore.App.runtimeconfig.json	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\Microsoft.VisualBasic.Core.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\Microsoft.VisualBasic.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\Microsoft.Win32.Primitives.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\Microsoft.Win32.Registry.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\mscordaccore.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\mscordaccore_amd64_amd64_6.0.2824.12007.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\mscordbi.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\mscorlib.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\mscorrc.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\msquic.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\netstandard.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.AppContext.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Buffers.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Collections.Concurrent.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Collections.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Collections.Immutable.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Collections.NonGeneric.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Collections.Specialized.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.ComponentModel.Annotations.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.ComponentModel.DataAnnotations.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.ComponentModel.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.ComponentModel.EventBasedAsync.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.ComponentModel.Primitives.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.ComponentModel.TypeConverter.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Configuration.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Console.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Core.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Data.Common.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Data.DataSetExtensions.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Data.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Diagnostics.Contracts.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Diagnostics.Debug.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Diagnostics.DiagnosticSource.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Diagnostics.FileVersionInfo.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Diagnostics.Process.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Diagnostics.StackTrace.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Diagnostics.TextWriterTraceListener.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Diagnostics.Tools.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Diagnostics.TraceSource.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Diagnostics.Tracing.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Drawing.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Drawing.Primitives.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Dynamic.Runtime.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Formats.Asn1.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Globalization.Calendars.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Globalization.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Globalization.Extensions.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.IO.Compression.Brotli.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.IO.Compression.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.IO.Compression.FileSystem.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.IO.Compression.Native.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.IO.Compression.ZipFile.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.IO.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.IO.FileSystem.AccessControl.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.IO.FileSystem.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.IO.FileSystem.DriveInfo.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.IO.FileSystem.Primitives.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.IO.FileSystem.Watcher.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.IO.IsolatedStorage.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.IO.MemoryMappedFiles.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.IO.Pipes.AccessControl.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.IO.Pipes.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.IO.UnmanagedMemoryStream.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Linq.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Linq.Expressions.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Linq.Parallel.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Linq.Queryable.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Memory.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Net.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Net.Http.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Net.Http.Json.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Net.HttpListener.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Net.Mail.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Net.NameResolution.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Net.NetworkInformation.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Net.Ping.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Net.Primitives.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Net.Quic.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Net.Requests.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Net.Security.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Net.ServicePoint.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Net.Sockets.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Net.WebClient.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Net.WebHeaderCollection.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Net.WebProxy.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Net.WebSockets.Client.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Net.WebSockets.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Numerics.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Numerics.Vectors.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.ObjectModel.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Private.CoreLib.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Private.DataContractSerialization.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Private.Uri.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Private.Xml.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Private.Xml.Linq.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Reflection.DispatchProxy.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Reflection.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Reflection.Emit.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Reflection.Emit.ILGeneration.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Reflection.Emit.Lightweight.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Reflection.Extensions.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Reflection.Metadata.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Reflection.Primitives.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Reflection.TypeExtensions.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Resources.Reader.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Resources.ResourceManager.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Resources.Writer.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.CompilerServices.Unsafe.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.CompilerServices.VisualC.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.Extensions.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.Handles.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.InteropServices.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.InteropServices.RuntimeInformation.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.Intrinsics.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.Loader.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.Numerics.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.Serialization.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.Serialization.Formatters.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.Serialization.Json.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.Serialization.Primitives.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.Serialization.Xml.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Security.AccessControl.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Security.Claims.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Security.Cryptography.Algorithms.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Security.Cryptography.Cng.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Security.Cryptography.Csp.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Security.Cryptography.Encoding.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Security.Cryptography.OpenSsl.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Security.Cryptography.Primitives.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Security.Cryptography.X509Certificates.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Security.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Security.Principal.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Security.Principal.Windows.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Security.SecureString.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.ServiceModel.Web.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.ServiceProcess.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Text.Encoding.CodePages.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Text.Encoding.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Text.Encoding.Extensions.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Text.Encodings.Web.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Text.Json.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Text.RegularExpressions.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Threading.Channels.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Threading.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Threading.Overlapped.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Threading.Tasks.Dataflow.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Threading.Tasks.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Threading.Tasks.Extensions.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Threading.Tasks.Parallel.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Threading.Thread.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Threading.ThreadPool.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Threading.Timer.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Transactions.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Transactions.Local.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.ValueTuple.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Web.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Web.HttpUtility.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Windows.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Xml.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Xml.Linq.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Xml.ReaderWriter.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Xml.Serialization.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Xml.XDocument.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Xml.XmlDocument.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Xml.XmlSerializer.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Xml.XPath.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\System.Xml.XPath.XDocument.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\ucrtbase.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.28\WindowsBase.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\Accessibility.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\cs	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\Microsoft.VisualBasic.Forms.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\PresentationCore.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\PresentationFramework.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\PresentationUI.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\ReachFramework.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\System.Windows.Controls.Ribbon.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\System.Windows.Forms.Design.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\System.Windows.Forms.Primitives.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\System.Windows.Forms.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\System.Windows.Input.Manipulations.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\System.Xaml.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\UIAutomationClient.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\UIAutomationClientSideProviders.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\UIAutomationProvider.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\UIAutomationTypes.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\WindowsBase.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\WindowsFormsIntegration.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\D3DCompiler_47_cor3.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\de	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\de\Microsoft.VisualBasic.Forms.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\de\PresentationCore.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\de\PresentationFramework.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\de\PresentationUI.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\de\ReachFramework.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\de\System.Windows.Controls.Ribbon.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\de\System.Windows.Forms.Design.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\de\System.Windows.Forms.Primitives.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\de\System.Windows.Forms.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\de\System.Windows.Input.Manipulations.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\de\System.Xaml.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\de\UIAutomationClient.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\de\UIAutomationClientSideProviders.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\de\UIAutomationProvider.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\de\UIAutomationTypes.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\de\WindowsBase.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\de\WindowsFormsIntegration.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\DirectWriteForwarder.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\es	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\es\Microsoft.VisualBasic.Forms.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\es\PresentationCore.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\es\PresentationFramework.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\es\PresentationUI.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\es\ReachFramework.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\es\System.Windows.Controls.Ribbon.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\es\System.Windows.Forms.Design.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\es\System.Windows.Forms.Primitives.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\es\System.Windows.Forms.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\es\System.Windows.Input.Manipulations.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\es\System.Xaml.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\es\UIAutomationClient.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\es\UIAutomationClientSideProviders.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\es\UIAutomationProvider.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\es\UIAutomationTypes.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\es\WindowsBase.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\es\WindowsFormsIntegration.resources.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.28\fr	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\mbtun
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\mbtun\mbtun.sys
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\mbtun\mbtun.inf
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\mbtun\mbtun.cat
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\sdk
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.sys
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.inf
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.cat
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.tmf
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.sys
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.inf
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.cat
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Directory created: C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.tmf

Creates a software uninstall entry

Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1

PE / OLE file has a valid certificate

Source: MBSetup.exe

Static PE information: certificate valid

Submission file is bigger than most known malware samples

Source: MBSetup.exe

Static file information: File size 2589624 > 1048576

PE file has a big raw section

Source: MBSetup.exe

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x179200

PE file contains a mix of data directories often seen in goodware

Source: MBSetup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: MBSetup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: MBSetup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: MBSetup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: MBSetup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: MBSetup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: MBSetup.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

PE file contains a debug data directory

Source: MBSetup.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Binary contains paths to debug symbols

Source:	Binary string: e:\jenkins\workspace\N_MBTunDriver\bin\x64\WinR_Release\mbtun.pdb source: MBVpnTunnelService.exe, 00000005.00000003.2284751755.0000018753023000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000008.00000003.2428356278.0000027072D00000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000008.00000003.2425307600.0000027072CA9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: d:\jenkins\workspace\N_inserr\bin\Win32\Release\inserr.pdb source: MBAMInstallerService.exe, 00000002.00000000.1845634681.00007FF783E9F000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: d:\jenkins\workspace\N_MBVpn_MBTunInstaller\bin\x64\Release\mbtun.pdb source: MBVpnTunnelService.exe, 00000005.00000003.2284751755.0000018753023000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: e:\jenkins\workspace\N_MBTunDriver\bin\x64\Win7_Release\mbtun.pdb source: MBVpnTunnelService.exe, 00000005.00000003.2284751755.0000018753023000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: d:\jenkins\workspace\N_Elam_Kernel\bin\x64\Win7_Release\MbamElam.pdb source: MBAMInstallerService.exe, 00000002.00000003.2023088147.0000015EF50AE000.00000004.00001000.00020000.00000000.sdmp, MBAMInstallerService.exe, 00000002.00000003.2097374584.0000015EF47E0000.00000004.00001000.00020000.00000000.sdmp, MBAMInstallerService.exe, 00000002.00000003.2097629214.0000015EF4FE0000.00000004.00001000.00020000.00000000.sdmp, MBAMInstallerService.exe, 00000002.00000003.2022178107.0000015EF47E0000.00000004.00001000.00020000.00000000.sdmp, MBAMService.exe, 00000009.00000003.2452465973.00000264B4280000.00000004.00000020.00020000.00000000.sdmp, MBAMService.exe, 00000009.00000003.2452838840.00000264B4280000.00000004.00000020.00020000.00000000.sdmp, MBAMService.exe, 00000009.00000003.2446597783.00000264B4284000.00000004.00000020.00020000.00000000.sdmp, MBAMService.exe, 00000009.00000003.2453426133.00000264B4280000.00000004.00000020.00020000.00000000.sdmp, MBAMService.exe, 00000009.00000002.2454379553.00000264B4280000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: d:\jenkins\workspace\N_MBVpnTunnel\bin\x64\Release\MBVpnTunnelService.pdb source: MBVpnTunnelService.exe, 00000005.00000000.2282427452.00007FF751687000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: D:\Jenkins\workspace\N_MBAMService\bin\x64\Release\MBAMService.pdb~ source: MBAMInstallerService.exe, 00000002.00000003.2023088147.0000015EF50AE000.00000004.00001000.00020000.00000000.sdmp, MBAMService.exe, 00000009.00000002.2455239360.00007FF7E274F000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: D:\Jenkins\workspace\N_7zip_vs2022\7z2301-src\CPP\7zip\Bundles\Format7zF\x64\7z.pdb source: MBAMInstallerService.exe, 00000002.00000003.2024376899.0000015EF4A66000.00000004.00000020.00020000.00000000.sdmp, MBAMInstallerService.exe, 00000002.00000003.2018209780.0000015EF46AB000.00000004.00000020.00020000.00000000.sdmp, MBAMInstallerService.exe, 00000002.00000000.1845634681.00007FF783E9F000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: C:\Projects\MBAE\MBAENA\src\mbae-sys\MadCodeHook-MBDriver\MBMCHDrv\bin\x64\release\mbae64.pdb source: MBAMInstallerService.exe, 00000002.00000003.2097374584.0000015EF47E0000.00000004.00001000.00020000.00000000.sdmp, MBAMInstallerService.exe, 00000002.00000003.2097629214.0000015EF4FE0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\Jenkins\workspace\N_MB5_InstallerService\bin\x64\Release\MBAMIService.pdb source: MBAMInstallerService.exe, 00000002.00000000.1845438065.00007FF783D34000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: C:\Jenkins\workspace\MBAM-Windows\A_MB5_MBSetup\bin\Win32\Release\MBSetup.pdb source: MBSetup.exe, 00000000.00000000.1650375405.0000000000809000.00000002.00000001.01000000.00000003.sdmp
Source:	Binary string: D:\Jenkins\workspace\N_MBAMService\bin\x64\Release\MBAMService.pdb source: MBAMInstallerService.exe, 00000002.00000003.2023088147.0000015EF50AE000.00000004.00001000.00020000.00000000.sdmp, MBAMService.exe, 00000009.00000002.2455239360.00007FF7E274F000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: C:\Users\Jason A. Donenfeld\Projects\wireguard-nt\Release\arm64\setupapihost.pdb source: MBAMInstallerService.exe, 00000002.00000003.2097374584.0000015EF47E0000.00000004.00001000.00020000.00000000.sdmp, MBAMInstallerService.exe, 00000002.00000003.2097629214.0000015EF4FE0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\Jenkins\workspace\N_MB5_InstallerService\bin\x64\Release\MBAMIService.pdbS source: MBAMInstallerService.exe, 00000002.00000000.1845438065.00007FF783D34000.00000002.00000001.01000000.0000000A.sdmp

PE file contains a valid data directory to section mapping

Source: MBSetup.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: MBSetup.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: MBSetup.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: MBSetup.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: MBSetup.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

Binary contains a suspicious time stamp

Source: System.Web.dll.2.dr

Static PE information: 0xA8C18CA1 [Sat Sep 20 04:12:17 2059 UTC]

PE file contains sections with non-standard names

Source: MBAMInstallerService.exe.0.dr

Static PE information: section name: _RDATA

Uses code obfuscation techniques (call, push, ret)

Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	Code function: 5_2_00007FF7514BA592 push rbp; iretd	5_2_00007FF7514BA59B
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	Code function: 5_2_00007FF7514D205D push rbp; iretd	5_2_00007FF7514D205E
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	Code function: 5_2_00007FF7514D1F4D push rbp; iretd	5_2_00007FF7514D1F4E

Persistence and Installation Behavior

Installs new ROOT certificates

Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A Blob	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E Blob	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2 Blob	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 Blob	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8DA7F965EC5EFC37910F1C6E59FDC1CC6A6EDE16 Blob	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\5A8CEF45D7A69859767A8C8B4496B578CF474B1A Blob	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0D44DD8C3C8C1A1A58756481E90F2E2AFFB3D26E Blob	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F6108407D6F8BB67980CC2E244C2EBAE1CEF63BE Blob	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F6108407D6F8BB67980CC2E244C2EBAE1CEF63BE Blob
Source: C:\Windows\System32\drvinst.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2 Blob
Source: C:\Windows\System32\drvinst.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 Blob
Source: C:\Windows\System32\drvinst.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E Blob
Source: C:\Windows\System32\drvinst.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A Blob
Source: C:\Windows\System32\drvinst.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8DA7F965EC5EFC37910F1C6E59FDC1CC6A6EDE16 Blob
Source: C:\Windows\System32\drvinst.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\5A8CEF45D7A69859767A8C8B4496B578CF474B1A Blob
Source: C:\Windows\System32\drvinst.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0D44DD8C3C8C1A1A58756481E90F2E2AFFB3D26E Blob
Source: C:\Windows\System32\drvinst.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F6108407D6F8BB67980CC2E244C2EBAE1CEF63BE Blob
Source: C:\Windows\System32\drvinst.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2 Blob
Source: C:\Windows\System32\drvinst.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 Blob
Source: C:\Windows\System32\drvinst.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E Blob
Source: C:\Windows\System32\drvinst.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A Blob
Source: C:\Windows\System32\drvinst.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8DA7F965EC5EFC37910F1C6E59FDC1CC6A6EDE16 Blob
Source: C:\Windows\System32\drvinst.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\5A8CEF45D7A69859767A8C8B4496B578CF474B1A Blob
Source: C:\Windows\System32\drvinst.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0D44DD8C3C8C1A1A58756481E90F2E2AFFB3D26E Blob
Source: C:\Windows\System32\drvinst.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F6108407D6F8BB67980CC2E244C2EBAE1CEF63BE Blob
Source: C:\Windows\System32\drvinst.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2 Blob
Source: C:\Windows\System32\drvinst.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 Blob
Source: C:\Windows\System32\drvinst.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E Blob
Source: C:\Windows\System32\drvinst.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A Blob
Source: C:\Windows\System32\drvinst.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8DA7F965EC5EFC37910F1C6E59FDC1CC6A6EDE16 Blob
Source: C:\Windows\System32\drvinst.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\5A8CEF45D7A69859767A8C8B4496B578CF474B1A Blob
Source: C:\Windows\System32\drvinst.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0D44DD8C3C8C1A1A58756481E90F2E2AFFB3D26E Blob

Drops PE files

Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\fr\System.Windows.Input.Manipulations.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\fr\UIAutomationClientSideProviders.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Diagnostics.FileVersionInfo.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Text.Encoding.CodePages.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Configuration.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MwacLib.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\es\PresentationUI.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.AppContext.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\fr\PresentationFramework.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	File created: C:\ProgramData\Malwarebytes\MBAMService\lkg_db\BrowserSDKDLL.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\Microsoft.VisualBasic.Forms.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\UIAutomationClient.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\wintun.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MbamUI.Services.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.ServiceProcess.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\Accessibility.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\SelfProtectionSdk.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\mbshlext.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\fr\System.Xaml.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.IO.FileSystem.AccessControl.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\mbupdatr.exe	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	File created: C:\Program Files\Malwarebytes\Anti-Malware\mbtun\mbtun.sys	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\Microsoft.VisualBasic.Forms.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\it\System.Windows.Forms.Design.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Threading.Tasks.Dataflow.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\es\UIAutomationTypes.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Malwarebytes_Assistant.exe	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\7z.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\it\PresentationUI.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\coreclr.dll	Jump to dropped file
Source: C:\Users\user\Desktop\MBSetup.exe	File created: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Microsoft.Data.Sqlite.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\PresentationCore.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\DryIoc.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MbamUI.UICommon.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Diagnostics.StackTrace.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Prism.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Serilog.Enrichers.Thread.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	File created: C:\Windows\System32\drivers\MbamElam.sys	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\pl\UIAutomationClientSideProviders.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\DirectWriteForwarder.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\createdump.exe	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ja\UIAutomationTypes.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ja\UIAutomationClient.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Security.Principal.Windows.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Sentry.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\WindowsBase.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\pl\UIAutomationProvider.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Xml.XPath.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-interlocked-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.InteropServices.RuntimeInformation.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\System.Windows.Forms.Design.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Private.Xml.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Security.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\it\PresentationCore.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Diagnostics.TraceSource.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.IO.FileSystem.Primitives.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\it\UIAutomationClient.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\SQLitePCLRaw.provider.e_sqlite3.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\Microsoft.VisualBasic.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Net.Requests.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\mscorlib.dll	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{edf7d8d8-304a-1448-a26a-bba0a7428f74}\SETA745.tmp	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.ComponentModel.EventBasedAsync.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MBVpnTunnel_mbtun.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\clretwrc.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dbclspkg\MBAMCoreV5.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\es\System.Windows.Forms.Design.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-profile-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\e_sqlcipher.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ja\PresentationUI.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	File created: C:\Windows\ELAMBKUP\MbamElam.sys	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.IO.FileSystem.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\dbgshim.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ja\System.Xaml.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.IO.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\System.Xaml.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Data.Common.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Net.WebHeaderCollection.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ja\UIAutomationProvider.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\ActionsShim.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Formats.Asn1.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ja\PresentationCore.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\es\UIAutomationClientSideProviders.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Reflection.Emit.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\it\System.Windows.Input.Manipulations.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\fr\PresentationUI.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.Serialization.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Net.Http.Json.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ja\System.Windows.Controls.Ribbon.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\mb5uns.exe	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\7z.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\System.Text.Json.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\SQLitePCLRaw.core.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Security.Cryptography.Csp.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-console-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Resources.Reader.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MWACControllerImpl.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\de\System.Windows.Controls.Ribbon.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.IO.MemoryMappedFiles.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\mscorrc.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-rtlsupport-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ja\PresentationFramework.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\es\System.Xaml.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\mbcut.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\es\System.Windows.Forms.Primitives.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\es\PresentationCore.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Net.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\mbamelam.sys	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Malwarebytes.UI.Theme.Light.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\System.Management.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Malwarebytes.exe	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.ComponentModel.Primitives.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Net.Http.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\pl\PresentationUI.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\de\PresentationUI.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\de\WindowsFormsIntegration.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.ComponentModel.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Threading.Overlapped.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Collections.Specialized.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\fr\System.Windows.Forms.Primitives.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\PenImc_cor3.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\es\Microsoft.VisualBasic.Forms.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\UpdateControllerImpl.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\Microsoft.VisualBasic.Core.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Web.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Threading.Tasks.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\mbupdatr.exe	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\Microsoft.Win32.Primitives.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\System.Text.Encodings.Web.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Core.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Malwarebytes.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ja\System.Windows.Input.Manipulations.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Text.Encodings.Web.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ko\ReachFramework.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ja\UIAutomationClientSideProviders.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\mbae-api-na.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Collections.NonGeneric.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Security.Cryptography.Cng.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ko\System.Windows.Forms.Design.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.Serialization.Xml.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Transactions.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\e_sqlite3.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.Extensions.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Security.Cryptography.X509Certificates.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Security.Cryptography.OpenSsl.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Malwarebytes.UI.TrayNotification.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Data.DataSetExtensions.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\pl\WindowsFormsIntegration.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\SwissarmyShim.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\de\System.Windows.Forms.Primitives.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-file-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-libraryloader-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\pl\WindowsBase.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Microsoft.Extensions.Options.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Diagnostics.TextWriterTraceListener.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Microsoft.EntityFrameworkCore.Relational.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Net.NetworkInformation.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\AEControllerImpl.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Security.AccessControl.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MbamUI.Data.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.IO.Compression.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.Serialization.Formatters.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-utility-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Xml.XmlDocument.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.IO.FileSystem.DriveInfo.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Reflection.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Xml.Linq.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Console.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dbclspkg\sampleV5.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-private-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Xml.ReaderWriter.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\mbae.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dbclspkg\BrowserSDKDLLV5.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\clrjit.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\pl\System.Windows.Forms.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Numerics.Vectors.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Microsoft.EntityFrameworkCore.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Microsoft.Extensions.Primitives.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-sysinfo-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Net.ServicePoint.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Windows.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ja\WindowsBase.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\TelemetryControllerImpl.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Text.Encoding.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Reflection.Primitives.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\de\PresentationCore.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\System.DirectoryServices.Protocols.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\Microsoft.Win32.SystemEvents.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\System.Windows.Forms.Primitives.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.IO.FileSystem.Watcher.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.IO.IsolatedStorage.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Resources.ResourceManager.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Net.NameResolution.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Malwarebytes.UI.Controls.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Linq.Expressions.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\UIAutomationProvider.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\netstandard.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.IO.Compression.ZipFile.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Net.Security.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\PresentationUI.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Malwarebytes.UI.Style.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\LicenseControllerImpl.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ko\PresentationUI.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\fr\UIAutomationClient.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\es\WindowsBase.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ko\System.Xaml.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	File created: C:\ProgramData\Malwarebytes\MBAMService\lkg_db\ig.exe	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\SQLitePCLRaw.provider.e_sqlcipher.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\de\PresentationFramework.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Diagnostics.Tracing.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Threading.Channels.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.IO.Compression.FileSystem.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Web.HttpUtility.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ko\System.Windows.Controls.Ribbon.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\pl\Microsoft.VisualBasic.Forms.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\de\System.Windows.Input.Manipulations.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Text.RegularExpressions.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.Serialization.Primitives.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Text.Json.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Transactions.Local.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\pl\ReachFramework.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Linq.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\de\ReachFramework.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\host\fxr\6.0.28\hostfxr.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-multibyte-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\hostpolicy.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.ComponentModel.TypeConverter.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.IO.Pipes.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Dynamic.Runtime.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Linq.Parallel.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\mbae64.sys	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\fr\UIAutomationTypes.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Net.Quic.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Net.WebSockets.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\mbamsisdk.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\ReachFramework.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\es\System.Windows.Forms.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\System.DirectoryServices.AccountManagement.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Prism.DryIoc.Wpf.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MBAMWsc.exe	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\de\System.Xaml.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.ComponentModel.Annotations.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Program Files\Malwarebytes\Anti-Malware\mbuns.exe	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\SQLitePCLRaw.batteries_v2.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\BrowserSDKDLLShim.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-process-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Drawing.Primitives.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\it\System.Windows.Controls.Ribbon.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.Intrinsics.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Threading.ThreadPool.dll	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{edf7d8d8-304a-1448-a26a-bba0a7428f74}\mbtun.sys (copy)	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.CompilerServices.VisualC.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\fr\Microsoft.VisualBasic.Forms.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\pl\UIAutomationTypes.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\rtp.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Net.Ping.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	File created: C:\ProgramData\Malwarebytes\MBAMService\lkg_db\Actions.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\WindowsFormsIntegration.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-util-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Net.WebProxy.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dbclspkg\igV5.exe	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MbamUI.Tray.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ko\UIAutomationClientSideProviders.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\Microsoft.CSharp.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Diagnostics.DiagnosticSource.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ja\System.Windows.Forms.Primitives.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\it\UIAutomationProvider.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Collections.Immutable.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\de\WindowsBase.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MBVpnTunnelService.exe	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\pl\System.Windows.Controls.Ribbon.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Microsoft.Extensions.DependencyInjection.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Security.SecureString.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Net.Sockets.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ja\Microsoft.VisualBasic.Forms.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\sentrynativesdk.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\fr\System.Windows.Forms.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\es\System.Windows.Input.Manipulations.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Reflection.DispatchProxy.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ja\System.Windows.Forms.Design.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Drawing.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\de\UIAutomationClientSideProviders.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.CompilerServices.Unsafe.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Collections.Concurrent.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Microsoft.Extensions.Logging.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Net.Primitives.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MBUpdateDlg.exe	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Security.Cryptography.Algorithms.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\pl\PresentationFramework.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\System.Windows.Forms.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\System.Windows.Input.Manipulations.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\es\WindowsFormsIntegration.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\Microsoft.Win32.Registry.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\it\UIAutomationClientSideProviders.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-handle-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Security.Cryptography.Encoding.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\PresentationFramework.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\QRCoder.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\ArwLib.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Threading.Timer.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.Loader.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.ValueTuple.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\fr\UIAutomationProvider.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Threading.Tasks.Parallel.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Security.Principal.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Malwarebytes.UI.Theme.Primitives.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Reflection.Emit.Lightweight.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\de\Microsoft.VisualBasic.Forms.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-debug-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Buffers.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-string-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-errorhandling-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\RTPControllerImpl.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll (copy)	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Globalization.Extensions.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\WindowsBase.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\it\UIAutomationTypes.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Resources.Writer.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Swissarmy.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\fr\System.Windows.Forms.Design.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\offreg.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	File created: C:\ProgramData\Malwarebytes\MBAMService\lkg_db\MBAMCore.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ko\Microsoft.VisualBasic.Forms.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ko\UIAutomationTypes.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Globalization.Calendars.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\System.Diagnostics.EventLog.Messages.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\it\WindowsBase.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\fr\PresentationCore.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\mbampt.exe	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Globalization.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\it\System.Windows.Forms.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Microsoft.Extensions.Configuration.Abstractions.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MBAMCrashHandler.exe	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Serilog.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Malwarebytes_Assistant.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\it\PresentationFramework.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Microsoft.Extensions.Caching.Abstractions.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.IO.Compression.Native.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.Numerics.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ko\WindowsBase.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\es\UIAutomationClient.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MBAMShim.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Assistant.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Memory.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Diagnostics.Process.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ko\System.Windows.Input.Manipulations.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\pl\PresentationCore.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-console-l1-2-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Xml.XPath.XDocument.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.Serialization.Json.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Malwarebytes.UI.Theme.Dark.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Microsoft.Xaml.Behaviors.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.Handles.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Reflection.Metadata.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Private.Uri.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\CloudControllerImpl.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\MBUpdateDlg.exe	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\D3DCompiler_47_cor3.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\it\ReachFramework.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\mbtun.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Private.DataContractSerialization.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-namedpipe-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Private.CoreLib.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\de\System.Windows.Forms.Design.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.InteropServices.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Prism.Container.Extensions.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Diagnostics.Contracts.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\PresentationCore.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\VPNControllerImpl.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ja\System.Windows.Forms.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Assistant.exe	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\System.ServiceProcess.ServiceController.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\System.Windows.Controls.Ribbon.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\SPControllerImpl.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\it\WindowsFormsIntegration.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ko\PresentationFramework.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Threading.Thread.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Data.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\servicepkg\MBAMService.exe	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.ComponentModel.DataAnnotations.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Xml.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\ucrtbase.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Diagnostics.Tools.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MBVpnTunnel_wintun.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ko\System.Windows.Forms.Primitives.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-localization-l1-2-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\mscordaccore_amd64_amd64_6.0.2824.12007.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\de\UIAutomationClient.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\de\UIAutomationProvider.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\fr\ReachFramework.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\pl\UIAutomationClient.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.IO.UnmanagedMemoryStream.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-processenvironment-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\Microsoft.Win32.Registry.AccessControl.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\pl\System.Windows.Forms.Design.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Collections.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ko\UIAutomationClient.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\fr\System.Windows.Controls.Ribbon.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\pl\System.Xaml.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.ObjectModel.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Threading.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\msquic.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\pl\System.Windows.Forms.Primitives.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MBAMService.exe	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Reflection.Extensions.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\es\ReachFramework.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\Microsoft.DiaSymReader.Native.amd64.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MbamUI.Core.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\PoliciesControllerImpl.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Microsoft.Extensions.Logging.Abstractions.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-memory-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-conio-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Net.WebSockets.Client.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\fr\WindowsFormsIntegration.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Threading.Tasks.Extensions.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MBVpnTunnel_wireguard.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Linq.Queryable.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.IO.Compression.Brotli.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-datetime-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ko\System.Windows.Forms.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Malwarebytes.Interop.Activation.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ko\WindowsFormsIntegration.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-synch-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dbclspkg\MBAMCore_b.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\it\System.Windows.Forms.Primitives.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ko\UIAutomationProvider.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\de\UIAutomationTypes.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\SelfProtectionShim.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-fibers-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\mscordaccore.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\mbae64.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Microsoft.Extensions.DependencyModel.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\UIAutomationClientSideProviders.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Reflection.Emit.ILGeneration.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Serilog.Extensions.Logging.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\es\PresentationFramework.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\de\System.Windows.Forms.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-processthreads-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\mscordbi.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Text.Encoding.Extensions.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MbamBgNativeMsg.exe	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\es\System.Windows.Controls.Ribbon.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Diagnostics.Debug.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ko\PresentationCore.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Numerics.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Xml.XmlSerializer.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ja\ReachFramework.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Microsoft.Extensions.DependencyInjection.Abstractions.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Xml.XDocument.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Security.Cryptography.Primitives.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.IO.Pipes.AccessControl.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Xml.Serialization.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Serilog.Enrichers.Process.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Serilog.Sinks.File.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\ArwControllerImpl.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Reflection.TypeExtensions.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Microsoft.Extensions.Caching.Memory.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Net.Mail.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\Microsoft.VisualBasic.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Security.Claims.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.ServiceModel.Web.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MBAMWsc_Legacy.exe	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dbclspkg\ActionsV5.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\UIAutomationTypes.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Microsoft.EntityFrameworkCore.Sqlite.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Private.Xml.Linq.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\ScanControllerImpl.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\it\Microsoft.VisualBasic.Forms.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Net.WebClient.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Microsoft.EntityFrameworkCore.Abstractions.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\it\System.Xaml.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\pl\System.Windows.Input.Manipulations.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\es\UIAutomationProvider.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\CleanControllerImpl.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Net.HttpListener.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Prism.Wpf.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\servicepkg\mbamelam.sys	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\fr\WindowsBase.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ja\WindowsFormsIntegration.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\wireguard.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Malwarebytes.Protection.Interop.dll	Jump to dropped file

Drops PE files to the application program directory (C:\ProgramData)

Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	File created: C:\ProgramData\Malwarebytes\MBAMService\lkg_db\Actions.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	File created: C:\ProgramData\Malwarebytes\MBAMService\lkg_db\ig.exe	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	File created: C:\ProgramData\Malwarebytes\MBAMService\lkg_db\sample.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	File created: C:\ProgramData\Malwarebytes\MBAMService\lkg_db\BrowserSDKDLL.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	File created: C:\ProgramData\Malwarebytes\MBAMService\lkg_db\MBAMCore.dll	Jump to dropped file

Drops PE files to the windows directory (C:\Windows)

Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\fr\System.Windows.Input.Manipulations.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\fr\UIAutomationClientSideProviders.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Diagnostics.FileVersionInfo.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Text.Encoding.CodePages.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Configuration.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MwacLib.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\es\PresentationUI.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.AppContext.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\fr\PresentationFramework.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\Microsoft.VisualBasic.Forms.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\UIAutomationClient.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\wintun.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MbamUI.Services.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.ServiceProcess.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\Accessibility.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\SelfProtectionSdk.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\mbshlext.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\fr\System.Xaml.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.IO.FileSystem.AccessControl.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\mbupdatr.exe	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\Microsoft.VisualBasic.Forms.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\it\System.Windows.Forms.Design.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Threading.Tasks.Dataflow.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\es\UIAutomationTypes.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Malwarebytes_Assistant.exe	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\7z.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\it\PresentationUI.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\coreclr.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Microsoft.Data.Sqlite.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\PresentationCore.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\DryIoc.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MbamUI.UICommon.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Diagnostics.StackTrace.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Prism.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Serilog.Enrichers.Thread.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	File created: C:\Windows\System32\drivers\MbamElam.sys	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\pl\UIAutomationClientSideProviders.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\DirectWriteForwarder.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\createdump.exe	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ja\UIAutomationTypes.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ja\UIAutomationClient.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Security.Principal.Windows.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Sentry.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\WindowsBase.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\pl\UIAutomationProvider.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Xml.XPath.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-interlocked-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.InteropServices.RuntimeInformation.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\System.Windows.Forms.Design.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Private.Xml.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Security.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\it\PresentationCore.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Diagnostics.TraceSource.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.IO.FileSystem.Primitives.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\it\UIAutomationClient.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\SQLitePCLRaw.provider.e_sqlite3.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\Microsoft.VisualBasic.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Net.Requests.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\mscorlib.dll	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{edf7d8d8-304a-1448-a26a-bba0a7428f74}\SETA745.tmp	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.ComponentModel.EventBasedAsync.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MBVpnTunnel_mbtun.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\clretwrc.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dbclspkg\MBAMCoreV5.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\es\System.Windows.Forms.Design.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-profile-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\e_sqlcipher.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ja\PresentationUI.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	File created: C:\Windows\ELAMBKUP\MbamElam.sys	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.IO.FileSystem.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\dbgshim.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ja\System.Xaml.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.IO.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\System.Xaml.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Data.Common.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Net.WebHeaderCollection.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ja\UIAutomationProvider.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\ActionsShim.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Formats.Asn1.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ja\PresentationCore.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\es\UIAutomationClientSideProviders.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Reflection.Emit.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\it\System.Windows.Input.Manipulations.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\fr\PresentationUI.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.Serialization.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Net.Http.Json.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ja\System.Windows.Controls.Ribbon.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\mb5uns.exe	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\7z.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\System.Text.Json.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\SQLitePCLRaw.core.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Security.Cryptography.Csp.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-console-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Resources.Reader.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MWACControllerImpl.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\de\System.Windows.Controls.Ribbon.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.IO.MemoryMappedFiles.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\mscorrc.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-rtlsupport-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ja\PresentationFramework.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\es\System.Xaml.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\mbcut.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\es\System.Windows.Forms.Primitives.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\es\PresentationCore.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Net.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\mbamelam.sys	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Malwarebytes.UI.Theme.Light.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\System.Management.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Malwarebytes.exe	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.ComponentModel.Primitives.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Net.Http.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\pl\PresentationUI.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\de\PresentationUI.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\de\WindowsFormsIntegration.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.ComponentModel.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Threading.Overlapped.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Collections.Specialized.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\fr\System.Windows.Forms.Primitives.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\PenImc_cor3.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\es\Microsoft.VisualBasic.Forms.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\UpdateControllerImpl.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\Microsoft.VisualBasic.Core.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Web.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Threading.Tasks.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\mbupdatr.exe	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\Microsoft.Win32.Primitives.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\System.Text.Encodings.Web.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Core.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Malwarebytes.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ja\System.Windows.Input.Manipulations.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Text.Encodings.Web.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ko\ReachFramework.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ja\UIAutomationClientSideProviders.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\mbae-api-na.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Collections.NonGeneric.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Security.Cryptography.Cng.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ko\System.Windows.Forms.Design.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.Serialization.Xml.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Transactions.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\e_sqlite3.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.Extensions.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Security.Cryptography.X509Certificates.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Security.Cryptography.OpenSsl.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Malwarebytes.UI.TrayNotification.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Data.DataSetExtensions.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\pl\WindowsFormsIntegration.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\SwissarmyShim.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\de\System.Windows.Forms.Primitives.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-file-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-libraryloader-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\pl\WindowsBase.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Microsoft.Extensions.Options.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Diagnostics.TextWriterTraceListener.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Microsoft.EntityFrameworkCore.Relational.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Net.NetworkInformation.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\AEControllerImpl.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Security.AccessControl.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MbamUI.Data.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.IO.Compression.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.Serialization.Formatters.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-utility-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Xml.XmlDocument.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.IO.FileSystem.DriveInfo.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Reflection.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Xml.Linq.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Console.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dbclspkg\sampleV5.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-private-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Xml.ReaderWriter.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\mbae.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dbclspkg\BrowserSDKDLLV5.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\clrjit.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\pl\System.Windows.Forms.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Numerics.Vectors.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Microsoft.EntityFrameworkCore.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Microsoft.Extensions.Primitives.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-sysinfo-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Net.ServicePoint.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Windows.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ja\WindowsBase.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\TelemetryControllerImpl.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Text.Encoding.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Reflection.Primitives.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\de\PresentationCore.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\System.DirectoryServices.Protocols.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\Microsoft.Win32.SystemEvents.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\System.Windows.Forms.Primitives.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.IO.FileSystem.Watcher.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.IO.IsolatedStorage.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Resources.ResourceManager.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Net.NameResolution.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Malwarebytes.UI.Controls.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Linq.Expressions.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\UIAutomationProvider.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\netstandard.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.IO.Compression.ZipFile.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Net.Security.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\PresentationUI.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Malwarebytes.UI.Style.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\LicenseControllerImpl.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ko\PresentationUI.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\fr\UIAutomationClient.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\es\WindowsBase.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ko\System.Xaml.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\SQLitePCLRaw.provider.e_sqlcipher.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\de\PresentationFramework.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Diagnostics.Tracing.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Threading.Channels.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.IO.Compression.FileSystem.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Web.HttpUtility.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ko\System.Windows.Controls.Ribbon.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\pl\Microsoft.VisualBasic.Forms.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\de\System.Windows.Input.Manipulations.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Text.RegularExpressions.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.Serialization.Primitives.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Text.Json.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Transactions.Local.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\pl\ReachFramework.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Linq.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\de\ReachFramework.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\host\fxr\6.0.28\hostfxr.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-multibyte-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\hostpolicy.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.ComponentModel.TypeConverter.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.IO.Pipes.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Dynamic.Runtime.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Linq.Parallel.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\mbae64.sys	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\fr\UIAutomationTypes.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Net.Quic.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Net.WebSockets.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\mbamsisdk.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\ReachFramework.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\es\System.Windows.Forms.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\System.DirectoryServices.AccountManagement.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Prism.DryIoc.Wpf.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MBAMWsc.exe	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\de\System.Xaml.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.ComponentModel.Annotations.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\SQLitePCLRaw.batteries_v2.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\BrowserSDKDLLShim.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-process-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Drawing.Primitives.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\it\System.Windows.Controls.Ribbon.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.Intrinsics.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Threading.ThreadPool.dll	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{edf7d8d8-304a-1448-a26a-bba0a7428f74}\mbtun.sys (copy)	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.CompilerServices.VisualC.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\fr\Microsoft.VisualBasic.Forms.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\pl\UIAutomationTypes.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\rtp.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Net.Ping.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\WindowsFormsIntegration.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-util-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Net.WebProxy.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dbclspkg\igV5.exe	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MbamUI.Tray.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ko\UIAutomationClientSideProviders.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\Microsoft.CSharp.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Diagnostics.DiagnosticSource.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ja\System.Windows.Forms.Primitives.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\it\UIAutomationProvider.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Collections.Immutable.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\de\WindowsBase.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MBVpnTunnelService.exe	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\pl\System.Windows.Controls.Ribbon.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Microsoft.Extensions.DependencyInjection.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Security.SecureString.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Net.Sockets.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ja\Microsoft.VisualBasic.Forms.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\sentrynativesdk.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\fr\System.Windows.Forms.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\es\System.Windows.Input.Manipulations.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Reflection.DispatchProxy.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ja\System.Windows.Forms.Design.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Drawing.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\de\UIAutomationClientSideProviders.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.CompilerServices.Unsafe.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Collections.Concurrent.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Microsoft.Extensions.Logging.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Net.Primitives.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MBUpdateDlg.exe	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Security.Cryptography.Algorithms.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\pl\PresentationFramework.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\System.Windows.Forms.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\System.Windows.Input.Manipulations.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\es\WindowsFormsIntegration.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\Microsoft.Win32.Registry.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\it\UIAutomationClientSideProviders.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-handle-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Security.Cryptography.Encoding.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\PresentationFramework.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\QRCoder.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\ArwLib.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Threading.Timer.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.Loader.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.ValueTuple.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\fr\UIAutomationProvider.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Threading.Tasks.Parallel.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Security.Principal.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Malwarebytes.UI.Theme.Primitives.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Reflection.Emit.Lightweight.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\de\Microsoft.VisualBasic.Forms.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-debug-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Buffers.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-string-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-errorhandling-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\RTPControllerImpl.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Globalization.Extensions.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\WindowsBase.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\it\UIAutomationTypes.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Resources.Writer.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Swissarmy.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\fr\System.Windows.Forms.Design.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\offreg.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ko\Microsoft.VisualBasic.Forms.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ko\UIAutomationTypes.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Globalization.Calendars.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\System.Diagnostics.EventLog.Messages.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\it\WindowsBase.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\fr\PresentationCore.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\mbampt.exe	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Globalization.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\it\System.Windows.Forms.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Microsoft.Extensions.Configuration.Abstractions.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MBAMCrashHandler.exe	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Serilog.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Malwarebytes_Assistant.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\it\PresentationFramework.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Microsoft.Extensions.Caching.Abstractions.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.IO.Compression.Native.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.Numerics.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ko\WindowsBase.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\es\UIAutomationClient.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MBAMShim.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Assistant.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Memory.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Diagnostics.Process.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ko\System.Windows.Input.Manipulations.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\pl\PresentationCore.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-console-l1-2-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Xml.XPath.XDocument.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.Serialization.Json.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Malwarebytes.UI.Theme.Dark.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Microsoft.Xaml.Behaviors.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.Handles.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Reflection.Metadata.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Private.Uri.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\CloudControllerImpl.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\MBUpdateDlg.exe	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	File created: C:\Windows\System32\drivers\MbamChameleon.sys	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\D3DCompiler_47_cor3.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\it\ReachFramework.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\mbtun.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Private.DataContractSerialization.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-namedpipe-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Private.CoreLib.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\de\System.Windows.Forms.Design.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.InteropServices.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Prism.Container.Extensions.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Diagnostics.Contracts.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\PresentationCore.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\VPNControllerImpl.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ja\System.Windows.Forms.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Assistant.exe	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\System.ServiceProcess.ServiceController.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\System.Windows.Controls.Ribbon.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\SPControllerImpl.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\it\WindowsFormsIntegration.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ko\PresentationFramework.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Threading.Thread.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Data.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\servicepkg\MBAMService.exe	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.ComponentModel.DataAnnotations.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Xml.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\ucrtbase.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Diagnostics.Tools.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MBVpnTunnel_wintun.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ko\System.Windows.Forms.Primitives.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-localization-l1-2-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\mscordaccore_amd64_amd64_6.0.2824.12007.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\de\UIAutomationClient.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\de\UIAutomationProvider.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\fr\ReachFramework.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\pl\UIAutomationClient.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.IO.UnmanagedMemoryStream.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-processenvironment-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\Microsoft.Win32.Registry.AccessControl.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\pl\System.Windows.Forms.Design.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Collections.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ko\UIAutomationClient.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\fr\System.Windows.Controls.Ribbon.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\pl\System.Xaml.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	File created: C:\Windows\System32\drivers\mbamswissarmy.sys	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.ObjectModel.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Threading.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\msquic.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\pl\System.Windows.Forms.Primitives.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MBAMService.exe	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Reflection.Extensions.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\es\ReachFramework.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\Microsoft.DiaSymReader.Native.amd64.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MbamUI.Core.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\PoliciesControllerImpl.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Microsoft.Extensions.Logging.Abstractions.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-memory-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-conio-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Net.WebSockets.Client.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\fr\WindowsFormsIntegration.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Threading.Tasks.Extensions.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MBVpnTunnel_wireguard.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Linq.Queryable.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.IO.Compression.Brotli.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-datetime-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ko\System.Windows.Forms.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Malwarebytes.Interop.Activation.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ko\WindowsFormsIntegration.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-synch-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dbclspkg\MBAMCore_b.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\it\System.Windows.Forms.Primitives.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ko\UIAutomationProvider.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\de\UIAutomationTypes.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\SelfProtectionShim.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-fibers-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\mscordaccore.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\mbae64.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Microsoft.Extensions.DependencyModel.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\UIAutomationClientSideProviders.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Reflection.Emit.ILGeneration.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Serilog.Extensions.Logging.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\es\PresentationFramework.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\de\System.Windows.Forms.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-processthreads-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\mscordbi.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Text.Encoding.Extensions.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MbamBgNativeMsg.exe	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\es\System.Windows.Controls.Ribbon.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Diagnostics.Debug.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ko\PresentationCore.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Numerics.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Xml.XmlSerializer.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ja\ReachFramework.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Microsoft.Extensions.DependencyInjection.Abstractions.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Xml.XDocument.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Security.Cryptography.Primitives.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.IO.Pipes.AccessControl.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Xml.Serialization.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Serilog.Enrichers.Process.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Serilog.Sinks.File.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\ArwControllerImpl.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Reflection.TypeExtensions.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Microsoft.Extensions.Caching.Memory.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Net.Mail.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\Microsoft.VisualBasic.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Security.Claims.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.ServiceModel.Web.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MBAMWsc_Legacy.exe	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dbclspkg\ActionsV5.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\UIAutomationTypes.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Microsoft.EntityFrameworkCore.Sqlite.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Private.Xml.Linq.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\ScanControllerImpl.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\it\Microsoft.VisualBasic.Forms.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Net.WebClient.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Microsoft.EntityFrameworkCore.Abstractions.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\it\System.Xaml.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\pl\System.Windows.Input.Manipulations.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\es\UIAutomationProvider.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\CleanControllerImpl.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Net.HttpListener.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Prism.Wpf.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\servicepkg\mbamelam.sys	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\fr\WindowsBase.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ja\WindowsFormsIntegration.resources.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\wireguard.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File created: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Malwarebytes.Protection.Interop.dll	Jump to dropped file

Creates install or setup log file

Source: C:\Users\user\Desktop\MBSetup.exe

File created: C:\Users\user\AppData\Local\Temp\mbsetup.log

Creates an undocumented autostart registry key

Boot Survival

Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\MBAMShlExt NULL
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\MBAMShlExt NULL

Registers a service to start in safe boot mode

Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe

Registry value created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\MBAMService NULL

Creates or modifies windows services

Source: C:\Users\user\Desktop\MBSetup.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MBAMInstallerService\Parameters

Modifies existing windows services

Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MBAMInstallerService\Parameters

Extensive use of GetProcAddress (often used to hide API calls)

Hooking and other Techniques for Hiding and Protection

Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe

Code function: 5_2_00007FF75163D7B0 EncodePointer,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

5_2_00007FF75163D7B0

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Source: C:\Users\user\Desktop\MBSetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries memory information (via WMI often done to detect virtual machines)

Source: C:\Users\user\Desktop\MBSetup.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT serialNumber FROM Win32_PhysicalMemory
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT serialNumber FROM Win32_PhysicalMemory
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT serialNumber FROM Win32_PhysicalMemory
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT serialNumber FROM Win32_PhysicalMemory
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT serialNumber FROM Win32_PhysicalMemory

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Desktop\MBSetup.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT SerialNumber FROM Win32_DiskDrive WHERE Index=0
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT SerialNumber FROM Win32_DiskDrive WHERE Index=0
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT SerialNumber FROM Win32_DiskDrive WHERE Index=0
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT SerialNumber FROM Win32_DiskDrive WHERE Index=0
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT SerialNumber FROM Win32_DiskDrive WHERE Index=0

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Source: C:\Users\user\Desktop\MBSetup.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT serialNumber FROM Win32_PhysicalMemory
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT serialNumber FROM Win32_PhysicalMemory
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT serialNumber FROM Win32_PhysicalMemory
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT serialNumber FROM Win32_PhysicalMemory
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT serialNumber FROM Win32_PhysicalMemory

Allocates memory with a write watch (potentially for evading sandboxes)

Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe

Memory allocated: 295EEAB0000 memory reserve | memory write watch

Contains capabilities to detect virtual machines

Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosDate
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion

Contains long sleeps (>= 3 min)

Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Thread delayed: delay time: 240000
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Thread delayed: delay time: 239656
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Thread delayed: delay time: 239297
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Thread delayed: delay time: 238953
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Thread delayed: delay time: 235781
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Thread delayed: delay time: 235438
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Thread delayed: delay time: 234501
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Thread delayed: delay time: 234162
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Thread delayed: delay time: 233815
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Thread delayed: delay time: 233335
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Thread delayed: delay time: 233006
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Thread delayed: delay time: 232648
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Thread delayed: delay time: 232285
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Thread delayed: delay time: 231927
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Thread delayed: delay time: 231573
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Thread delayed: delay time: 231239
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Thread delayed: delay time: 230892

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Users\user\Desktop\MBSetup.exe	Window / User API: threadDelayed 2669	Jump to behavior
Source: C:\Users\user\Desktop\MBSetup.exe	Window / User API: threadDelayed 7147	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Window / User API: threadDelayed 1522
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Window / User API: threadDelayed 2182
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Window / User API: threadDelayed 807
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Window / User API: threadDelayed 3984

Found dropped PE file which has not been started or loaded

Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\mbamsisdk.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Diagnostics.FileVersionInfo.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\System.DirectoryServices.AccountManagement.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Prism.DryIoc.Wpf.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MBAMWsc.exe	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MwacLib.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Configuration.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.ComponentModel.Annotations.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\SQLitePCLRaw.batteries_v2.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.AppContext.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Dropped PE file which has not been started: C:\ProgramData\Malwarebytes\MBAMService\lkg_db\BrowserSDKDLL.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\BrowserSDKDLLShim.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-process-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.Intrinsics.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Threading.ThreadPool.dll	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{edf7d8d8-304a-1448-a26a-bba0a7428f74}\mbtun.sys (copy)	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.CompilerServices.VisualC.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\rtp.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\wintun.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Net.Ping.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Dropped PE file which has not been started: C:\ProgramData\Malwarebytes\MBAMService\lkg_db\Actions.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.ServiceProcess.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\SelfProtectionSdk.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\Accessibility.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-util-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Net.WebProxy.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dbclspkg\igV5.exe	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\mbshlext.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MbamUI.Tray.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\Microsoft.CSharp.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Diagnostics.DiagnosticSource.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Collections.Immutable.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.IO.FileSystem.AccessControl.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\mbupdatr.exe	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Microsoft.Extensions.DependencyInjection.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	Dropped PE file which has not been started: C:\Program Files\Malwarebytes\Anti-Malware\mbtun\mbtun.sys	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Security.SecureString.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\Microsoft.VisualBasic.Forms.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Net.Sockets.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\sentrynativesdk.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Threading.Tasks.Dataflow.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Reflection.DispatchProxy.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Drawing.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.CompilerServices.Unsafe.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Malwarebytes_Assistant.exe	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\7z.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Collections.Concurrent.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Microsoft.Extensions.Logging.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MBUpdateDlg.exe	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\coreclr.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Security.Cryptography.Algorithms.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Microsoft.Data.Sqlite.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\DryIoc.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MbamUI.UICommon.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Diagnostics.StackTrace.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\Microsoft.Win32.Registry.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-handle-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Prism.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Dropped PE file which has not been started: C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.sys	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Security.Cryptography.Encoding.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Dropped PE file which has not been started: C:\Windows\System32\drivers\MbamElam.sys	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Serilog.Enrichers.Thread.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\createdump.exe	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\DirectWriteForwarder.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Security.Principal.Windows.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\QRCoder.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Sentry.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\ArwLib.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Threading.Timer.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Xml.XPath.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-interlocked-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.Loader.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.ValueTuple.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Threading.Tasks.Parallel.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.InteropServices.RuntimeInformation.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Security.Principal.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Private.Xml.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Security.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Diagnostics.TraceSource.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Reflection.Emit.Lightweight.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\SQLitePCLRaw.provider.e_sqlite3.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-debug-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Buffers.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\Microsoft.VisualBasic.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Net.Requests.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-string-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-errorhandling-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\mscorlib.dll	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{edf7d8d8-304a-1448-a26a-bba0a7428f74}\SETA745.tmp	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\RTPControllerImpl.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.ComponentModel.EventBasedAsync.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Globalization.Extensions.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\WindowsBase.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MBVpnTunnel_mbtun.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\clretwrc.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Resources.Writer.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Swissarmy.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dbclspkg\MBAMCoreV5.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-profile-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\offreg.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Dropped PE file which has not been started: C:\ProgramData\Malwarebytes\MBAMService\lkg_db\MBAMCore.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\e_sqlcipher.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Dropped PE file which has not been started: C:\Windows\ELAMBKUP\MbamElam.sys	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.IO.FileSystem.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Globalization.Calendars.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\dbgshim.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.IO.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Data.Common.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Net.WebHeaderCollection.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\ActionsShim.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Formats.Asn1.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Dropped PE file which has not been started: C:\ProgramData\Malwarebytes\MBAMService\lkg_db\sample.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Reflection.Emit.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\mbampt.exe	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Globalization.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Microsoft.Extensions.Configuration.Abstractions.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MBAMCrashHandler.exe	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Serilog.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Malwarebytes_Assistant.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.Serialization.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Microsoft.Extensions.Caching.Abstractions.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Net.Http.Json.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\mb5uns.exe	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\7z.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.IO.Compression.Native.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\System.Text.Json.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\SQLitePCLRaw.core.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Security.Cryptography.Csp.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.Numerics.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-console-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MBAMShim.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Assistant.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Resources.Reader.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Memory.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MWACControllerImpl.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\mscorrc.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-rtlsupport-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Diagnostics.Process.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\mbcut.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Net.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\mbamelam.sys	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Malwarebytes.UI.Theme.Light.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\System.Management.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Net.Http.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.ComponentModel.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Threading.Overlapped.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-console-l1-2-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Xml.XPath.XDocument.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Collections.Specialized.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\PenImc_cor3.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.Serialization.Json.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Malwarebytes.UI.Theme.Dark.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Microsoft.Xaml.Behaviors.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Reflection.Metadata.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Private.Uri.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\CloudControllerImpl.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\UpdateControllerImpl.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Dropped PE file which has not been started: C:\Windows\System32\drivers\MbamChameleon.sys	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\MBUpdateDlg.exe	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\D3DCompiler_47_cor3.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\Microsoft.VisualBasic.Core.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\mbtun.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Private.DataContractSerialization.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Web.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Threading.Tasks.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\mbupdatr.exe	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-namedpipe-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Private.CoreLib.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\System.Text.Encodings.Web.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Prism.Container.Extensions.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Core.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Diagnostics.Contracts.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\VPNControllerImpl.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Text.Encodings.Web.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\PresentationCore.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Assistant.exe	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\System.ServiceProcess.ServiceController.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\mbae-api-na.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\SPControllerImpl.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Threading.Thread.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Data.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.ComponentModel.DataAnnotations.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Collections.NonGeneric.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Xml.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Security.Cryptography.Cng.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Diagnostics.Tools.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Transactions.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.Serialization.Xml.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\e_sqlite3.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MBVpnTunnel_wintun.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.Extensions.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\mscordaccore_amd64_amd64_6.0.2824.12007.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-localization-l1-2-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Security.Cryptography.OpenSsl.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Malwarebytes.UI.TrayNotification.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Data.DataSetExtensions.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\SwissarmyShim.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.IO.UnmanagedMemoryStream.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-processenvironment-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\Microsoft.Win32.Registry.AccessControl.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-file-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Collections.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-libraryloader-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Microsoft.Extensions.Options.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Diagnostics.TextWriterTraceListener.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Dropped PE file which has not been started: C:\Windows\System32\drivers\mbamswissarmy.sys	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.ObjectModel.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Threading.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Microsoft.EntityFrameworkCore.Relational.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Net.NetworkInformation.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\msquic.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\AEControllerImpl.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Reflection.Extensions.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Security.AccessControl.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MbamUI.Data.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.IO.Compression.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\Microsoft.DiaSymReader.Native.amd64.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MbamUI.Core.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\PoliciesControllerImpl.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.Serialization.Formatters.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Microsoft.Extensions.Logging.Abstractions.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-memory-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-conio-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Net.WebSockets.Client.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-utility-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Threading.Tasks.Extensions.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Xml.XmlDocument.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MBVpnTunnel_wireguard.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Linq.Queryable.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-datetime-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.IO.Compression.Brotli.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.IO.FileSystem.DriveInfo.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Reflection.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Xml.Linq.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Console.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dbclspkg\sampleV5.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Malwarebytes.Interop.Activation.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-private-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-synch-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dbclspkg\MBAMCore_b.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Xml.ReaderWriter.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\mbae.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dbclspkg\BrowserSDKDLLV5.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\SelfProtectionShim.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-fibers-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\mscordaccore.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\clrjit.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\mbae64.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Numerics.Vectors.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Microsoft.Extensions.DependencyModel.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Microsoft.EntityFrameworkCore.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Reflection.Emit.ILGeneration.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-sysinfo-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Serilog.Extensions.Logging.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Net.ServicePoint.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-processthreads-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\mscordbi.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Text.Encoding.Extensions.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Windows.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Dropped PE file which has not been started: C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.sys	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MbamBgNativeMsg.exe	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Diagnostics.Debug.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\TelemetryControllerImpl.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Numerics.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Text.Encoding.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Xml.XmlSerializer.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Microsoft.Extensions.DependencyInjection.Abstractions.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\System.DirectoryServices.Protocols.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\Microsoft.Win32.SystemEvents.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.IO.IsolatedStorage.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.IO.FileSystem.Watcher.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Resources.ResourceManager.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Malwarebytes.UI.Controls.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Net.NameResolution.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Xml.XDocument.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.IO.Pipes.AccessControl.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Xml.Serialization.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Linq.Expressions.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Serilog.Enrichers.Process.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Serilog.Sinks.File.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\netstandard.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\ArwControllerImpl.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.IO.Compression.ZipFile.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Net.Security.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Reflection.TypeExtensions.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Microsoft.Extensions.Caching.Memory.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Malwarebytes.UI.Style.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\LicenseControllerImpl.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Net.Mail.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\Microsoft.VisualBasic.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Security.Claims.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Dropped PE file which has not been started: C:\ProgramData\Malwarebytes\MBAMService\lkg_db\ig.exe	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.ServiceModel.Web.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MBAMWsc_Legacy.exe	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\SQLitePCLRaw.provider.e_sqlcipher.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Diagnostics.Tracing.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Threading.Channels.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.IO.Compression.FileSystem.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dbclspkg\ActionsV5.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Microsoft.EntityFrameworkCore.Sqlite.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\ScanControllerImpl.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Web.HttpUtility.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Private.Xml.Linq.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Net.WebClient.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Microsoft.EntityFrameworkCore.Abstractions.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Text.RegularExpressions.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Text.Json.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Transactions.Local.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\CleanControllerImpl.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Net.HttpListener.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Prism.Wpf.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Linq.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\servicepkg\mbamelam.sys	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\host\fxr\6.0.28\hostfxr.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-multibyte-l1-1-0.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\wireguard.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.ComponentModel.TypeConverter.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\hostpolicy.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Malwarebytes.Protection.Interop.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Dynamic.Runtime.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\mbae64.sys	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Linq.Parallel.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Net.WebSockets.dll	Jump to dropped file
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Dropped PE file which has not been started: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Net.Quic.dll	Jump to dropped file

Is looking for software installed on the system

Source: C:\Users\user\Desktop\MBSetup.exe

Registry key enumerated: More than 232 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Users\user\Desktop\MBSetup.exe TID: 7296	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MBSetup.exe TID: 7384	Thread sleep time: -2669000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\MBSetup.exe TID: 7384	Thread sleep time: -7147000s >= -30000s	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe TID: 7580	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe TID: 2016	Thread sleep time: -60000s >= -30000s
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe TID: 2116	Thread sleep time: -4611686018427385s >= -30000s
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe TID: 2116	Thread sleep time: -240000s >= -30000s
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe TID: 2116	Thread sleep time: -239656s >= -30000s
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe TID: 2116	Thread sleep time: -239297s >= -30000s
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe TID: 2116	Thread sleep time: -238953s >= -30000s
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe TID: 2116	Thread sleep time: -235781s >= -30000s
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe TID: 2116	Thread sleep time: -235438s >= -30000s
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe TID: 2116	Thread sleep time: -234501s >= -30000s
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe TID: 2116	Thread sleep time: -234162s >= -30000s
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe TID: 2116	Thread sleep time: -233815s >= -30000s
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe TID: 2116	Thread sleep time: -129953s >= -30000s
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe TID: 2116	Thread sleep time: -129752s >= -30000s
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe TID: 2116	Thread sleep time: -233335s >= -30000s
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe TID: 2116	Thread sleep time: -129419s >= -30000s
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe TID: 2116	Thread sleep time: -233006s >= -30000s
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe TID: 2116	Thread sleep time: -129056s >= -30000s
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe TID: 2116	Thread sleep time: -232648s >= -30000s
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe TID: 2116	Thread sleep time: -128694s >= -30000s
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe TID: 2116	Thread sleep time: -232285s >= -30000s
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe TID: 2116	Thread sleep time: -128352s >= -30000s
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe TID: 2116	Thread sleep time: -231927s >= -30000s
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe TID: 2116	Thread sleep time: -128005s >= -30000s
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe TID: 2116	Thread sleep time: -231573s >= -30000s
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe TID: 2116	Thread sleep time: -127652s >= -30000s
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe TID: 2116	Thread sleep time: -231239s >= -30000s
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe TID: 2116	Thread sleep time: -127309s >= -30000s
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe TID: 2116	Thread sleep time: -230892s >= -30000s
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe TID: 2116	Thread sleep time: -99388s >= -30000s
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe TID: 2116	Thread sleep time: -126099s >= -30000s
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe TID: 2116	Thread sleep time: -59718s >= -30000s
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe TID: 2116	Thread sleep time: -59252s >= -30000s
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe TID: 2116	Thread sleep time: -58893s >= -30000s
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe TID: 2116	Thread sleep time: -58524s >= -30000s
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe TID: 2116	Thread sleep time: -58191s >= -30000s
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe TID: 2116	Thread sleep time: -57822s >= -30000s
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe TID: 2116	Thread sleep time: -57489s >= -30000s
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe TID: 2116	Thread sleep time: -57073s >= -30000s
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe TID: 2116	Thread sleep time: -56740s >= -30000s
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe TID: 2116	Thread sleep time: -56371s >= -30000s
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe TID: 2116	Thread sleep time: -56039s >= -30000s
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe TID: 2116	Thread sleep time: -55669s >= -30000s
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe TID: 2116	Thread sleep time: -55321s >= -30000s
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe TID: 2116	Thread sleep time: -54967s >= -30000s
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe TID: 2116	Thread sleep time: -54619s >= -30000s
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe TID: 2116	Thread sleep time: -54281s >= -30000s
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe TID: 2116	Thread sleep time: -53942s >= -30000s
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe TID: 2116	Thread sleep time: -53579s >= -30000s
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe TID: 2116	Thread sleep time: -53240s >= -30000s
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe TID: 2116	Thread sleep time: -52876s >= -30000s
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe TID: 2116	Thread sleep time: -52537s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 4556	Thread sleep time: -30000s >= -30000s

Queries disk information (often used to detect virtual machines)

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Source: C:\Users\user\Desktop\MBSetup.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT processorID FROM win32_processor
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT processorID FROM win32_processor
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT processorID FROM win32_processor
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT processorID FROM win32_processor
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT processorID FROM win32_processor

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\MBSetup.exe

File Volume queried: C:\ProgramData FullSizeInformation

Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	Code function: 5_2_00007FF7514B3BA2 FindFirstFileW,FindClose,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,GetLastError,GetLastError,LoadLibraryW,GetLastError,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,		5_2_00007FF7514B3BA2
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	Code function: 5_2_00007FF751513EC0 FindFirstFileW,GetLastError,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,		5_2_00007FF751513EC0

Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Thread delayed: delay time: 240000
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Thread delayed: delay time: 239656
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Thread delayed: delay time: 239297
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Thread delayed: delay time: 238953
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Thread delayed: delay time: 235781
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Thread delayed: delay time: 235438
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Thread delayed: delay time: 234501
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Thread delayed: delay time: 234162
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Thread delayed: delay time: 233815
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Thread delayed: delay time: 129953
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Thread delayed: delay time: 129752
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Thread delayed: delay time: 233335
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Thread delayed: delay time: 129419
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Thread delayed: delay time: 233006
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Thread delayed: delay time: 129056
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Thread delayed: delay time: 232648
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Thread delayed: delay time: 128694
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Thread delayed: delay time: 232285
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Thread delayed: delay time: 128352
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Thread delayed: delay time: 231927
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Thread delayed: delay time: 128005
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Thread delayed: delay time: 231573
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Thread delayed: delay time: 127652
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Thread delayed: delay time: 231239
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Thread delayed: delay time: 127309
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Thread delayed: delay time: 230892
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Thread delayed: delay time: 99388
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Thread delayed: delay time: 126099
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Thread delayed: delay time: 59718
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Thread delayed: delay time: 59252
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Thread delayed: delay time: 58893
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Thread delayed: delay time: 58524
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Thread delayed: delay time: 58191
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Thread delayed: delay time: 57822
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Thread delayed: delay time: 57489
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Thread delayed: delay time: 57073
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Thread delayed: delay time: 56740
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Thread delayed: delay time: 56371
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Thread delayed: delay time: 56039
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Thread delayed: delay time: 55669
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Thread delayed: delay time: 55321
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Thread delayed: delay time: 54967
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Thread delayed: delay time: 54619
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Thread delayed: delay time: 54281
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Thread delayed: delay time: 53942
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Thread delayed: delay time: 53579
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Thread delayed: delay time: 53240
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Thread delayed: delay time: 52876
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Thread delayed: delay time: 52537

Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File opened: C:\Windows\TEMP\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\ArwControllerImpl.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File opened: C:\Windows\TEMP\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\7z.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File opened: C:\Windows\TEMP\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\7z.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File opened: C:\Windows\TEMP\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File opened: C:\Windows\TEMP\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\ActionsShim.dll	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	File opened: C:\Windows\TEMP\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\AEControllerImpl.dll	Jump to behavior

Source: MBVpnTunnelService.exe, 00000005.00000003.2337416620.00000187528A2000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2355991897.00000187533D1000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2327677941.00000187528B1000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2334651799.00000187528AB000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2353688897.00000187528A2000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2351424730.00000187528A2000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2329473191.00000187528A8000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2352470075.00000187528A5000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2391960961.00000187537DB000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2419608475.0000018753957000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft Hyper-V Network Adapter
Source: MBVpnTunnelService.exe, 00000005.00000003.2337416620.00000187528A2000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2355991897.00000187533D1000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2327677941.00000187528B1000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2334651799.00000187528AB000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2353688897.00000187528A2000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2351424730.00000187528A2000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2329473191.00000187528A8000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2352470075.00000187528A5000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2391960961.00000187537DB000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2419608475.0000018753957000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft hyper-v vpn network adapter
Source: MBVpnTunnelService.exe, 00000005.00000003.2391960961.00000187537DB000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2419608475.0000018753957000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft hyper-v ethernet network adapter
Source: MBVpnTunnelService.exe, 00000005.00000003.2337416620.00000187528A2000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2327677941.00000187528B1000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2334651799.00000187528AB000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2353688897.00000187528A2000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2351424730.00000187528A2000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2329473191.00000187528A8000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2352470075.00000187528A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft Hyper-V Network Adapter Installation Disk #11
Source: MBVpnTunnelService.exe, 00000005.00000003.2337416620.00000187528A2000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2327677941.00000187528B1000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2334651799.00000187528AB000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2353688897.00000187528A2000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2351424730.00000187528A2000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2329473191.00000187528A8000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2352470075.00000187528A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft Hyper-V WiFi Network Adapter3
Source: MBVpnTunnelService.exe, 00000005.00000003.2355991897.00000187533D1000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2391960961.00000187537DB000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2419608475.0000018753957000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft Hyper-V CDMA MBB Network Adapter
Source: MBVpnTunnelService.exe, 00000005.00000003.2313220263.0000018752E05000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0Gb LOM\|qemulex ocl11102r-f-l virtu[
Source: MBVpnTunnelService.exe, 00000005.00000003.2337416620.00000187528A2000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2327677941.00000187528B1000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2334651799.00000187528AB000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2353688897.00000187528A2000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2351424730.00000187528A2000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2329473191.00000187528A8000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2352470075.00000187528A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft hyper-v ethernet network adapter`'%netvsc_eth.devicedesc%
Source: MBVpnTunnelService.exe, 00000005.00000003.2352947313.0000018752E0D000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2311905039.0000018752E0D000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2405612269.0000018752E10000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2381364351.0000018752E0A000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2316291593.0000018752E09000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2439008472.0000018752E12000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2355139484.0000018752E0D000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2361233708.0000018752E0D000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2337587654.0000018752E0D000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2317016164.0000018752E10000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0Gb LOM\|qemulex ocl11102r-f-l virtu
Source: MBAMService.exe, 00000009.00000002.2455239360.00007FF7E274F000.00000002.00000001.01000000.0000000E.sdmp	Binary or memory string: ??VMwareVMwareVBoxVBoxVBoxXenVMMXenVMMKVMKVMKVMParallels Hv lrpepyh vrbhyve bhyveXenVMwareVRTUALReading the machine id from the registry key.MachineIDD:\Jenkins\workspace\N_MBCommon-vs2022\src\mbcommon\MachineId.cppmb::common::system::MachineId::GetMachineGuidInternalSOFTWARE\Malwarebytes\idSuccessfully read the machine id from the registry key.The machine id registry key does not exist, creating the key and writing the uuid.Unable to save to the machine id registry key.Software\Microsoft\CryptographyMachineGuidHardware\Description\SystemSystemBiosVersionSystemBiosDate\|Unable to retrieve the disk serial number. Using alternative value.mb::common::system::MachineId::GetHostMachineId3%02X:%02X:%02X:%02X:%02X:%02XROOT\CIMV2SELECT Index, MACAddress, Name FROM Win32_NetworkAdapter where AdapterTypeId=0WQLIndexMACAddressNameSELECT UUID FROM Win32_ComputerSystemProductUUIDSELECT SerialNumber FROM Win32_BIOSSerialNumberSELECT processorID FROM win32_processorprocessorIDError %lu calling GetSystemDirectorymb::common::system::MachineId::GetDiskSignatureInternal\\?\%sError %lu calling wsplitpath_sError %lu from CreateFileError %lu calling DeviceIoControlSELECT Signature FROM Win32_DiskDrive WHERE Index=%uSignature%uError %lu calling CoInitializeSecurity hr=0x%08Xmb::common::system::MachineId::GetMemorySerialNumbersInternalError %lu calling CoCreateInstance hr=0x%08XError %lu calling ConnectServer hr=0x%08XError %lu calling CoSetProxyBlanket hr=0x%08XSELECT serialNumber FROM Win32_PhysicalMemoryError %lu calling ExecQuery hr=0x%08XserialNumberError %lu calling Get hr=0x%08XError %lu calling StringCchCopy hr=0x%08Xmb::common::system::MachineId::GetDiskSerialNumberInternalSELECT SerialNumber FROM Win32_DiskDrive WHERE Index=%uError: exception in StringCchCopyAMySafeStringCchCopyAError: NULL buffermb::common::system::MachineId::GetDiskSerialNumberInternal2Calling CreateFileW with path (%ls).Error %lu calling CreateFileWError %lu calling DeviceIoControl to get buffer size.Error: zero size descriptorError %lu calling DeviceIoControl to get buffer.DeviceIoControl didn't return a serial number.Error: NULL serial numberNull reg utilsmb::common::system::MachineId::RegKeyExistsmb::common::system::MachineId::WriteDatamb::common::system::MachineId::GetValueString
Source: MBVpnTunnelService.exe, 00000005.00000003.2301571546.0000018752876000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ; ConnectX-4 Hyper-V VF
Source: MBVpnTunnelService.exe, 00000005.00000003.2337416620.00000187528A2000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2327677941.00000187528B1000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2334651799.00000187528AB000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2353688897.00000187528A2000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2351424730.00000187528A2000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2329473191.00000187528A8000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2352470075.00000187528A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft hyper-v wifi network adapterc
Source: MBVpnTunnelService.exe, 00000005.00000003.2355991897.00000187533D1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft hyper-v network adapterLA
Source: MBVpnTunnelService.exe, 00000005.00000003.2355991897.00000187533D1000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2391960961.00000187537DB000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2419608475.0000018753957000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft hyper-v gsm mbb network adapter
Source: MBSetup.exe, 00000000.00000003.2445362612.0000000000AD2000.00000004.00000020.00020000.00000000.sdmp, MBSetup.exe, 00000000.00000003.2622235015.0000000000AD2000.00000004.00000020.00020000.00000000.sdmp, MBSetup.exe, 00000000.00000003.1674570638.0000000000AD2000.00000004.00000020.00020000.00000000.sdmp, MBAMInstallerService.exe, 00000002.00000003.1901984347.0000015EF3C37000.00000004.00000020.00020000.00000000.sdmp, MBAMInstallerService.exe, 00000002.00000003.2008357187.0000015EF3C43000.00000004.00000020.00020000.00000000.sdmp, MBAMInstallerService.exe, 00000002.00000003.1943053820.0000015EF3C43000.00000004.00000020.00020000.00000000.sdmp, MBAMInstallerService.exe, 00000002.00000003.1864398090.0000015EF3C42000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: MBVpnTunnelService.exe, 00000005.00000003.2337416620.00000187528A2000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2327677941.00000187528B1000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2334651799.00000187528AB000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2353688897.00000187528A2000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2351424730.00000187528A2000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2329473191.00000187528A8000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2352470075.00000187528A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft Hyper-V Ethernet Network Adapter2
Source: MBVpnTunnelService.exe, 00000005.00000003.2355991897.00000187533D1000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2391960961.00000187537DB000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2419608475.0000018753957000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Emulex OCl11102R-F-L Virtual Fabric Adapter 2-port 10Gb LOM\|qemulex ocl11102r-f-l virtual fabric adapter 2-port 10gb lom$
Source: MBVpnTunnelService.exe, 00000005.00000003.2355991897.00000187533D1000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2391960961.00000187537DB000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2419608475.0000018753957000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft Hyper-V GSM MBB Network Adapter$
Source: MBVpnTunnelService.exe, 00000005.00000003.2439008472.0000018752E22000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: {vmnetextensionsystem32\drivers\wfplwfs.sys,-6001g
Source: MBVpnTunnelService.exe, 00000005.00000003.2355991897.00000187533D1000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2391960961.00000187537DB000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2419608475.0000018753957000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft Hyper-V Ethernet Network Adapter -
Source: MBVpnTunnelService.exe, 00000005.00000003.2323844843.0000018752E0D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0Gb LOM\|qemulex ocl11102r-f-l virtuY
Source: MBVpnTunnelService.exe, 00000005.00000003.2288327575.0000018752D41000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2289037292.0000018752DB2000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2287787400.000001875288B000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2288856939.0000018752DB2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: qemulex ocl11102-f6-x virtual fabric adapter 2-port 10gb lomL
Source: MBVpnTunnelService.exe, 00000005.00000003.2337416620.00000187528A2000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2327677941.00000187528B1000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2334651799.00000187528AB000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2353688897.00000187528A2000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2351424730.00000187528A2000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2329473191.00000187528A8000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2352470075.00000187528A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 'Hyper-V Network Adapter Name
Source: MBVpnTunnelService.exe, 00000005.00000003.2301571546.0000018752876000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ; ConnectX-4 non Hyper-V VF
Source: MBVpnTunnelService.exe, 00000005.00000003.2337416620.00000187528A2000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2327677941.00000187528B1000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2334651799.00000187528AB000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2353688897.00000187528A2000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2351424730.00000187528A2000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2329473191.00000187528A8000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2352470075.00000187528A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft Hyper-V CDMA MBB Network Adapter(
Source: MBVpnTunnelService.exe, 00000005.00000003.2337416620.00000187528A2000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2327677941.00000187528B1000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2334651799.00000187528AB000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2353688897.00000187528A2000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2351424730.00000187528A2000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2329473191.00000187528A8000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2352470075.00000187528A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft Hyper-V GSM MBB Network Adapterl#netvsc_mbb_cdma.DeviceDesc_D
Source: MBAMService.exe, 00000009.00000003.2452465973.00000264B426B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: MBVpnTunnelService.exe, 00000005.00000003.2439378727.000001875280B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll11
Source: MBVpnTunnelService.exe, 00000005.00000003.2419608475.0000018753957000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft hyper-v cdma mbb network adapterX
Source: MBVpnTunnelService.exe, 00000005.00000003.2355991897.00000187533D1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft Hyper-V WiFi Network Adapter
Source: MBVpnTunnelService.exe, 00000005.00000003.2337416620.00000187528A2000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2327677941.00000187528B1000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2334651799.00000187528AB000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2353688897.00000187528A2000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2351424730.00000187528A2000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2329473191.00000187528A8000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2352470075.00000187528A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft hyper-v cdma mbb network adapter1\+%netvsc_mbb_cdma.devicedesc%
Source: MBSetup.exe, 00000000.00000000.1650375405.0000000000809000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: xustring too long{ADC340ED-D55E-4E83-92AB-E57BEE7DD6F8}VMwareVMwareVBoxVBoxVBoxXenVMMXenVMMKVMKVMKVMParallels Hv lrpepyh vrbhyve bhyveXenVMwareVRTUALSOFTWARE\MalwarebytesidSoftware\Microsoft\CryptographyMachineGuidHardware\Description\SystemSystemBiosVersionSystemBiosDate\|ROOT\CIMV2WQLSELECT UUID FROM Win32_ComputerSystemProductUUIDSELECT SerialNumber FROM Win32_BIOSSerialNumberSELECT processorID FROM win32_processorprocessorID\\?\%sSELECT Signature FROM Win32_DiskDrive WHERE Index=%uSignature%uSELECT serialNumber FROM Win32_PhysicalMemoryserialNumberSELECT SerialNumber FROM Win32_DiskDrive WHERE Index=%uinvalid string positionvector<T> too long0123456789abcdef
Source: MBVpnTunnelService.exe, 00000005.00000003.2391960961.00000187537DB000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2419608475.0000018753957000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft Hyper-V WiFi Network AdapterX
Source: MBVpnTunnelService.exe, 00000005.00000003.2337416620.00000187528A2000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2327677941.00000187528B1000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2334651799.00000187528AB000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2353688897.00000187528A2000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2351424730.00000187528A2000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2329473191.00000187528A8000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2352470075.00000187528A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft hyper-v gsm mbb network adapter
Source: MBVpnTunnelService.exe, 00000005.00000003.2288327575.0000018752D41000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2289037292.0000018752DB2000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2287787400.000001875288B000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2288856939.0000018752DB2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Qemulex oneconnect oce11101-i, nic
Source: MBVpnTunnelService.exe, 00000005.00000003.2355991897.00000187533D1000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2391960961.00000187537DB000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2419608475.0000018753957000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft hyper-v wifi network adapter
Source: MBVpnTunnelService.exe, 00000005.00000003.2419176498.00000187528A8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmnetextensionptra se 3455 plus ps3n
Source: MBAMService.exe, 00000009.00000002.2455239360.00007FF7E274F000.00000002.00000001.01000000.0000000E.sdmp	Binary or memory string: VMwareVMware
Source: MBVpnTunnelService.exe, 00000005.00000003.2337416620.00000187528A2000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2355991897.00000187533D1000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2327677941.00000187528B1000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2334651799.00000187528AB000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2353688897.00000187528A2000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2351424730.00000187528A2000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2329473191.00000187528A8000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2352470075.00000187528A5000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2391960961.00000187537DB000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2419608475.0000018753957000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Microsoft Hyper-V VPN Network Adapter
Source: MBVpnTunnelService.exe, 00000005.00000003.2355991897.00000187533D1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft hyper-v ethernet network adapterl
Source: MBVpnTunnelService.exe, 00000005.00000003.2290240136.0000018752D8F000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2293819782.0000018752DAD000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2300563965.0000018752DA0000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2302945645.0000018752DAD000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2297641102.0000018752DAD000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2303194226.00000187531F1000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2318459287.0000018753200000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2307436225.0000018753200000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2290931068.0000018752D90000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2294324761.0000018752DAD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Emulex OCl11102R-F-L Virtual Fabric Adapter 2-port 10Gb LOM\|qemulex ocl11102r-f-l virtual fabric adapter 2-port 10gb lom
Source: MBVpnTunnelService.exe, 00000005.00000003.2355991897.00000187533D1000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2391960961.00000187537DB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft hyper-v cdma mbb network adapter
Source: MBAMInstallerService.exe, 00000002.00000000.1845438065.00007FF783D34000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: VMwareVMwareXenVMMXenVMMVBoxVBoxVBoxParallels HvKVMKVMKVMbhyve bhyve lrpepyh vrVMwareXenReading the machine id from the registry key.VRTUALD:\Jenkins\workspace\N_MBCommon-vs2022\src\mbcommon\MachineId.cppMachineIDSOFTWARE\Malwarebytes\mb::common::system::MachineId::GetMachineGuidInternalSuccessfully read the machine id from the registry key.idUnable to save to the machine id registry key.The machine id registry key does not exist, creating the key and writing the uuid.MachineGuidSoftware\Microsoft\CryptographySystemBiosVersionHardware\Description\SystemSystemBiosDatemb::common::system::MachineId::GetHostMachineId3Unable to retrieve the disk serial number. Using alternative value.ROOT\CIMV2%02X:%02X:%02X:%02X:%02X:%02XWQLSELECT Index, MACAddress, Name FROM Win32_NetworkAdapter where AdapterTypeId=0MACAddressIndexNameUUIDSELECT UUID FROM Win32_ComputerSystemProductSerialNumberSELECT SerialNumber FROM Win32_BIOSprocessorIDSELECT processorID FROM win32_processormb::common::system::MachineId::GetDiskSignatureInternalError %lu calling GetSystemDirectoryError %lu calling wsplitpath_s\\?\%sError %lu calling DeviceIoControlError %lu from CreateFileSignatureSELECT Signature FROM Win32_DiskDrive WHERE Index=%umb::common::system::MachineId::GetMemorySerialNumbersInternalError %lu calling CoInitializeSecurity hr=0x%08XError %lu calling ConnectServer hr=0x%08XError %lu calling CoCreateInstance hr=0x%08XSELECT serialNumber FROM Win32_PhysicalMemoryError %lu calling CoSetProxyBlanket hr=0x%08XserialNumberError %lu calling ExecQuery hr=0x%08XError %lu calling StringCchCopy hr=0x%08XError %lu calling Get hr=0x%08XSELECT SerialNumber FROM Win32_DiskDrive WHERE Index=%umb::common::system::MachineId::GetDiskSerialNumberInternalMySafeStringCchCopyAError: exception in StringCchCopyAmb::common::system::MachineId::GetDiskSerialNumberInternal2Error: NULL bufferError %lu calling CreateFileWCalling CreateFileW with path (%ls).Error: zero size descriptorError %lu calling DeviceIoControl to get buffer size.Error %lu calling DeviceIoControl to get buffer.Error: NULL serial numberDeviceIoControl didn't return a serial number.mb::common::system::MachineId::RegKeyExistsNull reg utilsmb::common::system::MachineId::GetValueStringmb::common::system::MachineId::WriteData0123456789abcdef
Source: MBVpnTunnelService.exe, 00000005.00000003.2337416620.00000187528A2000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2327677941.00000187528B1000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2334651799.00000187528AB000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2353688897.00000187528A2000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2351424730.00000187528A2000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2329473191.00000187528A8000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2352470075.00000187528A5000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2391960961.00000187537DB000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2419608475.0000018753957000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft hyper-v network adapter
Source: MBVpnTunnelService.exe, 00000005.00000003.2419176498.00000187528C2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmnetextensionpn\Policies\System\NoConnec}
Source: MBSetup.exe, 00000000.00000003.2622235015.0000000000AEA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBn6
Source: MBVpnTunnelService.exe, 00000005.00000003.2319031374.0000018752E10000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0Gb LOM\|qemulex ocl11102r-f-l virtut

Source: C:\Users\user\Desktop\MBSetup.exe

Process information queried: ProcessInformation

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Anti Debugging

Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe

Code function: 5_2_00007FF75163F2C4 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

5_2_00007FF75163F2C4

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe

Code function: 5_2_00007FF75163F630 GetLastError,IsDebuggerPresent,OutputDebugStringW,

5_2_00007FF75163F630

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe

Code function: 5_2_00007FF7514C026D GetProcessHeap,HeapAlloc,Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock,GetLastError,GetLastError,Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock,

5_2_00007FF7514C026D

Enables debug privileges

Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Process token adjusted: Debug
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Process token adjusted: Debug

Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	Code function: 5_2_00007FF75163F2C4 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00007FF75163F2C4
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	Code function: 5_2_00007FF75163ECC4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_00007FF75163ECC4
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	Code function: 5_2_00007FF7516495A8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00007FF7516495A8

Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	NtQueryDirectoryFile: Indirect: 0x7FFDF7C2A52F
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	NtQueryDirectoryFile: Indirect: 0x7FFDF9E86545

Creates a process in suspended mode (likely to inject code)

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -install -extension "C:\Users\user\AppData\Local\Temp\{242af0bb-db11-4734-b7a0-61cb8a9b20fb}.xpi"

Language, Device and Operating System Detection

Contains functionality to query locales information (e.g. system language)

Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,wcschr,wcschr,GetLocaleInfoW,	5_2_00007FF75166FC4C
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	5_2_00007FF7516704A4
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	5_2_00007FF751670680
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	Code function: try_get_function,GetLocaleInfoW,	5_2_00007FF75166862C
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	Code function: EnumSystemLocalesW,	5_2_00007FF751670068
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	Code function: EnumSystemLocalesW,	5_2_00007FF75166805C
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe	Code function: EnumSystemLocalesW,	5_2_00007FF75166FF98

Queries the volume information (name, serial number etc) of a device

Source: C:\Windows\System32\drvinst.exe	Queries volume information: C:\Windows\System32\DriverStore\Temp\{edf7d8d8-304a-1448-a26a-bba0a7428f74}\mbtun.cat VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\DUBAI-MEDIUM.TTF VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\DUBAI-LIGHT.TTF VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\flat_officeFontsPreview.ttf VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\OFFSYMSL.TTF VolumeInformation
Source: C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe	Queries volume information: C:\Windows\Fonts\OFFSYMSB.TTF VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe

Code function: 5_2_00007FF7514C46A0 GetLastError,_Init_thread_footer,_Init_thread_footer,Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock,CreateThreadpool,GetLastError,CreateThreadpoolCleanupGroup,GetLastError,SetThreadpoolThreadMinimum,SetThreadpoolThreadMaximum,WaitForSingleObject,CreateNamedPipeW,GetLastError,WaitForSingleObject,CloseHandle,GetLastError,CreateThreadpoolWork,GetLastError,CloseHandle,SubmitThreadpoolWork,CloseThreadpoolWork,CloseThreadpoolCleanupGroupMembers,CloseThreadpoolCleanupGroup,CloseThreadpool,_invalid_parameter_noinfo_noreturn,

5_2_00007FF7514C46A0

Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe

Code function: 5_2_00007FF7514CC220 _invalid_parameter_noinfo_noreturn,GetLocalTime,GetTickCount,GetCurrentThreadId,

5_2_00007FF7514CC220

Source: C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe

Code function: 5_2_00007FF7514CF3C0 GetModuleHandleW,GetProcAddress,GetVersionExW,NetWkstaGetInfo,NetApiBufferFree,RegOpenKeyExW,RegQueryValueExW,RegQueryValueExW,RegQueryValueExW,RegCloseKey,VerSetConditionMask,VerifyVersionInfoW,

5_2_00007FF7514CF3C0

Source: C:\Users\user\Desktop\MBSetup.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

AV process strings found (often used to terminate AV products)

Lowering of HIPS / PFW / Operating System Security Settings

Source: MBVpnTunnelService.exe, 00000005.00000003.2399420733.000001875325D000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2400514237.000001875325E000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2399815000.000001875325D000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2401914948.0000018753268000.00000004.00000020.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2402150638.000001875326C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PGSETUP.EXE
Source: MBVpnTunnelService.exe, 00000005.00000003.2399420733.000001875325D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 123.exe

Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	Jump to behavior
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION
Source: C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION

Remote Access Functionality

Yara detected PsExec sysinternal tool

Source: Yara match

File source: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\AEControllerImpl.dll, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	1 Replication Through Removable Media	311 Windows Management Instrumentation	1 Scripting	1 Abuse Elevation Control Mechanism	1 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	11 Peripheral Device Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Search Order Hijacking	1 DLL Search Order Hijacking	1 Abuse Elevation Control Mechanism	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	31 Windows Service	1 Extra Window Memory Injection	2 Obfuscated Files or Information	NTDS	147 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	2 Registry Run Keys / Startup Folder	1 Access Token Manipulation	1 Install Root Certificate	LSA Secrets	1 Query Registry	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	31 Windows Service	1 Timestomp	Cached Domain Credentials	371 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	12 Process Injection	1 DLL Side-Loading	DCSync	11 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	2 Registry Run Keys / Startup Folder	1 DLL Search Order Hijacking	Proc Filesystem	261 Virtualization/Sandbox Evasion	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 File Deletion	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Extra Window Memory Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	33 Masquerading	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	1 Modify Registry	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking
Determine Physical Locations	Virtual Private Server	Compromise Hardware Supply Chain	Unix Shell	Systemd Timers	Systemd Timers	261 Virtualization/Sandbox Evasion	GUI Input Capture	Permission Groups Discovery	Replication Through Removable Media	Email Collection	Proxy	Exfiltration over USB	Network Denial of Service
Business Relationships	Server	Trusted Relationship	Visual Basic	Container Orchestration Job	Container Orchestration Job	1 Access Token Manipulation	Web Portal Capture	Local Groups	Component Object Model and Distributed COM	Local Email Collection	Internal Proxy	Commonly Used Port	Direct Network Flood
Identify Business Tempo	Botnet	Hardware Additions	Python	Hypervisor	Process Injection	12 Process Injection	Credential API Hooking	Domain Groups	Exploitation of Remote Services	Remote Email Collection	External Proxy	Transfer Data to Cloud Account	Reflection Amplification

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
MBSetup.exe	0%	ReversingLabs
MBSetup.exe	0%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner
C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	0%	ReversingLabs
C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll (copy)	0%	ReversingLabs
C:\Program Files\Malwarebytes\Anti-Malware\mbtun\mbtun.sys	0%	ReversingLabs
C:\Program Files\Malwarebytes\Anti-Malware\mbuns.exe	0%	ReversingLabs
C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.sys	0%	ReversingLabs
C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.sys	0%	ReversingLabs
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\Actions.dll	0%	ReversingLabs
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\BrowserSDKDLL.dll	0%	ReversingLabs
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\MBAMCore.dll	0%	ReversingLabs
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\ig.exe	0%	ReversingLabs
C:\ProgramData\Malwarebytes\MBAMService\lkg_db\sample.dll	0%	ReversingLabs
C:\Windows\ELAMBKUP\MbamElam.sys	0%	ReversingLabs
C:\Windows\System32\DriverStore\Temp\{edf7d8d8-304a-1448-a26a-bba0a7428f74}\SETA745.tmp	0%	ReversingLabs
C:\Windows\System32\DriverStore\Temp\{edf7d8d8-304a-1448-a26a-bba0a7428f74}\mbtun.sys (copy)	0%	ReversingLabs
C:\Windows\System32\drivers\MbamChameleon.sys	0%	ReversingLabs
C:\Windows\System32\drivers\MbamElam.sys	0%	ReversingLabs
C:\Windows\System32\drivers\mbamswissarmy.sys	0%	ReversingLabs
C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\7z.dll	0%	ReversingLabs
C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\7z.dll	0%	ReversingLabs
C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\AEControllerImpl.dll	0%	ReversingLabs
C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\ActionsShim.dll	0%	ReversingLabs
C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\ArwControllerImpl.dll	0%	ReversingLabs
C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\ArwLib.dll	0%	ReversingLabs
C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Assistant.dll	0%	ReversingLabs
C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Assistant.exe	0%	ReversingLabs
C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\BrowserSDKDLLShim.dll	0%	ReversingLabs
C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\CleanControllerImpl.dll	0%	ReversingLabs
C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\CloudControllerImpl.dll	0%	ReversingLabs
C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\DryIoc.dll	0%	ReversingLabs
C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\LicenseControllerImpl.dll	0%	ReversingLabs
C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MBAMCrashHandler.exe	0%	ReversingLabs
C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MBAMService.exe	0%	ReversingLabs
C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MBAMShim.dll	0%	ReversingLabs
C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MBAMWsc.exe	0%	ReversingLabs
C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MBAMWsc_Legacy.exe	0%	ReversingLabs
C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MBUpdateDlg.exe	0%	ReversingLabs
C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MBVpnTunnelService.exe	0%	ReversingLabs
C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MBVpnTunnel_mbtun.dll	0%	ReversingLabs
C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MBVpnTunnel_wintun.dll	0%	ReversingLabs
C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MBVpnTunnel_wireguard.dll	0%	ReversingLabs
C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MWACControllerImpl.dll	0%	ReversingLabs
C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Malwarebytes.Interop.Activation.dll	0%	ReversingLabs
C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Malwarebytes.Protection.Interop.dll	0%	ReversingLabs
C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Malwarebytes.UI.Controls.dll	0%	ReversingLabs
C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Malwarebytes.UI.Style.dll	0%	ReversingLabs
C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Malwarebytes.UI.Theme.Dark.dll	0%	ReversingLabs
C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Malwarebytes.UI.Theme.Light.dll	0%	ReversingLabs
C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Malwarebytes.UI.Theme.Primitives.dll	0%	ReversingLabs
C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Malwarebytes.UI.TrayNotification.dll	0%	ReversingLabs
C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Malwarebytes.dll	0%	ReversingLabs
C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Malwarebytes.exe	0%	ReversingLabs
C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Malwarebytes_Assistant.dll	0%	ReversingLabs
C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Malwarebytes_Assistant.exe	0%	ReversingLabs
C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MbamBgNativeMsg.exe	0%	ReversingLabs
C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MbamUI.Core.dll	0%	ReversingLabs
C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MbamUI.Data.dll	0%	ReversingLabs
C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MbamUI.Services.dll	0%	ReversingLabs
C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MbamUI.Tray.dll	0%	ReversingLabs
C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MbamUI.UICommon.dll	0%	ReversingLabs
C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Microsoft.Data.Sqlite.dll	0%	ReversingLabs
C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Microsoft.EntityFrameworkCore.Abstractions.dll	0%	ReversingLabs
C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Microsoft.EntityFrameworkCore.Relational.dll	0%	ReversingLabs
C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Microsoft.EntityFrameworkCore.Sqlite.dll	0%	ReversingLabs
C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Microsoft.EntityFrameworkCore.dll	0%	ReversingLabs
C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Microsoft.Extensions.Caching.Abstractions.dll	0%	ReversingLabs
C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Microsoft.Extensions.Caching.Memory.dll	0%	ReversingLabs
C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Microsoft.Extensions.Configuration.Abstractions.dll	0%	ReversingLabs
C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Microsoft.Extensions.DependencyInjection.Abstractions.dll	0%	ReversingLabs
C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Microsoft.Extensions.DependencyInjection.dll	0%	ReversingLabs
C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Microsoft.Extensions.DependencyModel.dll	0%	ReversingLabs
C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Microsoft.Extensions.Logging.Abstractions.dll	0%	ReversingLabs
C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Microsoft.Extensions.Logging.dll	0%	ReversingLabs
C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Microsoft.Extensions.Options.dll	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
http://crl.rootca1.amazontrust.com/rootca1.crl0	0%	URL Reputation	safe
http://crt.rootca1.amazontrust.com/rootca1.cer0?	0%	URL Reputation	safe
http://www.appinf.com/properties/bla-activation-threshold	0%	Virustotal		Browse
https://subscribe-staging.mwbsys.com	0%	Virustotal		Browse
http://www.appinf.com/features/enable-partial-reads	0%	Virustotal		Browse
https://cdn.mwbsys.com:443/packages/mbam-c.isvc.64bitv5/c/c/9/1/cc91fbc5e424154388afbe808de25ff6/102	0%	Virustotal		Browse
https://cdn.mwbsys.com/packages/mbam-c.sevenzip.32bit/0/e/8/7/0e872772dae952c6da648cb5914b4304/91bef	0%	Virustotal		Browse
http://crt.sectigo.com/SectigoRSACodeSigningCA2.crt0#	0%	Virustotal		Browse

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.malwarebytes.com/images/mb-logo-2.png	MBSetup.exe, 00000000.00000000.1650493980.0000000000861000.00000002.00000001.01000000.00000003.sdmp	false		high
https://www.google.com/policies/privacy	MBSetup.exe, 00000000.00000000.1650493980.0000000000861000.00000002.00000001.01000000.00000003.sdmp	false		high
http://www.appinf.com/properties/bla-activation-threshold	MBAMInstallerService.exe, 00000002.00000000.1845438065.00007FF783D34000.00000002.00000001.01000000.0000000A.sdmp	false	0%, Virustotal, Browse	unknown
https://subscribe-staging.mwbsys.com	MBAMInstallerService.exe, 00000002.00000000.1845438065.00007FF783D34000.00000002.00000001.01000000.0000000A.sdmp, MBAMService.exe, 0000000A.00000003.2468740901.000002160A797000.00000004.00000020.00020000.00000000.sdmp, MBAMService.exe, 0000000A.00000003.2468398420.000002160A785000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://www.appinf.com/features/enable-partial-reads	MBAMInstallerService.exe, 00000002.00000000.1845438065.00007FF783D34000.00000002.00000001.01000000.0000000A.sdmp	false	0%, Virustotal, Browse	unknown
http://crt.sectigo.com/SectigoRSACodeSigningCA2.crt0#	MBAMInstallerService.exe, 00000002.00000003.2024376899.0000015EF4A66000.00000004.00000020.00020000.00000000.sdmp, MBAMInstallerService.exe, 00000002.00000003.2023088147.0000015EF50AE000.00000004.00001000.00020000.00000000.sdmp, MBAMInstallerService.exe, 00000002.00000000.1845634681.00007FF784256000.00000002.00000001.01000000.0000000A.sdmp, MBAMInstallerService.exe, 00000002.00000003.2018209780.0000015EF46AB000.00000004.00000020.00020000.00000000.sdmp, MBAMInstallerService.exe, 00000002.00000000.1845634681.00007FF783E9F000.00000002.00000001.01000000.0000000A.sdmp, MBAMInstallerService.exe, 00000002.00000003.2022178107.0000015EF47E0000.00000004.00001000.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2284751755.0000018753023000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000008.00000003.2428356278.0000027072D00000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000008.00000003.2425307600.0000027072CA9000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://ocsp.sectigo.com0	MBAMInstallerService.exe, 00000002.00000003.2024376899.0000015EF4A66000.00000004.00000020.00020000.00000000.sdmp, MBAMInstallerService.exe, 00000002.00000003.2023088147.0000015EF50AE000.00000004.00001000.00020000.00000000.sdmp, MBAMInstallerService.exe, 00000002.00000000.1845634681.00007FF784256000.00000002.00000001.01000000.0000000A.sdmp, MBAMInstallerService.exe, 00000002.00000003.2018209780.0000015EF46AB000.00000004.00000020.00020000.00000000.sdmp, MBAMInstallerService.exe, 00000002.00000000.1845634681.00007FF783E9F000.00000002.00000001.01000000.0000000A.sdmp, MBAMInstallerService.exe, 00000002.00000003.2022178107.0000015EF47E0000.00000004.00001000.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2284751755.0000018753023000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000008.00000003.2428356278.0000027072D00000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000008.00000003.2425307600.0000027072CA9000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
https://ark.mwbsys.com/bgext8	MBSetup.exe, 00000000.00000003.2622235015.0000000000B0F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.adr.org/Rules	MBSetup.exe, 00000000.00000000.1650493980.0000000000861000.00000002.00000001.01000000.00000003.sdmp	false		high
https://ark.mwbsys.com/bgextce	MBSetup.exe, 00000000.00000003.2622235015.0000000000B0F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.youronlinechoices.eu/	MBSetup.exe, 00000000.00000000.1650493980.0000000000861000.00000002.00000001.01000000.00000003.sdmp	false		high
https://cdn.mwbsys.com/packages/mbam-c.sevenzip.32bit/0/e/8/7/0e872772dae952c6da648cb5914b4304/91bef	MBAMInstallerService.exe, 00000002.00000000.1845438065.00007FF783D34000.00000002.00000001.01000000.0000000A.sdmp	false	0%, Virustotal, Browse	unknown
https://cdn.mwbsys.com:443/packages/mbam-c.isvc.64bitv5/c/c/9/1/cc91fbc5e424154388afbe808de25ff6/102	MBSetup.exe, 00000000.00000003.2444931439.0000000004C67000.00000004.00000020.00020000.00000000.sdmp, MBSetup.exe, 00000000.00000003.1844874753.0000000004C65000.00000004.00000020.00020000.00000000.sdmp, MBSetup.exe, 00000000.00000003.1844715993.0000000004C64000.00000004.00000020.00020000.00000000.sdmp, MBSetup.exe, 00000000.00000003.1843077591.0000000004C64000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://links.malwarebytes.comnohttps://subscribe-staging.mwbsys.comacctOwnerFirstNameacctOwnerLastN	MBAMInstallerService.exe, 00000002.00000000.1845438065.00007FF783D34000.00000002.00000001.01000000.0000000A.sdmp	false		unknown
https://malwarebytes.com/supportstring	MBAMInstallerService.exe, 00000002.00000000.1845634681.00007FF783E9F000.00000002.00000001.01000000.0000000A.sdmp	false		high
https://links.malwarebytes.comYI	MBAMService.exe, 0000000A.00000003.2468398420.000002160A785000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://cdn.mwbsys.com/	MBSetup.exe, 00000000.00000003.2622235015.0000000000AEA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://xml.org/sax/features/namespace-prefixes	MBAMInstallerService.exe, 00000002.00000000.1845438065.00007FF783D34000.00000002.00000001.01000000.0000000A.sdmp	false		high
https://support.malwarebytes.com/hc/en-us/articles/360039142934-Installation-troubleshooting-for-Mal	MBSetup.exe, 00000000.00000000.1650375405.0000000000809000.00000002.00000001.01000000.00000003.sdmp	false		high
https://links.malwarebytes.com/support/mb/windows/security-other-avhttps://links.malwarebytes.com/su	MBSetup.exe, 00000000.00000000.1650375405.0000000000809000.00000002.00000001.01000000.00000003.sdmp	false		high
http://xml.org/sax/features/string-interning	MBAMInstallerService.exe, 00000002.00000000.1845438065.00007FF783D34000.00000002.00000001.01000000.0000000A.sdmp	false		high
https://www.malwarebytes.com/images/uploads/2020/07/30233020/EULA_Chart-2.png	MBSetup.exe, 00000000.00000000.1650493980.0000000000861000.00000002.00000001.01000000.00000003.sdmp	false		high
http://xml.org/sax/features/external-parameter-entities	MBAMInstallerService.exe, 00000002.00000000.1845438065.00007FF783D34000.00000002.00000001.01000000.0000000A.sdmp	false		high
https://ark.mwbsys.com/mb.dotnetruntime.win.x64/release	MBAMInstallerService.exe, 00000002.00000003.2008357187.0000015EF3C43000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ark.mwbsys.com/mbam-c.isvc.64bitv5/release1	MBSetup.exe, 00000000.00000003.2445362612.0000000000B0F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ark.mwbsys.com/	MBAMInstallerService.exe, 00000002.00000003.1901984347.0000015EF3C37000.00000004.00000020.00020000.00000000.sdmp, MBAMInstallerService.exe, 00000002.00000003.1864398090.0000015EF3C37000.00000004.00000020.00020000.00000000.sdmp, MBAMInstallerService.exe, 00000002.00000003.1943216300.0000015EF3C37000.00000004.00000020.00020000.00000000.sdmp, MBAMInstallerService.exe, 00000002.00000003.2008507733.0000015EF3C37000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.appinf.com/features/no-whitespace-in-element-contenthttp://xml.org/sax/features/validatio	MBAMInstallerService.exe, 00000002.00000000.1845438065.00007FF783D34000.00000002.00000001.01000000.0000000A.sdmp	false		unknown
https://cdn.mwbsys.com/packages/mbam-c.isvc.64bitv5/c/c/9/1/cc91fbc5e424154388afbe808de25ff6/102f6bc	MBSetup.exe, 00000000.00000003.2444345366.0000000000AAA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.malwarebytes.com/eula/	MBSetup.exe, 00000000.00000000.1650493980.0000000000861000.00000002.00000001.01000000.00000003.sdmp	false		high
https://cdnjs.cloudflare.com/ajax/libs/slick-carousel/1.6.0/slick.css	MBSetup.exe, 00000000.00000000.1650493980.0000000000861000.00000002.00000001.01000000.00000003.sdmp	false		high
https://www.malwarebytes.com/legal/privacy-policyopenhttps://www.malwarebytes.com/eula/MBAM-Crelease	MBSetup.exe, 00000000.00000000.1650375405.0000000000809000.00000002.00000001.01000000.00000003.sdmp	false		high
https://ark.mwbsys.com/mbam-c.dbcls.64bitv5/release	MBAMInstallerService.exe, 00000002.00000003.1943053820.0000015EF3C43000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://fr.malwarebytes.com/privacy/	MBSetup.exe, 00000000.00000000.1650493980.0000000000861000.00000002.00000001.01000000.00000003.sdmp	false		high
https://cdn.mwbsys.com/packages/mbam-c.bgext.32bit/d/6/9/0/d69098824cb3f15eba951cc1848bcc85/11feade3	MBSetup.exe, 00000000.00000003.2622235015.0000000000AEA000.00000004.00000020.00020000.00000000.sdmp, MBSetup.exe, 00000000.00000003.2622235015.0000000000AB9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.appinf.com/properties/bla-maximum-amplification	MBAMInstallerService.exe, 00000002.00000000.1845438065.00007FF783D34000.00000002.00000001.01000000.0000000A.sdmp	false		unknown
https://cdn.jsdelivr.net/npm/slick-carousel	MBSetup.exe, 00000000.00000000.1650493980.0000000000861000.00000002.00000001.01000000.00000003.sdmp	false		high
https://cdn.mwbsys.com/packages/mbam-c.svc.64bitv5/9/2/7/d/927d42fa5b00a0bda8e9604e74f25979/0b804105	MBAMInstallerService.exe, 00000002.00000003.1864398090.0000015EF3C42000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://pt.malwarebytes.com/privacy/	MBSetup.exe, 00000000.00000000.1650493980.0000000000861000.00000002.00000001.01000000.00000003.sdmp	false		high
https://cdnjs.cloudflare.com/ajax/libs/slick-carousel/1.6.0/slick-theme.css	MBSetup.exe, 00000000.00000000.1650493980.0000000000861000.00000002.00000001.01000000.00000003.sdmp	false		high
https://ark.mwbsys.com/mbam-c.isvc.64bitv5/release	MBSetup.exe, 00000000.00000003.2445362612.0000000000B0F000.00000004.00000020.00020000.00000000.sdmp, MBSetup.exe, 00000000.00000003.2622235015.0000000000B0F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://aws.amazon.com/compliance/	MBSetup.exe, 00000000.00000000.1650493980.0000000000861000.00000002.00000001.01000000.00000003.sdmp	false		high
http://crl.sectigo.com/SectigoRSACodeSigningCA2.crl0t	MBAMInstallerService.exe, 00000002.00000003.2024376899.0000015EF4A66000.00000004.00000020.00020000.00000000.sdmp, MBAMInstallerService.exe, 00000002.00000003.2023088147.0000015EF50AE000.00000004.00001000.00020000.00000000.sdmp, MBAMInstallerService.exe, 00000002.00000000.1845634681.00007FF784256000.00000002.00000001.01000000.0000000A.sdmp, MBAMInstallerService.exe, 00000002.00000003.2018209780.0000015EF46AB000.00000004.00000020.00020000.00000000.sdmp, MBAMInstallerService.exe, 00000002.00000000.1845634681.00007FF783E9F000.00000002.00000001.01000000.0000000A.sdmp, MBAMInstallerService.exe, 00000002.00000003.2022178107.0000015EF47E0000.00000004.00001000.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2284751755.0000018753023000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000008.00000003.2428356278.0000027072D00000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000008.00000003.2425307600.0000027072CA9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.malwarebytes.com/support/lifecycle/	MBSetup.exe, 00000000.00000000.1650493980.0000000000861000.00000002.00000001.01000000.00000003.sdmp	false		high
https://malwarebytes.com/support	MBAMInstallerService.exe, 00000002.00000000.1845634681.00007FF783E9F000.00000002.00000001.01000000.0000000A.sdmp	false		high
https://block.malwarebytes.comallowlistsbgCloudTimeoutblocklistsblockpagebrowserOnlyProtectiondomain	MBAMInstallerService.exe, 00000002.00000000.1845438065.00007FF783D34000.00000002.00000001.01000000.0000000A.sdmp	false		unknown
https://www.malwarebytes.com/js/mess.js	MBSetup.exe, 00000000.00000000.1650493980.0000000000861000.00000002.00000001.01000000.00000003.sdmp	false		high
https://code.jquery.com/jquery-3.3.1.min.js	MBSetup.exe, 00000000.00000000.1650493980.0000000000861000.00000002.00000001.01000000.00000003.sdmp	false		high
https://msdn.micros	MBAMService.exe, 00000009.00000003.2452838840.00000264B427B000.00000004.00000020.00020000.00000000.sdmp, MBAMService.exe, 00000009.00000002.2454379553.00000264B427B000.00000004.00000020.00020000.00000000.sdmp, MBAMService.exe, 00000009.00000003.2453426133.00000264B427B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://pl.malwarebytes.com/privacy/	MBSetup.exe, 00000000.00000000.1650493980.0000000000861000.00000002.00000001.01000000.00000003.sdmp	false		high
https://ru.malwarebytes.com/privacy/	MBSetup.exe, 00000000.00000000.1650493980.0000000000861000.00000002.00000001.01000000.00000003.sdmp	false		high
http://www.appinf.com/features/no-whitespace-in-element-content	MBAMInstallerService.exe, 00000002.00000000.1845438065.00007FF783D34000.00000002.00000001.01000000.0000000A.sdmp	false		unknown
http://www.malwarebytes.com/legal	MBSetup.exe, 00000000.00000000.1650493980.0000000000861000.00000002.00000001.01000000.00000003.sdmp	false		high
https://links.malwarebytes.com/link/uninstalled?days_since_install=launching	MBSetup.exe, 00000000.00000000.1650375405.0000000000809000.00000002.00000001.01000000.00000003.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0	MBSetup.exe, 00000000.00000000.1650493980.0000000000861000.00000002.00000001.01000000.00000003.sdmp, MBSetup.exe, 00000000.00000003.1651236201.0000000002659000.00000004.00000020.00020000.00000000.sdmp, MBSetup.exe, 00000000.00000003.1651265227.000000000265A000.00000004.00000020.00020000.00000000.sdmp, MBSetup.exe, 00000000.00000003.1676201400.000000000283A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.privacyshield.gov/list	MBSetup.exe, 00000000.00000000.1650493980.0000000000861000.00000002.00000001.01000000.00000003.sdmp	false		high
https://preferences-mgr.truste.com/	MBSetup.exe, 00000000.00000000.1650493980.0000000000861000.00000002.00000001.01000000.00000003.sdmp	false		high
https://sectigo.com/CPS0	MBAMInstallerService.exe, 00000002.00000003.2024376899.0000015EF4A66000.00000004.00000020.00020000.00000000.sdmp, MBAMInstallerService.exe, 00000002.00000003.2023088147.0000015EF50AE000.00000004.00001000.00020000.00000000.sdmp, MBAMInstallerService.exe, 00000002.00000000.1845634681.00007FF784256000.00000002.00000001.01000000.0000000A.sdmp, MBAMInstallerService.exe, 00000002.00000003.2018209780.0000015EF46AB000.00000004.00000020.00020000.00000000.sdmp, MBAMInstallerService.exe, 00000002.00000000.1845634681.00007FF783E9F000.00000002.00000001.01000000.0000000A.sdmp, MBAMInstallerService.exe, 00000002.00000003.2022178107.0000015EF47E0000.00000004.00001000.00020000.00000000.sdmp, MBVpnTunnelService.exe, 00000005.00000003.2284751755.0000018753023000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000008.00000003.2428356278.0000027072D00000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000008.00000003.2425307600.0000027072CA9000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ark.mwbsys.com/q.	MBAMInstallerService.exe, 00000002.00000003.2008507733.0000015EF3C37000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://cdn.cookielaw.org/consent/9530a107-0af8-4204-a2c2-217efb78222b.js	MBSetup.exe, 00000000.00000000.1650493980.0000000000861000.00000002.00000001.01000000.00000003.sdmp	false		high
http://xml.org/sax/features/external-general-entities	MBAMInstallerService.exe, 00000002.00000000.1845438065.00007FF783D34000.00000002.00000001.01000000.0000000A.sdmp	false		high
https://ark.mwbsys.com:443/mbam-c.svc.64bitv5/release	MBAMInstallerService.exe, 00000002.00000003.2008450880.0000015EF3BFF000.00000004.00000020.00020000.00000000.sdmp, MBAMInstallerService.exe, 00000002.00000003.1901746615.0000015EF3BFF000.00000004.00000020.00020000.00000000.sdmp, MBAMInstallerService.exe, 00000002.00000003.1864398090.0000015EF3BFF000.00000004.00000020.00020000.00000000.sdmp, MBAMInstallerService.exe, 00000002.00000003.1943161971.0000015EF3BFF000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ark.mwbsys.com/3/N	MBAMInstallerService.exe, 00000002.00000003.1943216300.0000015EF3C37000.00000004.00000020.00020000.00000000.sdmp, MBAMInstallerService.exe, 00000002.00000003.2008507733.0000015EF3C37000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://es.malwarebytes.com/privacy/	MBSetup.exe, 00000000.00000000.1650493980.0000000000861000.00000002.00000001.01000000.00000003.sdmp	false		high
http://xml.org/sax/features/namespaces	MBAMInstallerService.exe, 00000002.00000000.1845438065.00007FF783D34000.00000002.00000001.01000000.0000000A.sdmp	false		high
https://ark.mwbsys.com/LPsd	MBSetup.exe, 00000000.00000003.2445362612.0000000000AD2000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.wireguard.com/D	MBAMInstallerService.exe, 00000002.00000003.2097374584.0000015EF47E0000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://block.malwarebytes.com	MBAMInstallerService.exe, 00000002.00000000.1845438065.00007FF783D34000.00000002.00000001.01000000.0000000A.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	drvinst.exe, 00000008.00000002.2434287955.0000027072CA5000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000008.00000003.2432411808.0000027072CA5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.jamsadr.com/eu-us-privacy-shield.	MBSetup.exe, 00000000.00000000.1650493980.0000000000861000.00000002.00000001.01000000.00000003.sdmp	false		unknown
https://www.malwarebytes.com/images/share/Malwarebytes-homepage-share.jpg	MBSetup.exe, 00000000.00000000.1650493980.0000000000861000.00000002.00000001.01000000.00000003.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	drvinst.exe, 00000008.00000002.2434287955.0000027072CA5000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000008.00000003.2432411808.0000027072CA5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.google.com/policies/privacy	MBSetup.exe, 00000000.00000000.1650493980.0000000000861000.00000002.00000001.01000000.00000003.sdmp	false		high
https://cdn.mwbsys.com:443/packages/mb.dotnetruntime.win.x64/5/b/9/c/5b9c2c0ca079ea2f33181a1ef938ca4	MBAMInstallerService.exe, 00000002.00000003.2008507733.0000015EF3C37000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ark.mwbsys.com/8	MBSetup.exe, 00000000.00000003.2622235015.0000000000B0F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.adr.org/Forms	MBSetup.exe, 00000000.00000000.1650493980.0000000000861000.00000002.00000001.01000000.00000003.sdmp	false		high
https://nl.malwarebytes.com/privacy/	MBSetup.exe, 00000000.00000000.1650493980.0000000000861000.00000002.00000001.01000000.00000003.sdmp	false		high
https://links.malwarebytes.comfi	MBAMService.exe, 0000000A.00000003.2468398420.000002160A785000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://cdn.mwbsys.com/packages/mbam-c.ctlr.64bitv5/9/e/f/5/9ef598bb4c2426f4b31baebf99fce838/e8691b7	MBAMInstallerService.exe, 00000002.00000003.1901984347.0000015EF3C37000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://xml.org/sax/properties/declaration-handler	MBAMInstallerService.exe, 00000002.00000000.1845438065.00007FF783D34000.00000002.00000001.01000000.0000000A.sdmp	false		high
https://www.privacyshield.gov/article?id=How-to-Submit-a-Complaint	MBSetup.exe, 00000000.00000000.1650493980.0000000000861000.00000002.00000001.01000000.00000003.sdmp	false		high
https://links.malwarebytes.com	MBAMService.exe, 0000000A.00000003.2468398420.000002160A785000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.malwarebytes.com/eula/services-agreement/	MBSetup.exe, 00000000.00000000.1650493980.0000000000861000.00000002.00000001.01000000.00000003.sdmp	false		high
https://www.malwarebytes.com/privacy/	MBSetup.exe, 00000000.00000000.1650493980.0000000000861000.00000002.00000001.01000000.00000003.sdmp	false		high
https://cdn.mwbsys.com/packages/mb.dotnetruntime.win.x64/5/b/9/c/5b9c2c0ca079ea2f33181a1ef938ca40/51	MBAMInstallerService.exe, 00000002.00000003.2008450880.0000015EF3BFF000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://crt.rootca1.amazontrust.com/rootca1.cer0?	drvinst.exe, 00000008.00000002.2434287955.0000027072CA5000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000008.00000003.2432411808.0000027072CA5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://xml.org/sax/features/validation	MBAMInstallerService.exe, 00000002.00000000.1845438065.00007FF783D34000.00000002.00000001.01000000.0000000A.sdmp	false		high
https://br.malwarebytes.com/privacy/	MBSetup.exe, 00000000.00000000.1650493980.0000000000861000.00000002.00000001.01000000.00000003.sdmp	false		high
https://cdn.mwbsys.com/packages/mbam-c.dbcls.64bitv5/7/0/3/c/703c717289fea89d7b39642c7b8bc66e/8a445d	MBAMInstallerService.exe, 00000002.00000003.1943053820.0000015EF3C43000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.appinf.com/features/enable-partial-readshttp://www.appinf.com/properties/bla-maximum-ampl	MBAMInstallerService.exe, 00000002.00000000.1845438065.00007FF783D34000.00000002.00000001.01000000.0000000A.sdmp	false		unknown
http://www.microsoft.h_	drvinst.exe, 00000008.00000003.2432411808.0000027072CCC000.00000004.00000020.00020000.00000000.sdmp, drvinst.exe, 00000008.00000002.2434287955.0000027072CCC000.00000004.00000020.00020000.00000000.sdmp	false		low
https://it.malwarebytes.com/privacy/	MBSetup.exe, 00000000.00000000.1650493980.0000000000861000.00000002.00000001.01000000.00000003.sdmp	false		high
https://www.wireguard.net/D	MBAMInstallerService.exe, 00000002.00000003.2097374584.0000015EF47E0000.00000004.00001000.00020000.00000000.sdmp, MBAMInstallerService.exe, 00000002.00000003.2097629214.0000015EF4FE0000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://ark.mwbsys.com/mbam-c.ctlr.64bitv5/release#R-	MBAMInstallerService.exe, 00000002.00000003.1901984347.0000015EF3C37000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.malwarebytes.com	MBSetup.exe, 00000000.00000000.1650493980.0000000000861000.00000002.00000001.01000000.00000003.sdmp	false		high
http://xml.org/sax/properties/lexical-handler	MBAMInstallerService.exe, 00000002.00000000.1845438065.00007FF783D34000.00000002.00000001.01000000.0000000A.sdmp	false		high
https://de.malwarebytes.com/privacy/	MBSetup.exe, 00000000.00000000.1650493980.0000000000861000.00000002.00000001.01000000.00000003.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
3.161.136.22	unknown	United States	16509	AMAZON-02US	false
44.199.68.15	unknown	United States	14618	AMAZON-AESUS	false
34.117.237.239	unknown	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
52.10.78.57	unknown	United States	16509	AMAZON-02US	false
34.117.188.166	unknown	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
35.82.157.101	unknown	United States	237	MERIT-AS-14US	false
3.163.101.87	unknown	United States	16509	AMAZON-02US	false
3.233.23.101	unknown	United States	14618	AMAZON-AESUS	false
23.216.73.151	unknown	United States	20940	AKAMAI-ASN1EU	false
34.234.125.19	unknown	United States	14618	AMAZON-AESUS	false
34.120.208.123	unknown	United States	15169	GOOGLEUS	false
45.83.223.233	unknown	Sweden	39351	ESAB-ASSE	false
23.20.67.183	unknown	United States	14618	AMAZON-AESUS	false
34.149.100.209	unknown	United States	2686	ATGS-MMD-ASUS	false
34.107.243.93	unknown	United States	15169	GOOGLEUS	false
3.161.136.57	unknown	United States	16509	AMAZON-02US	false
3.161.136.79	unknown	United States	16509	AMAZON-02US	false
34.107.221.82	unknown	United States	15169	GOOGLEUS	false
52.25.6.244	unknown	United States	16509	AMAZON-02US	false
35.244.181.201	unknown	United States	15169	GOOGLEUS	false
44.234.138.74	unknown	United States	16509	AMAZON-02US	false
34.231.228.179	unknown	United States	14618	AMAZON-AESUS	false
34.160.144.191	unknown	United States	2686	ATGS-MMD-ASUS	false
35.82.208.123	unknown	United States	237	MERIT-AS-14US	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1427208
Start date and time:	2024-04-17 09:13:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 9s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	MBSetup.exe
Detection:	SUS
Classification:	sus38.troj.evad.winEXE@37/761@0/25
EGA Information:	Successful, ratio: 50%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, MoUsoCoreWorker.exe
Execution Graph export aborted for target MBAMService.exe, PID 8144 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtEnumerateValueKey calls found.
Report size getting too big, too many NtOpenKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtSetValueKey calls found.
Report size getting too big, too many NtWriteFile calls found.
Skipping network analysis since amount of network traffic is too extensive

Simulations

Behavior and APIs

Time	Type	Description
09:14:00	API Interceptor	16066x Sleep call for process: MBSetup.exe modified
09:14:19	API Interceptor	3x Sleep call for process: MBAMInstallerService.exe modified
09:15:29	API Interceptor	3x Sleep call for process: MBAMService.exe modified
09:15:38	API Interceptor	2x Sleep call for process: svchost.exe modified
09:15:38	API Interceptor	1192x Sleep call for process: Malwarebytes.exe modified
09:15:48	API Interceptor	1x Sleep call for process: firefox.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
34.117.188.166	Evernote.exe	Get hash	malicious	LummaC	Browse
	VLJWG-Y3VJN-21LNUV2-AHEB0VE.hta	Get hash	malicious	Unknown	Browse
	https://mega.nz/file/1uN3EaxZ#CUbFeX5nzgfkR0qb6Ucg8nGbIFqE9cmqjhfatbJqPpk	Get hash	malicious	HTMLPhisher	Browse
	vm.dll	Get hash	malicious	CobaltStrike	Browse
	W2_AND_1095_PDF.jar	Get hash	malicious	Unknown	Browse
	https://Chem.microsoft@cloudflare-ipfs.com/ipfs/bafkreif2klim7glbgcsrfe6lm7wfd2scwmhee5i6dglyggzgvjgl53zw2i/#ZGFuaWVsLmNhcmRhb0BjaGVtLmx1	Get hash	malicious	Unknown	Browse
	https://carenetworkservices-my.sharepoint.com/:b:/g/personal/dburgess_ashlandhc_com/Ec-Zq4_m5URLoTCU-KGg_KMB9z03_-668TZH2YT4tEDNrg?e=oADOv8	Get hash	malicious	Unknown	Browse
	UpdaterTag.dll	Get hash	malicious	Unknown	Browse
	ZoominstallerFull.exe	Get hash	malicious	PureLog Stealer, RedLine, zgRAT	Browse
	YmXa44bW67.exe	Get hash	malicious	Unknown	Browse
3.163.101.87	SecuriteInfo.com.Win32.TrojanX-gen.29663.14829.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse
	SecuriteInfo.com.Win32.TrojanX-gen.6370.3894.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse
	Blog.zip	Get hash	malicious	RHADAMANTHYS	Browse
	SecuriteInfo.com.Trojan.Siggen26.6766.7257.21259.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse
	file.exe	Get hash	malicious	RisePro Stealer	Browse
	R3qD3GiVhQ.exe	Get hash	malicious	Amadey, RisePro Stealer	Browse
	5k3Ffb6Jl2.exe	Get hash	malicious	Unknown	Browse
	e0Ae1lY8DL.exe	Get hash	malicious	Unknown	Browse
	r1cE8H161I.exe	Get hash	malicious	RisePro Stealer	Browse
	file.exe	Get hash	malicious	RisePro Stealer	Browse
34.117.237.239	Evernote.exe	Get hash	malicious	LummaC	Browse
	VLJWG-Y3VJN-21LNUV2-AHEB0VE.hta	Get hash	malicious	Unknown	Browse
	https://mega.nz/file/1uN3EaxZ#CUbFeX5nzgfkR0qb6Ucg8nGbIFqE9cmqjhfatbJqPpk	Get hash	malicious	HTMLPhisher	Browse
	vm.dll	Get hash	malicious	CobaltStrike	Browse
	W2_AND_1095_PDF.jar	Get hash	malicious	Unknown	Browse
	https://Chem.microsoft@cloudflare-ipfs.com/ipfs/bafkreif2klim7glbgcsrfe6lm7wfd2scwmhee5i6dglyggzgvjgl53zw2i/#ZGFuaWVsLmNhcmRhb0BjaGVtLmx1	Get hash	malicious	Unknown	Browse
	https://carenetworkservices-my.sharepoint.com/:b:/g/personal/dburgess_ashlandhc_com/Ec-Zq4_m5URLoTCU-KGg_KMB9z03_-668TZH2YT4tEDNrg?e=oADOv8	Get hash	malicious	Unknown	Browse
	UpdaterTag.dll	Get hash	malicious	Unknown	Browse
	ZoominstallerFull.exe	Get hash	malicious	PureLog Stealer, RedLine, zgRAT	Browse
	YmXa44bW67.exe	Get hash	malicious	Unknown	Browse
23.216.73.151	wsf.zip	Get hash	malicious	Remcos	Browse
	file.zip	Get hash	malicious	Unknown	Browse
	phish_alert_iocp_v1.4.48 (5).eml	Get hash	malicious	HTMLPhisher	Browse
	phish_alert_iocp_v1.4.48.eml	Get hash	malicious	HTMLPhisher	Browse
	BorradorRenta.xlsm	Get hash	malicious	Unknown	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	nsis-installer.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
	nsis-installer.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	34.117.186.192
	SecuriteInfo.com.FileRepMalware.18165.2747.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
	SecuriteInfo.com.FileRepMalware.18165.2747.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
	7AdIyN5s2K.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	file.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	34.117.186.192
	YUoiqJo8Sk.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	JR58WqLhRl.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
AMAZON-02US	http://139.144.214.53/5nXpDw325kdXA19thlgqqvurf31CSRUYYRTWNTDQNU30935IYSS28p9	Get hash	malicious	Phisher	Browse	3.163.101.110
	https://casestudybuddy.com	Get hash	malicious	Unknown	Browse	52.17.217.12
	n7h2Ze4ezf.elf	Get hash	malicious	Mirai	Browse	54.171.230.55
	bUAZ.exe	Get hash	malicious	Remcos	Browse	54.94.248.37
	https://bestohiomortgagerate.com/dream/mer/7/nobody@nobody.org	Get hash	malicious	HTMLPhisher	Browse	108.156.152.4
	https://fmcompan.pages.dev/	Get hash	malicious	PayPal Phisher	Browse	76.223.87.32
	SecuriteInfo.com.Trojan.Generic.35702255.16709.9631.msi	Get hash	malicious	Hidden Macro 4.0	Browse	3.141.55.131
	SecuriteInfo.com.Trojan.Generic.35702255.16709.9631.msi	Get hash	malicious	Hidden Macro 4.0	Browse	3.141.55.131
	https://ph2-cc-pages.s3.ap-southeast-2.amazonaws.com/microsoft-include-password-field/index.html	Get hash	malicious	Unknown	Browse	52.95.131.26
GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	nsis-installer.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
	nsis-installer.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	34.117.186.192
	SecuriteInfo.com.FileRepMalware.18165.2747.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
	SecuriteInfo.com.FileRepMalware.18165.2747.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
	7AdIyN5s2K.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	file.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	34.117.186.192
	YUoiqJo8Sk.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	JR58WqLhRl.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
AMAZON-02US	http://139.144.214.53/5nXpDw325kdXA19thlgqqvurf31CSRUYYRTWNTDQNU30935IYSS28p9	Get hash	malicious	Phisher	Browse	3.163.101.110
	https://casestudybuddy.com	Get hash	malicious	Unknown	Browse	52.17.217.12
	n7h2Ze4ezf.elf	Get hash	malicious	Mirai	Browse	54.171.230.55
	bUAZ.exe	Get hash	malicious	Remcos	Browse	54.94.248.37
	https://bestohiomortgagerate.com/dream/mer/7/nobody@nobody.org	Get hash	malicious	HTMLPhisher	Browse	108.156.152.4
	https://fmcompan.pages.dev/	Get hash	malicious	PayPal Phisher	Browse	76.223.87.32
	SecuriteInfo.com.Trojan.Generic.35702255.16709.9631.msi	Get hash	malicious	Hidden Macro 4.0	Browse	3.141.55.131
	SecuriteInfo.com.Trojan.Generic.35702255.16709.9631.msi	Get hash	malicious	Hidden Macro 4.0	Browse	3.141.55.131
	https://ph2-cc-pages.s3.ap-southeast-2.amazonaws.com/microsoft-include-password-field/index.html	Get hash	malicious	Unknown	Browse	52.95.131.26
AMAZON-AESUS	http://139.144.214.53/5nXpDw325kdXA19thlgqqvurf31CSRUYYRTWNTDQNU30935IYSS28p9	Get hash	malicious	Phisher	Browse	35.153.110.80
	https://theredhendc.com	Get hash	malicious	Unknown	Browse	52.71.238.51
	https://telegra.ph/Stephen-M-Hickey-04-10	Get hash	malicious	HTMLPhisher	Browse	35.170.12.36
	https://hatdotgov.freewebhostmost.com/	Get hash	malicious	TechSupportScam	Browse	100.24.193.230
	https://webex-install.com	Get hash	malicious	NetSupport RAT	Browse	3.226.143.241
	You have a newly assigned document from Frey Navarro P.L.L.C. .msg	Get hash	malicious	HTMLPhisher	Browse	54.221.7.233
	AdobeAcrobat2.1.2.msi	Get hash	malicious	AteraAgent	Browse	54.175.191.205
	RES094464-2180.ppam	Get hash	malicious	RevengeRAT	Browse	54.91.135.60
	http://live-uoe-edweb.pantheonsite.io	Get hash	malicious	Unknown	Browse	54.237.92.187
	https://www.dropbox.com/l/AABrfWjSV514IDLhR60LLT60TO4apO7UVoY/privacy#privacy	Get hash	malicious	Unknown	Browse	75.101.128.186

Process:	C:\Users\user\Desktop\MBSetup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6
Entropy (8bit):	2.2516291673878226
Encrypted:	false
SSDEEP:	3:Hy:Hy
MD5:	9F06243ABCB89C70E0C331C61D871FA7
SHA1:	FDE773A18BB29F5ED65E6F0A7AA717FD1FA485D4
SHA-256:	837CCB607E312B170FAC7383D7CCFD61FA5072793F19A25E75FBACB56539B86B
SHA-512:	B947B99D1BADDD347550C9032E9AB60B6BE56551CF92C076B38E4E11F436051A4AF51C47E54F8641316A720B043641A3B3C1E1B01BA50445EA1BA60BFD1B7A86
Malicious:	false
Preview:	test..

C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe

Process:	C:\Users\user\Desktop\MBSetup.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10102920
Entropy (8bit):	6.656977443186218
Encrypted:	false
SSDEEP:	196608:GqKLK82GXBmCtqbaacfS90763XEZ+hD9s:gLD2GXBmtbQfS2JKs
MD5:	CC91FBC5E424154388AFBE808DE25FF6
SHA1:	94E1C35EA3F8D75622CCF6F14A2AD18BFAC00E3E
SHA-256:	ED16B285A19A54CB07262E0AC68608218307FBAAF075C0EAC4D5E106D94C6C00
SHA-512:	9185C81449CF4F81E68FE008EE4889388751F7D70CB550ED52B816BF146BDF1FB105E1DA8E7AB2230CA028EE2079D9724FB0A80F8C1682082DAA0AB94B130567
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......7..,s..s..s..8..~t..8..~...s..r..uk.~`..uk.~a..uk.~...8..~Q..8..~r..8..~v..s..S...k.~&...k.~h...k.~....kK.r..s.#.q...k.~r..Richs..........................PE..d...3..e.........."....&.B...U................@........................................`..................................................W.<.....\..:...Y.............P......hQ.T....................jQ.(...0.D.@............@B.....PmW......................text....(B......B................. ..`.rdata...k...@B..l....B.............@..@.data...T2....W.......W.............@....pdata.......Y......4Y.............@..@_RDATA........\.......[.............@..@.rsrc....:...\...:...[.............@..@.reloc......P.......v..............@..B........................................................................................................................................................

C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.json

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	654
Entropy (8bit):	5.239890166969036
Encrypted:	false
SSDEEP:	12:tPRgsg7gGHEozYFc/Dy/PFxiWoEkqPMJV3U0vaF7dZMXuEkqqq7aNldQZPVKkkM5:HgzE0YFcbyXFxiWkqPM7U0CxqqH8P8RE
MD5:	55E3ABDF48F7DA9FB502F81E959B5E8A
SHA1:	8A1BC3D2C6CDE6CE63EC049C682244A68DBA0AE7
SHA-256:	BB33927DE8097DEE5326B2DCF98F3449B0C776962CBFC9CA3ACB995B2A69A611
SHA-512:	620A8A21B7BD3EE08A180A4804425270F3FC771697B9D2672C0887E72E29B597E6F1ECBBD3476CF9CE97BA3B68A6D513CB7C17C6F01E83F2C303CF989799D260
Malicious:	false
Preview:	5D1AC6D5707F7B2336F8480E0BC4183793FE3648A9A1E8E3CAB85BED09478F13..{.. "affiliateId": "",.. "affiliateName": "",.. "allowSCMSvcStop": true,.. "checkConfig": true,.. "dataPath": "C:\\ProgramData\\Malwarebytes\\MBAMService",.. "delayInterval": 15000,.. "delayStart": false,.. "enableDumpCollection": true,.. "installPath": "C:\\Program Files\\Malwarebytes\\Anti-Malware",.. "logFileBackups": 10,.. "logFilePath": "C:\\ProgramData\\Malwarebytes\\MBAMService\\logs\\mbamservice.log",.. "logFileSize": 10485760,.. "maxLogLevel": "info",.. "productBuild": "consumer",.. "productCode": "MBAM-C",.. "productVersion": "5.1.2.109"..}

C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.json.bak

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	654
Entropy (8bit):	5.239890166969036
Encrypted:	false
SSDEEP:	12:tPRgsg7gGHEozYFc/Dy/PFxiWoEkqPMJV3U0vaF7dZMXuEkqqq7aNldQZPVKkkM5:HgzE0YFcbyXFxiWkqPM7U0CxqqH8P8RE
MD5:	55E3ABDF48F7DA9FB502F81E959B5E8A
SHA1:	8A1BC3D2C6CDE6CE63EC049C682244A68DBA0AE7
SHA-256:	BB33927DE8097DEE5326B2DCF98F3449B0C776962CBFC9CA3ACB995B2A69A611
SHA-512:	620A8A21B7BD3EE08A180A4804425270F3FC771697B9D2672C0887E72E29B597E6F1ECBBD3476CF9CE97BA3B68A6D513CB7C17C6F01E83F2C303CF989799D260
Malicious:	false
Preview:	5D1AC6D5707F7B2336F8480E0BC4183793FE3648A9A1E8E3CAB85BED09478F13..{.. "affiliateId": "",.. "affiliateName": "",.. "allowSCMSvcStop": true,.. "checkConfig": true,.. "dataPath": "C:\\ProgramData\\Malwarebytes\\MBAMService",.. "delayInterval": 15000,.. "delayStart": false,.. "enableDumpCollection": true,.. "installPath": "C:\\Program Files\\Malwarebytes\\Anti-Malware",.. "logFileBackups": 10,.. "logFilePath": "C:\\ProgramData\\Malwarebytes\\MBAMService\\logs\\mbamservice.log",.. "logFileSize": 10485760,.. "maxLogLevel": "info",.. "productBuild": "consumer",.. "productCode": "MBAM-C",.. "productVersion": "5.1.2.109"..}

C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll (copy)

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2589624
Entropy (8bit):	7.0522420857261565
Encrypted:	false
SSDEEP:	49152:/5wZat2ranBQjvaq/Gtl8StQyfvE0Z3R0nxiIq2ddBzOnX:/5wZauUBQjvL0SKtQRq2cnX
MD5:	B6D8B7E6F74196F62CABA2CA77A7AE91
SHA1:	6AC9C99F084B5772440E2F135B8D5365F7F45314
SHA-256:	74B0BF9C17091AB1C6C61AF0AEFBC599F1ECC0FFF6DEE0144A3DFD5CD1F5E18F
SHA-512:	AD58BC7B626A13606E3F44DF7188B2420E0F31ECB55632EAC4B6A05DC1574F1EC1B0EF6B52E11832713C6F8F91C807FE3A815699D0748284993ECC54F2823044
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........Lo."<."<."<..!=."<..'=[."<..!=.."<..&=."<..'=l."<..&=.."<..$=."<..#=."<.#< ."<H.+=."<H..<.."<.<."<H. =.."<Rich."<........PE..L......e.................r...j......n.............@...........................'.....D.'...@..................................N..d.....................&......`&.`....L..p....................M..........@....................4.......................text...vq.......r.................. ..`.rdata...............v..............@..@.data....[...`...F...F..............@....rsrc...............................@..@.reloc..`....`&.......&.............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files\Malwarebytes\Anti-Malware\mbtun\mbtun.cat

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	data
Category:	dropped
Size (bytes):	11245
Entropy (8bit):	7.248368253798659
Encrypted:	false
SSDEEP:	192:gM6dynJCSEJOL7yKnUi8rFWQFIGjl8zjEswYt1FfRM/GX01k9z3AeOlFa:gqS4CFRWGjl8M8/fi/GR9z/OlFa
MD5:	8ABFF1FBF08D70C1681A9B20384DBBF9
SHA1:	C9762E121E4F8A7AD931EEE58EE60C8E9FC3ECB6
SHA-256:	9CEB410494B95397EC1F8FA505D071672BF61F81CC596B8ECCD167A77893C658
SHA-512:	37998E0AEE93FF47FE5B1636FCE755966DEBE417A790E1AEBD7674C86C1583FEEF04648A7BC79E4DEDAABB731051F4F803932AC49EA0BE05776C0F4D218B076F
Malicious:	false
Preview:	0.+....H........+.0.+....1.0...`.H.e......0.....+.....7......0...0...+.....7.....V.o....F.W..B....220518151502Z0...+.....7.....0..V0....RB.E.2.7.1.1.1.4.8.B.9.9.2.A.A.B.6.B.D.C.7.1.3.C.9.9.6.8.3.E.E.0.C.F.F.3.F.2.8.7...1..S06..+.....7...1(0&...F.i.l.e........m.b.t.u.n...s.y.s...0M..+.....7...1?0=0...+.....7...0...........0!0...+.........'.....k.q<.h>....0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0f..+.....7...1X0V...O.S.A.t.t.r.......@2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.1.0...0...0....RC.E.C.5.E.8.8.C.2.4.8.1.D.3.2.3.E.C.3.6.6.C.1.8.0.2.4.D.6.1.A.1.1.7.F.0.1.B.2.1...1..K06..+.....7...1(0&...F.i.l.e........m.b.t.u.n...i.n.f...0E..+.....7...17050...+.....7.......0!0...+...........$..#.6l..Ma....!0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0f..+.....7...1X0V...O.S.A.t.t.r.......@2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.1.0...0.......0...0J..+

C:\Program Files\Malwarebytes\Anti-Malware\mbtun\mbtun.inf

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	1906
Entropy (8bit):	5.5538908997445064
Encrypted:	false
SSDEEP:	48:FjfmAP/5H7cXq7lthzHU/lltFDmDQB7581EjEkD:Fj+AnlAXq7ltZHUxp/qeEkD
MD5:	5D1917024B228EFBEAB3C696E663873E
SHA1:	CEC5E88C2481D323EC366C18024D61A117F01B21
SHA-256:	4A350FC20834A579C5A58352B7A3AA02A454ABBBD9EECD3CD6D2A14864A49CD8
SHA-512:	14B345F03284B8C1D97219E3DD1A3910C1E453F93F51753F417E643F50922E55C0E23AAB1D437300E6C196C7017D7B7538DE4850DF74B3599E90F3941B40AB4A
Malicious:	false
Preview:	;..; Copyright (C) 2020 Malwarebytes. All Rights Reserved.....[Version]..Signature = "$Windows NT$"..Class = Net..ClassGUID = {4D36E972-E325-11CE-BFC1-08002BE10318}..Provider = %MBTun.CompanyName%..DriverVer = 09/03/2020, 1.0.0.0..CatalogFile.NT = mbtun.cat..CatalogFile = mbtun.cat....[Manufacturer]..%MBTun.CompanyName% = %MBTun.Name%, NTamd64....[SourceDisksNames]..1 = %MBTun.DiskDesc%, "", ,....[SourceDisksFiles]..mbtun.sys = 1....[DestinationDirs]..DefaultDestDir = 12..MBTun.CopyFiles.Sys = 12....[MBTun.CopyFiles.Sys]..mbtun.sys, , , 0x00004002 ; COPYFLG_IN_USE_RENAME \| COPYFLG_NOSKIP....[MBTun.NTamd64]..%MBTun.DeviceDesc% = MBTun.Install, mbtun....[MBTun.Install]..Characteristics = 0x1 ; NCF_VIRTUAL..AddReg = MBTun.Ndi..CopyFiles = MBTun.CopyFiles.Sys..IfType = 53 ; IF_TYPE_PROP_VIRTUAL..MediaType = 19 ; NdisMediumIP..*PhysicalMediaType = 0 ; NdisPhysicalMediumUnspecified..EnableDhcp = 0 ; Disable DHCP....[MBTun.Install.Services]..AddService = mbtun, 2, MBTun.Service, MBTun.Event

C:\Program Files\Malwarebytes\Anti-Malware\mbtun\mbtun.sys

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	110104
Entropy (8bit):	6.851513818294034
Encrypted:	false
SSDEEP:	1536:k0h5S895dQOYJaryTmbMc6uqkZUcmSl47AjpdAyDCYJqUufIfmNn3VzwZ6Dh7Q9y:C895uOYJar1MLcmSlrSgC6Duls2t
MD5:	83D4FBA999EB8B34047C38FABEF60243
SHA1:	25731B57E9968282610F337BC6D769AA26AF4938
SHA-256:	6903E60784B9FA5D8B417F93F19665C59946A4DE099BD1011AB36271B267261C
SHA-512:	47FAAB5FFF3E3E2D2AEA0A425444AA2E215F1D5BF97EDEE2A3BB773468E1092919036BCD5002357594B62519BF3A8980749D8D0F6402DE0E73C2125D26E78F1E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......{N..?/..?/..?/..dG..6/..?/..K/..dG..;/..dG..9/...F.../...FA.>/...F..>/..Rich?/..........................PE..d......b.........."..........2.......0.........@.............................`....../......A.................................................0..d....@..........D............P..8...`...8............................................................................text............................... ..h.rdata..t...........................@..H.data...............................@....pdata..D...........................@..HPAGE....l.... ...................... ..`INIT.........0...................... ..b.rsrc........@......................@..B.reloc..<....P......................@..B........................................................................................................................................................................................

C:\Program Files\Malwarebytes\Anti-Malware\mbuns.exe

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2589624
Entropy (8bit):	7.0522420857261565
Encrypted:	false
SSDEEP:	49152:/5wZat2ranBQjvaq/Gtl8StQyfvE0Z3R0nxiIq2ddBzOnX:/5wZauUBQjvL0SKtQRq2cnX
MD5:	B6D8B7E6F74196F62CABA2CA77A7AE91
SHA1:	6AC9C99F084B5772440E2F135B8D5365F7F45314
SHA-256:	74B0BF9C17091AB1C6C61AF0AEFBC599F1ECC0FFF6DEE0144A3DFD5CD1F5E18F
SHA-512:	AD58BC7B626A13606E3F44DF7188B2420E0F31ECB55632EAC4B6A05DC1574F1EC1B0EF6B52E11832713C6F8F91C807FE3A815699D0748284993ECC54F2823044
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........Lo."<."<."<..!=."<..'=[."<..!=.."<..&=."<..'=l."<..&=.."<..$=."<..#=."<.#< ."<H.+=."<H..<.."<.<."<H. =.."<Rich."<........PE..L......e.................r...j......n.............@...........................'.....D.'...@..................................N..d.....................&......`&.`....L..p....................M..........@....................4.......................text...vq.......r.................. ..`.rdata...............v..............@..@.data....[...`...F...F..............@....rsrc...............................@..@.reloc..`....`&.......&.............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files\Malwarebytes\Anti-Malware\mbuns.exe:Zone.Identifier

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.cat

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
File Type:	data
Category:	dropped
Size (bytes):	11237
Entropy (8bit):	7.24758174910655
Encrypted:	false
SSDEEP:	192:T3p/yriJCSEXFBkyKuqwFWQFoWylybTseUfX01k9z3AnhDoM:zDsFRCFy/6fR9zU0M
MD5:	F7C8E0339BD48B6FE8ECA81AC3BA5BA5
SHA1:	1369BD4DCFA7709D8EED12FA76FDBEBD39DD6BCC
SHA-256:	A9DD01F84A075EA8D0B0968FD7A11720E49F019834F7D4FE80F50DACB12030AA
SHA-512:	C722510C40FBED32BCDA3B5B69C590A9043E4E51F8E804F77F73EB8EA0CAC0F4A587EF540F2773981839F04E44F48BBC8B5E8C03DED3F0CF637ED1E3172C8E07
Malicious:	false
Preview:	0.+...*.H........+.0.+....1.0...`.H.e......0..u..+.....7.....f0..b0...+.....7........M.M.&....@`..231129195737Z0...+.....7.....0..h0....R2.7.B.1.3.1.1.D.3.B.1.9.9.E.4.C.2.2.7.7.2.F.A.1.B.7.E.A.5.5.6.8.0.5.7.7.5.D.3.7...1..[0E..+.....7...17050...+.....7.......0!0...+........'.1.;..L"w/...Uh.w]70F..+.....7...1806...F.i.l.e.......$m.b.a.m.s.w.i.s.s.a.r.m.y...i.n.f...0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0f..+.....7...1X0V...O.S.A.t.t.r.......@2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.1.0...0...0....R3.F.F.6.5.A.4.B.3.D.F.3.1.9.E.A.2.5.E.A.F.C.2.2.0.C.5.A.F.8.1.2.7.F.F.0.B.1.A.1...1..U0F..+.....7...1806...F.i.l.e.......$m.b.a.m.s.w.i.s.s.a.r.m.y...s.y.s...0M..+.....7...1?0=0...+.....7...0...........0!0...+........?.ZK=...%..".Z....0X..+.....7...1J0H...O.S.A.t.t.r.......22.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.1.0...0...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.

C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.inf

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	2327
Entropy (8bit):	4.87388289954056
Encrypted:	false
SSDEEP:	48:uK0fONQBQgw3hE5MLPbg/NihXOy5bad0SX1H:uhfONQBQguhECTbgKXO2bad0s1H
MD5:	D87C2F68057611E687BDB8CC6EBEA5B8
SHA1:	27B1311D3B199E4C22772FA1B7EA556805775D37
SHA-256:	FF93773F55BF4A6A0242ADF82276A8C95C0B244B9BC05E515C4E810C81A960E8
SHA-512:	4AA65B8911D8A2A0F9EF0EE6E934B94DB0A9AD4C2EC543B5EDCF21486BE43F6AB1FDA6617EA2CBB85EFF230628C9FA8E7649DA915D6DE695803B28E55BEF5819
Malicious:	false
Preview:	;;;..;;; Malwarebytes Anti-Malware SwissArmy..;;;..;;;..;;; Copyright (c) 2017, Malwarebytes..;;;....[Version]..Signature = "$Windows NT$"..Class = "ActivityMonitor" ;This is determined by the work this filter driver does..ClassGuid = {b86dff51-a31e-4bac-b3cf-e8cfe75c9fc2}..Provider = %Malwarebytes%..DriverVer = 03/02/2016,3.0.0.30..CatalogFile = mbamswissarmy.cat....[DestinationDirs]..DefaultDestDir = 12..Swissarmy.DriverFiles = 12 ;%windir%\system32\drivers....;;..;; Default install sections..;;....[DefaultInstall.NTamd64]..OptionDesc = %SwissarmyServiceDesc%..CopyFiles = Swissarmy.DriverFiles....[DefaultInstall.NTamd64.Services]..AddService = %SwissarmyServiceName%,,Swissarmy.Service....;;..;; Default uninstall sections..;;....[DefaultUninstall.NTamd64]..LegacyUninstall=1..DelFiles = Swissarmy.DriverFiles......[DefaultUninstall.NTamd64.Services]..DelService = %SwissarmyServiceName%,0x200

C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.sys

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	239576
Entropy (8bit):	6.482860996728927
Encrypted:	false
SSDEEP:	3072:H4czIC7UsK3MJNbwCfxrdy19MbMA2gtylc0jGYjNHLcUMfTCGTkpk/BzS6XYrh41:HXhf/RL4MylcGGYjVcjTCGVBfXi8
MD5:	4B2CC2D3EBF42659EA5E6E63584E1B76
SHA1:	0042DA8151F2E10A31ECCEB60795EB428316E820
SHA-256:	3DB4366CCB9D94062388000926C060E2524C7D3EE4B6B7C7CF06F909F747FC6C
SHA-512:	804D64D346B3DBB1CE3095A5D0FA7ACC5DA0BF832C458E557DAC486559FE53144F15F08C444FEA84A01471FD5981E68801A809B143C56B5B63E3E16DE9DB0D98
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......C.Kl..%?..%?..%?\.#>..%?\.&>..%?\.!>..%?\.$>..%?..$?..%?.. >..%?..!>..%?...?..%?..'>..%?Rich..%?................PE..d....@Ne.........."............................@..........................................`A...................................................d............P..X........%......P...P...8............................................................................text............................... ..h.rdata...,..........................@..H.data....S.......<..................@....pdata..X....P......................@..HPAGE.....-...p.......0.............. ..`INIT.................^.............. ..b.rsrc................\|..............@..B.reloc..P...........................@..B................................................................................................................................................................................

C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.tmf

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	159417
Entropy (8bit):	5.605139444615912
Encrypted:	false
SSDEEP:	1536:RSQfu/iSbUtiruK6ZeI+FIfGbDMT05caJ:IQfu/xbUtirR7d5j
MD5:	C4B7DD8394E2525D3B7F50AD55334F02
SHA1:	B95C4B6CB09F53A72F82383E08E9FA0574032F44
SHA-256:	F098DAE3D2C6685C33A3D8D58BB9A6C7CD933F0CF98BBAAA65316F9CA18030FB
SHA-512:	7A38530D9E99F9B8674BCEB43C4F7C8BFACA39FA6B133A99766FCAC162BA697DEF26A1B7001741D719340C261BF83FE545D9FA03E67E755C3FE95B1B79FD7CFE
Malicious:	false
Preview:	// PDB: e:\jenkins\workspace\N_Swissarmy_Kernel\src\..\bin\x64\Win7_Release\mbamswissarmy.pdb..// PDB: Last Updated :2023-11-10:14:41:01:023 (UTC) [tracepdb]..a73b0b10-a83a-333a-6e02-d44fa848fff1 SwissarmyKernel // SRC=util.c MJ= MN=..#typev util_c368 23 "%0Invalid DOS header!" // LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=BreakExecutableHeader..{..}..#typev util_c374 24 "%0Invalid NT header!" // LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=BreakExecutableHeader..{..}..#typev util_c361 22 "%0Invalid DOS header!" // LEVEL=MBLogLevelDebug FLAGS=TraceFlag FUNC=BreakExecutableHeader..{..}..#typev util_c92 14 "%0Invalid Parameter" // LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=ConcatFileName..{..}..#typev util_c98 15 "%0Memory allocaiton failure. size (%10!d!)" // LEVEL=MBLogLevelError FLAGS=TraceFlag FUNC=ConcatFileName..{..(PrefixLength + FileNameLength + 2) * sizeof(WCHAR), ItemLong -- 10..}..#typev util_c56 11 "%0Invalid input string." // LEVEL=MBLogLevelDebug FLAGS=TraceFla

C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.cat

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
File Type:	data
Category:	dropped
Size (bytes):	11341
Entropy (8bit):	7.25740687904965
Encrypted:	false
SSDEEP:	192:F8+3A/ytTJCSEXFBkyKuqwFWQFjDrwLobDX01k9z3AmkQPRpg:VTsFR5DMyDR9zpDPbg
MD5:	1CD8ABDAEA3BCD30214F01046ECD450D
SHA1:	ABC8FEF03A274DCB9F15C17396E9F0AF85A0B0FD
SHA-256:	CF981AD0B084C330FBFC00F9E559404C6731D407A9F004CE68B50ECD7ABE7425
SHA-512:	A04F2BEAFBE2311A5EEC84F8ECFF16DB1DDA864D420643184B0164ACA9958B679205C3AB23BB71095D710F45DC4C3C51FF8B267C36A1FFC768126B48556F5F86
Malicious:	false
Preview:	0.,I..*.H........,:0.,6...1.0...`.H.e......0..u..+.....7.....f0..b0...+.....7.....6..'..O.'.ec.....231204171810Z0...+.....7.....0..h0....R8.4.E.E.6.7.A.9.1.6.7.B.5.E.B.6.5.6.0.7.1.1.B.9.8.7.1.D.E.9.8.8.9.8.A.D.0.7.A.5...1..[0E..+.....7...17050...+.....7.......0!0...+..........g..{^.V.........0F..+.....7...1806...F.i.l.e.......$m.b.a.m.c.h.a.m.e.l.e.o.n...i.n.f...0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0f..+.....7...1X0V...O.S.A.t.t.r.......@2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.1.0...0...0....RA.7.1.2.F.9.9.4.5.2.6.7.F.6.F.7.E.B.0.8.F.6.F.A.4.8.F.D.C.2.2.F.2.8.D.B.8.7.B.B...1..U0F..+.....7...1806...F.i.l.e.......$m.b.a.m.c.h.a.m.e.l.e.o.n...s.y.s...0M..+.....7...1?0=0...+.....7...0...........0!0...+............Rg......H../(..0X..+.....7...1J0H...O.S.A.t.t.r.......22.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.1.0...0...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.

C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.inf

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	3160
Entropy (8bit):	4.9911690962982975
Encrypted:	false
SSDEEP:	96:uFfJNQBQg8GCER6btAG98sI3ZPmZLPPP5g03Cra1bBS:uFfJVg8GCRb98jZPmZLPPP5dyra1bBS
MD5:	5A9717E1385703E8F06B27AA10A69E87
SHA1:	84EE67A9167B5EB6560711B9871DE98898AD07A5
SHA-256:	47B7C516BB57C612DE19F0CA865590AF95B6E32BF873A0FEF9E011B2C5B483D4
SHA-512:	DD3C7278C2C11AD15A55FAE6D19B96DADD92F85B7F0C8CE934298258AF00BB5C052A84A98499B8867B0F43704FB307C67D03692CA69DDA4D814C6C17DD73DF44
Malicious:	false
Preview:	;;;..;;; Malwarebytes Anti-Malware Chameleon..;;;..;;;..;;; Copyright (c) 2016, Malwarebytes..;;;....[Version]..Signature = "$Windows NT$"..Class = "ActivityMonitor" ;This is determined by the work this filter driver does..ClassGuid = {b86dff51-a31e-4bac-b3cf-e8cfe75c9fc2}..Provider = %Malwarebytes%..DriverVer = 03/02/2016,3.0.0.30..CatalogFile = MbamChameleon.cat....[DestinationDirs]..DefaultDestDir = 12..Sp.DriverFiles = 12 ;%windir%\system32\drivers....;;..;; Default install sections..;;..[DefaultInstall.NTamd64]..OptionDesc = %SpServiceDesc%..CopyFiles = Sp.DriverFilesCopy....[DefaultInstall.NTamd64.Services]..AddService = %SpServiceName%,,Sp.Service....;;..;; Default uninstall sections..;;..[DefaultUninstall.NTamd64]..LegacyUninstall=1..DelFiles = Sp.DriverFiles..DelReg = Sp.DelRegistry....[DefaultUninstall.NTamd64.Services]..DelService = %SpServiceName%,0x200 ;Ensure service is st

C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.sys

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	223296
Entropy (8bit):	6.394126446542679
Encrypted:	false
SSDEEP:	3072:2VeOHYV711N4ItXO0dlAWaHXJXFUIb7Pre7BlPv+OKEg8XiBGQjiaEwp74q+XuN8:hoQ78XJVUpstEW3ji/wujXuW
MD5:	262CCB223392F18ADB4B4C846905C4DA
SHA1:	63403407FBE1712A4BFAD0A74EFABEBA297325CA
SHA-256:	5D2004603E3B392693A1E74926A36A2AB3573C6790B00DDB14564C8AFFBD4F4F
SHA-512:	68B2684B9F0A2E5E33B76E43AC4B25B8E7D3DC3D678FC3C90D70EC5EE65EBDD884D838950FB4BC5145FF927E25796D2E6E97EE6BF365ED4F66AC7F7BA8F63B33
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........KlG.%?G.%?G.%?..#>@.%?..&>C.%?..!>A.%?..$>N.%?G.$?..%?.. >D.%?..!>V.%?...?F.%?..'>F.%?RichG.%?........................PE..d.....me.........."..................c.........@.....................................7.....A.................................................c..d....................B..@&..............8...........................0...................`............................text....m.......n.................. ..hNONPAGE..............r.............. ..h.rdata..$N.......P...t..............@..H.data...............................@....pdata..............................@..HPAGE....$:... ...<.................. ..`INIT.........`...................... ..b.rsrc................<..............@..B.reloc...............@..............@..B................................................................................................................................

C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.tmf

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	146007
Entropy (8bit):	5.666761910187043
Encrypted:	false
SSDEEP:	1536:Y52/FHnO3dhxcBByaoQJ0/+u/rqYSI94wTRxdOEi4e/hTXdd4aZ:YsHwTRxQNdn
MD5:	D76B1CE1AC6AAA4500CE3681F5426888
SHA1:	6CC78FA516EFA9C98074798698947255430E5BCE
SHA-256:	FEE89BCEDBD81B5A96144573FD92415035B6CD4A2C2848693AC9EF7C6C045662
SHA-512:	A5C512D0C8CCE4A82365DBF727A587102EF8319337AEE8ADAD3EE0B6F483D74F0B0BC88B6CD995C8E5EDFC614935AE2F4636C7CE7FA7D4055633AC7D2F7F2355
Malicious:	false
Preview:	// PDB: d:\jenkins\workspace\N_SelfProtection_Kernel\src\..\bin\x64\Win7_Release\MbamChameleon.pdb..// PDB: Last Updated :2023-12-04:16:26:09:296 (UTC) [tracepdb]..0add512e-3b83-316f-ac22-ee30143d27d9 SelfProtectionKernel // SRC=watchdog-common.c MJ= MN=..#typev watchdog-common_c207 16 "%0Failed to allocate memory for protected process (Line %10!u! %11!u! bytes)." // LEVEL=MBLogLevelError FLAGS=TRACE_FLAG_PROCESS FUNC=AddProtectedProcess..{..__LINE__, ItemLong -- 10..sizeof(PROCTECTED_PROCESS_CONTEXT), ItemLong -- 11..}..#typev watchdog-common_c203 15 "%0Added protected process %10!p! - %11!s!." // LEVEL=MBLogLevelDebug FLAGS=TRACE_FLAG_PROCESS FUNC=AddProtectedProcess..{..ProcessId, ItemPtr -- 10..pProcessCtx->ProcessName, ItemWString -- 11..}..#typev watchdog-common_c324 21 "%0AddQuarantinedProcess failed to allocate memory" // LEVEL=MBLogLevelError FLAGS=TRACE_FLAG_PROCESS FUNC=AddQuarantinedProcess..{..}..#typev watchdog-common_c319 20 "%0AddQuarantinedProcess: %10!p!" //

C:\ProgramData\Malwarebytes\MBAMService\LOGS\MBAMSERVICE.LOG

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	75390
Entropy (8bit):	3.748741893025327
Encrypted:	false
SSDEEP:	768:0QMdEQx4FVZIgpkXppppppp/Q6QKs8Q6Q8/CN++BgERoXL:JBfKsJf8/URoXL
MD5:	3E3621DA7787664FDEAD5996D5AA9102
SHA1:	C9F17A71D3ED71613403DD990F3D7F3D451F05B6
SHA-256:	599433209A2272B6AE5D074353E9C3CAF88029FF3CB10C3F00D92BAAC5EB0FAD
SHA-512:	B64F33A3BABA27441A63194F09BC4F2F895617307DC0B1DA8EBC558C6547481CE7A6F33934343AE98EBF34E0381DE79510BECF825CE8698D9000B66510910BF4
Malicious:	false
Preview:	..D.a.t.e...T.i.m.e...T.i.c.k. .C.o.u.n.t...P.r.o.c.e.s.s. .I.D...T.h.r.e.a.d. .I.D...L.o.g. .L.e.v.e.l...C.o.n.t.e.x.t. .T.a.g...F.u.n.c.t.i.o.n. .N.a.m.e...F.i.l.e. .N.a.m.e...L.i.n.e. .N.u.m.b.e.r...M.e.s.s.a.g.e.....0.4./.1.7./.2.4...". .0.9.:.1.5.:.1.8...8.9.5."...6.2.0.6.6.2.5...1.a.f.8...0.4.a.4...I.N.F.O...L.o.g.C.o.n.t.r.o.l.l.e.r...C.L.o.g.C.o.n.t.r.o.l.l.e.r.:.:.S.t.a.r.t...".L.o.g.C.o.n.t.r.o.l.l.e.r...c.p.p."...9.3...".S.t.a.r.t.e.d. .l.o.g.g.i.n.g.".....0.4./.1.7./.2.4...". .0.9.:.1.5.:.1.8...8.9.5."...6.2.0.6.6.2.5...1.a.f.8...0.4.a.4...I.N.F.O...L.o.g.C.o.n.t.r.o.l.l.e.r...C.L.o.g.C.o.n.t.r.o.l.l.e.r.:.:.S.t.a.r.t...".L.o.g.C.o.n.t.r.o.l.l.e.r...c.p.p."...9.5...".L.o.c.a.l. .t.i.m.e. .z.o.n.e.:. .'.W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e.'. .(.U.T.C.+.0.2.:.0.0.).".....0.4./.1.7./.2.4...". .0.9.:.1.5.:.1.9...0.5.1."...6.2.0.6.7.8.1...1.a.f.8...0.4.a.4...I.N.F.O...S.e.r.v.i.c.e.C.o.n.t.r.o.l.l.e.r.I.m.p.l...S.e.r.v.i.c.e.C.o.n.t.r.o.l.l.e.r.I.m.p.l.e.m.e.n.t.a.t.i.o.n.

C:\ProgramData\Malwarebytes\MBAMService\LOGS\MBAMUI.LOG

Process:	C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2655
Entropy (8bit):	5.24923636589869
Encrypted:	false
SSDEEP:	48:ttJ+DZLoABXeUH0mMi5LxuAAA2AAxJAxJAv:ttJ+D1oABX7+/ABAvAvAv
MD5:	75716009A4958C11E35A68DB01C1ACA3
SHA1:	316579DA08C7166576212FF0A45B8AE78DC0A55B
SHA-256:	DA54DF7A313508923A5595FCEAED52F57F47E1697A5A5873425DE3A225134FD6
SHA-512:	A76074B4A058D1F1A2E345080F643EA790223788DAC609AA62DDCB725486F91AACB91E2FB24EA4C7AE62A07742080EF6CC3656DBC1E88287990FDA18A266E355
Malicious:	false
Preview:	2024-04-17 09:15:37.624 +02:00 [INF] No configuration files found. Initializing default settings...2024-04-17 09:15:38.514 +02:00 [INF] Attempting to apply migrations to the DB..2024-04-17 10:37:41.164 +02:00 [WRN] WlanOpenHandle failed, last error: 1062..2024-04-17 10:41:32.056 +02:00 [ERR] Underlying PoliciesController COM sent invalid windows updates json information...System.Text.Json.JsonException: The JSON value could not be converted to System.DateTime. Path: $.lastSuccessfulInstall \| LineNumber: 1 \| BytePositionInLine: 30... ---> System.FormatException: The JSON value is not in a supported DateTime format... at System.Text.Json.ThrowHelper.ThrowFormatException(DataType dataType).. at System.Text.Json.Utf8JsonReader.GetDateTime().. at System.Text.Json.Serialization.Converters.DateTimeConverter.Read(Utf8JsonReader& reader, Type typeToConvert, JsonSerializerOptions options).. at System.Text.Json.Serialization.Metadata.JsonPropertyInfo`1.ReadJsonAndSetMember(Object obj, Rea

C:\ProgramData\Malwarebytes\MBAMService\LOGS\MBVpnTunnelService.log

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	3902
Entropy (8bit):	3.6894958450842172
Encrypted:	false
SSDEEP:	96:NE/9fwKKRHEMRHDZ4SHUO73YOiJtOiaOi5Si0iiIirLJNM:NElonixtnON6E
MD5:	1C743FED31F5C258B758F30AC206FB6D
SHA1:	1B9D08D14F958C53B29768F9EF3E777FA46C51BA
SHA-256:	2D9A966F621E1A999A1F845F31BD73C0157AC78A36A2F29F061131F4BE3F1BB8
SHA-512:	8BA2CE3A91315A6E04C7EE5C3855C3FF9FE2C07A5C2EF7FB5ADFA449CC76A0BDA3686136D92E09D40D44CD22EA3EBFEDCE528609494B106DD6C239AAB697BB64
Malicious:	false
Preview:	..D.a.t.e...T.i.m.e...T.i.c.k. .C.o.u.n.t...P.r.o.c.e.s.s. .I.D...T.h.r.e.a.d. .I.D...L.o.g. .L.e.v.e.l...C.o.n.t.e.x.t. .T.a.g...F.u.n.c.t.i.o.n. .N.a.m.e...F.i.l.e. .N.a.m.e...L.i.n.e. .N.u.m.b.e.r...M.e.s.s.a.g.e.....0.4./.1.7./.2.4...". .0.9.:.1.5.:.0.1...4.5.3."...6.1.8.9.1.8.7...1.e.f.4...1.e.f.8...I.N.F.O...M.B.V.p.n.T.u.n.n.e.l.S.e.r.v.i.c.e...R.u.n.M.B.T.u.n.I.n.s.t.a.l.l.e.r...".m.b.t.u.n...c.p.p."...8.7...".R.e.m.o.v.e.D.r.i.v.e.r.=.1. .R.e.i.n.s.t.a.l.l.D.r.i.v.e.r.=.1. .V.e.r.s.i.o.n.=.2.".....0.4./.1.7./.2.4...". .0.9.:.1.5.:.0.1...5.3.1."...6.1.8.9.2.6.5...1.e.f.4...1.e.f.8...I.N.F.O...M.B.T.u.n.D.r.i.v.e.r.I.n.s.t.a.l.l.e.r...U.n.i.n.s.t.a.l.l.M.B.T.u.n.H.e.l.p.e.r...".c.u.s.t.o.m.a.c.t.i.o.n...c.p.p."...1.3.6...".D.r.i.v.e.r. .p.a.c.k.a.g.e. .f.o.l.d.e.r.:. .C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.M.a.l.w.a.r.e.b.y.t.e.s.\.A.n.t.i.-.M.a.l.w.a.r.e.\.m.b.t.u.n...".....0.4./.1.7./.2.4...". .0.9.:.1.5.:.1.4...5.4.7."...6.2.0.2.2.8.1...1.e.f.4...1.e.f.8...I.N.F.O...M.B.T.u.n.D.r.

C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	68392
Entropy (8bit):	3.9217669336951695
Encrypted:	false
SSDEEP:	384:cr1PalGB5AWiWq2mhzJUVVqxKS3xV2CjNrBa7gHOykEajctcxPaF:iUAHiWqn1UVVqx9U7gYEaIKoF
MD5:	9A60BDDA49C6D040C119F5A4BE15447A
SHA1:	D6DFFB90C07B48B4693820759A02A1BB1E5F0DCA
SHA-256:	53764C9EF0A33354B143953D4E48C8E888646CB075596534BF5A5B78C581910B
SHA-512:	40A2489C9DDC7B4F24B32CB019C84D38BF0F8B3EA49DD18181A79F2226FC6FE839CE7989792B74A711421FD25A92425131B763D8BEF78CED603F49978363B8C6
Malicious:	false
Preview:	0DAC368A9714EE43C27CA227472A929ED26621677B193AAFBD71902ACBBD62BA..{.. "AH": 65,.. "BASLR": 66,.. "Blocked": "0",.. "CALLER": 863,.. "DAH": 65,.. "DEPHDLR": 0,.. "DLL": 591,.. "DefaultProtectedAppsReset": true,.. "DefaultProtectedAppsReset2": true,.. "DefaultProtectedAppsReset3": true,.. "FILE": 65407,.. "JAVACMD": 1,.. "JAVACMD2": 0,.. "JAVACMD2DefaultReset": true,.. "JAVAIN": 1,.. "JAVAINTRANET": 0,.. "JAVAOUT": 0,.. "JAVASOCK": 1,.. "L0DEP": 587,.. "L1DEP": 591,.. "L3BLOCK_MALICIOUS_EMAILATTACHMENT": 1,.. "L3EMAIL_CLIENT_SCRIPTING_ABUSE": 2,.. "L3EXCEL_MACRO_4DOT0_ABUSE": 2,.. "L3OFFICE_LOADING_POINTS_ABUSE": 2,.. "L3OFFICE_SCRIPTING_ABUSE": 2,.. "L3OFFICE_SPAWNING_BATCH_COMMAND": 2,.. "L3OFFICE_VBE7_OBJECT_ABUSE": 2,.. "MACRO_DISABLE": 0,.. "MSGBOX": 0,.. "OFFICE_VBA7": 2,.. "OFFICE_WMI": 2,.. "PENTESTDefaultReset": true,.. "PENTEST_MODE": 0,.. "PIV": 863,.. "PROCESS": 65535,.. "ROPC32": 853,.. "ROPC64": 853,.

C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json.bak

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	68392
Entropy (8bit):	3.9217669336951695
Encrypted:	false
SSDEEP:	384:cr1PalGB5AWiWq2mhzJUVVqxKS3xV2CjNrBa7gHOykEajctcxPaF:iUAHiWqn1UVVqx9U7gYEaIKoF
MD5:	9A60BDDA49C6D040C119F5A4BE15447A
SHA1:	D6DFFB90C07B48B4693820759A02A1BB1E5F0DCA
SHA-256:	53764C9EF0A33354B143953D4E48C8E888646CB075596534BF5A5B78C581910B
SHA-512:	40A2489C9DDC7B4F24B32CB019C84D38BF0F8B3EA49DD18181A79F2226FC6FE839CE7989792B74A711421FD25A92425131B763D8BEF78CED603F49978363B8C6
Malicious:	false
Preview:	0DAC368A9714EE43C27CA227472A929ED26621677B193AAFBD71902ACBBD62BA..{.. "AH": 65,.. "BASLR": 66,.. "Blocked": "0",.. "CALLER": 863,.. "DAH": 65,.. "DEPHDLR": 0,.. "DLL": 591,.. "DefaultProtectedAppsReset": true,.. "DefaultProtectedAppsReset2": true,.. "DefaultProtectedAppsReset3": true,.. "FILE": 65407,.. "JAVACMD": 1,.. "JAVACMD2": 0,.. "JAVACMD2DefaultReset": true,.. "JAVAIN": 1,.. "JAVAINTRANET": 0,.. "JAVAOUT": 0,.. "JAVASOCK": 1,.. "L0DEP": 587,.. "L1DEP": 591,.. "L3BLOCK_MALICIOUS_EMAILATTACHMENT": 1,.. "L3EMAIL_CLIENT_SCRIPTING_ABUSE": 2,.. "L3EXCEL_MACRO_4DOT0_ABUSE": 2,.. "L3OFFICE_LOADING_POINTS_ABUSE": 2,.. "L3OFFICE_SCRIPTING_ABUSE": 2,.. "L3OFFICE_SPAWNING_BATCH_COMMAND": 2,.. "L3OFFICE_VBE7_OBJECT_ABUSE": 2,.. "MACRO_DISABLE": 0,.. "MSGBOX": 0,.. "OFFICE_VBA7": 2,.. "OFFICE_WMI": 2,.. "PENTESTDefaultReset": true,.. "PENTEST_MODE": 0,.. "PIV": 863,.. "PROCESS": 65535,.. "ROPC32": 853,.. "ROPC64": 853,.

C:\ProgramData\Malwarebytes\MBAMService\config\ArwControllerConfig.json

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	607
Entropy (8bit):	4.87825661570254
Encrypted:	false
SSDEEP:	12:cRFaij0nfXhHENZC8Slo2VEWz7dXpdS57dSJpdwn+XC7dwn+XMpduKR7ducpeuck:cRFj0XREHdSloqptqLcsjaf
MD5:	080000AF04D0CFFDF7FCBD2F903187A0
SHA1:	DA289A0251F22A24F1A3EAD775B9CAF33057503D
SHA-256:	79CF1C8D43A7FE4D7824DB8776FFC10A0BFF832A396A01E5359A87416F92B092
SHA-512:	947B22C637B22119A32FA0DC37677F55B38503710DE7F4EF0BCA24D3CD16158D5926FDFF4AD2EC0CC9E78AEDE89D1BBE16CC68E950A97A323FBDC963F1C89BF0
Malicious:	false
Preview:	A00C43FEC0CB15B54D966F501E308E3AB2A7166D95E4FCFFDF71F41CB85FBF13..{.. "autoClean": false,.. "channel": "release",.. "enforceSilentMode": false,.. "exclusions": [.... ],.. "moduleBalanceComboDisabled": false,.. "moduleBalanceComboIsBeta": false,.. "moduleEarlyClassifyDisabled": false,.. "moduleEarlyClassifyIsBeta": false,.. "moduleFolderRelatorDisabled": false,.. "moduleFolderRelatorIsBeta": false,.. "moduleKeeperDisabled": false,.. "moduleKeeperIsBeta": false,.. "protectionState": "enabled",.. "silent_mode": false,.. "totaldetectioncount": 0,.. "useStaging": false..}

C:\ProgramData\Malwarebytes\MBAMService\config\ArwControllerConfig.json.bak

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	607
Entropy (8bit):	4.87825661570254
Encrypted:	false
SSDEEP:	12:cRFaij0nfXhHENZC8Slo2VEWz7dXpdS57dSJpdwn+XC7dwn+XMpduKR7ducpeuck:cRFj0XREHdSloqptqLcsjaf
MD5:	080000AF04D0CFFDF7FCBD2F903187A0
SHA1:	DA289A0251F22A24F1A3EAD775B9CAF33057503D
SHA-256:	79CF1C8D43A7FE4D7824DB8776FFC10A0BFF832A396A01E5359A87416F92B092
SHA-512:	947B22C637B22119A32FA0DC37677F55B38503710DE7F4EF0BCA24D3CD16158D5926FDFF4AD2EC0CC9E78AEDE89D1BBE16CC68E950A97A323FBDC963F1C89BF0
Malicious:	false
Preview:	A00C43FEC0CB15B54D966F501E308E3AB2A7166D95E4FCFFDF71F41CB85FBF13..{.. "autoClean": false,.. "channel": "release",.. "enforceSilentMode": false,.. "exclusions": [.... ],.. "moduleBalanceComboDisabled": false,.. "moduleBalanceComboIsBeta": false,.. "moduleEarlyClassifyDisabled": false,.. "moduleEarlyClassifyIsBeta": false,.. "moduleFolderRelatorDisabled": false,.. "moduleFolderRelatorIsBeta": false,.. "moduleKeeperDisabled": false,.. "moduleKeeperIsBeta": false,.. "protectionState": "enabled",.. "silent_mode": false,.. "totaldetectioncount": 0,.. "useStaging": false..}

C:\ProgramData\Malwarebytes\MBAMService\config\CleanControllerConfig.json

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	846
Entropy (8bit):	4.909205684366062
Encrypted:	false
SSDEEP:	24:E4VE/u84u7zaDOtWKgzTDCvvCPuCnCJAZiA2:2/pv7+StWDz/CvvCWCnCJAip
MD5:	D7D3E28C3D93C2AE5EBBE2E37E8208BF
SHA1:	233A7B6655A9DD73386BB21A21B97217DE1AEB4D
SHA-256:	6292F946FBAA6F2CE59192DB6D4F14C33F87910F4E181C48BF495FBF6C0D6D74
SHA-512:	DC923BAF51366063C905505BF69227243A49ED9E3D1AC114826972C809DF7D086E7D41185F3959C925C094CBB2EA183DE6CE8EDEAE245B19347173BA41F283B2
Malicious:	false
Preview:	C948770C1B9DC50844E29AFF43332B6EDBC218F78A86CA4E7621A08AAB1258A8..{.. "allow_data_collection": true,.. "arw_hubble_timeout_ms": 5000,.. "auto_reboot_on_pending_action_dor": false,.. "auto_start_override_set": false,.. "delay_wl_startup_secs": 0,.. "disable_meps": false,.. "disable_mwac_hubble_query": false,.. "disable_rules_wl": false,.. "disable_signature_wl": false,.. "disable_system_protected_wl": false,.. "enable_extra_log": false,.. "enable_mass_unquarantine": true,.. "mass_unquarantine_progress": [.... ],.. "mass_unquarantine_scan_delay_secs": 600,.. "mass_unquarantine_start_delay_secs": 600,.. "mass_unquarantine_update_delay_secs": 30,.. "quarantine_pruning_age_hours": 0,.. "rtp_hubble_timeout_ms": 4000,.. "scan_hubble_timeout_ms": 6000,.. "schemaVersion": 4,.. "use_staging": false..}

C:\ProgramData\Malwarebytes\MBAMService\config\CleanControllerConfig.json.bak

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	846
Entropy (8bit):	4.909205684366062
Encrypted:	false
SSDEEP:	24:E4VE/u84u7zaDOtWKgzTDCvvCPuCnCJAZiA2:2/pv7+StWDz/CvvCWCnCJAip
MD5:	D7D3E28C3D93C2AE5EBBE2E37E8208BF
SHA1:	233A7B6655A9DD73386BB21A21B97217DE1AEB4D
SHA-256:	6292F946FBAA6F2CE59192DB6D4F14C33F87910F4E181C48BF495FBF6C0D6D74
SHA-512:	DC923BAF51366063C905505BF69227243A49ED9E3D1AC114826972C809DF7D086E7D41185F3959C925C094CBB2EA183DE6CE8EDEAE245B19347173BA41F283B2
Malicious:	false
Preview:	C948770C1B9DC50844E29AFF43332B6EDBC218F78A86CA4E7621A08AAB1258A8..{.. "allow_data_collection": true,.. "arw_hubble_timeout_ms": 5000,.. "auto_reboot_on_pending_action_dor": false,.. "auto_start_override_set": false,.. "delay_wl_startup_secs": 0,.. "disable_meps": false,.. "disable_mwac_hubble_query": false,.. "disable_rules_wl": false,.. "disable_signature_wl": false,.. "disable_system_protected_wl": false,.. "enable_extra_log": false,.. "enable_mass_unquarantine": true,.. "mass_unquarantine_progress": [.... ],.. "mass_unquarantine_scan_delay_secs": 600,.. "mass_unquarantine_start_delay_secs": 600,.. "mass_unquarantine_update_delay_secs": 30,.. "quarantine_pruning_age_hours": 0,.. "rtp_hubble_timeout_ms": 4000,.. "scan_hubble_timeout_ms": 6000,.. "schemaVersion": 4,.. "use_staging": false..}

C:\ProgramData\Malwarebytes\MBAMService\config\CloudConfig.json

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	825
Entropy (8bit):	4.892062503503783
Encrypted:	false
SSDEEP:	24:EY/TyEEp/u8Xdx6GQhZ873iVg3V/bpd+w:EYTEp/pXdxmyiOV/bpcw
MD5:	700B738A7816ACC73ABCFD1F0C3A8F0E
SHA1:	B550C0CBAAB21DF7EC61E01460B4F02565D66203
SHA-256:	F8B6FF796A97F24E6368B82547D07ACE679E013EBFF1E22F867706D359B957B3
SHA-512:	9328FB4733F9E97B76D3AA4389A9CC8A159FF1A7064AC3F04F135F5FDD2F14CB3F872560C43CB0BA60BA3A331D476F1B8B07624F98F60DB8B12258E1DC3AF82A
Malicious:	false
Preview:	9D5F5CC97ACD11E5A1B99B9BFD00E6B8662C0D438C3FCBA4C1CA42176478D7C0..{.. "ae_datafiles": [.... ],.. "allow_data_collection": true,.. "amsi_detections": [.... ],.. "arw_detections": [.... ],.. "btoc_counts_reset_interval": 86400,.. "btoc_ddsonly_detection_upload_limit": 8,.. "btoc_fn_upload_limit": 25,.. "btoc_fp_upload_limit": 15,.. "btoc_ignored_upload_limit": 4,.. "btoc_lp_upload_limit": 25,.. "btoc_naming_upload_limit": 8,.. "btoc_test_mode": false,.. "btoc_total_upload_limit": 60,.. "dop_detections": [.... ],.. "initial_delay_seconds": 120,.. "max_record_age_hours": 168,.. "mbae_detections": [.... ],.. "mwac_detections": [.... ],.. "retry_interval_seconds": 7200,.. "rootkit_detections": [.... ],.. "shuriken_detections": [.... ],.. "use_staging": false..}

C:\ProgramData\Malwarebytes\MBAMService\config\CloudConfig.json.bak

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	825
Entropy (8bit):	4.892062503503783
Encrypted:	false
SSDEEP:	24:EY/TyEEp/u8Xdx6GQhZ873iVg3V/bpd+w:EYTEp/pXdxmyiOV/bpcw
MD5:	700B738A7816ACC73ABCFD1F0C3A8F0E
SHA1:	B550C0CBAAB21DF7EC61E01460B4F02565D66203
SHA-256:	F8B6FF796A97F24E6368B82547D07ACE679E013EBFF1E22F867706D359B957B3
SHA-512:	9328FB4733F9E97B76D3AA4389A9CC8A159FF1A7064AC3F04F135F5FDD2F14CB3F872560C43CB0BA60BA3A331D476F1B8B07624F98F60DB8B12258E1DC3AF82A
Malicious:	false
Preview:	9D5F5CC97ACD11E5A1B99B9BFD00E6B8662C0D438C3FCBA4C1CA42176478D7C0..{.. "ae_datafiles": [.... ],.. "allow_data_collection": true,.. "amsi_detections": [.... ],.. "arw_detections": [.... ],.. "btoc_counts_reset_interval": 86400,.. "btoc_ddsonly_detection_upload_limit": 8,.. "btoc_fn_upload_limit": 25,.. "btoc_fp_upload_limit": 15,.. "btoc_ignored_upload_limit": 4,.. "btoc_lp_upload_limit": 25,.. "btoc_naming_upload_limit": 8,.. "btoc_test_mode": false,.. "btoc_total_upload_limit": 60,.. "dop_detections": [.... ],.. "initial_delay_seconds": 120,.. "max_record_age_hours": 168,.. "mbae_detections": [.... ],.. "mwac_detections": [.... ],.. "retry_interval_seconds": 7200,.. "rootkit_detections": [.... ],.. "shuriken_detections": [.... ],.. "use_staging": false..}

C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
File Type:	ASCII text, with very long lines (645), with CRLF line terminators
Category:	dropped
Size (bytes):	11786
Entropy (8bit):	4.558124851898332
Encrypted:	false
SSDEEP:	192:ixmf/FYgVMzhrgHTb0MAJUKfVgH8BZ8ZEms:MmlYgVMzhrgHTb0MAJUKfVgH8BZ8ZEms
MD5:	ED85073C56FF57ECBFE1C7B5E30BCBBC
SHA1:	1D25F082188FBF21B40EE45AE3335BAEEC47D9AE
SHA-256:	6E89A5F1106FA12A6F57FF71816975E0296EAC2D46029439D2C36707266FD37C
SHA-512:	4267F2AC656A8F00878EEF5ED62A0A2F39E0EF25F9A22C9DE4191963C0D6F5593387507C4D18112485A7957008C96BB9B1E20A6FFA954308A1CC111D41011672
Malicious:	false
Preview:	E9B66A2E9EB651AFB7AA733873FFB285DD1B2207E8E0755A5322CEA8EC933ECF..{.. "acctOwnerFirstName": "",.. "acctOwnerLastName": "",.. "acctOwnerMaskedEmail": "",.. "backendAPI": "V2",.. "browserExtensionTrialGiven": true,.. "checkBeforeActivate": false,.. "checkIntervalSeconds": 86400,.. "computerName": "124406",.. "entitlementAutoRenew": "",.. "entitlementEndDate": "",.. "entitlementEnhancedAutoRenew": "",.. "entitlementFeatures": "",.. "entitlementKey": "",.. "entitlementProductsCode": "",.. "entitlementProductsCustomerType": "",.. "entitlementProductsName": "",.. "entitlementReferralKey": "",.. "entitlementStartDate": "",.. "entitlementStatus": "",.. "entitlementSubscriptionId": "",.. "entitlementSubscriptionSecret": "",.. "entitlementTermLength": 0,.. "entitlementTermType": "",.. "entitlementVolumePurchased": 0,.. "entitlementVolumeUsed": 0,.. "expirationDate": "",.. "expirationNotificationID": "ad4d9c69-eee9-43f4-b59c-de23a687b10c",..

C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json.bak

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
File Type:	ASCII text, with very long lines (645), with CRLF line terminators
Category:	dropped
Size (bytes):	11786
Entropy (8bit):	4.558124851898332
Encrypted:	false
SSDEEP:	192:ixmf/FYgVMzhrgHTb0MAJUKfVgH8BZ8ZEms:MmlYgVMzhrgHTb0MAJUKfVgH8BZ8ZEms
MD5:	ED85073C56FF57ECBFE1C7B5E30BCBBC
SHA1:	1D25F082188FBF21B40EE45AE3335BAEEC47D9AE
SHA-256:	6E89A5F1106FA12A6F57FF71816975E0296EAC2D46029439D2C36707266FD37C
SHA-512:	4267F2AC656A8F00878EEF5ED62A0A2F39E0EF25F9A22C9DE4191963C0D6F5593387507C4D18112485A7957008C96BB9B1E20A6FFA954308A1CC111D41011672
Malicious:	false
Preview:	E9B66A2E9EB651AFB7AA733873FFB285DD1B2207E8E0755A5322CEA8EC933ECF..{.. "acctOwnerFirstName": "",.. "acctOwnerLastName": "",.. "acctOwnerMaskedEmail": "",.. "backendAPI": "V2",.. "browserExtensionTrialGiven": true,.. "checkBeforeActivate": false,.. "checkIntervalSeconds": 86400,.. "computerName": "124406",.. "entitlementAutoRenew": "",.. "entitlementEndDate": "",.. "entitlementEnhancedAutoRenew": "",.. "entitlementFeatures": "",.. "entitlementKey": "",.. "entitlementProductsCode": "",.. "entitlementProductsCustomerType": "",.. "entitlementProductsName": "",.. "entitlementReferralKey": "",.. "entitlementStartDate": "",.. "entitlementStatus": "",.. "entitlementSubscriptionId": "",.. "entitlementSubscriptionSecret": "",.. "entitlementTermLength": 0,.. "entitlementTermType": "",.. "entitlementVolumePurchased": 0,.. "entitlementVolumeUsed": 0,.. "expirationDate": "",.. "expirationNotificationID": "ad4d9c69-eee9-43f4-b59c-de23a687b10c",..

C:\ProgramData\Malwarebytes\MBAMService\config\MwacControllerConfig.json

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2423
Entropy (8bit):	4.330799344484782
Encrypted:	false
SSDEEP:	48:I0iSFC/nFPihFrOypRfkEZGCNG7CdICYcNf:niS6nYPKKnZGCuCSCd
MD5:	5233400A6F57B44EFF70F470A0461D28
SHA1:	2F0DA9682D77A49E41638C3301D01FA86DD75591
SHA-256:	2082ED5A1410B4CDB76D4C2C50B4DF4D4323F1BF8381F0C62E1D7F8BFF9B2181
SHA-512:	8CDB0D977121E8E22EB9559DB26DED539819FCFB32D35918A86449953EBA2ADA65F14904E817093D63B625E7EC91B988818B54FC32B7F6253B3B95732572D231
Malicious:	false
Preview:	2CAF58DEBB4948F6C905320D9A42E172EE50FCA1EDDB06932AAD0FC50A89921B..{.. "allowlists": [.. {.. "handle": 0,.. "listname": "ipallowlist",.. "state": "Active",.. "type": "IP".. },.. {.. "handle": 0,.. "listname": "domainallowlist",.. "state": "Active",.. "type": "Domain".. },.. {.. "handle": 0,.. "listname": "processallowlist",.. "state": "Active",.. "type": "ProcessPath".. }.. ],.. "autoClean": true,.. "bfpEnabledForBeta": false,.. "bfpSettings": {.. "blockFrequency": {.. "attemptDuration": 300,.. "attempts": 5,.. "blockDuration": 300.. },.. "enabled": false,.. "protocols": [.. {.. "defaultPort": 3389,.. "enabled": false,.. "port": 3389,.. "type": "RDP".. }.. ],.. "skipLocalTraffic": true.. },.. "bgCloudTimeout": 2000,.. "blocklists": [..

C:\ProgramData\Malwarebytes\MBAMService\config\MwacControllerConfig.json.bak

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2423
Entropy (8bit):	4.330799344484782
Encrypted:	false
SSDEEP:	48:I0iSFC/nFPihFrOypRfkEZGCNG7CdICYcNf:niS6nYPKKnZGCuCSCd
MD5:	5233400A6F57B44EFF70F470A0461D28
SHA1:	2F0DA9682D77A49E41638C3301D01FA86DD75591
SHA-256:	2082ED5A1410B4CDB76D4C2C50B4DF4D4323F1BF8381F0C62E1D7F8BFF9B2181
SHA-512:	8CDB0D977121E8E22EB9559DB26DED539819FCFB32D35918A86449953EBA2ADA65F14904E817093D63B625E7EC91B988818B54FC32B7F6253B3B95732572D231
Malicious:	false
Preview:	2CAF58DEBB4948F6C905320D9A42E172EE50FCA1EDDB06932AAD0FC50A89921B..{.. "allowlists": [.. {.. "handle": 0,.. "listname": "ipallowlist",.. "state": "Active",.. "type": "IP".. },.. {.. "handle": 0,.. "listname": "domainallowlist",.. "state": "Active",.. "type": "Domain".. },.. {.. "handle": 0,.. "listname": "processallowlist",.. "state": "Active",.. "type": "ProcessPath".. }.. ],.. "autoClean": true,.. "bfpEnabledForBeta": false,.. "bfpSettings": {.. "blockFrequency": {.. "attemptDuration": 300,.. "attempts": 5,.. "blockDuration": 300.. },.. "enabled": false,.. "protocols": [.. {.. "defaultPort": 3389,.. "enabled": false,.. "port": 3389,.. "type": "RDP".. }.. ],.. "skipLocalTraffic": true.. },.. "bgCloudTimeout": 2000,.. "blocklists": [..

C:\ProgramData\Malwarebytes\MBAMService\config\PoliciesConfig.json

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	814
Entropy (8bit):	5.072020070507454
Encrypted:	false
SSDEEP:	24:/CWkKx+cKTNkhI5+9+7hfHd+RIfbIRjoM8F7eXcIrvp:/CjKxZKR2s+9+7hfHd+0rQp
MD5:	68B22FE429ACD0D11A4B8B6F9CF6BD54
SHA1:	652BD3B2A9E27471D5106417EC1FACA43C81690C
SHA-256:	2E17EB0EA185EECDF01114A7009EDA5732E1A6941578D2B0FEB0C3689E911F84
SHA-512:	2C3F58024A59C676036268E82994BCDD9B528DFF8EA3F1C1C7B937295458564C2A6E2F6A64A65840AB4FD753A934CE63B5AD13B81638651BF1CE31FD7A756CD7
Malicious:	false
Preview:	43065C38AD76C8D2259A8B0FC14C96FC3FF8218E78C32C70063526BF4CA081C4..{.. "AutoStartService": true,.. "AutoStartServiceOverride": false,.. "CloseNotifyTimeout": 5000,.. "DisplayLanguage": "en-US",.. "EnableContextMenu": true,.. "ExportEventLogData": false,.. "NotifyWhenFullUpdatesAvailable": false,.. "Password": "",.. "ProtectedAreas": 0,.. "ProxyNeedAuth": false,.. "ProxyPassword": "",.. "ProxyPort": 0,.. "ProxyServer": "",.. "ProxyUserName": "",.. "RebootVisibility": false,.. "RestrictAccess": false,.. "ShowRealTimeNotification": true,.. "ShowSystemTrayNotification": true,.. "TamperProtection": false,.. "TrayIconVisibility": true,.. "UseAlternateURLs": false,.. "UseProxyServer": false,.. "UserInterfaceVisibility": false,.. "WarnWhenDefsAreOutOfDate": true..}

C:\ProgramData\Malwarebytes\MBAMService\config\PoliciesConfig.json.bak

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	814
Entropy (8bit):	5.072020070507454
Encrypted:	false
SSDEEP:	24:/CWkKx+cKTNkhI5+9+7hfHd+RIfbIRjoM8F7eXcIrvp:/CjKxZKR2s+9+7hfHd+0rQp
MD5:	68B22FE429ACD0D11A4B8B6F9CF6BD54
SHA1:	652BD3B2A9E27471D5106417EC1FACA43C81690C
SHA-256:	2E17EB0EA185EECDF01114A7009EDA5732E1A6941578D2B0FEB0C3689E911F84
SHA-512:	2C3F58024A59C676036268E82994BCDD9B528DFF8EA3F1C1C7B937295458564C2A6E2F6A64A65840AB4FD753A934CE63B5AD13B81638651BF1CE31FD7A756CD7
Malicious:	false
Preview:	43065C38AD76C8D2259A8B0FC14C96FC3FF8218E78C32C70063526BF4CA081C4..{.. "AutoStartService": true,.. "AutoStartServiceOverride": false,.. "CloseNotifyTimeout": 5000,.. "DisplayLanguage": "en-US",.. "EnableContextMenu": true,.. "ExportEventLogData": false,.. "NotifyWhenFullUpdatesAvailable": false,.. "Password": "",.. "ProtectedAreas": 0,.. "ProxyNeedAuth": false,.. "ProxyPassword": "",.. "ProxyPort": 0,.. "ProxyServer": "",.. "ProxyUserName": "",.. "RebootVisibility": false,.. "RestrictAccess": false,.. "ShowRealTimeNotification": true,.. "ShowSystemTrayNotification": true,.. "TamperProtection": false,.. "TrayIconVisibility": true,.. "UseAlternateURLs": false,.. "UseProxyServer": false,.. "UserInterfaceVisibility": false,.. "WarnWhenDefsAreOutOfDate": true..}

C:\ProgramData\Malwarebytes\MBAMService\config\RtpConfig.json

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1382
Entropy (8bit):	4.962625571550982
Encrypted:	false
SSDEEP:	24:uEE58XpoNGmWWTU0WdIhQTAlT4xWWmt1fp5ufQKNImYIQT3TxB0eSY17REMLrIaH:LEiONmv0wwQVtSB5uX7oNVHn
MD5:	AC85E99229A2C0B4EA12C4FA404160D6
SHA1:	00C0C9017D95FCE1F2DC91E0B2EA335AC9FE0D42
SHA-256:	74D4C5B9583823EBB3AFCA4D449794401F13F97288FE2FDE00E266C5E3E9E09D
SHA-512:	68235BFB5E611F753B46370EA874AB1C3F4E15DF3AD6FF8D659A05B07387FD74F4075BE6B484E32C5C56A273AD29B6A8F6AC800BC8B8B02732E6C3C8D6EF71D5
Malicious:	false
Preview:	9921509DB8FFAA5B59354C3D47080944FFD0E923F04BF6804AB60FB7CF0E899C..{.. "aggressiveThreats": false,.. "autoClean": true,.. "autoGameModeSwitching": true,.. "cacheTime": 0,.. "disableDDSBetterNameScan": false,.. "disableIG": false,.. "earlyBlockMode": false,.. "enableAME": true,.. "enableAMSIKillSwitch": true,.. "enableAMSISetting": true,.. "enableAMSISilentKillSwitch": true,.. "enableArchiveExtraction": true,.. "enableDDSIG": true,.. "enableDDSIGAggressiveMode": false,.. "enableDoppelgangingDetection": true,.. "enableLAS": true,.. "enableLargePEKillSwitch": true,.. "enableLargePESetting": true,.. "enableNetworkShareDetection": false,.. "enableRTPFeatureScriptScanningKillSwitch": false,.. "enableRTPFeatureScriptScanningSetting": true,.. "enableScriptScanning": false,.. "enableShuriken": true,.. "enableSilentBlock": true,.. "enabledArchiveExtractionOnce": true,.. "enabledDoppelgangingDetectionOnce": true,.. "enhanceShurikenAnomalyDetect

C:\ProgramData\Malwarebytes\MBAMService\config\RtpConfig.json.bak

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1382
Entropy (8bit):	4.962625571550982
Encrypted:	false
SSDEEP:	24:uEE58XpoNGmWWTU0WdIhQTAlT4xWWmt1fp5ufQKNImYIQT3TxB0eSY17REMLrIaH:LEiONmv0wwQVtSB5uX7oNVHn
MD5:	AC85E99229A2C0B4EA12C4FA404160D6
SHA1:	00C0C9017D95FCE1F2DC91E0B2EA335AC9FE0D42
SHA-256:	74D4C5B9583823EBB3AFCA4D449794401F13F97288FE2FDE00E266C5E3E9E09D
SHA-512:	68235BFB5E611F753B46370EA874AB1C3F4E15DF3AD6FF8D659A05B07387FD74F4075BE6B484E32C5C56A273AD29B6A8F6AC800BC8B8B02732E6C3C8D6EF71D5
Malicious:	false
Preview:	9921509DB8FFAA5B59354C3D47080944FFD0E923F04BF6804AB60FB7CF0E899C..{.. "aggressiveThreats": false,.. "autoClean": true,.. "autoGameModeSwitching": true,.. "cacheTime": 0,.. "disableDDSBetterNameScan": false,.. "disableIG": false,.. "earlyBlockMode": false,.. "enableAME": true,.. "enableAMSIKillSwitch": true,.. "enableAMSISetting": true,.. "enableAMSISilentKillSwitch": true,.. "enableArchiveExtraction": true,.. "enableDDSIG": true,.. "enableDDSIGAggressiveMode": false,.. "enableDoppelgangingDetection": true,.. "enableLAS": true,.. "enableLargePEKillSwitch": true,.. "enableLargePESetting": true,.. "enableNetworkShareDetection": false,.. "enableRTPFeatureScriptScanningKillSwitch": false,.. "enableRTPFeatureScriptScanningSetting": true,.. "enableScriptScanning": false,.. "enableShuriken": true,.. "enableSilentBlock": true,.. "enabledArchiveExtractionOnce": true,.. "enabledDoppelgangingDetectionOnce": true,.. "enhanceShurikenAnomalyDetect

C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4943
Entropy (8bit):	4.445883796311846
Encrypted:	false
SSDEEP:	48:GRtPVSfKuGQf9uEswkV8EkmduwxVTmqXKeWQX9OMEmAf3wsaA:0AfK5k9BhkfkYfV3XKBs9pjAf3wsaA
MD5:	02E67948498BE09FD258A720F6B1A07B
SHA1:	51B66C33361E069CEB0A01A31D902CA5D6FE5D00
SHA-256:	8553AC78B916AFA8DB2BDAF3B72ACEF241224B89B8DD707B4CB84274DB2EBC95
SHA-512:	CF8D8872C7FE98B21D8DF2951A30A695572ABD53CDD25E1D8661814DB14C5FA30BE9044444113F0D6CC6FEE2A23E343D77DF7B1E5078903F587ACBE1936DF9DC
Malicious:	false
Preview:	D16478153F3BEEEB61061119338501231F9E09705E6E4C6729213C80CE8D146C..{.. "defaultScheduledScanSet": false,.. "defaultSmartScanConversion": false,.. "enableLAS": true,.. "enableLargePEKillSwitch": true,.. "enableLargePESetting": true,.. "estimatedFileSystemObjects": 0,.. "estimatedRegistryObjects": 0,.. "estimatedRootkitScanObjects": 0,.. "forceDDSLicenseEntitlement": false,.. "globalScanParams": {.. "aggressiveThreats": false,.. "allowNetworkPaths": false,.. "autoClean": false,.. "autoRestart": false,.. "checkForUpdates": true,.. "customPathPatterns": [.... ],.. "disableAggressiveModeTrigger": false,.. "disableDDSBetterNameScan": false,.. "disableIG": false,.. "disableLinking": false,.. "disableScanCompleteNotificationOnNoThreats": false,.. "disableWLCheck": false,.. "enableAME": true,.. "enableAMETestingMode": false,.. "enableDDSGoodwareClassifications": true,.. "enableDDSIG": true,..

C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json.bak

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4943
Entropy (8bit):	4.445883796311846
Encrypted:	false
SSDEEP:	48:GRtPVSfKuGQf9uEswkV8EkmduwxVTmqXKeWQX9OMEmAf3wsaA:0AfK5k9BhkfkYfV3XKBs9pjAf3wsaA
MD5:	02E67948498BE09FD258A720F6B1A07B
SHA1:	51B66C33361E069CEB0A01A31D902CA5D6FE5D00
SHA-256:	8553AC78B916AFA8DB2BDAF3B72ACEF241224B89B8DD707B4CB84274DB2EBC95
SHA-512:	CF8D8872C7FE98B21D8DF2951A30A695572ABD53CDD25E1D8661814DB14C5FA30BE9044444113F0D6CC6FEE2A23E343D77DF7B1E5078903F587ACBE1936DF9DC
Malicious:	false
Preview:	D16478153F3BEEEB61061119338501231F9E09705E6E4C6729213C80CE8D146C..{.. "defaultScheduledScanSet": false,.. "defaultSmartScanConversion": false,.. "enableLAS": true,.. "enableLargePEKillSwitch": true,.. "enableLargePESetting": true,.. "estimatedFileSystemObjects": 0,.. "estimatedRegistryObjects": 0,.. "estimatedRootkitScanObjects": 0,.. "forceDDSLicenseEntitlement": false,.. "globalScanParams": {.. "aggressiveThreats": false,.. "allowNetworkPaths": false,.. "autoClean": false,.. "autoRestart": false,.. "checkForUpdates": true,.. "customPathPatterns": [.... ],.. "disableAggressiveModeTrigger": false,.. "disableDDSBetterNameScan": false,.. "disableIG": false,.. "disableLinking": false,.. "disableScanCompleteNotificationOnNoThreats": false,.. "disableWLCheck": false,.. "enableAME": true,.. "enableAMETestingMode": false,.. "enableDDSGoodwareClassifications": true,.. "enableDDSIG": true,..

C:\ProgramData\Malwarebytes\MBAMService\config\SpConfigFile.json

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	11736
Entropy (8bit):	4.918923076464792
Encrypted:	false
SSDEEP:	192:C8+xwb8fkY/sDpS8t7SSdUCExUYS9oFfJ7MLPi5LnDjufzqoA+8xRj81offZJZQE:C8+xwb8fkY/sDY8t7SSdUCExUYS9oFft
MD5:	5A354562DC7385FCDF35D23448E4213A
SHA1:	697453D00199AF2B1A749E22521FDCE92A217B39
SHA-256:	F86FFCC27CE9FBBCD35957CB713D39193C1E22B2358200C82513B0917518395A
SHA-512:	5528462AE904DB4A8F198E0F30738A1595931914A6E9E95A0E75080662E83AAFE8AA79A51487BC59235BB30CD435AC601F0699B9751745C011382CD5C276543E
Malicious:	false
Preview:	FF086B164536790C600F7373CFBF80C78326B66CB117A6F94B76E4A865CBF3E9..{.. "driverState": true,.. "installed": false,.. "mountBlockStatus": false,.. "protectedItems": [.. {.. "path": "\\REGISTRY\\MACHINE\\SOFTWARE\\CLASSES\\CLSID\\{03141A2A-5C3A-458E-ABEC-0812AD7FF497}\\",.. "type": "regkey".. },.. {.. "path": "\\REGISTRY\\MACHINE\\SOFTWARE\\CLASSES\\CLSID\\{11D1E5E8-14E1-4B5B-AE1A-2678CB91E8E5}\\",.. "type": "regkey".. },.. {.. "path": "\\REGISTRY\\MACHINE\\SOFTWARE\\CLASSES\\CLSID\\{130CD414-6BFD-4F6C-9362-A2264B222E76}\\",.. "type": "regkey".. },.. {.. "path": "\\REGISTRY\\MACHINE\\SOFTWARE\\CLASSES\\CLSID\\{17BE78EE-B40A-4B9E-835F-38EC62F9D479}\\",.. "type": "regkey".. },.. {.. "path": "\\REGISTRY\\MACHINE\\SOFTWARE\\CLASSES\\CLSID\\{251AD013-20AD-4C3F-8FE2-F66A429B4819}\\",.. "type": "regkey".. },.. {.. "path": "\\REGISTRY\\MACHINE\\SOFT

C:\ProgramData\Malwarebytes\MBAMService\config\SpConfigFile.json.bak

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	11736
Entropy (8bit):	4.918923076464792
Encrypted:	false
SSDEEP:	192:C8+xwb8fkY/sDpS8t7SSdUCExUYS9oFfJ7MLPi5LnDjufzqoA+8xRj81offZJZQE:C8+xwb8fkY/sDY8t7SSdUCExUYS9oFft
MD5:	5A354562DC7385FCDF35D23448E4213A
SHA1:	697453D00199AF2B1A749E22521FDCE92A217B39
SHA-256:	F86FFCC27CE9FBBCD35957CB713D39193C1E22B2358200C82513B0917518395A
SHA-512:	5528462AE904DB4A8F198E0F30738A1595931914A6E9E95A0E75080662E83AAFE8AA79A51487BC59235BB30CD435AC601F0699B9751745C011382CD5C276543E
Malicious:	false
Preview:	FF086B164536790C600F7373CFBF80C78326B66CB117A6F94B76E4A865CBF3E9..{.. "driverState": true,.. "installed": false,.. "mountBlockStatus": false,.. "protectedItems": [.. {.. "path": "\\REGISTRY\\MACHINE\\SOFTWARE\\CLASSES\\CLSID\\{03141A2A-5C3A-458E-ABEC-0812AD7FF497}\\",.. "type": "regkey".. },.. {.. "path": "\\REGISTRY\\MACHINE\\SOFTWARE\\CLASSES\\CLSID\\{11D1E5E8-14E1-4B5B-AE1A-2678CB91E8E5}\\",.. "type": "regkey".. },.. {.. "path": "\\REGISTRY\\MACHINE\\SOFTWARE\\CLASSES\\CLSID\\{130CD414-6BFD-4F6C-9362-A2264B222E76}\\",.. "type": "regkey".. },.. {.. "path": "\\REGISTRY\\MACHINE\\SOFTWARE\\CLASSES\\CLSID\\{17BE78EE-B40A-4B9E-835F-38EC62F9D479}\\",.. "type": "regkey".. },.. {.. "path": "\\REGISTRY\\MACHINE\\SOFTWARE\\CLASSES\\CLSID\\{251AD013-20AD-4C3F-8FE2-F66A429B4819}\\",.. "type": "regkey".. },.. {.. "path": "\\REGISTRY\\MACHINE\\SOFT

C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1461
Entropy (8bit):	4.755969584471309
Encrypted:	false
SSDEEP:	24:8XjVE/u8RO0s02AAP0phBy/m/vNx1PN1PXbrHZzo5cvi7kAp0qBVB+iO9RdA3F9/:sju/ph92QDB5lDPn5yA9ejBp5
MD5:	3B794912BA58194003A94F9ED3C515CC
SHA1:	41CE3CE7F5A3F7CB8178FB2CEB639A6B911F8BE1
SHA-256:	68C8F29125D62DC43B14CE08789C84F8DA88206EAFA035C79EB67E47773C864B
SHA-512:	D162D765D7277A0F1620786FB2747C77382C06FED3BE189531AA2ED8AA2011D30FFF5A67E72EDA0970C6E1DDD99AC0723D932E44BBAD54B248F056B517866163
Malicious:	false
Preview:	CA47255DB9E5ADA975F65F545834F17C55AB1323FDAFC14E689F6ABA9093A786..{.. "allow_data_collection": true,.. "ark_enabled": false,.. "arw_enabled": false,.. "arw_stream_uuid": "",.. "bsod_count": 0,.. "client_stream_delay": 0,.. "client_stream_uuid": "43271e83fc8a11ee9b71ecf4bbea1588",.. "crash_count": 0,.. "delay_interval": 0,.. "ea_installed": false,.. "exploit_stream_uuid": "",.. "installation_uuid": "",.. "last_bsod_ts": "",.. "license_stream_uuid": "",.. "mbae_enabled": false,.. "mwac_enabled": false,.. "mwac_stream_uuid": "",.. "nebula_account_id": "",.. "nebula_ea_plugin_version": "",.. "nebula_ea_version": "",.. "nebula_group_id": "",.. "nebula_jwt": "",.. "nebula_machine_id": "",.. "nebula_machine_name": "",.. "nebula_origin": "",.. "nebula_policy_etag": "",.. "nebula_policy_id": "",.. "pum_setting": 2,.. "pup_setting": 2,.. "recent_crash_count": 0,.. "rtp_enabled": false,.. "scan_archives": true,.. "send_applog_telem

C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json.bak

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1461
Entropy (8bit):	4.755969584471309
Encrypted:	false
SSDEEP:	24:8XjVE/u8RO0s02AAP0phBy/m/vNx1PN1PXbrHZzo5cvi7kAp0qBVB+iO9RdA3F9/:sju/ph92QDB5lDPn5yA9ejBp5
MD5:	3B794912BA58194003A94F9ED3C515CC
SHA1:	41CE3CE7F5A3F7CB8178FB2CEB639A6B911F8BE1
SHA-256:	68C8F29125D62DC43B14CE08789C84F8DA88206EAFA035C79EB67E47773C864B
SHA-512:	D162D765D7277A0F1620786FB2747C77382C06FED3BE189531AA2ED8AA2011D30FFF5A67E72EDA0970C6E1DDD99AC0723D932E44BBAD54B248F056B517866163
Malicious:	false
Preview:	CA47255DB9E5ADA975F65F545834F17C55AB1323FDAFC14E689F6ABA9093A786..{.. "allow_data_collection": true,.. "ark_enabled": false,.. "arw_enabled": false,.. "arw_stream_uuid": "",.. "bsod_count": 0,.. "client_stream_delay": 0,.. "client_stream_uuid": "43271e83fc8a11ee9b71ecf4bbea1588",.. "crash_count": 0,.. "delay_interval": 0,.. "ea_installed": false,.. "exploit_stream_uuid": "",.. "installation_uuid": "",.. "last_bsod_ts": "",.. "license_stream_uuid": "",.. "mbae_enabled": false,.. "mwac_enabled": false,.. "mwac_stream_uuid": "",.. "nebula_account_id": "",.. "nebula_ea_plugin_version": "",.. "nebula_ea_version": "",.. "nebula_group_id": "",.. "nebula_jwt": "",.. "nebula_machine_id": "",.. "nebula_machine_name": "",.. "nebula_origin": "",.. "nebula_policy_etag": "",.. "nebula_policy_id": "",.. "pum_setting": 2,.. "pup_setting": 2,.. "recent_crash_count": 0,.. "rtp_enabled": false,.. "scan_archives": true,.. "send_applog_telem

C:\ProgramData\Malwarebytes\MBAMService\config\UI_ApplicationSettings.json

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	600
Entropy (8bit):	5.1924963631898216
Encrypted:	false
SSDEEP:	12:ZUWKATOGDauZ7v/wxE7G19lUGXJRqHiTNRyXyw:ZUWXvDauZzA17V3vNIX
MD5:	89F7179605DD3DE415D20222CDB07777
SHA1:	5C7BA16857F9DB76098B47700BA7872AC738DB0E
SHA-256:	3D5B39DFDC3117CE507D1C1C52D97ACB7811BD9385EEEB0066EC2AA48CB655FB
SHA-512:	9A7C989CADEF76F166E1A9650C928A5BEC2C66F6DC97C9E2403B14F590BBE42CB0CA62CCE94C16E0C72A8D63878D9C2A93D2D5CAE45E8798B1186837F319E13B
Malicious:	false
Preview:	1BC10212378661ADB7079166087D3F5E40D5EC5490740241E241BB57273B5C80..[..{.. "SettingId": 0,.. "CountOnboardingSeen": 0,.. "ActivationDateTime": "",.. "DeactivationDateTime": "",.. "LicenseStateChangeDateTime": "0001-01-01T00:00:00",.. "EmailCollected": false,.. "LastExecutedOnVersion": "5.1.2.109",.. "Theme": "System",.. "ClassicDashboard": false,.. "TrialExpirationDialogLastShown": "0001-01-01T00:00:00",.. "SubscriptionExpirationDialogLastShown": "0001-01-01T00:00:00",.. "HighScore": 0,.. "ShowWelcomeToMb5Dialog": true,.. "StartupLicenseCheck": false,.. "WidenStrings": false..}..]

C:\ProgramData\Malwarebytes\MBAMService\config\UI_DCountInfo.json

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	157
Entropy (8bit):	5.100825629541593
Encrypted:	false
SSDEEP:	3:gdi71kgpLQWRCYJxRVlOvOHn3M1zGqTA969viWvQARito6/Rx4Logn:gkL2+xR8OH3yzGo9gcQxZx4nn
MD5:	55B723C19BDB1DDF59265ACF994BA903
SHA1:	B9AF59478996D476AC114C02E996C87262474787
SHA-256:	30F18443D8167D9FCF5D0831374DE3FC07889FFB05258BCEF3441A541ADE43F4
SHA-512:	0E457DCD3CBBD3A7317E842504EA7102B454DBE394A1FEC233A10D4B3C79DF23FBC5DBEF381256C6A245FCECC62543C12BB0C97897B2DC8DA7A159C31086FE0A
Malicious:	false
Preview:	7D602FFD14D64025EAE81618491DA474A593419A86CF592F8B40C70B9159EFD8..[..{.. "SettingId": 5,.. "TeOverride": -1,.. "LastCountDate": "",.. "DCounts": []..}..]

C:\ProgramData\Malwarebytes\MBAMService\config\UI_IrisSettings.json

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
File Type:	ASCII text, with very long lines (64846), with CRLF line terminators
Category:	modified
Size (bytes):	149869
Entropy (8bit):	5.594716394447801
Encrypted:	false
SSDEEP:	1536:AONG/aE+tKPPAR11H1Kc5FYC+fPZ2IlgNj+D7ROuJQ5LfEuYidM3D:U/05W2IqNg7keQ5LfRI
MD5:	A6A13A10D5BBD6B13B54A90A50126239
SHA1:	CE76949524469C536073F93B8906CAAE40654556
SHA-256:	3BB1FEA0B15E6E001E84243EC3A8E23FA646BC39551FECAD82748742A5FE78FC
SHA-512:	D093FBCB69D02BE8E46AC6C790C8F1EAF6EEF5235D449549965C55AC81E1DC5FDA0FAB268BC00696766D222E4A921E10AE5B90329D9DC240DBF1019FC53360AD
Malicious:	false
Preview:	857DB9B128F3428393CB4BF67AC23F9ECC29ACFA55E9899CC0F7FAEAE712F1CD..[..{.. "SettingId": 3,.. "Server": "",.. "ControlPath": "",.. "NextEndpointCheck": "2024-04-17T10:00:23.7124382Z",.. "LastNotificationShown": "0001-01-01T00:00:00",.. "LastDropOffReportSent": "2024-04-17T09:09:17.6811887Z",.. "ToasterDisplayCooldownSeconds": 86400,.. "DropoffTelemetryCooldownSeconds": 86400,.. "InitialToasterDisplaySeconds": 900,.. "Testing": false,.. "DebugControlStatementChainPath": "",.. "InterpreterLogging": false,.. "UseCachedControlStatementChains": false,.. "DisableMessages": false,.. "CachedControlStatementChains": {.. "https://iris.mwbsys.com/api/v1/control_statements": {.. "ControlStatementChain": "eyJhc3NldHMiOnsiY29udHJvbF9zdGF0ZW1lbnRzIjogeyI2OTM2Ijp7ImlkIjo2OTM2LCJldmFsdWF0b3IiOiJjbGllbnQiLCJldmFsdWF0aW9uX21vZGUiOiJjb250aW51b3VzIiwibXV0dWFsX2V4Y2x1c2lvbnMiOltdLCJ0YWdzIjpbImQxMl90cmlhbF9tYjUiLCJhdWRpZW5jZV8xc3RfY3MiLCJ3aW5fbWI1Il0sImNvbmRpdGlvbmFscyI6W3sicmVmX2lkIjoiMS

C:\ProgramData\Malwarebytes\MBAMService\config\UI_NotificationsSettings.json

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	161
Entropy (8bit):	5.243974043668064
Encrypted:	false
SSDEEP:	3:EdhxQytVXgRjTmS9kZQ3hRphhkfxW3Hn3M1VE241TW/moXRMLC/HaW/DCvFg:EjxUM2/h5hUoH3yH41UqE9/DF
MD5:	4DE76AFF2F9A685835477DD404B14725
SHA1:	B257BCB3B3EC83B0B05CBC0E55AD21FD6B836D3C
SHA-256:	056F3816581B52B9C7533A67D50C6920132E5A47ECB9D94F886582CA8D1C4567
SHA-512:	4DB997C7C59381B13FE1C793E9BE8662D7F5F605FAF37C7DFF1C66EACC3717BB27B50815C6537CE201892A53C39974A184A34EF2E41882BDF519FC38AE8C0ED8
Malicious:	false
Preview:	188D1A669450D32CB02E4FCACE82479174404A605B741D9EF0DDA6630A6EBC1E..[..{.. "SettingId": 4,.. "StartupDelayMinutes": null,.. "MarketingNotifications": true..}..]

C:\ProgramData\Malwarebytes\MBAMService\config\UI_ScanSettings.json

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.409629407810503
Encrypted:	false
SSDEEP:	6:4FGNgROCH3yq+3/+4XTg/0YsQdJ6y0ci+FD+wfCf1reWrpPn9owWDK/ToNgn:4FGNgwnqU/9MJd0GFfc1Dh9sW/Tcg
MD5:	79289ED338C2BD5B6E9A7798D77FDBCF
SHA1:	C0234D55D259EC0768C4B7F502BCB41B410B3555
SHA-256:	CF4D3DFE9CDFF04408A9452DF858A86C17599DF5FB1353C839156FBFC509E359
SHA-512:	1FE34FBD5506DA82F43CB9104EC7A427EF302508D9501C794505836B6B1D0140BADE41B35D495ED3CF28AFDF7C4DCF2A72E32FAE46A02572BD4EC8C19C31643F
Malicious:	false
Preview:	E1D97A69C77BEA2291FCE2F407EA519762B657769B43CE7B26D33957403EF197..[..{.. "SettingId": 1,.. "ScanReminder": false,.. "ScanReminderInterval": 30,.. "ScheduledScansCompleteWithoutThreats": false,.. "SecuritySummary": true,.. "NextScanReminderTimeUtc": "2024-05-17T07:15:37.7337259Z",.. "DefaultReportSaveLocation": "C:\\Users\\user\\Desktop"..}..]

C:\ProgramData\Malwarebytes\MBAMService\config\UI_SecurityAdvisorSettings.json

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.282058357489781
Encrypted:	false
SSDEEP:	6:SQbFiaQRVH8p02CH3yG/ncJK8RMJWdcJK76rywyDNN6y94n:9igPn2nfajJf94
MD5:	2BF70FB1C6D35314726CC45EA4914882
SHA1:	A084A5B3C2C35C51AC63C3CAB49C4E751BDAFDE2
SHA-256:	D375ECAE27C6899AF9DC9FFB5A6470D2BDBD06C0CE8D28F612C9C78FFC276DDB
SHA-512:	50D0AE906B20592959841572066A29448A81613DF91A13DEDED0AF28CF37FA5379D59D296BDC94FAA396556C2E6CC15AC2420FFD63146E87B0938B332D8302F9
Malicious:	false
Preview:	D0D052559824F432563F28754B4A04744E5D761A78ACA196878CCD81E2AA884C..[..{.. "SettingId": 2,.. "SecurityAdvisorIgnoredItems": [],.. "SecurityAdvisorNotification": true,.. "LastNotificationShown": "0001-01-01T00:00:00"..}..]

C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1447
Entropy (8bit):	4.900743067456263
Encrypted:	false
SSDEEP:	24:bizZeGVEE+1ut1ufL5KBv1Uej6YFP13ZV1q15Y1PcsM15+MR+0bCiv0iQ1Au4TNM:OzZ4Fu3ufL58dZjX91G5APc3v5RtvtYx
MD5:	0074BF968F705718C12BC2DA589489F5
SHA1:	B49D062B6110023FE759AAE4BFCE9C5A66C5C380
SHA-256:	C764708E5ACDF78927ADB8439BE3168B8EAB7B7682828B6E37613F4B73359C93
SHA-512:	C4C87D5AE4200EFDC2BB97B9AC324BC25FBEB4632323E229EF39DA191557C978A4EC1CA590832F0A367A06217F22C1AF74B1C07816241BE69919ABF0EA02EEC3
Malicious:	false
Preview:	B60CA067DF08D29BD47532C9D495EB8C0C34091DB0356E74C445A242FD1CF154..{.. "ae_dynconfig_version": "0.0.1",.. "ae_exclusions_version": "0.0.1",.. "auto_check_delay": 1,.. "auto_update_interval": 360,.. "beta_db_pkg": false,.. "beta_opt_in": false,.. "channel": "release",.. "controllers_version": "1.0.1214",.. "cu_test_mode": false,.. "db_pub_date": "1713335980",.. "db_update_time": "2024-04-17T07:15:20Z",.. "db_version": "2024.04.17.07",.. "dbcls_pkg_version": "1.0.83541",.. "dbupdatr_pkg_version": "1.0.0",.. "disable_cu_timer": false,.. "dotnet_pkg_version": "6.0.28",.. "enable_auto_update_dbcls": true,.. "enable_auto_update_sdkctlr": true,.. "enable_auto_update_service": true,.. "force_full_update": false,.. "installer_update_pending": false,.. "installer_version": "5.1.2",.. "iris_initial_delay": 1,.. "last_upgrade_available_time": "",.. "legacy_db_mode": false,.. "max_incremental_updates": 8,.. "messages": [.... ],.. "min_DB_age"

C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json.bak

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1447
Entropy (8bit):	4.900743067456263
Encrypted:	false
SSDEEP:	24:bizZeGVEE+1ut1ufL5KBv1Uej6YFP13ZV1q15Y1PcsM15+MR+0bCiv0iQ1Au4TNM:OzZ4Fu3ufL58dZjX91G5APc3v5RtvtYx
MD5:	0074BF968F705718C12BC2DA589489F5
SHA1:	B49D062B6110023FE759AAE4BFCE9C5A66C5C380
SHA-256:	C764708E5ACDF78927ADB8439BE3168B8EAB7B7682828B6E37613F4B73359C93
SHA-512:	C4C87D5AE4200EFDC2BB97B9AC324BC25FBEB4632323E229EF39DA191557C978A4EC1CA590832F0A367A06217F22C1AF74B1C07816241BE69919ABF0EA02EEC3
Malicious:	false
Preview:	B60CA067DF08D29BD47532C9D495EB8C0C34091DB0356E74C445A242FD1CF154..{.. "ae_dynconfig_version": "0.0.1",.. "ae_exclusions_version": "0.0.1",.. "auto_check_delay": 1,.. "auto_update_interval": 360,.. "beta_db_pkg": false,.. "beta_opt_in": false,.. "channel": "release",.. "controllers_version": "1.0.1214",.. "cu_test_mode": false,.. "db_pub_date": "1713335980",.. "db_update_time": "2024-04-17T07:15:20Z",.. "db_version": "2024.04.17.07",.. "dbcls_pkg_version": "1.0.83541",.. "dbupdatr_pkg_version": "1.0.0",.. "disable_cu_timer": false,.. "dotnet_pkg_version": "6.0.28",.. "enable_auto_update_dbcls": true,.. "enable_auto_update_sdkctlr": true,.. "enable_auto_update_service": true,.. "force_full_update": false,.. "installer_update_pending": false,.. "installer_version": "5.1.2",.. "iris_initial_delay": 1,.. "last_upgrade_available_time": "",.. "legacy_db_mode": false,.. "max_incremental_updates": 8,.. "messages": [.... ],.. "min_DB_age"

C:\ProgramData\Malwarebytes\MBAMService\config\VPNControllerConfig.json

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
File Type:	ASCII text, with very long lines (432), with CRLF line terminators
Category:	dropped
Size (bytes):	1190
Entropy (8bit):	5.05246237254266
Encrypted:	false
SSDEEP:	24:aAECY6w8aJ8uyzaPoO0Fdp7YgdX8gwjhUk8sUPWbXi9/qsDtKNuUlG6hyL:wCY6XaCzz7Ns+X8Vwwr7TlGge
MD5:	EE7293E91FD4EFBF36E23FD54503857D
SHA1:	79C88789C1CD2857B6B69E57041C94E7318CCB38
SHA-256:	2A2A1EF0D12E39389FF3ED0E280DB85BFD02B0AF04B059B849D09411B4850F34
SHA-512:	EEF08C0BFB30546168CCCF9ECFEBD400C0FDE572B2A4B55230AC781C1F380EC63ADC233820252C7259B0D8517AC7C023A299B0B8BCC56E394EEC9F9F1922CB29
Malicious:	false
Preview:	13E6290324264FABB4A852BE6D1D3FCF15DCB0F17C0FA04516076C45ACC50254..{.. "allowIPv6Connections": false,.. "allowLocalTraffic": true,.. "autoConnect": false,.. "autoConnectInsecureNetworks": false,.. "connectionDriver": "wireguardnt",.. "connectionMode": "singleHop",.. "defaultRegions": [.... ],.. "enableKillSwitch": false,.. "ipv4DNS": "193.138.218.74",.. "ipv4DNSOverride": "",.. "ipv4MTU": 1360,.. "ipv4MaskAll": "0.0.0.0/0",.. "ipv4MaskNoLocal": "0.0.0.0/5, 8.0.0.0/7, 11.0.0.0/8, 12.0.0.0/6, 16.0.0.0/4, 32.0.0.0/3, 64.0.0.0/2, 128.0.0.0/3, 160.0.0.0/5, 168.0.0.0/6, 172.0.0.0/12, 172.32.0.0/11, 172.64.0.0/10, 172.128.0.0/9, 173.0.0.0/8, 174.0.0.0/7, 176.0.0.0/4, 192.0.0.0/9, 192.128.0.0/11, 192.160.0.0/13, 192.169.0.0/16, 192.170.0.0/15, 192.172.0.0/14, 192.176.0.0/12, 192.192.0.0/10, 193.0.0.0/8, 194.0.0.0/7, 196.0.0.0/6, 200.0.0.0/5, 208.0.0.0/4",.. "ipv6MTU": 1360,.. "ipv6MaskAll": "::/0",.. "ipv6MaskNoLocal": "0::/1, 8000::/2, c000::/3, e000::/4, f000

C:\ProgramData\Malwarebytes\MBAMService\config\VPNControllerConfig.json.bak

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
File Type:	ASCII text, with very long lines (432), with CRLF line terminators
Category:	dropped
Size (bytes):	1190
Entropy (8bit):	5.05246237254266
Encrypted:	false
SSDEEP:	24:aAECY6w8aJ8uyzaPoO0Fdp7YgdX8gwjhUk8sUPWbXi9/qsDtKNuUlG6hyL:wCY6XaCzz7Ns+X8Vwwr7TlGge
MD5:	EE7293E91FD4EFBF36E23FD54503857D
SHA1:	79C88789C1CD2857B6B69E57041C94E7318CCB38
SHA-256:	2A2A1EF0D12E39389FF3ED0E280DB85BFD02B0AF04B059B849D09411B4850F34
SHA-512:	EEF08C0BFB30546168CCCF9ECFEBD400C0FDE572B2A4B55230AC781C1F380EC63ADC233820252C7259B0D8517AC7C023A299B0B8BCC56E394EEC9F9F1922CB29
Malicious:	false
Preview:	13E6290324264FABB4A852BE6D1D3FCF15DCB0F17C0FA04516076C45ACC50254..{.. "allowIPv6Connections": false,.. "allowLocalTraffic": true,.. "autoConnect": false,.. "autoConnectInsecureNetworks": false,.. "connectionDriver": "wireguardnt",.. "connectionMode": "singleHop",.. "defaultRegions": [.... ],.. "enableKillSwitch": false,.. "ipv4DNS": "193.138.218.74",.. "ipv4DNSOverride": "",.. "ipv4MTU": 1360,.. "ipv4MaskAll": "0.0.0.0/0",.. "ipv4MaskNoLocal": "0.0.0.0/5, 8.0.0.0/7, 11.0.0.0/8, 12.0.0.0/6, 16.0.0.0/4, 32.0.0.0/3, 64.0.0.0/2, 128.0.0.0/3, 160.0.0.0/5, 168.0.0.0/6, 172.0.0.0/12, 172.32.0.0/11, 172.64.0.0/10, 172.128.0.0/9, 173.0.0.0/8, 174.0.0.0/7, 176.0.0.0/4, 192.0.0.0/9, 192.128.0.0/11, 192.160.0.0/13, 192.169.0.0/16, 192.170.0.0/15, 192.172.0.0/14, 192.176.0.0/12, 192.192.0.0/10, 193.0.0.0/8, 194.0.0.0/7, 196.0.0.0/6, 200.0.0.0/5, 208.0.0.0/4",.. "ipv6MTU": 1360,.. "ipv6MaskAll": "::/0",.. "ipv6MaskNoLocal": "0::/1, 8000::/2, c000::/3, e000::/4, f000

C:\ProgramData\Malwarebytes\MBAMService\config\VPNServerListConfig.json

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	125
Entropy (8bit):	4.864421283002227
Encrypted:	false
SSDEEP:	3:7CVj+kfR4MwVmDDkFHWGHX+zlmv/0AXTmWJq7Yn:mVqkfR4nVuoFHWo+lmv/0yThJSY
MD5:	470BB7BC71B7E076BCD232DA6B3B812C
SHA1:	CF09EE0A895B38822041271C09854F65B20C939C
SHA-256:	2464ADCF1A53B97D535682F7AFAFA8C1D038321265538CBF4C15BD03A21A06B8
SHA-512:	0E59B2C9B97A2734E1276AB830507D28F4919DC51654FE27F3A7E4FFF3D722DA9DC831B7A728A5B8939A4B7088A3ADA8807CC1D4CB235B03EED4B15E2DF5D43C
Malicious:	false
Preview:	B5FF7241D097D9D0AD194048F5F44D0D81A05DD15B049D750C4EA26F88DE0C04..{.. "schemaVersion": 2,.. "serverRegions": [.... ]..}

C:\ProgramData\Malwarebytes\MBAMService\config\VPNServerListConfig.json.bak

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	125
Entropy (8bit):	4.864421283002227
Encrypted:	false
SSDEEP:	3:7CVj+kfR4MwVmDDkFHWGHX+zlmv/0AXTmWJq7Yn:mVqkfR4nVuoFHWo+lmv/0yThJSY
MD5:	470BB7BC71B7E076BCD232DA6B3B812C
SHA1:	CF09EE0A895B38822041271C09854F65B20C939C
SHA-256:	2464ADCF1A53B97D535682F7AFAFA8C1D038321265538CBF4C15BD03A21A06B8
SHA-512:	0E59B2C9B97A2734E1276AB830507D28F4919DC51654FE27F3A7E4FFF3D722DA9DC831B7A728A5B8939A4B7088A3ADA8807CC1D4CB235B03EED4B15E2DF5D43C
Malicious:	false
Preview:	B5FF7241D097D9D0AD194048F5F44D0D81A05DD15B049D750C4EA26F88DE0C04..{.. "schemaVersion": 2,.. "serverRegions": [.... ]..}

C:\ProgramData\Malwarebytes\MBAMService\config\telemetry.json

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	387
Entropy (8bit):	4.656474937972401
Encrypted:	false
SSDEEP:	12:Au1msHEjDeREHBD1uBP8PsL0LPX2sXtBTee/sY:AMHEjaREHBh+P8PsoLX2sXPKe/sY
MD5:	BE64F81A708E45AA9EE890F69BD971CE
SHA1:	01C6AFAB491E17C3FB9C2DCB9EE2CCDF31A67AD5
SHA-256:	3D4651ACEAE19B137F23F565E626979FF55401D5F5750653DE0B163EF721832F
SHA-512:	B1B48D0E2AB545CD79F31F0B3170D21224A6D744208828325345AB59B7BA0074861B58E60BF66BF18A3849A1A59B24EE7EC9C147010B5B731D52E3591B19D119
Malicious:	false
Preview:	4FC770329BF74793713301F811DC923E71748C01F72CC810266EA271D7466595..{.. "arw_data": [.... ],.. "error_data": [.... ],.. "exploit_data": [.... ],.. "iris2_data": [.... ],.. "iris_data": [.... ],.. "malware_data": [.... ],.. "mwac_data": [.... ],.. "quarantine_actions_data": [.... ],.. "quarantine_refresh_data": [.... ],.. "user_actions": [.... ]..}

C:\ProgramData\Malwarebytes\MBAMService\lkg_db\Actions.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4672344
Entropy (8bit):	6.294948484134738
Encrypted:	false
SSDEEP:	49152:tzBxfafNoYk03h1UjDIbeNqj+wdCzkrJuSu1BrtGgfBsAGxQ1ZbvdPd2uqaSpeOj:1rbNqFxlpxyn2upOZ
MD5:	20D70C6E04DBF14C01AB2D756E97854F
SHA1:	F172C8B8C0E87D2A9AB064513DCE004D16D03E0D
SHA-256:	C4002339B58BC493AE3540BAFE1B2CA0A70BBA0F853E29F60E0F6A1680FA9A24
SHA-512:	13E073CD4B3D53C6D9FDDA671A55962266B5C0A18ABCB5774092C35F0D0BF2C5D0D9802D8955D32CCEB166821634BFC067DAC7809C9ADE143CF3A3B497743B36
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$.......:T..~5..~5..~5..5M..y5..5M..5..~5...5..5M...5..5M...5..x...o5..x...l5..x...&5..5M..a5..~5...4..5M..U5..G...4......k5.......5.......5.......5....3..5..~5[..5.......5..Rich~5..................PE..d......e.........." ...&.N&..........(.......................................PF......eG...`..........................................@......@.\|.....E.......C.......E.X.....E.......<.p.....................<.(.....<.@............`&..............................text....L&......N&................. ..`.rdata...q...`&..r...R&.............@..@.data.........@.......@.............@....pdata........C......PC.............@..@_RDATA........E.......D.............@..@.rsrc.........E.......E.............@..@.reloc........E.......E.............@..B........................................................................................................................................

C:\ProgramData\Malwarebytes\MBAMService\lkg_db\BrowserSDKDLL.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5649632
Entropy (8bit):	6.5646324710155435
Encrypted:	false
SSDEEP:	49152:wyLEnIYGoPW0X0lfzc+Spd3hdC0qdcz+UbDa+El4+LorSojkoy7HJBQCdfvxYffA:tYdbZmczU+ypLha/S8JQ
MD5:	A3FE79081A59D493C01B5C1139BABDC9
SHA1:	1505CB4053BCD9B55C40227AD6B62A2457CEBBDF
SHA-256:	60C8C024FF020F04FCCCEC10EE78872BB1E6985463D6370C6AF095761D88B860
SHA-512:	22310A585EDB36050FF20356CD9EB5129CDAE3FFEA2CCD7A54D9652DBD336D7F402ED119DC59AE3250B93BAD40E75983184256C0BB239CFF049BBB983F487BDC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$..........$Q..wQ..wQ..w...vV..w...v...wQ..wP..wWH.v@..wWH.v5..wWH.vE..w...vO..w?H.v...wQ..w...w...vv..w?H.v^..w?H.v...w?H.vP..w?H.wP..wQ.rwP..w?H.vP..wRichQ..w........................PE..d...4;.e.........." ...&..:..H............................................... U.......V...`...........................................N.......N.@....`T.(.....Q.....PT......pT.......I.p.....................I.(.....I.@.............:..............................text.....:.......:................. ..`.rdata...p....:..r....:.............@..@.data...tm... O.......N.............@....pdata.......Q.......P.............@..@_RDATA.......PT.......S.............@..@.rsrc...(....`T.......S.............@..@.reloc.......pT.......S.............@..B........................................................................................................................................................

C:\ProgramData\Malwarebytes\MBAMService\lkg_db\Global.nm

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
File Type:	data
Category:	dropped
Size (bytes):	343000
Entropy (8bit):	1.3643101998826728
Encrypted:	false
SSDEEP:	6144:IhGoLNRdpPTzHC76NidE/XTKNwcc99Pa5W2IIzQiLiNKshgNcLZTVIM5TAO/jIbW:IhGkNRdpPTzHC76NidE/XTKNwcc99Pa4
MD5:	FE4EC049045997B88F5F1FB5F7829BCF
SHA1:	034A7AE32F9A689227358F432AE5A141A9310C28
SHA-256:	E88E2E80BFDC35A74DBA07DA5AC4B1A5819F18FC4BBE0C62B6B1CAF825B5F31E
SHA-512:	A5CDBDC25888FCE78350877C59F840A88153A09362A585E10106DF19A4F3DA92EFBE2F4A9F7CF7C9766C2503B0DFA3D54EC2CE05B12805260699E0FBFA20BC0E
Malicious:	false
Preview:	.....z*.1.8.0.S.o.l.u.t.i.o.n.s...A.d.w.a.r.e...A.d.v.e.r.t.i.s.i.n.g...D.D.S...s.r.....................................................................................................................................................................................................1.C.l.i.c.k.D.o.w.n.l.o.a.d...A.d.w.a.r.e...D.o.w.n.l.o.a.d.e.r...D.D.S...s.r...................................................................................................................................................................................................5.H.e.x...A.d.w.a.r.e...A.d.v.e.r.t.i.s.i.n.g...D.D.S...s.r...r...D.D.S...s.r...................................................................................................................................................................................................7.Z.i.p...T.r.o.j.a.n...M.a.l.P.a.c.k...D.D.S...s.r.....s.r...r...D.D.S...s.r...................................................................................................

C:\ProgramData\Malwarebytes\MBAMService\lkg_db\Global.sr

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
File Type:	data
Category:	dropped
Size (bytes):	20435064
Entropy (8bit):	6.773040544420836
Encrypted:	false
SSDEEP:	393216:ifMkLDMqTnmaHiaPCNHVNrFkWPX0xrIle7Q:ikiDMjaCa0DBPQrQ
MD5:	2533ACCFBF44382328CB91613D3356E0
SHA1:	82DD1220E69BE7F8640D29853289BDF623FA1BE8
SHA-256:	9E9AC3D2ED93A5E4035F4C408558A14144ACC4F6D348A0FE7FA560A1F5656FC5
SHA-512:	8DEFF61628598DBBD7931DEFB2E667FCF6FAC16D8D8A79BCDFAE01F7B0ABDF06EC39698A4E46EA9E1AEAF6BC5426602374BF42C06CA5F0ADB853A380F5D4D116
Malicious:	false
Preview:	.....z*.........................vI......vI.......3.......................................\|......q.......................................................................................................~..y._..j......n<57.7~3.a......../.@wu).......j..W...c........\|..R\.m........Z.b.,.3.g......../..2..(...........................r/.........;. U...D.........C.}.U..A=.......................x..........0.-..#?........7V..$...L..........M....d........d.<............l'.Zl&m.........C...'p.........@...m.u'...........~..fc....../....f..........q^.XBZ.X.........................S..VV.../...........O#%E.......Q..b..@^....................N...............@P<O.,T........].....Og........=t...u........+`q_.[.].........M9...#..n......o..W..6M.z........Z...I..........A...Y.........Di.bK...)D......~..'..4.H.............q........../".Rj........1..,b..Qh.......T..o...O............-.7X.......2.u.G.e.].......:..J"X.p........-.7.(.l.......LN.J.I.G........l...3.(m.........t....K.%.......

C:\ProgramData\Malwarebytes\MBAMService\lkg_db\MBAMCore.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7009696
Entropy (8bit):	6.385161924256879
Encrypted:	false
SSDEEP:	98304:UPxTXttZarMzMk4PEcxZ3M6GdPiwjQDZ:UP1XbZawzMk4PEcT33sjQDZ
MD5:	B2763ACFD7AC2CE596A4F3A930DD2A3F
SHA1:	AC18DF54E4B64268E93B6E0AF650D6CD8FE60274
SHA-256:	3B8FDECC7155BBB62B1D76AA30F06BF079924BC794CF700F5D51ADE13444D049
SHA-512:	40B9F4BD1DC10034A5B18D3C0D2447A98AA6E4655D5D43B22AAE83720E9EDA8F818CF7FEBC0E8D0CD3B3F051805407A6112B66EB4FDDD49AE2CA882A1AAA57B3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$.......................................................................................................................I...........0...X.........Rich....................PE..d...[}.e.........." .....Z7..`2......b*.......................................i......k...`..........................................aN.....PeN.......T..w...PR..o....h..?...@i.`....UG.p...................@WG.(...@VG..............p7.p............................text....Y7......Z7................. ..`.rdata.......p7......^7.............@..@.data........N......\|N.............@....pdata...o...PR..p...2Q.............@..@.rsrc....w....T..x....S.............@..@.reloc..`....@i.......h.............@..B................................................................................................................................................................................

C:\ProgramData\Malwarebytes\MBAMService\lkg_db\cfg.bin

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
File Type:	data
Category:	dropped
Size (bytes):	845
Entropy (8bit):	4.798278423365327
Encrypted:	false
SSDEEP:	12:rMXBoOWZOVMlpC4O18quZXmwJs5fGFyYiM9uUCO3/JgX0/dzWAH0Xn:YXBqOVMK8l4GoPM9uUCC/GSZXH0Xn
MD5:	1BEA85F6F77B365122FD5F51B10777E3
SHA1:	2431DDA3AE3310739FDBC59A1C40AADF5B0C5E2F
SHA-256:	EBB6BFBCB66F79D34E10C57E70B26AEE5F99E11207E6F103C660B4C2A005F771
SHA-512:	01402E189787BB653C14400721ACD55ED2AE78F94C4CE9D0C9B9FD8A49EE504136BEE56DEAF24291E0594DFC73489A973D54F2E19094EA21F061CAD2DAF35460
Malicious:	false
Preview:	....?.......?...........................................................................................................................................................................................................4........................................................................................................................................................................................5....`................?..L?.....c........................AQRGEQG"../OCZ@C_PV@1..2\\IPHRN:-+.gkfsjmg~x. $.`c}tft{sym{.17.\|.................t_Yq...........!,$( 5O.Q\BI`dJ $0?=6Szr:@').;-..................................-44..?Abflxbo..5Wt\|vf\|u^_.........................-8;:..4789..>=>;.. #$-..)++..,/../)....%#....#%....9?....71....MKpsw\|KMzy.{AG\|.eg_YfecnUShkjjSURQURioTW_]ga^]YZ}{@CCB{}JIMCqwLO.................................

C:\ProgramData\Malwarebytes\MBAMService\lkg_db\clean.mbdb

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
File Type:	data
Category:	dropped
Size (bytes):	12039
Entropy (8bit):	7.97533612150655
Encrypted:	false
SSDEEP:	192:VAKNoJdP/gHM9RJtp6wWs3IWFTr7PN0/7kw/Q3G9nzFzUcPpIMQUPTf9Mv7cj:VON/995p6ls5fV24stnycPOM3VS7cj
MD5:	E5043DB63E70D72E5AED7D50646F3B06
SHA1:	132CC537282A08374D7D6964D6955D972C793E36
SHA-256:	2C1E964836E1A92FA778673783FF04D2BD76CF3743879CFB63173CC04F52B900
SHA-512:	DFDC83087E5B4D3B4E08D223005C9758E9B5BB19F4E6BFF8768081E8A81B18969C4F0296F912C9CD9A2EF9EAFDF1F5FEE94071206A3A35D50BA8E22F9FCE21BA
Malicious:	false
Preview:	MBDB........x..}.tc_Z.dI...n...b..{.WK.ror.-Wz[...,.'!....B.!....,..,..B'.....Y{...aw.yg..........w.{c.!......].O...g..xuM...=O...h....@..........ew.....H8..wAd/1F..\|.E..\|...x..S.:.Ety.....X.,..*uq..NXT..aT..zqX.H.Jt&3..@..(v.....t.......OG..W.Q..N..g....M..g/..EF.V.".]T.F6..l..FZ.k..i.#L.CT.........#K.;...;a.;`....{..!.<.'o.u.....k.g....Q^.Z.. wJ]...~c.Q...s$ast..Ni./.O...,...orw.-...8..............x.....;.p..#.....U.\..........t3....x.......vM.p...Z._a....c.5...Q...s..\|.n@.E..>...>...0:.]..6.+l.....]...<...n&Z.[...K..~..{.p.\|2.0.....5...N.4\r....cp..3q ./!S.U.....Ey...I..].8x.;..6g...9ICL\..B.c.....;...:..].8..w`)k......7O...O]f...UEE..y.._\|..evC.1q3.%...:.....4eKL..Z.D..hK8.w.%...Ij{.....r.k....v........N\...+.v..u....S....b.........o...N[..D.8......;5.!D\.....4...h[...3..3}.h...4..l..0.C...>P.{.a>.&.r...D."Y..k. .<u.S....vIpX..Y[.....u......:......n..Th.vO}.NB..>;...o{.6[........S.....t.9....l.....6r...+....Jh.....^..........0..{

C:\ProgramData\Malwarebytes\MBAMService\lkg_db\dbmanifest2.dat

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	924
Entropy (8bit):	4.686212273872669
Encrypted:	false
SSDEEP:	24:ihWFbafaK3OCwCLFU3iK8k4xQSrrXFcHp:o7f1OuLAXyQSrrFyp
MD5:	4BBCF199E6BAAC2489008A646BF59C94
SHA1:	0F8945B336D227533E8CBD46498667BB45978AF8
SHA-256:	9EB85EB251678712E62E87189B8BCAC3797308A135C688DDD3FFF33532EF982E
SHA-512:	3339C7A7D46B4CC9DEE25B0DE2A68BE0FE1C226451AE5DAF7EDC5BD11BB5E84E07B9E90DBA989824B533AEAAF934AA1C688421C990F8C2E2462291022488353B
Malicious:	false
Preview:	clean.mbdb,AB15C1E4541E80E28D71F0C42E011830E86B43DBDAC53C364DE61873E1B3C18E..prot.mbdb,6089FBF0C0C1413F62E91DC9497BEDC6D8A271E9DC761E20ADC0DCCF6F4A0C1F..rdefs.mbdb,E1C7DE8B30104F402627A8D5CC1630DE5B7F0824A6DFA2C91DE1C4A8839F6B21..rules.mbdb,74E70A79556AEA618F8573D1820084CACA400171E02663FD24A8952847127F6C..scan.mbdb,F7BDC60BE1A19A5D0DCD73CDA6F253BE105D7DEA4BE02C9A052E5DEAB912A8AD..tids.mbdb,B5A2C2285DB1A841F3AE323236275976FDECCD8DBBD1E4A9D1B17DDCB243672C..wprot2.mbdb,8A5E8C4A4DA67CB209ED309B871FA4AA1221A58A5C8BB898313F748DA13DD74C..exclusions.txt,9E87E4C9DA3337C63B7F0E6ED0EB71696121C74E18A5DA577215E18097715E2F..dynconfig.dat,008254CA1F4D6415DA89D01A4292911DE6135B42833156720A841A22685765DC..Global.sr,9E9AC3D2ED93A5E4035F4C408558A14144ACC4F6D348A0FE7FA560A1F5656FC5..Global.nm,E88E2E80BFDC35A74DBA07DA5AC4B1A5819F18FC4BBE0C62B6B1CAF825B5F31E..cfg.bin,EBB6BFBCB66F79D34E10C57E70B26AEE5F99E11207E6F103C660B4C2A005F771..

C:\ProgramData\Malwarebytes\MBAMService\lkg_db\dynconfig.dat

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
File Type:	data
Category:	dropped
Size (bytes):	40814
Entropy (8bit):	3.3297840656455446
Encrypted:	false
SSDEEP:	384:jNOT68xDvtG9ObE7L8u8sXNVkIfvs4FRj:ay8u8KVkIXsWRj
MD5:	10F23E7C8C791B91C86CD966D67B7BC7
SHA1:	3F596093B2BC33F7A2554818F8E41ADBBD101961
SHA-256:	008254CA1F4D6415DA89D01A4292911DE6135B42833156720A841A22685765DC
SHA-512:	2D1B21371ADA038323BE412945994D030EE8A9007DB072484724616C8597C6998A560BC28886EBF89E2C8919FB70D76C98338D88832351823027491C98D48118
Malicious:	false
Preview:	;...-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....;...-...E.J.E.M.P.L.O...D.E. .C.O.N.F.I.G.U.R.A.C.I.O.N.........................................-.....;...-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....;...[.N.o.m.b.r.e.S.e.c.c.i.o.n.].....;...o.b.j.e.c.t.T.y.p.e.......=...1.....;...o.b.j.e.c.t.V.a.l.u.e.......=...".C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.a.l.w.a.r.e.b.y.t.e.s. .A.n.t.i.-.E.x.p.l.o.i.t.\.".....;...l.0._.v.b._.d.i.s.a.b.l.e._.m.a.s.k...=...M.B.A.E._.F.L.A.G._.A.L.L._.F.A.M.I.L.I.E.S.....;...l.0._.v.b._.d.i.s.a.b.l.e.....=...M.B.A.E._.F.I.D._.S.U.S.P.I.C.I.O.U.S. .\|. .M.B.A.E._.F.I.D._.T.E.S.T. .\|. .M.B.A.E._.F.I.D._.O.T.H.E.R.....;.

C:\ProgramData\Malwarebytes\MBAMService\lkg_db\exclusions.txt

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
File Type:	data
Category:	dropped
Size (bytes):	23674
Entropy (8bit):	3.1643905914459673
Encrypted:	false
SSDEEP:	384:OpHJUPIIawosLqVqmv4EHUtVbUQIKiKn6p+C+vNCMSP+TyHS7ivS/6:mYmsGfvSp/6pzgH4cyH9E6
MD5:	AEF4ECA7EE01BB1A146751C4D0510D2D
SHA1:	5CF2273DA41147126E5E1EABD3182F19304EEA25
SHA-256:	9E87E4C9DA3337C63B7F0E6ED0EB71696121C74E18A5DA577215E18097715E2F
SHA-512:	D31D21E37B0048050B19600F8904354CFF3F3EC8291C5A7A54267E14AF9FB88DFB6D11E74A037CC0369ADE8A8FB9B753861F3B3FB2219563E8EC359F66C042DB
Malicious:	false
Preview:	0.0.A.7.C.F.3.B.A.A.E.0.9.5.D.B.F.B.E.4.5.8.2.6.4.E.5.A.A.6.4.9.....0.2.3.3.C.2.4.6.0.C.0.2.0.F.B.7.7.6.8.5.F.5.0.7.0.1.5.8.D.6.3.D.....0.2.B.0.C.3.5.9.F.6.F.6.6.5.7.5.B.8.E.C.1.0.A.7.0.0.2.A.7.E.F.1.....0.3.4.C.C.A.D.C.1.C.0.7.3.E.4.2.1.6.E.9.4.6.6.B.7.2.0.F.9.8.4.9.....0.3.A.4.C.E.F.2.6.C.5.4.4.4.7.3.A.3.F.2.3.E.1.0.A.C.C.E.5.1.7.F.....0.3.E.0.A.0.8.1.2.C.D.D.2.A.D.7.2.6.1.E.A.F.5.3.3.F.7.7.6.1.F.6.....0.3.F.B.B.F.C.5.8.7.F.2.D.6.D.0.6.B.6.F.0.8.5.F.2.E.7.4.5.E.C.8.....0.3.F.C.F.B.E.2.C.8.E.7.1.C.6.0.F.1.B.C.3.4.E.B.9.1.D.0.7.F.9.9.....0.4.6.5.1.6.0.B.9.2.E.7.C.F.1.1.B.D.3.2.2.7.2.6.E.E.8.C.F.0.E.2.....0.4.6.A.7.8.D.2.0.8.8.9.A.0.B.9.6.B.8.4.6.4.6.B.2.E.5.9.7.2.9.F.....0.4.E.6.9.D.1.6.1.3.7.C.2.E.B.4.A.C.3.5.3.B.E.3.F.9.E.A.A.1.A.6.....0.5.0.E.6.D.D.C.4.8.F.D.C.D.4.5.8.A.B.C.A.C.2.A.6.0.D.9.6.7.5.7.....0.5.7.5.F.6.F.E.E.E.5.E.0.4.0.1.7.D.6.D.3.8.4.4.0.E.1.4.4.C.B.F.....0.8.8.e.d.8.b.b.d.1.a.2.b.0.5.e.b.4.6.6.4.5.9.a.a.6.8.c.3.e.c.6.....0.9.4.C.D.1.E.B.F.8.0.A.E.8.D.4.6.6.D.E.A.2.5.B.

C:\ProgramData\Malwarebytes\MBAMService\lkg_db\ig.exe

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1929504
Entropy (8bit):	6.461883146459182
Encrypted:	false
SSDEEP:	24576:7/pw8j0kcU71dHGvPKN8kP95bLS0pBm2L6y1szQGftwuTVHzw8mvkJ:7T0kcOnk88kPt7+zQUZw8mvkJ
MD5:	BBB352DBBF17F6FC29CD86BC1D80A417
SHA1:	1C83C920AE75D0F6E8634804E508E9156F565148
SHA-256:	73DF768292A90E52FCBC5DEDC51F8091083FB6042F4413D69AFEACE1CB0BA509
SHA-512:	12242406306D9808AFB3C9D9D590867F4D116A765D0EC761436B4E272CE456B0B72A5687856D1B6672980FAF4246721D297B0520821D5FCB81D7EAA86775EE5F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......(_.Gl>..l>..l>...X..S>...X...?...H..e>..rl<.n>...h.e>..>V..{>..>V..v>..>V..]>...X..N>...X..m>...X...>..l>...+...W...>...W..m>...WP.m>..l>8.m>...W..m>..Richl>..................PE..L......d.............................E............@.................................r.....@..@...@..............................$....... ............... .......H...........................`...........@...............X............................text...B........................... ..`.rdata..............................@..@.data..............................@....rsrc... ............d..............@..@.reloc..H............j..............@..B........................................................................................................................................................................................................................................................

C:\ProgramData\Malwarebytes\MBAMService\lkg_db\mbdigsig2.dat

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
File Type:	ASCII text, with very long lines (512), with CRLF line terminators
Category:	dropped
Size (bytes):	514
Entropy (8bit):	4.004648261705856
Encrypted:	false
SSDEEP:	12:ewoWyzdBYDrEvKsQUJiguICOdT3bOIIik+AV/Ll8NPAX0HflMBYc:eNzdBY/EpZTyIIir6xiPAXufm
MD5:	093666A888763C16D2F02B6EF0E46B1D
SHA1:	422F42C0F9BFE38CB9B3A91F93EEFCC4C81AA5F4
SHA-256:	3978056F6A0E1D4F55104202245202C903398AAB5E6A33C23748549D6A6C4E8F
SHA-512:	E50065A814A484F85A4A32ACE9C06CF1884DFBF3D3F50D6FED6C4254DC80432BDFE402AF9CB24C36C8D75E8A667364FD8B71F0F1A060C75EDFA224BBB5F0EEE0
Malicious:	false
Preview:	2530a222b87f4195d777bce28a2f466fedbfb6b381cd40c3f783f80ee4d9944f633f9fe728cadadd9c0701c9890be3e02c4483cf6688399ddeda8a7dd2681d4ae8e23dacc7323818a89f3c0811bc7f2e56273eb07bb2537b7ddb68681e31202e6bea0a6b598dc8736cf1b1ebd1c0a073a50078e9bb28cb87ec0a4c08933a76ab151e97b2898fd7179c7bf3e5ff271201088b07be64fffcf4e886c197996d4242ead7334407fe63e52ea1798a37a35cd9b14bfbb6251a632d77575bb3e22a7bd5c0067d1fe27d6f49a456dd194e5d2356be06fd3735524f28e20235d9c2b6e24d03733ca8704618af79a89dee7dcb1ddd65c3d6ebc01a851aa97f4cca421633ba..

C:\ProgramData\Malwarebytes\MBAMService\lkg_db\prot.mbdb

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.919372148594611
Encrypted:	false
SSDEEP:	3:cl03Q:cOA
MD5:	546D9E30EADAD8B22F5B3FFA875144BF
SHA1:	3B323FFEF009BFE0662C2BD30BB06AF6DFC68E4D
SHA-256:	6089FBF0C0C1413F62E91DC9497BEDC6D8A271E9DC761E20ADC0DCCF6F4A0C1F
SHA-512:	3478F5DCF7AF549DD6FE48AD714604200DE84A90120B16A32233B6D44FA7240F5F4E5FE803F54B86BBDFD10FA1BFDD88FB85EB6A78E23E426933F98D0A2565EC
Malicious:	false
Preview:	MBDB........x.c```......

C:\ProgramData\Malwarebytes\MBAMService\lkg_db\rdefs.mbdb

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.836038815261278
Encrypted:	false
SSDEEP:	3:cSSKQ:cSm
MD5:	2F7423CA7C6A0F1339980F3C8C7DE9F8
SHA1:	102C77FAA28885354CFE6725D987BC23BC7108BA
SHA-256:	850A4EA37A0FD6F68BF95422D502B2D1257264EB90CC38C0A3B1B95AA375BE55
SHA-512:	E922AC8A7A2CDE6D387F8698207CF5EFBD45B646986A090E3549D97A7D552DD74179BD7AC20B7D246CA49D340C4C168982C65B4749DF760857810B2358E7EB69
Malicious:	false
Preview:	MBDB........x.c```......

C:\ProgramData\Malwarebytes\MBAMService\lkg_db\rules.mbdb

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
File Type:	data
Category:	dropped
Size (bytes):	9792739
Entropy (8bit):	7.997671993740626
Encrypted:	true
SSDEEP:	196608:NLy02KXVuUAvIv0Bun33vwFA0274c7R9wIflXwMeTVog4iszT+fwZE13ms:Ne02KXoUAvIagfDU2lX/eGgozbwms
MD5:	1C45007940AC110A6521CEA00C215148
SHA1:	241D639D134BCB88DA083CC3E8F42CC4FC9B93B7
SHA-256:	C1ECE900A6AAB8F755B38C36AD8480D9EF685C613592CFB84E0D9B976BACC0C4
SHA-512:	A026929240CA752721FEE312827D912787DDCB44DC1D1B00FDC5116DA81A51DA646B375EC2019CF3C0A9F62075F9A9CB017DE4DF80B4DC8F4E05D7EF5EA2599D
Malicious:	false
Preview:	MBDB........x..w\|..Q>>9.I..Waw.U....(kr.9...i.l...l0.`..&..1&'....lr..`.`._W....yg.....;}..~........~?.....F...G.......3.V.........F.F..b(..I.d.U...n..K#.0.....B.u..h....>.6EG?.....mp..O.w5...&....l....+S...Y.9.....ayHda.........i{..mC7M...r../...wd...q.;i..oE6K&sj=...-_.A.m...a. 3.w..iB.a....ar..fW.eE...o!2.{...D..w...-..._...A.I..`...c/.`@..6......Y.K._\._..../z..lS....LgF.d...6.....C...T~.r.2w..^......N.{s...^....6..g.xN...oMG...)z..JR.8..n0..9..XE~3....}z.p=..._ .J..G..6\|.>...r0.=....diYi.....F...@..6l3.a.c.ie.\|.q.s<..]w_..........2.<...3.h%...a.A4}.;..ofk0@....)..."..8;;v.q..8..Ia.}...\|Yy..k...&.....p4-...a....._..g.M....s...6.nL8...}...M06f....YoV>...M..S..\|.K.Z}h.*.......i.qE....;..mJw......._.P3.e'^y.I(.C..6e;^Vv..6.4...\|N9..@.2. .S.&R.,..?...M....x.;...I.a....\|.......q..)$z......l.3m.H_Z..i.v6`i.m..\|n..;.)=..<^..y.C..s..6$.$...bL.....g....j7.J..\.V}K.Ka.Q.&-......~.....x......8i.Z}.lU.<Ylil((9.....%v.i..mH;.%.-..{.x..a..\.s..,.A..^

C:\ProgramData\Malwarebytes\MBAMService\lkg_db\sample.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	540944
Entropy (8bit):	5.869801499606895
Encrypted:	false
SSDEEP:	12288:oYIAmy9w5vPkTEetmCqryujcqhL0HU5WhjW5w:oY/VJrqhLcZ
MD5:	746DF014F6869285E5545505D5FEC062
SHA1:	52D5F0232B78C0D8746A29E75F80A2B436F38B69
SHA-256:	22047C6EFD6906C64EBB45BF08632220AA82C03D1FE21B79502B0CB7B67B32C2
SHA-512:	58E7A0051CFF72168EC56072339B2A4961A9BC12600A6FE4DD3C01F0AA8B7D22E3D79D72C7EE9A622508E4052EB7C82D047063659C23B34BF93EFF7124619848
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......q...5.U5.U5.Us.AU..Us..U'.Us.@UO.U.&kU0.U5.Ua.U8.AU4.U8.{U4.U8.~U4.URich5.U................PE..L......Z...........!................m................................................9....@..................................q..<.......<........................:..P...8...............................@............p...............................textbss5................................text...[........................... ..`.rdata..(>.......@..................@..@.data...@>...0.......D..............@....idata.......p.......^..............@..@.rsrc...<............j..............@..@.reloc..)D.......F...p..............@..B................................................................................................................................................................................................................................................

C:\ProgramData\Malwarebytes\MBAMService\lkg_db\scan.mbdb

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
File Type:	data
Category:	dropped
Size (bytes):	949798
Entropy (8bit):	7.997726238014049
Encrypted:	true
SSDEEP:	24576:1lduP4j+BAE2dAAIxvRGJrHF5B7p+G6W3PYR:1E4Q12cGRdS
MD5:	9E7AD31430DD76A68E40216C63431C8C
SHA1:	30DA69C07884892707D3F8AAF376874BED47F9DB
SHA-256:	11B6D2DAA977237E8389C179D23F4AC90AD3063441EA4EF5F0306BE0A503E221
SHA-512:	4A22F4460746404B1852D7D6CA44D18708FBEFAD5A4172CD0DBA149259DC0EF4D311880B36EABFD80D6B70997F8BBF7C8C561AD2F3A91080FE5B346441D70B67
Malicious:	false
Preview:	MBDB........x.....+[V.+u..n.sV.t:(g.:.s..sP.JI...2.!3.....l..mL0..l..3.....7..m...V.u.s...e....{...U........>...c0.L..........p>y.>..v..L....C.....ra~0.:k..._...F..6..01V..U.>].4U~V.90..__X....[.....}Q"j..._I.b......$\|z...h)..IJ.........>.3......6....t..j..5...`Vz...Fab.45..E-...x...'..w....\|...,Rj6a.9...W.-.%.A..f..M.VL.&/.....~.=2O.:...c.>.g..E_..+.....m....&......LK.;[2^s^.N.../.-,UC5jxm\|.....{{yN..:.-H.{..aUQL..E.]..T.=..LW..Bf.>^.3....[I.{...^.UT.c...}w.>.gX.N..p{....\|......c.....o.`\...o.4XeE.}{.>.gh.....w..!.mGZ....V.x.E.}g................S....H...Ad(.t.S......K.i"~w...q...`..$i%..^..i/}O....bx.R.:..v.Sa..G..a.=.B.9..E.(.i&xO...>l.jW..Z.>.zO......O.M....z..........[Zb.C....=...{...;\|..Q.i.i..Ok...j{ru...V....P.Y..i.~O[.).\Z.;.i.yK...@:..L.N)j..^.......c\|.A_......=...........{WG....5?...F."..M..<.f..m.uQ.. K.>.L...........Lhh2Pl.=.q.A.G....m{..?W{.R...\|..P.(...y.m....<P?....y...0.g......`........9...'y'....O&.\|..~'Ty...7.8.6.

C:\ProgramData\Malwarebytes\MBAMService\lkg_db\tids.mbdb

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
File Type:	data
Category:	dropped
Size (bytes):	174079
Entropy (8bit):	7.996320887729739
Encrypted:	true
SSDEEP:	3072:IZDHlfWrUShtc5N6roxVEjKRatcxlWuZUIlhzw2DhBrRFCV7YdDbvAQLtyEdaxpd:mDFXS87xGcx1jw27FAADHLwEExpvbR
MD5:	3155B1467DC98CA6808179A322DEEB19
SHA1:	D33D17687177D97F06D8FBA15A93C1CD0FA8295A
SHA-256:	5240A25DE1A184F85245BCEE28E0D4E146AF9E89EB675F38D5440D59F2D4B656
SHA-512:	A0B65EAD4849D057767CC7CFA54656A482AB3294EEE799D92DC1BA09BA8EFFCBA742D3EABCA838606A66CBEFC94EDFF72E7D03D39A805BBB31C2B23E158421FB
Malicious:	false
Preview:	MBDB........x..}.x.]ux..{.H.. .0.L...a..H.d..I.p.].j.u.j.jm.V...V..:..j...m....\.O...=.....=....s...,/.////?/._#..%......)S.U..9...>.........p..J.lR.`R4..5...$.@!..u..6...)a.N.S..{.....X..[.......X....d..s1..q.2....85.=k.r.f.Q=@.<.rw.h.v....-e!k.!..m...........g...Y.>....T........r......q..4o.H.[...J ....z4?........~.7._....?%.Y._...v.L5...y...T.....c.Z.\...a.^....D.....-.?.q.j...j"..aV7....).X.sBi.d....n.My,V,.V....^6`.d....\|A..Ls.Y.g~m..U....\|.0..b..0r..m?mO.........e'E1.G..b.h.q...i.X..ix^<o...h.)......,_..&...@4..h..L.1..C..I.8..rV.04...ta.)..H.J..Tm.z..H..Hx.. ......p.A.~....e...C.....C..[...q0\....# b.&.Z2=..:x..3nC.1L..}.,.\|+.+.....6...(_..W.........h...........`.cZ....v%.;!......e...at..k.Z..z....2.0...b.....!L !'..... ..Y.dIiR.........7.B.>..yu......<...#&.p[....../...+ga*.Q.i.!...z.ss9.+I...'xS...@..J....-.....i(Z.4.}gj..w5.CxY.........`.....h......y..e5..G...#.T....Y.L.l"..~%....r.."..%..=....QqB.0#$M....m.U.6F:6..Pu....xA

C:\ProgramData\Malwarebytes\MBAMService\lkg_db\version.dat

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.272769892034794
Encrypted:	false
SSDEEP:	3:SVdRUoPnVmSL4yn:S9x041
MD5:	45265FD7A7C0AF2C92359B013B7A97CA
SHA1:	3EBCB34826F7AF7B88C076F94D17E3E63481E1F5
SHA-256:	78FE5DD6D1B0352C34486307AB2259AA1AB175C1E921723E9E6EB6DFB49C4EC8
SHA-512:	C51926AD685D3AD27EB3F4BC70D1005A70EA1E6A82D53869F89A07C0071C35516B0E45210C7CA49ECB65C2FFBC22F6A5293333BAAAB6D53BE0DFFF9146B69C3A
Malicious:	false
Preview:	1.0.83541..2024.04.17.07..

C:\ProgramData\Malwarebytes\MBAMService\lkg_db\wprot2.mbdb

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
File Type:	data
Category:	dropped
Size (bytes):	31928162
Entropy (8bit):	5.8702115727779915
Encrypted:	false
SSDEEP:	393216:seOalzZwaOu0v1Lqo7vU1h2DwghUAa/uT+DhrNO0s9Y3kAHyDn/keCbW026RcVFd:soGakv1LqojNe6EFj0Kknb87bNQs6H
MD5:	93A2FEF2287EE51CB0AE5D4002C89D4C
SHA1:	80A111C11405DEC10ABEA63B710BFAA6B90E3378
SHA-256:	8A5E8C4A4DA67CB209ED309B871FA4AA1221A58A5C8BB898313F748DA13DD74C
SHA-512:	EF180FD72EB91ADE35FD098DA408A682C251AE76B4E414B2A848E0AF746AE23EAA9355A572D9F58035EC4CCD36688324E25F8874AD8E2A8C7138D9F0FB10375C
Malicious:	false
Preview:	MBDB........H......................,...............:...........;~{Q...............................................................................................................................................M............."...........................&.........................................X...........................r.........................../.............0.............:.........................................................................................................................................................&.............e.............\|.............................................................................................................................9...............................................................................................................1i............@k.............n............wq.............q............7u............Bu.............w............p.............m....................................................................d...

C:\ProgramData\Malwarebytes\MBAMService\pkgvers.dat

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	75
Entropy (8bit):	4.346147230815376
Encrypted:	false
SSDEEP:	3:tdfF/wX5GrtShApFmLhUQRUo0xr8dVLE:tdCX8rtSha8dfxW8g
MD5:	6DAFD89A10FCA1585081031708FD78BD
SHA1:	62C3873190AE23C0C86C57A5AD5C4A95828E26C1
SHA-256:	29C589740CE763E2FC36A0BFA3651834D15A3EE17ED342F6F7392E2317874228
SHA-512:	C974ADC5AC2DA19DE80E618EABDE9C19CD4BBF23263F2C8D659174FA68DAF2F54FED519FF09D5EB7D594DFFDAAA2535A2193FFAC3496289ED41CCE8F1F47D532
Malicious:	false
Preview:	INSTLR : 5.1.2.109..SDKCTL : 1.0.1214..DBCLS : 1.0.83541..DOTNET : 6.0.28..

C:\ProgramData\Malwarebytes\MBAMService\version.dat

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.272769892034794
Encrypted:	false
SSDEEP:	3:SVdRUoPnVmSL4yn:S9x041
MD5:	45265FD7A7C0AF2C92359B013B7A97CA
SHA1:	3EBCB34826F7AF7B88C076F94D17E3E63481E1F5
SHA-256:	78FE5DD6D1B0352C34486307AB2259AA1AB175C1E921723E9E6EB6DFB49C4EC8
SHA-512:	C51926AD685D3AD27EB3F4BC70D1005A70EA1E6A82D53869F89A07C0071C35516B0E45210C7CA49ECB65C2FFBC22F6A5293333BAAAB6D53BE0DFFF9146B69C3A
Malicious:	false
Preview:	1.0.83541..2024.04.17.07..

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073617318402726
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvr8:KooCEYhgYEL0In
MD5:	8F9F8EBF4AFDD9197AE8ECC81D2EAE98
SHA1:	F48C783CAE8DB303D346E1813175ED269C168C7F
SHA-256:	151CEBF28957196C15D8682991A97DA0BEAE3EA8792C36309C490A3FC46D921C
SHA-512:	986BED56E3CC13BE15EFCFD08AE480F3F5131396FF4C96C3B675F2DD6E8A3C02DE309FFD28FB7436CBB1D0BE5B53CACD50240879FCF135BBBEF286A56FA79179
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xb9bd528c, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4221493792632624
Encrypted:	false
SSDEEP:	1536:xSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:xaza/vMUM2Uvz7DO
MD5:	66CBC37C036892BC45610408A3DA1BCA
SHA1:	DCC17A8E9E7B55DD7308DFF28E2786A9F5E41926
SHA-256:	48749E5E198CEEC4A6B3F71E14E7DA197EDFC1C9CD0C281C4C21A2F745934141
SHA-512:	9910C4B7C7C9AB295FAD1E94841EC1F12D934C31A7758922EE528F4B686FE08674FF666C93508A8EB8B682C597A1985A8F916398E2F338C952BA353857AD46C7
Malicious:	false
Preview:	..R.... .......A.......X\...;...{......................0.!..........{A.&....\|/.h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{..................................N...&....\|/.....................&....\|/..........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07714461359967484
Encrypted:	false
SSDEEP:	3:H7XllEYe0Zt+djjn13a/5+0KtlXallcVO/lnlZMxZNQl:b1lEzWAj53qI0KXeOewk
MD5:	CB0FF3F96BEBC95B0A043951BC9B9611
SHA1:	5696CB79589DA8E007C2D0425455B2618E76EE27
SHA-256:	E703A73C97F1B1BC7ABFE657276652073908BE2D306DA5440F1D9B3719301EB6
SHA-512:	F3AA1C281993C2E40CBE22E31E22A87A2EFFD014989080847DA79A35531A7DDEBFE01BDDB369EB233266E5EE249533D061D43CDB260F63AA16F15C55F9A6E1DD
Malicious:	false
Preview:	.........................................;...{..&....\|/......{A..............{A......{A..........{A]....................&....\|/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mbamtestfile.dat

Process:	C:\Users\user\Desktop\MBSetup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6
Entropy (8bit):	2.2516291673878226
Encrypted:	false
SSDEEP:	3:Hy:Hy
MD5:	9F06243ABCB89C70E0C331C61D871FA7
SHA1:	FDE773A18BB29F5ED65E6F0A7AA717FD1FA485D4
SHA-256:	837CCB607E312B170FAC7383D7CCFD61FA5072793F19A25E75FBACB56539B86B
SHA-512:	B947B99D1BADDD347550C9032E9AB60B6BE56551CF92C076B38E4E11F436051A4AF51C47E54F8641316A720B043641A3B3C1E1B01BA50445EA1BA60BFD1B7A86
Malicious:	false
Preview:	test..

C:\Users\user\AppData\Local\Malwarebytes\data.db

Process:	C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe
File Type:	data
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	7.954777468859076
Encrypted:	false
SSDEEP:	96:DjkZlB3opxEokAGmn30aMDqUCs1QaneSESHiNtm4ESC:D6popxEoyK0aM/USO+
MD5:	4BABE079789890EE5DD4585762931739
SHA1:	19CF592224B9DB67E50CF244E78C81D40C07F2A8
SHA-256:	B34B2551AD2575767F2111D1DE3A11549027332B960DCB7199627684569B7F76
SHA-512:	BB2076FAF46A80B4B4F0F8481224A51B424AB76048CEBC5CB7E731D9D9F76BA6D1D4C9E1BFCDDEBF3B6B0089C25152E0BB546D9BB8095969F6380612DD15097E
Malicious:	false
Preview:	/z......V...R..Qw.m5.".)5.l.b7....z..%.Y[..D.r.....a......^.u........Y...J?.L."...$.T$Qp....E..v..&.....$>...C_.].$........=..@...1........70....l..Z..Kn..]......\|hV...}.....O....$.....4.....t.........2.....8..y...l5.."..d..n.y.mz.2G7H(?:........'a.y.....U.&SG?.6...%..7.y...wE..D...+27...nQ.......\..9..%..g.^..'z...]...\|.....<...w.xF..j...X..K.b.U.]^B....s.....R.1.....3+..w...i6Q...28M...6wE.P..._.../$....).f...H..?.....T.d....^y/9....qI..g_.K..vI...[V."1.2:.T...r./...[..;.xp<.M..p._.%~._.3..#.l..gk.I...en5`...J7...8.`R\|../.....{_...x.Z...c.%L.izt.Jn.....cxI.]x.oC..2.......N..l.7..&..uA.D(n..5 ..:..b.J..m2.v...1.....h......c...h/.v.U&.6..E.........q=..xc?...f..0...:...h.h....0J6I+.`I........./m..F...f..hc.......F.....f..]/...\..>.7I1oe...#....F.. ..Fn.O.m.;QE..Y.Vj7.........;..O...4...[..f.!.Z....L.[_....\W..X..7..z.I.k.....]..u.Y......q.s..B].a.<9........=_....J..xL>43y..O.7._r..t...G....{.5.AY.uI.g\|.m........G.S.L.......D.&...

C:\Users\user\AppData\Local\Malwarebytes\data.db-journal

Process:	C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.28499812076190567
Encrypted:	false
SSDEEP:	3:7FEG2l/7OqdlFll:7+/l/7O
MD5:	DDFC62E1C49086A79DCE1F4F6D84A895
SHA1:	E20D970F042F463C2AB1EC29B65E0C0AE1C524A5
SHA-256:	0F167A47F57288266852BAE9D2C14158C9F8C0CEB32202BDD7F38971D0A647B4
SHA-512:	123FFDCB8D0078E5C43E242739170EC7A1853E4CC29C467E68CABC2D058BCE2E46741F730895A21C17DC1C7E9D83EA2B3EEF2F6D085DD445F1DA80B043E8A7C8
Malicious:	false
Preview:	.... .c......k>.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Malwarebytes\data.db-shm

Process:	C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.13409391453493325
Encrypted:	false
SSDEEP:	12:akIklyMl/cOl/Pml/0l/hN+AeCHg12dkWPv:vZMEcOFi0rReCAokIv
MD5:	62DCD08C6553CFA43899DF3898B76386
SHA1:	60861EF8646D3C6A9FD689BAA883422F77713A88
SHA-256:	A0A66593BB73ED207CAE33980B4FE86359D14B639C6F241730EE75662FFFCC76
SHA-512:	773D48939044FA6852D021BF6EBC0C4C035A55C20C940B9CA438696F4189B4B935888FAADD7BDBC1E8CAC545B945DBA29495B6E5F4D58DF604FA5EE4031305AB
Malicious:	false
Preview:	..-.............r.......u1.Y...K..\:.Q......d..-.............r.......u1.Y...K..\:.Q......d........r...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Malwarebytes\data.db-wal

Process:	C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	469712
Entropy (8bit):	7.999122816838679
Encrypted:	true
SSDEEP:	12288:/mXpzXYQv5GhPC9bUki/LcRIdB0Dckw5NtsrJ:uZzoQxcPIUkG0MuB/rJ
MD5:	4EF0764620BBBEE98F2D8393BD866666
SHA1:	5E7CC0AD913694418C57AB8CAFF11D4DE8FF649E
SHA-256:	D36A5BF84C4D454B27D8A232BF60621A9A00EB5C66AABE2CAF4F091ADCDBFFB0
SHA-512:	BD0AF92F60E12E94D50064F43316FAF10BE6955EA7CC48C72F1FF102E8D41A1E85FCD566E0CCBF359857502217A3125C9014EE20B48687F6DABA94E867FFC780
Malicious:	false
Preview:	7....-...........K..\:.Q.N...a..........K..\:.Q..o.n./z......V...R.v4...\|kZ..D..8.H.z$.q.m\.i.1.`...~....._.[r._p..D.r[.j..V.0.....A.).EO.he~.MI.S_a..IRO.{.J.t.F...K.?h.B.........i..<.y..4....=..erX\..3......X.....ag.ej..H....<.9.#...E.S../.^h:............I.H...:..L'..'"Z"....i.a#....... 3d.i}c..A...R{B.....c.!aq..x.=.....t~...S.T.....eW..........x.s......s...h.6.a."T.M.L...7]..[.v.,....-OR.B.."....w.V.....-g..f.j..K.2..u(...?......"+.!......-.)........8.B.W.Q...{..q..:.....@...@4..8l..F.)..nYM......g.z............@lu.O#8\.1..:......k[.2k.]...(..%.0..U...l .........E........r ..).....y..E.K.a..HW...F..,WEu.p.]P....<...N..[.;........Ve..f........1.B...\.`Np...fP\|....b..J,..XJ.....mk........hOu...o..l..k..S.4..{ O.!!..er.bw....dz.......[.UD.i..w.c....<.`..X....[b....T...xo.Z.,).$.A./5.L........O.Z.P.6G..h.X8..}R..T..+.~B9.....".Ys.tQ'..@..b2Z.*A............QfR7.m.h3........:....!.`...g.}....y.^.\|....c.>.s.4M.OA...?rd......._.O..

C:\Users\user\AppData\Local\Temp\mbsetup.log

Process:	C:\Users\user\Desktop\MBSetup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	9310
Entropy (8bit):	5.294490619747723
Encrypted:	false
SSDEEP:	192:/g9viCA5raYwF6JrR03sHWZ6M6mTUfqOuxZhAb:/ghirrGswiu8BwO
MD5:	FC2EB98C9389CF6ACA7D8D07C841C2B6
SHA1:	17F8F23B8E910CEC9444CF9FF54FD560350E5EBA
SHA-256:	A4EC81E398C6C70807CDC3CCF94D673BE3C8D868DA86545ED35058BF8F37F9A8
SHA-512:	743AC69DEB970CEB2447F6C411722AE1E67DE06E7840EFD7DCEDB9473C7C3A9715E7C107D6017ADC852F730FBF93ABB4FE29327DFEB7A579ED90D42DA5D3BAFA
Malicious:	false
Preview:	..===== Install started 2024-04-17 10:53:19 (UTC +0200) =====..2024-04-17 10:53:19 (UTC +0200) c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\mbsetup.cpp:207: setting working directory to 'C:\Windows'..2024-04-17 10:53:19 (UTC +0200) c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\mbsetup.cpp:217: Parsing Command Line: ..2024-04-17 10:53:19 (UTC +0200) c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\mbsetup.cpp:241: MBSetup mode : installing..2024-04-17 10:53:19 (UTC +0200) c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\mbsetup.cpp:4010: Looking for Privacy VPN..2024-04-17 10:53:19 (UTC +0200) c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\mbsetup.cpp:292: This is an ONLINE installer build...2024-04-17 10:53:19 (UTC +0200) c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\mbsetup.cpp:317: MBSetup version 5.1.2.88..2024-04-17 10:53:19 (UTC +0200) c:\jenkins\workspace\mbam-windows\a_mb5_mbsetup\src\mbsetup\mbsetup.c

C:\Users\user\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.4593089050301797
Encrypted:	false
SSDEEP:	48:9SP0nUgwyZXYI65yFRX2D3GNTTfyn0Mk1iA:9SDKaIjo3UzyE1L
MD5:	D910AD167F0217587501FDCDB33CC544
SHA1:	2F57441CEFDC781011B53C1C5D29AC54835AFC1D
SHA-256:	E3699D9404A3FFC1AFF0CA8A3972DC0EF38BDAB927741E9F627C7C55CEA42E81
SHA-512:	F1871BF28FF25EE52BDB99C7A80AB715C7CAC164DCD2FD87E681168EE927FD2C5E80E03C91BB638D955A4627213BF575FF4D9EECAEDA7718C128CF2CE8F7CB3D
Malicious:	false
Preview:	... ftypisom....isomiso2avc1mp41....free....mdat..........E...H..,. .#..x264 - core 152 r2851 ba24899 - H.264/MPEG-4 AVC codec - Copyleft 2003-2017 - http://www.videolan.org/x264.html - options: cabac=1 ref=3 deblock=1:0:0 analyse=0x3:0x113 me=hex subme=7 psy=1 psy_rd=1.00:0.00 mixed_ref=1 me_range=16 chroma_me=1 trellis=1 8x8dct=1 cqm=0 deadzone=21,11 fast_pskip=1 chroma_qp_offset=-2 threads=4 lookahead_threads=1 sliced_threads=0 nr=0 decimate=1 interlaced=0 bluray_compat=0 constrained_intra=0 bframes=3 b_pyramid=2 b_adapt=1 b_bias=0 direct=1 weightb=1 open_gop=0 weightp=2 keyint=250 keyint_min=25 scenecut=40 intra_refresh=0 rc_lookahead=40 rc=crf mbtree=1 crf=23.0 qcomp=0.60 qpmin=0 qpmax=69 qpstep=4 ip_ratio=1.40 aq=1:1.00......e...+...s\|.kG3...'.u.."...,J.w.~.d\..(K....!.+..;....h....(.T.*...M......0..~L..8..B..A.y..R..,.zBP.';j.@.].w..........c......C=.'f....gI.$^.......m5V.L...{U..%V[....8......B..i..^,....:...,..5.m.%dA....moov...lmvhd...................(...........

C:\Users\user\AppData\Local\Temp\{242af0bb-db11-4734-b7a0-61cb8a9b20fb}.xpi

Process:	C:\Users\user\Desktop\MBSetup.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	18075960
Entropy (8bit):	7.998854055144424
Encrypted:	true
SSDEEP:	393216:mjEFYgVasEPpFob3HTcAmoynSDp/XME6/nH+ym9glPqF:mfgtEvoPcAmomk/8E6/H+ymh
MD5:	D69098824CB3F15EBA951CC1848BCC85
SHA1:	3BCA5A826847B2F6FE2B94EE4654422FAC01FAC9
SHA-256:	34AF720775485B541BBFB13FAC5F23CFB8879D732E9614607FEA4F103B00E25C
SHA-512:	D8C22D01CC4B6CCF518B9C51370E232C61D928F511813938D03F0411DA4C92EF3F8AB1403A001B803F8F218BB459A5A1E605A431265C59F41A0CA6E2E5F77726
Malicious:	false
Preview:	PK............................809fb28f111232930ae4.svg,.... ...UH_....s.....#..:./]..o..C..V...>S~.\{.Yg.S5..6.@...@!z.^s\5fR.D..b$.p.a.)...X....yn.......PK..(y..f...v...PK............................3b8a0aa5e9ad69a1fc02.svg,.... ...U..z5.8L...p....:./]...w.l.....k..}.\G..S.0.[.g..y5........+@Q...bH....#@U}...s{......PK...)X.a...n...PK............................background.js..s../....`..2#4@..Di.1.%J.lA.M8Z..UMN....03.........9..[...=...{..Yg#;.&v.IU6.a.../..s.......#..)..~y...~...... ,.{[.h..o..../..).h)...I.^.......E....]..~.....N....e....'a....ts.l.~w.x.>...u..,/,8......./.?o..:..?.........w.\.../-....Y..[^....e....L...'..r 9s.C..e.!i.]#1....0..x.Gq.&T..{?..0.Kd<...`c...uT.v-b.......H.#.{.#......n/Z..B+....F.4.~o.B..!.uc..s..=.T.s]R..~....._.q..-..u..%a..p.+.~.UJB.^....k...={b8..L...K....[a.G.xT."...JI&..'..Gb.*qmk....U.kq...../..Zv%..i.+..u.e...$v.n..Y1.03...v..x$..'+...$l.....M.0q."._..ad.m,.Z=..S.i.n......{..>..y........Q..>(1uY.M.e..F;....;.8.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\ExperimentStoreData.json (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3621
Entropy (8bit):	4.929692974496455
Encrypted:	false
SSDEEP:	48:YnSwkmrOfJNmPUFpOdwNIOdoWLEWLtkDLuuukx5FBvipA6kbbXjQthvLuhakNU9m:8S+OfJQPUFpOdwNIOdYVjvYcXaNLHJ8P
MD5:	AFF2CE185157E63AC39AC5EFBFD8FAE4
SHA1:	50C1C276CE31F0B02882AE51CD95A1B11B27434B
SHA-256:	BFA9BF28224F41D75A9C4BECCDCF9293FA1AFEBE764F3422E72F19FA854F00F4
SHA-512:	2A3EFCBEC3939C23459B3256135EF6B9DBAEDBCF3C20FFA6CC5A662FAF8BA9C59EF24CF6B88CA9AD6F884C178886EFE9675014F35A2F318B4F39DE50AEF78C81
Malicious:	false
Preview:	{"csv-import-release-rollout":{"slug":"csv-import-release-rollout","branch":{"slug":"enable-csv-import","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pre-95-support"},"features":[{"value":{"csvImport":true},"enabled":true,"featureId":"cm-csv-import"}]},"active":true,"enrollmentId":"c5d95379-f4ee-4629-a507-6f15a0e93cd4","experimentType":"rollout","source":"rs-loader","userFacingName":"CSV Import (Release Rollout)","userFacingDescription":"This rollout enables users to import logins from a CSV file from the about:logins page.","lastSeen":"2023-10-03T11:50:29.548Z","featureIds":["cm-csv-import"],"prefs":[{"name":"signon.management.page.fileImport.enabled","branch":"default","featureId":"cm-csv-import","variable":"csvImport","originalValue":false}],"isRollout":true},"serp-ad-telemetry-rollout":{"slug":"serp-ad-telemetry-rollout","branch":{"slug":"control","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pr

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\ExperimentStoreData.json.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3621
Entropy (8bit):	4.929692974496455
Encrypted:	false
SSDEEP:	48:YnSwkmrOfJNmPUFpOdwNIOdoWLEWLtkDLuuukx5FBvipA6kbbXjQthvLuhakNU9m:8S+OfJQPUFpOdwNIOdYVjvYcXaNLHJ8P
MD5:	AFF2CE185157E63AC39AC5EFBFD8FAE4
SHA1:	50C1C276CE31F0B02882AE51CD95A1B11B27434B
SHA-256:	BFA9BF28224F41D75A9C4BECCDCF9293FA1AFEBE764F3422E72F19FA854F00F4
SHA-512:	2A3EFCBEC3939C23459B3256135EF6B9DBAEDBCF3C20FFA6CC5A662FAF8BA9C59EF24CF6B88CA9AD6F884C178886EFE9675014F35A2F318B4F39DE50AEF78C81
Malicious:	false
Preview:	{"csv-import-release-rollout":{"slug":"csv-import-release-rollout","branch":{"slug":"enable-csv-import","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pre-95-support"},"features":[{"value":{"csvImport":true},"enabled":true,"featureId":"cm-csv-import"}]},"active":true,"enrollmentId":"c5d95379-f4ee-4629-a507-6f15a0e93cd4","experimentType":"rollout","source":"rs-loader","userFacingName":"CSV Import (Release Rollout)","userFacingDescription":"This rollout enables users to import logins from a CSV file from the about:logins page.","lastSeen":"2023-10-03T11:50:29.548Z","featureIds":["cm-csv-import"],"prefs":[{"name":"signon.management.page.fileImport.enabled","branch":"default","featureId":"cm-csv-import","variable":"csvImport","originalValue":false}],"isRollout":true},"serp-ad-telemetry-rollout":{"slug":"serp-ad-telemetry-rollout","branch":{"slug":"control","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pr

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addons.json (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	3.91829583405449
Encrypted:	false
SSDEEP:	3:YWGifTJE6iHQ:YWGif9EE
MD5:	3088F0272D29FAA42ED452C5E8120B08
SHA1:	C72AA542EF60AFA3DF5DFE1F9FCC06C0B135BE23
SHA-256:	D587CEC944023447DC91BC5F71E2291711BA5ADD337464837909A26F34BC5A06
SHA-512:	B662414EDD6DEF8589304904263584847586ECCA0B0E6296FB3ADB2192D92FB48697C99BD27C4375D192150E3F99102702AF2391117FFF50A9763C74C193D798
Malicious:	false
Preview:	{"schema":6,"addons":[]}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addons.json.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	3.91829583405449
Encrypted:	false
SSDEEP:	3:YWGifTJE6iHQ:YWGif9EE
MD5:	3088F0272D29FAA42ED452C5E8120B08
SHA1:	C72AA542EF60AFA3DF5DFE1F9FCC06C0B135BE23
SHA-256:	D587CEC944023447DC91BC5F71E2291711BA5ADD337464837909A26F34BC5A06
SHA-512:	B662414EDD6DEF8589304904263584847586ECCA0B0E6296FB3ADB2192D92FB48697C99BD27C4375D192150E3F99102702AF2391117FFF50A9763C74C193D798
Malicious:	false
Preview:	{"schema":6,"addons":[]}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\content-prefs.sqlite

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 5, last written using SQLite version 3042000, page size 32768, file counter 5, database pages 8, cookie 0x6, schema 4, largest root page 8, UTF-8, vacuum mode 1, version-valid-for 5
Category:	dropped
Size (bytes):	262144
Entropy (8bit):	0.04905391753567332
Encrypted:	false
SSDEEP:	24:DLivwae+Q8Uu50xj0aWe9LxYkKA25Q5tvAA:D6wae+QtMImelekKDa5
MD5:	DD9D28E87ED57D16E65B14501B4E54D1
SHA1:	793839B47326441BE2D1336BA9A61C9B948C578D
SHA-256:	BB4E6C58C50BD6399ED70468C02B584595C29F010B66F864CD4D6B427FA365BC
SHA-512:	A2626F6A3CBADE62E38DA5987729D99830D0C6AA134D4A9E615026A5F18ACBB11A2C3C80917DAD76DA90ED5BAA9B0454D4A3C2DD04436735E78C974BA1D035B1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......\|....~.}.}z}-\|.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite-shm

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.035699946889726504
Encrypted:	false
SSDEEP:	3:GtlstFuqQMYr6PK6AIlstFuqQMYr6PK6AfJ89//alEl:GtWtsqQZr6yuWtsqQZr6yn89XuM
MD5:	6192F5E5639A7AB7DF080CAE5DACCD61
SHA1:	53451B808A8E96D17763882AF0910BF242D65623
SHA-256:	19FAED56EF54D141FF266F50F9A5254A90DAD5659FABB8349DC77983EA5F6367
SHA-512:	3D41A2373A91C65D80D1C86256FAAB05C2B2A589DCAA6EADA060F8B1A573C549287866091C4551487C714F5D7FD23A5E44A70F63BCC70CDA1576A8C4262581AA
Malicious:	false
Preview:	..-......................jX.6,w.i..[m=..;....i.P..-......................jX.6,w.i..[m=..;....i.P........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	32824
Entropy (8bit):	0.039350364946187016
Encrypted:	false
SSDEEP:	3:Ol1xqIYnJaZ4lfM/4k6l8rEXsxdwhml8XW3R2:KjYnJai+Cl8dMhm93w
MD5:	028E4602342D15F3F32FDFA3F1934456
SHA1:	C60763B91827E7386B00BFC15A2427CE5EDA7D11
SHA-256:	0AB4A47C5BA7E762C95C37774D120DA51916FDE764A5587CC721525E25A4E433
SHA-512:	21D8451C21BF458935C8BF7786C7D21233E27A2EB38B3FA44EF552658672C1742644FFA55E08A016442455E9147E8974BA47967550455FCBFEE33AABDAC9D52B
Malicious:	false
Preview:	7....-..........i..[m=..1..\|............i..[m=...Xj..w,6................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs-1.js

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	12058
Entropy (8bit):	5.496165953599736
Encrypted:	false
SSDEEP:	192:9naRtLYbBp6Rhj4qyaaX86KwvNf05RfGNBw8dYSl:gejquTUcwL0
MD5:	BD7C5B6E9454428E455007C4941D7B77
SHA1:	BB1C47702D0BDEB3D7DB76075EE38682766B1D75
SHA-256:	6D76EFCAAAA80D61BE6C917CEE6111A52543C95404DFA9433A89EBBF0C3698EB
SHA-512:	C02B1A12FC09738232F52269AF7A3465A4DD078C04A41C09D183EBA28BE2B7152374F72F2A943541F8B4B85AE4878FB316072DB46D763A4D84CA19CC48CEDBFB
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 1);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1713344109);..user_pref("app.up

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	12058
Entropy (8bit):	5.496165953599736
Encrypted:	false
SSDEEP:	192:9naRtLYbBp6Rhj4qyaaX86KwvNf05RfGNBw8dYSl:gejquTUcwL0
MD5:	BD7C5B6E9454428E455007C4941D7B77
SHA1:	BB1C47702D0BDEB3D7DB76075EE38682766B1D75
SHA-256:	6D76EFCAAAA80D61BE6C917CEE6111A52543C95404DFA9433A89EBBF0C3698EB
SHA-512:	C02B1A12FC09738232F52269AF7A3465A4DD078C04A41C09D183EBA28BE2B7152374F72F2A943541F8B4B85AE4878FB316072DB46D763A4D84CA19CC48CEDBFB
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 1);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1713344109);..user_pref("app.up

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\protections.sqlite

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 1, last written using SQLite version 3042000, page size 32768, file counter 5, database pages 2, cookie 0x1, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.04062825861060003
Encrypted:	false
SSDEEP:	6:ltBl/l4/WN1h4BEJYqWvLue3FMOrMZ0l:DBl/WuntfJiFxMZO
MD5:	18F65713B07CB441E6A98655B726D098
SHA1:	2CEFA32BC26B25BE81C411B60C9925CB0F1F8F88
SHA-256:	B6C268E48546B113551A5AF9CA86BB6A462A512DE6C9289315E125CEB0FD8621
SHA-512:	A6871076C7D7ED53B630F9F144ED04303AD54A2E60B94ECA2AA96964D1AB375EEFDCA86CE0D3EB0E9DBB81470C6BD159877125A080C95EB17E54A52427F805FB
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......x..x..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionCheckpoints.json (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionCheckpoints.json.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\recovery.jsonlz4 (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 5283 bytes
Category:	dropped
Size (bytes):	1432
Entropy (8bit):	6.266885779965319
Encrypted:	false
SSDEEP:	24:vO/MS+vIC+AT5suf0cZD611HFbUjZSCgLPCxA7PiLdVcNdvXfQEG0yCYD1KZrVMy:W/Mnvnz/8cZ6/0JduXXQW0KM/LR4
MD5:	B6228922B192232966A18F748A632B8A
SHA1:	1FDC9654802F04E272AC82FCDFDA2508B74DD689
SHA-256:	0364F7739B8293089295B2E598AA344603808A996D3F12EEFB3C1C261B47E54A
SHA-512:	AABFFEFAA79616BC0CC525D5D64287670E9120514135E5B16F16EE1AAEB1B3BB2C87A628580EF6FE91B8D37C33FE1D4885E05BBDAFCF9B393D724D44804EA0E9
Malicious:	false
Preview:	mozLz40.......{"version":["ses....restore",1],"windows":[{"tab....],"selected":0,"_closedT..d_lastC...%GroupCount":-1,"busy":false,"chromeFlags":2167541758x...dth":1164,"height":891,"screenX":4...Y....izemode":"normal"...BeforeMinimiz...#..0workspaceID":"1a5ccf63-1000-409f-b5c1-afec7f75d4d9","zIndex":1}...W+.5":1......4..^.@":{" ...Update":1713344119082,"startTim....098974,"recentCrashes":0},"global":{},"cooki....[{"host":"addons.mozilla.org","valu$..A8bad2467092e6ddeb0dfa9e5ea54d86d26790ca7ba2ce88d10cb4604fe726755","path":"/","na..p"taarIdy...ecure":true,"httponly..fexpiry....09337,"originAttribut....{"firstPartyDomain":"","geckoViewS...ContextId....inIsolatedMozBrowsers..partitionKey/.qprivate).0ingF.w0,"userX..3},"sameSi...\|..hemeMap":2},u..D.4u..b.Z....._.1...b.2u..!],...c.!St...1.!d{"entr..0url....bout:home","title":"New Tab","cache..00,"...4,"docshellUU...."{4928f5ff-b473-439a-b63d-349ac3523a33}"9...sultPrincipalURI":null.......ToInherit_base64_.c\"0\":..`\"moz-6..4...:{c0c3c76c-

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\recovery.jsonlz4.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Mozilla lz4 compressed data, originally 5283 bytes
Category:	dropped
Size (bytes):	1432
Entropy (8bit):	6.266885779965319
Encrypted:	false
SSDEEP:	24:vO/MS+vIC+AT5suf0cZD611HFbUjZSCgLPCxA7PiLdVcNdvXfQEG0yCYD1KZrVMy:W/Mnvnz/8cZ6/0JduXXQW0KM/LR4
MD5:	B6228922B192232966A18F748A632B8A
SHA1:	1FDC9654802F04E272AC82FCDFDA2508B74DD689
SHA-256:	0364F7739B8293089295B2E598AA344603808A996D3F12EEFB3C1C261B47E54A
SHA-512:	AABFFEFAA79616BC0CC525D5D64287670E9120514135E5B16F16EE1AAEB1B3BB2C87A628580EF6FE91B8D37C33FE1D4885E05BBDAFCF9B393D724D44804EA0E9
Malicious:	false
Preview:	mozLz40.......{"version":["ses....restore",1],"windows":[{"tab....],"selected":0,"_closedT..d_lastC...%GroupCount":-1,"busy":false,"chromeFlags":2167541758x...dth":1164,"height":891,"screenX":4...Y....izemode":"normal"...BeforeMinimiz...#..0workspaceID":"1a5ccf63-1000-409f-b5c1-afec7f75d4d9","zIndex":1}...W+.5":1......4..^.@":{" ...Update":1713344119082,"startTim....098974,"recentCrashes":0},"global":{},"cooki....[{"host":"addons.mozilla.org","valu$..A8bad2467092e6ddeb0dfa9e5ea54d86d26790ca7ba2ce88d10cb4604fe726755","path":"/","na..p"taarIdy...ecure":true,"httponly..fexpiry....09337,"originAttribut....{"firstPartyDomain":"","geckoViewS...ContextId....inIsolatedMozBrowsers..partitionKey/.qprivate).0ingF.w0,"userX..3},"sameSi...\|..hemeMap":2},u..D.4u..b.Z....._.1...b.2u..!],...c.!St...1.!d{"entr..0url....bout:home","title":"New Tab","cache..00,"...4,"docshellUU...."{4928f5ff-b473-439a-b63d-349ac3523a33}"9...sultPrincipalURI":null.......ToInherit_base64_.c\"0\":..`\"moz-6..4...:{c0c3c76c-

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\targeting.snapshot.json (copy)

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4537
Entropy (8bit):	5.034538300172929
Encrypted:	false
SSDEEP:	48:YrSAYff6UQZpExB1+anOsW4Vh351VxWRzzc8eYMsku7f86SLAVL7if5FtsfAcbyk:ycHyTEr5QFRzzcMvbw6KkCrrc2Rn27
MD5:	3EF5E770653A24D544091C2C15C670F3
SHA1:	79E571F17F66E4502BA9DCDB4C42871610528917
SHA-256:	4B31ED63E0A55E907B387A8C7AE88516308075C6045E99961A0B08154CAEA380
SHA-512:	F058766BA0E24E323A53B3FBC521F5437692A4E18CA7542D589E0EAEA256352132417D1FB2795F877A6F9D023B46F13DA9EF36C117CF2D26483DDD31F27D8BBD
Malicious:	false
Preview:	{"environment":{"locale":"en-US","localeLanguageCode":"en","browserSettings":{"update":{"channel":"release","enabled":true,"autoDownload":true,"background":true}},"attributionData":{"campaign":"%2528not%2Bset%2529","content":"%2528not%2Bset%2529","dlsource":"mozorg","dltoken":"cd09ae95-e2cf-4b8b-8929-791b0dd48cdd","experiment":"%2528not%2Bset%2529","medium":"referral","source":"www.google.com","ua":"chrome","variation":"%2528not%2Bset%2529"},"currentDate":"2024-04-17T08:55:11.895Z","profileAgeCreated":1696333826043,"usesFirefoxSync":false,"isFxAEnabled":true,"isFxASignedIn":false,"sync":{"desktopDevices":0,"mobileDevices":0,"totalDevices":0},"xpinstallEnabled":true,"addonsInfo":{"addons":{"formautofill@mozilla.org":{"version":"1.0.1","type":"extension","isSystem":true,"isWebExtension":true,"name":"Form Autofill","userDisabled":false,"installDate":"2023-09-28T01:41:23.000Z"},"pictureinpicture@mozilla.org":{"version":"1.0.0","type":"extension","isSystem":true,"isWebExtension":true,"name"

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\targeting.snapshot.json.tmp

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4537
Entropy (8bit):	5.034538300172929
Encrypted:	false
SSDEEP:	48:YrSAYff6UQZpExB1+anOsW4Vh351VxWRzzc8eYMsku7f86SLAVL7if5FtsfAcbyk:ycHyTEr5QFRzzcMvbw6KkCrrc2Rn27
MD5:	3EF5E770653A24D544091C2C15C670F3
SHA1:	79E571F17F66E4502BA9DCDB4C42871610528917
SHA-256:	4B31ED63E0A55E907B387A8C7AE88516308075C6045E99961A0B08154CAEA380
SHA-512:	F058766BA0E24E323A53B3FBC521F5437692A4E18CA7542D589E0EAEA256352132417D1FB2795F877A6F9D023B46F13DA9EF36C117CF2D26483DDD31F27D8BBD
Malicious:	false
Preview:	{"environment":{"locale":"en-US","localeLanguageCode":"en","browserSettings":{"update":{"channel":"release","enabled":true,"autoDownload":true,"background":true}},"attributionData":{"campaign":"%2528not%2Bset%2529","content":"%2528not%2Bset%2529","dlsource":"mozorg","dltoken":"cd09ae95-e2cf-4b8b-8929-791b0dd48cdd","experiment":"%2528not%2Bset%2529","medium":"referral","source":"www.google.com","ua":"chrome","variation":"%2528not%2Bset%2529"},"currentDate":"2024-04-17T08:55:11.895Z","profileAgeCreated":1696333826043,"usesFirefoxSync":false,"isFxAEnabled":true,"isFxASignedIn":false,"sync":{"desktopDevices":0,"mobileDevices":0,"totalDevices":0},"xpinstallEnabled":true,"addonsInfo":{"addons":{"formautofill@mozilla.org":{"version":"1.0.1","type":"extension","isSystem":true,"isWebExtension":true,"name":"Form Autofill","userDisabled":false,"installDate":"2023-09-28T01:41:23.000Z"},"pictureinpicture@mozilla.org":{"version":"1.0.0","type":"extension","isSystem":true,"isWebExtension":true,"name"

C:\Windows\ELAMBKUP\MbamElam.sys

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	21480
Entropy (8bit):	6.332949178488545
Encrypted:	false
SSDEEP:	384:HO/iZbhL/Uqqn2+s/+8gpUad+JR9zuspd:PtUR2h5adk9zuK
MD5:	9E77C51E14FA9A323EE1635DC74ECC07
SHA1:	A78BDE0BD73260CE7AF9CDC441AF9DB54D1637C2
SHA-256:	B5619D758AE6A65C1663F065E53E6B68A00511E7D7ACCB3E07ED94BFD0B1EDE0
SHA-512:	A12CCF92BEAD694F5D3CBA7FF7E731A2F862198EFC338EFC7F33A882FE0EB7499FB3FB533538D0A823E80631A7CA162962FBDFD78E401E3255672910B7140186
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%^c.a?.Ha?.Ha?.H.Y.Ib?.H.Y.Id?.H.Y.Ie?.H.Y.If?.Ha?.Ht?.H.W.I`?.H.W.H`?.H.W.I`?.HRicha?.H........................PE..d....2Bb.........."............................@..........................................`A................................................dQ..P....`..H....@...........%...p..$.... ..8............................!............... ...............................text............................... ..h.rdata..0.... ......................@..H.data........0......................@....pdata.......@......................@..HINIT....\....P...................... ..b.rsrc...H....`......."..............@..B.reloc..$....p.......,..............@..B........................................................................................................................................................................................................................

C:\Windows\INF\oem4.inf

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	1906
Entropy (8bit):	5.5538908997445064
Encrypted:	false
SSDEEP:	48:FjfmAP/5H7cXq7lthzHU/lltFDmDQB7581EjEkD:Fj+AnlAXq7ltZHUxp/qeEkD
MD5:	5D1917024B228EFBEAB3C696E663873E
SHA1:	CEC5E88C2481D323EC366C18024D61A117F01B21
SHA-256:	4A350FC20834A579C5A58352B7A3AA02A454ABBBD9EECD3CD6D2A14864A49CD8
SHA-512:	14B345F03284B8C1D97219E3DD1A3910C1E453F93F51753F417E643F50922E55C0E23AAB1D437300E6C196C7017D7B7538DE4850DF74B3599E90F3941B40AB4A
Malicious:	false
Preview:	;..; Copyright (C) 2020 Malwarebytes. All Rights Reserved.....[Version]..Signature = "$Windows NT$"..Class = Net..ClassGUID = {4D36E972-E325-11CE-BFC1-08002BE10318}..Provider = %MBTun.CompanyName%..DriverVer = 09/03/2020, 1.0.0.0..CatalogFile.NT = mbtun.cat..CatalogFile = mbtun.cat....[Manufacturer]..%MBTun.CompanyName% = %MBTun.Name%, NTamd64....[SourceDisksNames]..1 = %MBTun.DiskDesc%, "", ,....[SourceDisksFiles]..mbtun.sys = 1....[DestinationDirs]..DefaultDestDir = 12..MBTun.CopyFiles.Sys = 12....[MBTun.CopyFiles.Sys]..mbtun.sys, , , 0x00004002 ; COPYFLG_IN_USE_RENAME \| COPYFLG_NOSKIP....[MBTun.NTamd64]..%MBTun.DeviceDesc% = MBTun.Install, mbtun....[MBTun.Install]..Characteristics = 0x1 ; NCF_VIRTUAL..AddReg = MBTun.Ndi..CopyFiles = MBTun.CopyFiles.Sys..IfType = 53 ; IF_TYPE_PROP_VIRTUAL..MediaType = 19 ; NdisMediumIP..*PhysicalMediaType = 0 ; NdisPhysicalMediumUnspecified..EnableDhcp = 0 ; Disable DHCP....[MBTun.Install.Services]..AddService = mbtun, 2, MBTun.Service, MBTun.Event

C:\Windows\INF\setupapi.dev.log

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Generic INItialization configuration [BeginLog]
Category:	dropped
Size (bytes):	37444
Entropy (8bit):	5.189024742565676
Encrypted:	false
SSDEEP:	384:OGdni80C/8g0atRf7yr14ujuNY9AZi3Z/oUtwr05hauVVYqFy7ypu4G:Own95cdyYloiwQ+snG
MD5:	5A25197AEB2731FD5040441A3CAF562F
SHA1:	BD4632EB62F1DB5115ABE0D46B1F3482364552D6
SHA-256:	35DED7F897895A0E414ED4FA135299C8A3609972FCE4CC5CE5635027AB48876D
SHA-512:	8CEF3E201CBB5A674DB4CC206C835006FAD0BC603D3A56C24AE707FC5327C68357FD81D4BA77B382276E9EF3A7E3F40E2B769918AF8407C48F381D155CE1EB2B
Malicious:	false
Preview:	[Device Install Log].. OS Version = 10.0.19045.. Service Pack = 0.0.. Suite = 0x0100.. ProductType = 1.. Architecture = amd64....[BeginLog]....[Boot Session: 2023/10/03 09:57:02.288]....>>> [Setup Import Driver Package - C:\Windows\system32\spool\tools\Microsoft Print To PDF\prnms009.Inf]..>>> Section start 2023/10/03 09:57:37.904.. cmd: C:\Windows\System32\spoolsv.exe.. inf: Provider: Microsoft.. inf: Class GUID: {4D36E979-E325-11CE-BFC1-08002BE10318}.. inf: Driver Version: 06/21/2006,10.0.19041.1806.. inf: Catalog File: prnms009.cat.. ump: Import flags: 0x0000000D.. pol: {Driver package policy check} 09:57:37.920.. pol: {Driver package policy check - exit(0x00000000)} 09:57:37.920.. sto: {Stage Driver Package: C:\Windows\system32\spool\tools\Microsoft Print To PDF\prnms009.Inf} 09:57:37.920.. inf: {Query Configurability: C:\Windows\system32\spool\tools\Microsoft Print To PDF\prnms009.Inf} 09:57:37.920.. inf:

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\SysWOW64\drivers\mbamtestfile.dat

Process:	C:\Users\user\Desktop\MBSetup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6
Entropy (8bit):	2.2516291673878226
Encrypted:	false
SSDEEP:	3:Hy:Hy
MD5:	9F06243ABCB89C70E0C331C61D871FA7
SHA1:	FDE773A18BB29F5ED65E6F0A7AA717FD1FA485D4
SHA-256:	837CCB607E312B170FAC7383D7CCFD61FA5072793F19A25E75FBACB56539B86B
SHA-512:	B947B99D1BADDD347550C9032E9AB60B6BE56551CF92C076B38E4E11F436051A4AF51C47E54F8641316A720B043641A3B3C1E1B01BA50445EA1BA60BFD1B7A86
Malicious:	false
Preview:	test..

C:\Windows\System32\DriverStore\FileRepository\athw8x.inf_amd64_55014eff4ceefbdf\athw8x.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x191e0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	230388
Entropy (8bit):	4.256327463251637
Encrypted:	false
SSDEEP:	3072:YlOj+VGC2tf4DEdL73a9gRVb4JKsBRybovrnx0K5kfTG7zc:Y/4Csp2+RiMsBIbovETr
MD5:	DA971BD6B44F05441CFA4AFAEEC415A2
SHA1:	D7BD43845B762188B6C86C2A00947C2E6BAD6B7B
SHA-256:	BEC2E9084B47CC102EC9305FCC3849D796CB77930C17D764AFFEC161392790E5
SHA-512:	1EA4A99557E0476C69ED4EA3A21116EB22F8C8A9C34C6D370EF6454B80393370F95641CE07EDA5AD891E009CDDE339BE30822969F79FB790196A418037FD5D77
Malicious:	false
Preview:	........................oI(......t.........L...........$.......\|..@4.........h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........X.......@.. E...\|......N......t...................h..../.......=.......U...a...\|...F...D......@p..<q...+...P......Ti..4............... 3...\.....0...."..p... j..........\|.......`........... ~..D...\....m......P...L...p5..D.......T...4................Q..4....s.......i.......(.......s..H2......P-.......m..lu...+......HN..8L.....L....k..........,...`...\...$0.......~.....d....................g..xd..$...\............f..p&..,{..\|h......4b...Q..........L...............h...........4...D>..`.......Hm...,...-..8....}..4...................\|.......d-..8,.......'..8......l...\|...........<...\w......H...`D..\|......\g..(.......t...\.... ..l#..............8....\|...!..(....-......XG..,P.......y...'......$Y...&...O.......`......./......8.......\|....B..tH..pl...v......4W..l7..t...(%...0...........W..P8..(M...d......T...............pN...*..................

C:\Windows\System32\DriverStore\FileRepository\b57nd60a.inf_amd64_77a731ab08be20a5\b57nd60a.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x2da58 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	473236
Entropy (8bit):	4.467509898691642
Encrypted:	false
SSDEEP:	3072:AV5Zjelt5v9fIAGCpYLKCVurCACB1sFQ37f9qtpThTyDtN85hlLBmZaaAAhsnsZA:K5WG1sX8Nl07btv0yb5E16u7G
MD5:	8E0D099A64C8881A7DF093A8D37E0D2E
SHA1:	EBAABB1FBB88DF2FF7B7AE845883A306BF9F0FBF
SHA-256:	E12C4CCA4F3018FEA28424C8E1C9B189075A856E631D966F1B42524444BFBAD9
SHA-512:	12BD136749AAC5F252403358D9C2FB0F38554A76392D837B695783BC1A84CDAB269391C899C3804EE640D0D40D00C059E54ED125CBF0A0D06D958D4147703A26
Malicious:	false
Preview:	....................X...QZ.........................h...LJ...%......`8......x...h................8......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...........8....x.........d....Y... ...X..............Lo...6...........5...+.......C...8...g..@...8...\|...dY..H....:..$O..\|............R..\|c..@.......,... ....(...x...-...)..$!..............T......X....D.......S......HN..DJ...g...Q...,..(........%...N..h...X....0..0...............H..,K..d................l......d........b......\I..8r..$'..X............8..P....z...W......................T...S...6..4U..<....4......0....P...-...-..\|.......(...<..............`j......P`...X.....t`..`....F..h...lC..<i........h........J...O..\u......l... ....q...%...........#......R...p...c..d....7.......7...8...V.......+......P....D......d...4....g.......S...J..x.......@q...)..<9..<...(...x...4D..........\|m..\;.......g.......u...h..,.......,..............<....=...........[..."......\|'.........0...Pn...... ....j..Tk..\|...l...(....9..0...0:..l>......{..\|...0.......

C:\Windows\System32\DriverStore\FileRepository\bcmdhd64.inf_amd64_e0bae6831f60ea5f\bcmdhd64.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x6718 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	47348
Entropy (8bit):	3.9590771421645714
Encrypted:	false
SSDEEP:	384:duglypKJqO3pO0b9dONjzZKi6sUL9AsrFkadx2yGHB41IpBd9ThO206QMfE1sF4D:QxK3kNjzZMtx5FkaiyvMf0mDWBPZ
MD5:	4A41255FD19FDC0FE8EB876E64438872
SHA1:	6C9FCA36A6D5A47345C3E64DFFE76739A2F68675
SHA-256:	FF7B1498D972F5A290684C4595C1C8EFCDE0F8F22B6B66B66BD8C8A04E95A772
SHA-512:	FFF565F672D2C97C4EEAB59F3CB5743C03821E9CC12AAD12729F51A26B9FBAE54BA1E7F78F1E97E4BE5B8A4830E9842CA403AB628A2A71C9A94A5E295E44AD2B
Malicious:	false
Preview:	.....................g..oI(.................f..$....h.......j..............P...h......................C.:.\.W.i.n.d.o.w.s..................e...%......./...E.......]..P...............................T4...U..HW...!......x,......l/.................$........C...+.......R...=...0.................. 4......LI..t>.......=..p=..h@...X...X...X..<...<.......TE..`5..8O.......Q..D...@...t<.. c..,R...............5......N.......F......d...........O..........pc..\|c......\3..$3..@(.......V...,......</...S...C..@B..........\|O..$D...W..4....U...]..<U..<H...c......de..pV..0X.......c.......B.......F...........7...^...&...^......\".. _..D_..`_..(Z...Q...Y...(..........(..._..dD...7..._..07......x=..pI..pa..L1...'..l%......<-...H...W...........D...Y...D..."..<2...?...e..H#...H.......(...................;..\|[...........6...-...).......b..L>..TU...........V.......U.......c..L@...........>.......4..d#...1.......I..`H...........]......................<D.......... S..h]..<...XX..."..L)..........P...........

C:\Windows\System32\DriverStore\FileRepository\bcmwdidhdpcie.inf_amd64_977dcc915465b0e9\bcmwdidhdpcie.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x54e0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	39780
Entropy (8bit):	3.9782561863088968
Encrypted:	false
SSDEEP:	384:A18LPqOOYOjdyNxddsomwD1/WcMm7625BpPqTWuiWIXUROrWzACEeSGFdnQP1bxa:hPfdqLUB0TWuiCS1xlB7BE
MD5:	9D4756D1CF33B20D4E367E741D51059B
SHA1:	7FC8F7866E30B800E2588B6348E58E4AEF5DB6A4
SHA-256:	DA8A10A3C243A9669E9070F7A9F678987CE9E3508CE8898B5EEE835D21C7B783
SHA-512:	706DD7DC8F5B8987EB26C56A906AA2409CFDFF031E222AADDABFFA86F504C9116FAC26202B12F2F793A47F71976B776118D5645B43FA07E6B66241CFD378F3DF
Malicious:	false
Preview:	.....................T..o.*......t.........LT.......U..X...0X.......j..8...(...h...............`.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......h8.......=...............-...........K..\.......(R.......................1..dG......P........'......8-...........$......8.......X6..l%.......D..\9.......................1......./...:......h...T9...;...6...P...,......P............2...R.......J..P...T...L8.......C..X.......$....3...$...Q......x.......P$...........R...................)...........".......G...(.......-..\E...?...I..............p?..\|?..H....F...K...F..@2......H........H.......Q..............................."....... ...............&.......................#...................?...........F......................L"...4......`(......................t,........... ..d;...O..X...0B......(#.......................................(...$.......N...9...'..........\H.......F...... @...;..$........9......,2......./......hA...N...........K...................?...?......p....D..TK...........(...#......

C:\Windows\System32\DriverStore\FileRepository\bthpan.inf_amd64_b06c3bc32f7db374\bthpan.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1e30 "Provider", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	10972
Entropy (8bit):	3.661802503981105
Encrypted:	false
SSDEEP:	192:yLVV2oEVWkJAMgL9wjaSx/0ZDcVgWs3y3aj2aX:yLVOXNgL9ZS2aW3copX
MD5:	44B37D3C4A87F3AAC3199573A5F5E841
SHA1:	D576521A8799EED2BB712C746822A0D4CE5EA219
SHA-256:	314281860E888DD7D5532D0C07601CEE38BECFB4EEB64C0AA799BB6B6E3EFD4D
SHA-512:	0AB1C5F5DA739CFB5695BC206B13497299D3BC62831500F84C3B27ED582655ED4C00B7C99081661DC01DB38F65FCB026F9435086496BB55E92282AD10599E589
Malicious:	false
Preview:	....................0...Z.{........................@.......X ..<....#......8'..h................*......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......................................................................0...................................p...................................L...............................H...........X.......\|...T.......P...........................................................................0.......................................................................................@.......................L...........................................l...........................................................@...........................................................................................................\|.......$...............,...t.......................................................................0.......................,...................................@...............................................................0...p...........................

C:\Windows\System32\DriverStore\FileRepository\c_net.inf_amd64_32a9ad23c1ecc42d\c_net.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1550 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-GB
Category:	dropped
Size (bytes):	7412
Entropy (8bit):	3.456841942401006
Encrypted:	false
SSDEEP:	96:uJdaioQpdr0tfHgnNtf/gikF1HO3tBlAry7mv4rxNPGXULjZC9Kcb:uvSfHgrRkF1CynvK1Cl
MD5:	4A7CEABC9B52B5BC01D6E930B821AC53
SHA1:	11FB66F314717B7620FB608E7BA9EB2CD0F3A85D
SHA-256:	20E4EE01706130A981F8589221C5CB5C97F56CEC9283A8A5413643E07E020E3C
SHA-512:	7EA7961E1A535B9F37B48590DDC3918CFA629763F635D5052D4F5D76A346F8B24E6713587056AA2B4AB8470BF58C15CFFEE986BDE0F298705DA3FEAF4E7F0BA1
Malicious:	false
Preview:	....................P...../........................H.......8...................h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.G.B...................................<.......................8...............................................l...........................................................................<...........................................................................................................................................................................................<...............................T.......$...................................................................................................................................................................D...........0...................................................<...............................................................................................................................................................................................................................

C:\Windows\System32\DriverStore\FileRepository\dc21x4vm.inf_amd64_3294fc34256dbb0e\dc21x4vm.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x3328 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	22988
Entropy (8bit):	3.8034488884262934
Encrypted:	false
SSDEEP:	384:uY9KkffKgVhh9Jv2xCB9SAXIjsPaVRI86Mhm65rxa+iDv7G3:x9Kkfvj9JvHMtwDv7G3
MD5:	8E1100B6CE6579FAB65F6C1E2C719AB3
SHA1:	E1E77E922321D517819D7C41FE16D80440752450
SHA-256:	5DC56EA3189C5E7B1DB254888AB2DA03CD3EB0A6F91952F324F8736B634D1D14
SHA-512:	722D2AEA3A72BE6D63E3ED14B2AD5569E8A0027057D3032336E914114373F060C45614E7903C27B8E5BE6AE62F9423A7103F51C44E5A0F8DDD79B73A8170C43C
Malicious:	false
Preview:	....................(3...MD....}............2...... 4.......5......h?..0....L..h................Y......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......<................-..........x...........................................8-......................x...........L...............\...............$'...1.......'...,...........+...........1..D...p"..8....... ........#...........2......0-..........d .......,... ..h............"......<............$.......#......t.......p................#......T0.......&...........'......x........2..0...........L%..d%..L'..\|%..p%..X)......p(...............'.. (...........$..............D&....... ......T,...........$......L#.........................................................,...........%.......#..<$...-..T$...............#...........%......0$..T...........................<...........,+...&...........................0..............................<....................-..(0..................................`$..............L............... ...........................

C:\Windows\System32\DriverStore\FileRepository\e2xw10x64.inf_amd64_04c2ae40613a06ff\e2xw10x64.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x4ad0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	55036
Entropy (8bit):	3.85594806680005
Encrypted:	false
SSDEEP:	1536:mXugMl1Ahj3g3M0/WI5zQ+JVVzclQkGqw17wv3v83mEO2lt8YF2lt88F2lt88N2K:m+gMl1Ahj3g3M0/WI5zQ+JVVzgQLqMNR
MD5:	F213503ABA180457FC55DD7291E054A2
SHA1:	8B32C94D1D55C4106425E6F489E6B6B684BDB1F3
SHA-256:	6203989ABFCF9999989AD997B0AB78360536C142AD5A0318FF73787D18B25861
SHA-512:	3D75FB45EEC410855946199D3DCED55F1FEB12092CE550847ED71DA609846E86FE81A8E20B6B159E213B5B6FE889E83813EBAF0B87F1AD7265AB200FEEA99991
Malicious:	false
Preview:	.....................J...b.................<J..1....K.......O..x!...q...2......h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......8+.......H......L#......@...............\;.......0......,F...C...5.......'...........:...7...9..........X....7..................\|(..........d.......0?...?......@@.......8.......C..\............&...+...(.......6...$...)...0......\|?...@...#...@...... /.......C...0..............($...'...E...........................7..........................(D..............4...p........+...I..`............8...1..HA......L'.......:...........$...B.......B...F...(..........`D..........(2...$..........H...............8...t.......,:..(...............................`6.......................................................,..\................2..<,..............<........3..$+..."..X'..T4...4..L....................'...............:...........................,....... .......!..P"...........8..........d...DD.......:...3.. E.......I..8I...........4......xC...A...3..,.......

C:\Windows\System32\DriverStore\FileRepository\ipoib6x.inf_amd64_ef71073a5867971f\ipoib6x.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x7b50 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	57668
Entropy (8bit):	4.037131427684051
Encrypted:	false
SSDEEP:	1536:oQSZKDuLLaWxLFu/AQh3HSnUFwmLTp4Pq:oQSZKDuLLaWxLFu/AQh3HSnUFwmLTp4y
MD5:	E629426CD031C2EC07DC1812BC67C6C8
SHA1:	DFDEE431B052E252278F97A2F83834BE6A03F5C9
SHA-256:	F590FB80C7F48A3FAEB19CB728EE96C1E05FFBC251E06715621FCF02A3D5E43D
SHA-512:	0A1FE6A3F8E13BA2D4E95FEE1A7D760A6C8E0508D5B06E4E512BA70C2996B405A2274199122D15E440991C93122568DC7A9836F936086ECCCEE76D7850FCED4F
Malicious:	false
Preview:	....................P{..w..................z......`\|.......~..4...P...t$.....h...............@.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S................Z..hn.......f...7...f...................m..Xv...u...............j......D....?..4[...a...B...6...Q.......................5.......A...a..Tw...8...7...\..x9...]......d........x...`..Pm...9...7..l...<S..,0......\4...=...........v......Pj..P5.......p...............m.......R...........3..\Z...S...N..............d...\|.......0....F...y...l..$O.. R...0.......1...6.......F...k......@8...V..ta..................pV...3...]...R...q...0......x3..$o...................[...c..<...(...<...h`...h......$i..........`....m..........po...............;..h=..........$....V..,6...9...........`...n...........0.......l..tz...z..hg..$s...h...s..........."......Lz..................t...............<2.......$......4`...w.......a..............(l...........t..@b.......w..4....S...........B...........T...r...Y......d[...................v..0....Y.......[..T...Xn.......b..

C:\Windows\System32\DriverStore\FileRepository\kdnic.inf_amd64_6649425cdcae9b5f\kdnic.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1a60 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	9604
Entropy (8bit):	3.5475326895572676
Encrypted:	false
SSDEEP:	96:WVVE0TPx0N76qj/m25I5Zl5QRv5/HXovNlz/0JqWVF5v5/6hV6CyaMrmP1+9fYY7:W7xL6j/m2qzlePqAF5vUz0mP1PHI
MD5:	91056F3EF3EB635C4ED602F58A7205B1
SHA1:	A0D83316DE4043B94AA31E7714703FAE8F77E447
SHA-256:	061967C8548926A93424F284B9211CC6834E22ACEC2ACB7ADB471B5A577E0AC8
SHA-512:	D040BD9051ACE171DB97583FEA0BED6757BC0346D5EB790600467ECFA397B39ECB685B8B7B39D75E0EBCF74437AFD20DFB8A882268BB9B55BD7FE83CB30E60D8
Malicious:	false
Preview:	....................`............V.................p.......(...d............"..h................%......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...............................8.......................................................................................................d...............(...................................p...............t.......................h...............................d.......................\|.......................................t.......................................................................................\|...........................................................$.......................X.......................................................................................................h...................................`...........................................................................H...........$.......X.......................................................................................d...$.......................................

C:\Windows\System32\DriverStore\FileRepository\mrvlpcie8897.inf_amd64_07fc330c5a5730ca\mrvlpcie8897.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x3080 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	21388
Entropy (8bit):	3.910530458947307
Encrypted:	false
SSDEEP:	384:klIA2X6YNt0DK/P4jJiJYclrFv1RPhC4AI6X:E2XzNFIjMJYqrFv1Rg4q
MD5:	6D0593B16D9DC42B4401A3C69812603A
SHA1:	3BAF933F2D471C4C3685B0A78C9EBFBBF656B576
SHA-256:	F547E87F0193E84C916D5D834F3E98AA0A941A989ACBED4DC59650605059B502
SHA-512:	1E6D69CE35E25B9E77BCB4AA13789047FB0CC26E0147FEC132359275EE3A2DD61992F3B80D05E6F0D5B8616A2AE1563F8887368F37F44B6CE7260D6F2B30D1AC
Malicious:	false
Preview:	.....................0...].......{........../.......1..X....3..p...X<.......G..h................S......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...............,..................8............................'...)......................................h.......T(..........h........................!......4...(...x...........h...8................ ..P...............t....#......................."..................D.......................x%..............l...............8.......................(................).......'..........h+..........P)...,..h...&..........h...$....)........... ..L'.......................................................,.............................................................................................................. (......................................................................t-......p(...................!...............................'...........................-.............................................../..8/.......(......................$.......

C:\Windows\System32\DriverStore\FileRepository\msdri.inf_amd64_97bef65a8432edd4\msdri.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1390 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	6948
Entropy (8bit):	3.3396517726633754
Encrypted:	false
SSDEEP:	48:ZoQN6ymXAaAXQtkgXqHMjL5qgLD4G+nImh27FVK/93c58Mtrxe2pep7+YUhzQ9XZ:6VyzanRXaMRWbh2HYChJz6oC8Ixj1
MD5:	F249C366031504BE09F7B09046C45530
SHA1:	2C3CAB54893CB778851F8A9DB8B573AB2E5770E0
SHA-256:	A4CDB761AC034A49B4A70E80E0B6D2A712B36FC4DA59C7752DD26A640A290A9F
SHA-512:	AFB271D9CFE4140ABB1B7CE79542FF9D1325A9ACADC89B09DDAB2E295D3728F6F379602A39760890D8BD91EAEF665C0D55C25CC17D0B5B54053A350CADA7484B
Malicious:	false
Preview:	...............................T......................@...........`.......@...h............... .......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......0...................................................................................................P...........................................................................\...................................(.......................................................................x............................................................................... ...........................................x...................................................p...................................................................................................................L...........................................................................................................(...........................................x.......................................................................................................X.......................

C:\Windows\System32\DriverStore\FileRepository\msux64w10.inf_amd64_5aa81644af5957b3\msux64w10.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x4900 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	35804
Entropy (8bit):	3.948302811511412
Encrypted:	false
SSDEEP:	768:hJi5qeh4CI1aVF5CQLNAxFt/4yxtREtURMy27S+LuMj7tTMZTyMlP7jLc+DlqQ3R:hs5iaVF5CQsREl7S+LuMj7tTMZTyMVcc
MD5:	7E98646E0B733EE1995106D1EEAC5B29
SHA1:	3D57642EBBCDDF2CFB8460504CB51517DDA62C92
SHA-256:	74B9BE831AEF65963D91F504C793D376CC28D1865C503ADB90B5A1D214A2E87A
SHA-512:	AA2D785E52C1B1D2B929F39F846BDD5C7DE5470900212DEBA3D689A6E531AF2E22BEBA75057A5B0DF93B1F73EAD9D19F77DCC5F0C5B2CCAB6C6DDE12486075A4
Malicious:	false
Preview:	.....................I...........b.........lH..(....I.. ....M.......].......t..h......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........-...................1....... ...;......`2......\3.......5..............(@..........................X....$.......................(.......,.......E......48..40...8.......!..........@F...........'...+...(.../..\-.......'...G...........)......t9...........B......\=......l+.......&...8..P0..........................................d-...............A..........T...............tG...................G...A.......A..$'......P........$.....................................................,...h...............X....................<......................t...................................................................X.......d(..P..PC..................<)..p....>.......>..`...(?..........d....................F..(........"....... ...............C...........E.......'.......1..............4A..h?...........>...:..,...0H...G......h...T...........@?..x>...+......

C:\Windows\System32\DriverStore\FileRepository\mwlu97w8x64.inf_amd64_23bc3dc6d91eebdc\mwlu97w8x64.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x2a98 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	18340
Entropy (8bit):	3.82528128837348
Encrypted:	false
SSDEEP:	384:Y/NRU2IAOXybcl5qjbGA+Q2Ac4GlWVNDNx7bRVmZMT:aXU2IAXbc4bGAj2AczA7bRVmZMT
MD5:	0D845C9CA34B0EBB5CCF230034671C07
SHA1:	5A6453CAE53F74CDE7D19C7838FB59629C5F27D7
SHA-256:	48F5E1B449642A3EF53511952932F604AFB710BCBB0054B0EFB648F2519B9E31
SHA-512:	A2E7D056890B4FD7B0FE21232FA9F73EC010EE9548C958F1BFB13BFB19EEA39A124DEC0247329B1D643E06958B87F734D9501FF4430EFF44BF452857A785B64A
Malicious:	false
Preview:	.......................M%......R..................+.......-.......4..x...(>..h................G......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...............................0...........h#...................%..............................................................@......................., ..................................t...8....... ........... ....!..x(......l ...............(... ........... ...#......................$%...........#......................................................................t........(..p"..............d... "......($...(..................H....%......,...L'..........................................,"......`.......4...........................................................t$...........................&...............................$..........."...........#..................................H...................L........................$..........................P.......................................................d)...)...........!...!......................

C:\Windows\System32\DriverStore\FileRepository\ndisimplatformmp.inf_amd64_8de1181bfd1f1628\ndisimplatformmp.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x32f8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	21852
Entropy (8bit):	3.85981011126826
Encrypted:	false
SSDEEP:	384:90wm4iSEHwjj8WsM4w3KgK4RK4KmcKeKFGKYKHTK7KECKEYwxjr5I0Lmin7w30Ix:90wm4iSEHwjxL9R9zcf0GVCTWxCukmu8
MD5:	8123835B5D6552DBBE8B1F398C387409
SHA1:	AFCCEE58B29CA6C1281BFD4FA83FDF6B4D1AD20D
SHA-256:	D86E095EE87E294D913FB50C4B2767BF340D3D963D3BCEE8CEA7535A5A21BF42
SHA-512:	E15DD6780A046D60D485D766AC879F2E594C51573C46FAD60D6D4E3E958CDDAED31AE4EE60DAC7503E18D8460E731BD174FA5DFFD75B1C3821AFD794DB5ED033
Malicious:	false
Preview:	........(T...........2...........b.........h2.......3.......4..L....=.......H..h...............XU......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......4"......(..................................................d..........................\*..........\...............................................d...H'.......'..........0........................"...#..4#.......$...................'......D(..........,!...............!......l........(..................................`....................................'.......(..............................t"......h........................................-......................\)...!...............................................)..................................h........................................ ..........t...L........... ...0/......D............................................1.............................. 1......................T-..T0...................................................#.......................-......0...................t.......d...

C:\Windows\System32\DriverStore\FileRepository\net1ic64.inf_amd64_5f033e913d34d111\net1ic64.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x10650 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	129964
Entropy (8bit):	4.167125797211877
Encrypted:	false
SSDEEP:	3072:ZAnbg5V+26+kce+nKUShBBTnZN57veQcbfb4Rf2B2ucte9k7rzE:fe+Chcbfh
MD5:	187126238332F8CBF142EC69F623A4AC
SHA1:	52E491890350C1EABE906095B46BB702533A5F47
SHA-256:	5FC80FE23224C7133CE2AD288C4A403B15968A710F3A217F76B138C942231BB1
SHA-512:	96FE497C58F08446714873EB9A4AA3A1F7D918DF12B8F580D8555A418F8ADE70421A69A890265B7A387264EEDAA5AC9DFB48D0BD885B78C6D7AFE94097757DC4
Malicious:	false
Preview:	....................P.....\....:.}.................H...d........B...X..dQ..0...h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......4.......x................Z..\|[......\|...p...................t...H.......p...p.......h...................8...P...D....]..d..............h.......T........................\......`...D...................d...(...h.......0.......0...He..H....d..P...........(........d.....p....'...G.............../.....`.......x............+..l...........T...d...........L.......................................0...........,...L........................8...........................+..\,...-..............4....3.../...3...1..l2..................0...$...........o..l...............d........g..8.......4........!......x...................Dp..,................................$...:.......5...6..t4..........<...........x.......p...t.......@...x...X...d!..l...............H........q..x...d....t..........H........x......d...X...t...........<..................d...$...l...x.......

C:\Windows\System32\DriverStore\FileRepository\net1yx64.inf_amd64_8604d8a50804b9c1\net1yx64.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x5520 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	39012
Entropy (8bit):	4.00429852776567
Encrypted:	false
SSDEEP:	768:o9/DoMjmeHYM0cpSXHc2PnL/VKhtPY7h2FjnzNsWMEMc+JmhdpyLE:m/NHYM0cpI5LP7h2FjnzNs7mhdSE
MD5:	51E29FF2A7D0FC6A11E7350B4E5119DC
SHA1:	8A4EDDB490A68DB1AEEEFB89A7B4BDA6FDA49729
SHA-256:	EB2900351CA5FBADCD111864382C45018214386FD9198C7FD1E3CCE98BC9DB49
SHA-512:	4A1FE44CD9B026C1275205DF6B1B5C59276C557D46CD015427F60B2516EA6AA8D7B9B51829AE3639CD55879D8280E823F0FA21E380F48A38240E8785C6105353
Malicious:	false
Preview:	.................... U..w..................T..!....V.......X..\|...0j......H...h...............`.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........?.......K..............<&...&..........t........=..p...d>..........d$...6...............L...........%..........\9..........$....5..........(;..lS......DG.......G.......F.......M...R...........4..T9...5...8...I..H3...M...S...........G...............-...7.../......X0..X!.......2..T6..................,...\F..............8............................A...............%.......S...............:...T...................A......l'..d3......,.......HI...........6..............dD..................................x3.......:......................tI..4.......$....A..........X2...................C.......C......P.......l:..............\7...N...7...K..t........ ..."..."...#..8$..........L....2.......... I...........Q......D:..X...........X.......\|M...O......$....J.......4..........X....C...................K......dC......TT...T...................... D..............

C:\Windows\System32\DriverStore\FileRepository\net44amd.inf_amd64_450d4b1e35cc8e0d\net44amd.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x59d8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	45092
Entropy (8bit):	4.037984090573503
Encrypted:	false
SSDEEP:	768:Ik4MjoP6y6efrxgZ0vLxTfPTVpDekxcFCkseDiz01:F4MjoP6cPTVpDUPP
MD5:	EC1198836C08A53B399B40B346DA8D94
SHA1:	C8F71596BF466D612213B402F3D80E09B649DEB7
SHA-256:	F260BC82812B79BE2E01FB7D52BD0E2CF3752C6AD9095CB49C25F53CA8059902
SHA-512:	7D7DC11D595E77F61C9E5BF0BAA427042918C3BD5474457FD63ECE7236BB08952D5404567FD175F52A3418937B6FE9409A88DE27879B50DA54591331210BA3A3
Malicious:	false
Preview:	.....................Y..L.......R..........DY..3....Z.......^.......t......p...h............... .......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......$1..t1...1...2..d2...7..d..../..L6..x...$....................................T...................................................?...A...R......hJ..................PL...........;..,<..<5...5..T...4....<..T3...0..l:...>...J.................. U...........T...............O......d.......,................9......d;.......................4...................................L...U......`7...H...........P.......?...................=......................xL...........N.......V..P.......................tG.......................M...................O......4A......X................R.......Q...F.......G.......................E..L........W..............................h...................<7.......................H...N...............................W...................>...................................................V..4V......P....D..........................

C:\Windows\System32\DriverStore\FileRepository\net7400-x64-n650.inf_amd64_557ce3b37c3e0e3b\net7400-x64-n650.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x5bc0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	43844
Entropy (8bit):	3.991147108802528
Encrypted:	false
SSDEEP:	768:4AlvFsnnGPAtQVcI+1qj6LjNnZJJLRHxZ0H7FhICvkZmIl6:4AvFsnxtQVcI+1A6LjNnZJJLRHxmH7vh
MD5:	75C626EC96E92B23B15EFCC1A211FD19
SHA1:	06B01EF8D26E1010386A812F1F204D58C1A990D7
SHA-256:	F436C54C5363975DF7F6CDF9226C538AD4AED32551E909E2F4346BF6DC469F94
SHA-512:	91D8D9B8F9C11F30E0FF75325DF58695F5CC033066DF9E5620060E0138A7C57B18C915C1C7A420F145694CC26EFBB5DEE9B91B9B5EF3D1D40772C7D41C38B5D6
Malicious:	false
Preview:	................x....[...........b.........,[......8]..\|....^.......s......x...h...............@.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........9.......E...........M.......M.......7...J..........0*...................S...........,...R...%..4...d&..........\|................7............... ..8K...K.......(...............'..h9..........x5...:...7......\<..d6......\>.......K...L.......L......LB...9......."...............6...G...F...........Q...;...............................................F..8!......p2...........Z.......F.......>...>...?..4?..X?.......@..x....@...6..............tD...........B..................8C..0........................)..........(.... ...,..0.......8....................B...I.......2...3..............$A..LA..tA...A..\|... =.......3..,............................!.......!..........41..`'...................+......................0<......................\Y...T...S..............$5......,...\.......\4..........................42...Z..\|Z..$....&...4...........E..............

C:\Windows\System32\DriverStore\FileRepository\net7500-x64-n650f.inf_amd64_cc87c915f33d1c27\net7500-x64-n650f.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x47c8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	33036
Entropy (8bit):	3.961425747350629
Encrypted:	false
SSDEEP:	768:F/vtE1VcIOjTnVgUpXJ/pgHx/Y1vRfnOd:tvS1VcIOjTnVgUpXJ/pgHxw1vR0
MD5:	3B0360D89C583CE0E29F80A2E45ECB00
SHA1:	9CC8883BE10BD7FE716C6456FD41E913B3A95752
SHA-256:	3F9AC2F1634F4E019DB8D5FEACE8FBDB62D9FB8EA6B7D63ED12F3B42E15BE598
SHA-512:	D01B85B890F3B4A7CB3FB9DE082D40A1CF47783981AF04EC5C5DF26E75369665ED063993B9779FB012E20DDC21BAFEBF1140C6A399042D1763BAFB39801BB063
Malicious:	false
Preview:	.....................G...........b.........4G......hI..h....J.......Y......Hm..h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......T......<3..........h;..D!...+...........)........................................... .......... 2..............0................)..............p...h&..t9.......:...........?..L....D..\,.......&...+..(+..(@..@/...........+..4...89...9..\|8..X:.. ...............................'..d5..04...A......h?...........................C..................tE...3...........$... .......F.......4...+...1.......G...-..\'..........,........(...............1...............................(......................................(...X...\ ..................................87..........................................0...H%..................8&...A..\...........l.......D.......................L....................#......\|D..H..../...........................A.......@...........&...................................?..........X$...F..xF......p................1..............

C:\Windows\System32\DriverStore\FileRepository\net7800-x64-n650f.inf_amd64_178f1bdb49a6e2fd\net7800-x64-n650f.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x6198 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	46140
Entropy (8bit):	4.002931240001021
Encrypted:	false
SSDEEP:	768:rC2WE6eErCPrjf13Mwde0GzZJFOUHxDweJYEA8Il:rC2WEvPrjf13Bde0GzZJFOUHxkuY
MD5:	47F9E4C857B194ABE0A2CBD1C6237DD4
SHA1:	785CC0305E4E55B1E1A455F9A98DD08D13A4952A
SHA-256:	31AC6AD8BEA794DDDD8515DF97290C320C8EAF89B2E309803B2A8B699B21A44C
SHA-512:	A705EF9776F8D5D826955050A2D5E24E19EC3537EAB1881423EBF26FB21BE4C79828C814D6ACF0E1A9F8DA0EFB6A7B63069CE6743DD7AD994674AB950092F1B0
Malicious:	false
Preview:	................\|....a...........b..........a.......c..h....d......hz......P...h...............8.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........K.......L.......Y...T...1..d=...........Q...........,.............................../.......(..,....(..........t............6..H;............... .. R...R......08...........Y..@*...^...........8..$>..x;.......A...<.......K..x...tR...=.......S... ...F...<..x....$..............T9...N...L...........X...Z...................................]...........M...#..\_...4...0.......`.......M...=..\|C...C...C...C...D......,E..p...\|E...9...............I... .......F.. #..............H:..(........................+..........(....!..T/..(.......$G...................G..tP...........................E...E...F..DF..t....A..........\|5..........h[.......8...........K..8$...............)..................\|....3..........d^...3...@...........................[...................Z..........T........................Y...........4...`..X`......d)...............I..............

C:\Windows\System32\DriverStore\FileRepository\net8185.inf_amd64_7a30f5a9441cd55b\net8185.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x2890 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	14428
Entropy (8bit):	3.803563441651614
Encrypted:	false
SSDEEP:	192:HOZCqRDcka7+V/ZrcaWhuDHh5x8ofiyCKVReQvSHGSGcWsx:HOZkaTIwFLf5COewk
MD5:	3D3D385B30604E6292B108778199136C
SHA1:	7E9C033C119CEF5AA5C7CA2E70B94B14B81155F2
SHA-256:	42D1D547FBF346992F57AD044135DDC252588E23770A167C8D06FF7B24276CE8
SHA-512:	5EA5C8470AAA623FF284EB3DA3AABCBAFC8FF71B1E3D7A6CBC779639B9C515CC6075E1E05C246F567166DEBAC68F153F48262ADB825930A3D5F0AA87720A7B23
Malicious:	false
Preview:	.....................(...].......{..........'.......)..T....*...............3..h...............X8......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......L%......................................................D...........................................8.......<...................$...p........ ..4&......................D'..`.......\|%........... ..P!..@"..H#......@.......t&..................l...........@ ..................l................................................'..............................H...................d'...............!...'...'..l...........X...................................................(................................................ ......................p...............................................................................@............"..,................&...........$..............\|...........................T%......."...........................".......................................................................'...&......................l...............

C:\Windows\System32\DriverStore\FileRepository\net8187bv64.inf_amd64_bc859d32f3e2f0d5\net8187bv64.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x3290 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	20988
Entropy (8bit):	3.8843831740539345
Encrypted:	false
SSDEEP:	384:PTf5qRac2HOnBkhgiIxn99xBRwiii86fkxPNl:PTf5Z4Bkhgi099FwiiiHf2Pf
MD5:	B26FA0A3E3C28CEC00C61DB88D23F2BA
SHA1:	5F6734691E4085D5AB9456D026D097283EF8015E
SHA-256:	14F53E739DE792944ED2C99FE2ABFFF064EFDF20B25FE4B150E32C840F3C3100
SHA-512:	C532854A20A06FF67E8A1468C69217AEE512F4D511205F4E7D8B94F055215EB9D2AF3CD3302F49E83F8393C209A852ADBE3208B20EFA8F38D5BF03FD77481AA6
Malicious:	false
Preview:	.....................2...p/......{..........1.......3.......5..\|....=..,....G..h................Q......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......0.......................x...................................t...........H"..........................,.......`%...............1...$..............4+..<....................".......+..\|...............(...$..8(..8...........t+..................&...........&......................."......................................................................x.......0................0......T........,..D1..P1...0..80..T0..p0..........h!.................../...........................,.............../...................................................................................$.......0..............................................h'.../...........'......D$..................................................T*..<-..................L........,...'...................#..................................................\1...1...........-..........................

C:\Windows\System32\DriverStore\FileRepository\net8187se64.inf_amd64_99a4ca261f585f17\net8187se64.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x4058 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	25588
Entropy (8bit):	3.959019298103327
Encrypted:	false
SSDEEP:	384:JWsRuF9cK8ZijW+PWM3inFl0/CrGiChTeItiH7JZsexV3JZsW:A/PcK8ZijW+PWM3in8EGigTJSIbW
MD5:	3BFECDAF4011AD011D64D54C4F89F2AE
SHA1:	DE6AAE43BF728C1402D5CC94F218568627428534
SHA-256:	56706C80DADEA5FC5921AD57A5CDD935EF2ACF0D6B20F7EE942A573B3F503457
SHA-512:	05FC875A31E2C4F23CE183423552C088CB7F6CC60BC5E88925971D6B61677E6B505A2D3C2A910544901F7DDD4C8B29703F0A8B5564F8313491C50B986C2406D1
Malicious:	false
Preview:	....................X@...p/......{..........?......PA.......B.......L......`X..h................c......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......<.......................@$...$.......................=......$....................*...........6...+...#......................X3...2......$........8.......;...........(..........89..............@...X5..<2...5..4;..P0.......8.......1.......&...4...........3......................./..................<(...'...............................................................#.......>..........l&...:...?...?...=...>.. >..<>...0......D/..........\,......p:.......'...............8...:..........D=...<.................................................. ........................................2..............P?...........%...................4...<......................,........-..............T...................l7...7......................d...........<5...................0..............P...................................(?..p?..@#..................................

C:\Windows\System32\DriverStore\FileRepository\net8192se64.inf_amd64_167684f9283b4eca\net8192se64.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x8f88 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	60932
Entropy (8bit):	4.120795443275485
Encrypted:	false
SSDEEP:	768:r0SH/t6OPNCzMfW1CV/CDPYL24th+YQ2MGnTu7M//m:oSfciNCzm4CV/CDQL24thw29nO/
MD5:	64686178C2769D97FCE5B3AFED29FBA9
SHA1:	FFB0EDA6CE11FF25E3DF9C5D6E680AB69904D6C9
SHA-256:	542BF5CEA734154AA3E48ACB1FD00C97594453B5911AC77FB0A3727DB5C898B3
SHA-512:	3B437A4272FE9C85EE4796AFA3CDA05AAB2896AE6FBB22B430D83F7B6268E0CFF421637ACBAA7CD5EB0A04B3A338CB3A1F96E7DCAD36D231A56B3E18A541C620
Malicious:	false
Preview:	.........................p/......{............$...........P.......p...H ......h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........S..hU..................<4...U.......@...$...............................s.......E..,....y...........3.......}..$....&..x'..."...v......@.......\........h..............xs.......U..."...<...@.......A...v..l....K...`...\..(o...l..Xl.......l...g...g..8...8~...d...x..Xe...f......t...........P......(.......................................<.......\|....................3...Z..\....1..DO...6...S...S..@T...\...............+.......Q...........7.......{...........".........................T...............T........................}..............................<%......Dw..........................}..........z...5..82...................y..P...`........y..........<........$.....xx......8...................\|...,$...)...)...........................A..............`u..........p...............D6......................4..................../..00...{...... B... ..

C:\Windows\System32\DriverStore\FileRepository\net8192su64.inf_amd64_66c8bfc7a4b1feed\net8192su64.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xbc10 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	74020
Entropy (8bit):	4.139223951482821
Encrypted:	false
SSDEEP:	768:FZj6/PTwenkW8SNqm9xWgDXndkJwIg4hQkeKLxtLC+l:FhmP3nkWbFfVDNkJwIgsQkLp
MD5:	309F969C68055220A0E3846D619D81ED
SHA1:	F68AE865006068A85F289A33D6D67390081E7702
SHA-256:	459659712725960071BCF0F9512D603FE5310C70DAD1850C8AF8F709755344B1
SHA-512:	533D630C6FF532ECB0D39570FA72E6B1D17EB8C6C0DF0CC4C8B87B1F1AA8A91A1530D2A76A9D5DBAF610A63C07672D98A4E556B9A9B3DC18CF29C7216BD205FC
Malicious:	false
Preview:	..........................\....:.}.........\|...;.......................8!......h............... !......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......x....................x...`...q.......P..@Q...........m......$...............l........................`.......8.......@...A...C..X.......\|E..4>..h?..(D...,.......g.............X...............w.. .......X...<.............................xW...............6.......U..\F..<G..h...pH.......)......x...`p......0........................................k..........Hf.........X....1.......i..$......$.......x...........T........%..............$...............R..........................H...I..\...........n..`t...............r...O...P...l..T............[......,.......Lc..........p...........................?...A..DB...........D..d=...>..lC......@-......,.......................T....q......D.......X.......\m...T.......w.......3.............$\...............E...F...Z...G...c.................<..................$....#......d...XR......p{.......N...r..

C:\Windows\System32\DriverStore\FileRepository\net819xp.inf_amd64_ff7a5dd4f9b1ceba\net819xp.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x5900 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	35284
Entropy (8bit):	4.025091314683729
Encrypted:	false
SSDEEP:	768:CQPtCk/LUaNhWnX+su6YDOxwa9x0bo0axrC71Tc3SX08aTNTfLMrKQ1592LLIcIh:74kjUaNhWnX+su6YDOxwa9x0bo0axrCz
MD5:	523A271DC5069A0E953FADD5A3C9F23A
SHA1:	378552D48D3CA7CF16AA5CBAA88BED5AF7F8D5E7
SHA-256:	A5906859D649EEFC5956583C874338243BC91EA2E3D11DA2BEE845F804504713
SHA-512:	AE4A653EF92A7C3CBBAE7D177C9D7F9DB59ACC5C0D84C5AD36844455A5B627BB1A618C51D08BA32276EF2CB325BA6AE7FAB396D4EEFEF6E14D6C3A53DF08CD0D
Malicious:	false
Preview:	.....................Y...p/....:.}.........lX.......Y.......[.......i.. ....y..h......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......8O......<>.............../.../...........................B......t........G.......$......$$.......................... D..(........J..............LV..\....P...M...)......H).......V..T............... N...J..XS...P...H...F...V...O...5..l....9...4...6......hL.......<...0..........LH......................pG...............V...............&..........H........ ..P............&...W..h%...>..p,...Q...?...@..4Q..L(..lQ...Q...I.......H...........C......HW..........p............................P...O..........0................0...E..0.......................,U...............................M..........<P..p=..........P0...................R......@M..,.......LC..............`;......`:.......................B...>..lU...................................S..................pI..........0M..........,G..`+..\3...................W..hW...................*..................

C:\Windows\System32\DriverStore\FileRepository\net9500-x64-n650f.inf_amd64_e92c5a65e41993f9\net9500-x64-n650f.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x5f48 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	41428
Entropy (8bit):	4.000824727882409
Encrypted:	false
SSDEEP:	384:6wEIvjsmNyFQEUv52AgOLKoTPSnwsArb8/cjicVuk2MP0WGvGjuKDOpzDUv9YWbI:tBvjsmNyFQEUNKoTPiSrbq6+G74kGSSz
MD5:	5FAAFA8E50AE022FB5417CB036F5572B
SHA1:	8249FDB052F2CD5C2D9DB8A04AD84C10FBEC7CCF
SHA-256:	A6DA84FBED0CFF35979E93DE86937F5FB24BF7E29FFC29254AA4465BCC619B9F
SHA-512:	E123C1A5B2CFFC02100E86D22A331CF0059F495F3C804715346084F89A6F0B2BB029352193FAF28A7F25D5EB7EFBD085B0CBB640284E7A0869E65277134F4F97
Malicious:	false
Preview:	....................H_...........b..........^.."....`.......c..X....t..x...X...h......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........A..H....Q.......... ^..4&..DC...........U......$>... ...............................%...........P...&...........................?..............h............:...............S..4A..$\...........K..pC..8>..DW...B...V..@....".......G..tH...H..\I.. J...J..`B.......................;.......R...........X...L..............................l...0...........\|...P........,...%..."..p^......(S...C...F.......^...D..`E..<................<...............O..............p...............$<..................................@...(...4...L%..t........T...................................E..........LT..............................0-...........8...Y..\2..(3......H....5..p ...........................I..x(..t$..8....+..h)...)...)...)......X*..HF..............tY..............HX...:..8.......h.......................tV..........H,..H^...]...................7..$P..............

C:\Windows\System32\DriverStore\FileRepository\netathr10x.inf_amd64_2691c4f95b80eb3b\netathr10x.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x16aa8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	190068
Entropy (8bit):	4.147266693783788
Encrypted:	false
SSDEEP:	1536:s3AY/6+38PA6KIur21g0FoNfg/5kB4NHjwvtE3F2HAUTQek6:s3AY/73mA6KIur2S0Foy0OXsAU8f6
MD5:	D9A0FFCAD3A313D99BFF8E0786606BA7
SHA1:	D6F5B5CFB2DC8BF45600E74CB4F55DF32F3689FD
SHA-256:	FBCBD41EA7FFE51631F8F07F4957B391A9021CF1013282B99DBC8E5D24A9A727
SHA-512:	B1574A05FA5FE2C6E277AB012CAC9ED296F48AA3A63A05F00A9C83337B6875B3A5C76BBD8EAC1D17A44C87FC27E9D25D3C3B21DB571E9FD3A8A12C363132736B
Malicious:	false
Preview:	.....................j...p/....:.}..........j.......k..........xW.. ...(...Hd..h...............p.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...............T?......p..................0b..\|b.......7..X3...................s..4...\|... q......."..0...........H...t................t..<........t..`.......H................s......@....u..l..............(W..0X...W...:...<..t8...<..x=...#..T,......T.......p.......`....S...`..$p..._...s..P........O..H........c..P...8................#...V......hv......tX..<a..(.......h........i...z..0........~.............. .......8....7..l...L...HV...Y..0....F..$\..\|\...\..0....]...]..4^...^..PR..P!...L......................(...\|K..................................p...............(................................M..h[..pf..H.......pm..H...P....O..........x............]..........(....I..............\|[.......U......l...4.......d........$..X....a..x=...........................a......P...\G...G...H..........<....X...Y..`Y..$0..<F...E..........P.. ......................

C:\Windows\System32\DriverStore\FileRepository\netathrx.inf_amd64_220db23f5419ea8d\netathrx.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x2e6e8 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	379012
Entropy (8bit):	4.458412041197137
Encrypted:	false
SSDEEP:	3072:rr6VN1v6Qei+L4pBAC9WXWIw9KxPv0p58IbBH3SffasnX2vzkW0zn:qxrPzIwU3W+AH3Sm0zn
MD5:	348DFCC7B99CDA92E1F860146C0B6DCF
SHA1:	D4BE80F84220F90EF3B36E919F602B56755AE47C
SHA-256:	6748B1D0841A343AE0790AD0077C17BCDD434550AA5C9876D482FD8BBD58E2AD
SHA-512:	D954C285524AC38739E77BE6D4E3AE922AEBE91F689B49E94B60D8A9E32E73FE1B95AB2950CEE67E78174EEA73A41B0C19C43FC2D86D4527F50E731032C61C30
Malicious:	false
Preview:	..........................8................d............7..............@...@...h.......................C.:.\.W.i.n.d.o.w.s.....4....n..\|...........;..@........0.......j..............t....f...{...$............... ...[..............0..t......x...`.......=..........$...\|...d.... .. ...xI...q..\|....p... ..d...(O..H........r......h....e..d7..p8..........................th..\...Dj...d..,Y...f..Tq.......'......hH...........,..........H.......t'..h...,.......4.......$...p.......T........p...5...0.............. ..................................D...t...............$.......(....,...o.......T........4p...x...2..pD......@...4.......@...`...x...................1..X...0...............4&..T....>..\|...0................/..0........4..,.......\|........(..........L....v..............U..D...........8...T~......h...x....9...&..hK..h...t...8...x..........h?...$...A..........\|....b.......Q.......Y..l;..L.......3......\|...(.......\...............\|r...A...O.......(...................:..4%..d.......

C:\Windows\System32\DriverStore\FileRepository\netavpna.inf_amd64_f6f0831ba09dd9f5\netavpna.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1420 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	6932
Entropy (8bit):	3.3361111290112953
Encrypted:	false
SSDEEP:	96:L5l9oACPXZs/HaiRjJpFYtId6LhRw1DcHC4:Ws/HaiVFpd664
MD5:	05CF9BCEB8D1D267DA5E40F5E396435F
SHA1:	BE19739BD75C152C13DAF86705F5772121DA2463
SHA-256:	D50C9109F568DF58A8AF6377351E62430B14BBD49B16A64A56EC3C8C6BC2AAE2
SHA-512:	970432A192022395B5FA79F3FB14DFF2BD8FEEF66B45AF23A8A80259F1269E476C443024B4320ADACD8D1D686227B379FAFB206E447F3FC0E8215AC56D5FE6C4
Malicious:	false
Preview:	.................... ....b.........................................p.......@...h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...................................................................................................................................................................................................................\.......................................................................................................................................................................................................................8...........@...................................................................................,...............................................................................D...............................\|...................L...............................`...............................................................................0...............................................................................................

C:\Windows\System32\DriverStore\FileRepository\netax88179_178a.inf_amd64_b6748bc8bb8ccf4d\netax88179_178a.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x4470 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	32148
Entropy (8bit):	3.9122761002400006
Encrypted:	false
SSDEEP:	768:e1afMqLfNdnGseTli2ChOup0f1auNAsyMiQv70KCt:e1afMqLfNdnGseTli2ChOup0f1auNAs0
MD5:	23E5E3C49AC32F36FB4EECB896076C8F
SHA1:	EA9DB741E80AD5B3F6B0443071146FC626B46699
SHA-256:	D5A59C8CDDD9ADA0091E1864F13896A87C36E77B3D0EA3AE63B946C243871EEF
SHA-512:	C0203CFD0F6A4DF5DE54ADFA4F46096D15306E21576246285054B5A55CBDBA4B2F6F3AE398CB859D44800CE8954C9396B885365F60C83F01D85DFDDC850599F8
Malicious:	false
Preview:	....................pD...........b..........C......hE..\|....F.......U.......i..h................}......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........+......4............-.......-..................@:...............?..............................................`"...2..........P...2...........@...8..............................t...............0......<1..<,..h3..X)...3......89.......<...>..4/..(0..D>...............,..H...x(.......1...................................2..................................................,C...............=...........2...)...<...............(......H .......9...............:...........5..D,...........7... ...#..............................4................&..............................................`#..............................x;.......>..................(............:..............................l'...........A..................................0?......(....@......D)..x...............................D0...........*...C..PC...>..................l4.......$......

C:\Windows\System32\DriverStore\FileRepository\netax88772.inf_amd64_5d1c92f42d958529\netax88772.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x4358 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	32284
Entropy (8bit):	3.9562535715181113
Encrypted:	false
SSDEEP:	768:5t2VQILT3MxShGizmFUSsz9Hi8nApA2q19MNANqkNdu:5t2VQILT3MxShGizmhsz9Hi8nApA919k
MD5:	01FAD7E811FBED46668193E539F0927D
SHA1:	74D2842DBAD5B2659187A1618903AD6D0C247055
SHA-256:	638FB30FD760D57D90398FD1A00CC9DD009A8C52CF50FAFEDC9CC182ADAB4DA2
SHA-512:	CAC9079C4D89E24506BEF738BFEF0D12AC4F70BDE1A6819346573339660EC5921AA746B2B24A21653375BE71B122DBF7E16BCECE7C6E09CE47B3FB03D03BA35F
Malicious:	false
Preview:	....................XC...........b..........B......PD......HF......(U..x....i..h................~......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........)...................-..d....-...................8...................................*.......................).......:...........(..............p?...9......8+.. .......@...<...................T'..T+..<(...0...+...3...'...;..............43...=..........<=..............<,..<...4&...;...0......\+..............................................H...........,.......h<...........B...............3......t,...;...'...3..............<%...<..........88..............X9..........04...%...5......................................................H?..................................................L........................)...................=..............................(9......$....................>...............?..................................(>...........?......\|)..........................................l/......\|B..(B...=..\....2...........1..............

C:\Windows\System32\DriverStore\FileRepository\netbc63a.inf_amd64_7ba6c9cea77dd549\netbc63a.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xc618 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	93836
Entropy (8bit):	4.145850015201672
Encrypted:	false
SSDEEP:	1536:BKUiqw/38OvdeH/izD81iXYs3CGEuXxrhrZXXXmXXBFXXXtzXXXXXXX+aUZ6:B3id/38OvYH/3S3CGvXXXmXXBFXXXtzh
MD5:	385E34CAF3281992465FAF5FDB0C6296
SHA1:	519197C241B65E9E3EC6121CF349C92B3E16E9CB
SHA-256:	2F60DB150E3159240B4BE85C88705011B6143FB5429E3E265A8EED7EFF89D290
SHA-512:	61FB0C87E20E30D4D357690B6380127D81F672C03DB3080E497B4F714B32B42BA4685191381AFA234CD65FA8E56A50ACF6A6E0E727C85978C400F3F41FC7F277
Malicious:	false
Preview:	........................V8;....................J...............,+......<;..H3..h................n......C.:.\.W.i.n.d.o.w.s.....p... D...C...C..HC..x....H...C..4...ln..T&..p...........xX...........F...F......h...TG......T....G..(F.......G...0.............h...........T...<.......K.......\..........@...hD.........l...4....E......(...<....4...O...P...............h....6......4...<........_..0c...........0...............1..d0.................................. J......H(..........h...............\...................F..t....P..8Q......P...(...<...t...ld...G.........$....k..L7..h.......7...7.......7...&...8...c..........X...0....0...I.......(..`8...8.../..\9......X...........L............=..\|?...'..p...............:..t:...$......D....z...... A..L...,...(0...........(...............R..4...lg..........<..........t...X.......dV..............,...t.......<F...........................J...#..........p....p..............@7..X7..p7..p........7..84....................n..8...x.......(....2..

C:\Windows\System32\DriverStore\FileRepository\netbc64.inf_amd64_b96cdf411c43c00c\netbc64.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x6e50 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	62220
Entropy (8bit):	3.9845081571775443
Encrypted:	false
SSDEEP:	1536:F6XLFC/wCPYfrIHPtY4LLPLjPRQdpFzyaUz01NFKReYb2W8qoOYaBsMreBOufZf1:I7FC//PYfrI1PRQdpFz+01NFKR5foOY7
MD5:	41B62544DA7C85E563CF616E2D441A90
SHA1:	E1D4C3BCEB4A5C1065BA4B82E94B36F9B7821D96
SHA-256:	01D2477C376276E9CCD1550B9DF4823EAD723293291F3E7609505F4A55C832A9
SHA-512:	EDEAB333B9B85B51216FAF3BE217EBD4B999685AB2C32475F2C9C2250CEE142489604E29DB2C71CE5E33C6E7BEAA8ACF5C1F9CF41DF7FEE0374B7F899EDB01D6
Malicious:	false
Preview:	....................Pn..V8;....:.}..........m..8...Ho..`....s...!..8....... ...h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......XF...........$..`........(..$C..........$........l..d=.......i.......B..@/..<P.......g...8...j.......(...........#...............1...$...2..`M...;..........t9.......h.../..lk...H..49......@j...;..P>...Q...Q...Q..8...p........B..L0...G......xK..P...0m...:...a...L..........d...x0...#...1.......F..................`T..x........a...a..D5.. ...7..."......\|P...b...)...7..4N..XA...Q...........U...A...A.......O..@X...W.../..8b.......X...P..LQ...e..Db..........dB...F...f......T3...T... ..,U......dU..<2...U...7...2...L...R...#...............U...B..h2...W...2..LX...6...H...^...8..@"...3..l]..LY...X..`8...+......0B...R.. Z...^.. ,...=...d......(H...j...#..HZ.......................].......1......X#......@_..<<..DE..........4Q......xO.......a..4>..D........<......./..............H...G...i..L....................f.......A...........M...M..8...tQ..............

C:\Windows\System32\DriverStore\FileRepository\netbxnda.inf_amd64_1fff3bc87a99b0f1\netbxnda.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x27528 "signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	403700
Entropy (8bit):	4.3200105760004925
Encrypted:	false
SSDEEP:	3072:VMajVogEOGa611rOjp9uFAgZ8tqqCST+4yPreeWIXXWBZdLyaO4f6tP:V30XAgZ8xT+/LP
MD5:	D83479C96CFAA3EB60608826CA70B5FE
SHA1:	9A8BB447C5099BF4D170DFAD9E415D9C57863FD1
SHA-256:	F54D59479C74CD9780B37683B0899010AAA56670CB01C5B493C1C0DFB4E84083
SHA-512:	CDC1461C235086D4ACD04580EA894420306C1B6DC632D54320D2AD779DC79969EB220A67C6FF8E258DCF81939D9AB0135419043BC2B67A4DBC4AEDD94A6462B2
Malicious:	false
Preview:	....................(u........yl...........t......8v..@8..x.......0{...V......h................(......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........*..,....... ...,...D...H...4/..D0......,.......\|o..lT..._..L`..`4...p..........hn.......h.......p..t............f...)......l...$y..Xr..........xS..,l...s..p....e..\"...\|..@[...z......@...<...........8....a.../..P....I..`...........hs..._..Hf...q...v...Q..x...L.......L.......H........b.......................4..8m.. ...X............................A..............X>..(@..H........\|.............\|...........t...8...l...................h...D....l..te...d..lj..`g......h..TY..$)......./.. ....j...............b...b...Z..8....v...!...................F...K..8c...l...Q...D...C..8....M.......3...2..(....4..t... .......................P....c...r..D........f.........,d...\.....@b...m...3......4.......0v...Q..h......................t>...o...O...F...]...m...%...x......T`..\|........s.......+...k..\|&.......~......<t...s..`m..<..........P`..hX.........4...

C:\Windows\System32\DriverStore\FileRepository\nete1e3e.inf_amd64_895623810c19146a\nete1e3e.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x9120 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	66444
Entropy (8bit):	4.0818033723509926
Encrypted:	false
SSDEEP:	1536:NxfgyfAJL8T5lqce/hPaTnTOEXbHzACuWRZBzYQoH4rWb9yPeQWARKKq:rfgyfAJYT5lqce/hPaTnTOEXbHzfBxKh
MD5:	C756C31CADF9A9F5ACFC9DF807999AF9
SHA1:	FD003D8F20B3D7E0A5CA4130D13627C9F94BBEA2
SHA-256:	BAB8311A2CDFF6F72457381865AED9D2808B7FB7124A21AE6054A1A57F1A7E49
SHA-512:	4754F345553B46248B6B5B96C970DF8D06C3BB8CAEFEE949A9420569F9FDAD28296097DA059A20DBB07D08900CC66D919128A7D77163DDA4B6FB2736816964E2
Malicious:	false
Preview:	........x........... ............b.............L...............l...x....&......h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........C.......K...............7...7...................=..P...DA.......c.......n...J..LI......X.......\|....6..........Dv......Dq..\....n.. ........x......... ................8..........p....`.......k..<v..D_..._..._..4`.......... .......l.......$g..tg...^...t...]....... ..\|r.......q.......q...$......d)....... ......T.......................D.......<....~..<............6.......................w..l...\|...........hM..h~......L8...l...r...(...s..`........1..HX...2..P3...,...-..01......l.......@#..p%...&...5.../...(...w.......................................~.......M..............8...........................[..Tw..Dt...t......`s..........H...T....4......H.......p0...q...............n..........P...........H....O..,w...M......,N.............. ................d...m..D....f......t........;...A.. D..0j...]..L.......D.......tq..@....q..................X.......

C:\Windows\System32\DriverStore\FileRepository\nete1g3e.inf_amd64_af58b4e19562a3f9\nete1g3e.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xab88 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	79100
Entropy (8bit):	4.120316550358503
Encrypted:	false
SSDEEP:	1536:tKiypa/lmWfh5F32ccTD7fNvfcY3caBOOIPmN:xypa/lmWDcv7fNvfcY3ckIP+
MD5:	F404F29AD3B666325293AA95322C9268
SHA1:	259E08FF20FF4DD9FC94FDEB2B3F9D75618841E0
SHA-256:	586E9036DF513EAD57ADC88E8C4254E3E5502D8F88C9D34277A0FE11B2C48C6B
SHA-512:	0278E8B580E924822F6ABF3396E0F3CD25C072F2A6377F3B1642A8FFB187E772CFA8CD30E5D8FE173F69B399902CC263D3490EF82CDA0B5C7201AAAC35F098B3
Malicious:	false
Preview:	........................L.......R..............T................%..............h................4......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......\|...DQ...............q..TD...D...K......$...............`...............$...............pF...........D..<...................\............H..`..........................t................;.................(........(.......'...).............`...X+...0...........'..T)..........T......... 1...0..x1.......1..(2...;..<<...2.......#.......7......T....................C......4.......................T.......4..............0.......p5..........S......T........ ...........3..x.......P....G.......4.......M..dk...8...9...9......x...(...........t:..$...........Ph...............l..P... n......X...........p...t~...........}......p.......\...H...l...................$e..TB...?..T?.......Y...B..\@...A...<...<...v...y...z.......~..@%..t....... ...0...........,...............l...h...,...<..................................X.......$F......D.......................

C:\Windows\System32\DriverStore\FileRepository\netefe3e.inf_amd64_7830581a689ef40d\netefe3e.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xd820 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	91644
Entropy (8bit):	4.184494762255978
Encrypted:	false
SSDEEP:	1536:S8j4BpvIgeD1qKtMcVGDW+1YxhhcXGIJ3F+chnAW:S8kBpvIWncVGDW+1jvZF+cF
MD5:	6F60D40346BF165F9FB6A4CF890DF25F
SHA1:	CCFCFCB69D2ADDE255E2308E1050269FFCA3CB0C
SHA-256:	53B45385D456D0349A2234137805A24A89B5D0B8EBF09456A3189C74F0B3244D
SHA-512:	159238EDE968C2BE195AA2DA513D5B1DB831BD608024940B90876691BEC22ADA3A4EDA173E70952FDA8E321790E9EC3D080ABD65121A467E424A01C5F4C50145
Malicious:	false
Preview:	.................... ............b.............U................%...... 0...5..h................e......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......,...lL..........4........E...............S.......D...........a..................L...........XS......\|E.. k......\|d..........\...D...T.......d................G....... ...I..........................t...p....B..........P...P....n..........\|8......."......,....o.......H..........<...............d!......................Q..................0W..0...............h....:..LE......X...0....H......d.......................T........F..,...$Z...........[..................@R......8...................0...1...1..h2.. 3...3..4`...4..$5..........h...........Hi..............t...........d.......,........X..................(...........(....e..................8....C.........x............z.......5...6...}...}..4...d..........L....Y..87......dn......<...T............7......D%..<....................+.............. ...4...P.......\|........I...K...`.......J...H..p?......

C:\Windows\System32\DriverStore\FileRepository\netelx.inf_amd64_7812e4e45c4a5eb1\netelx.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x5dfe0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	484876
Entropy (8bit):	4.278149644413416
Encrypted:	false
SSDEEP:	3072:0QxL411rZdcfyoLngQngKREk1IuqPlDTNyvV3cqU5Dssqi9s2pYk5brmbzi9MCkP:0iL8dDLFXsjuUnIP7lmZFxF
MD5:	AE0C99548D4C9494A2B0966CD747B4E9
SHA1:	FF1BF1029975363CC90DBFD8D9834B3EE3BD774E
SHA-256:	E5F2C4870DAE6875A552A0320D4F9CECEEBFC5A5CCAE7F44D40B7B4EDB6D463D
SHA-512:	D20EC35922807007B1FA2EC73F51DF45F3106949F64F9C400458D48E53F5631FC7FA023350C8141A232F362E6C2FBD65243E8DF872E83F334529A0077CE431EC
Malicious:	false
Preview:	.........................+....yl..........P...=...............Xq...V..........h................f......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...........t........1......2.........`V..............j...........Z.......5...6.. [...q...c...d...f..,g..pB...D..to...p..@?...@......\|....b..pT...U...V...-...u.......v...7...}...q..,x...l...E...... u..\...8........m...\|...z...~......,........y..H.......<Q..l]...>.....L.......<^...Z..l...H.......\|...$f..Pn..h...x....(.../...`......`...$K..,.......\|s...........o...r..4n.............H...0.......<....W..................Xn.......o.....@....I.......[...................X...~......l....f..,....g..TG...h......03.......:..Ds...t..\L..0E...O..8}...8...$.......t................h...$r.............\|....Z.....0a.......~..0...4q..d~..........\|=......`z......<...(...Lb......Hy...c..(\|...c..h...d........J......,.......d....M..............x...XP...........r...s..hs...s...t..dt...t...u..`u...u...7.......8..h...\|...........l.......Hg...... .......$...............

C:\Windows\System32\DriverStore\FileRepository\netg664.inf_amd64_84cd7b2798e0a666\netg664.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x4988 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	34140
Entropy (8bit):	3.973245608855182
Encrypted:	false
SSDEEP:	768:ab8I2P1PaNVfYLWZt2teURMNimwfne6ApwHuUeK/5PeIbG000WCCCG:axfYLWZt2toimwfne3Uen000K
MD5:	E187E2529F41DC78B559FE414D3A350D
SHA1:	F83D139651BC2F000A1E18AE60069A653256C3D5
SHA-256:	4566D481E854E85AA91EE98565A0B7BC12B9E1911EF3469FF281B90ABE770FFF
SHA-512:	D71782D8707A747F518DFFBE055E3C05AE0FD7FA31F8039E7FF40525FE578A1C5956177E9EFE8C1E99622A7C48879803C42584AD61411CAAD2641A637E5F7114
Malicious:	false
Preview:	.....................I..L.......R...........H.. ....J.......M..`...x\..p....p..h...............X.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......p,...!...........%..$'..P............B..L3......................................................................................./......x3.......E...4... ..H6...........!...........F..H........... .../...3...3..p-......<A.......!...3......PC..........$C...............8.......-......................\............................3..................D...D/...>..............hH...............9...H...8......8/...........:.......-...........................................................C.......................... 9...!..,3....... ..........`...........80.. 1..t1...1......D.......................X?...........@..........`:.......C..........................`$..."..........`...(...`....................:..lF..................................8D.......0..0F.......=.......,..4....;..............@.......DA..........$H...G......P...............l=......$.......

C:\Windows\System32\DriverStore\FileRepository\netimm.inf_amd64_8b2087393aaef952\netimm.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1028 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	5548
Entropy (8bit):	3.1211234498418445
Encrypted:	false
SSDEEP:	48:Q+mlXqXoNn0OYJHO5SGYNcYBFp+eNACKfZD2iQ777+qDHEUBQr:Q+mYXotgmgT/2Cy2M
MD5:	3AC467939D401E40F4383A472EB6CDA0
SHA1:	69C487AE7BC48D59BEC73ACFC717AF738E02F929
SHA-256:	8C71ED58DA08107FAD8F015EF34BA77A4528235F14403C408779FB229E1FE743
SHA-512:	8EDE875BFFFCDC0292FDD965C5A1688753471C905EE6EE66277BC10AA31331CEBF6F91AF946EAE94B1C2B8F8590FC00C06A1D623EC9CE28FF8252A96CB8D0595
Malicious:	false
Preview:	....................(...L.......R.................. ...........,.......H...`...h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...................................H.......................................................................x...x...........................$...................................8.......................T...........................................................................................................................................................................H.......................................................................................................................................................P.......................................................................................................................................................P...................................................................................................................................................................t...D...................

C:\Windows\System32\DriverStore\FileRepository\netjme.inf_amd64_752bf22f1598bb7e\netjme.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x47c0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	33700
Entropy (8bit):	3.9488766604958943
Encrypted:	false
SSDEEP:	768:sDDIUHM9AyfoaA21XjZhSsRM/gQC2TwDaL0G1aPgW0Mjhcto:s89AyfoaA21X1hWgQC2TwDaL0G1aPgWh
MD5:	3159BC0DE458BDA6C8F58B8A56CADB1A
SHA1:	443C02556DA0B495C17945AD5B44D2D4E6E00983
SHA-256:	3B0946C0AD584C2E75476BB01D8E702AE7BF88774E4F6DB6CB986F184B56255F
SHA-512:	088B12B1B24D15BE1C5D6BA58631A8BDF29ADDEE0B19232549671E3D8B608025BE48066DAC5324AE7C1EBBB21F13F634E4A034B21305397EC756B2636567F5B0
Malicious:	false
Preview:	.....................G..L.......R..........0G..!....H......PK......`Z.......o..h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...............>.......7......d ... ..........................................4................F.......:... ...........%..\|)...........)...............E.......7.......<......t"...........E..t...0B...2..<...t....D..<0...%.......E..pA.......8.......<...........A...............-......P%..X4...4..........................................D0.......5..............H........4.......;...F..............d+...G..,........(......................\|"......................................`,...%......(...............................\.......................)...5..\...l...........................@........B..............T....................6......pB......T...........xD..................................$....................D...............-......45...........B...................'..D1......D...<;.......1......41...........1...5..DF...E...2...................,......p0......

C:\Windows\System32\DriverStore\FileRepository\netk57a.inf_amd64_d823e3edc27ae17c\netk57a.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xc088 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	91292
Entropy (8bit):	4.16192930954462
Encrypted:	false
SSDEEP:	1536:oH+XdKfq8e1eqQBAC+sYGVSDK1AyjABIbe74N:oH+XdKS8e1eqQBAC+sYGVUWud4N
MD5:	A97C282DF6A5AAD504C15620D47442EA
SHA1:	E22781F47C8F257722D8122DE32EA44DBD1B4B86
SHA-256:	6E52D1475A99FBC67A1331174C5F5A2A73DB2C6448FDAD35E6621513EDD55D37
SHA-512:	47BD55D33F0B54C447047FB582FAE92206A3DB731F76242AF3C33264E4904906B667698F0C855299A7CF397953F9C914C2A447B724F4B3D2D3C11097DADF8F47
Malicious:	false
Preview:	........................L.......R..............n...........0....'......`9..8+..h................d......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......(...p............}...o...%..d&......$b.. p.......p.......;..............<...............?...?...m......d...............B......P.......(....'...........&............h...p..........\|...\.......,&..`.......... ...d......P .. (...........k......`q......L.......,B..,...t ..........D.......................................8......................(............"..$%.....................\........q..x...t...\F......\|.............................H........k..l.......................................,..............(...\...............................@................t...... ... .......X...T....!..L..............................x...........4...x...\$..\|...........8.......T..................................p.....................................................p.......................`.......................<.......<.......0..................4...

C:\Windows\System32\DriverStore\FileRepository\netl160a.inf_amd64_e4cbe375963a69e9\netl160a.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x2e78 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	22028
Entropy (8bit):	3.7997254614302434
Encrypted:	false
SSDEEP:	384:CsXD5rf+PBgdwJ5DV22vnGy7nznJ+z5abaR3MaG:FXDVf+PBgdwzV22OynJ+MbB9
MD5:	531B5C338DA0587F0C2BD2E18E7BC9E6
SHA1:	6484959227D55B323A022725CE85E308F7623B14
SHA-256:	5337C7750FC29B23C1C0E3ACEF636C4ADB108DC03B8FC112F7D865509F901E8F
SHA-512:	D3A2B12F14D64A9F9BA9CF1BFB936E6C9D7022601E46B536FCD73B078528FB8A64585FFDEE62A48CE275B744324959E4596DACEB205CC35BDE5B9748BA91357E
Malicious:	false
Preview:	....................x..........HR...........-......p/......@1......(;..l....H..h................V......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......@)......................(................................................%.......)...&......l&.............. ...................0................ ...................................!..........x...D...`...\|....&......8...."..L........,..........<.......................................................l........................................................%..............P-...............$...-..t-.............0$......h#..8........................(......................."...................................................................&..........................X...................................................................$...............@.................... ...................,..........d!..............$...................(...........0!..............\...`,...............%......h'......0......(-...,.......'..........t....+..............

C:\Windows\System32\DriverStore\FileRepository\netl1c63x64.inf_amd64_4d6630ce07a4fb42\netl1c63x64.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x20300 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	267668
Entropy (8bit):	4.413875222448295
Encrypted:	false
SSDEEP:	6144:Q419ORkbp78gkmAkmVbo36Y+q8fkoiCZbiNDBK51BK5YBK5yBK5tBK5LBK5GBK5e:319OR+p78gkmAkmVbo36Y+q8fkoiCZbr
MD5:	DF700C2227960B212348F16A261800E6
SHA1:	1914FAD622AAA9155CD482DED0165283ACE52B80
SHA-256:	1C556E320B028DA06CBC6CE6CC1EC901C3B951C9A96F872766B05206E8B7531C
SHA-512:	9928A5301AEC2CF2FC9CE0EFA22A7316AE57F7BB1DF97E9ECA42925F7A59D83AD5532A7A218E878E139AA6E185EB97321C0BDC15A896B20CDEFDF4A8AB11126E
Malicious:	false
Preview:	........................,.......R..........p...........$... ..............Y..h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...............................$..P.......,..............,...........X...............................l.......\...H................B..0........T..h...L...\|....Y..\|&...........\..........,...............@...X.......T....p..............4................................... H.....D...L...X...,...........HW...W...R..p......X....................... ...L...........l...t...............d...........\...L........"...................+.. ...........D...............X...<...................H..........H...0...,.......L%......D...,...x...........<.......\|........E......................l...................8^..............T........................]..h...x...P.....................<0...0..P...........x...........@Y..........0.......................p... ...D...........................t...........h...D...........................T.......................<...8...L.......

C:\Windows\System32\DriverStore\FileRepository\netl1e64.inf_amd64_8d5ca5ab1472fc44\netl1e64.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x4e68 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	39684
Entropy (8bit):	3.9965400885449776
Encrypted:	false
SSDEEP:	768:UpxwLWp9GlGyjmWHn5DRGSQWswN5zcDJ9tzMR1hGfdCJXAI5:kw8WGyjmWHn5DRGSQWswN5zcDJ9tzMRd
MD5:	E3390C0F5169B1A64A22FD6DBA4ED800
SHA1:	08D6D17642FB122F5CE3DE968FA327F9DA7D4DC2
SHA-256:	8932A1C2CB8AA299401C09A7208568EB120C939B926CC9172456FDAC3FEB2DBA
SHA-512:	9FDE0BDC7364A9F1DBE5DDA3B04B87B7EC3074CFCA8FEEB35DDA7CFCB7882D8FED01B0779A2A91B81D7872A6DA5E289A43168AA74D6BEB083DCB245B1FB50923
Malicious:	false
Preview:	....................hN..,.......R...........M..<...`O.......T..P...`g......0...h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......8J..........................<6..........8(.......+.......K.......)......./..X).......!.......A......`........................2..\|0..`.......$....;...I.......9...................7...<...............8...0......@9..L-......\|=.......I... ... ...5...........6.......................,.../.......3..t5......d.......d............1..................................$...`...........LM..............4@...M..\G......T/..<"... ..h....#..h-...C.......C...,...6......d6..............X,...F..........8...t...........(.......d....A.......................... 2..........................P............4...........................B...........B.......9.......................>...?..4?..\?...?......\..................../..\|...X<......pB..........................(:..........$<..................L@...............@..........$?...K.......M...L...8......L?...........G...>..........

C:\Windows\System32\DriverStore\FileRepository\netl260a.inf_amd64_783312763f8749c7\netl260a.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x27e0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	17500
Entropy (8bit):	3.7514744224236
Encrypted:	false
SSDEEP:	384:3O+aWC62RMb0pKjFosOjckETcqpOJqicLzf:++aWC62q0pKusOjckz4iYzf
MD5:	D06B62835479E40612F8CF0567543529
SHA1:	0AE83557EF3B59BC0C06283728ECCA32EADAA7B2
SHA-256:	33780D528E01913B2AE0306D4628F0889947507E07BF31B08D3AABE50B688FAD
SHA-512:	1C7C55B855FBBE4AA3B7708F2DE3A6D931BB145BFB9C3C43167B13CB4357CECD0EC70C76481957EA72626A1AEB3130811B257C207A32A62275B98A9E207C2715
Malicious:	false
Preview:	.....................'.........HR..........P'.......(..T...0*..8...h1..x....:..h...............XD......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........!..........................\...........................................p........"...$.......#..................................p...............@............................... ................................"..................................................................@...............................................................................t#......\........&..............0!..0'...&..p"...........$..........................................................,...........................................,........................$......................................................h........................%...... ...............@...............................l...................................................................................\|...........H!...............!......\%.......".......&..H&......(...............................

C:\Windows\System32\DriverStore\FileRepository\netloop.inf_amd64_762588e32974f9e8\netloop.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1950 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	9316
Entropy (8bit):	3.5222949060885087
Encrypted:	false
SSDEEP:	96:ZwK8MutZW0YHE0aVGlyhOlyh0yhcVfq11mtBOnIwr0wOPBvwqOt1k6boT7Yu504l:2kHE7GlZlnM1WMqvQwu4l
MD5:	D5542637D6150BDCC5C77313277355FF
SHA1:	49BC02DDB641A3DE73F37F12D368099E56B5D1E1
SHA-256:	63840B88FDB97CDBF5B1FFF9934D39F992AB30AA84986677DCE989C645084803
SHA-512:	618DE600A2EA109FC8A9823D30AC4495A1B45FFF4ACF727E83931C8A5E84A133C1919F0766C4C745236DF790769F7BC589DF56DF4D21937CD51EB231718481E9
Malicious:	false
Preview:	....................P...*......4Ne.................`...\|.......\|...`.......`!..h...............`$......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...........\|.......................X.......................................................................\|...........................P.......................................................................l...................................................................L...............................................................................................L.......4...................................................T...........................................................................H...............\|...........`...................................................................\|...................................................................................................................................h...........t...............................................p...................................................................

C:\Windows\System32\DriverStore\FileRepository\netmlx4eth63.inf_amd64_3809a4a3e7e07703\netmlx4eth63.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xc290 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	91252
Entropy (8bit):	4.118203894028192
Encrypted:	false
SSDEEP:	1536:CnbwY4lKZGD9cEZXiUGX+8cm/YH1R4P5LQ4TXhWJ1j4sRoQROWcWDz3Aj6bHSKbe:QbwY4lKZGD9cEZXiU8cm/YH1R4P5LQ4D
MD5:	35A3EFCC1CA20A683D082177AEA117D8
SHA1:	306D794EF5FBDBE4739A653198134EB0AE414CDA
SHA-256:	DF1195CFEDEFD8697535DE23493DB9816ADCF488FCD22E92AF98F0D4A91A3D7B
SHA-512:	A59BAF6799D597AA4C6DC14C45C299C424E82BC378571E89E01D9D94C69ACCC0078FDFAD5ED25A95621117C1F8A8F98E639E6B7574EB5542DD3A610D04E8DA51
Malicious:	false
Preview:	........................w...................../...........P....)..p....:..p*..h...............pd......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......`....h..................LS..<.......................0V..<X......@....!...............c..x............S.......#...................Q...t...#.......j..pP...T..$......T.......`....P.....8z...........{..........0M.......(..h........&..............Q......l............................5.......N.....p!......................x.......,..................$....M..p...d'..@...................pT...........O..........d...L....N...(..........M.....xN..,...P.......h...P....z...t..............4......................,.......... ...,-...Z......................$_.........\R..8...<%..................\...................L....v..8...<...h............Y..$...<............'......p...............P%......Le..........H......<).............(...@..............d...5....... ......D.......P...........\................[..........p....u..(...\|3......DK..d ......dg..`]..

C:\Windows\System32\DriverStore\FileRepository\netmlx5.inf_amd64_101a408e6cb1d8f8\netmlx5.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x10f90 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	114740
Entropy (8bit):	4.206914472033581
Encrypted:	false
SSDEEP:	3072:SX3m/ZaDu3ilYCxZbTC2rGaf6PAbRL4jXB76NuqqtS3KjItqWAELHHHSHFAUgbDN:SXsgRaIt/gt/Q7
MD5:	1AB7C38CF698787F638FB54D5BAE7447
SHA1:	AE211588DAD3605093055E5B4C959A1927689651
SHA-256:	D9BA75C83F34CE5FD041EFBE129B5854329E69FC4FBBD7D1D5B94269195B7035
SHA-512:	F3D64B40398170FD9FE4C61024C9492301240E43254DB7DF54378839D3468E312C22B8B2256FAE085C0CC423204F9A4B89901B31827A044278FB1CA40482D36A
Malicious:	false
Preview:	........................QZ.....................#...........`........A..$?......h...............0.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S..............D...\...l.......PJ...... .....................;...;......'...................4...5......p<......@!.......*..`/......DI..$6..."..D........K...K..LM...d..............,B...B..x....H...C..............i.......&..p...............L...hi...H..D....................$...........&...-...F..........4................... ............T...... .......tK..<D..8....%...N...c......,...........(..............0...........$F..,&...........D.......E..........DQ......<.......t...0...t.......T...d...............L.......t...P...t...................................p........H.............. b..........................d...................L...............d................%...........P.......................... ...t...........................................P...@...............`...D...............x........N..................t....a..D...................h...........

C:\Windows\System32\DriverStore\FileRepository\netmyk64.inf_amd64_1f949c30555f4111\netmyk64.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x20c40 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	194572
Entropy (8bit):	4.3650523378713535
Encrypted:	false
SSDEEP:	3072:PxEVKYeFc7/qhjLbnLhjUnMfXJ7fb+WiSDQ20Gqb50wVavZ9g9UpG:Rb1u9UpG
MD5:	04F5FC1D13C5A091302DD566CCBADA7C
SHA1:	F7F18A23514CFCFEC2121542C4DC5BC713E70C59
SHA-256:	A4A90ECCF96A3194E36FFCE120816FDBC0545CBF1AF16DB218B3FA7CBD7DFE13
SHA-512:	483B9CCB8ACC52931710492D8D7AA7458AB32DBAA803B1E6DA8E26314D4E88AA23EF94C204A551EBB7E661EA7B607C35BAFA1B0F5D5ECB7E89DE2D3EEB100883
Malicious:	false
Preview:	....................@...,.......R..............0...8............@...Q..@S.....h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......4.......<........@..\....r......\d..........N...N..h....1...j....................................<...........0X...a...i...k...l...m...n..\|o..tp...?..\|.......\..........@...........,...<...........,...\|...........l...........\............u..P....@..........................d..................l...l....Y...b...j..Xd..De...]...^..0f...g...h...h...P..........`.......@...............l...........\........z......p...P...T....z.......t..`............................................................... .......X........W...)..............XD.....(......p...l.......8y.......v......\q..........................h...<...`.......................t.......t.......0...........................t7......H.......H............W..........................................+.../...........y...5...0...2...3.......\|.......5..l.......d............6.......9...;...<..........

C:\Windows\System32\DriverStore\FileRepository\netnvm64.inf_amd64_35bbbe80dec15683\netnvm64.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x6ac8 "Class", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	51716
Entropy (8bit):	4.0133097138255
Encrypted:	false
SSDEEP:	1536:5tLYas1xL/VW3Hpx10kBExc9fOnl57cKDL56koqR0J11ITZTNIHeNTSvA/b//dOE:5tLYas1xL/VW3Hpx10kBExc9fOnl57cM
MD5:	2302FA3CA7775439D723A031A0BDFF7F
SHA1:	C7EF0A69C8CB9EF2274821C9B357B6AF169FFD04
SHA-256:	7BCE8C37383F361821B84B15E5C4D5017329BC40C770D8246D59F113797E036D
SHA-512:	37C47DBF153D9C0442345D80AD3CF905E31A3B374E908666267E0D7ECA4F0B6A1B6380BDF5A52A09AE8D47DC8C13C852492FE201AEC25E05105049B3DA70AE04
Malicious:	false
Preview:	.....................j..,.......R..........4j..U....k.......r..@....... .....h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........@.......R...............'..LI...........O..............(................7...............R...........R...........@..............<A......l7..l8...8...:...'......x>...=..\2.......?.......@..d....7...'...@...M..tT...3..(f..DI...L..D`...Q.......a...........I..........TL..hi.......2...7..(d......,T......x...`M...................D..................($...............e...'......\G..........h...._...........h...*...+..............03.........../......l....1...................U...:...X...#..@\..................`...........P........................................(..........d...........................h@......................(........i.......`..Lc..d............T...............T..P....@...A...A..lB..\_......xC...B......8C...C.......C..8D......(E......D....G..h%...6...%...........b..4S...N......,O.......(.......G..4G...F..........PW......hY.......]..........

C:\Windows\System32\DriverStore\FileRepository\netnvma.inf_amd64_7080f6b8ea1744fb\netnvma.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x4bf8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	33028
Entropy (8bit):	3.9623153065725645
Encrypted:	false
SSDEEP:	768:LsjRa2Fbr/Y31Of/fd9hG6U4KRFRKV3fOkxnxZpgJVhjY+kDZNTGZhaKxhqUX/Bq:wjRa2Fbr/Y31Of/fd9hG6U4KRFRKV3f/
MD5:	558F663F575C58715D1B46A8DC63BA65
SHA1:	ED5AD99F037C9578B0C8F3A6A4AA4B1DBA6F8BE6
SHA-256:	1B75D5CDC30E4F68D6CB2993CB8DC1A66746E3FEFC2B343DDC3B2E55E8B65D57
SHA-512:	4C6FDDBC4FB349D4A43835EFE38C9ED602EB4987100A5425F24FDFE643616FD16F22D8351929B239D8EEABC49386F9111E5D447E10649DE3AE1F0F18630162C1
Malicious:	false
Preview:	.....................K...........b.........hK..(....L.. ....P..\...p]......8o..h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........5......................P$...$...........<...........................................................$..........................h1..............t6..HH...H.......I...... &..0....5..(...@<..D....-..H,...1...;...>.......-..,8..........<I.......I...........8..............d9.......+.......;..,...T>...... ...........................................D#..<)...............#.......6...........'...'..(.......!..L................!..d,......................................d=..t?..h#..PA..8"......d...............`............%...................................................................)..\|8......@6..............................p3..........,K...............>...........1...1..l....2..........,>...G.......7...................................3...........6.......-...............&...'...<.....d<.......%...........5...5......................h.......`.......

C:\Windows\System32\DriverStore\FileRepository\netr28ux.inf_amd64_d5996f2a9d9aa9e3\netr28ux.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x28fb8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	278348
Entropy (8bit):	4.37589284940549
Encrypted:	false
SSDEEP:	3072:++VZCM3xKEjhVFTD2ZzDPRBm6dvNuZFbqwGFbE:++VZCIvcDmG1uZFbqPFbE
MD5:	7F385AADAE3D220F94C06A34478EBB72
SHA1:	DDA56BBE2C77F35052D4AB61D864E1C42FFFA732
SHA-256:	360561A9F845D5036F9A36CF674C8344116E48DF9537085D484932EB4937E4F4
SHA-512:	812C6E31391062ADF89A19657D6C3207BE79EDA170F579DAD9E6FBE5AA3FFCE7AB4AB7EDC602F1FAC5942B05A363591F45EED36F3255898212A3CDBFEA240E76
Malicious:	false
Preview:	..........................\....:.}.........$...Q.......T.......pt..x......`...h...............H?......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........P.......w......0................~...@..0$.......S..........0........Y.......Z..tn..$r.......m...i......`....w...i......,........:...x......PH...........$..$.......L............&... ...x..@.......\...lk......lE..Te..,...t........>..T...P............=.......b......X.......<<...?.......&...*..HN..@....}..x.......................t......H...@...d%..$J.....tR...Q...j......X...\|[...Q..d=...C...F..\|S...F......,g..LH...M..$J...J...N..(N...;...W..PX...X..0%......\|U..xz.......1......x......x......(...............H...dN..Hz..P....... .......#..@...H...........\|...l........_..h7...B..(;...K...B...>...e...L..\L...........V...'..T...$........^...d..................<c.......<..$=..4....>..H........O..........4...PP..`...<...p{..,.......<....... G..x...........t............v......T...8...TA..X=...'...C..................~..........................@F..p...

C:\Windows\System32\DriverStore\FileRepository\netr28x.inf_amd64_5d63c7bcbf29107f\netr28x.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1d828 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	219084
Entropy (8bit):	4.335598060802031
Encrypted:	false
SSDEEP:	3072:3bFhE88pkTAvQTzvg+dB6jbvcK1D/PLD/Rs:VpFdaDv1DrDm
MD5:	A84E21A1D9FEB0452168D1F439E3348C
SHA1:	769BF0399135CEBD40BF966D4EE12EC71F777237
SHA-256:	5AA96B8B61F047C68B117DDF79F8EC219A64CE30133D4A229A7B5C2E308D7DF2
SHA-512:	7E00BF084EDD83FC0C89D943B010BE5F5C380BA8FD556A49BCD6A52350868E751BD513A65B89E3E2CA89947B432C0BA6E81CCBFA4F5E6C6570B68C188704FBEF
Malicious:	false
Preview:	....................(.....\....:.}.............4... .......0....f...X..........h................W......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......\...H...X....#..PU...U.................8........r.........<............n...K..........X..p....L......8u......d....y......80..x.................... ...q..............xn......H{.......V.. ....]...2..\|...,.......d...............q...T....................(...4...............U.......~..8!...k......pu.........\z...z.......\|...\|...}..$....~.....h ..\|#......t...H...4...4............4...5..<$..8'..........x&...%...p...a..................#......\l...l..,m...$...........h...k..........t[...S..`....v..@M..........P....m..Tn......Hm..Di..t...(................A..................0...........T...t....(..$I...I......PX..`C...X..\Y...\|...Z..D[..T...X.......h.......$...........\|...........x...........P........2..P3..d.......`...H.......@...T...H`..,...L...0...h...........0...hR...J.......O...Q...R...L...M..............@...T......H....c..................

C:\Windows\System32\DriverStore\FileRepository\netr7364.inf_amd64_310ee0bc0af86ba3\netr7364.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xa820 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	66980
Entropy (8bit):	4.133132209120458
Encrypted:	false
SSDEEP:	1536:iABMFl8OZL/ebMMC8a82y1aexa/wKH4+eEh:iABMFCnC8aDw9I/w2T
MD5:	2EE3C013FAA0B3051E9B196DD660FBAC
SHA1:	ECFB3841BC23D04DEF4B827EC0F0A0CF8C83B1E9
SHA-256:	486048CBBA05AC7C7FEC1A88EA46FDC10B938ECFB83C674430584FBBD66625E7
SHA-512:	B7D4D22AA5B9EE7FEC46F9C3322FD5E2540965932F67A1B65C62CC2AA3FB7C25D7046F595828A1F57183E06D0A369CC76DCC627D7046936C782A4B3939DEB21E
Malicious:	false
Preview:	.................... ...<.^....:.}.............L.......................h...8...h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......0~...W..h...`...........4G...Z...u..@...............8.......... ...D...............................F.................4...$................J.. ...........d...d..........X...d<...C..............\|r.........tp......T........w..t....c...b......8>...............(..t....)...*.................\|s...........`...e..0l.. ..........Xe......8f......TM...f.../...........F......\...............X....#..p........$..,......<q..h...........k.......9..,"...... r..PL.............. _......P...U.. ........C.......................!..........,........x.......M..8...8....Q..8w..<O.......................%.......x..........@........q.......................i...~.......j...M......$F...>.......N.......\...c...e..h................k..@....d..(....[......\........L..x...Ln...}..............48..L:...\...O...:...........#......4......8?...,..@m...@..$,...A...B...B...B..

C:\Windows\System32\DriverStore\FileRepository\netrasa.inf_amd64_1bdf7a435cb3580d\netrasa.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x34d8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	23036
Entropy (8bit):	3.8435936893157097
Encrypted:	false
SSDEEP:	384:b68RHbt7tTGNsShJjt4A4d4Jys44oG+HG08neWrGmBQ3qnoA5xRx2rPQ:btHbt7tTGNsShJjt4A4d4Jys44oG+HGv
MD5:	9A8A4E99A903E04075C19B2C5DAD7B7A
SHA1:	00AD1E88FED4437B47C672D69851F88013DDB579
SHA-256:	B3C36837C54CE0854498DDAAA35685B4417BC29312FD575EA12D6CBCF8D13974
SHA-512:	270FEED8E93688003A7399FB91E192B013F747C676DB88D4289A1C2E4CBB3ED78C1EA916DF78E5D3DFDB3F110B82A3233442716A78A333E5AA429A5D20937FBA
Malicious:	false
Preview:	.....................4.....................H4..5....5..$....9.......B......xN..h................Y......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......D...........................$...<%...0..d%...-......D#......p2.......................*...........(..P...p+...........'..l..../..0&..............02..............................l...x1..H"... ...$....... ..t ..L(.......................,......H...........(.......................(...............................P...............................x....................... ........3..X...............P)...!...+...,...!.., ......P ..t.......L...................."...........$......................H$..................,$......8............!...........2.......................................%..............<.......$!.......................(...(.......#.......................2..............0+.........../..........P1...................................)..........h#...................................................................!..............$3..................

C:\Windows\System32\DriverStore\FileRepository\netrndis.inf_amd64_be4ba6237d385e2e\netrndis.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1b88 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	10196
Entropy (8bit):	3.5544525909304525
Encrypted:	false
SSDEEP:	96:DikIUNgdIa1X3hRV1zh5b1yUDL56bnsNzl4gMMmkIq99flOvqwxM7fUjEfuseyHu:DghRVl8bns9AMcvbMAjYeyO
MD5:	32AF098D759A4D55D6170B6A5AB53ACB
SHA1:	AB1F4604519E8A8BBD375E3EC64E1FCE1B83847C
SHA-256:	686C404BA53EA4290E2524A4618C8154E7E1AC9929DB7C471F0E7F34FF7FAD8B
SHA-512:	4D974480373F97759683AB3A85BC6C21E45D4C88C359F1E161D600816DDEA988BC14B6148AB55D0B66CEBC407B911961F7D38C64AC9B85E90CCCA76D6AFF74A5
Malicious:	false
Preview:	.........................\|../....#..........................(........ ..p...`$..h................'......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......`.......................\|...0...........................................\|...........................0...........................x....... .......................................,...........\|...................................................d...................................................................................................................................X...................................................D...........................................................................................D...........................................................................l...........0...............................................................\|.......................................................................................................`...................@...............8.......................(.......................

C:\Windows\System32\DriverStore\FileRepository\netrtl64.inf_amd64_8e9c2368fe308df2\netrtl64.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x76a8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	42548
Entropy (8bit):	4.0540829372051626
Encrypted:	false
SSDEEP:	768:iTh0s2rXFTEeL5zcn0BETvckGL9S9j/4yZP7a86Mkzp:iTh0DEe9zcn0BEQk0W7ZI
MD5:	6771D6E36C86CD2143C3B49B30419C51
SHA1:	6F0D4E9FBCD0FD121A173362D7AC3C738D571BCD
SHA-256:	5845AA763C9D29938E301D3D5BADE824DC040084AE55D59022A6F0F92227B801
SHA-512:	7A6DC0D0ACB14C44395EB8A0DE8398C078839AD7E732A465FD8654D0FC1754B5A3C21D7E2A34B4E6FFD2CD3610341BE9EEE15398FA6CDF19A001964E41564695
Malicious:	false
Preview:	.....................v..,.......R...........v.......w..\|... y..............h...h...............0.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........1...=...................7.. 8.......................P...........L...U..\|=..0....................H..$ ......H6.......u...........i......$U.......r...P...............S...9.......2...s......X#..8i...k..(j...3..`^..._...h..@........ ......,B..4p......$W...'...(...D..............T....+.......[.......a..........................0.......................d...p...h............&...t...........Y.......B..PZ......L-...............e..............................T........o...........;...D..@...\|...........0...l...............09...............................V..$X.......f...............[......\|....b......4d......................,l.......p...............:...u...............U..........X.......................8]...s..............\a..........p:...8..Dq...k......Ps.......h..................tV...W..............h............u..lu..........................$...........

C:\Windows\System32\DriverStore\FileRepository\netrtwlane.inf_amd64_20caba88bd7f0bb3\netrtwlane.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xc8b0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	120452
Entropy (8bit):	4.072290617953
Encrypted:	false
SSDEEP:	1536:qSJYeFRLUpisAj5FRbetKSqSF+Coe5O/dcH:qSZFRLUpisAj5FRbetKSqST50dcH
MD5:	852452A566BC51984615B0E3952D7A30
SHA1:	BE02C4F8B2D12445ABA00EC00C8119736BA49F0C
SHA-256:	F634DD467502830E151BDEFF64F0F24B845A9A66C9C1ED9EBBAF63AACFCD6EDF
SHA-512:	C24995F06E7BA24D2AED8F0CC521791F9C0AF6B33792B94CF5FEAA7329DC83E6750C5615A75D34794F6FF66F22F6B1B1598B2878BBFE40A02374AC247B9B5123
Malicious:	false
Preview:	........................r.=....:.}..............................B......T]..(y..h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........~......Xs...z...........7..T...D.......\|%.......B......P...X...$.......xd..........0.......x....v..........................4....g.........4................)..........(.......4....$..4.......t......p...p...x_..4e..$J...........^..........D............0...6..(...........@...................\...........d...X...p...8L......0....................................Q..(T...;..0...P.......<n..l...........\..li......$E...!...D..._......p.......xl.. ...........4...................x......d.......{...g..<y.. ...............8.......P......., ..H...h~...D...:...z..\|....=..HU...K......(...<.......4............'.. ......,...\.......0...............i..P...4Z..`...............0..........................................................l...(-.......5..$6...........e..H...P...................t...P.......+...q...........................9..,...............X"..

C:\Windows\System32\DriverStore\FileRepository\netrtwlane01.inf_amd64_b02695ef070d7a42\netrtwlane01.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xeff0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	137868
Entropy (8bit):	4.155220417026901
Encrypted:	false
SSDEEP:	3072:EwqpCLzHqsI8ByORVErpbqiTk6ezLtzZLY:tAVizLtzZLY
MD5:	0F802B866285532B98AEFE6F209CD60A
SHA1:	E667375DAEEE4CF07268A6C95D58819CAA947FB6
SHA-256:	28C0217756F0BEDD39D9F082A3A7E66798E788FCFCFBC06230D898B435FE2C46
SHA-512:	A732BE578C06D4A501D1BC8BAA0794D0A2B797CA820DF999ADDA67E1BEF2E8087ADA4A620E23DEB3039AA95A345681CFDCF6CCAF36B7EF8556E8703ABE051F42
Malicious:	false
Preview:	........................NS@....:.}.........`....................I...N...e......h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...........h...\|...............hA..Dz..........\|%......\|...\|...`...X...0...tj......\:...>..0.......<........4..l...................\|#..L.......l...............$....)..D..............@....$..4.......t....w..HU..................@...,....l.......a...s...x......H...d...Lv...z..\|.......d...........(...4...........d...................p........3...............W...{......hs...0..41..h............k...S.......H..<X..(.......XT...!...F.......L..L....\|..ta...V..\|o..h...,$..H.......................h.......L.......................d..................., ..H.......0....D...S..........\....N.......K.......................'..T.......H...........4...l...............4...8u..`...............43...........V..............,........%..........\...............h@..T........I...p...6..4.......P...............q.....\|........+...[......$.......h...P<..h=..8C...<..8...........X"..

C:\Windows\System32\DriverStore\FileRepository\netrtwlane_13.inf_amd64_992f4f46e65f30d4\netrtwlane_13.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xc078 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	89732
Entropy (8bit):	4.169898088948422
Encrypted:	false
SSDEEP:	1536:EPNYRKtgyWjNqudNknU2rmyIsXcBgjVbLSQbI3R:21tgyWxqudNknU2rmyIsXrkQbIB
MD5:	DCE782CC8E8790221E3E0AEB3FE77DA9
SHA1:	F83535C94A33B69815FB483C92547E651BA68B27
SHA-256:	93302EA5E89889A02D33663FC7EE69270E1DA678AA3684376B110CD14716983A
SHA-512:	BEBD8B0A8BC4CE304F533EE0A4C4FB5D6165D1866E30B3F1904BB9380A75D1A2D2C705D541B2AF82AEB4476312388C7F3B59EEE241A2B4A4EE64A2DE54CAC518
Malicious:	false
Preview:	....................x...u]B....:.}............j...p...H.......d).. ....5...(..h................^......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......`5..d4......D[..p...,^...?..p@.......*...%.......\......................t........r...........[.......?..........t:...Z..`...HM......9..`....B..`n.. .......).......2..xK...........#.......d......P.......`...P.......8..............8.......<....F..X...\|...l...\|F..,F...k..\|......hE.. L...G......H....M...................n...............................b......0....~..8...T.......8....... ...@C.....x...x..........d!..Lr.....`............^..(............#..,........w......,{..8......`..................................t............................................w..(y.......................z......h'..0A..t........A......\.......p...\|...................X...<....&.................D...............,...<%.....................................................8.........T....s..0J..,........H..................h.......<............................!..

C:\Windows\System32\DriverStore\FileRepository\netrtwlans.inf_amd64_97cd1a72c2a7829c\netrtwlans.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x7668 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	67796
Entropy (8bit):	3.98763719636139
Encrypted:	false
SSDEEP:	1536:6u5O877eLHOBoKROiqGReDbsIE0vHDGo9+Rl5D5dZ9Odv7rGziy2mq:6F877FBeDvHDGo9+e5
MD5:	F9BA427BE29097A8B3F5857240BE7403
SHA1:	5578F8E73206E696E97855A836B7FE81D378FD39
SHA-256:	9C7E5E50483AE62047F1E4FCE036EC9EFD4728935BFCF25982EB2DF6447C2840
SHA-512:	BB39CB254C1CB68854BDB9849B8BCD70A79A3701711DA115E79D5831D954B0F945C3DA7AAF31171D54031D2FF412C8C79057C0982A1AB24778CAB78CECBF4871
Malicious:	false
Preview:	....................hv..<.^....:.}..........u..a...`w.......~...$.......2..8...h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........W.......H..................L/..\m...................[..........\|J.......C......lh...G..............\|...\.......X.......TQ...s...E......t........X..(...Hd..............dC......tn...W......\|Z...T...U...F...o...Z...........X...c...E...........e...........T..._...............e...C.......p.......e...............................l..................4................j...4..X....t..._..h4...4...k...t...3...3...5...2...4..h3...l...q..0j...8...7...r......,2......P6..p<...........c..@k...............L..du..8...........,u......`r...^...........Y.......M.......R.......S...O...f...........Z...L...P...^..pg......p....0...@...j..._...<..`G..pt...T..p........h..........t....Q...n..@q...l..............\\......$c...W..0f.......2..........d...........lU...:......\1.......?..T9..4&.......... m..8$.......+.......-...%...&...u...u......."...)..........Lc..TH..........

C:\Windows\System32\DriverStore\FileRepository\netrtwlanu.inf_amd64_1815bafd14dc59f0\netrtwlanu.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1cab8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	246276
Entropy (8bit):	4.323576096896733
Encrypted:	false
SSDEEP:	3072:YyI3B2C1Hw2f76rFvLS+ilmyRfTDDb9do:YyhKw2M4fTDDA
MD5:	BF0D855299D4E5ACDC0A7B318656962F
SHA1:	8B27E2CBB5572852CE86346DAA10AEF7C28488A0
SHA-256:	4E94825017088BFFE21857361C2E25CF94CA92DBEF862C7A1BE3CE24863BEFE7
SHA-512:	6F136D80D486F89D1BF3EF53AF529A0B60741B89602C8D5A1D4B12AA7FE08691710B9E61EC9DE124BCF9BFCA675D336629023E29A0617A14F7041EB88D1044AE
Malicious:	false
Preview:	........................<.^....:.}.........$...............8....~...\......p...h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......h.......,....p......t.......pl......f...u...............l.......^..........X....P...*......,......X...........4s.................8....h...1...4..........\Y..H...4x...N...P..`Q..\|........................f..0...........\....#...U...........!... .. ...T+.......2......D_.....,T...9...........[..$...lc..he...Q......H"......0........]...e..._..l..............(...\.......`........U...T..T....e..<...t........3...Z.......s..h....v.....01...@..P.......pf..............8...H..............G...(...........A......l...............r...............{...\...d...9...r.......z.....$k.......:.............H<...&......(... ......l...$~...............\|...2...I..Dw..L...DO...P.......?... ...^..pA...:...e..Pa.........................!..X........}.....@$..................$........m..H.......,u..\|M...8..$...h%...d..........T-..T........?...=..4....#......`G..

C:\Windows\System32\DriverStore\FileRepository\netsstpa.inf_amd64_e76c5387d67e3fd6\netsstpa.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x13b0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	6748
Entropy (8bit):	3.305224690980059
Encrypted:	false
SSDEEP:	96:8zlxu+BECERZWYarFwXSR3lOE1Dj0eqmn:8ozW1LnhDn
MD5:	71A288BC3B38D259EDABF64A3C3BAF9B
SHA1:	00E282C78C40AC92AD4790E41DA750713E2C71F8
SHA-256:	4C431FB576D3E6B318BE7525ACE37435A5F77A78749A4BE58C0544037075C621
SHA-512:	482F0D3E6F43846ECAE28CA17FDDC972A3518052678190EECA5473285BEB4ACBCE82C4D2A31F41645C18E945818C9512E774C455FDDC99B058E9E72198046CFC
Malicious:	false
Preview:	.........................b.................................p...t...............h...............X.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......(...................................................................................................<...........................,...................................................T...........4.......................................................................................................................l...................d...............................t...............................................0.......p...,.......................................................................................................\|...................................................................................................................................4...................................................................................................x...............................................................................................

C:\Windows\System32\DriverStore\FileRepository\nett4x64.inf_amd64_54eacac1858c78ab\nett4x64.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x69b0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	57236
Entropy (8bit):	3.977772107927716
Encrypted:	false
SSDEEP:	1536:Zg4AGe80sVOEHfSEEhYqxChDJJJA1Ye6/hqWTvfURimrUnu69Sovv0Mog5KD:Zg4AGe80sVOEHfSEiYqxChDhA1Ye6/h0
MD5:	AACC3927BAFCCE4C0684A784BC2BE569
SHA1:	E2F3013CF2A0668DC3A2A8E416C0C47D6DC68B0D
SHA-256:	2C05C37A9A5D55FCD865679E3DFB868A43ABD049090D7341E52C8076E5893404
SHA-512:	EB2A15AEC8F4E50616101BE7F376097C1B08BD4EBD6885C525E89DE1707CF5EDFCA9AEDDBFBE2CFA75A514884145DB6748C0A17D9F62262720545FDCDB3F9D36
Malicious:	false
Preview:	.....................i..QZ................. i..0....j......hn...........)......h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...........,9..8...........lZ...-...8.......a.......... ,...c..................\N..T............,...........-...!..$[......P1.......0...6......p0...Y...g...Y..xL......XM.. Z...&...!.......;......X`...4..H4.. 7...E..,D...\......4Z...C.......b.......*...........:...S.. 2......Da.......3.......D.......\...G..X:.......B...... "..0V...........8..PZ.......d......\|f..........t-......(h...?......t....@..D=.. ........=.......V......pX...5..........................0M...@..pS...Y...>...[..(...................$...........L'...b..x.......D...t`..lP...<.........../...3...(.......:...............@...................(......P%..."......(.......`d...c...............c...............................Q..\|........E...........g...R.......=...............]...P...d......p7..........d4......0........`...N...1...E..,E..xT...............h...h....... ...........X..4>..LC..PB......

C:\Windows\System32\DriverStore\FileRepository\netv1x64.inf_amd64_30040c3eb9d7ade4\netv1x64.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x36d0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	25700
Entropy (8bit):	3.875777627344835
Encrypted:	false
SSDEEP:	768:PK2UXZpQKpCEeyUDcFYDHnzNQJV4oXUpKn:i5ZpQKpCEeyUDcFYDHnzNQIokMn
MD5:	6F80F9AF50E648D40DA1D2D236A26B82
SHA1:	AA4E7260A8FBE754C292A11587CF87344D24165E
SHA-256:	90EFF5B4DAA6AA430EAABCA78DD4AE70B63A522FF8BAEE48AC531CDEA872C5F2
SHA-512:	A971C28DA7BF92FAC4EA36ABA825C4B1CA42A82E56905D1B7655893ABE3D0839E8372A0967F388DC1A1E3D8D9FEEF41CB363D1B02203C114E45FC5170EBB287A
Malicious:	false
Preview:	.....................6...+....yl..........<6.......7..X... :.......E..D....U..h...............`d......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......<1..............(2......H................%......L'.......(............... ..................................................8................$...2......\,.......,......<.......(0...#..........$....%... ..D%.........../...2...........,......H....!......`"..........................t ..................................\................................#.......................5..............4$.......5...........)..D*.......... ...........................\!.......!.......+..........................................\$..........h...p......../..........................."..................l+.. 1..........................4 ..8.......,3..(+......................H+.................. .......D...................D1.......#..............X......../...3......T... ........................+...........!.......................6...5......@...d............+...$..........

C:\Windows\System32\DriverStore\FileRepository\netvchannel.inf_amd64_ba3e73aa330c95d6\netvchannel.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xf78 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	5220
Entropy (8bit):	3.0616220573452892
Encrypted:	false
SSDEEP:	96:QGMMOF+5O1p1IVS6RS21NO158OT7YOhOqtOPxkOrgvU:HiEVt5i25UntPcgvU
MD5:	27948018D1BF7A3B7D44B5A5BED97F14
SHA1:	EAF2FA9837C94DAEC52CD06FC6CEFFF67C404043
SHA-256:	CBA422B42911CBB6AF63F99BF73EB784E0E2B45AFB27C8A7D81ECADB8DF9210F
SHA-512:	64385FDC252C32A0C2CA89C9500AA4F16059ED2A3B33077ADBAB16D6C5C98F43829FEAAFC45CC311A9EF7055589D1A02594412C0B0DCAB02AAC1D4C3545E8E95
Malicious:	false
Preview:	....................x...<.(......&.................p.......P.......P.......X...h...............`.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...............................................................................$...........................\|...........................................................................................................\|...........................................................................................................................................................L...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\DriverStore\FileRepository\netvf63a.inf_amd64_a090e6cfaf18cb5c\netvf63a.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xe6f0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	96092
Entropy (8bit):	4.142629571817447
Encrypted:	false
SSDEEP:	1536:nfOMgcTjw9/zomjP99LYwjjMRSIu+GRwIj+9s0nWXpw:nfOMgcTM9/zomjP99LYwPMRSIu+GRwIu
MD5:	730E24EE5166ABC5412F22402AA32420
SHA1:	A4229654253BBEEAD8EB32293EE857D9BD3DCC35
SHA-256:	CC5A606929A24C73FC5B442ACB91C31BF056288F6DEB7DD36B24881BC914DDB1
SHA-512:	B76A93A50FFBCDE96AD84040198D0A560D16311F8A65BE5A1C603C202EE0352228881C2088FA688508033A8889B3FF416BFD4498A0DECA7ADBEDB60B540034F3
Malicious:	false
Preview:	........................,.......R..........`...-...............L&.......2...D..h...............Xw......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S..............P....g.......8...!...-..........t...........................................................h!..<...................h........(.......... #......h"..........pK.......................... ....".....................\|...P... ...........`...........H............#.......,..X.......0....+..........8................... ...................4...............T.......8!..................................,............$..........d.......................................H....... ...................................................t...................X...........................................................................................P&..D.......X...T'...........+......................................\............................)......D............................................................*..H$..,...............................d...\|....$......

C:\Windows\System32\DriverStore\FileRepository\netvg63a.inf_amd64_9f5493180b1252cf\netvg63a.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x3bf8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	27724
Entropy (8bit):	3.955116102479092
Encrypted:	false
SSDEEP:	768:t3aEf6eymukeCPAhtGY1JVR05GcwIuge1Ep+:BrfJymHeCPAhtGWJVR05GcwIuge1EQ
MD5:	E8F9D4B1F9031B898B5EC029BC10F7B2
SHA1:	F2023997D131D0FFEACB531BAEDA15551583F1EA
SHA-256:	84315108D17158EE5C0F74AC6FEAE4F5ED62B5F695B76FF045CE0C2CF743D593
SHA-512:	419928DF6AD3568A54D1831E9DF55027F1F28DCE5BA05179828E6F40E98C33E8ADC3797EEEBF09314BE057657F42D5DE04FC4793ED98B6BF4197A29436B7BD21
Malicious:	false
Preview:	.....................;..,.......R..........h;.......<.......>.......J......p[..h...............Hl......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........&..........l.... ......(...........................................................................................................8;..........L:..H4..................P........................$..\....%......\|+...#..t$...'...(...4......./..t&...........&...........+..........."......@5..............\|.......,1......`/.../...................-...............................:...........&..........'...'.........../.......0..x#...............................'......P,......4#...........................)...........+..x.......`........................................-..........0........)...................+.......................6...'......'......./..,...............................................<&..l9..............................d'..T7..................`$......H1..................................4...p....:...:......P............1..$...T...........

C:\Windows\System32\DriverStore\FileRepository\netvwifimp.inf_amd64_ec11d0ad3c5b262a\netvwifimp.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1bf0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	10036
Entropy (8bit):	3.6026890406287126
Encrypted:	false
SSDEEP:	192:tKxz9Zrb7uOQzXrnoYn8mJovlFlw9svuL:tKxz9xaLcWJovlFQsvuL
MD5:	E7268DEB722FD5E246422D057ECDF584
SHA1:	9F18FAB48AB251AFE813FD527ABC243A4B6545C3
SHA-256:	0DFC78B53643CB4821F2598E2438D2256B944D80E8283C13DE40DAC364298A64
SHA-512:	AF32AE380470D4ED6B24904C7207CC7BCE15CECF7E48AB274AE4876E6AC921A96DF6BDD999DE2C7236A0EAAA6210ECCF7010E9ED2B03A824E6CB02B873551B77
Malicious:	false
Preview:	........................<.(....yl..........\...........T...@........ .......$..h...............0'......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......4.......................x...`...................................................L...........8.......,...........................................................................................T...x...H...........................,...............................................X...................................\...........................................................................................................................................l...............................................................................................................................................................................4...............................................................................................................\...................p...............................................................................................

C:\Windows\System32\DriverStore\FileRepository\netvwwanmp.inf_amd64_f9e30429669d7fff\netvwwanmp.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x10e0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	5676
Entropy (8bit):	3.1764221959436503
Encrypted:	false
SSDEEP:	48:0PuY9X+g7ilW1q24svMp5ug3ghRY1j3jd8YYLj7z1oxD7+Ex3ZxE1qMZ:0PD9X+0it24svMnWR8j3jd8oxdluZ
MD5:	199C56A9E25E22A93818D795F372FFB6
SHA1:	957678B0129D475A0E8762BF56BA62DD4E7FD538
SHA-256:	B052B2DB7FF68539470BAD1712D4C9B8A6EAE69E14365F3F3E8D319018327AEC
SHA-512:	CA2AC5DBE92127A74A0377D9423C6C1410D9E8E830E484D0960367F6EAB57C7E64643259695518B01185FA1BF19E5841E62DC158BCFB698689F237102D801553
Malicious:	false
Preview:	........................<.(......&.........P...........................@.......h...............(.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......P...........................................................................................\.......l...........................................................................................p...................................\.......................................................................................................................................<...........................................................,...............................................................................................(...............................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\DriverStore\FileRepository\netwbw02.inf_amd64_1c4077fa004e73b4\netwbw02.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x18dc8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	237404
Entropy (8bit):	4.190278423987044
Encrypted:	false
SSDEEP:	1536:ziDWQR3dfMPrs7Ju5Wg1Pmb6C6ehbFPAORPFwQKZqCcDr9gK5:ziTyPrs6C60PTIbcHn
MD5:	1620DFD3D9C3C46E5E2C1D93A4D06F3F
SHA1:	1EED1B9D4FCC461B564052EEC98ED172CB1F3B8F
SHA-256:	69A08C89BEAF7FDE413E81D25179BD2315054F21A23C9DC6527F18C1696DEE7C
SHA-512:	A3AA87CB4E51F97CA24160E5D2CE8A0A643F135FB000166A6B8543866E6E23C91DEC5895D680AB803DF9A36DC816ECD85828DA5A296CA1C3CBB28F182090D044
Malicious:	false
Preview:	.......................u]B....:.}.........4...........#..x.......8>..........h...............X.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........N...*......D2...........,..0....x...................u..P....P..x...........\.......pI..t....U..(_...,......L...t............0.....(...........B......X,...&......H[......`c...v.......H...3...E..X}..._..Dp... ..<....X..(...........(........$...... .......l&..Px...............x...s......$........[..dh.....(...............4......T...T....t..<u..............`t......4 ...J......p!...........i...........T......8b..$N.......\|..... 9..p>......H........z......x+...t..hR..d...............x...l...............P...............`....!..(X...K..0g......8"...D......h............c..................Xu......$G...:..........\...........tu..............P ......h...........dI...b......t$..\.......@.......H%..<....'..8...............H.......\....v..X'..........\|....j..(x..xd.......d.......g.......u..t...................@...........T"...A..<<......x...Dh..@8...=..

C:\Windows\System32\DriverStore\FileRepository\netwew00.inf_amd64_325c0bd6349ed81c\netwew00.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x98b8 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	89092
Entropy (8bit):	3.9941390256384417
Encrypted:	false
SSDEEP:	1536:zb5g+bpgE9y3bW3jIcghtleR5GqVWoS47IECHWEflm11aPkQ3ApGsfr:zbtK3bW3jI/leR5GqVWoS47IJm11aPkf
MD5:	53FE048BBA5207F97A3B47CBF9DE7080
SHA1:	DC0201DEB11BCAD0D7C96F603B9632F908A9CBB8
SHA-256:	61426E0E55C0E0E34507DA49E84FDB2688BA569D9726BD83F5CB96B207E94ADE
SHA-512:	6D352068A05E849886B2E5BFD77FB3DF1AB5E1462946AF0FBA5FF2FC37ACF138FA573AB77C5CB3A3C3954E2E820EDB2AC1154689F1CA3FCF1AE5AC64D81CA222
Malicious:	false
Preview:	........................u]B................4...q..................P...XE......h................\......C.:.\.W.i.n.d.o.w.s..............w..............P,...)..........h.......P...<u.......k...{.......?.......j...k...............,..........@h...........t...^..Xq..........D........+..xt.......e..X?..p...Ld..............`{......Ti..<\|..,r...q..l...h....!...C...}.......%........... ..('.......%..x4.......B..................8....9..........H~..$.................... ..4r......H`..........X....+..d............h..........$o..(... R..lp.....Tk.......r..........g..........\|U...f..P}...".....DI.............$...0............t..............................Ht..................h!..............\|.......0l...C...o..x..........................L{..............P........................a...{.......k...k......0%... ..............&..X%...(..4................................(.......$..0*..@p.....(_.......m..........P[..............L...........T....................I..H....P...v......h....p.......d..pe..

C:\Windows\System32\DriverStore\FileRepository\netwew01.inf_amd64_153e01d761813df2\netwew01.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xf730 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	182812
Entropy (8bit):	4.070707069417629
Encrypted:	false
SSDEEP:	3072:yemvIVWLM1Y+K5+Nnmde/MBSOETOluTPdNK76vEj6RO7ridYeIMc:N/6VzMc
MD5:	5B585D24778E57F5D0B1CAF7CBF42FC0
SHA1:	C42A950AF8EF889ED2C821F209205CFFF6DFADEE
SHA-256:	E07A88BAD3755363EC695FACBBC03828F9F569BED77C927C2E18591D6B2AA2EB
SHA-512:	F489935EC51F8B3BB7E57423AA8B95614209509B7979AFC60EA8308663EBE02ADB317DC209F576458DF55C1C99EF14ABF556CA023820D2659A4B505380A4A33E
Malicious:	false
Preview:	....................0....6G....:.}.................@...<.......hp...\|.......#..h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........ ......................T....+..x...................$...8...... ........Y..@...pI..PD......\|0..0?......(i..................P..........\................-...)..........dY..........\.......$z......Hq..............L...X........#...]..\........'..........."..,)..................x....:... .. .......l...`...............(...................."...........................-..h!..........`m.........................@........]......0Z......P...........p...........L....,..x...............x...X............................... ...........$.......0...........l#..................................\|...............@..................p....................!...!...i..<...0.......p...D.......4'......@............(..\'.....8......................................<...4,.................P...........8...............................`...............`......................

C:\Windows\System32\DriverStore\FileRepository\netwlv64.inf_amd64_0b9818131664d91e\netwlv64.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x29320 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	525196
Entropy (8bit):	4.271315618038867
Encrypted:	false
SSDEEP:	3072:QNg+la3Qmzi5NIoE47etlvR3ouFF9uO7bLfnzaa0Ec/07OYqfyTptY9vDpVHT9s/:QNDzJV3QaBKfehkb8Qm7O
MD5:	8F8A2F7CF5A8E1A1B4908E0AD94B83C4
SHA1:	AACA91BEB22B6F4DFA0884EABF14DB50B5439263
SHA-256:	5BC3EE493AB44B62AAB3DC6E7598D7E8F6801198125AD35DC6E009B99DD4817D
SHA-512:	75C2E9F2B1B220712FAD6C3ACC5331DA68357860C66EC2A6A389FC6ACB753EE7E8682B7FD55640D0F5D3DE420D995479C852EFF991743DC1C86A80296DFBAEC6
Malicious:	false
Preview:	.................... .....I....:.}.................0....M.......?...!..........h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......\|W...Z...].......D.......u..<%..........0............/..H...\|...H...Da..Dl..xl..$k..Xk..PP...z...Y......h........%...E...s..........l...l@..H....X...I..(..../...Y...q..40.. s...l......j...........W..........t......I..La..l0..,........... s...I.......m..,_..d9.....D8...3...:..l)..hl......du...y.................\|i...K...`..........L...<G........._..@R..<>...<...l...N...............W...:..l........D...U...'......\\...C..$<...5...S...G...m...I...D...R..\|s...}..<-...2.......V..tA..<S..............0....d..\f..x............/...Y.......r...-.....$q......Xp..8...x...`U..4A..........\...X....@......P`...b..tr..p8......Lu..H....H..........4...Pb..@,..X0...^...&...A.......r...@..d7...8.......-...^..t~..L....b.......B.......?..H..PJ..l........d...V..4)..t7..d^.......R..0.......d...........,/...~......t=.........,...........TI...V......<;...4...V..

C:\Windows\System32\DriverStore\FileRepository\netwmbclass.inf_amd64_dba6eeaf0544a4e0\netwmbclass.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1c60 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	10492
Entropy (8bit):	3.589939072710336
Encrypted:	false
SSDEEP:	96:aVFFzOkn0maOBT6f3m6qLCMH9Se2U68GZNT0vyjbvMwxA4ZVl/YxnDTHaqZx:axumtheYvHQc6ZDvNA4MDTHaK
MD5:	CFA9351DE24659642CB8FCC40DA81DE4
SHA1:	EDE57F3A5D4B891EAD92B9816F3AC6DEE8034F0A
SHA-256:	9F5B0A5F8BBA88D6DA12E1D452D91116B997F17B450D2C58CF4BBF5E2F9BF718
SHA-512:	D10E790DC99E6F3FE18FA32D182EC660075ED8CF0BD80FA4CE4D911033FB41D652A983580474EED83BAFAFBD40002783EAD36E11C20FD2B7344A7FFBECF07639
Malicious:	false
Preview:	....................`...gi../...(km.................X...T............!......P%..h................(......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...........................................x...........\|.......................T...........................@...............................................................................................H...........................X...................L...............................\...............................................................................................4.......................X...................h.......x.......................................d...............................................................................................................................................0...........0...........................................................0...........................................................`...........................................P...p...................................8...\|...........................

C:\Windows\System32\DriverStore\FileRepository\netwns64.inf_amd64_162bb49f925c6463\netwns64.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x12018 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	177060
Entropy (8bit):	4.13144608840925
Encrypted:	false
SSDEEP:	3072:n3lIP8WNhtA+Esd5+ENVKWXqgz9I3+DrkkO8PP8CQ2NiiSDpp6zrejoD5Oev2wfg:nlwoKF2F
MD5:	95AC4314FAE5EE4C9BEBCAE355151C11
SHA1:	9D1C876BE7C13D7B13B018F28DA3FD83D586A4E1
SHA-256:	9F87C2E467D5B15DA3B47192B0B5CDC650111AB277A6F91F56C2B4482E944BA4
SHA-512:	B8000A7656268F93A3C02460355AAF38D13BAABBFA0A98B44E37AF83B27F0134C3E92983BA70EBF802CB0F2B4E67E3078421FA5D82E921984AD91712327AD962
Malicious:	false
Preview:	..................... ....I....:.}.................(!..L...x/...c..0...8...h#..h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......x...H............f.........................................8...0...........\...........\...DQ...u..\|...........H............a...........e...............o..........DT..@...4f..H....p...U......0$.......h..T(..........X...tb...;..d...........h....]..L........r.......5..\|...........................p....................\|......T....%..............p..........L...........0.......`.......L...........d...............................Y...................%..........<...$...8...H...............H... ...........4........y......d!..............\...........4...4...._.......w......(...$i......@...........D............$..x...............................L........6..p*...........U..........D.......0...........$...............<9.......{.......4..@...D................... ...0B..$%......@?..........d..........8.......T.......h........{..............................

C:\Windows\System32\DriverStore\FileRepository\netwsw00.inf_amd64_24d55504ae3587aa\netwsw00.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x10c10 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	161044
Entropy (8bit):	4.1003267299604484
Encrypted:	false
SSDEEP:	3072:97ygzN37yz7icP6Zls+H8Ptu/m0KI1168MUS6B/2mqqX+c9Bs:Fb+Us
MD5:	90A349C3FF263443F4AEC4AC166C5468
SHA1:	78AD80EA90628744057FA9B44127F8B870806431
SHA-256:	A778B7CFB79214E1E7EAD401904027EB91676D6323B0C4DEC1BD6750BE7D15F3
SHA-512:	3DF2A83D6F56628A595D06618A137629F07652FCEEFD6F5536218EF24E94EE7585E07EC03D25C28D72CA6BBE9E2023FDAC54E87146B9515458BC71EC69D990B6
Malicious:	false
Preview:	........................F.K........................ ...t.... ...U...v..<.......h................u......C.:.\.W.i.n.d.o.w.s.............D.......4.......8T..................P...4.......h...............@~..`h......X...\|............S..4...........................0...............................4....~......(...(.......h...D...........t...................l...`............P..........PK...t......\...Pc.............. J.......... ...P...............`F...................K..........................\|S...J..................\...................8...............................8.......t.......DM...R..h...D...........T...........................p...@C..<...........4...D...(*......(F..................................4...D...............D....R......\...............4...........PJ...J......l...0...p.......t.......lP...L......L....$..@Q...P..........T...........@E......<.......`...4...........................l,..d...@-...)..\|...(....... .......................E......\|...........T......................X...

C:\Windows\System32\DriverStore\FileRepository\netwtw02.inf_amd64_42e02bae858d0fbd\netwtw02.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x2d860 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	413292
Entropy (8bit):	4.177806561511297
Encrypted:	false
SSDEEP:	3072:uWh3WY78QG0nrKSjGekfdFtqSPT2ZHBl3oX:JrKSSeklR2ZE
MD5:	8714C3032A3CB6C5AEFB7DF035AC302E
SHA1:	2FBFE9B244F2A1162DB7B220C9EA7D4BFC819E75
SHA-256:	80731FFB68E945C1C1952C7759023DE294B47369932A8FB87A94AB6806E8CC5B
SHA-512:	285B956599671A1450B02766F617629F39943654E5E138822F65400AA8133330F93A70B89BB4DB61D6B537299DB12295675EB5044FA1924C73B4D1BD418AF05B
Malicious:	false
Preview:	....................`....[N....:.}.................p....;..H...<.......l'...&..h...............hN......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......T^..........`6..@....,..,"..\..../......@\|......0...L.......}..lZ..PU......(........$...W..p...@...................4/..x....S..(K......,...........l#..............8...p...........`...<m...n...j...+..`-...(......k..........z.......G..`I..4.......h.......0a..............T...<.......0....... ...L...........................$..................$..,....c..Le..x`..p!......dp...h...b...&..p'..(....2......H(................. .......(....g..._..8... ...h...`.... ..................................(...........x...........t.......T...........f..(....9.......6......(-...;...............\|..............8l...m...i..(...l,...'..............\...t).. ...........................................................<...$...................?...7..............h...4............v...w...r..p_...I...2..`o...t...a.......F.. ...........<'..........8.......$..............

C:\Windows\System32\DriverStore\FileRepository\netwtw04.inf_amd64_c8f5ae6576289a2d\netwtw04.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x188c8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	217836
Entropy (8bit):	4.219343400226776
Encrypted:	false
SSDEEP:	3072:qj5dNU3bSPUWY3dmYmIYAPN4uUP1fBmPr2bHOA7vIs4hu:bcethN1UP1fBmPr2bHOA7viu
MD5:	6BD15B0FDB17DFFCDCC6D4EE0223149A
SHA1:	2A61B9A8368F18B88668B657F4D0B8C997EB050E
SHA-256:	1B2ACDDE8DA5EA27D519EDB7BDF30E9DC91486178C493412F34FDE20E864D15E
SHA-512:	9D79DAA5C19C6AF7C37E6111E9E91B15CD21AEBC90045B6299CEC31A7BB6DBD514A6B84774E2F5CDDE90E18EF36A0332FBB6B5F5D3939048E96A5B794694DD61
Malicious:	false
Preview:	.......................[.P....:.}.........8...a..........p....v......d.......h................R......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........%..`#......\|q......<M...'...!..................0....t..._..l+...z..........86..X_...G...z..l$..........4...................l$...&......p.......0...P...0...............\...dk.../..pS..........dR.......4...m......$....D..\...l....:..........x........t..<............v.........h...`q..d....-...x..$................o..4...........x...D...........\..<I.......(...q...............f..L...........8...XY.......i......(`..l...l!..(.......T...$}.......z...1..d%.......&...]...,.........................8O..........x...@....R..........Xt...8..Di...#.......................6.......b..t...\.......D....s..l....A...+..............8........s.......P..4...........T....e......._...7..........D.......H%......$...0... ...@...............?..(...........0 .../......L"......4y...c.......K..........HT..8t......@...@~......0.....................`...........\|...(.......

C:\Windows\System32\DriverStore\FileRepository\netwtw06.inf_amd64_2edd50e7a54d503b\netwtw06.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x12d70 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	165348
Entropy (8bit):	4.1550411723640375
Encrypted:	false
SSDEEP:	3072:9tl0wfFCp6/ZH8dY3trm+lkCSiCSCiCiySiSiyCiyCysSiyCzyCSyCSiiiiSCSif:Fgyrm+Ff
MD5:	70E4EB02CFA74BC4DB97965D9EFB141F
SHA1:	7A90101DB320209EA5B9A9D705C46F1F1E808BA6
SHA-256:	9707D2943A6E6FF1659541D20EBD3D485563196211124D5EBA29677D18FEB354
SHA-512:	25E2F124F0C908F8243FF403C84778A5EB2EC3057255956903B33A8422E080508B0ABBBA7ADFE05C3DFC6B7E37C7DA71C31ED9EA6DE5B753A09934C8685E8A66
Malicious:	false
Preview:	....................p-... T....:.}..........,...............B...X.......u..`...h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......l).. '..........d....\|...+......0....................................a...h...J..............,(......d+..................@........n..........L..........0+..`#.......x...h......8...........D%..............8.......d...@"...~.......l..........8...\.......T...........\|...D..............$...pb......4....w..........D.......,s......./.........T...x....P...R......<....\|......H,...................,...,..`...............,l..,%...i..........................p......P*..........Hi....... ..........H...L................+..........................................\......................................................................\|'..0....}..T...................$..................(...h....).......!.. ....$...y...z...v.......................#.......!.....d.......0................{.................. "......t....+..l+..@................ ..X&..l!..........

C:\Windows\System32\DriverStore\FileRepository\netwtw08.inf_amd64_7c0c516fb22456cd\netwtw08.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1b7c8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	227612
Entropy (8bit):	4.309617020442084
Encrypted:	false
SSDEEP:	1536:YPigoEOMGRkpIAMPk293nW6Y0e2qgj4BYUoEaYpHEnzYRrMxaul9B4L7K0j05pTi:YqgoNyItPn9Yjsj6bPMwul9B4LL
MD5:	61356F344F00CF7FAFADA282CD302833
SHA1:	B6D4293394867A2F05269A0962C5F15F0D1B5CC3
SHA-256:	DEDA3F925FAA6253C7F72136AA77F6BD5931880329C367E0D73F4801BE27A1EE
SHA-512:	6EEA956D1766E1844E9F7EF3276042965E7F6B49143EC3DE27789B611B2E40ED38B0A2F16EBEA03C857CB60F9E0AC701C9011B5CB4F47D6033FD5C6B20290A42
Malicious:	false
Preview:	.......................}.U....:.}.........8..."...............p...?.....P...h................y......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......P0......<................4...,..........X........y..x....}..............L......4....P......./......P4...(..`V...].........<1.......;..HE...1...@...R..@...D..Pb...Y..........DY..tz...........Z...:...^......8..........t.......,...L......0...@#..8...8%......................`...H....!..4.......@Z..\%..<O.........x>......<............%...A..8........E......(v...p...$......,E..DL..............0...(............8..0...............@.......T+......T...d.......<3...Z..................P...0a......L].......I..D5..h....................a..4..............D...........8...T...P.......l...P...\|..............T....................X......( .......,...1..............8......`a......`....%......./..HS..p.......d+.............................T....*......h(...,..p...D........3......XN..........4<..........................t.......\|...........0...(.......,.......

C:\Windows\System32\DriverStore\FileRepository\netxex64.inf_amd64_ede00b448bfe8099\netxex64.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x5b28 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	39292
Entropy (8bit):	4.028509750695518
Encrypted:	false
SSDEEP:	768:uy8n/ZzNhVAGRfysrB0tTfvhUY7nvNEHBIWc39uHN2tS:uNnpNhVAAasrB0RvhUY7nvNEaWA/8
MD5:	EC280217E5DFDD8B4B45D59C0C86B74F
SHA1:	9CA8D950C91D06039284E8CE79B8325BE007E4EB
SHA-256:	ED679B39C7007F7204B30EEACF6BDD05D64B926C42FA5010F2017DEC2BC629FE
SHA-512:	46CEAAD708FC78DC037773E4602A704AFB661CC18659962E4FF7D89C5A1294640613E329729C21E71B532CC7CE109920C0BE11847A72180457724AEFB87A4970
Malicious:	false
Preview:	........h...........([..,.......R...........Z...... \.......^.......n..\.......h...............x.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........J.......T...............)...4..........T.......`H......(I...........:...>...2...........,..l/...<...(...........D...............;...Y.......?...V.......O......<P.......*..@...XU...V...........@...D..pA...C..TT...?..(U...W...........P.......P......86...B.......7...7..........h>...>..................l....................................N..........tB...............(.......Y...............E...............@...K..DL......PV...?......................D...................4O......P........A......\B...................E......................0+......(...........0>..........................lM..\V..0...............t...................PW..(M......xN..p ......$T..HM..................(............... S..........xV.......E.......................U...W..................4@..x.......DN...M..................xS...............Z...Y......\................N...........3..

C:\Windows\System32\DriverStore\FileRepository\rndiscmp.inf_amd64_81bff1eb756435c6\rndiscmp.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x11e0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	6268
Entropy (8bit):	3.2173352889878686
Encrypted:	false
SSDEEP:	96:Dc+jHWWT1PRQFkSqwXc5aaMzmJmKeO4QXE:RVPQOaM5aaMzmcyZU
MD5:	DE84DD4C8831D5F1A60B0572522D54CD
SHA1:	0F5417A36EF0CB7E0C4AAEB7DDCB0B5F71EF2998
SHA-256:	C1EECF85AAB841464D5211626BFFB327274EB1FA55276062E317BCEF20D7A629
SHA-512:	5E4701C6F5F8B8C4D4C3DB9B4816C5BC9B0C2B1C509EEB828F52722A8344603A5428DB72386D001BE80F9F1643D02B71B3CB3DCCC8E0FF44ECAA0DA875EE99EE
Malicious:	false
Preview:	.........................-......#..........L...................t...............h...............x.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...............................................................................4...............................................................................$...............L....................... .......(...................................................................................................................................................................\|...........x...............................................x...........................................................................................`...................................................................................`...............................................................................................................................................................................................................................................................

C:\Windows\System32\DriverStore\FileRepository\rt640x64.inf_amd64_8984d8483eef476c\rt640x64.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x13948 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	159188
Entropy (8bit):	4.290225126574499
Encrypted:	false
SSDEEP:	3072:iWxe6Etnc44MJnTCesun7ICkMKTyS6UfRGUslw0Rv:6tnpWAw0Rv
MD5:	4D68364436A7415201D82E8A0E9C8E3F
SHA1:	563D69078FCC4C0696A465065CC7E4E2EDF1446C
SHA-256:	0C58D2326D880674FC4D28C4D03885D34C5B5A56EB5546F11EA8AB2D9AF4FE09
SHA-512:	8161BD2FDE4DBD9DA9DD261AF015550204652D619A42EB32F87D58CC8B1C803622C86DB5384808F258453A4E7CAE92E5109D65F37684FF3DB108315CF4BA61FE
Malicious:	false
Preview:	....................H9........4Ne..........8......@:..p....G...P..P....j......h................m......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......0h......$...P.......H#...7...?..................$...0...'.......................$......8...........@7..........\...@.......P...................,5...%..........).......5......\|....5.......F......t...0....,......x.......,............1..$...`!...r...e..\|.......\|... 6.................P..........D...t.......P"..D..........HK...........)..l...........x6..(...d...H<.. ...,8...E...f......Pf...f...............................h%.../...t.......)...(......L\|...\|......$...X...\|...d.......t..................L...(....8..............................................8c..4...\.......................H.......X...L...$...$A..<B.......A..........p...@...\|... ...............(...H............%..$D..........l...................lD.......?..........p3...:.......5......`...P.......................@!........... ..X........8...7...........&..8d.....................

C:\Windows\System32\DriverStore\FileRepository\rtux64w10.inf_amd64_d6132e4c7fe2fac6\rtux64w10.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x8f48 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	71204
Entropy (8bit):	4.057647555384605
Encrypted:	false
SSDEEP:	1536:s+Dld5V+6kdjlL1PX3nJ8oGB4Ewr8ubNscUQfeYe5p+hhv6r5mtippfXuHrHfxM3:5hd5V+6kdjlL1PX3nJ8oGB4Ewr8ubNsp
MD5:	D5FDFBA2AB631191BAB90C4A47B17BFC
SHA1:	5ABD1780317C51B0DF880E28992D13455E66BFF5
SHA-256:	2380DE39B1CF4B33F616852BA3D13313BC57C0FE7928331FC291CFE827C468E4
SHA-512:	8A5F8B904A195EFD4CA243C4DC48FF33A80337FE5DFB870FF4F4257ED5F2C461DC8775F7FD0600BF0F7CF2337B4B129AC3B91EB2227D65A902ABD83296C17E49
Malicious:	false
Preview:	....................H.........4Ne.............H...X...........(#.. ...........h............... .......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........K.......................5..l=..........H?......8C..lF..lz.......]...G..........L....S...T...U..`V..P5...b.......................f......0...............}...l...}.......7...............2.......e..l6...f...t..Lr.......e..h....%.......j......\~...m.......m......D...Xh.. p...'.......\|..8u.......k......@`.......n...2...:..........Tr..........,8..t........3..L3...3...3.../......x4...T.........,..........@f...e......H'.......b...............-...............................i......$3..`3...W...3...C..P4...4...4.......(.......!..................l'.......7...................`.......Z...k...............k..........P-......Lf...R..........\........(...i..h+..p...lm...U..X1.......!.. h..\/...........h......d... 2..`o...9.......n...6......T9..............0........e...$...L..."..............P.......$...........$...\|...8.......`0..L,..........(...`....p......

C:\Windows\System32\DriverStore\FileRepository\rtwlanu_oldic.inf_amd64_1a82423cc076e882\rtwlanu_oldic.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x131c8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	134220
Entropy (8bit):	4.2615190441864526
Encrypted:	false
SSDEEP:	1536:V3O3P28IUC0/3krI5S1Ca5e0DkYqMa296XR:V3xTrI5S1zwmi2W
MD5:	3A058E814F8BE32D3D5005DEB4CC72FB
SHA1:	327FA1E376E96EC1F77C4D2B4C39E24D91527535
SHA-256:	8CDC88582EED0D336A8AD3DB8F0BE4F76F541C7E50ACFFBDF579BFA1001147B8
SHA-512:	84B2CE5CDA109A8BFABCD34D1DE2BB0DBF6798AC49D0829495775E52CD0F51473E276ED7152F6D5F02F8E29BDD18B8FE48765AEBDED766F306BC078FA63BBB9A
Malicious:	false
Preview:	.....................1...#b....:.}.........81..j....2..H....;...:...u..DK......h...............H.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...............4k.......K..L.......4a..h...(.......................d....'..4....2...........@...$..........p.......................0h...........................%..l...........................................T... ...\...T...H... ................W...........c..,)...\..h.......8N..p...(...<....s..............................$ ...............U..,......................<.......X....0..................................-..,8......."......0L..45.........H...x...."...+..........\,.......&..('..Xr.......'..p............J..........h`...........?..............L...4v......H............B..(@.......)...........,...*...$......d............... ........]...........!...............j..............`...8...........\|...Hn..\:...i......D...............lW...X.......Z...\...............J.......g..H...p...@...<................0..dx...0...0..`...X2......................h.......

C:\Windows\System32\DriverStore\FileRepository\usbncm.inf_amd64_9957a38c3d2283ed\usbncm.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1a00 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	9172
Entropy (8bit):	3.537836984039507
Encrypted:	false
SSDEEP:	96:Zi+K8bG/zBa6cvGR2+n77pZkRCV628QXj5KqZUt0LQ56nj7Ia9UyYc0EN+:ork67k+sYswKqjQa9UcXU
MD5:	7317BA0BF255BA3C3FEEA7350ED2FEAB
SHA1:	7494DB7584B3A2A1FB6700AB8E863F31E99025AB
SHA-256:	7FC13D01915E99A648570A788681F02791B8F2FF958BC67B55E5AF46E935BAA7
SHA-512:	A4D78C391048B490813B882A8678E615922DBBC53F5A11A8782C5E4B244C1BDEAC75407734D075377D34F8C99DDB4DFB8B38A525C146FA3754C0E593D5A22E43
Malicious:	false
Preview:	................&........#b........................(.......@...@...........(!..h................#......C.:.\.W.i.n.d.o.w.s.............................4...\|...4...........................................................................(.......................................@...............................p...........d.......................$....................................................................................... .......p...............................................................................................................................................................<...........................................................................................................................................................P.......................<.......................................................................................................................................p...................................................................................

C:\Windows\System32\DriverStore\FileRepository\usbnet.inf_amd64_9e6bb7a4b7338267\usbnet.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x2fa8 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	18604
Entropy (8bit):	3.7649793801414453
Encrypted:	false
SSDEEP:	192:MMb2TiZSF73gfwVpgDKw4+TFWJ6hk1pZUSTTeFOAHOXkATTdXli:lKT4SF73gfwVpgm4MJYk1pZUI6FOsAHK
MD5:	178AAEE74D589BEFA860260971878551
SHA1:	EBE050885838162DE74C2B441AD3DF249CDEA4AF
SHA-256:	9E861EC1543184BE8D5137F273B18D330C6B5091798D1FA4AD3D756A40CA7ABF
SHA-512:	6B962B0BBA4D51340D996ACAE8974A6D7AB89B72FE59AE4EA9D29ED0CB0E3D886DFC9781F4BF54D9026A1008A102BB30A2527573207437F93CA338746190645F
Malicious:	false
Preview:	................"..../...+................$/.......0..@....2.......8..P...X@..h................H......C.:.\.W.i.n.d.o.w.s.....x..........t ..............p....................................................................................#............... ...........&..\..........................t........-..$........(..."..$ ...$..........................0...X....!........... ..................................................`................)..............................0...x.......d......../.......................#......@&..d...P)......................................................\...<#.......%...&..........................@..................x&..........0...................................................$'..t#...................'...(..........................$..D%...............................................,..................h'..............(+......L...............................................0*..........................L...............0&..............................

C:\Windows\System32\DriverStore\FileRepository\wceisvista.inf_amd64_07ad61d07466a58a\wceisvista.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xf00 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	4932
Entropy (8bit):	2.986616576320396
Encrypted:	false
SSDEEP:	48:9F537BvhkGEcr08QKgvr5DVyiqlTkuAPVs6AN2eb7+WFjTDVRc:9F53N6GEcY3KwRYTkuAPVvrUj9Rc
MD5:	9D73A7B0AFED7AE61095A766EA70B4E7
SHA1:	BC1F893FEE4CE513B99A542FDD6C280A82F473F1
SHA-256:	45951B6448005F89E035178AA385FB327B06B411DB8908ACD95060878DF24332
SHA-512:	343ADE70381323D2CA56149FD2271233ECF0CFAFA40180959A6B74A898AF88DC35AA540981873E75816D708187907B8A690226CDE38C57990771FAAF86B17EE1
Malicious:	false
Preview:	.........................-......#..........p.......................p.......X...h...............@.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...........................................................................................................X...............................................................................................................................................................................,...........................h...........................................................(...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................(.......................

C:\Windows\System32\DriverStore\FileRepository\wnetvsc.inf_amd64_268e58b44338d192\wnetvsc.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x5c08 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	42796
Entropy (8bit):	4.00376695313131
Encrypted:	false
SSDEEP:	768:eXZiBH417mPDW4rf5KcjfhlPOY9FlzpBimDNmctnekDTtKBRjp8YEDc:e0BH417mPDW4rf5KcjD19FlzpBimDNmJ
MD5:	E8B928097B0688681BE77BB64C1F0109
SHA1:	0670F6389C49017629176D94D976F5A9BC72553C
SHA-256:	48C65C343C5F277A1EA784B70B7316658DEF7F868C04D55263819ADB60ADCFF2
SHA-512:	DFECF3DC11C93B3E6EC5855F0AD6999BE0A83551C7C0F31125DE92C196599943EBACF10EB51BFF77E7730DE818B5AAB9DF766BEA2EF0C2256F84E6509C659E51
Malicious:	false
Preview:	.....................\...$../.......0.......t[..&....].......`.......r..........h...............(.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........#.......C...9...........!...%..xQ.......+.......6..........8....N.......................C..........l!..........................81.......5...............#..dS...................Z..\Q......,R..,0..."...=..p7..tV...:.../.......4.......F.......4...E.......9...........E..@:......P.......TG......P;..................................D....... T..............4 ...;... ...G.......#...S...*..\|Z...C..............\|B.......3...3...F..$/.......&...............5......X............-...9.......0..4P..........4............................'......$S...............3...5..H...........................................T1......\....4..t5.......F...Y..................\|H..X3...4...............O...................+..................46..........."..,Y......x...$7.................../..............................8....A...[...........#..x#...N..T........(.......C..LB...A..P-..

C:\Windows\System32\DriverStore\FileRepository\ykinx64.inf_amd64_0bbd8466b526ef26\ykinx64.PNF

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x47d8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	30020
Entropy (8bit):	3.996557623360472
Encrypted:	false
SSDEEP:	768:HQfHNVAYaNc7keBsIW5ouh5ZISJQ2zPs5d06VaJF9v9o:HQfHNVAYaNc7keBsIW5ouh5ZISJQ2zP2
MD5:	761FC7033AAF5B77F8E35D5AD13A083D
SHA1:	49D78D107E062B6FC6D982E375C3528FF8821F09
SHA-256:	55CC6F521A63D198B8ED53615E24168244E1B01B40478B3A49EC1586EF97ED45
SHA-512:	50324ED5F5392CE1085171C64ABF0648A85DD197872BAF7C9F44933283F112317E6CFE069C73C3BB0F160C1DB1B169B940E746ECB3499B00B5EAF335B3504468
Malicious:	false
Preview:	.....................G.....................DG.......H..X...(K..X....V..`....e..h...............@u......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........7...$......p&...&...'..P........%.......%.................. -..........<-.................. A.................. ...............l1..0...........DD..."...#..@$...>......,...@...x=..4!......L)..hF..d4.. &...+..8A.../..T0...E..........x>.......?..P.......\|A...............6......p/......4=..............l........................................................................F...................G..$G.......0...)......,...6...-..P4..4....1..............................p7..`6..................................T.......`"...(..$............... F.......................;..............................................................<B......p...........F.......................................................D...................................B.......(...D......@0..........................d;...............=......@F...E......................,7..............

C:\Windows\System32\DriverStore\Temp\{edf7d8d8-304a-1448-a26a-bba0a7428f74}\SETA714.tmp

Process:	C:\Windows\System32\drvinst.exe
File Type:	data
Category:	dropped
Size (bytes):	11245
Entropy (8bit):	7.248368253798659
Encrypted:	false
SSDEEP:	192:gM6dynJCSEJOL7yKnUi8rFWQFIGjl8zjEswYt1FfRM/GX01k9z3AeOlFa:gqS4CFRWGjl8M8/fi/GR9z/OlFa
MD5:	8ABFF1FBF08D70C1681A9B20384DBBF9
SHA1:	C9762E121E4F8A7AD931EEE58EE60C8E9FC3ECB6
SHA-256:	9CEB410494B95397EC1F8FA505D071672BF61F81CC596B8ECCD167A77893C658
SHA-512:	37998E0AEE93FF47FE5B1636FCE755966DEBE417A790E1AEBD7674C86C1583FEEF04648A7BC79E4DEDAABB731051F4F803932AC49EA0BE05776C0F4D218B076F
Malicious:	false
Preview:	0.+....H........+.0.+....1.0...`.H.e......0.....+.....7......0...0...+.....7.....V.o....F.W..B....220518151502Z0...+.....7.....0..V0....RB.E.2.7.1.1.1.4.8.B.9.9.2.A.A.B.6.B.D.C.7.1.3.C.9.9.6.8.3.E.E.0.C.F.F.3.F.2.8.7...1..S06..+.....7...1(0&...F.i.l.e........m.b.t.u.n...s.y.s...0M..+.....7...1?0=0...+.....7...0...........0!0...+.........'.....k.q<.h>....0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0f..+.....7...1X0V...O.S.A.t.t.r.......@2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.1.0...0...0....RC.E.C.5.E.8.8.C.2.4.8.1.D.3.2.3.E.C.3.6.6.C.1.8.0.2.4.D.6.1.A.1.1.7.F.0.1.B.2.1...1..K06..+.....7...1(0&...F.i.l.e........m.b.t.u.n...i.n.f...0E..+.....7...17050...+.....7.......0!0...+...........$..#.6l..Ma....!0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0f..+.....7...1X0V...O.S.A.t.t.r.......@2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.1.0...0.......0...0J..+

C:\Windows\System32\DriverStore\Temp\{edf7d8d8-304a-1448-a26a-bba0a7428f74}\SETA724.tmp

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	1906
Entropy (8bit):	5.5538908997445064
Encrypted:	false
SSDEEP:	48:FjfmAP/5H7cXq7lthzHU/lltFDmDQB7581EjEkD:Fj+AnlAXq7ltZHUxp/qeEkD
MD5:	5D1917024B228EFBEAB3C696E663873E
SHA1:	CEC5E88C2481D323EC366C18024D61A117F01B21
SHA-256:	4A350FC20834A579C5A58352B7A3AA02A454ABBBD9EECD3CD6D2A14864A49CD8
SHA-512:	14B345F03284B8C1D97219E3DD1A3910C1E453F93F51753F417E643F50922E55C0E23AAB1D437300E6C196C7017D7B7538DE4850DF74B3599E90F3941B40AB4A
Malicious:	false
Preview:	;..; Copyright (C) 2020 Malwarebytes. All Rights Reserved.....[Version]..Signature = "$Windows NT$"..Class = Net..ClassGUID = {4D36E972-E325-11CE-BFC1-08002BE10318}..Provider = %MBTun.CompanyName%..DriverVer = 09/03/2020, 1.0.0.0..CatalogFile.NT = mbtun.cat..CatalogFile = mbtun.cat....[Manufacturer]..%MBTun.CompanyName% = %MBTun.Name%, NTamd64....[SourceDisksNames]..1 = %MBTun.DiskDesc%, "", ,....[SourceDisksFiles]..mbtun.sys = 1....[DestinationDirs]..DefaultDestDir = 12..MBTun.CopyFiles.Sys = 12....[MBTun.CopyFiles.Sys]..mbtun.sys, , , 0x00004002 ; COPYFLG_IN_USE_RENAME \| COPYFLG_NOSKIP....[MBTun.NTamd64]..%MBTun.DeviceDesc% = MBTun.Install, mbtun....[MBTun.Install]..Characteristics = 0x1 ; NCF_VIRTUAL..AddReg = MBTun.Ndi..CopyFiles = MBTun.CopyFiles.Sys..IfType = 53 ; IF_TYPE_PROP_VIRTUAL..MediaType = 19 ; NdisMediumIP..*PhysicalMediaType = 0 ; NdisPhysicalMediumUnspecified..EnableDhcp = 0 ; Disable DHCP....[MBTun.Install.Services]..AddService = mbtun, 2, MBTun.Service, MBTun.Event

C:\Windows\System32\DriverStore\Temp\{edf7d8d8-304a-1448-a26a-bba0a7428f74}\SETA745.tmp

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	110104
Entropy (8bit):	6.851513818294034
Encrypted:	false
SSDEEP:	1536:k0h5S895dQOYJaryTmbMc6uqkZUcmSl47AjpdAyDCYJqUufIfmNn3VzwZ6Dh7Q9y:C895uOYJar1MLcmSlrSgC6Duls2t
MD5:	83D4FBA999EB8B34047C38FABEF60243
SHA1:	25731B57E9968282610F337BC6D769AA26AF4938
SHA-256:	6903E60784B9FA5D8B417F93F19665C59946A4DE099BD1011AB36271B267261C
SHA-512:	47FAAB5FFF3E3E2D2AEA0A425444AA2E215F1D5BF97EDEE2A3BB773468E1092919036BCD5002357594B62519BF3A8980749D8D0F6402DE0E73C2125D26E78F1E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......{N..?/..?/..?/..dG..6/..?/..K/..dG..;/..dG..9/...F.../...FA.>/...F..>/..Rich?/..........................PE..d......b.........."..........2.......0.........@.............................`....../......A.................................................0..d....@..........D............P..8...`...8............................................................................text............................... ..h.rdata..t...........................@..H.data...............................@....pdata..D...........................@..HPAGE....l.... ...................... ..`INIT.........0...................... ..b.rsrc........@......................@..B.reloc..<....P......................@..B........................................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{edf7d8d8-304a-1448-a26a-bba0a7428f74}\mbtun.cat (copy)

Process:	C:\Windows\System32\drvinst.exe
File Type:	data
Category:	dropped
Size (bytes):	11245
Entropy (8bit):	7.248368253798659
Encrypted:	false
SSDEEP:	192:gM6dynJCSEJOL7yKnUi8rFWQFIGjl8zjEswYt1FfRM/GX01k9z3AeOlFa:gqS4CFRWGjl8M8/fi/GR9z/OlFa
MD5:	8ABFF1FBF08D70C1681A9B20384DBBF9
SHA1:	C9762E121E4F8A7AD931EEE58EE60C8E9FC3ECB6
SHA-256:	9CEB410494B95397EC1F8FA505D071672BF61F81CC596B8ECCD167A77893C658
SHA-512:	37998E0AEE93FF47FE5B1636FCE755966DEBE417A790E1AEBD7674C86C1583FEEF04648A7BC79E4DEDAABB731051F4F803932AC49EA0BE05776C0F4D218B076F
Malicious:	false
Preview:	0.+....H........+.0.+....1.0...`.H.e......0.....+.....7......0...0...+.....7.....V.o....F.W..B....220518151502Z0...+.....7.....0..V0....RB.E.2.7.1.1.1.4.8.B.9.9.2.A.A.B.6.B.D.C.7.1.3.C.9.9.6.8.3.E.E.0.C.F.F.3.F.2.8.7...1..S06..+.....7...1(0&...F.i.l.e........m.b.t.u.n...s.y.s...0M..+.....7...1?0=0...+.....7...0...........0!0...+.........'.....k.q<.h>....0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0f..+.....7...1X0V...O.S.A.t.t.r.......@2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.1.0...0...0....RC.E.C.5.E.8.8.C.2.4.8.1.D.3.2.3.E.C.3.6.6.C.1.8.0.2.4.D.6.1.A.1.1.7.F.0.1.B.2.1...1..K06..+.....7...1(0&...F.i.l.e........m.b.t.u.n...i.n.f...0E..+.....7...17050...+.....7.......0!0...+...........$..#.6l..Ma....!0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0f..+.....7...1X0V...O.S.A.t.t.r.......@2.:.5...0.0.,.2.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.1.0...0.......0...0J..+

C:\Windows\System32\DriverStore\Temp\{edf7d8d8-304a-1448-a26a-bba0a7428f74}\mbtun.inf (copy)

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	1906
Entropy (8bit):	5.5538908997445064
Encrypted:	false
SSDEEP:	48:FjfmAP/5H7cXq7lthzHU/lltFDmDQB7581EjEkD:Fj+AnlAXq7ltZHUxp/qeEkD
MD5:	5D1917024B228EFBEAB3C696E663873E
SHA1:	CEC5E88C2481D323EC366C18024D61A117F01B21
SHA-256:	4A350FC20834A579C5A58352B7A3AA02A454ABBBD9EECD3CD6D2A14864A49CD8
SHA-512:	14B345F03284B8C1D97219E3DD1A3910C1E453F93F51753F417E643F50922E55C0E23AAB1D437300E6C196C7017D7B7538DE4850DF74B3599E90F3941B40AB4A
Malicious:	false
Preview:	;..; Copyright (C) 2020 Malwarebytes. All Rights Reserved.....[Version]..Signature = "$Windows NT$"..Class = Net..ClassGUID = {4D36E972-E325-11CE-BFC1-08002BE10318}..Provider = %MBTun.CompanyName%..DriverVer = 09/03/2020, 1.0.0.0..CatalogFile.NT = mbtun.cat..CatalogFile = mbtun.cat....[Manufacturer]..%MBTun.CompanyName% = %MBTun.Name%, NTamd64....[SourceDisksNames]..1 = %MBTun.DiskDesc%, "", ,....[SourceDisksFiles]..mbtun.sys = 1....[DestinationDirs]..DefaultDestDir = 12..MBTun.CopyFiles.Sys = 12....[MBTun.CopyFiles.Sys]..mbtun.sys, , , 0x00004002 ; COPYFLG_IN_USE_RENAME \| COPYFLG_NOSKIP....[MBTun.NTamd64]..%MBTun.DeviceDesc% = MBTun.Install, mbtun....[MBTun.Install]..Characteristics = 0x1 ; NCF_VIRTUAL..AddReg = MBTun.Ndi..CopyFiles = MBTun.CopyFiles.Sys..IfType = 53 ; IF_TYPE_PROP_VIRTUAL..MediaType = 19 ; NdisMediumIP..*PhysicalMediaType = 0 ; NdisPhysicalMediumUnspecified..EnableDhcp = 0 ; Disable DHCP....[MBTun.Install.Services]..AddService = mbtun, 2, MBTun.Service, MBTun.Event

C:\Windows\System32\DriverStore\Temp\{edf7d8d8-304a-1448-a26a-bba0a7428f74}\mbtun.sys (copy)

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	110104
Entropy (8bit):	6.851513818294034
Encrypted:	false
SSDEEP:	1536:k0h5S895dQOYJaryTmbMc6uqkZUcmSl47AjpdAyDCYJqUufIfmNn3VzwZ6Dh7Q9y:C895uOYJar1MLcmSlrSgC6Duls2t
MD5:	83D4FBA999EB8B34047C38FABEF60243
SHA1:	25731B57E9968282610F337BC6D769AA26AF4938
SHA-256:	6903E60784B9FA5D8B417F93F19665C59946A4DE099BD1011AB36271B267261C
SHA-512:	47FAAB5FFF3E3E2D2AEA0A425444AA2E215F1D5BF97EDEE2A3BB773468E1092919036BCD5002357594B62519BF3A8980749D8D0F6402DE0E73C2125D26E78F1E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......{N..?/..?/..?/..dG..6/..?/..K/..dG..;/..dG..9/...F.../...FA.>/...F..>/..Rich?/..........................PE..d......b.........."..........2.......0.........@.............................`....../......A.................................................0..d....@..........D............P..8...`...8............................................................................text............................... ..h.rdata..t...........................@..H.data...............................@....pdata..D...........................@..HPAGE....l.... ...................... ..`INIT.........0...................... ..b.rsrc........@......................@..B.reloc..<....P......................@..B........................................................................................................................................................................................

C:\Windows\System32\catroot2\dberr.txt

Process:	C:\Windows\System32\drvinst.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	4648
Entropy (8bit):	5.390049089044558
Encrypted:	false
SSDEEP:	96:QO00eO00erMwUgWUg0B1kE3ZhpJp8ZpkRepk3hpTpbCpEpDk+psNVpsLZbE:QO00eO00erMwmkB1kAIrN4FbE
MD5:	AE7D64F1EBC708348CD54F8421FBDB2F
SHA1:	937305A21F9F469CA32971CBFECCF1FA67DD7930
SHA-256:	F88657DEFE04710002213BE21F362E93F4196FD7D1BDCC8BE700D2DAB4E20978
SHA-512:	BC1DB6BA4B0E49DD2EEF9D0B23B3B102C78E5F8592B90B0177B3668F8FA5CE525B6116676A9BAAEAC3B4801E6F6568E46FC2A8AF79275B6D0162D6AA69C3E9EE
Malicious:	false
Preview:	CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #6041 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #6699 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #4398 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #6041 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #6699 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #4398 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #2083 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #2459 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: SyncAllDBs Corruption or Schema Change..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #891 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #1307 encountered JET error -1601..CatalogDB: 08:57:12 03/10/2023: SyncDB:: Sync sta

C:\Windows\System32\drivers\MbamChameleon.sys

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	223296
Entropy (8bit):	6.394126446542679
Encrypted:	false
SSDEEP:	3072:2VeOHYV711N4ItXO0dlAWaHXJXFUIb7Pre7BlPv+OKEg8XiBGQjiaEwp74q+XuN8:hoQ78XJVUpstEW3ji/wujXuW
MD5:	262CCB223392F18ADB4B4C846905C4DA
SHA1:	63403407FBE1712A4BFAD0A74EFABEBA297325CA
SHA-256:	5D2004603E3B392693A1E74926A36A2AB3573C6790B00DDB14564C8AFFBD4F4F
SHA-512:	68B2684B9F0A2E5E33B76E43AC4B25B8E7D3DC3D678FC3C90D70EC5EE65EBDD884D838950FB4BC5145FF927E25796D2E6E97EE6BF365ED4F66AC7F7BA8F63B33
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........KlG.%?G.%?G.%?..#>@.%?..&>C.%?..!>A.%?..$>N.%?G.$?..%?.. >D.%?..!>V.%?...?F.%?..'>F.%?RichG.%?........................PE..d.....me.........."..................c.........@.....................................7.....A.................................................c..d....................B..@&..............8...........................0...................`............................text....m.......n.................. ..hNONPAGE..............r.............. ..h.rdata..$N.......P...t..............@..H.data...............................@....pdata..............................@..HPAGE....$:... ...<.................. ..`INIT.........`...................... ..b.rsrc................<..............@..B.reloc...............@..............@..B................................................................................................................................

C:\Windows\System32\drivers\MbamElam.sys

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	21480
Entropy (8bit):	6.332949178488545
Encrypted:	false
SSDEEP:	384:HO/iZbhL/Uqqn2+s/+8gpUad+JR9zuspd:PtUR2h5adk9zuK
MD5:	9E77C51E14FA9A323EE1635DC74ECC07
SHA1:	A78BDE0BD73260CE7AF9CDC441AF9DB54D1637C2
SHA-256:	B5619D758AE6A65C1663F065E53E6B68A00511E7D7ACCB3E07ED94BFD0B1EDE0
SHA-512:	A12CCF92BEAD694F5D3CBA7FF7E731A2F862198EFC338EFC7F33A882FE0EB7499FB3FB533538D0A823E80631A7CA162962FBDFD78E401E3255672910B7140186
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%^c.a?.Ha?.Ha?.H.Y.Ib?.H.Y.Id?.H.Y.Ie?.H.Y.If?.Ha?.Ht?.H.W.I`?.H.W.H`?.H.W.I`?.HRicha?.H........................PE..d....2Bb.........."............................@..........................................`A................................................dQ..P....`..H....@...........%...p..$.... ..8............................!............... ...............................text............................... ..h.rdata..0.... ......................@..H.data........0......................@....pdata.......@......................@..HINIT....\....P...................... ..b.rsrc...H....`......."..............@..B.reloc..$....p.......,..............@..B........................................................................................................................................................................................................................

C:\Windows\System32\drivers\mbamswissarmy.sys

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	239576
Entropy (8bit):	6.482860996728927
Encrypted:	false
SSDEEP:	3072:H4czIC7UsK3MJNbwCfxrdy19MbMA2gtylc0jGYjNHLcUMfTCGTkpk/BzS6XYrh41:HXhf/RL4MylcGGYjVcjTCGVBfXi8
MD5:	4B2CC2D3EBF42659EA5E6E63584E1B76
SHA1:	0042DA8151F2E10A31ECCEB60795EB428316E820
SHA-256:	3DB4366CCB9D94062388000926C060E2524C7D3EE4B6B7C7CF06F909F747FC6C
SHA-512:	804D64D346B3DBB1CE3095A5D0FA7ACC5DA0BF832C458E557DAC486559FE53144F15F08C444FEA84A01471FD5981E68801A809B143C56B5B63E3E16DE9DB0D98
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......C.Kl..%?..%?..%?\.#>..%?\.&>..%?\.!>..%?\.$>..%?..$?..%?.. >..%?..!>..%?...?..%?..'>..%?Rich..%?................PE..d....@Ne.........."............................@..........................................`A...................................................d............P..X........%......P...P...8............................................................................text............................... ..h.rdata...,..........................@..H.data....S.......<..................@....pdata..X....P......................@..HPAGE.....-...p.......0.............. ..`INIT.................^.............. ..b.rsrc................\|..............@..B.reloc..P...........................@..B................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\7z.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2621328
Entropy (8bit):	5.905747441287892
Encrypted:	false
SSDEEP:	49152:zdNyZQQ6uR3+YjqAVyEc/tKpa7KlZQcS+JzEDW41mINGn7HKWFhf6hfsJYwAJ0Le:XyFh2LET2W+hH
MD5:	A144E24209683E3CBA6E29DAB5764162
SHA1:	AB2112CCE717BEC8F5667721A072D790484095EC
SHA-256:	B2FF9DBF90CBD0C45CD7D95CE4892377EC7E92970E05F2E56B0CE93861190348
SHA-512:	2C823981B53B7EB7C1B726468D3B28C234C7E555AAB35E759E88D38658566D267A20867F1CB18D96C830E7D53643629A9FA313EECEE8B553703086FBB64CC984
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........XS.G9=.G9=.G9=..A>.@9=..A8..9=.RF8.`9=.RF9.W9=.RF>.N9=..A9.L9=..A<.N9=.G9<..9=.~.8.9=.~.9.n9=.~.>.@9=.~.=.F9=.~...F9=.~.?.F9=.RichG9=.................PE..d.....Re.........." ...%.. ...................................................'.....=.(...`...........................................#.....$.#.d.....&......p$..v....&.......'..'...P".T............................O".@............. ..............................text.... ....... ................. ..`.rdata........ ....... .............@..@.data...,.....#.......#.............@....pdata...v...p$..x....#.............@..@_RDATA..\.....%.......%.............@..@.rsrc.........&......0%.............@..@.reloc...'....'..(....&.............@..B................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg.7z

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	7-zip archive data, version 0.4
Category:	dropped
Size (bytes):	33525523
Entropy (8bit):	7.9998886347598885
Encrypted:	true
SSDEEP:	786432:8ea5GcT1f9kcxmNjAvxfXTu/hmNu8WHZG5FztIAacw+AemP8:ZRcT1f6cxmxAXJuAA1Cs8
MD5:	9EF598BB4C2426F4B31BAEBF99FCE838
SHA1:	DCFE1EE97A6F1F3C26DB4809C3DC8D57C347B74B
SHA-256:	C7D54F42298F7D035DFD7EDF2EBC34020F56BC1B70C6A76FFF0250D6F75FD4B6
SHA-512:	54C120BC3A41962625C73F9AF58FB206CE547AA8ECDCCD68A915496BE567C23E9A5678EB3685F5E60E71E7DF8D8C43996859D839434063194FDE259915446B5B
Malicious:	false
Preview:	7z..'....).Y.......%.......w).z.d.D.].. .d..........&p].`..2#S_I...G^~._.I.!?.=fV.}y.P..Z.2Ae..u..$e.......v.....r....P..q.%...3.K...c....-.(B...2..l.>P..k.aL..FLi8.HG...@.k.fn..D...8{-.....]..L...d.M....t.gA.@.}.v.O.._.k..T{.h.v.KD..AB....d.K.n.Yy4h.\....Q.((..Byzd..E.).E.=kXB...........p..G.....4.)xUK.X7}..4...]...0ABT....q.I..1L.sO`..il{ng...,.....].-.'.Y.8E.._Gy..1..].~...... .<1.=.?/.....J......rO........Kr....j...7.......o.A..(...U..5..5.AK..8&.d-.QE4.p....D.$%U......`k\....EMS]\..<.w.Rz...'.eq.7..H..........t.Q.h.+...1.z.......pUYH@...n.z0"K..x.:_.5:.i..q=.;....%V._......5.=..k..nK..<.<..j.&W.Q.......+(.c..W......G$.]q.%..G.F....X..../X..uR(...M.2.L.S.@....'.....aE.ma&.aM.,8s`...Z....c.MAN{}........N.......[.l}.E.w......>.#.t....e.B.-..C.....}8./N.%J'...3)..%E..aY..K7..f......(.=.<..;....?..t+.%...".Vte88...o..r*Q-(:.`b.k.X...)M9.p....c......:.@1\|..v...=...%.KW.N.K.%L.a....;6..S1PGo.....z.]..)/..p...`4..,!..h.....f...Bl ......-<S.t

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\7z.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1754008
Entropy (8bit):	6.363189253050595
Encrypted:	false
SSDEEP:	24576:oLB2ycglUr6G8epqFMyn9w44NBdzHq5FmBq7Wk2zjt:gB2GUr1882ANBdzHq5B7WlF
MD5:	B9BAB3B367C53472908741B774FCE358
SHA1:	987E358915E7BB78491A65073189642F88D0D823
SHA-256:	77A4EB913E5BC068FE1479F6DA9BD2B31303B6D23C7E353DDE2984FA373273F2
SHA-512:	60B3858901DF2AD51DB7EFDE8673FD17C529C09029247D6BFB6565031D53D00B1D554BA558B0440A00C961204B0BB812D0F9CEEF16A7FC1934F6B1A5EFA91745
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\+F..J(..J(..J(.n.U..J(.n.S..J(..J).~J(.n.F..J(.?,..J(.n.E.3J(.8+..J(.n.R..J(.n.T..J(.n.P..J(.Rich.J(.........................PE..d...`E.a.........." .........N............................................................`..........................................$..y...L...x........{...................`..H....................................................0..x............................text............................... ..`.rdata.......0......................@..@.data...H....0......................@....pdata........... ..................@..@.rsrc....{.......\|...8..............@..@.reloc...1...`...2..................@..B................................................................................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\AEControllerImpl.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4027864
Entropy (8bit):	6.381253518958122
Encrypted:	false
SSDEEP:	49152:AoKO7qKdlUA9XQOx2WqSYYXhJs0eM/77EF2epzOh5P6drACDTNMhyPN1jE28DNVO:PTT4mCPnUC3N+W1jOc
MD5:	DE76AB21EF00F3678038A05D8D88DF14
SHA1:	97C4471FBA8DE5BD8F9E330070B2B1F0E1329880
SHA-256:	4242F14DA85C06066107000C66CD1E9521AA37EADC939F9943CC9B29252C1D9E
SHA-512:	882BE2A8B81CA7A4DE2FF6F0DE0545C3DDC3F1CC9E8AD0279AE37CF46265EADE69C878BD06BAA2D44D9FC9FD59A9584A95C9E1589D9FB8766E896737FA9BE894
Malicious:	false
Yara Hits:	Rule: JoeSecurity_PsExec, Description: Yara detected PsExec sysinternal tool, Source: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\AEControllerImpl.dll, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......+0..oQ..oQ..oQ...5..cQ...5...Q...5..mQ..=9..fQ..=9..)Q..=9..NQ...5..sQ...9../S...9..0Q..oQ...P...5..HQ...8...Q...8..nQ...8f.nQ..oQ..nQ...8..nQ..RichoQ..........................PE..d...:..e.........." ......&..F........!.......................................<....._.=...`..........................................8.......8.h.....;.......:.......;..y....<.P...p.3.p.....................3.(.....3.............. &..............................text...<.&.......&................. ..`.rdata....... &.......&.............@..@.data...T2....8.......8.............@....pdata........:.......9.............@..@.rsrc.........;......l;.............@..@.reloc..P.....<......r;.............@..B................................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\ActionsShim.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2263200
Entropy (8bit):	6.571718660784422
Encrypted:	false
SSDEEP:	49152:kkwFsV5rJRP8Km1hPz4vq8VcwBAut3o3dPGSst9qNn:zVVJ81utgQSsHM
MD5:	356D88398E0F55237088BABDA9359E75
SHA1:	7C6055F402CEE9C09E4193220A1E7B7F84F10A5C
SHA-256:	432B3CA94EAFB1C6FEFE33AA9431960ECDFA1B8044C4D7DE383B04C4771AAC82
SHA-512:	CA3C918F152B57FBE23104B73250FC2BE3882F69802BCD9AFE76E8FE30D5DD122108B0E7469288C95CE6C7030FEA75461F8E96BFCC1073995AF60FF18CAF6ED6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$..........8..k..k..k..j..k..j...k..k..k.1.j..k.1.j..k.1.j...k..j..k..kG..k..j.k.0.j7..k.1.j..k.1.j...k.1.j...k.1.j..k.1@k..k.(k..k.1.j..kRich..k........PE..d......e.........." ...&.4...........V....................................... "......."...`.........................................p.......,.........!....... .......!.......!..Z......p.......................(.......@............P...............................text...t3.......4.................. ..`.rdata......P.......8..............@..@.data...........L..................@....pdata........ ....... .............@..@_RDATA........!......"!.............@..@.rsrc.........!......$!.............@..@.reloc...Z....!..\...*!.............@..B................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\ArwControllerImpl.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3985448
Entropy (8bit):	6.527604112699939
Encrypted:	false
SSDEEP:	49152:hai/eCmnLY81HlP/GRO2rwEpd2C3M6ekuGTT9bSBec6glnlkfbBdPsfk5OerGgl6:hai+yzJnuyu6glWTBOfijrY5
MD5:	905C39B8691DD7508CD9C07752955067
SHA1:	D02E7A32BE71BDF14DA0ABD24024E3C58FF0F09D
SHA-256:	2104FC38B0707FF6F6D97C3A72C17306BDAF8BEF8B65DBBD49750079EBAAD4B0
SHA-512:	845400029A9089D7319E4EA7241B4AE048E990C2BCB88C2F8F1D281986A595641C76F9B4A27E68D42F8C217AF4DDC839B71F4AC5B4F4C745C8B421CA02A5781E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$.......k.l/..?/..?/..?d..>(..?d..>..?/..?...?)6.>>..?)6.>=..?)6.>w..?d..>...?d..>-..?/..?...?d..>...?.7.>..?A6.>2..?A6.>L..?A6.>S..?A6.>...?A6.?...?/.a?...?A6.>...?Rich/..?................PE..d....y.e.........." ...&..'..........\!.......................................<.....~.=...`......................................... +8......18.h....p;.......9.0....\;.(t....;..y...{4.p....................}4.(....y4.@.............'..............................text.....'.......'................. ..`.rdata..d.....'.......'.............@..@.data....M...`8......@8.............@....pdata..0.....9......29.............@..@_RDATA.......`;.......:.............@..@.rsrc........p;.......:.............@..@.reloc...y....;..z....:.............@..B................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\ArwLib.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5324832
Entropy (8bit):	6.632689335934084
Encrypted:	false
SSDEEP:	49152:SvpnoIaNrhLFEX32se6H5NjdEX97d8lOslRow9cxwYPXGI1+/a7BWpQGtgWuiNkD:+UeM6Oq/a9WltD3MmcZMfRSq5IYSJ
MD5:	4EA0A0D25B4CEB0AEC56B93DFB3F90C4
SHA1:	FF92AE978A840F7FD557E0CB2D1EFE7B7FD05743
SHA-256:	AC59CA7934EF25143B3103041A1D44073489087BB187A5681D4732683B86C468
SHA-512:	5181510A29436A74E3E24128CEE3732F24A423A13D8735E8486A298117C3F9CE58C6E4AA1AE4CC3B01E5A1C5C465057AEE7020EC126614E770AE10F97DDC1A52
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.............v...v...v...u...v...s.~.v...v...v..$r...v..$u...v..$s..v...r...v...p...v.v.r...v.v.s..v...w.L.v...w...v..$....v..$v...v..$....v.......v..$t...v.Rich..v.........PE..d...%..e.........." ...&..0..................................................0P......EQ...`...........................................B.x...x.B.......F..!...`D.@....rO. .....O..w..P.>.p.....................>.(.....>.@.............1..............................text.....0.......0................. ..`.rdata..F.....1.......0.............@..@.data....N....C.......B.............@....pdata..@....`D.......C.............@..@_RDATA.......pF.......E.............@..@.rsrc....!....F.."....E.............@..@.reloc...w....O..x....N.............@..B................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Assistant.deps.json

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	27957
Entropy (8bit):	5.160061124507893
Encrypted:	false
SSDEEP:	384:+1szimU19FqfR16BQxpvOql1kkAS2ioUDYPjYyHgM94M:+1sziGp1XpvOql1uVaM
MD5:	610B80601370C08B4750035721484267
SHA1:	E5B66945DDE705D242BA51252497F91BA287D5C6
SHA-256:	F265C60813102B66ED30E9B54E3153B1190CDC5CA5376591C79F29C5192ACF3A
SHA-512:	94F7E308C61CDBC749CFB0485293AA3EB56495F3CF5CE749AFD44E9A0F43D1ECA9D79F248A861D2C728784260F418224928C98DCE660C2FA647CD855C6493959
Malicious:	false
Preview:	{.. "runtimeTarget": {.. "name": ".NETCoreApp,Version=v6.0/win-x64",.. "signature": "".. },.. "compilationOptions": {},.. "targets": {.. ".NETCoreApp,Version=v6.0": {},.. ".NETCoreApp,Version=v6.0/win-x64": {.. "Assistant/5.0.0.804": {.. "dependencies": {.. "MBInteropActivator": "5.0.0.46",.. "MbamUI.Services": "5.0.0.804",.. "System.ServiceProcess.ServiceController": "6.0.0",.. "mbam_idl_interop": "1.3.0.22".. },.. "runtime": {.. "Assistant.dll": {}.. }.. },.. "DryIoc.dll/4.8.7": {.. "dependencies": {.. "System.Reflection.Emit.Lightweight": "4.3.0".. },.. "runtime": {.. "lib/netstandard2.0/DryIoc.dll": {.. "assemblyVersion": "4.8.7.0",.. "fileVersion": "4.8.7.0".. }.. }.. },.. "mbam_idl_interop/1.3.0.22": {.. "runtime": {.. "runtimes/win-x64/lib/netstandard2.0/Malwarebytes.Protecti

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Assistant.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	156864
Entropy (8bit):	5.044070013333686
Encrypted:	false
SSDEEP:	1536:FoM0km9ENrZZol8fgXZz1eiTGyKto7Q94keiz:FoM0km9ENdal8aC+5LK
MD5:	C14488416DF973B3D084968483468313
SHA1:	558B4C3576110B128BE62D4858246F7345CE914E
SHA-256:	01D8A19B4A8CD6A2533811D97ED1D8BC810C99F1247E8D74BAFA455E60F139E5
SHA-512:	83986E76E73D07E64933D7C8E90E32F7BE1B6DF481FAC9E1282996ACE3FEAB0CD883570AF1EB74620344CCB6304DB5A5C195AB8C88C9C7C1464791E4E7555CBD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....vB..........."...0..2............... .....@..... .......................@............`...@......@............... ...............................`...................f...........P..T............................................................ ..H............text....1... ...2.................. ..`.rsrc........`.......4..............@..@........................................H........(...'..........................................................Fs....s.....o......(....:.(......}........0..........s.......-.r...p(........r5..po....-.r9..p(........(.........{....}>.....{..........(....(...........s....(...+..-.rk..p.{>...r...p(....(.........(...+-.r...p.r...p(....(.......{.....\|....o.....E........................$...,...4...;...C...K...K...K...K...K...K...K...K...K...K...K...K...K...K...K...U...]...+b...(....+X..(.....(....+H.(....+@.(....+8.(....

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Assistant.exe

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	292816
Entropy (8bit):	5.732732023051062
Encrypted:	false
SSDEEP:	3072:Xczkitvo4BpYN/6mBPry8TXROLdW5m4mURh9OOGO0k0aPOVRr0:XA4NCmBPry/N2VOOLhOA
MD5:	21A1A3CBA08276304930769458D6D15A
SHA1:	107750A96FDA3E6349DFE94DC9421378B3CD3674
SHA-256:	98CF16DD21AE8A9931860EABC13E909B94F4E9A262A5F9DDD59FC70FF2A2504C
SHA-512:	41722D7C6F8E8B0DDC207FC86D793747078B0E80516A1F80C77BB085769B70E835B3B922FE44F44BC6F3D201B2210E5A423C88394BDA1B3736ACC77C45081DC5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........}.............../......./......./.....a.....S../........"...I../....I../....Rich............................PE..d......e..........".................`<.........@.............................p......sV....`.................................................t$...............`..@........k..............T.......................(.......8............................................text............................... ..`.rdata..............................@..@.data........@......................@....pdata..@....`.......&..............@..@_RDATA...............<..............@..@.reloc...............>..............@..B.rsrc................B..............@..@........................................................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Assistant.runtimeconfig.json

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	372
Entropy (8bit):	4.427922197527517
Encrypted:	false
SSDEEP:	6:3Hp/hdNyhAkI/X5BXmJe5S1sHRvXmJbJccVHdS1sHNAQ6NOCUo+K8EkNTy:dFk2BEe01sxvEbJc11slex+K8Es2
MD5:	D94CF983FBA9AB1BB8A6CB3AD4A48F50
SHA1:	04855D8B7A76B7EC74633043EF9986D4500CA63C
SHA-256:	1ECA0F0C70070AA83BB609E4B749B26DCB4409784326032726394722224A098A
SHA-512:	09A9667D4F4622817116C8BC27D3D481D5D160380A2E19B8944BDD1271A83F718415CE5E6D66E82E36819E575EC1B55F19C45213E0013B877B8D61E6FEB9D998
Malicious:	false
Preview:	{.. "runtimeOptions": {.. "tfm": "net6.0",.. "frameworks": [.. {.. "name": "Microsoft.NETCore.App",.. "version": "6.0.0".. },.. {.. "name": "Microsoft.WindowsDesktop.App",.. "version": "6.0.0".. }.. ],.. "configProperties": {.. "System.Reflection.Metadata.MetadataUpdater.IsSupported": false.. }.. }..}

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\BrowserSDKDLLShim.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2255408
Entropy (8bit):	6.571305937820757
Encrypted:	false
SSDEEP:	49152:fZ0HSx0VU4YZZmQ7i4WkqN4cqHD8TB24nWdPfensaTz13:USx7H4W1enjTz13
MD5:	F1848947DA7A0A936075BC2600BFBAFB
SHA1:	72CC97578EDC7826BA04060EA1F60A1F17DA25EF
SHA-256:	FB970B37252187B89D386C1E20260FFD7EF311D5F4943286955403123B5BA4D6
SHA-512:	575A683D28C1EE3F56F9CD7C30C14CC92E3E5353A0724C04542D08FE19B219C090B0DF1E87767B23BC7298D4BD85E9DDD79183FDE70009EFB87E3F44406C7E51
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...........~...~...~.......~......\|~...~...~.......~.......~.......~.......~.......~...~..5........~.......\|.......~.......~....M..~...~%..~.......~..Rich.~..........PE..d....:.e.........." ...&.&...........V........................................".....b/#...`.................................................\.........!.H....p ......n!.0.....!..Z..@o..p....................q..(....n..@............@...............................text....$.......&.................. ..`.rdata.......@.......*..............@..@.data...d........L..................@....pdata.......p ....... .............@..@_RDATA........!.......!.............@..@.rsrc...H.....!.......!.............@..@.reloc...Z....!..\....!.............@..B........................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\CleanControllerImpl.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6871024
Entropy (8bit):	6.46880446340782
Encrypted:	false
SSDEEP:	49152:5vZjkQRO5AZ+s2Ujkyk/v4DJMoF0mtEye9i87JaKN90V72kRRN/zFzgMD9spt0PI:jsEMopxxWR0Ogw6JkDtMcye/u90A8IG
MD5:	5DC7688F541DD075F4FFAD8DF38E441C
SHA1:	6711CF8B37731310A52C7D85956B26C8900CC49D
SHA-256:	72919A3B9A4DE7232E180CF08AE66656E96B89BA7BBB62B30297A28C0F008D2B
SHA-512:	545D544DC7C98E920BEA5E9C8EA1660817D4A924B4266DFC1E5C952DC592E284DA7D899D4D6BAF6C33CF5E454FAB407935A137F1775758566E550D4ED9ECBD63
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$..........w...$...$...$...%...$...%'..$...$...$...%...$...%...$.\|.%...$.\|.%...$.\|.%...$...%...$.\|.%...$.\|.%...$...$5..$...%...$.\|.%:..$.\|.%...$.\|*$...$..B$...$.\|.%...$Rich...$........PE..d...}..e.........." ...&.fF... .......<......................................`g.....".i...`.........................................`._......._.......f.......c.......f..3....f.....`QX.p....................SX.(... PX.@.............F.@............................text....dF......fF................. ..`.rdata.......F......jF.............@..@.data...T[... `.......`.............@....pdata........c.......b.............@..@_RDATA........f.......e.............@..@.rsrc.........f.......e.............@..@.reloc........f.......e.............@..B........................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\CloudControllerImpl.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4993504
Entropy (8bit):	6.506433606268315
Encrypted:	false
SSDEEP:	49152:lPgxyf4pLkL0EiM4n/k65+5Voaz0LHUNh1/62PibzBRPHieb+C4s8L5gZBl9Nxi8:y2VoEB0Ce9XicZtJxBL678RUJrpo/
MD5:	2C706562863593B6C52A3CB919F30C10
SHA1:	BD9723E91A41C53FDF7A567BFB8825C6E12D04A8
SHA-256:	4A1FA8BB383E8D6FDE45E75E5AB087C3F00FAA9376F69CE245F257F0C509673D
SHA-512:	19D3C6AC5CF1BBBC42840AD53EB41458CC9D142A3D335813AF638A76FBF2D980B0972680B89200A83F0D63C15089E55012623DFBFB509B4CEEA3B325E882793E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$..........:..i..i..i...h..i...h..i..i..i.M.h..i.M.h..i.M.h..i...h..i...h..i.M.h..i.M.h..i..id.i...h..i.M.h..i.M.h..i.Mbi..i...i..i.M.h..iRich..i........................PE..d......e.........." ...&..3..........3+...................................... K.....1.L...`...........................................F.....X.F.T....pJ.......H..@...vJ......J.....qA.p....................sA.(....oA.@.............3. ............................text.....2.......3................. ..`.rdata...-....3.......3.............@..@.data...$....@F..d...2F.............@....pdata...@....H..B....G.............@..@_RDATA.......`J.......I.............@..@.rsrc........pJ.......I.............@..@.reloc.......J.......I.............@..B................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\DryIoc.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	609336
Entropy (8bit):	6.650197633044797
Encrypted:	false
SSDEEP:	12288:t0pb1rj47g2z4v3MObszwrO8Zak08Zfnr6s0DssPS4mT:tqZL2uccZsxS4mT
MD5:	25066AC953A7C308E815CC3731F88597
SHA1:	0D235B6E20517610FD037848755F7C8BEB3A95D5
SHA-256:	724671297D238F19456F370A15E48D63F60946DC103683300E53FB4AE9FEA77D
SHA-512:	CDB474C6925B94C98BEEE95FDB26BB87F9A451B84F35BADA552FEE5E73E1804D9D66A37D75639025DB46869E4712DF0B79117150C53B314BAD655A4FE947339C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...7............." ..0.................. ........... .......................@...........@.................................n...O.......X...............8v... ......t...p............................................ ............... ..H............text........ ...................... ..`.rsrc...X...........................@..@.reloc....... ......................@..B........................H.......@=................................................................{3.....{4.....{5...r.(6.....}3.....}4.....}5.......0..S........ux.....,G(7....{3....{3...o8...,/(9....{4....{4...o:...,.(;....{5....{5...o<......0..K....... .5. )UU.Z(7....{3...o=...X )UU.Z(9....{4...o>...X )UU.Z(;....{5...o?...X*..0...........r...p......%..{3..........j.....j...-.qj........j...-.&.+...j...o@....%..{4..........\|.....\|...-.q\|........\|...-.&.+...\|...o@....%..{5...........}......}..

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\LicenseControllerImpl.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5019312
Entropy (8bit):	6.4951557630707315
Encrypted:	false
SSDEEP:	49152:03yBexYKzoGG878alLjU5GM6bGQLP7zZAFkqcEzcvBLULftVPeZTF3uEyPbGxyz2:IRzos78/Kp9ULft6IGxo/RIR
MD5:	8EBA86FC89C9A8B1ABF84E5B8F1FDCCE
SHA1:	3471646CBE8C33AB08609ACD341AD806B0FBD1D6
SHA-256:	C69D31C3CC78F71633E983CC58C8240957E48DFE4466B4AE0B7BFEB19E5279E7
SHA-512:	BD07AE2AE034E15D55F49C93AF9630049C82021A2C689D3A9973E6516A039FE65311B16D7297B9C98158FF4FC60AFBDC548EA7452BA6102E42AE00A1C3CC2D6F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$.........d....................................?......?......?.............}..........>.....?.....?.....?..N...?.....?...........?.....Rich...................PE..d......e.........." ...&..2..R................................................K.......L...`..........................................`F......pF.......J......`H..U....J.......J.l.....A.p.....................A.(.....A.@.............3..............................text...h.2.......2................. ..`.rdata........3.......2.............@..@.data...L.....F..\....F.............@....pdata...U...`H..V....G.............@..@_RDATA........J......:J.............@..@.rsrc.........J......<J.............@..@.reloc..l.....J......BJ.............@..B................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MBAMCrashHandler.exe

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	916960
Entropy (8bit):	6.531947748093342
Encrypted:	false
SSDEEP:	24576:U21L8DOYzFbprbWrLi1gOO9xjmcMu3df4+TIa56N5:51L8DdzF1SrLi1gOO9xjmcMu3dfdTIaE
MD5:	0B05552F4BE8E61A28B7889C8F0294BF
SHA1:	047E595A76B9C738258D37EBA475078E983B18AF
SHA-256:	BEB25F711CF07273DB3BA6E94111ADD1BB4A7328BEC3586D4B82EEF01034CF0C
SHA-512:	C89D4ACAE8B89434F832BB01FDAE0C6FA27AFAF585D8AEED34DA2C41769E650C744DB23AEDA96377DD520117357FC825D9031423B5158C6E3087A94FB3EFFC87
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........gx.............~......~..q...~........................................~......................Z...............Rich............................PE..d...N9.e.........."....&.P...........Q.........@..........................................`..................................................x..................P\|...V..............X.......................Z..(....W..@............`...............................text....N.......P.................. ..`.rdata..J....`...0...T..............@..@.data...8P.......8..................@....pdata..P\|.......~..................@..@_RDATA.......p.......:..............@..@CPADinfo8............<..............@....rsrc................>..............@..@.reloc...............B..............@..B................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MBAMService.exe

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	8884840
Entropy (8bit):	5.980130191818927
Encrypted:	false
SSDEEP:	49152:zSRXrjOYBuH25NgUc8xAv7aruVoUhZBM+Je9yXFXmbuumsgBJhqyjQD+DZhg3uQj:MsW/iZHvy2hqycD+NW+GarO3XhnR3
MD5:	B9251F9808C8ADE391E452F12F87E20D
SHA1:	954410042B92A87CD9383995B52F76F5148DA386
SHA-256:	21E69DB89F7E409E000BA45A020F24FA99903B7A1CFB1FE998F1C5815BCCDA04
SHA-512:	142E93C83748DBE7E978BBA3F82677E7E69AE02B25B196647644DC964E1B1D63CFD967729765A9E90261226026483D5C29B29D6DF5B2E924A2FCE9EF673C671A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......q.bT5...5...5...~...=...~.......5...4...3v..&...3v..'...3v..X...~........w......[v.. ...5... ...~.......[v..}...[v......[v..4...5...7...[v..4...Rich5...........................PE..d...O..e.........."....&.nJ...:.....toC........@..........................................`...................................................x......`.. k....\|..E.....h...........no.T....................po.(....lo.@.............J..............................text...NmJ......nJ................. ..`.rdata..&.-...J...-..rJ.............@..@.data........Px.."...:x.............@....pdata...E....\|..F...\{.............@..@_RDATA.......P......................@..@.rsrc... k...`...l..................@..@.reloc.............................@..B........................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MBAMShim.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3197432
Entropy (8bit):	6.446571170589238
Encrypted:	false
SSDEEP:	49152:6pgXGFlO4MQbGdfRbyLut575+57yYgAOh5PY68E9yP0d8n8d12i:BQcGKsv3693d8M1
MD5:	DE3D84B3D762B259A851B290A0649712
SHA1:	1FD43B1D27C7E4480A65F81468F6E48F48D72590
SHA-256:	08EB70B10713B35801AC77A3B0AA65758E0260681AE250191D55688952CEF57C
SHA-512:	AB1D22D5F482C3267DC713C6574C2C30742DFB403BFDD133E13B7B9654A7054222066A21ED0FE83E2BC69E7533206C4B641A317FD5CBB7A259D177F6AA0BFB98
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.............s...s...s...p...s...v.9.s...u...s...p...s...v...s...w...s...w...s...w...s...v...s...r...s...r...s.Q.z...s.Q.s...s.Q.....s......s.Q.q...s.Rich..s.........................PE..d...u}.e.........." ..........................................................0.......1...`...........................................,.......,.@...../.@.......(y..../..A..../..w..@S.p....................T.(....S*.............. ..@............................text............................... ..`.rdata....... ......................@..@.data...4.....,.......,.............@....pdata..(y.......z....-.............@..@.rsrc...@...../......./.............@..@.reloc...w..../..x..../.............@..B................................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MBAMWsc.exe

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2726768
Entropy (8bit):	6.504670541246361
Encrypted:	false
SSDEEP:	49152:5QjUlBp3Z621NxtQI86KKBjGb8NgGefGeC3EdPpYXSvRl3V:qyYbagZGNUzYX23V
MD5:	82069F9B07D23778D4A1FB38F73E49BB
SHA1:	21320C7B290AF59265EB6CF391D382D6DEA436D6
SHA-256:	2D7E4C89738AAA059B0383C1A8760DA7BC3D2D4FB6CF0A4B038E6CC5A5BC813F
SHA-512:	F427E5C9729B0A48448ADD44C424E432A7F0C916F05CD346D172633986BE5A3EBA5F887896DB832EFB65F7E912E2C08ECD7A0871587248472E660C4447B1FE20
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......R.>...P...P...P.].S...P.].U..P...P...P...T...P...S...P...U.w.P.k...P.e.T...P.].T...P./.T..P.x.T...P.x.U.I.P...Q...P.].Q.1.P.x.Y.(.P.x.....P......P.x.R...P.Rich..P.........PE..d...#..e.........."....&............l..........@..............................).....$G*.....................................................X.$.@.....&.......%..%...\|(.p.....(.._....".p.....................".(...P.".@............ ...............................text............................... ..`.rdata....... ......................@..@.data.........$..x....$.............@....pdata...%....%..&....%.............@..@_RDATA........&......B&.............@..@.rsrc.........&......D&.............@..@.reloc..._....(..`....(.............@..B........................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MBAMWsc_Legacy.exe

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2376736
Entropy (8bit):	6.400042657799699
Encrypted:	false
SSDEEP:	49152:sKVMZZG+qbR3SgF1i0YpKbUJD2KVVxOh5P+S56M+PBiKqhM/A5l3dp:l223SgEZvF9iKC3/
MD5:	3AAFC4BA7BBE49E318ED008E0005A6E3
SHA1:	B5C6F24D049E0D84365AD762A450A3885E2FBEE1
SHA-256:	583455EF71FA269FB926FFF2DDF0556E103C86597BBBE154E49B4880FF6C6593
SHA-512:	9F29444B3CCE9E137D04521C636FDB88F0A22BB22ED3F3B722A8E0E1D54A705743B0E73B84B114BC3859DAAA9F96A5B0997CC02FA4018EC541036058C5729924
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$......................................................................................................................j..........Rich...........................PE..d...\..]..........".................<..........@..............................#.......%......................................................(........!....... .......#. .....#.0^......p.......................(.................... ..h............................text............................... ..`.rdata....... ......................@..@.data...lD...@.......0..............@....pdata........ ......0 .............@..@.rsrc.........!......H!.............@..@.reloc..0^....#..`... #.............@..B........................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MBUpdateDlg.exe

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	393784
Entropy (8bit):	6.122019273927788
Encrypted:	false
SSDEEP:	6144:I8ZHqvWJjljPdtV/DwIzGZMBV85jjXaAOQtOGXpgh:Igq+7jPd/DwIzE5jjXa9GXpgh
MD5:	05C4054BB9249EF9ED229A0095428A4D
SHA1:	E0D1F1FBF5F4D2AAD192F115271F571CD2A3037A
SHA-256:	05749E32B65607F565ABC4E0B138C55F76B0FB8E68F48A2C90D75A0FBCA23852
SHA-512:	2E1AAE0B723F83023411FFEDBBD5F0F4A3C476A980EC43A9AC9CE387C2EEEB78738D35364A12E552CB3606CDE16DA13E5F5C2CA0B39606E4731FE0F6BEBD5652
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......(..albe2lbe2lbe2..f3abe2..`3.be2..a3zbe2>.f3ybe2>.a3Mbe2>.`3Sbe2..d3gbe2lbd2.be2..l3nbe2...2mbe2lb.2mbe2..g3mbe2Richlbe2........PE..L...xd e.................L...D...............`....@.................................0w....@.................................0\..x.......................8~.......#...9..p....................:.......:..@............`...............................text...~J.......L.................. ..`.rdata.......`.......P..............@..@.data...\....p.......V..............@....rsrc................f..............@..@.reloc...#.......$...`..............@..B........................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MBVpnTunnelService.exe

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3073888
Entropy (8bit):	6.446802515799829
Encrypted:	false
SSDEEP:	49152:bDOOqxekIwZbn005yZL8BFi0fXpn3pL/+9hBZhOh5PSXNPigdyPpQul+Lupy0X:Qdn5et0CWQu3pyK
MD5:	46F875F1FE3D6063B390E3A170C90E50
SHA1:	62B901749A6E3964040F9AF5DDB9A684936F6C30
SHA-256:	1CF9D3512EFFFAA2290C105AC8B7534026604067C9B533E7B7DF2E017569A4EC
SHA-512:	FDFB348061158F8133380E9A94215F4BFC0F6CE643A129D623CB8034C49144F1489DE56CD076DA645478506D9FBDDC7590FE3D643622210084B15FDF0D16B557
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$........3^..R0..R0..R0..43..R0..45.hR0..46..R0..:3..R0..:5..R0..:4..R0..44..R0..41..R0..:4..P0..:5..R0..R1.FS0..61..R0.~;9..R0.~;...R0..R...R0.~;2..R0.Rich.R0.........................PE..d......e.........."..........8.................@.............................@......../...`.................................................P.+.@.....-......@,..h....-.`3....-.du.. .(.p.....................(.(.....(................. ............................text...~........................... ..`.rdata...R.......T..................@..@.data...l....@+......$+.............@....pdata...h...@,..j....+.............@..@.rsrc.........-......8-.............@..@.reloc..du....-..v...>-.............@..B................................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MBVpnTunnel_mbtun.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4434408
Entropy (8bit):	6.237220427846423
Encrypted:	false
SSDEEP:	49152:sBPD6Io8w4LcTwEDRzTJoeM9YSxjQ5g+o9h6iO0oFjn2Q1Z0NwEIxZ:yDG8VQkgRzSeMfn+ofU13
MD5:	A312DF601EB0372302D70AC532310ABE
SHA1:	7E5DEBC669BC44693B4EECC53C65CCCE0018B368
SHA-256:	15D3D5E7CFBA1D3361919242E32ACD95D635ECBB07051B624022722E8B9EC20E
SHA-512:	F594FFCC38732786826FB8D99F4D38141FE79A59DC5E635DDF6DF38E1D9BF184319BFC91B1E42B6CAA124C755212E4A01A4F1C0C19641D3ECE8B9C16B7A68B40
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....;a..........."... ......B..$..P..........o..............................E.....F.D...`... .......................................?.9 ...0D...............;.......B.....`D.0O............................;.(....................2D.h............................text....~..........................`.``.data... p.......r..................@.`..rdata..`...........................@.`@.pdata........;.......;.............@.0@.xdata..$.....;.......;.............@.0@.bss....P"....;.......................`..edata..9 ....?.."....;.............@.0@.idata.......0D.......@.............@.0..CRT....X....@D.......@.............@.@..tls.........PD.......@.............@.@..reloc..0O...`D..P....@.............@.0B........................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MBVpnTunnel_wintun.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3872096
Entropy (8bit):	6.182813876566682
Encrypted:	false
SSDEEP:	49152:N91ge1HHUHrb/TjvO90dL3BmAFd4A64nsfJ+btRjtTJhFXcQBKvHVw+4HOr1u3Zt:N9FHa/hFnfz3MBia6
MD5:	B6190DA1B1D287FD100789A41B4D0CFD
SHA1:	333F6F38EF2C3BDC3B02C5F7F74E1BEB51474ED7
SHA-256:	9E75CCA2E71D7E52B44C7A5BCECE135765113090C4B36A143A6F54A80068D5AE
SHA-512:	4560D235C6FD35ED9ABD32BCD0777A56A1FC2DEC5AAFC50B0002DE454862F1F231BFDED4835E72983CEB1E4F365BD6048B2AE0BE7B8DBA93337622856C6F6096
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...G5(a.........." .....<...l................................................?.......;...`..........................................^5......_5.<.............>.l.....9.`i....>.. ..........................X[5.(...................0b5.`............................text...v:.......<.................. ..`.rdata.......P.......@..............@..@.data........p5..&...^5.............@....pdata..l.....>.......8.............@..@.tls..........>.......8.............@....reloc... ....>.."....8.............@..B........................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MBVpnTunnel_wireguard.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3022920
Entropy (8bit):	6.2317692504698305
Encrypted:	false
SSDEEP:	49152:liZVz3arb/TUvO90dL3BmAFd4A64nsfJNraOc3jxJpr7ZEN7DS25+NkzZGALgFto:lK30c3jxrw5HZId7WB
MD5:	428496C404105CE1887462E2EE7AB4A9
SHA1:	B8E27D840036A9C7AE5780382FBBD2F929BE042E
SHA-256:	AEA26EFC5056401A3563BCC2DB83D7AA57CB8CDE32641BDC5079A2D6CE0F7633
SHA-512:	2206D7563BF9C4D757FD10451B4351C1F4802ED541A4FA9B9F579227608C84AD4E3B7214AC9EA507AFA3026A86443940A92F4F6E8AA949C7481D8335B78DE139
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......d.........." ..........................................................3.....A.....`..........................................u)...../v).<.............2.l.....,.H0....2.HZ...........................q).(....................x).`............................text...6........................... ..`.rdata..dt.......v..................@..@.data.........).."...l).............@....pdata..l.....2.......,.............@..@.tls..........2.......,.............@....reloc..HZ....2..\....,.............@..B........................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MWACControllerImpl.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5995656
Entropy (8bit):	6.24345528252849
Encrypted:	false
SSDEEP:	98304:kUz0P+OTOyWNyH8DPfbwiuNBbbkABehBe:kUz0PhOyWNyH8DPfbwiuTEABKB
MD5:	D71F4A21F85864143A97CA0846E4B808
SHA1:	397895BB0BB2724CF5229C0B17DAFEEAE084174D
SHA-256:	3236A26F7EA007D4BED096E6D89952CF516EAEEB802D08DCA0024A15F3F9C372
SHA-512:	9299F4BD9EDA478A073382ABCA161240C43323E702971D82706DD6870D4CA4792EC5D8B321E4C6ADA68B999BEAE5B512628AA9B289BCFC41C7B12D17C6C6ECE3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.........s0...c...c...c...b...c...b...c...b...c...b...c...b...c...b...c...b>..c...b...c...b...c...cm..c...b...c...b..c...b...c...c...c...c...c...b...cRich...c................PE..d......e.........." ......:...........*......................................PZ.....f.[...`.........................................0TT......`T.h.....Y......pV.......Y.......Y.L.....L.p................... .L.(... .L...............:.P............................text.....:.......:................. ..`.rdata..d.....:.......:.............@..@.data...D.....T..P...vT.............@....pdata.......pV.......U.............@..@.rsrc.........Y.......X.............@..@.reloc..L.....Y.......X.............@..B........................................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Malwarebytes.Interop.Activation.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	37760
Entropy (8bit):	7.088252188978271
Encrypted:	false
SSDEEP:	768:SI9HlxK1JN2bwUUcXk6xf1mlrjE7W3b/bF+Y7N2Ip4O6xf1mlrjE71:l9HlS2bwUBfIfmADh7Q9HfIfm1
MD5:	2DB24FDB7584378E27E5A023CE1C4221
SHA1:	F4C59CC128A4C79B1A6B450A81F5C2F9ED7E6B9A
SHA-256:	F5A9E3587FCF855046D8B08E86ED61105F2F330A1C9021461446C137ED3B9AC5
SHA-512:	0E1FCD125A839F5A85ECD96E432ECE37A62A13AF579153B375FD6EC57B605689BCBB46E7F3D0A93E0E1235DDEDF4965B0D9B2F4826D7D7EAADA79A15A4EFE7B5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....n..........." ..0.............&<... ...@....... ..............................A.....`..................................;..O....@...............(...k...`.......:..T............................................ ............... ..H............text...,.... ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......&..............@..B.................<......H........$..............................................................~r...ps.........rK..ps..........0..6........(........(......#o.... ...........,..(....,..(....&........................"......:.. .....(...+..0..O.........(....}.......}.......}.......}.......} ......}!.....\|......(...+..\|....(#.....0...........{$......6"~%.....r...p.{&.... ...@s'...}(.....E....\.......k........{)... ....3u.{(....{*...o+....o,.......(-.......(....-A..%.}$......}/....\|0......(...+.v...

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Malwarebytes.Protection.Interop.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1875904
Entropy (8bit):	5.7772745832968475
Encrypted:	false
SSDEEP:	49152:/Bk74CHSDZqQgHJmCOxQhUB27LDAhD+Ebzvg+dxo:/BkUCHSDZqQgHJmCOxQhUB27LDAhD+EA
MD5:	CE25F7996EB6698D0EB5D9FA78AB05C7
SHA1:	197A3149088A7FAA0A792ACF5407E30A9BC5A46F
SHA-256:	7868F455C96A90AEBC79C6638176304CE1CA4DCA8FE8A272DA247296F5156530
SHA-512:	9A0CA2C04E7E239AD02060745FCF73946A9CA85F4B134B05EA530F8CE19B62F4D5E7F73EB7E7A857CF5725B2E3B5E33293A1A04A6A24BAB293617D92DDF02356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...$..e........... ..................... ........@.. ....................... ......8 ....@.................................H...L.................................................................................................... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B................H.......<....B..........................................................b.{....9.....{....o.......f.{....9.....{.....o......f.{....9.....{.....o......f.{....9.....{.....o......f.{....9.....{.....o....*....(......}......}......}......}......}......}.......0.......................t... ....... ....... ....... ........U... ........@... .........A.....j.... ........ .............. .........,....(.....{....o....t........o......t....} ....s....}....*........0..g..........(.....{ .

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Malwarebytes.UI.Controls.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	30848
Entropy (8bit):	7.2684349551206715
Encrypted:	false
SSDEEP:	768:QQgZZCzycfNEFiRvf0e+Y7N2Ip4/ynEFiRx4:QQACzlNeiZf0K7Q9qneiL4
MD5:	7B4AE88F67880D5EEF863B80774A2950
SHA1:	88BE943990D48CE4E71957C54F0E9474A72CEF44
SHA-256:	26503FF062A8C5C98B531C82CB52A5ECC87400F1C480BE98BF605F56F0EF552E
SHA-512:	C671D825564B9EB12FDA97879030873095EA23820D9627BF1424285F93C10CA52E40533526F209F7E6BBC3EABCFF0C94E450A1AD8E7891230EC49DDEEA51CB85
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....F..........." ..0..............+... ...@....... ..............................G.....`.................................t+..O....@..\................b...`......X..T............................................ ............... ..H............text........ ...................... ..`.rsrc...\....@......................@..@.reloc.......`......................@..B.................+......H........ ..............................................................F.~....(....t....6.~.....(......(.....r...p.....(.........(....~....s....%.o....(.........*..BSJB............v4.0.30319......l.......#~..d...@...#Strings........$...#US.........#GUID...........#Blob...........W..........3..........................................................................<.....<.....)...\.......C.........R...........q...........,...................C.....C.........+.......z...y.z.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Malwarebytes.UI.Style.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	95944
Entropy (8bit):	6.7392528496360935
Encrypted:	false
SSDEEP:	1536:vkNZVew4VH7DpjUJADA/IdH24Jh5UdzhOeiJV0K7Q9VOeiLm:v6Vew4VH7DpjUN/uW4Jhqdfb
MD5:	1742E0294069FA8D3CCE752C1ECAF61A
SHA1:	76AFDD864B00CFA81DED44AA82AF9F347DBB1278
SHA-256:	788C7FEE19F62A80AD43EC5965AAD8391A74E4EC804E937974DC47430F07451F
SHA-512:	256C28469A3105E3A0253DB094D439D146ED0079E077B8D9D1AEC3CFB0866CF1E462F97FCEF79185878985C6E23C2C2DBE4DE025569A65B69FBC731C07E17C01
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.............J'... ...@....... ....................................`..................................&..O....@..,................d...`.......%..T............................................ ............... ..H............text...P.... ...................... ..`.rsrc...,....@......................@..@.reloc.......`......................@..B................*'......H.......P .. ...........p%..p...........................................BSJB............v4.0.30319......l...x...#~......L...#Strings....0.......#US.4.......#GUID...D.......#Blob......................3......................................................{...../.....:.....b...........G.............................C.....w.....Z...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q...............'.....F...#.O...+.j...3.w...;.....C.....K.....S.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Malwarebytes.UI.Theme.Dark.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	47896
Entropy (8bit):	6.935994193423678
Encrypted:	false
SSDEEP:	768:YZlzpAolUsXGXR0RMzycSnHEFiRM0e+Y7N2Ip4WCEFiRxpx:RvIMzsnHeiG0K7Q9WCeiL7
MD5:	95BB363A55632A3044D83BFC69EEC0BE
SHA1:	45165319E89556F0E11C52643A4FC214D485C32B
SHA-256:	D234C7D1C3E3D2476705D9E105F586D58031BC4F0F710D7729F14C959D23C5D9
SHA-512:	FEAE5A68AEB779F354EDEC57C2338424C024395116558BB660E2618094830A3869E6453435251511591D13F3EF18471020839F122C79F3070AA332D257D9377C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..N...........l... ........... ...............................>....`.................................<l..O.......l............X...c...........k..T............................................ ............... ..H............text....L... ...N.................. ..`.rsrc...l............P..............@..@.reloc...............V..............@..B................pl......H.......P ..4............%...E..........................................BSJB............v4.0.30319......l...x...#~......X...#Strings....<.......#US.@.......#GUID...P.......#Blob......................3......................................................e...........I.....L...........1...........y.................-.....a.....D...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q...............'.....F...#.O...+.o...3.\|...;.....C.....K.....S.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Malwarebytes.UI.Theme.Light.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	47896
Entropy (8bit):	6.943194434997221
Encrypted:	false
SSDEEP:	768:X6PfnxXjzEbg6gizyc8EFiR960e+Y7N2Ip4kEFiR2:qNDizGeij60K7Q9kei0
MD5:	4FAC9E961F697929096067DDF8D548C3
SHA1:	0DB2BF4D9458F9F9935927136FC7A1E4D9BFF425
SHA-256:	9B274149D51FE6BA35D03E7E0C2C29F3476BDDF997D1EF8C40E0091A78B6BD8E
SHA-512:	94B3D3F95DE4893B055FCC4F8C89BB5A453B17D4A0F9AACB9EAB8025D72BCCFB5472FF4BBBCC6C0AD4C511A19BAA28298079BFE18AC1C20211E5BD93C6B354E2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....h@..........." ..0..N...........l... ........... ...................................`..................................l..O.......p............X...c..........`k..T............................................ ............... ..H............text....L... ...N.................. ..`.rsrc...p............P..............@..@.reloc...............V..............@..B.................l......H.......P ..8............%...E..........................................BSJB............v4.0.30319......l...x...#~......\...#Strings....@.......#US.D.......#GUID...T.......#Blob......................3......................................................e...........0.....L...........1...........y.................-.....a.....D...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q...............'.....F...#.O...+.p...3.}...;.....C.....K.....S.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Malwarebytes.UI.Theme.Primitives.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2212040
Entropy (8bit):	6.327788018438543
Encrypted:	false
SSDEEP:	24576:PR7Lmv3ser0IruI+dktHly2fuBLwf+ogKTAWrrBcUg0A7PEjRr8Diyy1:pc+4H42GBLwf+oFTAWrrBcUg0EEf/1
MD5:	A8E8450C9A6163A4837C8E53FFC5AD63
SHA1:	EB2BD299614ABFC9E48C54C0548736DC7A701DA6
SHA-256:	638156C5F93F7460D7F087231DD06A3B39A53A698B5388D87381091D01813DB8
SHA-512:	64D8A9BCDA552C8077D13CFE96AB1890437828E57AAA250792CA94C012C516BAD06B7DF96CCBFA14CD2AF472717A17BF0050D8095460536772B15DF74BBD878E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....T..........." ..0...!.........&(!.. ...@!...... ........................!......."...`..................................'!.O....@!...............!.....`!......&!.T............................................ ............... ..H............text...,.!.. ....!................. ..`.rsrc........@!.......!.............@..@.reloc.......`!.......!.............@..B.................(!.....H.......P ..P............%....!.........................................BSJB............v4.0.30319......l...x...#~......l...#Strings....P.......#US.T.......#GUID...d.......#Blob......................3......................................................e...........:.....L...........1...........y.................-.....a.....D...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q...............'.....F...#.O...+.u...3.....;.....C.....K.....S.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Malwarebytes.UI.TrayNotification.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	46360
Entropy (8bit):	6.8899233493300835
Encrypted:	false
SSDEEP:	768:CWQ0nUHOwXoXD+KQj2U8jri212LzycwEFiR0MVACVAzOJh2Ip42sjEFiR7:tQ9XoXD+/2XK/LzWeimMWCWg89bei5
MD5:	636818C605B77337AC880EBF8727956A
SHA1:	9BDB3B1E6EBA59428ADC7DA8679EFE26C0248C35
SHA-256:	FDBCE18D906F2FC0194F9D2D042DBC439E5CA70DABE98048A0E409FB86E1F2F3
SHA-512:	97EFF2C8521651A8BAD9F6ED4D1AB2F0EF5FAA3ABAB10EE743E611A3FA98AE1FDC472BCF0D6996CE0B704389DD37DBB083BEC5B375F75E308A17EE72ED275C98
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....K..........." ..0..H...........f... ........... ..............................6Q....`.................................<f..O....................R...c...........e..T............................................ ............... ..H............text....F... ...H.................. ..`.rsrc................J..............@..@.reloc...............P..............@..B................pf......H........4...0............................................................(....^.(.......3...%...}....:.(......}....:.(......}....z..}......}......}.......}........(....i..(....i..(....i..(....i(......{....v..{.....{.....YY}......}......{....v..{.....{.....YY}......}....:.{.....{....Y>...{....X}....:.{.....{....Y>...{....X}....J.{.....{....s....n...(....(.......(....(....J.(.....(....s....n...(....(.......(....(......{....l.{....l..(....l..(....ls....*..s...

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Malwarebytes.deps.json

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	52746
Entropy (8bit):	5.137197257427158
Encrypted:	false
SSDEEP:	384:+EB3n7DRlsWzC0SVBVpw1rHsFqfR16BQx3vOql/kkYSFQotRGnW6R2bpMR2YPjY4:+I33zC0SVeHvp1X3vOqlvFQsoRbVQU
MD5:	E37378966EDB4C9FAEB8270D33D9F80E
SHA1:	6CEB2FDF99AFC585114A90C5C7EE9F40FE0B4C00
SHA-256:	473A34B00A809C8B45183745D20E58FFDA059CC8CB9F1352FB6D4DD88D6D68D6
SHA-512:	60CDB3CA94D05F77D6D2C23555C646629823D430879C802D9A58A84093FDE5E4366836D0578F979347E1113AC3F6125B92C4C6E1F5A0D6232329E114ADB29A43
Malicious:	false
Preview:	{.. "runtimeTarget": {.. "name": ".NETCoreApp,Version=v6.0/win-x64",.. "signature": "".. },.. "compilationOptions": {},.. "targets": {.. ".NETCoreApp,Version=v6.0": {},.. ".NETCoreApp,Version=v6.0/win-x64": {.. "Malwarebytes/5.0.0.804": {.. "dependencies": {.. "MB.Theme.WPF": "1.0.0.105",.. "MB.TrayNotifications.WPF": "5.0.0.25",.. "MBInteropActivator": "5.0.0.46",.. "MbamUI.Core": "5.0.0.804",.. "MbamUI.Data": "5.0.0.804",.. "MbamUI.Services": "5.0.0.804",.. "MbamUI.Tray": "5.0.0.804",.. "MbamUI.UICommon": "5.0.0",.. "Microsoft.EntityFrameworkCore.Sqlite": "7.0.4",.. "Microsoft.EntityFrameworkCore.Tools": "7.0.4",.. "Microsoft.Extensions.Logging": "7.0.0",.. "Prism.Container.Extensions": "8.0.62",.. "Prism.DryIoc": "8.1.97",.. "QRCoder": "1.4.3",.. "Sentry": "3.36.0",.. "Serilog.Enrichers.Process": "2.0.2",..

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Malwarebytes.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	7490664
Entropy (8bit):	7.678482100150037
Encrypted:	false
SSDEEP:	98304:ZsacO0nfScO3C5MXZLQtvPsPdo8qh9dykOf3QkpQuNNAvQna5/IqP5b6hd:ZsacO0nFKZgkaXOf3fpLox4
MD5:	94D0FEC4D864E7380DCC8447C556847E
SHA1:	BC42D045C9740B2867A37995C9203D4EB63D0576
SHA-256:	6BC13263EF863B613D41F0A119050101B24E0FD6677D991AAC2818A43618E134
SHA-512:	CC8B2BF8231487CB2661E40E98FB07D7BE6151BB36CD7C0A0F63E97656E68B290CE3099DD485B41D4170BAEC80852E429351C0FDD28EF11AC97D47CCE745EABF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...~............."...0...o.............. .....@..... ....................... q.....H^r...`...@......@............... ...............................@o.,.............p.h`..........l2o.T............................................................ ..H............text.....o.. ....o................. ..`.rsrc...,....@o.......o.............@..@........................................H.......H...l.......6.........b...........................................{E.....{F...V.(G.....}E.....}F......0..A........u$.......4.,/(H....{E....{E...oI...,.(J....{F....{F...oK...... XI.P )UU.Z(H....{E...oL...X )UU.Z(J....{F...oM...X...0..b........r...p......%..{E......%q'....'...-.&.+...'...oN....%..{F......%q(....(...-.&.+...(...oN....(O.....(P...^.(P..........%...}....:.(P.....}....:.(P.....}....>. 4......(Q...2......oR...:........oS...*.0..,........oT...rC..p $...

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Malwarebytes.exe

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	295928
Entropy (8bit):	5.752788870739648
Encrypted:	false
SSDEEP:	3072:sczkitvo4BpYN/6mBPry8TXROLdW5m4mURh9OOG40klaPOC8j5pNd5I:sA4NCmBPry/N2VOOVOODjDHm
MD5:	F78BA9ED5C75BA595C2C73483C06EB06
SHA1:	69E390B174BD5E58187174437FB7BE4833B892E2
SHA-256:	1BCAF4BE52C1403A6853B34FF19E5180A9CF366A45232A74CFA9DCEE83AD9517
SHA-512:	A034851D14F94140B328A32CD332B4E779A6931FBA7B07EAF470B56A697C9C98BF9EAB102A9675C058595935EA0F3EB6E8C1C951789F3B33E0D3843A32AA8628
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........}.............../......./......./.....a.....S../........"...I../....I../....Rich............................PE..d......e..........".................`<.........@....................................l.....`.................................................t$..........(....`..@........k..............T.......................(.......8............................................text............................... ..`.rdata..............................@..@.data........@......................@....pdata..@....`.......&..............@..@_RDATA...............<..............@..@.reloc...............>..............@..B.rsrc...(............B..............@..@........................................................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Malwarebytes.runtimeconfig.json

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	441
Entropy (8bit):	4.562732110625819
Encrypted:	false
SSDEEP:	12:dFk2BEe01sxvEbJc11slex+K8E76jc/9J2:djBEx1sxvEb01sA0KEq9J2
MD5:	EDAF04AFDA9B2C6D778D7042E7824A2F
SHA1:	FC274B8D68C9EEBDF0A8867A7CC1B3FE614C5506
SHA-256:	AE076CC42958355D8E061A4D3D020BED0EF3CD0C37C1851BDF84844503F9880C
SHA-512:	3188760CDD8E97A482F839F94F178EA3F630EC89CEA100CFCB5C6C3993DC253FED9E5A9835ECF14CE9B43379CEC2C67C0BF0A18C8CC34DA706AB5A8E8DE2212B
Malicious:	false
Preview:	{.. "runtimeOptions": {.. "tfm": "net6.0",.. "frameworks": [.. {.. "name": "Microsoft.NETCore.App",.. "version": "6.0.0".. },.. {.. "name": "Microsoft.WindowsDesktop.App",.. "version": "6.0.0".. }.. ],.. "configProperties": {.. "System.Reflection.Metadata.MetadataUpdater.IsSupported": false,.. "System.Reflection.NullabilityInfoContext.IsSupported": true.. }.. }..}

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Malwarebytes_Assistant.deps.json

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	27996
Entropy (8bit):	5.161493313315752
Encrypted:	false
SSDEEP:	384:+4ZzimU19FqfR16BQxpvOql1kkASjioUDYPjYyHgM94M:+4ZziGp1XpvOql1/VaM
MD5:	BC635088AC6B17AAA88914C002C9B4ED
SHA1:	B0AD5ACD112DB4473E066A2C58906FEDD0570419
SHA-256:	BD66D807ED5FB5A97A0F689B3A350C2FC2160BBA4ED06D732F923B2CF3C41CB5
SHA-512:	2D759E1B9FA25F5F69A06FBD699926D59339E86B618F18445620061A4F3161A46A3B56EC1438A785B04515584C646454761E226BF6F1FCDE1B123D84315F9C05
Malicious:	false
Preview:	{.. "runtimeTarget": {.. "name": ".NETCoreApp,Version=v6.0/win-x64",.. "signature": "".. },.. "compilationOptions": {},.. "targets": {.. ".NETCoreApp,Version=v6.0": {},.. ".NETCoreApp,Version=v6.0/win-x64": {.. "Malwarebytes_Assistant/5.0.0.804": {.. "dependencies": {.. "MBInteropActivator": "5.0.0.46",.. "MbamUI.Services": "5.0.0.804",.. "System.ServiceProcess.ServiceController": "6.0.0",.. "mbam_idl_interop": "1.3.0.22".. },.. "runtime": {.. "Malwarebytes_Assistant.dll": {}.. }.. },.. "DryIoc.dll/4.8.7": {.. "dependencies": {.. "System.Reflection.Emit.Lightweight": "4.3.0".. },.. "runtime": {.. "lib/netstandard2.0/DryIoc.dll": {.. "assemblyVersion": "4.8.7.0",.. "fileVersion": "4.8.7.0".. }.. }.. },.. "mbam_idl_interop/1.3.0.22": {.. "runtime": {.. "runtimes/win-x64/lib/netstandar

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Malwarebytes_Assistant.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	152696
Entropy (8bit):	4.973398796599455
Encrypted:	false
SSDEEP:	768:mIEJQNhFyEb1qbudKVq+X5eD/IkZxx9zycweEFiRTia0MtU+Y7N2Ip45rEFiRc:jXhZolc/3XnzWeeihvtto7Q9Beii
MD5:	F27B688758953C1B2AC5F913DEFE587B
SHA1:	C36C75505A62EA2A8C01ED2074114561E823F528
SHA-256:	3254BDA7B992F917D278011C2638D54A8164973ECDE740144575DA5E1D7E8245
SHA-512:	2166190816BFA3716740D8ED727867B8B5F6A65191146E2C0CC80BC199C61FE88E88088C07B2711BF5CBCA19BD6A9C621F0CC13D79E0FFB9FD8C55BF2F472F83
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d................."...0.. ............... .....@..... ....................... ......8>....`...@......@............... ...............................@..................xf..........P>..T............................................................ ..H............text...m.... ... .................. ..`.rsrc........@......."..............@..@........................................H........#..............................................................Fs....s.....o......(....:.(......}........0..<.......s.......-.r...p(........r5..po....-.r;..p(...........o....}9........(....(...........s....(...+..-.rm..p.{9...r...p(....(.........(...+-.r...p.r...p(....(........3..{....o....-...{.....\|....o.....E...................."......2...:...B...+F.(....+>.(....+6.(....+..(....+&.(....+..(....+..(....+..(....+..(.......{....o.....o.....{....o.....<o.....{....o.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Malwarebytes_Assistant.exe

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	293328
Entropy (8bit):	5.7268435107588544
Encrypted:	false
SSDEEP:	3072:eczkitvo4BpYN/6mBPry8TXROLdW5m4mURh9OOGB0kfaPOZU0rn:eA4NCmBPry/N2VOOEwOa+
MD5:	933475515AFC71B2765F372BD42CBAA7
SHA1:	D2C696A0695C23D29DB3634CB32B4B00D924A129
SHA-256:	61A1791E3DF62D3B295634F1DF13D8578B7BE64855874AB2190893984058EA91
SHA-512:	EAFFE49B8FDFEFD3855D9082358B12E4B03047CE819BA62C458AA7657B163F17EA08B2E094D77CE6659AFA5183ECA232F4F89400D3FA74880499FD9F3252701A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........}.............../......./......./.....a.....S../........"...I../....I../....Rich............................PE..d......e..........".................`<.........@.............................p.......@....`.................................................t$...............`..@........k..............T.......................(.......8............................................text............................... ..`.rdata..............................@..@.data........@......................@....pdata..@....`.......&..............@..@_RDATA...............<..............@..@.reloc...............>..............@..B.rsrc................B..............@..@........................................................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Malwarebytes_Assistant.runtimeconfig.json

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	372
Entropy (8bit):	4.427922197527517
Encrypted:	false
SSDEEP:	6:3Hp/hdNyhAkI/X5BXmJe5S1sHRvXmJbJccVHdS1sHNAQ6NOCUo+K8EkNTy:dFk2BEe01sxvEbJc11slex+K8Es2
MD5:	D94CF983FBA9AB1BB8A6CB3AD4A48F50
SHA1:	04855D8B7A76B7EC74633043EF9986D4500CA63C
SHA-256:	1ECA0F0C70070AA83BB609E4B749B26DCB4409784326032726394722224A098A
SHA-512:	09A9667D4F4622817116C8BC27D3D481D5D160380A2E19B8944BDD1271A83F718415CE5E6D66E82E36819E575EC1B55F19C45213E0013B877B8D61E6FEB9D998
Malicious:	false
Preview:	{.. "runtimeOptions": {.. "tfm": "net6.0",.. "frameworks": [.. {.. "name": "Microsoft.NETCore.App",.. "version": "6.0.0".. },.. {.. "name": "Microsoft.WindowsDesktop.App",.. "version": "6.0.0".. }.. ],.. "configProperties": {.. "System.Reflection.Metadata.MetadataUpdater.IsSupported": false.. }.. }..}

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MbamBgNativeMsg.exe

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3518984
Entropy (8bit):	6.409829963295863
Encrypted:	false
SSDEEP:	49152:fqSyu1zrwcqZl/0nbw9UjpCaOqGo6w1iX7IfxOh5Pse5foEPVBIyPVs69HwAWTKw:GuOc8lLDtyWfzPVy+s6n3g
MD5:	DC434FDD909CFF34F67B6AAB12AEAA55
SHA1:	3A2EC2632528936A0583ABBF7EDF58BF550AD3B0
SHA-256:	5EA4CFA9925AC74154F1F881DD7F2B17F26B586481B334032495507F29EDA735
SHA-512:	D44263C91A724083D36431CCC41B7DED321DA7B5C51BEF11E793D31EBD756487E31255EDAD72B5905D8D4E02B4D47ADD253765EBE05764BE9018EACD3844FC9C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......95..}T.Y}T.Y}T.Y.0.XpT.Y.0.X.T.Y.0.X.T.Y/<.XtT.Y/<.X[T.Y/<.X.T.Y.0.XbT.Y.0.X~T.Y.<.X=V.Y.<.X"T.Y}T.Y.U.Y.=.XET.Y.=.XpT.Y.=2Y\|T.Y}TZY\|T.Y.=.X\|T.YRich}T.Y........PE..d...9-.e.........."......."....................@.............................p5.....?.6...`.................................................(.1.(.....4.x.... 3.h.....4.......4..~..`...T.......................(...`f,..............0".....H.1......................text....."......."................. ..`.rdata......0".......".............@..@.data...,$....1.......1.............@....pdata..h.... 3.......2.............@..@.rsrc...x.....4......P4.............@..@.reloc...~....4......V4.............@..B................................................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MbamUI.Core.deps.json

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14335
Entropy (8bit):	5.1497767715656115
Encrypted:	false
SSDEEP:	96:+FshmI6gklFfwzdnHMwwnP4vRecKqTdFPMpE4160bHk42Jdypp05P9PsyQj5bGVe:+FDMFIR16KxUMpScmium5YwEjYyyOzAn
MD5:	15FEB77891C7E08198D7D5C2AC7B8830
SHA1:	E2C653E7480D2955F42971EBC1AE5180C14CF972
SHA-256:	802194EE021CC98D71C466A15E87DD71E8AB4680DE7142C34BCC7D1DFCF3A695
SHA-512:	D7EA45C644DE95E9F1B806879670CE7460685463B880CD7B6D264FBB0215937274561EFB2F8A75E82A2215EAE8202D936BB824D43977093D96A22543579F43C5
Malicious:	false
Preview:	{.. "runtimeTarget": {.. "name": ".NETCoreApp,Version=v6.0/win-x64",.. "signature": "".. },.. "compilationOptions": {},.. "targets": {.. ".NETCoreApp,Version=v6.0": {},.. ".NETCoreApp,Version=v6.0/win-x64": {.. "MbamUI.Core/5.0.0.804": {.. "dependencies": {.. "Microsoft.Extensions.Logging": "7.0.0",.. "Prism.Wpf": "8.1.97",.. "Serilog": "2.10.0",.. "System.DirectoryServices.AccountManagement": "6.0.0",.. "System.Management": "6.0.0".. },.. "runtime": {.. "MbamUI.Core.dll": {}.. }.. },.. "Microsoft.Extensions.DependencyInjection/7.0.0": {.. "dependencies": {.. "Microsoft.Extensions.DependencyInjection.Abstractions": "7.0.0".. },.. "runtime": {.. "lib/net6.0/Microsoft.Extensions.DependencyInjection.dll": {.. "assemblyVersion": "7.0.0.0",.. "fileVersion": "7.0.22.51805".. }.. }.. },.. "Micros

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MbamUI.Core.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	102640
Entropy (8bit):	6.4204279979562
Encrypted:	false
SSDEEP:	1536:4GNRbRqC7kH5jXOKGIb7ELGxfT27t4HzoeiSvto7Q9SeiV:NrtqCoZkIb7ELGhT27GjLbe
MD5:	7B2BD897106E5FE4E18C0D5246AC2B58
SHA1:	D104BA9928A064122A6BC56E53D36A87452B8F72
SHA-256:	060407DFE1456286762AF0B29589AB5FDEB8BDFCE215F5A9F7E2D35273EE7DC1
SHA-512:	CF672BCFBF9C94E1E41D35934A13C0CBB9C72DFAA2F112FF83D7DC86F36AD0AB4CA588CD923C967F1C18C99AEE21AFC2B50189C50D000C26B9056664A9A6FFFA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....0..........." ..0..&............... ........... ...............................M....`...@......@............... ...............................`...............,...d...........C..T............................................................ ..H............text....$... ...&.................. ..`.rsrc........`.......(..............@..@........................................H........K................................................................(....^.(.......Y...%...}....:.(......}....:.(......}....^.(.......Z...%...}....:.(......}........0..F.......r...p..(.....r...p..(....&r!..p...\....(....&..(...+(.......,..o................;.......0..........r...p..(.....r...p...(....&r!..p...\....(....&.(....--..s........(......r7..p(.......(...+..( ...+...s........(...+..( .......(...+(!......,..o................}........0..F.......r...p..(.....r...p..

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MbamUI.Data.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	320064
Entropy (8bit):	6.098352039981224
Encrypted:	false
SSDEEP:	3072:TS4DR5DLifYSnmi6cRi115vKZRnClSrrxMKbCprl7V8pzcJr66d4A:OU7LXWpzcJm4
MD5:	7B9A084B476A3AD62BCDE076CF9477A3
SHA1:	91A5E611D2D9A1CE44CAA37E803572B71C22DE54
SHA-256:	4E443876242C1270C6B67F3075010C80E30D5E7FFBE4DF1098213B30AF8F24F6
SHA-512:	8B3F28E203F077FD3E8ED66462088AFD07BE58F8F6411B0D7C914A0DC63CADADE9CEEB02E7A83E18DE381937550236F979B8673C1C86C3EA486E68053F8D8742
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...x.q..........." ..0..p............... ........... ..............................%3....`...@......@............... ...............................................v..@l..............T............................................................ ..H............text....n... ...p.................. ..`.rsrc................r..............@..@........................................H.........................................................................{......{....V.(......}......}.......0..A........u........4.,/(.....{.....{....o....,.(.....{.....{....o....... .$I8 )UU.Z(.....{....o....X )UU.Z(.....{....o....X...0..b........r...p......%..{.......%q .... ...-.&.+... ...o.....%..{.......%q!....!...-.&.+...!...o.....(......{......{ .....{!.....{".....{#.....{$.....{%.....{&.....{'.....{(.....{).....{.....{+.....{,.....{-.....{....*..{/..

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MbamUI.Services.deps.json

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	27506
Entropy (8bit):	5.169246269027214
Encrypted:	false
SSDEEP:	384:+ASNzimU19FqfR16BQxpvOql1kkrioUDYPjYyHgM94r:+5NziGp1XpvOql7Var
MD5:	04BBEE16ED6CB5BCDF630CD2D3444A19
SHA1:	951B6AA18A53A7C150B6A342BBF54622860EEB41
SHA-256:	E87EF6C3141EC7EB9CC881AEE222BA6E9A405C7E05F57277C98D5D01DA59D17B
SHA-512:	7E97122F3DEE4768F057D05982E56B344E05685FB70B9AC957C042AD63A2E71C56C667DD4D07349E076D414D0DF67B50937C04C5FAD29E90B12FD221A8C10278
Malicious:	false
Preview:	{.. "runtimeTarget": {.. "name": ".NETCoreApp,Version=v6.0/win-x64",.. "signature": "".. },.. "compilationOptions": {},.. "targets": {.. ".NETCoreApp,Version=v6.0": {},.. ".NETCoreApp,Version=v6.0/win-x64": {.. "MbamUI.Services/5.0.0.804": {.. "dependencies": {.. "DryIoc.dll": "4.8.7",.. "MBInteropActivator": "5.0.0.46",.. "MbamUI.Core": "5.0.0.804",.. "Microsoft.Extensions.Logging": "7.0.0",.. "Microsoft.Extensions.Logging.Abstractions": "7.0.0",.. "Prism.Core": "8.1.97",.. "Prism.Wpf": "8.1.97",.. "Serilog.Sinks.File": "5.0.0",.. "System.ServiceProcess.ServiceController": "6.0.0",.. "mbam_idl_interop": "1.3.0.22".. },.. "runtime": {.. "MbamUI.Services.dll": {}.. }.. },.. "DryIoc.dll/4.8.7": {.. "dependencies": {.. "System.Reflection.Emit.Lightweight": "4.3.0".. },.. "runtime": {.. "lib/nets

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MbamUI.Services.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1790544
Entropy (8bit):	6.011031876142037
Encrypted:	false
SSDEEP:	12288:n4hEZOZYknAj51CDaZpszSTr6d0fT2+5FUeR85xwNhE3pmRTB3tG0G7vYPn4hBZp:bXZqzurE0C+59RewAWBdG0UvbZn
MD5:	CF219FAE16A502D4D693BD6A87F87B89
SHA1:	26EC645A60A8FA1C0057E910D8F4F18815AEADB2
SHA-256:	67CBB1E7321EDF361FAB80A0F1EC2467701E51FB5EF5EC1BEAB929655E0BF3A8
SHA-512:	7AE06A13E4AC691E70548043CC5AF3C56FEC08B7EE10F007F0AC895F87C53836039212218017C1D4FB347F49717E6EBD288EDD8BE07BA042A3989D4D6635A467
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....\N..........." ..0.................. ........... ..............................y.....`...@......@............... ..................................................P...............T............................................................ ..H............text........ ...................... ..`.rsrc...............................@..@........................................H..........8;..........$.................................................{(...:.().....}(.....0..)........u..........,.(....{(....{(...o+.....v .J3. )UU.Z(....{(...o,...X..0..:........r...p......%..{(......%q.........-.&.+.......o-....(......{/...:.().....}/.......0..)........u..........,.(....{/....{/...o+.....v I... )UU.Z(....{/...o,...X..0..:........r%..p......%..{/......%q.........-.&.+.......o-....(......()......0...........u.................rM..p..{0...

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MbamUI.Tray.deps.json

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	29041
Entropy (8bit):	5.1547691270099785
Encrypted:	false
SSDEEP:	384:+HWzimU19FqfR16BQxpvOql1kkASpioUDYPjYyHgM94u:+2ziGp1XpvOql1FVau
MD5:	02D0D31EF44B0244527D4657CAF10524
SHA1:	031D3754EF6BF89A5C72B4163ABED0249EBFA959
SHA-256:	A90806BEF1263FAC898516DD162990C456B8F36F4339CF6DDE2D89358546ED5B
SHA-512:	6A5DAF9C04B118EEA4FF268A35E52C55BFE8B36D57C259DEB404ECCE1AEA1527D532414DAC44C03D36D38869F2278FDBA55D32F59FD4A62E1053BB6430DCD86F
Malicious:	false
Preview:	{.. "runtimeTarget": {.. "name": ".NETCoreApp,Version=v6.0/win-x64",.. "signature": "".. },.. "compilationOptions": {},.. "targets": {.. ".NETCoreApp,Version=v6.0": {},.. ".NETCoreApp,Version=v6.0/win-x64": {.. "MbamUI.Tray/5.0.0.804": {.. "dependencies": {.. "MB.TrayNotifications.WPF": "5.0.0.25",.. "MbamUI.Core": "5.0.0.804",.. "MbamUI.Services": "5.0.0.804",.. "MbamUI.UICommon": "5.0.0",.. "Prism.Wpf": "8.1.97".. },.. "runtime": {.. "MbamUI.Tray.dll": {}.. }.. },.. "DryIoc.dll/4.8.7": {.. "dependencies": {.. "System.Reflection.Emit.Lightweight": "4.3.0".. },.. "runtime": {.. "lib/netstandard2.0/DryIoc.dll": {.. "assemblyVersion": "4.8.7.0",.. "fileVersion": "4.8.7.0".. }.. }.. },.. "MB.TrayNotifications.WPF/5.0.0.25": {.. "dependencies": {.. "Microsoft.Extensions.Depende

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MbamUI.Tray.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	455904
Entropy (8bit):	5.51779356269339
Encrypted:	false
SSDEEP:	12288:hibe+f6vAetrpdRvHffO2Qbe+f6vAetrpdRvYJfOlLl1Gw340:hibe+f6vAetrpdRvHffO2Qbe+f6vAetZ
MD5:	200FA713758D7F8B777A5556DD8B2E74
SHA1:	430B6CCC1F747C17F1A9FCA7EFAC498F928B2496
SHA-256:	E103040B6CDC89275C4848BB3DD30AEB7D5652325E22E2EC0AA4E5BEF90F3543
SHA-512:	BB04C8A5BEA00FCA9FFDC4D395C55C3B43BE5DE307EBB0AF31C44DBC9B852CA54F90BFCDFE5CAA8AB087C38277FC5A71958CDCC17C48662F40D2F6A07A50AC64
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....C..........." ..0..p............... ........... ...............................!....`...@......@............... ..................................T................p.............T............................................................ ..H............text....n... ...p.................. ..`.rsrc...T............r..............@..@........................................H........D..._..............H.............................................(....^.(.......k...%...}....:.(......}....:.(......}......{...."..}......{...."..}......{...."..}......(........0...........(....}.....(......}......}......}.......}.......}.......}.......(...+}.....s....%.o....%#.......@o....}.....{...........s....o.....{...........s....o.....{...........s....o.....{...........s....o ....{...........s!...o"....0..)........{.........(#...t......\|......(...+...3.*...

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MbamUI.UICommon.deps.json

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	27859
Entropy (8bit):	5.162994757733402
Encrypted:	false
SSDEEP:	384:+0zimU19FqfR16BQxpvOql1kkASOioUDYPjYyHgM94M:+0ziGp1XpvOql1GVaM
MD5:	CF7A8BCA39FD1B76AEC630F9A9E3720C
SHA1:	36D42A9168C6EDBC3BBFD98290D2F10E19D45130
SHA-256:	C5668FDC0FD9968F8291D7645DFC24F217E92DCFC8FF88DEFBE68253C2CD78D5
SHA-512:	7FCF6A998C8A64739CC22BCFAC2B57FACC28213DF0369EE71CB7A12463D8812081523891AC6E4E5290392A6B5B2D02F33E2C012F4E56456C3698C17BDD212921
Malicious:	false
Preview:	{.. "runtimeTarget": {.. "name": ".NETCoreApp,Version=v6.0/win-x64",.. "signature": "".. },.. "compilationOptions": {},.. "targets": {.. ".NETCoreApp,Version=v6.0": {},.. ".NETCoreApp,Version=v6.0/win-x64": {.. "MbamUI.UICommon/5.0.0.0": {.. "dependencies": {.. "MbamUI.Core": "5.0.0.804",.. "MbamUI.Services": "5.0.0.804".. },.. "runtime": {.. "MbamUI.UICommon.dll": {}.. }.. },.. "DryIoc.dll/4.8.7": {.. "dependencies": {.. "System.Reflection.Emit.Lightweight": "4.3.0".. },.. "runtime": {.. "lib/netstandard2.0/DryIoc.dll": {.. "assemblyVersion": "4.8.7.0",.. "fileVersion": "4.8.7.0".. }.. }.. },.. "mbam_idl_interop/1.3.0.22": {.. "runtime": {.. "runtimes/win-x64/lib/netstandard2.0/Malwarebytes.Protection.Interop.dll": {.. "assemblyVersion": "1.3.0.22",.. "fileVersion": "1.3.0.22".

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MbamUI.UICommon.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	35496
Entropy (8bit):	7.140351809865569
Encrypted:	false
SSDEEP:	768:2hYP6bTCyzycgtEFiRbftU+Y7N2Ip4OEFiRUq:QzbTCyzmteidfto7Q9Oeimq
MD5:	01F7D1F344C244BEA6EF9747F1809E31
SHA1:	EAC57193E9C74DF7C8002183AF6AEC61578312C2
SHA-256:	B2C4B1D70BF69C059E8D689D5A30D3205808EA6D7CD4561126DEE1A0C396B9A4
SHA-512:	D44D5B49B1B3390B43B0DEF7E93943A0F2AA00269624736A8A6169ACC89EA46BA08FE55A76654B33E1472977B0DB2DC6C1A32683A8DC7F423C46CA1231E4D0B0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...a............" ..0.."............... ........... ...............................x....`...@......@............... ...............................`...............(...b..........d@..T............................................................ ..H............text...m!... ...".................. ..`.rsrc........`.......$..............@..@........................................H........(...............................................................0...........E............-...=...J...W...d...q...~..............;....8....r...p(.....8....r...p(.....8....r=..p(.....8....r...p(.....+sr...p(.....+fr=..p(.....+Yr[..p(.....+Lr[..p(.....+?r...p(.....+2r...p(.....+%r...p(.....+.r...p(.....+.r...p(......*....0..0........E............-...=...a..............................;....8....r...p(.....8....rM..p(.....8....ry..p(.....8....r...p(....r...pr...p(....(.....8....r

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Microsoft.Data.Sqlite.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	170392
Entropy (8bit):	6.1412421476057375
Encrypted:	false
SSDEEP:	3072:/ncUUa2pdJawZJ491IZfJunvOtyD9TIlFFWbjvIS4dmspbZy7iqKyg7CgRV:T3wZJ4GnUZTIlFFWbjvIS4dmspbZy7Nn
MD5:	4F43C73C43C338F17015BBE077715B26
SHA1:	F72CB1ACD16655DC1A20C20B5DA981E3DB321FE1
SHA-256:	F103967A60922CD73AF5773568359024B72E5251A7EFCE80F92D07866B44CD5E
SHA-512:	ABCF1FA325E22BDAE7CF18F047865B5FC12D2C73889E719A14C7545D617D7B3AB518F09EE0B399B84F6C8EC02DF1D6B3A1B6C633AD06B3A6AF8891EE2437E07D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..f.............. ........... ..............................VN....`.....................................O....................r...'..............T............................................ ............... ..H............text....e... ...f.................. ..`.rsrc................h..............@..@.reloc...............p..............@..B.......................H........... ............p.. ...4.........................................(&...^.(&..........%...}....:.(&.....}....:.(&.....}....:.(&.....}......o'..., .o(...,..o)........(...(+.....F.o,...-...(-...2.(....%-.&...0............(.....0..(........(/...Q~.....P..o0...-...........s1....s2...%r...p.o3...%r...p.o3...%r-..p.o3...%rA..p.o3.........0../........o.......o4....o/....o.....o5.......,..o................#......:...(...........0../........o.......o4....o/...

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Microsoft.EntityFrameworkCore.Abstractions.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	34712
Entropy (8bit):	6.353857754643937
Encrypted:	false
SSDEEP:	768:FbOu2/CERb/ksbp5gtMLu9+HFbWKharGCxNaix9zMv:9OH/CId5WMQ+BWGMRjzY
MD5:	2FE4EF84E5D0ED10435DFDD3D785E99C
SHA1:	82B7EF4C239DC3102195AFD4B5A36EF6EDDE2FEB
SHA-256:	A777E065BCD584C87AB03720A3632065F28D634A5FAEAE4A72E888843A98DDA9
SHA-512:	9179E2F07284D9826EE5EDA58E6FF5680E24E876981B89E551130C57D81B116513F3EBF036EF5163F017A5F484A736B2C61692AA915023526B261FEEADFA8713
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....o..........." ..0..V...........u... ........... ..............................3.....`.................................Bu..O.......T............`...'..........Lt..T............................................ ............... ..H............text....U... ...V.................. ..`.rsrc...T............X..............@..@.reloc...............^..............@..B................vu......H........-...A..........\|o..P....s........................................("...^.("......>...%...}....:.(".....}....:.(".....}....:.(".....}......(".....(".....{......{....&...(....V.(".....}......}....&...(....&...(....&...(....V.(".....}......}......{......{....:.(".....}......{....j.("....r...p(@...&..}......{....j.("....r...p(@...&..}......{......(".....("....r...p(@...&..}......}......{....R.r...p(@...&..}......{...."..}......{...."..}....*.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Microsoft.EntityFrameworkCore.Relational.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1842072
Entropy (8bit):	5.993564574647202
Encrypted:	false
SSDEEP:	24576:lZApb4S9aL6hKgWndvtHbMMupTZ7Jbx8CoWcyQCzl+ASw1YLRNRgZ:lMaTRJp7g
MD5:	C5EB0CF9B942309060B1D0D0048BF0F5
SHA1:	F8CFEE8D1E793A51664E857CC18B2E4782FD85B6
SHA-256:	F84E9BB2A4E56E421C7E8FF872EFD59E726310CBE62895F5D1BF55AAA597FCED
SHA-512:	730F871FC3DA7C94A82FB73DC306146D643D439413153353464AFD44384EF14A8BC7BDE64F50A9E6EBA59582E9602B91C95E4410A1A1FA3E81C4E4ABEF921945
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...v............." ..0.................. ... ....... .......................`......>.....`.................................N...O.... ..4................'...@......\...T............................................ ............... ..H............text........ ...................... ..`.rsrc...4.... ......................@..@.reloc.......@......................@..B........................H...........0,..............(D............................................{i.....{j...V.(k.....}i.....}j......0..A........u........4.,/(l....{i....{i...om...,.(n....{j....{j...oo...... ~.F. )UU.Z(l....{i...op...X )UU.Z(n....{j...oq...X...0..b........r...p......%..{i......%q.........-.&.+.......or....%..{j......%qH....H...-.&.+...H...or....(s.....{t.....{u...V.(k.....}t.....}u....0..A........u........4.,/(l....{t....{t...om...,.(n....{u....{u...oo...... -:.p )UU.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Microsoft.EntityFrameworkCore.Sqlite.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	204696
Entropy (8bit):	6.252174781829077
Encrypted:	false
SSDEEP:	3072:XMxLsQupX72oMwMqzIFuj+47RGt+l+akHHMIqe:XMx9XgsF2EwWM
MD5:	C888D4269539ECF2576C8CFA4E76B3BB
SHA1:	003610EC631C0D94CEA0BBC668692BB3B3DAC4CF
SHA-256:	AE5B7C95EAD6AFEC11D44B51AC9EA67D2616726D0DD5870B214C1E53BA96976C
SHA-512:	625E2CFE9B96501565EEB7534AB0651EFCEA54FE459FD869ECA4EA7DBD9CC39BB7600596208F1E224659B9219BB4BF7665C027C25A77E74BF1A051194BE34624
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...f............." ..0.............n.... ... ....... .......................`.......S....`.....................................O.... ..t................'...@......,...T............................................ ............... ..H............text........ ...................... ..`.rsrc...t.... ......................@..@.reloc.......@......................@..B................O.......H.......d%..x.............................................................(:...^.(:......b...%...}....:.(:.....}....:.(:.....}....:.(:.....}....2.(;...%-.&...o<...,..o=....U...(>...(?....F.o@...,..(.....R.oA...,..oB.........oC...,....h...(>...(....~....%-.&~......2...sD...%.....(...+..(......$.-..(.....U...(>.........%...oF.......0..G........(.......(....-5......(>...(?...-#..f...(>...(?...-...g...(>...(?....*..0...........(........h...(>...(?...:......i...(

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Microsoft.EntityFrameworkCore.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2082712
Entropy (8bit):	5.998742186400001
Encrypted:	false
SSDEEP:	24576:cvjpLewns1NE+XvjZXPsNHD39iUhz9pFIRH5qn8+JfBG771DyDsn:cvMqs1i+XaOiuV5O8+JfB1gn
MD5:	43B3404ED58839C0F19B37E8FEF58785
SHA1:	36A3E112ADA41F1A250D2E9DBCB123530F6454FE
SHA-256:	5F9599E42E226C8E48EA2C49322F02F9953314EFA7C15467C6038312AB729609
SHA-512:	A59CF3F31E162FC7CD74339165C3DD7C32E97DBAAF20F6DA09BCE00BDFA6F3E7ED8BD66CB69C7292C43428320ECF4409DA2C5E27EDB4F0A663FE7945459F42C2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...m_V..........." ..0.............".... ........... ........................ ....... ...`....................................O.......l................'..............T............................................ ............... ..H............text...(.... ...................... ..`.rsrc...l...........................@..@.reloc..............................@..B........................H.......<`..............<...8...t.........................................{q.....{r...V.(s.....}q.....}r......0..A........u........4.,/(t....{q....{q...ou...,.(v....{r....{r...ow...... >.F. )UU.Z(t....{q...ox...X )UU.Z(v....{r...oy...X...0..b........r...p......%..{q......%q.........-.&.+.......oz....%..{r......%q.........-.&.+.......oz....({.....(\|...^.(\|....../...%...}....:.(\|.....}....:.(\|.....}....:.(\|.....}......(\|.....(\|.....{......{....&...(....V.(\|...

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Microsoft.Extensions.Caching.Abstractions.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	31880
Entropy (8bit):	6.325091470613618
Encrypted:	false
SSDEEP:	768:X2z8YAqmMe33Qy6uOje1T45wKIG/N0Syo7ieSuo0lEQP9zMKY:X2z8YAhHNROjeMwK/N5T7iio0jzMn
MD5:	89F216CF8EACB39551AC5DF4DF726D7F
SHA1:	CBB5349B9EF110D51AB28CF6E9EA8ACCA6C16E2A
SHA-256:	C004F78D9F8378C5F79AC3A88E90625A117B9700A75F5F02266289DD4D28E451
SHA-512:	2B4517149995A75D188EB195F3C53331CE4119E6D516ED385FCFCC1E62676997C97BA66B13C3484F4BCAB8509D566F17D3B58F5B146911644811A81C1AE36D17
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....8~..........." ..0..H...........f... ........... ...............................>....`.................................Kf..O.......\............T...(..........@e..T............................................ ............... ..H............text....F... ...H.................. ..`.rsrc...\............J..............@..@.reloc...............R..............@..B.................f......H.......\|,..D8...................d........................................(....^.(.......4...%...}....:.(......}....:.(......}....:.(......}....:.(......}.....-..(......s....z:.(......}......{......{...."..}......{...."..}......{...."..}......{...."..}.....(......(....:..s....o.....:..s....o.....:..s....o.......{...."..}......{......0..A.........~ ......(!...-..+...("....(#...,.r...p......rA..ps$...z..}......{........0..A.........~ ......(!...-..+.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Microsoft.Extensions.Caching.Memory.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	43648
Entropy (8bit):	6.356040065120218
Encrypted:	false
SSDEEP:	768:M/Lun0cK7s4dFnRmoFSTzje6EEYcu2Epuo0NHkOQ69z7:M/L4bKs4dFnRHAjyERu2Do0Dz7
MD5:	F60F3D61EA68254B8A5EE1F50E95F56F
SHA1:	0CFA3F1BE8F6B8F9A9439DCBA0BBED12DB4D58C0
SHA-256:	9EF11F0B594D5BE76341CA65A53BF3930AA807C312A278AE22043DCF4DB9CE25
SHA-512:	D14792DB1ABB631C9F1532EB1575CE63786E888BDCC4625F38A4E841A9315E95659D4634DBA592A37B4DD5441F1FE58F27DF91A45A6FBAF7EE09DB69DDAD7429
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0..x..........Z.... ........... ..............................jV....`.....................................O.......T................(..............T............................................ ............... ..H............text...`v... ...x.................. ..`.rsrc...T............z..............@..@.reloc..............................@..B................;.......H.......<>...R..........0...X.............................................(#...^.(#......M...%...}....:.(#.....}....:.(#.....}....:.(#.....}....:.(#.....}.....-..(......s$...z.~.......0..........(....,....(.....o%......&......................0...........(.......(&...-..,....(....,.r...p......%...%...('.....((....(....,.r...p......%...%...%...('......()....(....,!r...p......%...%...%...%...('.......(.....,&(....,..r...pr...p.('...(+.....(,....*.(....,.r..

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Microsoft.Extensions.Configuration.Abstractions.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	29328
Entropy (8bit):	6.445618238026777
Encrypted:	false
SSDEEP:	384:R+q+2Vv/+usFlLVyKo/9ETG/DwzzRjz69M1ZVMdWs6NWsY/WyRIHRN7eUBGQtR9h:R+EF/CvyKohrqnYuo0eUwQP9zV
MD5:	5EDCF3DCCEF856711D35E0AFDBDF6D0C
SHA1:	FEFE0A4870D36814A45F8E9C63530F1963CD6C0C
SHA-256:	893F042B8BEA61E3E56091EE6167AF61BC38A39D35CB1D0F9B222AAE4493146A
SHA-512:	DE9B23363D5FA78B45C96295713E392D24FA8B0D5A78CF6D2A2A8D04A071FED4F52F4B3559E36C829CDBFCB318C2A81B0DF3CC3D46EEA766C88AFE5F16DE5718
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...N............." ..0..>...........\... ...`....... ..............................<.....`.................................{\..O....`...............J...(..........d[..T............................................ ............... ..H............text....<... ...>.................. ..`.rsrc........`.......@..............@..@.reloc...............H..............@..B.................\......H........(...............W..X....Z........................................(&...^.(&......8...%...}....:.(&.....}....:.(&.....}....:.(&.....}....:.(&.....}.....-..(......s'...z.~.......0..........(....,....(.....o(......&......................0...........(.......()...-..,....(....,.r...p......%...%...(.....(+....(....,.r...p......%...%...%...(......(,....(....,!r...p......%...%...%...%...(.......(-.....,&(....,..r...pr...p.(...(......(/.....(....,.r..

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Microsoft.Extensions.DependencyInjection.Abstractions.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	45200
Entropy (8bit):	6.203265612785868
Encrypted:	false
SSDEEP:	768:2q+RszBJV7CkN9YxrIvw2DLBjYAQP0+lyJ9PPguo0eKW9/9zH:2q+SSkNNjdQc+cJNBo0qzH
MD5:	6C8655836651933FFA4C253B5FA72939
SHA1:	B75730D6C1EF5E0CA6D7F7A1A5EE540AEE940836
SHA-256:	087813B2F9350B8C2D31E5BC9A5410FAB198FADAC87BB1269F41DE6E6AD7EE62
SHA-512:	AFB2A83B58EAB2EB00116AD790110884D53391E6A88CCA3FA7BB8BF8837257DB1AEBE07AF63417A23E4F37AAE9DD217A2B4A58A8F25528C7559EF31582BABE42
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....r=..........." ..0..\|............... ........... ....................................`....................................O........................(..............T............................................ ............... ..H............text....{... ...\|.................. ..`.rsrc................~..............@..@.reloc..............................@..B........................H.......<=...U..........P....... .........................................(!...^.(!......E...%...}....:.(!.....}....:.(!.....}....:.(!.....}....:.(!.....}.....-..(......s"...z.~.......0..........(....,....(.....o#......&......................0...........(.......($...-..,....(....,.r...p......%...%...(%.....(&....(....,.r...p......%...%...%...(%......('....(....,!r...p......%...%...%...%...(%.......((.....,&(....,..r...pr...p.(%...().....(....*.(....,.r..

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Microsoft.Extensions.DependencyInjection.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	85152
Entropy (8bit):	6.236595239621282
Encrypted:	false
SSDEEP:	1536:LNNgvCsvGPrpqSMo4Z9M4IIWSYe2Kbj5u6fjQ+7PMMcmnJ2fxkwzOX:LMCsvGPPed5ZfjQ+rBvJNwe
MD5:	D73FB559B01ACA341A7750DDF3F6D6EB
SHA1:	5F62514899132AED440854E599B742683BCEA1D5
SHA-256:	F8FE8BEDBEDEFE0FAB7E68C48F508D486B42258E16C09572886D7293507BDAD6
SHA-512:	65CE8FAEB54F2F25AF62DEAB7A0C0CCF5EFA9CEC5CBD7049F34608DCAE4B2A6AC04026C6889E619527B8B65CB194FC98E01861FCA7E740904EA12FF9932B3209
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...R.)..........." ..0.............28... ...@....... ...............................N....`..................................7..O....@...............$...(...`.......6..T............................................ ............... ..H............text...8.... ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................8......H.......lj..............$%..0...T6........................................(&...^.(&......s...%...}....:.(&.....}....:.(&.....}....:.(&.....}....:.(&.....}.....~......0..........(....,....(.....o'......&......................0...........(.......((...-..,....(....,.r...p......%...%...().....(....(....,.r...p......%...%...%...()......(+....(....,!r...p......%...%...%...%...().......(,.....,&(....,..r...pr...p.()...(-.....(.....*.(....,.r...p......%...%...()..

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Microsoft.Extensions.DependencyModel.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	81024
Entropy (8bit):	6.208080511670094
Encrypted:	false
SSDEEP:	1536:lJRwgfJbzkoKyMv95Wm5LMo7lRowMfYM9gcLzQtqfSnXzQD:lJn/BwlLtgwMfV9gOQt1XI
MD5:	846A52DE605558912993EDA079B6A7D7
SHA1:	F5944F793EEF7CDA670F572F909B941259A6C56F
SHA-256:	8913B56A0F6E209EBAADABA532865B1EA8D10D73FEC86A1B8F93FE0ED8E0D2B8
SHA-512:	3096ED6A09ACC77110AE290D9B92365A0B7C561A9C56FB1B3D6C092F3CB615A3EFDDF16FB6618CA64279631BB3C3347D230DF08CD84A53DAB1F659CD761EA649
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0..............#... ...@....... ....................................`.................................5#..O....@...................(...`......4"..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................i#......H........j.......................!........................................(-...^.(-......S...%...}....:.(-.....}....:.(-.....}....:.(-.....}....:.(-.....}.....-..(......s....z.~.......0..........(....,....(.....o/......&......................0...........(.......(0...-..,....(....,.r...p......%...%...(1.....(2....(....,.r...p......%...%...%...(1......(3....(....,!r...p......%...%...%...%...(1.......(4.....,&(....,..r...pr...p.(1...(5.....(6.....(....,.r..

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Microsoft.Extensions.Logging.Abstractions.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	64120
Entropy (8bit):	6.254324434427211
Encrypted:	false
SSDEEP:	1536:M5PhAi33m3UOZsd4IZnuQDLtfjfCqfZwzl:gPhAi33mhZiHlvtbfCmwJ
MD5:	5127DDC4377A4FEC97EAC8E991477D00
SHA1:	EB1C84DA67D382390397E30FE801A38944BCF48C
SHA-256:	B4BF70C7E2AA5EA0090E13817B895339259CC435DD16D8BD32CE4EBD85DE4A3C
SHA-512:	86904AC640009CD7F11C1694E3CCB96F482CABB7A098498E9A76F84FB87060B01C6E7D1F73CD8451F031DD4A88DD802B715C337D58FB47B1F1CEBABE4DC735A9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...S............." ..0.................. ........... .......................@............`.....................................O.......................x(... ..........T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................H.......PO..............X.................................................()...^.()......N...%...}....:.().....}....:.().....}....:.().....}....:.().....}.....-..(......s...z.~.......0..........(....,....(.....o+......&.................!....0...........(.......(,...-..,....(....,.r...p......%...%...(-.....(.....(....,.r...p......%...%...%...(-......(/....(....,!r...p......%...%...%...%...(-.......(0.....,&(....,..r...pr...p.(-...(1.....(2....*.(....,.r..

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Microsoft.Extensions.Logging.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	48248
Entropy (8bit):	6.365550163252064
Encrypted:	false
SSDEEP:	768:N7d427HfKy1DQ+SKKKKzqPo6Zkn2qZKqLzZdd0UFxgofYyxLVNe9z:N7d42LfKy3SKKKKr8keqBdd0UFHfFnNW
MD5:	3F6480B7C509FC21AAF73C32B9FF7AA8
SHA1:	C623BA7AAF28DFE6B54FC0AD43C6EBA912C6B336
SHA-256:	6833A9076B9A4BB4195C87CDAC7CCF4B99B86D1FC848A08E074D668D1E03530E
SHA-512:	D8CE36217497231FACAA58FD66C560DE785521C86B04233DE20D7D25446C74D9D75504D24F5F691058773CBA62381FFA2EB66F2254CAECA3287D883888E80586
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....H..........." ..0.............Z.... ........... ....................................`.....................................O.......(...............x(..............T............................................ ............... ..H............text...`.... ...................... ..`.rsrc...(...........................@..@.reloc..............................@..B................9.......H.......\?...d...........................................................('...^.('......W...%...}....:.('.....}....:.('.....}....:.('.....}....:.('.....}.....-..(......s(...z.~.......0..........(....,....(.....o)......&......................0...........(.......(...-..,....(....,.r...p......%...%...(+.....(,....(....,.r...p......%...%...%...(+......(-....(....,!r...p......%...%...%...%...(+.......(......,&(....,..r...pr...p.(+...(/.....(0....*.(....,.r..

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Microsoft.Extensions.Options.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61560
Entropy (8bit):	6.281459852657229
Encrypted:	false
SSDEEP:	1536:Rg+uxEzzaW2uughzb1GZ90fD/AuJf4rzu:GFmD7XoZ9zuGra
MD5:	2CDE060200F09D54A11200F693D84BC9
SHA1:	F65C6BAA8A36CBB5B28249177FD74FA1279CFD1C
SHA-256:	792765A31E12260BF7AA7630D10E40DD9F2E140FFB5678237A2055266B478112
SHA-512:	7E47B7DEE51B0EB7C2693A0465DE79DCC9380AF377BD6372437F21027DCD00078B9AEAC422794EF294B9FDDB1148D55E0622E10D076797C43D0E2034834B03FE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...YE............" ..0.................. ........... ....................... ............`.....................................O.......H...............x(..............T............................................ ............... ..H............text....... ...................... ..`.rsrc...H...........................@..@.reloc..............................@..B........................H.......\|F......................$.........................................('...^.('......G...%...}....:.('.....}....:.('.....}....:.('.....}....:.('.....}.....-..(......s(...z.~.......0..........(....,....(.....o)......&......................0...........(.......(...-..,....(....,.r...p......%...%...(+.....(,....(....,.r...p......%...%...%...(+......(-....(....,!r...p......%...%...%...%...(+.......(......,&(....,..r...pr...p.(+...(/.....(0....*.(....,.r..

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Microsoft.Extensions.Primitives.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	42624
Entropy (8bit):	6.321725998886621
Encrypted:	false
SSDEEP:	768:kKsIwjxNp8hpwVeEfHuX1QUIh3kOP7oIyWb3jec/uiCR9Crwuuo0NChOQ69zO:0d8hMfHuXbIkOP7ym3jZ/uiCRgrAo0Ji
MD5:	3BA07A6760BE077504734E9C0BE0CCE3
SHA1:	A51ACEA6A9183D6C73DCEDB5B0536F2A5EFD5F43
SHA-256:	8578454489A439D5DEBD8A8CA9844B3B38076563EAF195CC5ED4BD27A8C54EA3
SHA-512:	1E3AB31B03826F634271246505F72FA4CD16EB0E23CA71BCA1EB5A398A3229DF6BFE87EB1B6A30EA2E0379E33D1F2AF951F178F950C0A520B07740AB11C8B0BA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...U.:..........." ..0..r............... ........... ....................................`................................./...O.......l............~...(..........8...T............................................ ............... ..H............text....q... ...r.................. ..`.rsrc...l............t..............@..@.reloc...............\|..............@..B................c.......H........:...O............................................................(-...^.(-......G...%...}....:.(-.....}....:.(-.....}....:.(-.....}....:.(-.....}.....~......0..........(....,....(.....o.......&......................0...........(.......(/...-..,....(....,.r...p......%...%...(0.....(1....(....,.r...p......%...%...%...(0......(2....(....,!r...p......%...%...%...%...(0.......(3.....,&(....,..r...pr...p.(0...(4.....(5.....(....,.r...p......%...%...(0..

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Microsoft.Xaml.Behaviors.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	145792
Entropy (8bit):	6.078227534820025
Encrypted:	false
SSDEEP:	3072:+XQg6pDJRt4v4VMvlat1dLXTrGmAJ5ryjTT:YQD1JRtigRGG
MD5:	A10C6F9556DFCCCA0DB08B9EF2E86C4B
SHA1:	E34DEDF472F32AC21306E5673D34DD2EC0DEAC15
SHA-256:	0493049FEBB4BE74BDF669AD7FA754941C2754FE33421E230A8F14C8FD06C8C4
SHA-512:	8128BC268C5A62CEC0EAF3BCB22B93E017F2A1D60808476A1C437EBDB6494EBFE898AC24DFBD620B525ED9B26BF81A8B7EBCFEA26DABBEAF18FBF5538AA160E1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..............." ..0................. ...@....... ...............................I....`..................................)..O....@...................#...`.......(..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H.......`....C..............8...P(......................................V!.7.U....s0........6.(1....{2.....(3.......4...s5...o6....s7...}8.......0..F........(9....{8...o:.....,0..+#..(;.........{8....o<........3...X...(9...2...{8....o=...,/(>...(v........(?...o@....(A...o@...(B...sC...z....0...........oD.....E............].......Y....oE...o'....+0.o%...........(F.....oG......{8.....(H....oI.....o"...-......u(.....,..o!.....oJ...o'....+#.o%.............oK....{8.....oL.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\MwacLib.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4563976
Entropy (8bit):	6.519146625309904
Encrypted:	false
SSDEEP:	49152:7rmX5tTjjRs5hQNtAxbFWQAiSAE8iCwkv5G67ocY6K9IFuOh5PHk04rVgwTjWyPt:rmQN0uqrVkc1D5O
MD5:	0655D1301293766BD2D1145BF48BB178
SHA1:	8B38ACA85251048CD4E7159940A42A64E5784A9D
SHA-256:	B0DD307627A3165FAB2A493FA83755D0B9B821C01CC08972D48C0AA39B0DDDEF
SHA-512:	FD9528AF0D26589F5A401A9DBB8201E932D7D924AF74DFD3B7F1886D07D38FDE9FD2B1A9712E6AE87585531954032292EB7D49188F47B3147CA05E835B314ACD
Malicious:	false
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$..........B..............\|.......z.=.....y.....oQ........\|.......z.......{.......{.......{.......z.......~.(.....~.....X.v.....X.......X...............X.}.....Rich............PE..d......e.........." ......&...........".......................................D......:F...`.........................................@/8.x....68.......;.0.....9.......D...... D.......4.p.....................4.(.....4...............&.X............................text...>.&.......&................. ..`.rdata..V.....&.......&.............@..@.data....;...`8......J8.............@....pdata........9.......9.............@..@.rsrc...0.....;.......;.............@..@.reloc....... D.......C.............@..B........................................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\PoliciesControllerImpl.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4394648
Entropy (8bit):	6.521996753419791
Encrypted:	false
SSDEEP:	49152:bQbh+BnQCImbMogKJ2D17GK9q89ZK12sRGGSFCBhJOUD3vlNgJrt8PsZtKUZmyPJ:m85I/jd8EBuJOevlNgBtwFI39t+xg
MD5:	2C3A623BC7035FF473BA7118AFE1B1EB
SHA1:	FC63DC1ED60A79BC6D4C69D2C7AAD5B8D0999421
SHA-256:	8D502EB7C1F76CC5210029B011F52A6F4D86DCA1DAD91DC5FECB5870D2E9182B
SHA-512:	33BF3593DAD88E0AD123105E42F41E51FEF6282E96524BE9BAC212856F654C229E931FC25FA06048125B94A8CEA49D2C09A0BDA4C2BB4BA03B6D2036BC64244F
Malicious:	false
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$..........jW..9W..9W..9...8P..9...8...9W..9V..9...8V..9Qw.8F..9Qw.8E..9Qw.8...9...8H..9nv.8b..99w.8w..99w.8L..9W..9...9...8p..99w.8...99w.8V..99w=9V..9W.U9V..99w.8V..9RichW..9........PE..d......e.........." ...&.L,.........\|}%...................................... B......mC...`..........................................}=......=.T.....A......P?.8....\|A.......A.......9.p.....................9.(...@.9.@............`,.0............................text....K,......L,................. ..`.rdata..lM...`,..N...P,.............@..@.data........=.......=.............@....pdata..8....P?.......>.............@..@_RDATA.......pA.......@.............@..@.rsrc.........A.......@.............@..@.reloc........A.......@.............@..B........................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Prism.Container.Extensions.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21088
Entropy (8bit):	6.199919980067835
Encrypted:	false
SSDEEP:	384:h8z2AKJxYjp8LXg0uHPF+jCZSZmZPSUPo2/VlhC9:h8z2AoYN3vF+jqSUPoAlhC9
MD5:	7C761CE50753F23707B12774D6191482
SHA1:	2A6367003777F077C2B0969E0454BC4DE7B0757A
SHA-256:	85A55B97F20431FCF6D33634DE6A86D7C6D441BE413C728E19DDA8B0AEF72E92
SHA-512:	CC0DC04D17316A816553BAC6092F124310C3FCB3C131EE9421BC6581710493233E7004D07BC097A9CAA818D3B0C1320135D6562794D9520C207FBE6DD2F4F559
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.............H... ...`....... ..............................4.....`.................................oH..O....`...............4..`............G..T............................................ ............... ..H............text....(... ..................... ..`.rsrc........`.......,..............@..@.reloc...............2..............@..B.................H......H.......D&..<!............................................................(....^.(......./...%...}....:.(......}....V!.O.......s.............0..........u......,...o....&+.s.......o......(.......(.......0..6...........(.....u!.....-..s......+....(...+-...(...+&.(...+...0..=........o.....8....s.......o....}.....{....o......E................8.....{....o ....(!...,"..{....o"....{....o ...o#...&8.....{....o$...,"..{....o"....{....o$...o%...&8.....{....o&...9p.....{....o"..

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Prism.DryIoc.Wpf.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	27232
Entropy (8bit):	6.257783619442787
Encrypted:	false
SSDEEP:	384:j6Xd47wSthuCfI0xlid20I3W7xrgfScZSZmZPtU91C/SyIpMehV:8d4sAuCfDxd16ZQSYtG1npKehV
MD5:	BD3F6009FC2B6A04BB3401C0158A2868
SHA1:	62AEB021C1FD18DD4BEE4E3C6947571738582819
SHA-256:	AD1666C83F2554B09396386FCEC856F9B3068B9BC2A29F13C08D3CE0C23D7D4F
SHA-512:	83E4ED6FF4351056C2003D776CB15916F280F1CD3AA4C6AE6E4CF982C0B69E21C1AD3C08D0EE4B3FBF7861F9B231F5DDB8735A037EE7BEB76C1AC485FE49450D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Q..........." ..0..@...........]... ...`....... ..............................i.....`..................................]..O....`..`............J..` ...........\..T............................................ ............... ..H............text....>... ...@.................. ..`.rsrc...`....`.......B..............@..@.reloc...............H..............@..B.................]......H........)...............X..0...L\......................................V!....&....s..........(....J.o.....s....s....B.8...(....( .....(!....(....J.o.....s....s....B.8...(....( .....("....~#....~$...o%...~&......('....o(...o)...o...o+...(,...o-.....{....J.(.....s....(........0..T........(......}.....(..........%......(.....%.."...(.................(/....8...(....( .....{........0...........(.................(0....^.(.......s1.....(0.......0.. ........(......

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Prism.Wpf.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	135264
Entropy (8bit):	6.06518083719373
Encrypted:	false
SSDEEP:	3072:ifxD31bs6W5SVEcJ8+s8ggRwfEQwwzOfzH3mgQ:ift31RVVRs8g5wwzOfz0
MD5:	7A103C5BDE44976AD0627443AF2E1A4B
SHA1:	55E4BB694CCA644846BD4A39782D76D9B4996480
SHA-256:	C3B44B118486A5D74D696C14853E5306EC893DADD0BE8EA6F404EDAE8C66F2D3
SHA-512:	8CA0142F855F776CD610C5E9E6ED46BAE8D980DEFF2A8916C8FB4356D516D1F0D9B8C0114F456740402F1DE1EA55C5EB4F797BB04F00196C7A647FE212E50836
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.................. ........... .......................@............`.................................M...O.......................` ... ......\|...T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................H...........T;..........T...."..........................................V!....&....s&...........0..I........-.r...ps'...z.-.r...ps'...z.o(....+..o)......o....o+...-....,..o,..............#..=.........(-........{....:..(.....(....N.o.....o.....o.....()......0...........%......s/...(0....(1...}......o....}......{....o......{....o.....{....o2.....{....o.....{....(...+...o.....{....(...+...o.....o.....o......,#.(......{....(...+(g...(m.....o.....o.....s....6..{....(*...

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Prism.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	91232
Entropy (8bit):	6.107663137944109
Encrypted:	false
SSDEEP:	1536:eH8fhOdBanbA/0soPhaECCcCxGVSCC+5rgnCnS+6j+DZORL0SSeVEEkqYyg1H:G8Z8MbwaCCcCxGVSCCFCnS+94LNSCYR
MD5:	0877A419AFC7306CFA2D301E314F0548
SHA1:	BA76AFB78636546C5DD73162BBA7A98AE3B34724
SHA-256:	92090C9C3C5195149885BE91AA469B85D2CBA9A215CB3BFB65E93945F33D852B
SHA-512:	5E3AC30005F4FDEE8F85D2A632415BEF7A9722ADD4CFC59745DA9A41E87CF79E5C62A0C2FB52B79381495BE94F7B7D0EC3A455F0F112E7B0BDAF63D6B46C6BD1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..8..........jV... ...`....... ....................................`..................................V..O....`...............D..` ..........TU..T............................................ ............... ..H............text...p6... ...8.................. ..`.rsrc........`.......:..............@..@.reloc...............B..............@..B................JV......H........l..,...........$E.......T......................................V!....&....s5...........(6...,.r...ps7...z~.....o8...-.~.....o9...2~.....o8.......0..#..........-...+..(....,..o:....+...&.......................0..3.......~.....o;...o8......o:...,.~.....o:...o;...o8.....`.s<............(........(........(........(........(.......0..C.........(=...}h......}i......}k......}l......}j......}g.....\|h.....(...+....(...+....(...+....(...+....(...+**....

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\QRCoder.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	171344
Entropy (8bit):	6.205291326607056
Encrypted:	false
SSDEEP:	3072:/xyL28tgLwBdPsbo7jG4T3YrA7hfjF0xQfOWIkHY+2otnMv9R:/utUEj+A7hbIkHHQ7
MD5:	4A1FEEB790912A9769BB6B96199F83C4
SHA1:	CB69EA3AFE7D672236C2ACAF9A19743F8F6EBE07
SHA-256:	0CB5BC9567F4A7703EA24F080C2B826993791C2AAD549E15A3B45ABF9FA86794
SHA-512:	9C9302AEAC1C15ABBA41F820D3CF9FD2F4E42E0A938DF63B9F5F4B7B7616A382207A791F79003C00F15D7E9CC43BE4DB499C7F95C92D4C5D5F2B22C68845A79D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..,...........'... ...`....... ..............................k}....`.................................k'..O....`...............6..Pg...........&..T............................................ ............... ..H............text...\+... ...,.................. ..`.rsrc........`......................@..@.reloc...............4..............@..B.................'......H.......4....F...................&........................................{......{....V.(......}......}.......0..A........u........4.,/(.....{.....{....o....,.(.....{.....{....o....... R..0 )UU.Z(.....{....o ...X )UU.Z(.....{....o!...X...0..b........r...p......%..{.......%q.........-.&.+.......o"....%..{.......%q.........-.&.+.......o"....(#.....{...."..}......(....:.(......(...."..(....f.(....%-.&+.(`.....(......(...."..(.......0..%.........($...(%...(&....#.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\RTPControllerImpl.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4558504
Entropy (8bit):	6.502237006139993
Encrypted:	false
SSDEEP:	49152:5NjUH3cEKTf9pfjh+koyLY+LHtZ92bEV95y/Iqo6yeJ25qT+bA32BQ0cO2BH13Fi:4wy/4g91sWMl1KH4
MD5:	D7EED51C5BDCFEB6690D68BF2AA55D86
SHA1:	609F167ADDF7BAC3CC64AB14FAF5DA146D33A01C
SHA-256:	A5287742D0BE41B16EEAFC81ECBB108899BC05D879FEDB92E9501A261232A307
SHA-512:	A9B05997AE74F4396CC5A3EB24767DAC0B4DACD92E852FF5B42EDB6BE20D97F72428FFD7CB23E33D86951AEF1A2238C743DF2E3D2115556074652C5D590BAAF1
Malicious:	false
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......^.R...<...<...<.Q.?...<.Q.9...<...<...<..S8...<..S?...<..S9.B.<.Q.8.:.<...=...<.Q.=.7.<.tS8...<.tS9.z.<.tS5...<.tS<...<.tS...<......<.tS>...<.Rich..<.................PE..d......e.........." ...&."-..*......D]........................................D......~F...`.........................................0.@.......@.......D.......B.T.....C.......D.$...@.;.p.....................;.(.....;.@............@-..............................text....!-......"-................. ..`.rdata.......@-......&-.............@..@.data.......P@..`...(@.............@....pdata..T.....B.......A.............@..@_RDATA........C......dC.............@..@.rsrc.........D......fC.............@..@.reloc..$.....D......lC.............@..B................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\SPControllerImpl.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3013928
Entropy (8bit):	6.521614342181038
Encrypted:	false
SSDEEP:	49152:y3SoiqB8FhUFLxdEhMd6DOn6BlSMoDPB+ukdPNGqcbop0w0G:+7qSM6PBEWqc8V
MD5:	A1C9F05A07F9D6C1A18BB49F8558D129
SHA1:	F8D85A98C64C33A9578CB3ACCF131AE8C0BA0B62
SHA-256:	094A7AEF14A5C4FF510605AAFDDCF928847A48C408EB5C68E7817984C7B70E37
SHA-512:	AC92530232B1AC46F67A7D7B5F111F0C83D1FC74A934787E7A696CD7BB0149AD2539DCDDE9E92D5D30568A51A6E7581C68FF8FA274ABD8B2BA8E2D56043BA72B
Malicious:	false
Preview:	MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$.......aR..%3..%3..%3..nK.."3..nK...3..%3..$3..#...43..#...73..#...}3..nK..;3.......2..K...03..K...E3..%3...2..nK...3..K...f3..K...$3..K.].$3..%35.$3..K...$3..Rich%3..........................PE..d....W.e.........." ...&.X..........P........................................`-......[....`..........................................Z......_.T.....,.X....p+.._....,.(5....,..f..p#(.p....................%(.(...0"(.@............p...............................text....W.......X.................. ..`.rdata..t....p.......\..............@..@.data...............l.............@....pdata..._...p+..`....*.............@..@_RDATA........,......X,.............@..@.rsrc...X.....,......Z,.............@..@.reloc...f....,..h...`,.............@..B................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\SQLitePCLRaw.batteries_v2.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	30336
Entropy (8bit):	7.319925711420022
Encrypted:	false
SSDEEP:	768:qfzycePnw+EFiRDwtU+Y7N2Ip47EFiRHY:qfzWJei1wto7Q97ei+
MD5:	BC9B875719B1187F21BCAF9C53F1507D
SHA1:	D541BEBAC463C7363CA6CB5070CCD809543221B9
SHA-256:	D0B3C4D4DF9B29E2CB77A4F307A6E5D325BB5572F4CEE71E006904F0D64848BB
SHA-512:	CD40B99ACD288D7BB54063340AA2AF1E8637AF56A169CF9715E4D8D213B730CC17E579C913BE4C6183A8893FF19887FA5F8438D9D8E6131917949D966C02A309
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t.G..........." ..0..............)... ...@....... ....................................`.................................{)..O....@..`................b...`......\(..T............................................ ............... ..H............text........ ...................... ..`.rsrc...`....@......................@..@.reloc.......`......................@..B.................)......H.......d ..x....................'.......................................(.....s....(.....BSJB............v4.0.30319......l.......#~..L.......#Strings............#US.........#GUID.......`...#Blob...........G..........3................................................6.m.....m...s.Z...............q...........V.............................Y...........8.1.....1.....1.....(...............1.9...........1.9.....P ............W ..............T.....T.....T...).T...1.T...9.T...A.T...

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\SQLitePCLRaw.core.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	76312
Entropy (8bit):	6.642852712116508
Encrypted:	false
SSDEEP:	1536:pLTtyXEQ3+bO6U+RlrPi1NLsFozPeiXVto7Q9Qeid:BRtHliMDA4
MD5:	1ED2B0FD916CE99A8D8EC5633F48657C
SHA1:	101C6731EE33E83086058C0257E55F1AF3A38630
SHA-256:	ABEFB869F01B6C738005A7D4886E3377FEB53D3A1C35997175E588F8F34C49DD
SHA-512:	EA499B6720FC8C7112B7EAD57C76208FBB2B5F17796B9D1743A46FE37B292B11D89ACB6B47ADD605B85E027999E9667219E43901AE45AC22D6C8F9771468A87F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....=..........." ..0.................. ........... ....................... ............`.....................................O.......0................d..............T............................................ ............... ..H............text........ ...................... ..`.rsrc...0...........................@..@.reloc..............................@..B........................H.......@@..<...........\|.................................................(......(......(...........Z~....,..oB...&.............b~....-.r...ps....z~.....(#...o8....0..........(#......o9.....(....Q6.(.....(%....0..........(#........o:.....(....QR.(.......(....('...:(#......o?...N.(.....(.....()...2(#....o;...2(#....o<.....o......o....2(#....o=...2(#....o>...6(#.....o.......0..........s"......}"....{"...-...+....#...s.......(1...6(#.....o....6..(....(3..

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\SQLitePCLRaw.provider.e_sqlcipher.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	62376
Entropy (8bit):	6.742057788007394
Encrypted:	false
SSDEEP:	1536:Vlg6P8yGn6Pe/x9JBZTZa1ztoIeiKto7Q9ueid:ftG62dBa8vZu
MD5:	6E832712159E334C9C33029B4B0E03E9
SHA1:	89E476F0B079C08741FCEB6A793DD79C79C03E25
SHA-256:	7E86073EB5A52E0CFD45EE8B2EA89AF624244277E4A296D37797244788E38F21
SHA-512:	6F463214E2CD27863D21E2F8F97EAB56DFF84E76A88DBBF91EC502B7ED181D89F454B1F3E3E7DA85AF2F64C52F00B68BC43567E046B453E22FB9970882E5D650
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.............&.... ........... ...............................z....`....................................O........................c..............T............................................ ............... ..H............text...,.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........3..`n..................(........................................r...p2...(.......N........s....o...+.0............(..........(9.....0............(........(........0............(.........(...........(.......0..>.........(.........(........(...........(....(.........{.......o>.....(......(......(...."..(....&...(......(......(....>.(.......o........0..I........,...........s.....+.......s.......(.............(.......(.........o........0............(.....

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\SQLitePCLRaw.provider.e_sqlite3.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61864
Entropy (8bit):	6.753869902208935
Encrypted:	false
SSDEEP:	1536:4+FQ3E9uoFc2npPI/3ehBJTZENz5eixZto7Q9HeiBI:15pQkBzEiPt
MD5:	5AF5F62C73B9D946469E53B746FAC3A3
SHA1:	AF7FBD992EF93D3BE0B9CC65972CB6E061B32012
SHA-256:	0C2214657A297982A5C9AE179465FDF928749C37AEF07531F4E7D94EE41B6DD1
SHA-512:	5912750439A036A2E860CB1F987E468C4650767B5D3FA95FB788035D9A3235D89761038FD9C8FB499E5EAEDDCF2987A9487D57AA78745C43A1F5DEB83C807E3C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...il..........." ..0.................. ........... ....................................`.................................9...O........................c..............T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B................m.......H........3..xm...........................................................r...p2...(.......N........s....o...+.0............(..........(5.....0............(........(........0............(.........(...........(.......0..>.........(.........(........(...........(....(.........{.......o:.....(......(......(...."..(....&...(......(......(....>.(.......o........0..I........,...........s.....+.......s.......(.............(.......(.........o........0............(.....

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\ScanControllerImpl.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5302080
Entropy (8bit):	6.456130763768141
Encrypted:	false
SSDEEP:	98304:wcUnfyU4MYOFGCxfdEgg4dl56RQD+NTky+nWl65nufuE:wCkiTf+nWw5nGV
MD5:	8999CAC6423C171FD38EFCA2F18C78E4
SHA1:	938663DC4EE52F39899B33421D02EDFC329221D0
SHA-256:	9A0948C129EFCDD80F422F4D0750179326B8420A4F3858C4C9FF84D5B0D5E267
SHA-512:	50B39D78E9CA92F75235DC8193C1BDFCD41A7DA87D0831185ACA69EEDAD3425A1E840A03FC983B2D109E5CC1514C38DF3153EBA8A10BF25A7882EF215A952A1F
Malicious:	false
Preview:	MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$............x..x..x..{..x..}.(.x..x..x.....x..~..x...\|...x...{...x...}..x..\|..x...\|...x..\|..x..}..x..y.@.x..y..x..q.u.x..x..x.....x.....x..z..x.Rich.x.................PE..d......e.........." ...&..4..........#........................................O......9Q...`...........................................J.`'..`.J......0O.......M.......O.@....@O.....@~E.p.....................E.(....}E.@.............5.H............................text.....4.......4................. ..`.rdata..\.....5.......4.............@..@.data.........K..~....J.............@....pdata........M......pL.............@..@_RDATA....... O.......N.............@..@.rsrc........0O.......N.............@..@.reloc.......@O.......N.............@..B........................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\SelfProtectionSdk.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3123968
Entropy (8bit):	6.598244435790604
Encrypted:	false
SSDEEP:	49152:HEAr99DdYlu8JhjPDCu09nBPhrVB7J5HqyzBsdPTNqoTKOoQU9T4:F9I0RrfHqqujqogbK
MD5:	2C1F472970F5FDEF733540F6BB1359B6
SHA1:	1E746BD398F7D3EEB249550B49CE1F78BF18E081
SHA-256:	386251AB42325CCFEDB3DBB993ADB7598D0FC5A9C0C13D4B94B7C13E6399E013
SHA-512:	0CE8E62B77CCE8CA3F1C9F8503B7BBB3899A6AC93E1538B37D51DCF38EF77B454ECA872A922F1D1E5DCAE4849E828E197D44A268F17A7D318DD011D9724A1C19
Malicious:	false
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.........o..<..<..<..=..<..=E.<..<..<.H.=..<.H.=..<.H.=..<..=..<.I.={.<.H.=..<.H.=..<..<5.<..=..<.H.=..<.H.=..<.Ht<..<...<..<.H.=..<Rich..<........PE..d...,].e.........." ...&.T...p......X........................................./.....[b0...`..........................................j&......n&.\|.....(.H....p'..6...n...=......._.. .$.p.....................$.(.....$.@............p...............................text....R.......T.................. ..`.rdata... ...p..."...X..............@..@.data.........&..v...z&.............@....pdata...6...p'..8....&.............@..@_RDATA........(......((.............@..@.rsrc...H.....(......*(.............@..@.reloc..._.......`..................@..B................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\SelfProtectionShim.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2591424
Entropy (8bit):	6.544285533082506
Encrypted:	false
SSDEEP:	49152:8hDLZ1DyMM2AhQMmzcwUho1B7yY9ipHzSrVdPvtLlr:6OJoR9+HOhFtLF
MD5:	52E5B30CC9E1E75A3CF410FF6FF4E601
SHA1:	6E0F4B1FF74D624F0E5D400FC3A264047E91D99F
SHA-256:	7B0F89D9BBBA21BE67CB494DE5D52A4E4968DB62CCA3E33AC4EC50B62CF7E615
SHA-512:	7E12A06C89979FE7A55D1776178107D7679F98C4FE74C2F75F8A2B37987E721DCA9EF89BF0E944CDB7CBB27C4F895B7395BDC5C00346B2CBCE9B3962F50A8E50
Malicious:	false
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$..........N...N...N.......I..........N...O...H;......H;.._...H;..\.......P...w:..... ;..[... ;......N..........i... ;..w... ;..O... ;?.O...N.W.O... ;..O...RichN...................PE..d....].e.........." ...&............d.........................................'.......'...`..........................................d$......i$.,.....&.`....P%.4%...r&.......&..^....".p.....................".(...p.".@............... ............................text............................... ..`.rdata..............................@..@.data.........$..j...z$.............@....pdata..4%...P%..&....$.............@..@_RDATA........&.......&.............@..@.rsrc...`.....&.......&.............@..@.reloc...^....&..`....&.............@..B........................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Sentry.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	608824
Entropy (8bit):	5.890084036546713
Encrypted:	false
SSDEEP:	6144:m/oNAsjsen898SrhV/rtUiiG8CLMqVKXkWK2f/jEwPOxXBVqKqKqNJkdsfX1NoWi:LAy8xVGGDMzd+qKqKqNKifPAVNV
MD5:	2B943CF0FA6D275AE086F15BEDDED27E
SHA1:	DBEDA3D6FA7115B1BC5023394009AAD7921F7B95
SHA-256:	31BBB6CE9F9C4E95D2E2CB08F42AC5735DD9B83D6A5A356D07FD9F0660C6AABC
SHA-512:	888152C63306D2F8974C7F4407530287F27390ED6D2D6E9165EB631E201B53B06219D43AF5C400ED39E854F87733A07EB2C7F296B68C198BFD62C2CB31180035
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....w..........." ..0.............z.... ........... .......................@............`.................................'...O.......................8v... ......h...T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B................[.......H.......h....5............................................................{N.....{O.....{P...r.(Q.....}N.....}O.....}P.......0..Y........uF.......L.,G(R....{N....{N...oS...,/(T....{O....{O...oU...,.(V....{P....{P...oW.........0..K....... .F.. )UU.Z(R....{N...oX...X )UU.Z(T....{O...oY...X )UU.Z(V....{P...oZ...X..0...........r...p......%..{N......%qJ....J...-.&.+...J...o[....%..{O......%qK....K...-.&.+...K...o[....%..{P......%qL....L...-.&.+...L...o[....(\.....(]...^.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Serilog.Enrichers.Process.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	31872
Entropy (8bit):	7.225284018446282
Encrypted:	false
SSDEEP:	768:SLg8qDIzpzycCnEFiRjv4tU+Y7N2Ip4KEFiRIW:SUOzpzQneixv4to7Q9Keit
MD5:	8F1CC9E9F382B5318CA1FB26EBDED71E
SHA1:	A980C25096F2F401E6B2881BC445646018A6FD24
SHA-256:	783BA7EEE0DAF92D76F41FA06453CD24AD78EA9A547FD23B6E0059039BA0F0ED
SHA-512:	6813FD804F73E2220C434709F7F0531A95C3A8AA3E70B8A2AA27FCF5C89218D1484AEFDDD72B3911150D56011E25A0B891538BD54188359016F8DDDF7D84330B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...[`............" ..0.............~.... ...@....... ...............................H....`.................................)...O....@...................b...`......<-..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................].......H.......`!..\....................,......................................V.-.r...ps....z.o...+V.-.r...ps....z.o...+...{....%-.&.r1..p(..........o....}......{....o.....0..........(......o........,..o.........................(.......{....%-.&.rE..p(.....o....}......{....o......0..........(......o........,..o.........................(....BSJB............v4.0.30319......l...,...#~..........#Strings.... ...`...#US.........#GUID...........#Blob...........W..........3........

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Serilog.Enrichers.Thread.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	31360
Entropy (8bit):	7.254421836955249
Encrypted:	false
SSDEEP:	384:gJL5sS+sS5oQzWcbxiGoGCJEF8ZpHWqDjDTIrj0DLhDLI+Y7h7X2Ip40GoGCJEF0:qGzycAEFiRNjXtU+Y7N2Ip4mEFiRP
MD5:	56870358416BFFAC54902EA9B4BDAF8F
SHA1:	461282DA6A749F52CFDD09246293AA1AFE78B443
SHA-256:	968AA7B9A98CD2510DA22227B2D2D4EE4F54FBFCB5BA91BDD53FFDFFBBB047DC
SHA-512:	5A29F75F238EBA8B8B3973D74B3B2A38DE898543FCDCA479A3020D2D6F7829F151F5F0197C29DF42380769E1EA9FF85408952C5C705C6A2C269EA27BC339A87A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.............J-... ...@....... ....................................@..................................,..O....@..L................b...`.......+..T............................................ ............... ..H............text...P.... ...................... ..`.rsrc...L....@......................@..@.reloc.......`......................@..B................)-......H........ ......................h+......................................V.-.r...ps....z.o...+V.-.r...ps....z.o...+..r1..p(.........s....s....o......(........0..%.......(....o......,..rC..p.s....s....o......(.......BSJB............v4.0.30319......l.......#~..h...`...#Strings........\...#US.$.......#GUID...4...P...#Blob...........W..........3..............................................................}...........x.....x.....x.....e.................O.........Z.....y.....

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Serilog.Extensions.Logging.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	42744
Entropy (8bit):	7.014533760067688
Encrypted:	false
SSDEEP:	768:PSCZUl2O1zCnXyzDHzycqEFiRntU+Y7N2Ip4QEFiRLh:KCK9SyzDHzkeitto7Q9Qeiph
MD5:	EBDDBB02002E8B520034587370ACC76D
SHA1:	A105DC73A486790D00DAC5628B312F2997C38A14
SHA-256:	E9F09ED4C81B9C97537238CAF5AC320B2DA609B15DE4E67A2A116A916A65B079
SHA-512:	718BFAA108B043B9A04BEC680746422EFB7197425AF37173187CD90546D7425BAE69E814F989B055CAA5A60B2C7A3F7213AAEE9E8A455BFA6488175981203E40
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....m..........." ..0..:..........vX... ...`....... ...............................h....`................................."X..O....`..h............D...b...........W..T............................................ ............... ..H............text...\|8... ...:.................. ..`.rsrc...h....`.......<..............@..@.reloc...............B..............@..B................VX......H.......H...H(...................V........................................(......(......-.r...ps....z.-.r...ps....z..s......o....v.-.r1..ps....z...s....o........0..V.......s.......}.....-.rA..ps....z.,..o......./...s....(...+&+...{.....s....(....&...(...+&....0...........-.rQ..ps....z.o.... ....1..{.....o.....{.....o....t......,...{.....o......{..........(.....{....o.... ....3..{....o ....{......o!......,..("..............U.4.........s#...}.....s$...}.....s%...}.....(

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Serilog.Sinks.File.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	56672
Entropy (8bit):	6.767961492223997
Encrypted:	false
SSDEEP:	768:sUqoXsEgfFHoiikZ9y3BHdD+XR/tGo06BAzyceEFiRaitU+Y7N2Ip4UEFiRar:DLrgfPw3mXREaAz8eiLto7Q9UeiQr
MD5:	D42E25B975B47F3DDF0AB614FB114F2A
SHA1:	11DD37379FAD9A74ED896A87059E1D16580F089F
SHA-256:	4D66162D143433CA2AB520BEE560B0912BF5E805CE0A046A00C6A050B833CF9A
SHA-512:	FCBAE025499AAF4B342CAE41D808FC9B24F55F5E50AB8EDE5850A811D85C9EE4FE07E58928C67D7B0B49ADCDC808569956EAD791B771E868CC9342C0A766DA20
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....z..........." ..0..p............... ........... ...................................`....................................O....................z..`c.............T............................................ ............... ..H............text...$n... ...p.................. ..`.rsrc................r..............@..@.reloc...............x..............@..B........................H........<...O..................X.........................................(....^.(.......D...%...}....:.(......}....:.(......}.......0..,.............................................(.....0.............................................(.......0..(.........................................(.....0..&.......................................(.......0..S........-.r...ps....z.-.r%..ps....z.-.r/..ps....z...s ..............................(......0..V........-.r...ps....z.-.rM.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Serilog.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	154304
Entropy (8bit):	6.375749372129313
Encrypted:	false
SSDEEP:	3072:jobKO7RaoWuUeZk/f0Sh1HlWZm1ZZTdyGFkNUMT+P65jDtIna:UbKKz1UeZk/Phv8lDuPaz
MD5:	6866B282735136949D35C91DAA26CD22
SHA1:	12407961A4BADFB662B2605D1D60D3F5AC2A311C
SHA-256:	7079CCE46C1AEB34DE1D5E67E4F06D1442A02E455EDE286BC80188EEE2E1CB1C
SHA-512:	D038A7702FBFF9FD25CB05FEA79A5931C2B02BA93C8F09E3050F639BCCE95AC6511D136AEC579D6D64B271FF264861050F15ECCB061CDFBFD8A43D636D11F05A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....\..........." ..0.............6.... ... ....... .......................`............`.....................................O.... ...................f...@..........T............................................ ............... ..H............text...<.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H.......h...0O............................................................{).....{...V.(+.....}).....}......0..;........u......,/(,....{)....{)...o-...,.(.....{....{...o/..... ... )UU.Z(,....{)...o0...X )UU.Z(.....{...o1...X.0..b........r...p......%..{)......%q.........-.&.+.......o2....%..{......%q.........-.&.+.......o2....(3.....{4.....{5...V.(+.....}4.....}5....0..;........u......,/(,....{4....{4...o-...,.(.....{5....{5...o/..... .T.2 )UU.Z(,....{4...o0

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\Swissarmy.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3756600
Entropy (8bit):	6.649543311109135
Encrypted:	false
SSDEEP:	49152:CX56PF5mUe5C+ESJTNMA4TpU7ki9NBmMTM35cn+83FkZdPwtgQFpqyNKMj+fhuK6:3Cn1+MQpc+83AWtgy
MD5:	C83E0CCD9556A6A5942C44B2D41E5192
SHA1:	4199FBBE10004603861C24DE8EBFFAFBF7CC28E7
SHA-256:	0AB5BB50043F3D4C500A65D5ECC716841AC89160B5509F0C847C93E0CE187A41
SHA-512:	18C7E6DFD4F20966913234B4463F8F6934F829CF91879709343AB694E5CE96FAD8615D0B5B0A5609A3BEE1D160C8FF6173FE7DBEE009DC1225D6E3AEB0995B13
Malicious:	false
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$........[...:.Q.:.Q.:.Q.B.P.:.Q.B.Pl:.Q.:.Q.:.Q...P.:.Q...P.:.Q...P.:.Q.B.P.:.Q..P.8.Q.:.Q.;.Q.B.P.:.Q..P.:.Q..P.:.Q..P.:.Q.%Q.:.Q.:MQ.:.Q..P.:.QRich.:.Q........................PE..d.....e.........." ...&.z..........d.........................................8......b9...`.........................................0.(.....@.(.\|.....+..... ..C....7.8h... 8..`..@.&.T.....................&.(.....&.@...............0............................text....x.......z.................. ..`.rdata..^............~..............@..@.data........0).......).............@....pdata...C... ..D....).............@..@_RDATA.......p+....................@..@.rsrc........+....................@..@.reloc...`... 8..b....7.............@..B........................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\SwissarmyShim.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2318976
Entropy (8bit):	6.548212106057069
Encrypted:	false
SSDEEP:	49152:KgFZncWsautHhfk712uK44B7UIZDkdQWSZIVA7y0dPlUTLOtP:d0/jUEk+XjUTCtP
MD5:	E2A94500D8638CEC43EA7804AC28C8DF
SHA1:	8C7C6A76E55CEAB47F0CB5EF7A80935F2FB02E05
SHA-256:	EE996A9F0631CB6253C63122DF4E5FC0AA1026C2A6C6BDB9BB3A11A848102BE7
SHA-512:	8811B7EC4028F0857A9C6D59EE2006CE61634FD08CDCE2DB8CCB78F17ABFD443E0A54977EDB157E06AD321F30004EC6F0AD1D26B93C45B0DE1F3F9D73D19901C
Malicious:	false
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$........z##..Mp..Mp..Mp.cNq..Mp.cHqo.Mp..Mp..Mp..Hq..Mp..Iq..Mp..Nq..Mp.cIq..Mp.Iq..Mp.Hq..Mp..Lp .Mp.cLq..Mp.Dq..Mp.Mq..Mp..p..Mp...p..Mp.Oq..MpRich..Mp........................PE..d...S..e.........." ...&............t.........................................".......#...`........................................... ...... ......p".x....P!......\"......."..Z...G..p....................J..(....F..@............................................text.............................. ..`.rdata..............................@..@.data...t..... ..J.... .............@....pdata.......P!....... .............@..@_RDATA.......`".......!.............@..@.rsrc...x....p".......!.............@..@.reloc...Z...."..\....".............@..B........................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\System.Diagnostics.EventLog.Messages.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	799856
Entropy (8bit):	1.7597847647294211
Encrypted:	false
SSDEEP:	192:g/r3V645uWOL8/pCuPHnhWgN7acW5RjroUEKup3JdqnajvsKyhr:gx6Yi/uPHRN7y/oU7aJdlrsKK
MD5:	6A205C78D14FA91EFCA3AE531D1FF7E8
SHA1:	9E26E81DFDBA74AE261912993DE875D13BB0891C
SHA-256:	6444DFA03609248EFFD398E8562AF484AD0163A6C47CEE6D3A287FFDEF809AD2
SHA-512:	FD797F528519BD9B864394C2A45AFA5C7F94F58D1F2B55E0017987FB521C9F7292DBE1366BE778E60352FA8F9A08C10B7299AEA39DEEEE3A164BB105857FE7ED
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...1.$..........." ..0..............(... ...@....... ..............................Ap....`.................................q(..O....@..l...............p$...`......h'..T............................................ ............... ..H............text........ ...................... ..`.rsrc...l....@......................@..@.reloc.......`......................@..B.................(......H.......P .......................&......................................BSJB............v4.0.30319......l.......#~......,...#Strings............#US.........#GUID...,...l...#Blob......................3..................................z...............\.....0...........-.................C.................[.....x...........D...................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.........................#.....+.....3.,...3.H...3.^...3.t...;.....

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\System.DirectoryServices.AccountManagement.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	275048
Entropy (8bit):	5.994906696792143
Encrypted:	false
SSDEEP:	6144:gw1bMhEqeJUiUd4dhHUgrUEtmKPrl7evN7mG/7C2dtl:gQ5qwuOHDogdjlev5bC8
MD5:	AB6940648A9B3A98AE27D21FCFE19368
SHA1:	B305827C8BF8A227CE089A1E0044621E293EBC99
SHA-256:	64E3C9C8474582853BA151287439A60C9DEC916DCF3DB096C4FE07A10D1EDA3C
SHA-512:	650C1E7641A4287CF3D8962025A36C89549E16456582E69AB8547855B7C0812890C01A720F90FC2491AFD2180541D34795220C2586BA8D56C9C061DB295961CD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....UQ..........." ..0..............!... ...@....... ....................................`.................................=!..O....@..................h$...`......( ..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................q!......H...........`...........0...xR...........................................~......0..........(....,....(.....o6......&......................0...........(.......(7...-..,....(....,.r...p......%...%...(8.....(9....(....,.r...p......%...%...%...(8......(:....(....,!r...p......%...%...%...%...(8.......(;.....,&(....,..r...pr...p.(8...(<.....(=.....(....,.r...p......%...%...(8......(>....(....,.r...p......%...%...%...(8.......(?....(....,"r...p......%...%...%...%..

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\System.DirectoryServices.Protocols.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	139368
Entropy (8bit):	6.121470063950255
Encrypted:	false
SSDEEP:	3072:98PyVelkk/wYhsn7xMR0Zu1IW7nwDEIjcRPipiiId:ukkbU7xMRrIW7pI8z
MD5:	75FF319C6D198CAD99BE299E9625F3EB
SHA1:	B85D5489D512E5073CEF81FD83B80A7A0A335F48
SHA-256:	7A4BC24DE93FBB7FF0F3BD8F10A74E68EA345B29B5C370FA1E31D3B36B9EB187
SHA-512:	0B61333C12C52FAA7AC7E6E4425E97AEA80517976CEACF54E0B09AD82CFAE2CBBD9E34E2012A67539BDC8DBA2ED94BED3610843F05C262F19890EF84E78A4B12
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...\n~..........." ..0.............n.... ... ....... .......................`......mQ....`.....................................O.... ..................h$...@..........T............................................ ............... ..H............text...t.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................M.......H............%..........,...h6............................................(%...^.(%......Z...%...}....:.(%.....}.....~.......0..........(....,....(.....o&......&......................0...........(.......('...-..,....(....,.r...p......%...%...((.....()....(....,.r...p......%...%...%...((......(....(....,!r...p......%...%...%...%...((.......(+.....,&(....,..r...pr...p.((...(,.....(-.....(....,.r...p......%...%...((......(.....(....,.r...p......%...%...%...((

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\System.Management.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	290944
Entropy (8bit):	6.004294024443454
Encrypted:	false
SSDEEP:	6144:HG17jgxtTSfK7JK7XUUmhOzZiRZHhGASipzvZhHcx:HG17jgfefK747ZmhOzZiRZH2wgx
MD5:	83CDA4CC597E6A0B2EBBD1B8F41E94D3
SHA1:	10415FA323A21D412EB36E583A98385088065D61
SHA-256:	AA474C96B9FD17CB3580D89BB8EB716CB1407C89026B5E8180402666EEEB766A
SHA-512:	FF7D869D416E3C47C082B8BD2D6907BBBE457D17D093CD84F66D42B978D143C088E008388041B440B01F7D82E373DDE9B1B5C1ACFD9553F98A63FA579D7EC8D2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....c............" ..0..@...........^... ...`....... ....................................`.................................[^..O....`...............L...$..........x]..T............................................ ............... ..H............text....>... ...@.................. ..`.rsrc........`.......B..............@..@.reloc...............J..............@..B.................^......H.......8&..............H3...)...\.......................................~......0..........(....,....(.....o%......&......................0...........(.......(&...-..,....(....,.r...p......%...%...('.....((....(....,.r...p......%...%...%...('......()....(....,!r...p......%...%...%...%...('.......(.....,&(....,..r...pr...p.('...(+.....(,.....(....,.r...p......%...%...('......(-....(....,.r...p......%...%...%...('.......(....*.(....,"r...p......%...%...%...%..

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\System.ServiceProcess.ServiceController.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61552
Entropy (8bit):	6.263680918942617
Encrypted:	false
SSDEEP:	768:r5tx7Q/QsFvqoEz2SviAC9Kd9OyPo+cbNxwx7uMSAXN92D1Nlt7fM8P:r5tx7gQ50ACapkNix7u6N0p7fMm
MD5:	7F88677A39BB63C3A50D96F3AA1B0E20
SHA1:	53A006B7E31A95163497D3C6F599EBA1070B2FD4
SHA-256:	B5C339CC240E490A996CA5EE526E885AA6EF214614761DE7B7704A4A0D9AAABB
SHA-512:	D81E56636F28DAE8C0FC885F5D9D04A830CA1B385525B09179F654CCBCF2775D59645AD97969EF8B01A9F615061A48DCB3636AD1CE395FF775E46C8DE4527724
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....89..........." ..0.................. ........... ....................... .......+....`.....................................O.......................p$..............T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........L..................8.............................................(%...^.(%......H...%...}....:.(%.....}....:.(%.....}....:.(%.....}....6.~&....('...R.~&....('.....((.....()...~&...(...-..()....s+...(....2.{,...(.....~......0..........(....,....(.....o-......&.................#....0...........(.......(....-..,....(....,.r...p......%...%...(/.....(0....(....,.r...p......%...%...%...(/......(1....(....,!r...p......%...%...%...%...(/.......(2...*..,

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\System.Text.Encodings.Web.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	71312
Entropy (8bit):	6.098338889319964
Encrypted:	false
SSDEEP:	1536:uQuedlunqpC9yYxC9P7tt08eeykGlsESo3ro0Mf9XzFP:93KICHxC9ZJexRsG3rMf9XZ
MD5:	7DD9AE427BE644501ED8DEA4204CE45B
SHA1:	4C0874D5DCEC93568957C5693A1AFAF320D9CDE4
SHA-256:	D2AF18FA9CEC4F826B75649B1AD7FC88A07138ADFDAD986481F11DB11817754E
SHA-512:	FE6BD1439143190CE0E100FAC26588434A14ADDD882760B148AB4F469DB08A75F6E9264D92F63BE1C86688A521A2E1C586FA1B0D7E966FF552934AEEAD263FC6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....n..........."!..0.................. ........@.. .......................`......t=....`.....................................O.... ...................(...@..........T............................................ ............... ..H............text...$.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H............w...........d................................................(....^.(...........%...}....:.(......}....:.(......}....^.(...........%...}....:.(......}........0..E........ ...._.b..._X ....Y..e pp.._.d.X ....X.`.....X(......R...(......d.R....0..K........ ...._.b..._X ....Y..e pp.._.d.X ....X.`.....X(..... ...._.S...(......d.Sf..._....0X....91...X.....~.....0..........(....,....(.....o.......&.....................~~....%-.&.....(....s....%.....*.r...p(.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\System.Text.Json.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	543392
Entropy (8bit):	5.982753168248858
Encrypted:	false
SSDEEP:	6144:x6+HbUMHVgQO61+5ZpvsQ60OghEusa4UQgce0x7KjF76pkLzLFEnJEIfibgPKiUT:x6aRgsgfEU4UDcxkLzJEBsgPKiUYFHu
MD5:	B7BCB19EA0110C433799412DF9AB7C8A
SHA1:	0C39979D5A017E7C46169CC9FBFDDA4448C33FB5
SHA-256:	A6CB476D20369516D882FDD0F318A7FE9EB694C166DC9F2089E99B4C27F17AC7
SHA-512:	234522A56FC47894A8F63A467F7FB7C44285EA490296BFEF893D1AE1533571F312A8BC5E9D586F19E5126C87F23E7BBC993DC04347F996F3A7FD0F19CDD874B3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B............."!..0..............3... ........@.. ....................................`.................................h3..S....@..............."...(...`.......2..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`....... ..............@..B.................3......H...........s...........C...w..H.........................................(....^.(...........%...}....:.(......}....:.(......}....:.(......}....:.(......}.....0..&........(.......(..../.(........(....G* .......0..@.......(.....3'..0Yn.!.~...~...i.?_b...@jY..._.j2....(.... .........B..... ....s.....~.....0..........(....,....(.....o.......&......................(....,.r...p......%...%...(......(.....(....,.r...p......%...%...%...(.......(.....(....,!r...p....

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\TelemetryControllerImpl.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5376736
Entropy (8bit):	6.5051243870632165
Encrypted:	false
SSDEEP:	98304:wZ8lQYo0vo5WPvzTBA0Dt5m54kBkcxG1n:w8lQYdvYkvz1Aet5m5Fly
MD5:	FB8B9D193BA7055C4D14B037ACBD5910
SHA1:	E4CA0C754BFAC2D9A4C74A6280B4C00E4A88064C
SHA-256:	9DFFD1EC3C6C91AED10670E0FD0DDA4CAB0925B75D572CDAC9D08FB39CF8B497
SHA-512:	559B6D14B708BE6F11C880D5498E84AA0C4E6EC89EB27516FEB981BB0D0DC69678F340D4C4C3E9DBFFCC36E6EC9CFD63EF70D4B4B867B23E7DC9FC89F0992062
Malicious:	false
Preview:	MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$.......#..[gk..gk..gk..,...`k..,....k..gk..fk..a...vk..a...uk..a...<k..,...yk..,...ek......2i......\|j..gk...j..,...Nk.......k......fk......fk..gkv.fk......fk..Richgk..........................PE..d......e.........." ...&."8.........p./.......................................P......fR...`...........................................K.......K......0P.......M.Hm...<P......@P......DF.p....................FF.(...pCF.@............@8.P............................text.... 8......"8................. ..`.rdata...}...@8..~...&8.............@..@.data...l.....K..~....K.............@....pdata..Hm....M..n..."M.............@..@_RDATA....... P.......O.............@..@.rsrc........0P.......O.............@..@.reloc.......@P.......O.............@..B................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\UpdateControllerImpl.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4532536
Entropy (8bit):	6.5176691680562
Encrypted:	false
SSDEEP:	49152:uVekPu+ejocutwpOkxpf/x0w78P4p8nst06Mvdxihz93LB2vgt9PRZZgdyPS5SHx:5Xjo8xx5Zx4pVvgtaF5SR
MD5:	CF9814F3FFC913705873BFD16C0C2B5F
SHA1:	B82A2C78C5AE3F5A9E73E9724A5D0AF3615A946B
SHA-256:	C5603B597794CC128058E6BCD6B59267A6579F29F1CEF4931B271E0C423DF18C
SHA-512:	403198166BB66ABDDB3D2CE8629ED4D38FCCEA637532C94CC85A4A4E80EF19C3CE14C2F1E4B5D0AB665FD1CF972499319AB4DE0DD5E4B9ED951914BE434EEEEF
Malicious:	false
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......7oqFs...s...s...8v..t...8v......s...r...u...(...u...b...u...a...8v..m...s.......8v..Z.......&.......h.......8.......r.......r...s...r.......r...Richs...........PE..d...?..e.........." ...&.\|-..t...............................................0D.....".F...`..........................................x?.....<.?.......C......PA.d'....C.8.....C....`.;.p.....................;.(... .;.@.............-..............................text....{-......\|-................. ..`.rdata........-.......-.............@..@.data...d.....?..8....?.............@....pdata..d'...PA..(....@.............@..@_RDATA........C.......B.............@..@.rsrc.........C.......B.............@..@.reloc.......C.......C.............@..B........................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\VPNControllerImpl.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3453184
Entropy (8bit):	6.566548136270904
Encrypted:	false
SSDEEP:	49152:ql7tw/Aoozvu8Y2J/U4S90u2hDD4/e53wBgBpGj4MQuD0/l7fzdPHQtKeidopP2:6P/NfbW4NuD0NpQtmdiP2
MD5:	17AC16FE5568CC24ECF93EFE6432C4AC
SHA1:	E6EE41BA20BC09F75F6FC60461687728FA9236FE
SHA-256:	6504E22FA9887669540F2B54D229193BED37E6FD4818DD716CD462D4AC1491FE
SHA-512:	A3322549226A95B0A2843B7504A971C6335BA2165B6E9830AD6C57A32EE4E378FF58D536779719BD9B7ADA6E2076DFB89C8C8228B5F502B0A2ED793666AE88F4
Malicious:	false
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.........& .Hs.Hs.Hs..Kr.Hs..Mr..Hs.Hs.Hs.1Lr.Hs.1Kr.Hs.1Mr..Hs.0Lr!.Hs.1Lr.Hs.1Mr..Hs..Lr..Hs.Is..Hs..Ir..Hs.1Ar..Hs.1Hr.Hs.1.s.Hs..s.Hs.1Jr.HsRich.Hs........PE..d......f.........." ...&.............B........................................3.......5...`.........................................p/0.T....80.h....p3.......1......^3..S....3.Xn...9-.p....................<-.(....8-.@............ ...............................text............................... ..`.rdata...?... ...@..................@..@.data....l...`0......N0.............@....pdata........1......d1.............@..@_RDATA.......`3.......2.............@..@.rsrc........p3.......2.............@..@.reloc..Xn....3..p....2.............@..B................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\e_sqlcipher.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1846416
Entropy (8bit):	6.60498492780192
Encrypted:	false
SSDEEP:	24576:POAtE1Tfv9L8Y4D2OyiNilZmD0PgZCYyx6A8YuA7x/PME87BA2sufihP:P8tdy2OgmDGdxGYH7JVLP
MD5:	7354E9A9250326BD5CBFCB3F92CEB480
SHA1:	249A9360F65F14AC9CB4AD5B2A1FEAA6A0C126EB
SHA-256:	A750036110DB9B7C4646A71320A99C1A695FB11913A6A5C666842B5DC17471F2
SHA-512:	C2AF011C18B15A4E92A9AE96BB35AACDD19E4B9F5AC1FD950A706E9D8651E452725B922444B309D4980A00BAED22308DB454C1B58C2C9E23E87F7E2E2327DCF4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\|.f.8..U8..U8..Us..T0..Us..T...Us..T3..Us..T;..U8..U...Uj..T...Uj..T6..Uj..T1..U...T...U...T9..U...U9..U...T9..URich8..U................PE..d....D.c.........." .....l...................................................`......Z.....`A........................................0....$...+..(....0.......0...............@..........T...........................@...8............... ............................text....k.......l.................. ..`.rdata...............p..............@..@.data...x....@...`...*..............@....pdata.......0......................@..@_RDATA....... .......t..............@..@.rsrc........0.......v..............@..@.reloc.......@.......x..............@..B................................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\e_sqlite3.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1674920
Entropy (8bit):	6.5740874467663755
Encrypted:	false
SSDEEP:	49152:bek0MS30xsjhNuIQEBlXrhMwI8nSQ7pz2RC:ZOjhNu6XrhMwI8nS0z0C
MD5:	FBD25C471BEE81CA0484DF57105857AC
SHA1:	F361069F1B4B242408709A38459AD25B7F95F2FA
SHA-256:	931B8166123B81573843DCC029006A700E909A64D3E2264BFCF7E078393F60F5
SHA-512:	86ADE6F45FD54091311B642425CE3C30A4099F534E0F4BEE1062E438042BA696840C602993B9010738AD881FB1278CEC7AAB78C309B969429991CF4D4CB8E836
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........U2..;a..;a..;a.8`..;a.>`*.;a.?`..;a.:`..;a..:a3.;a.>`..;a.?`..;a.8`..;ay.?`..;ay.;`..;ay..a..;ay.9`..;aRich..;a................PE..d....E.c.........." .........\|...............................................P.......y....`A........................................0}..p$......(.... .......0...............0..(....b..T........................... c..8............................................text............................... ..`.rdata..............................@..@.data....t.......^..................@....pdata.......0......................@..@_RDATA..............................@..@.rsrc........ ......................@..@.reloc..(....0......................@..B................................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\mb5uns.exe

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4008440
Entropy (8bit):	6.927981641656936
Encrypted:	false
SSDEEP:	49152:15PigeXnpHEw1zKhYOPCP1/j2T37gZKUxT2cHF6c9OtutC:1UpHb1+hDPS/j4gDx2B
MD5:	EAAC9032A5151EA0D7B74AE4BAB32B35
SHA1:	F2C1F886868F6B9F78AEDA8CF95DF5051239C1EF
SHA-256:	807379FDD7315C29BC1E96ED224285AC5AE0226BDFA5318642EAED6BB0CA3191
SHA-512:	91FC6C387EE270372C401AA27AA399C5F6091DBCF1E94058C88E5EDB473A7876C9DE632CFF5A4D6479A2A9BDCFB499C8AC6CDD3BD954B04DB89685CCDE0661DB
Malicious:	false
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........<\..]2.]2.]2..;1.]2..;7.y]2..51.]2..56.]2..57.3]2..;6.]2..;4.]2..;3.]2..46.._2..47..]2.]3._2..93.]2..4;..]2..4..]2.]..]2..40.]2.Rich.]2.................PE..L....$.e......................!......C............@...........................<.....*`=...@..................................{%......p&..............@<......@;..o...y$.p....................z$.......".@...................0i%.@....................text............................... ..`.rdata..............................@..@.data...l.....%......t%.............@....rsrc........p&.......&.............@..@.reloc...o...@;..p....:.............@..B................................................................................................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\mbae-api-na.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	725608
Entropy (8bit):	6.034775209026166
Encrypted:	false
SSDEEP:	12288:k+7cFmBrQHSTbgEQyl9l7zCUnyVK8vFn+hPrDGYOv2J:MMES/3Qmn7tg92J
MD5:	78DD52ABB0AF5F2DDBF98FA3188CED97
SHA1:	1DFA85C2F14DCBD62BE79A93AA74EF7E43E305AD
SHA-256:	EA711DD71EA4F18D7BB282AD224A849CFBECDF10F0D13F368B973B0B1E33C909
SHA-512:	593C55108497C25E57995029DC7EB5F6E35B243DCB625006C8D1BBF2D58176DCB340B3F01EE4F5FB41AB2D3C84073FD749D6AFD57E5A063E34322F55C568113F
Malicious:	false
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......M.....J...J...J..-J...JO.5J...JO..JD..JO..J..J..iJ...J..mJ...J..yJ...J.+5J...J.+.J...J.+.J...J...J...J.J!J...J.+.J*..J.+6J...J..1J...J..}J...J.+4J...JRich...J........PE..d...%T.e.........." .....f...P.......a....................................................`.................................................h..................../...~..h...............8............................'..p............................................text...8e.......f.................. ..`.rdata..X........ ...j..............@..@.data...............................@....pdata.../.......0...:..............@..@.rsrc................j..............@..@.reloc...............p..............@..B........................................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\mbae.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1464240
Entropy (8bit):	6.510407084290294
Encrypted:	false
SSDEEP:	24576:Wz1TLBkzc1BpkIf0kVhZRzNexp1hGD+GINwyRsLXa/vJVIjcpPr5nFD32w/Fs6F:mTwc1hBLzNc0dyRsUBVe4PVnF32eFs6F
MD5:	377373D418CC72167EF605AAF9A33566
SHA1:	8CB97DDFA24DE444E90C947BB34F9A1C889052DB
SHA-256:	207F26E51D71C080015F4E537B5003F698E2E9D15E29E12EB2895E5E8B55C943
SHA-512:	BCFA74977CDE193BE6715D88784D615F3A7F9332B218989F76AE80D566E3554676261D4DE8A6055F782FE604C38C8141582033A205BF40F3912DFF3532C06370
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........^Py.?>.?>.?>.n..?>n...?>.m..?>.m..?>.m.9?>.G..?>E...?>.G..?>.??.>>E..;?>.m..?>.?..?>E...?>Rich.?>........................PE..L....S.e...........!................5........................................p............@.................................H...........x.......................`...@...8...................Xv.......v..@...............$............................text............................... ..`.rdata..............................@..@.data...............................@....tls.........p......................@....rsrc...x...........................@..@.reloc..`...........................@..B........................................................................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\mbae64.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1816816
Entropy (8bit):	6.174002410726689
Encrypted:	false
SSDEEP:	24576:WbNYRqm3bGN2zd8XsKuNRRLHhKL2rK0/kOBzaI5H2s4BiaTHENqQ:WpYgUaNkOXjuDRLBQWauHUfgqQ
MD5:	E7E84F4FAD7B7757E51E1DF7822B229A
SHA1:	15382FCD3D5150D9E82C0B03B652E008279CD0CE
SHA-256:	CAD33B98C3F9189B77EB3F50E7D3A8D8741BA93D59934AFC7E7FAA353697EBB5
SHA-512:	33D32209AC435EA978084E879F4C5933BF9C959CA068F83A385D99C5C53DD9ED84202DFC19152D929506337AFAC7DE6F523C63050DB15FD9F3E25B2CD7276A41
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%.N.ao .ao .ao ....co .'>..mo .'>..-o .'>...o .h...bo .h...`o .h...zo .ao!. n .....to .....co .....o .l=..`o .ao..`o .....`o .Richao .........PE..d...0T.e.........." .........x......(,..............................................+J....`.............................................................x........................0..@*..8.......................(...@...p............ ..H............................text............................... ..`.rdata....... ......................@..@.data............D..................@....pdata..............................@..@.tls................................@....rsrc...x...........................@..@.reloc...0.......2..................@..B........................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\mbae64.sys

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	158640
Entropy (8bit):	6.482839108585478
Encrypted:	false
SSDEEP:	3072:Gqj/Hk4JrlFTsH8J3PxHSIIc46/3Zf3xNPugxmIHts0v:Gq4GhFTscJfxHSIIuF3xXJDv
MD5:	95515708F41A7E283D6725506F56F6F2
SHA1:	9AFC20A19DB3D2A75B6915D8D9AF602C5218735E
SHA-256:	321058A27D7462E55E39D253AD5D8B19A9ACF754666400F82FE0542F33E733C6
SHA-512:	D9230901ADEECB13B1F92287ABE9317CDAC458348885B96EF6500960793A7586C76AE374DF053BE948A35B44ABE934AA853975A6CCD3788F93909903CC718C08
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......rV\.672.672.672.m_1.372.m_6.072.Z_6.772.Z_7.572.m_3.172.673.M72..B6.872..B.772..B0.772.Rich672.................PE..d....4zb.........." .........J.......P....................................................`A.................................................P..P....`.......@.......F...%...p..4.......8...........................P...................@............................text............................... ..h.rdata...-..........................@..H.data........0......................@....pdata.......@.......$..............@..HINIT.........P.......2.............. ..b.rsrc........`.......@..............@..B.reloc..4....p.......D..............@..B........................................................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\mbam.firefox.manifest.json

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	210
Entropy (8bit):	4.946391252411788
Encrypted:	false
SSDEEP:	6:3HW8RqArTvFFWe/nVRVCxqArTvFFaFwpl8CcANWoVY:jqg57uqg5UwrP9vVY
MD5:	F83DF8976D2F549973B4741AABEC7DC8
SHA1:	93B41699FD645755AD548C2B35F6FCB9727277C8
SHA-256:	81E215E014635B567D9D11CCCCAE20A0E62BB4D640B1CCE0B30ECE970212AF02
SHA-512:	BE474BD0662B8BC8DE9152CD7F9C0A3FA600A6CDE158649152C1450EA6E5E0700D8C9295595B5E8C87E4FEE41910E78F770A976D7568A5D3F0736A977120CEE3
Malicious:	false
Preview:	{.. "name": "mbambgnativemsg.exe",.. "description": "MBAM Native host",.. "path": "mbambgnativemsg.exe",.. "type": "stdio",.... "allowed_extensions": [.. "{242af0bb-db11-4734-b7a0-61cb8a9b20fb}".. ]..}

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\mbam.manifest.json

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	343
Entropy (8bit):	4.802810469551003
Encrypted:	false
SSDEEP:	6:3HW8RqArTvFFWe/nVRVCxqArTvFFaFALulkNCp3nvWsNCPqdgJNCItZI5Sg+uY:jqg57uqg5UALAjNWbPQg+Q25SwY
MD5:	5B78211B7B0BD34E67C8367A1D52F9B0
SHA1:	8AEB4E8CAF605EBB8866CB899B67DF393699459B
SHA-256:	8322A303D1EB0FA5D7AD26B52D2E784E88F2BE068A04E5C03FD631E2FAF6D5C7
SHA-512:	F42829E3782695CBC0A4610F469D1710AF5D93EA41077BED40D88EC248778578FE502F5D9EE92ED570A7D7342BA7342301C304852ACA438B5872BD2357EB4C2B
Malicious:	false
Preview:	{.. "name": "mbambgnativemsg.exe",.. "description": "MBAM Native host",.. "path": "mbambgnativemsg.exe",.. "type": "stdio",.... "allowed_origins": [.. "chrome-extension://ihcjicgdanjaechkgeegckofjjedodee/",.. "chrome-extension://bdnmbmckbekibamnoenjkgmllboffdca/",.. "chrome-extension://bojobppfploabceghnmlahpoonbcbacn/".. ]..}

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\mbamelam.cat

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	data
Category:	dropped
Size (bytes):	11087
Entropy (8bit):	7.300621627947781
Encrypted:	false
SSDEEP:	192:2jijKjmjlydFvJCjvyyKwnsFWQFJFMFETTbbrmjX01k9z3AzsGpZH:OvornsFRnWFE3X+R9zusGpZH
MD5:	60608328775D6ACF03EAAB38407E5B7C
SHA1:	9F63644893517286753F63AD6D01BC8BFACF79B1
SHA-256:	3ED5A1668713EF80C2B5599B599F1434AD6648999F335CF69757EA3183C70C59
SHA-512:	9F65212121B8A5D1A0625C3BAA14EF04A33B091D26F543324333E38DCDB903E02CCC4D009E22C2E85D2F61D954E0B994C2896E52F685003A6EF34758F8A650C7
Malicious:	false
Preview:	0.+K..*.H........+<0.+8...1.0...`.H.e......0.....+.....7......0...0...+.....7.....B....^.F...D.#.\..220328224342Z0...+.....7.....0..X0.... R.G..)..O...o..f.M..Q.....y1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........m.b.a.m.e.l.a.m...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... R.G..)..O...o..f.M..Q.....y0.... y6&.@.....x.\|....$x...y...2.A...1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........m.b.a.m.e.l.a.m...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... y6&.@.....x.\|....$x...y...2.A...0.....c4..X2.XO.t......m1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........m.b.a.m.e.l.a.m...i.n.f...0...........F.2.j/M..hA1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........m.b.a.m.e.l.a.m...s.y.s......C0..?0J.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\mbamelam.inf

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	2163
Entropy (8bit):	5.19841611544481
Encrypted:	false
SSDEEP:	48:u/xqgH4uUeM6O/aC5Hho1eMnoByFzsYlr:uJqgFUN6OTHhohsOplr
MD5:	C481AD4DD1D91860335787AA61177932
SHA1:	81633414C5BF5832A8584FB0740BC09596B9B66D
SHA-256:	793626D240FD8EEFC81B78A57C8DFE12EA247889B6F07918E9FD32A7411AA1C3
SHA-512:	D292E028936412F07264837D4A321ECFA2F5754D4048C8BCF774A0E076E535B361C411301558609D64C71C1CE9B19E6041EFA44D201237A7010C553751E1E830
Malicious:	false
Preview:	;;;..;;; MbamElam..;;;....[Version]..Signature = "$Windows NT$"..Class..= "MalwarebytesElam"..ClassGuid.= {dfcb9a84-a210-465c-8e8f-7f3f2e64458d}..Provider = %ManufacturerName%..DriverVer = 03/02/2016,3.1.0.10..CatalogFile = MbamElam.cat....[DestinationDirs]..DefaultDestDir = 12..MiniFilter.DriverFiles = 12 ;%windir%\system32\drivers....[SignatureAttributes]..MbamElam.sys=SignatureAttributes.Elam....[SignatureAttributes.Elam]..Elam=true ..;;..;; Default install sections..;;....[DefaultInstall]..OptionDesc = %ServiceDescription%..CopyFiles = MbamElam.CopyDriverFiles..[DefaultInstall.Services]..AddService = %ServiceName%,,MbamElam.Service....;;..;; Default uninstall sections..;;..[DefaultUninstall]..DelFiles = MbamElam.DelDriverFiles....[DefaultUninstall.Services]..DelService = %ServiceName%,0x200 ;Ensure service is stopped before deleting..;..; Services Section..;..[MbamElam.Service]..DisplayName = MbamElam..Description

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\mbamelam.sys

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	21480
Entropy (8bit):	6.332949178488545
Encrypted:	false
SSDEEP:	384:HO/iZbhL/Uqqn2+s/+8gpUad+JR9zuspd:PtUR2h5adk9zuK
MD5:	9E77C51E14FA9A323EE1635DC74ECC07
SHA1:	A78BDE0BD73260CE7AF9CDC441AF9DB54D1637C2
SHA-256:	B5619D758AE6A65C1663F065E53E6B68A00511E7D7ACCB3E07ED94BFD0B1EDE0
SHA-512:	A12CCF92BEAD694F5D3CBA7FF7E731A2F862198EFC338EFC7F33A882FE0EB7499FB3FB533538D0A823E80631A7CA162962FBDFD78E401E3255672910B7140186
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%^c.a?.Ha?.Ha?.H.Y.Ib?.H.Y.Id?.H.Y.Ie?.H.Y.If?.Ha?.Ht?.H.W.I`?.H.W.H`?.H.W.I`?.HRicha?.H........................PE..d....2Bb.........."............................@..........................................`A................................................dQ..P....`..H....@...........%...p..$.... ..8............................!............... ...............................text............................... ..h.rdata..0.... ......................@..H.data........0......................@....pdata.......@......................@..HINIT....\....P...................... ..b.rsrc...H....`......."..............@..B.reloc..$....p.......,..............@..B........................................................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\mbampt.exe

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	34056
Entropy (8bit):	7.124255516356577
Encrypted:	false
SSDEEP:	768:JHzII9UUcWgqxf1mlv2VnxJImXK4MXK4xOJh2Ip4eTxf1mlQh5VdWe5K:lII9UO5fI+VnLI0KxKd89+fI+vW+K
MD5:	C834D6668C5DDB8CB57F2671EE6FC36F
SHA1:	3D33A66C7BCECC7D896CF79B7C2BF4AEE19837EA
SHA-256:	67DE0E14D5EFE0FD8A87F2EAB557548A01F5ADD324EEE286491A05F05266A6A8
SHA-512:	AEB5E14A9051EA291CA8ABFB988DD25A20A2981720276A3D67B3F3882BB2BCC6503AC3F21C0F356837FE68DE1FA312E683B51E3AB768C34AF93CE0897A756F72
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........vj.............................o...........................................Rich....................PE..d...a..e.........."....&.......................@.............................p.......r....`..................................................$..(....P.......@..H........m...`..(....!..p............................ ..@............ ..H............................text............................... ..`.rdata....... ......................@..@.data........0......................@....pdata..H....@......................@..@.rsrc........P......................@..@.reloc..(....`......................@..B........................................................................................................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\mbamsisdk.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	8656648
Entropy (8bit):	6.638514985857026
Encrypted:	false
SSDEEP:	98304:qYXBvpGH8RgajJS1AYPGRYVgpxwgxJQkE3eeABS3cCUV1nllM6J:q+BMcRgajMfjgp2ggkEueAg3hg1nlS6
MD5:	9918C78248ABCC82E6E1E78F1AFB80D5
SHA1:	095ABA89A64B98B40D2593746BD5E9A3B1E51763
SHA-256:	F8BE1E0304383DA80A8569D9E523A4D54616377F7513D02056307D064E3D7229
SHA-512:	0CB756D14412F2F405B6E3C3997C99D8E4692F136619163D23BC4C2BC0D983CEB8D4566B00E64F5C29952705024C9172B4B03CA156F496C94E85328A091D6BBA
Malicious:	false
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......~..:...:...:...q...=...q.......:...;...<(..+...<(..(...<(..[...q...$...:.....q........)..5....)..[...T(..p...T(..;...T(<.;...:.T.;...T(..;...Rich:...........PE..d...\|d.e.........." ...&.F....f.............................................. .......D....`............................................p......T....p-.h2U...+..h..............(n....(.p.....................(.(...`.(.@............`...............................text....D.......F.................. ..`.rdata..V_...`...`...J..............@..@.data...,.........................@....pdata...h....+..j...\|+.............@..@_RDATA.......`-.......,.............@..@.rsrc...h2U..p-..4U...,.............@..@.reloc..(n.......p..................@..B........................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\mbcut.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2993520
Entropy (8bit):	6.4672322502595225
Encrypted:	false
SSDEEP:	49152:zBNV8jmdJpiQhsMW2hJ/Ree7Yg8emBtUOh5Pl4fgyPIkZktqmc3:nR7jbg9zbkZT3
MD5:	44BF23228DFBFFBE01740ACAE3EE7C75
SHA1:	E5C2A0623321E9A7105414EF0EED02B8499A6786
SHA-256:	4809A9F26EF61964B712AD0DE7BD019E4171B149BBDAD2BE36C2E96BD1E80F38
SHA-512:	2935B05CEF3F993A4F420FBF3CCE3982915AA1124E00CBC44A2911DDDA204A632CEA7A2B6C9AD25F8A687E5863BC65BDB6EFB876A8B6C40224B7D79B75B79B93
Malicious:	false
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......30.{wQ\|(wQ\|(wQ\|(.5.){Q\|(.5y).Q\|(.5z)uQ\|(%9.)~Q\|(%9x)VQ\|(%9y)1Q\|(.5x)kQ\|(.5})^Q\|(wQ}(.P\|(.9x)7S\|(.9y)8Q\|(.8u)AQ\|(.8\|)vQ\|(.8.(vQ\|(wQ.(vQ\|(.8~)vQ\|(RichwQ\|(................PE..d.....e.........." .................k........................................-.....Q$....`.........................................0.).......).h.....,.0.....+.$b...\|,.p1....,.0s.. .'.p.....................'.(.....'.............. ...............................text............................... ..`.rdata....... ......................@..@.data...4.... ....................@....pdata..$b....+..d....*.............@..@.rsrc...0.....,.......,.............@..@.reloc..0s....,..t....,.............@..B........................................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\mbshlext.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2844504
Entropy (8bit):	6.374128451653002
Encrypted:	false
SSDEEP:	49152:C55UfKzapI/i54HB+mKu5Oh5P0/nx+AoGuylyPz7Ch9qLAoBMl3o:0i58zp3+cQChAAoB43o
MD5:	B7E5071B317550D93258F7E1E13E7B6F
SHA1:	2D08D78A5C29CF724BC523530D1A9014642BBC60
SHA-256:	467DE01D7CEE7EC54166B80658FF22F9FEEBDB1C24EAF1629CF40E4124508064
SHA-512:	9C35293C95C1A9141740AC99315605964AA37C4A42D3A11CAE9E5649FF1427A9480D3D5E7F763212CF13DB3511C5EA3C84E68F95F0067FE6339A9D3FB7B27C54
Malicious:	false
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......x...<.u.<.u.<.u.S.v.0.u.S.p...u.S.s.>.u.n.v.5.u.n.q...u.n.p.v.u.S.q...u.P.q.\|.u.P.p.l.u.<.t.K.u.S.t...u.P.\|...u.P.u.=.u.P...=.u.<..=.u.P.w.=.u.Rich<.u.................PE..d...:..c.........." .....,...`.......................................................+...`..........................................r$.....Ts$.......&.8....p%.<A...>.X)...P..o....".p.....................".(....."..............@...............................text...........,.................. ..`.rdata..6J...@...L...0..............@..@.data.........$......\|$.............@....pdata..<A...p%..B....%.............@..@.rsrc...8.....&......D&.............@..@.reloc...o...P*..p....).............@..B........................................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\mbtun.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2945104
Entropy (8bit):	6.51120807472477
Encrypted:	false
SSDEEP:	49152:xNrdEZjzdAj9fdc4fDrN1OxOh5PgqdnBq30yPFZP7KVxSL:bBzFRkshaZP2W
MD5:	2BBF63F1DAB335F5CAF431DBD4F38494
SHA1:	90F1D818AC8A4881BF770C1FF474F35CDAA4FCD0
SHA-256:	F21A980316BD4C57C70E00840AB76D9AD412092D7D2D6A2CFF4F1311F7C05364
SHA-512:	EBB9834323329DC01BA2C87E5FAD1083A4CB86F5ED761CB63299AC5336A9843A1AADD42FBED706797C2295117AF1C00F96806422338352653C8E0255FECC2FD5
Malicious:	false
Preview:	MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$........1 ..PN..PN..PN..6M..PN..6K..PN..6H..PN..8M..PN..8K..PN..8J..PN..6J..PN.x3K..PN..6O..PN..8J..RN..8K..PN..PO.}QN..4O..PN.u9G..PN.u9N..PN.u9...PN..P..PN.u9L..PN.Rich.PN.........................PE..d....!]e.........." .....N..........P........................................`,.....q.-...`..........................................$.......$...... '......%..J....+.P*....+..p....#.p.....................#.(.....#..............`...............................text...<L.......N.................. ..`.rdata...n...`...p...R..............@..@.data...d.....$.......$.............@....pdata...J....%..L...R%.............@..@.rsrc....... '.......&.............@..@.reloc...p....+..r...T+.............@..B................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\mbupdatr.exe

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5994624
Entropy (8bit):	6.89722018049946
Encrypted:	false
SSDEEP:	49152:L7xuJR/ZzSIHwWhQi41XN056KdctnRqCjuUjKxxaBfNYqbVAtIyetVPyZXVYLZ1N:LRWmRxeqxAqztEYfGQJaQzaeT007kx
MD5:	527B1221805146D404D0A6DF5D9BA560
SHA1:	F316DC9D5F2B9A6831C312A9ADF20B6B29FB809E
SHA-256:	8850EB71BC4950DA777ED369D60772F07D10CF496D276CA89E8837CB8D75C804
SHA-512:	536B4936247820DB6F1F7ED15E4A0391BDF2ED0C3AD5E123FD093204B43C404E5D8964520D2698DD8480F637200E1E8F250A3E89838887428955580BA2E5BDFD
Malicious:	false
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......aU..%4.%4.%4.nL."4.nL..4.%4.$4.#..64.#..74.#..I4.nL..4.....6.%4.36.nL..4.K...4.K..>5.K..y4.K.%.$4.%4M.'4.K..$4.Rich%4.........................PE..d....q.e.........."....&.x1..p(.......$........@.............................0Z.......[...`..................................................F...... K..h....H.4E...zY.......Y.......B.p.....................B.(.....A.@.............1.P............................text....w1......x1................. ..`.rdata...>....1..@...\|1.............@..@.data.........F..x....F.............@....pdata..4E....H..F...4H.............@..@_RDATA........K......zJ.............@..@.rsrc....h... K..j...\|J.............@..@.reloc........Y.......X.............@..B........................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\offreg.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	117088
Entropy (8bit):	6.808644555380222
Encrypted:	false
SSDEEP:	1536:qiFHo5qNN6RBMs4CRqU82r3kvy3ZuottZTBgmFcUNdfI9NMiIy7Q9bEfIBZ/2e:xff2BJ4CYNDo5Bg62Ivl
MD5:	F782F049B0E8C13B21F8E10E705BD7E5
SHA1:	5C11F955E3983C50EA46B5D432C97C9148AC8E9F
SHA-256:	16C450A310EDBEA07F578F31368F168EC338011CD117406898593E86EBB83DAE
SHA-512:	EED29C42B14FF26A030F53D61D6DC8E3971E478DC7646B26189F14F16699B6BEDC170C4BCC37EFE2E8F3048BDE37480033B49EAF1A4712B88464F5DA0EFC18F2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............oj[.oj[.oj[..nZ.oj[..iZ.oj[.ok[.oj[..kZ.oj[..jZ.oj[..bZ.oj[...[.oj[..hZ.oj[Rich.oj[........................PE..d...h............." .....&...6.......................................................i....`A.........................................R..4....T..d............p.......Z..`o...........E..T...........................PF...............@...............................text............................... ..`PAGE....p.......,.................. ..`.rdata..:....@... .................@..@.data........`.......J..............@....pdata.......p.......L..............@..@.rsrc................T..............@..@.reloc...............X..............@..B........................................................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\rtp.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3079880
Entropy (8bit):	6.609246851986975
Encrypted:	false
SSDEEP:	49152:HDydFAzWkD/DH3KyHZ7q+VBulPi/0AhqPNgYNHKXdPb14fWae6BZfrWen2T/vxKl:DOiSPToJ14+ae6vrH
MD5:	255776B83AB40FEC85808AB6BCDDFFEE
SHA1:	E708AB03D7C89BAD8540DB525D448927A809FF54
SHA-256:	1A9526677BD7318918DD7E825E393C195E168C2C46A0611EE4212537EFFD7D43
SHA-512:	C7CCDCAE79C6E7E9639D454214566E703B81C82B5550188FFC584EB1DA3E43A42B9DFE4C2D448A3F9A3FA9E579E41D8F1A58BB8DF5DE861D6FCC158A2F1D1995
Malicious:	false
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$..........7.y.d.y.d.y.d...e.y.d...e0y.d.y.d.y.d...e.y.d...e.y.d...e.y.d...e.y.d...e.{.d...e.y.d.y.dLx.d...e.y.d...e.y.d...e.y.d..Ad.y.d.y)d.y.d...e.y.dRich.y.d................PE..d...p..e.........." ...&.....J.......C.......................................`.......N/...`.........................................`.&.......&...... ).h.....'..3....-..:....-..`..p.$.p.....................$.(...0.$.@............................................text............................... ..`.rdata..~...........................@..@.data...\|.....'..v....&.............@....pdata...3....'..4...^'.............@..@_RDATA........).......(.............@..@.rsrc...h.... ).......(.............@..@.reloc...`....-..b...b-.............@..B................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\sentrynativesdk.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	598416
Entropy (8bit):	6.543847923778161
Encrypted:	false
SSDEEP:	12288:NEK5P1EK1dyEzqsKpBe580U3O9Zkt2UmLufNXCPqaBik:NEsP1EFN4U3O9Zk8VLCBCCaBik
MD5:	0FC4FBF0DD536F112BA8E5AD0AF417E2
SHA1:	197B917C3EF44CE59192B19A9F1FF39CF3EB6F3C
SHA-256:	53FC21363AD554AC116619E4E02904B547E6A26EDA7039DCD6407736D4ABFCED
SHA-512:	4BBC78C5EB7F30D405C9D471A0B4B16169FBB0DC7CD31D09533F47E6B6B119EBDD66B6EF1092C30D39379251992BE4E8DD0F8AE1F09F43900B4669B30FB11DC2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................)..............y.....y.....y.....y............S...y.....y.....y.....y&.....y....Rich...........PE..d...W9.e.........." ...&.4...Z......\...............................................N.....`.........................................`...@.......x............`...[...................U.......................W..(...PT..@............P...............................text....3.......4.................. ..`.rdata.......P.......8..............@..@.data...H7... ......................@....pdata...[...`...\..."..............@..@CPADinfo8............~..............@..._RDATA..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\srvversion.dat

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	2.4193819456463714
Encrypted:	false
SSDEEP:	3:ekg2:eX2
MD5:	35789C7AD83C065167201F3824B71A39
SHA1:	1C7A9B3214D58CB93ED2BC856431083DF2B6D674
SHA-256:	E02D0BF83E0533A612AFAB6BEF6E564DA94D0F9D2F7A5379F65E563399C08AAE
SHA-512:	86AF0B7DA8A43781AE8FA98D085CE4BC4C3A8240A99578963F1BBD87B0655523E48E9E374B5CD68EECC70328628AE08C237969AFD7AEF4D60FC08A0D22DD8167
Malicious:	false
Preview:	5.1.2.109

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\version.dat

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	8
Entropy (8bit):	2.1556390622295662
Encrypted:	false
SSDEEP:	3:SVR:SD
MD5:	0B7E6E059C5EE39C82A6C79E8DECE05B
SHA1:	053EF3E04D3FB9356961DE6737863FA098DC3923
SHA-256:	753A4C9FF9C48AD4A6658775D63F45C6E81D57B31D50506595BAEDBB55675001
SHA-512:	FAD64EA26AA8FA59741223A3D334C2A9AF503F8FD60FAE772F4272C1D6B69E6105CAC1871A1BD224CE4902B0F15FE175A90DB2588A25BEBC26C9066F6A034664
Malicious:	false
Preview:	1.0.1214

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\wintun.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	729192
Entropy (8bit):	6.34274577743969
Encrypted:	false
SSDEEP:	12288:LAVTLwnjv4ENcWpYAFjIxzy6hr/O0HysdYz/OwcV+q:e3e45mDyyg2lcV+q
MD5:	530AABF98F4E6DEB74C4B2AF7F31B6B1
SHA1:	21B4749D835B0F570A28BB1ADEE14AEA561126D2
SHA-256:	8A0581991CAF829CD92B27AABCB2BAB618CC8FBC887D8F86A533C95D2E3F17D4
SHA-512:	A5F6CA949A105696E7B96C0617189C823B919C14F1CE6111302C3A90F70E5BACF1C7835EC422B6D20B339D76FFD338A008EBCB7E6FE383915747D15CD8490B55
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......`"-.$CCK$CCK$CCK.1@J!CCK.1FJ.CCKH7GJ*CCKH7@J-CCKH7FJ.CCK.1GJ(CCK.1BJ!CCK$CBK.CCK.7KJ,CCK.7CJ%CCK.7.K%CCK$C.K%CCK.7AJ%CCKRich$CCK........................PE..d...]].a.........." ......... ......`........................................@...........`A................................................<...<....`....... ..........h:...0..........T...............................8.......................`....................text...@........................... ..`.rdata..............................@..@.data...P...........................@....pdata....... ......................@..@.didat..(....@......................@..._RDATA.......P......................@..@.rsrc........`......................@..@.reloc.......0......................@..B........................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\ctlrpkg\wireguard.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1340728
Entropy (8bit):	5.736858587876037
Encrypted:	false
SSDEEP:	12288:DUenDNpq9bKeKqM7cyOcN7kWCEKI2ExcN7kWOpPD:9pqFKew1N7VCEvcN7VOlD
MD5:	BAFA63CBEF47269E12392EB29FF87070
SHA1:	A5814B3548010DD3E3413835BDC0590F726346F6
SHA-256:	D2AD6CE25634776F5067FD9D5750A5E3D2ADD1ADDE98EB1F56A2DF194D0E9CBB
SHA-512:	95290F78B4BF8D98E64C4C5280AC334BDDA56265FD88370D7BA2CAEC93C776A13C33105FBD1C9F9BB8189D769415B95CA5DFE74F7276065E619EECEE5DC07E76
Malicious:	false
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.........0...^...^...^.3.]..^.3.[.o.^..Z..^..]..^..[...^.3.Z..^.3._..^......^..._._.^.X.V..^.X.^..^.X....^......^.X.\..^.Rich..^.........................PE..d.....ja.........." .....2...............................................................`A.........................................?.......A..<...........p.......&..8O...p......0...T........................... W..8............P......T4.......................text....1.......2.................. ..`.rdata..v....P.......6..............@..@.data...`....P.......6..............@....pdata.......p.......B..............@..@.didat.. ............`..............@..._RDATA...............d..............@..@.rsrc...............f..............@..@.reloc.......p......................@..B................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dbclspkg.7z

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	7-zip archive data, version 0.4
Category:	dropped
Size (bytes):	42552970
Entropy (8bit):	7.999867208385552
Encrypted:	true
SSDEEP:	786432:GnEIRyZPD4uMUCaeecqI9UeDHcS46FnH4xHZrkm1EweyOXsWnpbgHs:GU5ZeNT/F46W5VP1EweyDqpbgHs
MD5:	703C717289FEA89D7B39642C7B8BC66E
SHA1:	E71B9F0AF105FEE6F9FA7EE525D689E6F1D1C133
SHA-256:	0A621D8B0CBA3B3D4B93841251A1615FB317F10A89F26C5FB29507401E8BA8F7
SHA-512:	F4DC4154BBE0F69BA5273D66628E3A4B62C911392EFD0F3429C7F03AE3DC8E5E8FDA3344EA8E5C62F6A2971F99A743541A79E7524CA554ACE0B06FB529496068
Malicious:	false
Preview:	7z..'...K.sEN......%.......;:.....]...5...J.U.G....yP....S...J%.B:4...e.H.0...qd..2.\.....JI..rd.+JwU..y.X$....R...<.../RJ<..5..P.H.z(.N...-8}"....U..... D.....T.W.....\.P.v.[j......e.A...k0bc....V.eBv....T.....1U..RdE......../V}.&...@.N_.........f..X....r..oj.a{..~.E....\|....g...y..h.7.u\|.0.d.zLpOf%..N#..'".g.n.Zt.~..1J;..h\t.t74.u.L...Sf..%yF.5..?.....#.....r...S.C...?I.K.D..tdT.`.!.4&..6.>... ..04...A....k..<ya......s.Uu=.....n....`.R[.......R.%z.....@.g..,..\|.3...4T%'9:Z...\e..o@......qc5G.5.s+Y.......3}.(j.....m.Jw..0..-.<..h.G.H.m.-1..z.u.&.$.Z.!.M.k.[.../.....b%w.)..].....&su.\.#.....K.6.......\/...oF.C.?P.m...@......V...u.cmLv<I8Q....K.%..2.-.......X3....g.....vT..cn.)oy....3.....^.......;.+..Ez..<k......0.kv.w...\|.....&7....m,..LQ.cj..d$._. ..(..<...t:i.h.>.+DH....C....AUmM.......%....XA7D..S..&......e0j..?.?...S$.=.m...M.#*..........;...vr.....\|.h?.A....x_R.-..du..!]w..D.i6.....{..."........p.4......p%\... .....'.g....;.F

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dbclspkg\ActionsV5.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4672344
Entropy (8bit):	6.294948484134738
Encrypted:	false
SSDEEP:	49152:tzBxfafNoYk03h1UjDIbeNqj+wdCzkrJuSu1BrtGgfBsAGxQ1ZbvdPd2uqaSpeOj:1rbNqFxlpxyn2upOZ
MD5:	20D70C6E04DBF14C01AB2D756E97854F
SHA1:	F172C8B8C0E87D2A9AB064513DCE004D16D03E0D
SHA-256:	C4002339B58BC493AE3540BAFE1B2CA0A70BBA0F853E29F60E0F6A1680FA9A24
SHA-512:	13E073CD4B3D53C6D9FDDA671A55962266B5C0A18ABCB5774092C35F0D0BF2C5D0D9802D8955D32CCEB166821634BFC067DAC7809C9ADE143CF3A3B497743B36
Malicious:	false
Preview:	MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$.......:T..~5..~5..~5..5M..y5..5M..5..~5...5..5M...5..5M...5..x...o5..x...l5..x...&5..5M..a5..~5...4..5M..U5..G...4......k5.......5.......5.......5....3..5..~5[..5.......5..Rich~5..................PE..d......e.........." ...&.N&..........(.......................................PF......eG...`..........................................@......@.\|.....E.......C.......E.X.....E.......<.p.....................<.(.....<.@............`&..............................text....L&......N&................. ..`.rdata...q...`&..r...R&.............@..@.data.........@.......@.............@....pdata........C......PC.............@..@_RDATA........E.......D.............@..@.rsrc.........E.......E.............@..@.reloc........E.......E.............@..B........................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dbclspkg\BrowserSDKDLLV5.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5649632
Entropy (8bit):	6.5646324710155435
Encrypted:	false
SSDEEP:	49152:wyLEnIYGoPW0X0lfzc+Spd3hdC0qdcz+UbDa+El4+LorSojkoy7HJBQCdfvxYffA:tYdbZmczU+ypLha/S8JQ
MD5:	A3FE79081A59D493C01B5C1139BABDC9
SHA1:	1505CB4053BCD9B55C40227AD6B62A2457CEBBDF
SHA-256:	60C8C024FF020F04FCCCEC10EE78872BB1E6985463D6370C6AF095761D88B860
SHA-512:	22310A585EDB36050FF20356CD9EB5129CDAE3FFEA2CCD7A54D9652DBD336D7F402ED119DC59AE3250B93BAD40E75983184256C0BB239CFF049BBB983F487BDC
Malicious:	false
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$..........$Q..wQ..wQ..w...vV..w...v...wQ..wP..wWH.v@..wWH.v5..wWH.vE..w...vO..w?H.v...wQ..w...w...vv..w?H.v^..w?H.v...w?H.vP..w?H.wP..wQ.rwP..w?H.vP..wRichQ..w........................PE..d...4;.e.........." ...&..:..H............................................... U.......V...`...........................................N.......N.@....`T.(.....Q.....PT......pT.......I.p.....................I.(.....I.@.............:..............................text.....:.......:................. ..`.rdata...p....:..r....:.............@..@.data...tm... O.......N.............@....pdata.......Q.......P.............@..@_RDATA.......PT.......S.............@..@.rsrc...(....`T.......S.............@..@.reloc.......pT.......S.............@..B........................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dbclspkg\Global.nm

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	data
Category:	dropped
Size (bytes):	343000
Entropy (8bit):	1.3643101998826728
Encrypted:	false
SSDEEP:	6144:IhGoLNRdpPTzHC76NidE/XTKNwcc99Pa5W2IIzQiLiNKshgNcLZTVIM5TAO/jIbW:IhGkNRdpPTzHC76NidE/XTKNwcc99Pa4
MD5:	FE4EC049045997B88F5F1FB5F7829BCF
SHA1:	034A7AE32F9A689227358F432AE5A141A9310C28
SHA-256:	E88E2E80BFDC35A74DBA07DA5AC4B1A5819F18FC4BBE0C62B6B1CAF825B5F31E
SHA-512:	A5CDBDC25888FCE78350877C59F840A88153A09362A585E10106DF19A4F3DA92EFBE2F4A9F7CF7C9766C2503B0DFA3D54EC2CE05B12805260699E0FBFA20BC0E
Malicious:	false
Preview:	.....z*.1.8.0.S.o.l.u.t.i.o.n.s...A.d.w.a.r.e...A.d.v.e.r.t.i.s.i.n.g...D.D.S...s.r.....................................................................................................................................................................................................1.C.l.i.c.k.D.o.w.n.l.o.a.d...A.d.w.a.r.e...D.o.w.n.l.o.a.d.e.r...D.D.S...s.r...................................................................................................................................................................................................5.H.e.x...A.d.w.a.r.e...A.d.v.e.r.t.i.s.i.n.g...D.D.S...s.r...r...D.D.S...s.r...................................................................................................................................................................................................7.Z.i.p...T.r.o.j.a.n...M.a.l.P.a.c.k...D.D.S...s.r.....s.r...r...D.D.S...s.r...................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dbclspkg\Global.sr

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	data
Category:	dropped
Size (bytes):	20435064
Entropy (8bit):	6.773040544420836
Encrypted:	false
SSDEEP:	393216:ifMkLDMqTnmaHiaPCNHVNrFkWPX0xrIle7Q:ikiDMjaCa0DBPQrQ
MD5:	2533ACCFBF44382328CB91613D3356E0
SHA1:	82DD1220E69BE7F8640D29853289BDF623FA1BE8
SHA-256:	9E9AC3D2ED93A5E4035F4C408558A14144ACC4F6D348A0FE7FA560A1F5656FC5
SHA-512:	8DEFF61628598DBBD7931DEFB2E667FCF6FAC16D8D8A79BCDFAE01F7B0ABDF06EC39698A4E46EA9E1AEAF6BC5426602374BF42C06CA5F0ADB853A380F5D4D116
Malicious:	false
Preview:	.....z*.........................vI......vI.......3.......................................\|......q.......................................................................................................~..y._..j......n<57.7~3.a......../.@wu).......j..W...c........\|..R\.m........Z.b.,.3.g......../..2..(...........................r/.........;. U...D.........C.}.U..A=.......................x..........0.-..#?........7V..$...L..........M....d........d.<............l'.Zl&m.........C...'p.........@...m.u'...........~..fc....../....f..........q^.XBZ.X.........................S..VV.../...........O#%E.......Q..b..@^....................N...............@P<O.,T........].....Og........=t...u........+`q_.[.].........M9...#..n......o..W..6M.z........Z...I..........A...Y.........Di.bK...)D......~..'..4.H.............q........../".Rj........1..,b..Qh.......T..o...O............-.7X.......2.u.G.e.].......:..J"X.p........-.7.(.l.......LN.J.I.G........l...3.(m.........t....K.%.......

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dbclspkg\MBAMCoreV5.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7009696
Entropy (8bit):	6.385161924256879
Encrypted:	false
SSDEEP:	98304:UPxTXttZarMzMk4PEcxZ3M6GdPiwjQDZ:UP1XbZawzMk4PEcT33sjQDZ
MD5:	B2763ACFD7AC2CE596A4F3A930DD2A3F
SHA1:	AC18DF54E4B64268E93B6E0AF650D6CD8FE60274
SHA-256:	3B8FDECC7155BBB62B1D76AA30F06BF079924BC794CF700F5D51ADE13444D049
SHA-512:	40B9F4BD1DC10034A5B18D3C0D2447A98AA6E4655D5D43B22AAE83720E9EDA8F818CF7FEBC0E8D0CD3B3F051805407A6112B66EB4FDDD49AE2CA882A1AAA57B3
Malicious:	false
Preview:	MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$.......................................................................................................................I...........0...X.........Rich....................PE..d...[}.e.........." .....Z7..`2......b*.......................................i......k...`..........................................aN.....PeN.......T..w...PR..o....h..?...@i.`....UG.p...................@WG.(...@VG..............p7.p............................text....Y7......Z7................. ..`.rdata.......p7......^7.............@..@.data........N......\|N.............@....pdata...o...PR..p...2Q.............@..@.rsrc....w....T..x....S.............@..@.reloc..`....@i.......h.............@..B................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dbclspkg\MBAMCore_b.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7007400
Entropy (8bit):	6.38945218874662
Encrypted:	false
SSDEEP:	49152:lcisAuWx5ZGztkuNCEWMr5a8h+OmyNPd9pn9HEuRRs8BREvVG8jpOh5PMmYk5AVL:wkMt7NbpdzB5+5mhgb9E/4L6H259cKQ
MD5:	064E37718EF3547577D9361B879C9267
SHA1:	476BB77CD022D92CEB57C81FEDA98DF31E920763
SHA-256:	C63AFDF3940EE7786DD1A0BCEDE424F555DDEF0F80FD58B870065485498F0160
SHA-512:	DBCD963853FDD26CF36E46C6ABBC55E6F22DF471A7FB155380FD7273B6131D5221ACF6830727BB5F87A62476435F9DC5F43DCC42A96A86F4AFD73A0401D4F0BC
Malicious:	false
Preview:	MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$........o..V...V...V...9j..X...9j......f.._....f..)....f..r...9j..t...9j..U...:f......:f......9j..p....g..^...V.......3h..U....g..W....g.......g../....g..W....g .W...V.H.W....g..W...RichV...........PE..d...R..f.........." .....V7..`2......]*.......................................i.......k...`..........................................WN.....p[N.......T..w...PR..u....h..B...Pi.,....YG.p...................@[G.(...@ZG..............p7.p............................text...XT7......V7................. ..`.rdata.......p7......Z7.............@..@.data.........N......pN.............@....pdata...u...PR..v... Q.............@..@.rsrc....w....T..x....S.............@..@.reloc..,....Pi.......h.............@..B................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dbclspkg\MBUpdate.cat

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	data
Category:	dropped
Size (bytes):	20509
Entropy (8bit):	7.520253286075925
Encrypted:	false
SSDEEP:	384:1fOjahIvV31PMnYPLiP2M1MGRYIZsHLE58JN77hhBp:5OOhgbUBJM713hXp
MD5:	B1FE3C9BB3E9B52320F08F353757FF4F
SHA1:	5A6A69CFC5C4D10DF7EC1AEE6C5FBFFBB5CAC62B
SHA-256:	9799BE3707A3577DA33A4F69B61E0FD3086E9C78AC02AEF2744E40299229B12D
SHA-512:	4699A6F842EA642814CCB517A6D2C27B8AC5A1F33082FF34755F49BD54B4D8DE0690CF488A6F35978548BC160F0E20B21EADF95295FDDF5322C2B8465CC59642
Malicious:	false
Preview:	0.P....H........P.0.P....1.0...+......0.....+.....7......0...0...+.....7.....K.....%B...1i.....190108174037Z0...+.....7.....0...0....mcL..{..."..P.1.0...+.....7...1...0......K.Z...sy.z~..R 1.0...+.....7...1...0.... .7...9;}..sU....?p...~.....{Z..1...0...+.....7...1...0.....+.....7...1...0...0.....+.....7...0..........z...v.......$f.....`....`1..\0..X..+.....7...1..H...D.....V....C...5eR.R&.Jb..+..c/..S.......c.....3x .".a. .E7......t.H.. ..7..^.....U........{\|.8..u..0..P"..M.y..[..'.Z.....](.\...>.s6..@...c@.sN.!F.\~....."..5..2..].....P.......g6..q&..[..X...jm.%u.%.m.`...G%....n.Sm..Iu.$8=..=.}.><..s.p...,.........^. ..\......... .A........@..0.*..`...}.~..Ow.\S...........6T..t.s.....7.]G!.U......0.n..oF....-G...../.......#.......K.....W.......b.......;e..g..!...bo....F8...z.........c...k.....@.D....s.Ji.......c$K.Y...pPW.<<.e.h..q.Dc%..(@........,....k..n..O$X..6%..BF.y..X......Po\f..E....wx..{c..Z2.....{....S....F;......_"L[.Lv....[.h.Q...........e

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dbclspkg\cfg.bin

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	data
Category:	dropped
Size (bytes):	845
Entropy (8bit):	4.798278423365327
Encrypted:	false
SSDEEP:	12:rMXBoOWZOVMlpC4O18quZXmwJs5fGFyYiM9uUCO3/JgX0/dzWAH0Xn:YXBqOVMK8l4GoPM9uUCC/GSZXH0Xn
MD5:	1BEA85F6F77B365122FD5F51B10777E3
SHA1:	2431DDA3AE3310739FDBC59A1C40AADF5B0C5E2F
SHA-256:	EBB6BFBCB66F79D34E10C57E70B26AEE5F99E11207E6F103C660B4C2A005F771
SHA-512:	01402E189787BB653C14400721ACD55ED2AE78F94C4CE9D0C9B9FD8A49EE504136BEE56DEAF24291E0594DFC73489A973D54F2E19094EA21F061CAD2DAF35460
Malicious:	false
Preview:	....?.......?...........................................................................................................................................................................................................4........................................................................................................................................................................................5....`................?..L?.....c........................AQRGEQG"../OCZ@C_PV@1..2\\IPHRN:-+.gkfsjmg~x. $.`c}tft{sym{.17.\|.................t_Yq...........!,$( 5O.Q\BI`dJ $0?=6Szr:@').;-..................................-44..?Abflxbo..5Wt\|vf\|u^_.........................-8;:..4789..>=>;.. #$-..)++..,/../)....%#....#%....9?....71....MKpsw\|KMzy.{AG\|.eg_YfecnUShkjjSURQURioTW_]ga^]YZ}{@CCB{}JIMCqwLO.................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dbclspkg\clean.mbdb

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	data
Category:	dropped
Size (bytes):	12039
Entropy (8bit):	7.97533612150655
Encrypted:	false
SSDEEP:	192:VAKNoJdP/gHM9RJtp6wWs3IWFTr7PN0/7kw/Q3G9nzFzUcPpIMQUPTf9Mv7cj:VON/995p6ls5fV24stnycPOM3VS7cj
MD5:	E5043DB63E70D72E5AED7D50646F3B06
SHA1:	132CC537282A08374D7D6964D6955D972C793E36
SHA-256:	2C1E964836E1A92FA778673783FF04D2BD76CF3743879CFB63173CC04F52B900
SHA-512:	DFDC83087E5B4D3B4E08D223005C9758E9B5BB19F4E6BFF8768081E8A81B18969C4F0296F912C9CD9A2EF9EAFDF1F5FEE94071206A3A35D50BA8E22F9FCE21BA
Malicious:	false
Preview:	MBDB........x..}.tc_Z.dI...n...b..{.WK.ror.-Wz[...,.'!....B.!....,..,..B'.....Y{...aw.yg..........w.{c.!......].O...g..xuM...=O...h....@..........ew.....H8..wAd/1F..\|.E..\|...x..S.:.Ety.....X.,..*uq..NXT..aT..zqX.H.Jt&3..@..(v.....t.......OG..W.Q..N..g....M..g/..EF.V.".]T.F6..l..FZ.k..i.#L.CT.........#K.;...;a.;`....{..!.<.'o.u.....k.g....Q^.Z.. wJ]...~c.Q...s$ast..Ni./.O...,...orw.-...8..............x.....;.p..#.....U.\..........t3....x.......vM.p...Z._a....c.5...Q...s..\|.n@.E..>...>...0:.]..6.+l.....]...<...n&Z.[...K..~..{.p.\|2.0.....5...N.4\r....cp..3q ./!S.U.....Ey...I..].8x.;..6g...9ICL\..B.c.....;...:..].8..w`)k......7O...O]f...UEE..y.._\|..evC.1q3.%...:.....4eKL..Z.D..hK8.w.%...Ij{.....r.k....v........N\...+.v..u....S....b.........o...N[..D.8......;5.!D\.....4...h[...3..3}.h...4..l..0.C...>P.{.a>.&.r...D."Y..k. .<u.S....vIpX..Y[.....u......:......n..Th.vO}.NB..>;...o{.6[........S.....t.9....l.....6r...+....Jh.....^..........0..{

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dbclspkg\dbmanifest2.dat

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	924
Entropy (8bit):	4.686212273872669
Encrypted:	false
SSDEEP:	24:ihWFbafaK3OCwCLFU3iK8k4xQSrrXFcHp:o7f1OuLAXyQSrrFyp
MD5:	4BBCF199E6BAAC2489008A646BF59C94
SHA1:	0F8945B336D227533E8CBD46498667BB45978AF8
SHA-256:	9EB85EB251678712E62E87189B8BCAC3797308A135C688DDD3FFF33532EF982E
SHA-512:	3339C7A7D46B4CC9DEE25B0DE2A68BE0FE1C226451AE5DAF7EDC5BD11BB5E84E07B9E90DBA989824B533AEAAF934AA1C688421C990F8C2E2462291022488353B
Malicious:	false
Preview:	clean.mbdb,AB15C1E4541E80E28D71F0C42E011830E86B43DBDAC53C364DE61873E1B3C18E..prot.mbdb,6089FBF0C0C1413F62E91DC9497BEDC6D8A271E9DC761E20ADC0DCCF6F4A0C1F..rdefs.mbdb,E1C7DE8B30104F402627A8D5CC1630DE5B7F0824A6DFA2C91DE1C4A8839F6B21..rules.mbdb,74E70A79556AEA618F8573D1820084CACA400171E02663FD24A8952847127F6C..scan.mbdb,F7BDC60BE1A19A5D0DCD73CDA6F253BE105D7DEA4BE02C9A052E5DEAB912A8AD..tids.mbdb,B5A2C2285DB1A841F3AE323236275976FDECCD8DBBD1E4A9D1B17DDCB243672C..wprot2.mbdb,8A5E8C4A4DA67CB209ED309B871FA4AA1221A58A5C8BB898313F748DA13DD74C..exclusions.txt,9E87E4C9DA3337C63B7F0E6ED0EB71696121C74E18A5DA577215E18097715E2F..dynconfig.dat,008254CA1F4D6415DA89D01A4292911DE6135B42833156720A841A22685765DC..Global.sr,9E9AC3D2ED93A5E4035F4C408558A14144ACC4F6D348A0FE7FA560A1F5656FC5..Global.nm,E88E2E80BFDC35A74DBA07DA5AC4B1A5819F18FC4BBE0C62B6B1CAF825B5F31E..cfg.bin,EBB6BFBCB66F79D34E10C57E70B26AEE5F99E11207E6F103C660B4C2A005F771..

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dbclspkg\dynconfig.dat

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	data
Category:	dropped
Size (bytes):	40814
Entropy (8bit):	3.3297840656455446
Encrypted:	false
SSDEEP:	384:jNOT68xDvtG9ObE7L8u8sXNVkIfvs4FRj:ay8u8KVkIXsWRj
MD5:	10F23E7C8C791B91C86CD966D67B7BC7
SHA1:	3F596093B2BC33F7A2554818F8E41ADBBD101961
SHA-256:	008254CA1F4D6415DA89D01A4292911DE6135B42833156720A841A22685765DC
SHA-512:	2D1B21371ADA038323BE412945994D030EE8A9007DB072484724616C8597C6998A560BC28886EBF89E2C8919FB70D76C98338D88832351823027491C98D48118
Malicious:	false
Preview:	;...-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....;...-...E.J.E.M.P.L.O...D.E. .C.O.N.F.I.G.U.R.A.C.I.O.N.........................................-.....;...-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....;...[.N.o.m.b.r.e.S.e.c.c.i.o.n.].....;...o.b.j.e.c.t.T.y.p.e.......=...1.....;...o.b.j.e.c.t.V.a.l.u.e.......=...".C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.a.l.w.a.r.e.b.y.t.e.s. .A.n.t.i.-.E.x.p.l.o.i.t.\.".....;...l.0._.v.b._.d.i.s.a.b.l.e._.m.a.s.k...=...M.B.A.E._.F.L.A.G._.A.L.L._.F.A.M.I.L.I.E.S.....;...l.0._.v.b._.d.i.s.a.b.l.e.....=...M.B.A.E._.F.I.D._.S.U.S.P.I.C.I.O.U.S. .\|. .M.B.A.E._.F.I.D._.T.E.S.T. .\|. .M.B.A.E._.F.I.D._.O.T.H.E.R.....;.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dbclspkg\exclusions.txt

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	data
Category:	dropped
Size (bytes):	23674
Entropy (8bit):	3.1643905914459673
Encrypted:	false
SSDEEP:	384:OpHJUPIIawosLqVqmv4EHUtVbUQIKiKn6p+C+vNCMSP+TyHS7ivS/6:mYmsGfvSp/6pzgH4cyH9E6
MD5:	AEF4ECA7EE01BB1A146751C4D0510D2D
SHA1:	5CF2273DA41147126E5E1EABD3182F19304EEA25
SHA-256:	9E87E4C9DA3337C63B7F0E6ED0EB71696121C74E18A5DA577215E18097715E2F
SHA-512:	D31D21E37B0048050B19600F8904354CFF3F3EC8291C5A7A54267E14AF9FB88DFB6D11E74A037CC0369ADE8A8FB9B753861F3B3FB2219563E8EC359F66C042DB
Malicious:	false
Preview:	0.0.A.7.C.F.3.B.A.A.E.0.9.5.D.B.F.B.E.4.5.8.2.6.4.E.5.A.A.6.4.9.....0.2.3.3.C.2.4.6.0.C.0.2.0.F.B.7.7.6.8.5.F.5.0.7.0.1.5.8.D.6.3.D.....0.2.B.0.C.3.5.9.F.6.F.6.6.5.7.5.B.8.E.C.1.0.A.7.0.0.2.A.7.E.F.1.....0.3.4.C.C.A.D.C.1.C.0.7.3.E.4.2.1.6.E.9.4.6.6.B.7.2.0.F.9.8.4.9.....0.3.A.4.C.E.F.2.6.C.5.4.4.4.7.3.A.3.F.2.3.E.1.0.A.C.C.E.5.1.7.F.....0.3.E.0.A.0.8.1.2.C.D.D.2.A.D.7.2.6.1.E.A.F.5.3.3.F.7.7.6.1.F.6.....0.3.F.B.B.F.C.5.8.7.F.2.D.6.D.0.6.B.6.F.0.8.5.F.2.E.7.4.5.E.C.8.....0.3.F.C.F.B.E.2.C.8.E.7.1.C.6.0.F.1.B.C.3.4.E.B.9.1.D.0.7.F.9.9.....0.4.6.5.1.6.0.B.9.2.E.7.C.F.1.1.B.D.3.2.2.7.2.6.E.E.8.C.F.0.E.2.....0.4.6.A.7.8.D.2.0.8.8.9.A.0.B.9.6.B.8.4.6.4.6.B.2.E.5.9.7.2.9.F.....0.4.E.6.9.D.1.6.1.3.7.C.2.E.B.4.A.C.3.5.3.B.E.3.F.9.E.A.A.1.A.6.....0.5.0.E.6.D.D.C.4.8.F.D.C.D.4.5.8.A.B.C.A.C.2.A.6.0.D.9.6.7.5.7.....0.5.7.5.F.6.F.E.E.E.5.E.0.4.0.1.7.D.6.D.3.8.4.4.0.E.1.4.4.C.B.F.....0.8.8.e.d.8.b.b.d.1.a.2.b.0.5.e.b.4.6.6.4.5.9.a.a.6.8.c.3.e.c.6.....0.9.4.C.D.1.E.B.F.8.0.A.E.8.D.4.6.6.D.E.A.2.5.B.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dbclspkg\igV5.exe

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1929504
Entropy (8bit):	6.461883146459182
Encrypted:	false
SSDEEP:	24576:7/pw8j0kcU71dHGvPKN8kP95bLS0pBm2L6y1szQGftwuTVHzw8mvkJ:7T0kcOnk88kPt7+zQUZw8mvkJ
MD5:	BBB352DBBF17F6FC29CD86BC1D80A417
SHA1:	1C83C920AE75D0F6E8634804E508E9156F565148
SHA-256:	73DF768292A90E52FCBC5DEDC51F8091083FB6042F4413D69AFEACE1CB0BA509
SHA-512:	12242406306D9808AFB3C9D9D590867F4D116A765D0EC761436B4E272CE456B0B72A5687856D1B6672980FAF4246721D297B0520821D5FCB81D7EAA86775EE5F
Malicious:	false
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......(_.Gl>..l>..l>...X..S>...X...?...H..e>..rl<.n>...h.e>..>V..{>..>V..v>..>V..]>...X..N>...X..m>...X...>..l>...+...W...>...W..m>...WP.m>..l>8.m>...W..m>..Richl>..................PE..L......d.............................E............@.................................r.....@..@...@..............................$....... ............... .......H...........................`...........@...............X............................text...B........................... ..`.rdata..............................@..@.data..............................@....rsrc... ............d..............@..@.reloc..H............j..............@..B........................................................................................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dbclspkg\mbdigsig2.dat

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	ASCII text, with very long lines (512), with CRLF line terminators
Category:	dropped
Size (bytes):	514
Entropy (8bit):	4.004648261705856
Encrypted:	false
SSDEEP:	12:ewoWyzdBYDrEvKsQUJiguICOdT3bOIIik+AV/Ll8NPAX0HflMBYc:eNzdBY/EpZTyIIir6xiPAXufm
MD5:	093666A888763C16D2F02B6EF0E46B1D
SHA1:	422F42C0F9BFE38CB9B3A91F93EEFCC4C81AA5F4
SHA-256:	3978056F6A0E1D4F55104202245202C903398AAB5E6A33C23748549D6A6C4E8F
SHA-512:	E50065A814A484F85A4A32ACE9C06CF1884DFBF3D3F50D6FED6C4254DC80432BDFE402AF9CB24C36C8D75E8A667364FD8B71F0F1A060C75EDFA224BBB5F0EEE0
Malicious:	false
Preview:	2530a222b87f4195d777bce28a2f466fedbfb6b381cd40c3f783f80ee4d9944f633f9fe728cadadd9c0701c9890be3e02c4483cf6688399ddeda8a7dd2681d4ae8e23dacc7323818a89f3c0811bc7f2e56273eb07bb2537b7ddb68681e31202e6bea0a6b598dc8736cf1b1ebd1c0a073a50078e9bb28cb87ec0a4c08933a76ab151e97b2898fd7179c7bf3e5ff271201088b07be64fffcf4e886c197996d4242ead7334407fe63e52ea1798a37a35cd9b14bfbb6251a632d77575bb3e22a7bd5c0067d1fe27d6f49a456dd194e5d2356be06fd3735524f28e20235d9c2b6e24d03733ca8704618af79a89dee7dcb1ddd65c3d6ebc01a851aa97f4cca421633ba..

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dbclspkg\prot.mbdb

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.919372148594611
Encrypted:	false
SSDEEP:	3:cl03Q:cOA
MD5:	546D9E30EADAD8B22F5B3FFA875144BF
SHA1:	3B323FFEF009BFE0662C2BD30BB06AF6DFC68E4D
SHA-256:	6089FBF0C0C1413F62E91DC9497BEDC6D8A271E9DC761E20ADC0DCCF6F4A0C1F
SHA-512:	3478F5DCF7AF549DD6FE48AD714604200DE84A90120B16A32233B6D44FA7240F5F4E5FE803F54B86BBDFD10FA1BFDD88FB85EB6A78E23E426933F98D0A2565EC
Malicious:	false
Preview:	MBDB........x.c```......

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dbclspkg\rdefs.mbdb

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.836038815261278
Encrypted:	false
SSDEEP:	3:cSSKQ:cSm
MD5:	2F7423CA7C6A0F1339980F3C8C7DE9F8
SHA1:	102C77FAA28885354CFE6725D987BC23BC7108BA
SHA-256:	850A4EA37A0FD6F68BF95422D502B2D1257264EB90CC38C0A3B1B95AA375BE55
SHA-512:	E922AC8A7A2CDE6D387F8698207CF5EFBD45B646986A090E3549D97A7D552DD74179BD7AC20B7D246CA49D340C4C168982C65B4749DF760857810B2358E7EB69
Malicious:	false
Preview:	MBDB........x.c```......

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dbclspkg\rules.mbdb

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	data
Category:	dropped
Size (bytes):	9792739
Entropy (8bit):	7.997671993740626
Encrypted:	true
SSDEEP:	196608:NLy02KXVuUAvIv0Bun33vwFA0274c7R9wIflXwMeTVog4iszT+fwZE13ms:Ne02KXoUAvIagfDU2lX/eGgozbwms
MD5:	1C45007940AC110A6521CEA00C215148
SHA1:	241D639D134BCB88DA083CC3E8F42CC4FC9B93B7
SHA-256:	C1ECE900A6AAB8F755B38C36AD8480D9EF685C613592CFB84E0D9B976BACC0C4
SHA-512:	A026929240CA752721FEE312827D912787DDCB44DC1D1B00FDC5116DA81A51DA646B375EC2019CF3C0A9F62075F9A9CB017DE4DF80B4DC8F4E05D7EF5EA2599D
Malicious:	false
Preview:	MBDB........x..w\|..Q>>9.I..Waw.U....(kr.9...i.l...l0.`..&..1&'....lr..`.`._W....yg.....;}..~........~?.....F...G.......3.V.........F.F..b(..I.d.U...n..K#.0.....B.u..h....>.6EG?.....mp..O.w5...&....l....+S...Y.9.....ayHda.........i{..mC7M...r../...wd...q.;i..oE6K&sj=...-_.A.m...a. 3.w..iB.a....ar..fW.eE...o!2.{...D..w...-..._...A.I..`...c/.`@..6......Y.K._\._..../z..lS....LgF.d...6.....C...T~.r.2w..^......N.{s...^....6..g.xN...oMG...)z..JR.8..n0..9..XE~3....}z.p=..._ .J..G..6\|.>...r0.=....diYi.....F...@..6l3.a.c.ie.\|.q.s<..]w_..........2.<...3.h%...a.A4}.;..ofk0@....)..."..8;;v.q..8..Ia.}...\|Yy..k...&.....p4-...a....._..g.M....s...6.nL8...}...M06f....YoV>...M..S..\|.K.Z}h.*.......i.qE....;..mJw......._.P3.e'^y.I(.C..6e;^Vv..6.4...\|N9..@.2. .S.&R.,..?...M....x.;...I.a....\|.......q..)$z......l.3m.H_Z..i.v6`i.m..\|n..;.)=..<^..y.C..s..6$.$...bL.....g....j7.J..\.V}K.Ka.Q.&-......~.....x......8i.Z}.lU.<Ylil((9.....%v.i..mH;.%.-..{.x..a..\.s..,.A..^

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dbclspkg\sampleV5.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	540944
Entropy (8bit):	5.869801499606895
Encrypted:	false
SSDEEP:	12288:oYIAmy9w5vPkTEetmCqryujcqhL0HU5WhjW5w:oY/VJrqhLcZ
MD5:	746DF014F6869285E5545505D5FEC062
SHA1:	52D5F0232B78C0D8746A29E75F80A2B436F38B69
SHA-256:	22047C6EFD6906C64EBB45BF08632220AA82C03D1FE21B79502B0CB7B67B32C2
SHA-512:	58E7A0051CFF72168EC56072339B2A4961A9BC12600A6FE4DD3C01F0AA8B7D22E3D79D72C7EE9A622508E4052EB7C82D047063659C23B34BF93EFF7124619848
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......q...5.U5.U5.Us.AU..Us..U'.Us.@UO.U.&kU0.U5.Ua.U8.AU4.U8.{U4.U8.~U4.URich5.U................PE..L......Z...........!................m................................................9....@..................................q..<.......<........................:..P...8...............................@............p...............................textbss5................................text...[........................... ..`.rdata..(>.......@..................@..@.data...@>...0.......D..............@....idata.......p.......^..............@..@.rsrc...<............j..............@..@.reloc..)D.......F...p..............@..B................................................................................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dbclspkg\scan.mbdb

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	data
Category:	dropped
Size (bytes):	949798
Entropy (8bit):	7.997726238014049
Encrypted:	true
SSDEEP:	24576:1lduP4j+BAE2dAAIxvRGJrHF5B7p+G6W3PYR:1E4Q12cGRdS
MD5:	9E7AD31430DD76A68E40216C63431C8C
SHA1:	30DA69C07884892707D3F8AAF376874BED47F9DB
SHA-256:	11B6D2DAA977237E8389C179D23F4AC90AD3063441EA4EF5F0306BE0A503E221
SHA-512:	4A22F4460746404B1852D7D6CA44D18708FBEFAD5A4172CD0DBA149259DC0EF4D311880B36EABFD80D6B70997F8BBF7C8C561AD2F3A91080FE5B346441D70B67
Malicious:	false
Preview:	MBDB........x.....+[V.+u..n.sV.t:(g.:.s..sP.JI...2.!3.....l..mL0..l..3.....7..m...V.u.s...e....{...U........>...c0.L..........p>y.>..v..L....C.....ra~0.:k..._...F..6..01V..U.>].4U~V.90..__X....[.....}Q"j..._I.b......$\|z...h)..IJ.........>.3......6....t..j..5...`Vz...Fab.45..E-...x...'..w....\|...,Rj6a.9...W.-.%.A..f..M.VL.&/.....~.=2O.:...c.>.g..E_..+.....m....&......LK.;[2^s^.N.../.-,UC5jxm\|.....{{yN..:.-H.{..aUQL..E.]..T.=..LW..Bf.>^.3....[I.{...^.UT.c...}w.>.gX.N..p{....\|......c.....o.`\...o.4XeE.}{.>.gh.....w..!.mGZ....V.x.E.}g................S....H...Ad(.t.S......K.i"~w...q...`..$i%..^..i/}O....bx.R.:..v.Sa..G..a.=.B.9..E.(.i&xO...>l.jW..Z.>.zO......O.M....z..........[Zb.C....=...{...;\|..Q.i.i..Ok...j{ru...V....P.Y..i.~O[.).\Z.;.i.yK...@:..L.N)j..^.......c\|.A_......=...........{WG....5?...F."..M..<.f..m.uQ.. K.>.L...........Lhh2Pl.=.q.A.G....m{..?W{.R...\|..P.(...y.m....<P?....y...0.g......`........9...'y'....O&.\|..~'Ty...7.8.6.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dbclspkg\starfieldclass2.cer

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PEM certificate
Category:	dropped
Size (bytes):	1492
Entropy (8bit):	5.965208387944303
Encrypted:	false
SSDEEP:	24:LrgtDQ2XXkZwdiNLikQLrcXkZraeOpAhscUb862NOI7/JIOhUosXsWHXa9G8KPoR:LriQ2nkuYNOkQPkk5aeOpAhsGN595hU8
MD5:	7FE5FAFC33CE6E6F97E73BC5071BC3CE
SHA1:	9EA40194CD3610F746F9FADEE86D8E57E7905D2E
SHA-256:	64E8C4BF59964857ADCD42001E719C1764A7F060D52B170982504E07BD26246B
SHA-512:	4578F75AA7BD65E5932C9D851299F1EC71BCC6C3E70361A9DF76053532F246E026DE1CBFDFDC8AC285BC5C9EB32FCC39CDCD405995734F3D3256C61CFBAECA09
Malicious:	false
Preview:	-----BEGIN CERTIFICATE-----..MIIEDzCCAvegAwIBAgIBADANBgkqhkiG9w0BAQUFADBoMQswCQYDVQQGEwJVUzEl..MCMGA1UEChMcU3RhcmZpZWxkIFRlY2hub2xvZ2llcywgSW5jLjEyMDAGA1UECxMp..U3RhcmZpZWxkIENsYXNzIDIgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMDQw..NjI5MTczOTE2WhcNMzQwNjI5MTczOTE2WjBoMQswCQYDVQQGEwJVUzElMCMGA1UE..ChMcU3RhcmZpZWxkIFRlY2hub2xvZ2llcywgSW5jLjEyMDAGA1UECxMpU3RhcmZp..ZWxkIENsYXNzIDIgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwggEgMA0GCSqGSIb3..DQEBAQUAA4IBDQAwggEIAoIBAQC3Msj+6XGmBIWtDBFk385N78gDGIc/oav7PKaf..8MOh2tTYbitTkPskpD6E8J7oX+zlJ0T1KKY/e97gKvDIr1MvnsoFAZMej2YcOadN..+lq2cwQlZut3f+dZxkqZJRRU6ybH838Z1TBwj6+wRir/resp7defqgSHo9T5iaU0..X9tDkYI22WY8sbi5gv2cOj4QyDvvBmVmepsZGD3/cVE8MC5fvj13c7JdBmzDI1aa..K4UmkhynArPkPw2vCHmCuDY96pzTNbO8acr1zJ3o/WSNF4Azbl5KXZnJHoe0nRrA..1W4TNSNe35tfPe/W93bC6j67eA0cQmdrBNj41tpvi/JEoAGrAgEDo4HFMIHCMB0G..A1UdDgQWBBS/X7fRzt0fhvRbVazc1xDCDqmI5zCBkgYDVR0jBIGKMIGHgBS/X7fR..zt0fhvRbVazc1xDCDqmI56FspGowaDELMAkGA1UEBhMCVVMxJTAjBgNVBAoTHFN0..YXJmaWVsZCBUZWNobm9sb2dpZXMsIEluYy4xMjAwBgNVBAs

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dbclspkg\starfieldrootcag2_new.cer

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	Certificate, Version=3 Certificate, Version=00
Category:	dropped
Size (bytes):	993
Entropy (8bit):	7.262246702070581
Encrypted:	false
SSDEEP:	24:jM1niUl251niUlZ7iXNFf0fKG3cBf3KA0:YniU4niUzinoEfaA0
MD5:	D63981C6527E9669FCFCCA66ED05F296
SHA1:	B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E
SHA-256:	2CE1CB0BF9D2F9E102993FBE215152C3B2DD0CABDE1C68E5319B839154DBB7F5
SHA-512:	5FADA52FF721F4F7F14F5A70500531FA7B131D1203EABB29B5C85A39D67CF358287D9D5B9104C8517B9757DBA58DF9527D07DC9A82F704B8961F8473CDD92AE7
Malicious:	false
Preview:	0...0..........0....H........0..1.0...U....US1.0...U....Arizona1.0...U....Scottsdale1%0#..U....Starfield Technologies, Inc.1200..U...)Starfield Root Certificate Authority - G20...090901000000Z..371231235959Z0..1.0...U....US1.0...U....Arizona1.0...U....Scottsdale1%0#..U....Starfield Technologies, Inc.1200..U...)Starfield Root Certificate Authority - G20.."0....H.............0..................o[.H.y..aV..G...=5..C..i..... ..Iw2)V....".r.'a...Z..n...,.[.t.k_...R.FU..u....T.K.UrW....qY..(.t.H.l.....d7y...F^..mSLb....c.:...y..at.&.@c.rj......u.7....Y.b._._e0...MvZ.v^4..V........21\|..._..k.I\....c[.v.Vb.Kt...&...Y.................B0@0...U.......0....0...U...........0...U......\|.2...0..}h.b....['0....H..............Y.%O.o..;....9.v..^.(.mb]....u8.4j...&Q.,..-n. J...g{1.g....&.C.J1.......7."....{R.k.;..yQN..g...<Fz..}.X.m.0..$...........B.7..dY. w8.2>8.u.s.h.........~.~...-.......J...(...Tx.!q..}.....a=..."..{..dE.;@..}\|2...X.}.Ysd.6t^%..f...9..*.P...i.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dbclspkg\tids.mbdb

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	data
Category:	dropped
Size (bytes):	174079
Entropy (8bit):	7.996320887729739
Encrypted:	true
SSDEEP:	3072:IZDHlfWrUShtc5N6roxVEjKRatcxlWuZUIlhzw2DhBrRFCV7YdDbvAQLtyEdaxpd:mDFXS87xGcx1jw27FAADHLwEExpvbR
MD5:	3155B1467DC98CA6808179A322DEEB19
SHA1:	D33D17687177D97F06D8FBA15A93C1CD0FA8295A
SHA-256:	5240A25DE1A184F85245BCEE28E0D4E146AF9E89EB675F38D5440D59F2D4B656
SHA-512:	A0B65EAD4849D057767CC7CFA54656A482AB3294EEE799D92DC1BA09BA8EFFCBA742D3EABCA838606A66CBEFC94EDFF72E7D03D39A805BBB31C2B23E158421FB
Malicious:	false
Preview:	MBDB........x..}.x.]ux..{.H.. .0.L...a..H.d..I.p.].j.u.j.jm.V...V..:..j...m....\.O...=.....=....s...,/.////?/._#..%......)S.U..9...>.........p..J.lR.`R4..5...$.@!..u..6...)a.N.S..{.....X..[.......X....d..s1..q.2....85.=k.r.f.Q=@.<.rw.h.v....-e!k.!..m...........g...Y.>....T........r......q..4o.H.[...J ....z4?........~.7._....?%.Y._...v.L5...y...T.....c.Z.\...a.^....D.....-.?.q.j...j"..aV7....).X.sBi.d....n.My,V,.V....^6`.d....\|A..Ls.Y.g~m..U....\|.0..b..0r..m?mO.........e'E1.G..b.h.q...i.X..ix^<o...h.)......,_..&...@4..h..L.1..C..I.8..rV.04...ta.)..H.J..Tm.z..H..Hx.. ......p.A.~....e...C.....C..[...q0\....# b.&.Z2=..:x..3nC.1L..}.,.\|+.+.....6...(_..W.........h...........`.cZ....v%.;!......e...at..k.Z..z....2.0...b.....!L !'..... ..Y.dIiR.........7.B.>..yu......<...#&.p[....../...+ga*.Q.i.!...z.ss9.+I...'xS...@..J....-.....i(Z.4.}gj..w5.CxY.........`.....h......y..e5..G...#.T....Y.L.l"..~%....r.."..%..=....QqB.0#$M....m.U.6F:6..Pu....xA

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dbclspkg\version.dat

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	3.3206799482799565
Encrypted:	false
SSDEEP:	3:SVdRUoPnVmSL4yFBLVmSL5/LRVy:S9x04XBA45DRVy
MD5:	241090F6BD8F3FC3A98BC6C0A3238907
SHA1:	4035706A3575A318D7C92A0D74C17EA467DA619B
SHA-256:	62E747FAF98BC4E0CC36D926663A7AB5CE61EAB59FAA8ECC03923B699DF26258
SHA-512:	8FB4F1C5BF59F72E84ADA1A914195E21782F59FE52C402BAC6423D616616DF8A1777D0AA5F5DEC26D12FFF53C4073942E416E8A2DCC7E37366EDFE7E0B4226DD
Malicious:	false
Preview:	1.0.83541..2024.04.17.07..2024.04.17.06.39.40..

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dbclspkg\wprot2.mbdb

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	data
Category:	dropped
Size (bytes):	31928162
Entropy (8bit):	5.8702115727779915
Encrypted:	false
SSDEEP:	393216:seOalzZwaOu0v1Lqo7vU1h2DwghUAa/uT+DhrNO0s9Y3kAHyDn/keCbW026RcVFd:soGakv1LqojNe6EFj0Kknb87bNQs6H
MD5:	93A2FEF2287EE51CB0AE5D4002C89D4C
SHA1:	80A111C11405DEC10ABEA63B710BFAA6B90E3378
SHA-256:	8A5E8C4A4DA67CB209ED309B871FA4AA1221A58A5C8BB898313F748DA13DD74C
SHA-512:	EF180FD72EB91ADE35FD098DA408A682C251AE76B4E414B2A848E0AF746AE23EAA9355A572D9F58035EC4CCD36688324E25F8874AD8E2A8C7138D9F0FB10375C
Malicious:	false
Preview:	MBDB........H......................,...............:...........;~{Q...............................................................................................................................................M............."...........................&.........................................X...........................r.........................../.............0.............:.........................................................................................................................................................&.............e.............\|.............................................................................................................................9...............................................................................................................1i............@k.............n............wq.............q............7u............Bu.............w............p.............m....................................................................d...

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkg.7z

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	7-zip archive data, version 0.4
Category:	dropped
Size (bytes):	48912644
Entropy (8bit):	7.999994378611479
Encrypted:	true
SSDEEP:	786432:3ZhJo2mMRosH0/f+JY4uBGehVfOfPbiDagy8fYZN+6K1Kzv4xNqxY+907Swe4o/v:33JzmMasH0/fx4uBBhVfobi/uN+51Kzh
MD5:	5B9C2C0CA079EA2F33181A1EF938CA40
SHA1:	D4E456AE18E4B9AE9D3620DD3D05709227864784
SHA-256:	9203534662B070BF179ACB3D078A8E83A3C9097EDE6555C6DEB59A0BDB5383F7
SHA-512:	19D322A67481F5FC243E0DCEAB0231DEC47AEDFB72FBD9D20AB5ACB9137B360B8C4F15AC5887251BB16982257A32D569129DC5433149905EE729F20AD269A4B3
Malicious:	false
Preview:	7z..'.....4..X......&.......h3...M..]..........RY......@.?...O.V,....Z.n.+&...?M._.8.:....yJ.\|...<R......u\|4.."~({...2..Q[............A.)...n.....C..soN.?T.T.w.^W.2~....q........g(Cqn..e...'w......w......pdF....;..........Z^.ZP.."....C...h...._<.}\..{q.-.....H...L3...9..<.3.9 WH.!.2.h.\|..d..!..c&t........U... YN........um...h^.Xc.?..%..pA...7y....9$i.1...Q)p;LPX.Q...+. ...._..=..2.3^.i......`....BX...v$....)..)wji6...p.0.EP.ri..........)\|,.$w.n.8.X.j...C..GG.?y3.b..........%%..w.a.Pp.k.y#.7X7..;...5.\|=).X!.....X.._.....EFJ.`(....&.......i._e....h.x.....c....lw0......&A8hx......i.K.Q...F..>[.h.KA..}.R>Z..R......V$.>j...K.........0.Mw..c...+#b&.h.H.s.{t..XL...zG.:.=9.B1....M\e...'./!...y...%:..d..a.X..MT.f z.....u.9....';hV.Z.{...D..C.(2.iw..F...W..Xj+.K.yW......h...........=oD........T>....`..>.\|9....i..4!...............\|.t.s8h~...9...{...>....7H.A..o...M..?k@...fQ...O....3V...0n<..Q;I<...].W....r.......s..lKH{.]#F...Ol.....m..8.X..

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\MBUpdateDlg.exe

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	393784
Entropy (8bit):	6.122019273927788
Encrypted:	false
SSDEEP:	6144:I8ZHqvWJjljPdtV/DwIzGZMBV85jjXaAOQtOGXpgh:Igq+7jPd/DwIzE5jjXa9GXpgh
MD5:	05C4054BB9249EF9ED229A0095428A4D
SHA1:	E0D1F1FBF5F4D2AAD192F115271F571CD2A3037A
SHA-256:	05749E32B65607F565ABC4E0B138C55F76B0FB8E68F48A2C90D75A0FBCA23852
SHA-512:	2E1AAE0B723F83023411FFEDBBD5F0F4A3C476A980EC43A9AC9CE387C2EEEB78738D35364A12E552CB3606CDE16DA13E5F5C2CA0B39606E4731FE0F6BEBD5652
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......(..albe2lbe2lbe2..f3abe2..`3.be2..a3zbe2>.f3ybe2>.a3Mbe2>.`3Sbe2..d3gbe2lbd2.be2..l3nbe2...2mbe2lb.2mbe2..g3mbe2Richlbe2........PE..L...xd e.................L...D...............`....@.................................0w....@.................................0\..x.......................8~.......#...9..p....................:.......:..@............`...............................text...~J.......L.................. ..`.rdata.......`.......P..............@..@.data...\....p.......V..............@....rsrc................f..............@..@.reloc...#.......$...`..............@..B........................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\host\fxr\6.0.28\hostfxr.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	378544
Entropy (8bit):	6.299979367064144
Encrypted:	false
SSDEEP:	6144:XxMgmypv7OFU6mJ6x+29QenH9YkAPPpDoiXLPlO:m1FU8x1HXkpDoi7lO
MD5:	F0D1237749276AF278C16A5ABF3D8CBE
SHA1:	F36C0FDF6E2FAC12CFA5B1A41FFBF721B6F9DB1F
SHA-256:	2DA617103148E957C8F1DD02C60CF69549B76179D71C143D2245C3502DE115CA
SHA-512:	A0472E1909754E9019DC4D978BEB93E5AEF931A5FFB37B753CD88F2B1DBB0E866C687246C9EC3231362630DBF098E0727997A47CD90BAC308A520391311FA36A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........$.j{J.j{J.j{J.8.N.`{J.8.I.`{J.8.O.%{J.c...x{J...K.o{J.j{K..{J...C.v{J...J.k{J.....k{J...H.k{J.Richj{J.................PE..d...R..e.........." ................0................................................$....`A.........................................O......\R.................../.......(..........0...p.......................(.......8............................................text............................... ..`.rdata..@S.......T..................@..@.data........p.......V..............@....pdata.../.......0...`..............@..@_RDATA..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\mbupdatr.exe

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5994624
Entropy (8bit):	6.89722018049946
Encrypted:	false
SSDEEP:	49152:L7xuJR/ZzSIHwWhQi41XN056KdctnRqCjuUjKxxaBfNYqbVAtIyetVPyZXVYLZ1N:LRWmRxeqxAqztEYfGQJaQzaeT007kx
MD5:	527B1221805146D404D0A6DF5D9BA560
SHA1:	F316DC9D5F2B9A6831C312A9ADF20B6B29FB809E
SHA-256:	8850EB71BC4950DA777ED369D60772F07D10CF496D276CA89E8837CB8D75C804
SHA-512:	536B4936247820DB6F1F7ED15E4A0391BDF2ED0C3AD5E123FD093204B43C404E5D8964520D2698DD8480F637200E1E8F250A3E89838887428955580BA2E5BDFD
Malicious:	false
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......aU..%4.%4.%4.nL."4.nL..4.%4.$4.#..64.#..74.#..I4.nL..4.....6.%4.36.nL..4.K...4.K..>5.K..y4.K.%.$4.%4M.'4.K..$4.Rich%4.........................PE..d....q.e.........."....&.x1..p(.......$........@.............................0Z.......[...`..................................................F...... K..h....H.4E...zY.......Y.......B.p.....................B.(.....A.@.............1.P............................text....w1......x1................. ..`.rdata...>....1..@...\|1.............@..@.data.........F..x....F.............@....pdata..4E....H..F...4H.............@..@_RDATA........K......zJ.............@..@.rsrc....h... K..j...\|J.............@..@.reloc........Y.......X.............@..B........................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\.version

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	50
Entropy (8bit):	3.990435500513582
Encrypted:	false
SSDEEP:	3:W9znh2WdW0HXOr3WyBE:W9zUWPSmyBE
MD5:	01D59FE06F419943AFA2DF7A0D00E053
SHA1:	7508DCE616C1E0335E975246B697717FF975B5F8
SHA-256:	46F5B2DA50E46E90F23675C26E534759DDC1CEE3DCB2406D27C739C33E9E190B
SHA-512:	31DEBF9B2A63DEABB3C2F8D3106F4B6B1738BFF2771BF5AC343E5C75873CCC63ABE226DAD9202769254B2FE34411249C6FCA7BC30D2FC52497ADF2C6ED09A2CE
Malicious:	false
Preview:	34a109148c7d8a2c8e6431e83e4bce5712dd8083..6.0.28..

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\Microsoft.CSharp.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1042720
Entropy (8bit):	6.757688741461009
Encrypted:	false
SSDEEP:	24576:rfqYI005n3VY+u1xjx1J+Vu9yHbzsYdhdi4YBqxLsY:rC005nFELlT+Vu9yHRXiZG
MD5:	3DA7773C446874163FA596FED2E1C046
SHA1:	634F2794AC5087E569D275DB9DCEBEC43F438BEF
SHA-256:	65B8B2EC4D0DF5CCEC5B5BC56C5BCCD6F129AD619E08DA0E054D42C3C8484DF7
SHA-512:	3E2E5E3C8606E5563ABE560B90A856518EE7D73B5335B5885A996BBDA81EB832E698C74459706F8CD00125C59DB9C89FAD4BA7E61C50B39D5F1E913143F7B60A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....p..........." ......................................................................`...@......@............... ......................................$6...j...... )......<...pD..T...............................................................H............text............................... ..`.data...D...........................@....reloc..<...........................@..B............................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0.....d...C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\Microsoft.DiaSymReader.Native.amd64.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1841048
Entropy (8bit):	6.376188477077184
Encrypted:	false
SSDEEP:	24576:qz0s9kT3H8I0bo5rjwjnbRCJMy37DjZ3IrVynoT/RUqtMAIEohkGXTwImgP:qYs9m3H5rjQn1CiAnZ3yV+oTZQEoTTH
MD5:	804B9539F7BE4ECE92993DC95C8486F5
SHA1:	EC3CA8F8D3CD2F68F676AD831F3F736D9C64895C
SHA-256:	76D0DA51C2ED6CE4DE34F0F703AF564CBEFD54766572A36B5A45494A88479E0B
SHA-512:	146C3B2A0416AC19B29A281E3FC3A9C4C5D6BDFC45444C2619F8F91BEB0BDD615B26D5BD73F0537A4158F81B5EB3B9B4605B3E2000425F38EEEB94AA8B1A49F2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......._.+7..Ed..Ed..Ed..Ae..Ed3.Fe..Ed3.@e..Ed3.Ae..EdI.Ae..EdI.Fe..Ed..De..Ed..Dd.EdI.@ea.EdI.Le..EdI.Ee..EdI..d..EdI.Ge..EdRich..Ed........................PE..d......d.........." ................0~...............................................(....`A........................................0...p..../..P.... ..8.......D'.......'...0...K......T............................n..8...................P-..`....................text...L........................... ..`.rdata.............................@..@.data........@...F...,..............@....pdata..D'.......(...r..............@..@.didat..p...........................@..._RDATA..............................@..@.rsrc...8.... ......................@..@.reloc...K...0...L..................@..B........................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\Microsoft.NETCore.App.deps.json

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	32962
Entropy (8bit):	4.2902876314380585
Encrypted:	false
SSDEEP:	768:+z5YVEsIhKPMEPrT3XCGjDyiEc6BHa21Fe8kFN92uwtEeCJyU:gCVEsIhKPMEPrT3XCGjDyiEc6BHa21FC
MD5:	07727A09A6755587AF5C36B1E9323B7F
SHA1:	FE0127CA1BFDCE14D2A5FE023A0F08194DDCA741
SHA-256:	CF55FFDEC498D05F93EC8ADFF7CCF2AD64499BA89A28C64FD14C60A26BD28AB1
SHA-512:	4AA6F5D8A4E5523BA363C38AB81BBAA1E35434B5FEDF2E06FE4E04B8AFF712498D6090CB704CBEDE346A772F0C8DED23752EFF35404332082D66A7F7A005C338
Malicious:	false
Preview:	{.. "runtimeTarget": {.. "name": ".NETCoreApp,Version=v6.0/win-x64",.. "signature": "".. },.. "compilationOptions": {},.. "targets": {.. ".NETCoreApp,Version=v6.0": {},.. ".NETCoreApp,Version=v6.0/win-x64": {.. "Microsoft.NETCore.App.Runtime.win-x64/6.0.28": {.. "runtime": {.. "System.Private.CoreLib.dll": {.. "assemblyVersion": "6.0.0.0",.. "fileVersion": "6.0.2824.12007".. },.. "Microsoft.VisualBasic.dll": {.. "assemblyVersion": "10.0.0.0",.. "fileVersion": "6.0.2824.12007".. },.. "mscorlib.dll": {.. "assemblyVersion": "4.0.0.0",.. "fileVersion": "6.0.2824.12007".. },.. "netstandard.dll": {.. "assemblyVersion": "2.1.0.0",.. "fileVersion": "6.0.2824.12007".. },.. "System.AppContext.dll": {.. "assemblyVersion": "6.0.0.0",.. "fileVersion": "6.0.2824.12007".. },..

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\Microsoft.NETCore.App.runtimeconfig.json

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	159
Entropy (8bit):	4.54941695087313
Encrypted:	false
SSDEEP:	3:3Hpn/hdNxDI/pANC+KL4nNOcW3mJAGRM3Bojqy2VKXmHEk/FTy:3Hp/hdNyhAk+Q6NOCUo+K8EkNTy
MD5:	3FBD84A952D4BAB02E11FEC7B2BBC90E
SHA1:	E92DE794F3C8D5A5A1A0B75318BE9D5FB528D07D
SHA-256:	1B7AA545D9D3216979A9EFE8D72967F6E559A9C6A22288D14444D6C5C4C15738
SHA-512:	C97C1DA7AE94847D4EDF11625DC5B5085838C3842A550310CCA5C70BA54BE907FF454CA1E0080BA451EACFC5954C3F778F8B4E26C0933E55C121C86C9A24400B
Malicious:	false
Preview:	{.. "runtimeOptions": {.. "tfm": "net6.0",.. "configProperties": {.. "System.Reflection.Metadata.MetadataUpdater.IsSupported": false.. }.. }..}

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\Microsoft.VisualBasic.Core.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1245872
Entropy (8bit):	6.768148807139317
Encrypted:	false
SSDEEP:	24576:PrJvgxhKMUjH0tmcXwORVYljCi1Io+BGw:1vgxsMGHwmcXwiECiy
MD5:	77E3002D7B2881FA54D2EA4CFA20F95A
SHA1:	F161E5F050530DFCAA4B97E9F621C55360B14417
SHA-256:	57E93A089F72C2D594245DD7008E1104E57DD652E19277613BC533E972918C15
SHA-512:	67670EFF2458B6B25F4F948B33F75E16A544F946AC59EB3CF2C470E317F2CB44FAB30BE98A89D9A51194F9C5542A11627AD7D4BD8350C5E3D4C680DAF9F2AA1F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d................." ......................................................................`...@......@............... ..................................L........k.......(......l...xD..T...........................................................P...H............text............................... ..`.data........ ......................@....reloc..l...........................@..B............................................0.......................<.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............d...............?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........R.....S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0.....d...C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\Microsoft.VisualBasic.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18080
Entropy (8bit):	6.562156927188529
Encrypted:	false
SSDEEP:	384:R9SphH3cMPebxWmH6z9QdW3Tb2HRN7vb4DX+iR9znr:RkHMMP9L/iEDuO9zr
MD5:	F7F572E9AA88B0F96E57C1410BA2119D
SHA1:	4FBE0217D6324EDBD4D3C1A1666D858CAD65E609
SHA-256:	0E471104B7D7F6AC1F0978F111E2E2E382BC6091B09F200491D1ADD0196F3971
SHA-512:	05A4DEA691DB5F4A7A17FD4E004813396DCB28E056085032DD84F34837EFB613782D177221D4FF8FFF92252EE130E75B5BCB42C87AE59525CFE6B857B48BA525
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...J. ..........." ..0..............2... ...@....... ..............................7#....`.................................{2..O....@...................(...`.......1..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................2......H.......P .......................1......................................BSJB............v4.0.30319......l.......#~..p.......#Strings....l.......#US.p.......#GUID.......H...#Blob............T.........3....................................K...............2.................<.....d.J..........."...~."....."...}."....."...}."....."...d.".....".....x.....x.............................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y......... .............

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\Microsoft.Win32.Primitives.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	26272
Entropy (8bit):	6.548921679471847
Encrypted:	false
SSDEEP:	384:zWhPgpWGZWnjmMDQnqyXhvuoNbOOTb2HRN7gdDX+iR9zn05:x8jm5n5XhXZ/igdDuO9zq
MD5:	4E2AE57D38ABCC88D1478BE24CD89D1A
SHA1:	09868A07C1C3451AC2D6808BB3FDCA26818EEFA4
SHA-256:	6CE159CE103ACA32DFEDF744A63B9BAB2817E9531BF17EC6978AF2BEAE603A36
SHA-512:	0120E77198D199E5457243A12097863F6C92781C29BCC285636311E8A34ECA1B6D3EB31B7CD65E2AC2160B52C421400238495C7FA2AFF9B708076EB4015955D1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d..._............." .....4...................................................p......v.....`...@......@............... ..................................D............>...(...`..\...8...T...........................................................H...H............text....2.......4.................. ..`.data........P.......6..............@....reloc..\....`.......<..............@..B............................................0.......................4.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........L.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...(.....0.0.0.0.0.4.b.0.....d...C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\Microsoft.Win32.Registry.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	87728
Entropy (8bit):	6.606106579085083
Encrypted:	false
SSDEEP:	1536:rE9Ecxml5OdJKCILek2ymrsykEomWxGsViIo5Kkbq2pzs:rE9EIml54JKCdy5ykE8xGsViICKsJ4
MD5:	0680865251C89DC27994702031C6802E
SHA1:	5A4368E6350BE9DBA5EF8B5D67ABA2A6A69F58CF
SHA-256:	236973AFB760569525401D580E1A65428F4D8751D4231580BBE039C7CEF609D0
SHA-512:	8628CB272CC0B73C8DA87E2CCD5E31502ADC44BCCDC09764B66BD59B9552AB221305820FF70CC07DD06C9AF747E02C7376BEC4CE3D26EEC9FB066E908E650BB5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....?..........." .........................................................`............`...@......@............... ..................................8...p............(...P..........T...........................................................8...H............text............................... ..`.data........0......................@....reloc.......P.......,..............@..B............................................0.......................(.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........@.....S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0.....d...C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.AppContext.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15536
Entropy (8bit):	6.778391190306693
Encrypted:	false
SSDEEP:	192:gBGVGxxB4waW+m7WJ3WT56Os1HnhWgN7aIWfiiWo7bTseUfX01k9z3AfdClO:gBVrzaW+m7W85kHRN7tvq/6fR9zcolO
MD5:	1C90F8FD718678DEF7E9BF2D3C9DD6A6
SHA1:	3D63C0322970DF9790C0D90CF39B83207880BA58
SHA-256:	4636EFEB4149BF4D2D123465F876A6202D530B28E5E6096B714C9348469D6673
SHA-512:	23ACB7F732522086483B99DF08BB03EF1BB1E5E93425BFA361A3BFC17169D5B3F3344D3206CE367D8A7E66DC3321875ECDBCCF0A2D18816D22E8CC959D904613
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................"!..0.............^)... ........@.. ..............................kg....`..................................)..S....@..h................(...`......d(..8............................................ ............... ..H............text...d.... ...................... ..`.rsrc...h....@......................@..@.reloc.......`......................@..B................@)......H........ ......................P ......................................O.Luq.........;.r.u.F......K.NS..j.v.k...Y..e...`O..D.GUNg....7.zPg......8>.{...e....NBS~.....:\p..../.6...,..Sm....>.W..pBSJB............v4.0.30319......`.......#~..,.......#Strings............#GUID...........#Blob......................3................................................".p.....p...;.>.........f.............Q.....Q.....&...!.&.....&...[.&.....&.....&.....&...B.&...O.&...v.p...........

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Buffers.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15520
Entropy (8bit):	6.763491460156783
Encrypted:	false
SSDEEP:	192:RRU0eWYF2WycuWXebPpUNTQHnhWgN7acWCpsjDoSJj+iX01k9z3AgI4gf5d:RteWYF2WycTb2HRN7lkDX+iR9znafj
MD5:	8884C36C39DCA0C887E82CBE30E8DDED
SHA1:	392DF6E6848B4E88FA922006BF5496102D659884
SHA-256:	8736D2F36A2154062C048CD35FFD5B2F33F29BCCB9109699A3FD2045A08624EF
SHA-512:	88F0D12D67876C09313483B1A4B0FD87EACDDADCEEA96219CF768F278FC90683A38CB16BE4475AD4988FFA3E9093362C6713AC07CFEC4391437FD529ADDE2B68
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...o.`..........."!..0.............^)... ........@.. ....................................`..................................)..S....@..X................(...`......h(..8............................................ ............... ..H............text...d.... ...................... ..`.rsrc...X....@......................@..@.reloc.......`......................@..B................@)......H........ ......................P ........................................B8..q............q.Jm.......+.V.1&.3Q..i.U.1e.}....J..S.W..c..L..[0.u{....R0.*....s..Z.W..83b[...F80...k..YX..............BSJB............v4.0.30319......`.......#~..,.......#Strings............#GUID...........#Blob......................3..................................................y.....y...G.G.........r.......(.....Z.....Z...../...-./...../...g./...../...../...../...N./...[./.....y...........

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Collections.Concurrent.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	246944
Entropy (8bit):	6.847843545590775
Encrypted:	false
SSDEEP:	6144:PrgyviXtNUJvj7tDM6lqhORjXyikbyO2eGJ0pebr+:P88JvqoqKkbD2pier+
MD5:	6396FE89DB7776D8FEAF334B28CD09D0
SHA1:	71E0218CF72751665F2210BC56AC99D211F07ABB
SHA-256:	AC0B6DD11EFCEF49A9545D9F7D3B705995E8E16DC31CB7581ADA2D6A1144D96C
SHA-512:	6DF6B0A94AA24B3E29AA31E550B82BCD227C8FD3ADE33EBF2D495BA9031BA4FCE45F7F36D479642AC769AAD773565DD6D5E03D937AF3E8848D17702A8974A8A1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d..............." .....`...:......................................................4.....`...@......@............... .......................................e...........(..........P...T...............................................................H............text...._.......`.................. ..`.data....5...p...6...b..............@....reloc..............................@..B............................................0...........................l.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...T.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...C.o.l.l.e.c.t.i.o.n.s...C.o.n.c.u.r.r.e.n.t...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...d.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Collections.Immutable.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	666272
Entropy (8bit):	6.786218835472923
Encrypted:	false
SSDEEP:	12288:/36sIowhW4GbwaoBFavXz66M4cR+cr/oMyx6o1v:/3DJkaHey3l
MD5:	042D3971DEDEEA37C7B5FAA7C8184A86
SHA1:	41751CDAE6668674B6E54CB510FF6CEFC95F6FE1
SHA-256:	DE91B256B671390487FBFCA7377E0B995FF8188EE6164E7DB54723A1E116394C
SHA-512:	250FAA1D14DDE3A35F73EE3CDA5686388309FEBF327D6800C0CD7E5EEAD9B562A7EA4B34984FEEC9E9615AE1DA5B1A1DF2BDE49BED8FE8236C6EC71353C6ABAB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d................" ......................................................... ......h.....`...@......@............... ......................................4...P^.......(...... ...."..T...............................................................H............text............................... ..`.data...:.... ......................@....reloc.. ...........................@..B............................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...v./...C.o.m.m.e.n.t.s...T.h.i.s. .p.a.c.k.a.g.e. .p.r.o.v.i.d.e.s. .c.o.l.l.e.c.t.i.o.n.s. .t.h.a.t. .a.r.e. .t.h.r.e.a.d. .s.a.f.e. .a.n.d. .g.u.a.r.a.n.t.e.e.d. .t.o. .n.e.v.e.r. .c.h.a.n.g.e. .

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Collections.NonGeneric.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	101024
Entropy (8bit):	6.472542521394287
Encrypted:	false
SSDEEP:	1536:g6PNUxgnikL/XcEL/MTWsXRTk+Uf6gD+XBQCQeJwLDrG2kFifzA:g6PNUxgJvRQWsBTkyo+XBQCQeiLDrl0
MD5:	0EEE81985114E7ADCDE8B783491C1805
SHA1:	5DBDEF425BAD7D8ED447A4F20C2C4B8D91451575
SHA-256:	FE9E0451B80FBED70892C487BC649ED616A5E393650D2C0EE8795B335CAA390E
SHA-512:	4629048F03AFDCB88F49496CEFD740CF16FE1041CF82D121413B26745CAF4BE19ED743531DE327F8905E5878820DC5084243A456E40AB5DAE4FCA08849A7925D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....lW..........." .....L..........................................................%f....`...@......@............... ......................................83.......b...(..........X...T...............................................................H............text...@K.......L.................. ..`.data........`.......N..............@....reloc...............`..............@..B............................................0...........................l.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...T.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...C.o.l.l.e.c.t.i.o.n.s...N.o.n.G.e.n.e.r.i.c...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...d.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Collections.Specialized.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	95392
Entropy (8bit):	6.5307721247780215
Encrypted:	false
SSDEEP:	1536:NIPjcOLBhPvoiTCxaDVvkDTC5O7/LyY20WhhpVeypvi9zF:NeQWBZNBsDTs+zyY20WhhpVeych
MD5:	7CA9006429B2F2981FB8F561473DBE73
SHA1:	98D0D7F82A57610242C2B85DA28C02DAF16A52B8
SHA-256:	F6760C7F123E1C6DC9254BE65257E8597BE39D89C495061603F010EAA8D2BF7F
SHA-512:	804E1DC0B3C4415EB454907B9CBC56EAC3267AF7A849673A2E1A00EFA1AACAE5FCE416089EE54C223F8EFA5B6D72CACCD08FB8031D52802051CF083ADF05A752
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...Ov............" .....6...........................................................o....`...@......@............... .......................................0..h....L...(...p......P...T...............................................................H............text...x4.......6.................. ..`.data...\....P.......8..............@....reloc.......p.......J..............@..B............................................0...........................\|.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...V.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...C.o.l.l.e.c.t.i.o.n.s...S.p.e.c.i.a.l.i.z.e.d.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...f.....F.i.l.e.D.e.s.c.r.i.p.t.i.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Collections.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	264864
Entropy (8bit):	6.760026558978079
Encrypted:	false
SSDEEP:	6144:90bzX+JuwscnkH2KrzQ5t056pAje2l3kK7CLq:97JuwDkHQNWf7CLq
MD5:	DDEF4FEECB2CC7AB2F7283EE4064737B
SHA1:	3E70BF78C26E427291A0A4F6500BC29CEA3B2B82
SHA-256:	32847C6BFAE4060C2B4E51F27986778826D930D6FD401BE285B602FC44F6FE98
SHA-512:	171F5D03CE690905355C3A2DF9D5D2971AD466C73E390350CDB7310B9CCAF1D9FFDC0AA39544ABA4CE9A99E34B81DD084E9D205DFE1E9305CD319048240ADE49
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...Yu............" .........@............................................................`...@......@............... ..................................t...,]...........(......,.......T...........................................................x...H............text............................... ..`.data.../9.......:..................@....reloc..,...........................@..B............................................0.......................d.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........\|.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...X.....0.0.0.0.0.4.b.0...>.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...C.o.l.l.e.c.t.i.o.n.s.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...N.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.e.m...C.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.ComponentModel.Annotations.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	187056
Entropy (8bit):	6.459693288484151
Encrypted:	false
SSDEEP:	3072:huP/px29rZwFmfLvXF8IbGumTG5D5/vbF6i+F7SWYD4dN:MXpM9reF41QG5UF7Bk4b
MD5:	6D95D03CEF6FF41E06D6E14773A3E473
SHA1:	928FD0EB55917B6DC04E7B945B862CE12D77E546
SHA-256:	DD3862179E64841CDF2019D1D1E051416C41CAA09DEAF06E821680DF1CEB861B
SHA-512:	0109F17944E28E934A87E8CB26E81B5F4D8433AF5F3B4B35765FDB66979A374F492868BCA6AD97952B0DF163914D4E3A30640B5268BEB57E5BBEF83A673479DD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....&..........." .....v...:......................................................,.....`...@......@............... ...................................... G...........(..........("..T...............................................................H............text...*t.......v.................. ..`.data...a4.......6...x..............@....reloc..............................@..B............................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...\."...C.o.m.m.e.n.t.s...S.y.s.t.e.m...C.o.m.p.o.n.e.n.t.M.o.d.e.l...A.n.n.o.t.a.t.i.o.n.s...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...l."...F.i.l.e.D.e.s.c.r.i.p.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.ComponentModel.DataAnnotations.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	17672
Entropy (8bit):	6.642388002862503
Encrypted:	false
SSDEEP:	384:A8imyfJe9eGXx14McUFjWuqXWm4Tb2HRN7rsFXpR9zz9dI:A8jOJN4/irsFXD9zRe
MD5:	965B0D339AD79AA56E1AE0102A00C1FA
SHA1:	323BD0004B073BCDDF245EE54E5CDBFC7EE5361C
SHA-256:	3319EAAC125B522438FC58082C0584B762973C6D2E232ED61FEBD90F40CDD54D
SHA-512:	5BCE287968A6B6FD09DE13A8CDFF227D4FA548BD28E3217A8060965097057976C025C2E683A82D8264AAF0139406FC0086BA50AEE54E50D3BBC85131414D082C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..............0... ...@....... .............................._.....`.................................;0..O....@...................)...`......8/..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................o0......H.......P ..h...........................................................BSJB............v4.0.30319......l...D...#~......L...#Strings............#US.........#GUID.......X...#Blob............T.........3....................................+...............M.p...P.p.....]...........................O.....7.................>.....[...............................9.....p.................W.....W.....W...).W...1.W...9.W...A.W...I.W...Q.W...Y.W...a.W...i.W...q.W...y.W.....W. ...W.....W...

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.ComponentModel.EventBasedAsync.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	38576
Entropy (8bit):	6.479516708107219
Encrypted:	false
SSDEEP:	384:mWvjwWQoo22iZyrkEWyiIo/DiNPAo2BREwb7msbBTip9kZFDXSO88+6EZccdwVgf:TaMyrkRPW6fBI484t8LuWqgJ69zDUN
MD5:	5864FA7B31B5B413EF7F6A8A97AB1D81
SHA1:	6B09EA2D5482E14C49D14C5EFF5B9B2CD7FFD92F
SHA-256:	8284668898F85EFA5DEAB45D1FBF1A9285936721096EB15ABAA1ED5D43B8536E
SHA-512:	F4460B1F19125FB8E9C1DFD2F6A5C81D3021D3B65EB8886F598B51D055745B5E5B93056EDC0374ED17CB54DFB53FF6AC6F7BA2347CB18D520B1EBC06D59D4D59
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....W..........." .....b..........................................................."....`...@......@............... ......................................$...x....n...(..............T...............................................................H............text...Ra.......b.................. ..`.data................d..............@....reloc...............l..............@..B............................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...d.&...C.o.m.m.e.n.t.s...S.y.s.t.e.m...C.o.m.p.o.n.e.n.t.M.o.d.e.l...E.v.e.n.t.B.a.s.e.d.A.s.y.n.c...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...t.&...F.i.l.e.D.e.s.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.ComponentModel.Primitives.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	75424
Entropy (8bit):	6.417137287918974
Encrypted:	false
SSDEEP:	768:5Jk5nMIPKeAtuC2OB6BhRmz1yF0YDC2oKQ15ht9bQs2mDA/ivVDuO9zgY:Tk5XNP46bkAFlC2oKQDhmi1zgY
MD5:	521EF839C489404BA07B155C3B37FF21
SHA1:	15F9D88E4A68764000CBDA8356B88C5E44961D2A
SHA-256:	6545A5440ED30BCF9329C98D68FC1E0F3FD057B830A677B1E4397C0E4528431F
SHA-512:	E803C3F733D467FA9992C84B127BD75AA54B65EC47654A4D62F5FD8375FBD79A5D56D14D353DE975F042272919AE3EBEE968ABCB8CD9303FA7B3FBF422268357
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...'............." ......................................................... ............`...@......@............... .......................................&...........(..............T...............................................................H............text............................... ..`.data...............................@....reloc..............................@..B............................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...Z.!...C.o.m.m.e.n.t.s...S.y.s.t.e.m...C.o.m.p.o.n.e.n.t.M.o.d.e.l...P.r.i.m.i.t.i.v.e.s.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...j.!...F.i.l.e.D.e.s.c.r.i.p.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.ComponentModel.TypeConverter.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	744624
Entropy (8bit):	6.688422148617617
Encrypted:	false
SSDEEP:	12288:F/DFPRuu3Q/nmjaElVeBmCIdEVysExQMed4HigifVsVJKxYGqLQcBnd+KdOI3td2:Flx3QfmjTeBmCIdEVysEZ8lLQQcBnfdM
MD5:	E45A7DAF2F46E862A3C6ACB72F244509
SHA1:	7663BF16A867D59A9CD2548534D1609357E0C379
SHA-256:	31196E051F36FCB5B508387B10F5382AABDA2E49A26C778C466AA3B7F635FA24
SHA-512:	9D9ACDE33471BA90AE4D447BD70C9956D282E48987237A949E693F481292DB2C9541898BA349CC92CABAC2EB0F92846F15DBED73DC1A5F5F65EC7D0B87D31064
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...r~O..........." .....h...................................................P............`...@......@............... ......................................\|....\...4...(...@......h=..T...............................................................H............text....g.......h.................. ..`.data................j..............@....reloc.......@.......&..............@..B............................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...`.$...C.o.m.m.e.n.t.s...S.y.s.t.e.m...C.o.m.p.o.n.e.n.t.M.o.d.e.l...T.y.p.e.C.o.n.v.e.r.t.e.r...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...p.$...F.i.l.e.D.e.s.c.r.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.ComponentModel.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18592
Entropy (8bit):	6.57295979619582
Encrypted:	false
SSDEEP:	384:ZW401WSvIiaScpij+mCo8WEUTb2HRN7XnJBmo8R9zbcu+iQ:ydaScUZt/iDmoQ9zYu3Q
MD5:	2D96478828A3D80A3304E2F46CE842D7
SHA1:	EA5CD870A1C15470B38E21FE1FE6D5A5E4EF72B5
SHA-256:	A597543F43FB31C1FA0674122E78577B46BD23BE0A019A14CB6026B193872E46
SHA-512:	0A0CCDCF553F47700E168A14B70A0554BAF318A319A23C91C00A1291D96D1C5D51D8FE93D54363F6F72508C9482551580015204A2A61212C0D290B4EDEA3FB2B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...AJ............" .........................................................P............`...@......@............... ..........................................`.... ...(...@...... ...T...............................................................H............text............................... ..`.data...N....0......................@....reloc.......@......................@..B............................................0.......................t...,.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o...h.....0.0.0.0.0.4.b.0...D.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...C.o.m.p.o.n.e.n.t.M.o.d.e.l...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...T.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.e.m.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Configuration.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	19632
Entropy (8bit):	6.556607680518669
Encrypted:	false
SSDEEP:	384:OXoWX0yXQB1uXTSv/fvNRvGZYdf3zyP/weXEyUDmWvsNWNf5kHRN7xiaBmo8R9zm:xniX/kKxxmoQ9zYF
MD5:	07CB1EA133189A289CD3CE19B75719C7
SHA1:	9CA763C0022C61ED3559EC001154200A26B35A5B
SHA-256:	7DF1F899846B13634C53862FF01FED3FFDA7E7CE3EC7559B2AE227BE199980B4
SHA-512:	8418083E5A3FB2B52E75B3C329979E8EAB2368CFD7AAF86F99D3E52917CA2173D01F7AB2F89E97B4B23B6ED104DD56825FB3AAED104DF5C940D531E357284DEF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0..............9... ...@....... ...............................S....`..................................9..O....@...............$...(...`.......8..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......."..............@..B.................9......H.......P ......................88......................................BSJB............v4.0.30319......l.......#~......h...#Strings............#US.........#GUID.......P...#Blob............T.........3....................................h.....D...............s.......\|...............D.z...............Z.................0.....M.................<............."...,...................v.....v.....v...).v...1.v...9.v...A.v...I.v...Q.v...Y.v...a.v...i.v...q.v...y.v.....v. ...v.....v...

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Console.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	156832
Entropy (8bit):	6.595868346400089
Encrypted:	false
SSDEEP:	3072:pWG1iIWbCwq+p1waxbwbKbUGmOaYMGcTM:HALhIDcl3
MD5:	549EBA7C3660C8C30F88A5607EF885C6
SHA1:	AC7FD12CF92CCD5DB96864DA6BDC766C06F97668
SHA-256:	5E50AD9D7C4654DBE13E9062543804A56417E917BD625EBC5F9ADEEB00D5C7C5
SHA-512:	3AEE15108B139663671819D4899546D1966D3B37E0DA07387BB80F56424AC45D86850379A51049EB52592A93009B202B972A9657117DFB1B90230235AF2B2772
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....3..........." .........$...............................................`.......W....`...@......@............... .......................................<.......<...(...P......p...T...............................................................H............text............................... ..`.data........0... ..................@....reloc.......P.......8..............@..B............................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0.....d...C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Core.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	24224
Entropy (8bit):	6.279677656876579
Encrypted:	false
SSDEEP:	384:JsIbPFWOUSnPEW51b04H9DGMq/tE8aQjryAkxkBm4U1zXtvC1LIIsWX12W+Tb2HA:JvPFWOUSnP751b04H9DGMq/tE8aQjryB
MD5:	DFFEDE639CE57FAE809196977C1CAA6B
SHA1:	8D83BDA66D8F0211C3749D7E21191297262FAAF6
SHA-256:	F1C2178B3D903B8EBE6ACD22EF762E27EB4718CE501C13B3E23D1E75BCEE0488
SHA-512:	3DFF019131625454A0A6A6377EED83946ACB8AEEAE1C74D18858A7C0F057436F3601D4FD9BEA3B998D0F7FC431C34AB2DDAE34D061BFA216A5238EB6DD7A0BFD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...J............." ..0..,...........J... ...`....... ..............................I_....`.................................CJ..O....`..8............6...(..........tI..T............................................ ............... ..H............text....*... ...,.................. ..`.rsrc...8....`......................@..@.reloc...............4..............@..B................wJ......H.......P ...(...................H......................................BSJB............v4.0.30319......l.......#~..........#Strings.....%......#US..%......#GUID....%......#Blob............T.........3............................................................................1.N...c.................y.....0...........].....z...................................K...................[.....[.....[...).[...1.[...9.[...A.[...I.[...Q.[...Y.[...a.[...i.[...q.[...y.[.....[. ...[.....[...

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Data.Common.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2983688
Entropy (8bit):	6.806914918691061
Encrypted:	false
SSDEEP:	49152:Kbk0uqTkdVJjL1AhfUbEPba92I7aE0Vnv1XgVi4nNmcLaYDpBsjTzkt2B9TJ:mk0bU1ppwX
MD5:	89A7AEE4F6DCA09B0A9ABF1D4B9776C1
SHA1:	F62E9582980E6464DFA33A35FBEC3D952400EF12
SHA-256:	D753A06DC67E6F6E83A1B30CC43E74FFB65A16C179B6CBA60986CC66040C0FF2
SHA-512:	DA95B32E732B097B24D48A748A274BBA02AEE1A1E9BADB891FA45FFF08FDB86A8C973D8B556760B537CB094C0567B9F63DF6F656DD35C8C7D6D3A049F6D65086
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....)..........." .....r+...................................................-.....%.....`...@......@............... ..................................t...H'...K...^-..)...`-..&.....T...........................................................x...H............text...?q+......r+................. ..`.data.........+......t+.............@....reloc...&...`-..(...6-.............@..B............................................0.......................d.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........\|.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...X.....0.0.0.0.0.4.b.0...>.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...D.a.t.a...C.o.m.m.o.n.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...N.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.e.m...D.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Data.DataSetExtensions.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16032
Entropy (8bit):	6.649409793293799
Encrypted:	false
SSDEEP:	384:nruSfWuWam7WWTb2HRN7Wh/6fR9zcGbgRh:ruTd/iB9zW
MD5:	800286F3C0F5E3F7BA596E89D19B3BEF
SHA1:	3AC33D0CD2F80750F8D664ABC41B3446531579AD
SHA-256:	1A81E489FDA0D84D6413C7F061960D1BC1E560A81C8DA77D13E88CCBC8B71F17
SHA-512:	9A202D5D5E73DB5FC04ED22CF65ABF51C9B35CA977822FA23AAF869A1A40770AF9BD319960C95B711B1684F2E527E983A9B9D00C9332602DCF0C8650F45BCDD6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...3.h..........."!..0..............)... ........@.. ...............................{....`..................................)..O....@...................(...`.......(..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H........ .. ...................P ............................................dV.......I#..(..(_..\1.,,.x....[...Rr!...E;...^V.\..SL^\|+...y.....f1...J.#Sm...b...2......EJ^ bY5.L.ihD.-#j.^T.u...A...BSJB............v4.0.30319......`...H...#~......X...#Strings............#GUID...........#Blob......................3................................................E...............................:...'.A...i.A.....A...~.A.....A.....A.....A...e.A.....A...........E.................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Data.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	25888
Entropy (8bit):	6.250479721916774
Encrypted:	false
SSDEEP:	384:oBaJC9XmGP2SoxDZQb/H7vWiUFWw/5kHRN7H2IR9z56:owsXmJDZQzuzqWU9zE
MD5:	61F1E6D66B6F96BCA747A0B3AD1207A8
SHA1:	CC565BF0239A19965EC51B232CB8C2344A919465
SHA-256:	C77B9E321BA4B4278BC082A53F89CC75D4FC50A62F856978D7F9F126DDBF3F99
SHA-512:	3AF41CB744997743E37C87E44562A1D5686E855C516DD9342AA14C182E2294500B6DFBDBD245938190F7308A599E2415A3D5C707C76488FFC9D106596AB46904
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...7.0..........." ..0..2...........P... ...`....... ...............................~....`..................................P..O....`..8............<.. )...........O..T............................................ ............... ..H............text....0... ...2.................. ..`.rsrc...8....`.......4..............@..@.reloc...............:..............@..B.................P......H.......P ......................HO......................................BSJB............v4.0.30319......l.......#~......0...#Strings.... ,......#US.$,......#GUID...4,......#Blob............T.........3....................................<.....[...............:.................A...........o...........!...........R.....Z.....w............................... ...........#...........................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y......... .............

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Diagnostics.Contracts.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16032
Entropy (8bit):	6.77579550427955
Encrypted:	false
SSDEEP:	384:eW7A9W6F2W5Tb2HRN7Dp68Bmo8R9zbcnP:e6gx/iDNmoQ9zYP
MD5:	D78D4E3A7F815E99BA52850BC347EEB6
SHA1:	6BF0CFDB20DA929C6EEC9C269B99F402BC600327
SHA-256:	C98EBEC7E6826BFB5D6BD8CC9C9C0AD5C27DFA2AB623DF7E9508BFC44AF7885F
SHA-512:	14AC429FEEF93AC8DA0B742FB23F633B10F6AD1E467CB8A8BB1DFD917CA0144BD9C6EED85BEAE0702E49C875A9C2479241B2A303C9D81BD88E57AE0FB7DA0EEC
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................."!..0..............+... ........@.. ....................................`..................................+..W....@...................(...`.......*..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................+......H........ ......................P ........................................@....$.r:..../.'%..$7.M.7...b"..=AU.#lT...>)...Nm..M.[+....n.T...C.+._.2...?UPJ.....x...<.;k....n.l..]K.m...p....1..?h.BSJB............v4.0.30319......`.......#~......H...#Strings....8.......#GUID...H.......#Blob......................3......................................Z.........9.........................,.....{.........F...........5.............................#.....p.........................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Diagnostics.Debug.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16144
Entropy (8bit):	6.7739498538469105
Encrypted:	false
SSDEEP:	192:su81bIxx+NW2lmWWuWXebPpUNTQHnhWgN7agWgcADB6ZX01k9z3Az8s/b:toNW2lmWWTb2HRN7FcTR9zuF
MD5:	027A6B55839BD1ECE382A66BCAD8F825
SHA1:	428CA4FF2B7D5C10EFDA3052B97037ACCAF5C1F2
SHA-256:	7E24691AE38E5E238DFC38D2D864F58B148B82B3359962C81A430569314642D0
SHA-512:	E19F2AAC411FA2AD1474DE7FDC4B789E0ABE3ADD8F8458D4C36C0B41E77E579C11D0A8F9F4083DFCAC4AF16E2EA98728ECA4A8619E6FC70FAE6A1060A80829BD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................."!..0.............n+... ........@.. ..............................F^....`..................................+..W....@...................)...`......`..8............................................ ............... ..H............text...t.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................P+......H........ ......................P ...........................................#..o6IB......T.....s....).K.......u...0........V]BBl..B.r..X..s..W.....}[........3....H...>,>s..v...=P.8A..'.\|.....Q.QBSJB............v4.0.30319......`...t...#~..........#Strings............#GUID...........#Blob......................3............................................................o...................4.................;...8.;...].;.....;...F.;.....;... .;.....;.....;.................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Diagnostics.DiagnosticSource.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	380592
Entropy (8bit):	6.73538239971008
Encrypted:	false
SSDEEP:	6144:SurYIYONZfp86WWs4R2bWNcbaS/QSVsyVyCrEVYECJ01TdH:SuDZfXWI2kQ/uCrEVtlbH
MD5:	7A267FDCAE82B502279E7EF3B6CB911F
SHA1:	33B5E41301988562C2A0FAADE95274B07D23F2A8
SHA-256:	026FDA8CF0F380815C017E752EF8E19D659C3BDEE974978897D8A6A429B59955
SHA-512:	265430E2CF1DDEAEAC28BB5DD309B6B9FA8F30CA16E5F245A9D2C047C09550A3928573656E628787CB915A90BA00308913EFC62EAD95BE03C5A443CBCE4F671A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d..............." ......................................................................`...@......@............... ......................................`....+.......(.......... )..T...............................................................H............text............................... ..`.data....}...0...~..................@....reloc..............................@..B............................................0...........................X.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0.........C.o.m.m.e.n.t.s...P.r.o.v.i.d.e.s. .C.l.a.s.s.e.s. .t.h.a.t. .a.l.l.o.w. .y.o.u. .t.o. .d.e.c.o.u.p.l.e. .c.o.d.e. .l.o.g.g.i.n.g. .r.i.c.h. .(.u.n.s.e.r.i.a.l.i.z.a.b.l.e.). .d.i.a.g.n.o.s.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Diagnostics.FileVersionInfo.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	35592
Entropy (8bit):	6.485510060172919
Encrypted:	false
SSDEEP:	384:3WdUV9WVoyR50a+3ZgW1n6lsLiKqFCM1nTrmTwCpZ0oMaPaNTb2HRN7CSFDR9z9L:FsGpgW9LiKqFCM1n2Tw2ZZi/ijl9zyE
MD5:	70AEE4FAAFE68740D1B1376C17613DC6
SHA1:	BC476CD927F1EE8F4B284DA4C3465BD65B27029E
SHA-256:	A3C9C3B48CB02922C19AC84FAF042A94513D202816405CFCE46638B526C1668C
SHA-512:	CADED76687B4DCD00E21581E31DBCCB3E9181736CFFBCD4E67D926DCEFFA83D848A78786E1843CF159C720340C8232F913A4FA8D04E70793508ED84CC191268C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...7............." .....X..........................................................6`....`...@......@............... ..................................t...8........b...)......T.......T...........................................................x...H............text....W.......X.................. ..`.data........p.......Z..............@....reloc..T............`..............@..B............................................0.......................d.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........\|.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...X.....0.0.0.0.0.4.b.0.....d...C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Diagnostics.Process.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	290464
Entropy (8bit):	6.682018593338738
Encrypted:	false
SSDEEP:	6144:BbBvmYB8ACuu63yju63yxs9b3NX1PkxvqRS7s038p9:BbBe+8ACSCju6Cjt6038p9
MD5:	82C96AB1C3825ADB9752D108B3BFD027
SHA1:	17B496C80353FB97F703A4E45351859F2CB5112D
SHA-256:	56E13025805883C5F433818439E840FC85C22C45C3BA99C4F73D15B8A0FB04E4
SHA-512:	D2E9A7B0A5207118A73398F96561F402E5138D6BF055B6B93B29560A4C79FB87EC22E8D201C6887B74414497ACE16F9E4D8AD13BCCB54A9E8A34068C2EE89981
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...../..........." .........P...............................................p............`...@......@............... ..................................D....m...!...F...(...`......@&..T...........................................................H...H............text............................... ..`.data....H.......J..................@....reloc.......`.......@..............@..B............................................0.......................4.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........L.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...(.....0.0.0.0.0.4.b.0.....d...C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Diagnostics.StackTrace.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	36528
Entropy (8bit):	6.526748038034579
Encrypted:	false
SSDEEP:	768:ytTY25cejonuqkwx38n9Is/XASTsssssssssNa29zb:yBY25cejonuqjx38n9IaASgaCzb
MD5:	EE665B89BF66ED65102A70E3A8E08C03
SHA1:	DAA57E71933151D73D34460A17EEB9FE302A880B
SHA-256:	96E949B644515D96F112AD3A5745B50CC14428D62E6D268A6A800770F71E1CF4
SHA-512:	2D08C0C6FC0CA6A4E4022E21B34C973FA50A4DDD8E197B9C1A85A258BC117B4747E447655A10F6AA60040AA2B8295BE84D88234C83DCF96899A52D8C1E9B5E24
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...;Zb..........." .....Z...........................................................D....`...@......@............... ...............................................f...(..............T...............................................................H............text....X.......Z.................. ..`.data...~....p.......\..............@....reloc...............d..............@..B............................................0...........................l.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...T.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...D.i.a.g.n.o.s.t.i.c.s...S.t.a.c.k.T.r.a.c.e...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...d.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Diagnostics.TextWriterTraceListener.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	60704
Entropy (8bit):	6.54196782654426
Encrypted:	false
SSDEEP:	768:YmoBg4EIQZkFQUFP9JttwhPYgBsUbPSNI8QUQXECIDFFH0yFqOLkze9zK:bEFQG17ihPYDI8Gvch+VzazK
MD5:	67D6093B77B93C46B4E6DCE7F565CB33
SHA1:	B75EBBDD3A677D5D2DD1BA380D1364571DDE7AFE
SHA-256:	F6CC4522FE24A5496151E88F1AC3F868E7C68A7A4458077130E31B0C14CADA31
SHA-512:	F303C83376AC52EB3CD1235C9AEAC57FCA4189FF21D066E12E8A38D766D176BC15649C4B04513C8ABF06C7D84455557AAE66A3D08327EA4C16AE7B55BF33182F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....Y..........." .....................................................................`...@......@............... ..................................4....'..8....... )......$.......T...........................................................8...H............text............................... ..`.data...7...........................@....reloc..$...........................@..B............................................0.......................$.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........<.....S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...n.+...C.o.m.m.e.n.t.s...S.y.s.t.e.m...D.i.a.g.n.o.s.t.i.c.s...T.e.x.t.W.r.i.t.e.r.T.r.a.c.e.L.i.s.t.e.n.e.r.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...~.+...F.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Diagnostics.Tools.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16160
Entropy (8bit):	6.708978110259667
Encrypted:	false
SSDEEP:	192:NFVTAcxxeHyWQfUWUy3WT56Os1HnhWgN7agWfmA+2IyttuX01k9z3A2IyrVF:5cK8HyWQfUWUb5kHRN7iXSR9zf/VF
MD5:	013ABF91E91CBB57467DE5C2FAF43A08
SHA1:	A24F118E50BB732F59371DA92E17D1360537331B
SHA-256:	4ED7E56E702476B9DB0BCAF763F3C5C8A345D6E36963A970098B1C1B3940327A
SHA-512:	BB22D09DB9D074853E61F013FF2DE5B4058F1889BD0C85F9D2D9F8301BC587DC844FD56DF6C608094CAC2D433883CC974A7BE7B7CE425D47E6E613F39C6467C3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....?..........."!..0................. ........@.. ...............................1....`..................................)..K....@.................. )...`.......)..8............................................ ............... ..H............text...$.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.......................H........ ..L...................P ............................................N0^..H...=..e..s....A1...E...u}.2t...a.t^..Z&.y..u.bg..A...P.....}J.....J?.>j..n\|.}.Gk.GS...../0...Y..fU...8.....MBSJB............v4.0.30319......`.......#~..H...H...#Strings............#GUID...........#Blob......................3......................................Z.........s.........................,.....w...N.....F.....0.~...!.~.....~.....~.....~.....~.....~.....~.....~.................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Diagnostics.TraceSource.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	133280
Entropy (8bit):	6.546425729438175
Encrypted:	false
SSDEEP:	1536:y7LVCUParX7Uuy2bryHxgfEsMjO4jlesM9eV6iqRIL8OXmtyqbQSPiOmVz53:y7LVZParvbkefEsS/9M9eV6i72tyq8T5
MD5:	7B3B0628ADBF58B09444720B99D53E92
SHA1:	7B1A3BBF32D782C3362864A935870537C76B3288
SHA-256:	E8A546B09C03A5AC421CB9007B7463ED13518F03D657C6CB994AA7755EE0D964
SHA-512:	7AF18C896CE1999A4D4D94353CF4EB9CB6F142C59D5217DFE0D57C6FBFF9449C530656FA97665420C8850734D44B98D2E21E83E463F18A250654D8928E8AD3D0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d................" ......................................................................`...@......@............... ......................................T@...........(..............T...............................................................H............text............................... ..`.data...............................@....reloc..............................@..B............................................0...........................\|.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...V.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...D.i.a.g.n.o.s.t.i.c.s...T.r.a.c.e.S.o.u.r.c.e.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...f.....F.i.l.e.D.e.s.c.r.i.p.t.i.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Diagnostics.Tracing.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16544
Entropy (8bit):	6.704723416587313
Encrypted:	false
SSDEEP:	192:t25g6pDj+yAxxd+cWbeDW3YuWXebPpUNTQHnhWgN7awWBZBm+0U8X01k9z3AYLjS:tm+ye3fWbeDWITb2HRN7aZBmo8R9zbcH
MD5:	A3058019F7A0631D20DC60F734945439
SHA1:	864053CC397E9EDB8FB0668A81C97E6E4723730B
SHA-256:	A9454FF550C6F13F589F0CF280DCD0BD1717CAECDC1E719535FE12AE5378CF7F
SHA-512:	208FC362B0CAA8E8FC464D10589694C01FCD7B2ED2FE1E2C63EF72EEDF65B81214C81AA3C44450620B463A7939C9650C92F2C15E06A64BFD9CB588369783D2AB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....%..........."!..0.............>-... ........@.. ..............................a5....`..................................,..S....@...................(...`......0,..8............................................ ............... ..H............text...D.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................ -......H........ ..`...................P ......................................._.&6..$.WF...s....o-..2....5]{.'i28r.p..2..\..?\|B.;. q..k_..(9v.1..[..U....(../.....`..>..mmI..P...?.w..K....3ko/.".o..,.BSJB............v4.0.30319......`.......#~..........#Strings............#GUID...........#Blob......................3................................ .....................].........................................m.....q.....D...........P...........*...............................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Drawing.Primitives.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	130208
Entropy (8bit):	6.374985819265702
Encrypted:	false
SSDEEP:	3072:EAhfzY6c2/Pwp2Hj/ygb4xfHIKHnT6IdID7kHLbVlU:NhfPyyzKHm+PrU
MD5:	9C94E71A6906CA93390A68EF9FE5AC1D
SHA1:	883D59B38E03DA601DE92350080C2F2332F670CE
SHA-256:	7EF4BC539F1D9C99B51DBA13FCCEA548E0D57DCD547F71E24AABBCC6D05C5872
SHA-512:	62B9812A8BB3E1C2D8DCE13A1D179AF24899C616EEB6B67EE23241050BBA8F91FE06E43131F58744269FABFFDB1E2ADBB932BF7DA937F2C8BAA247CA63D6561B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d................." ................................................................5.....`...@......@............... ..................................8....0...........(......,.......T...........................................................8...H............text...f........................... ..`.data...f...........................@....reloc..,...........................@..B............................................0.......................(.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........@.....S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0.....d...C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Drawing.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21152
Entropy (8bit):	6.383948769657983
Encrypted:	false
SSDEEP:	384:egyLzP7uC8sYITetQP9WIbIaWxstW+Tb2HRN7RJ6Bmo8R9zbcfo:egy7rzP/iRJYmoQ9zYQ
MD5:	0572FE2D27C2C6361DDB09555F09CEC3
SHA1:	74BABB25FA0B4D63125F88578682254622F434E5
SHA-256:	6B8817B5D44F16BA026B25A7F36180814179B040BDB92C24E967B8D3BADFB33E
SHA-512:	71DA29A152CB9B3A09AE513DBECEFD4897D68D64B723C8CE614678292108FA7B9C146452D34B83A2138316F65D75972BB95587FCFFEA36EDA1AD865071009E04
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....~L..........." ..0.. ...........>... ...@....... ....................................`.................................}>..O....@..X............*...(...`.......=..T............................................ ............... ..H............text........ ... .................. ..`.rsrc...X....@......."..............@..@.reloc.......`.......(..............@..B.................>......H.......P ......................(=......................................BSJB............v4.0.30319......l.......#~......l...#Strings....\|.......#US.........#GUID.......H...#Blob............T.........3..................................................................m...........#...............d.....x...........W...................................;.....~.[.......................V.....V.....V...).V...1.V...9.V...A.V...I.V...Q.V...Y.V...a.V...i.V...q.V...y.V.....V. ...V.....V...

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Dynamic.Runtime.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16544
Entropy (8bit):	6.666302271220656
Encrypted:	false
SSDEEP:	384:qGMJ1joMWsJCWYTb2HRN7msfWNyBmo8R9zbcGw:y1bk/imsfvmoQ9zY1
MD5:	716993B7597E4D17854AC4A2298824E3
SHA1:	749D206580A2F09E6941E3673AF5834789EED534
SHA-256:	BC16C1071080C16754A53090C240A05D4B2FF0E55DE5CB71964CD0D260DCA975
SHA-512:	F379E59EC877A01C3FE28E640D687B119F4A6FCAE044A789ECB436D9BC6082B33F5739840973DC96C78E5B0E999A1255385F6F7240124C145EAB0E30A11FE674
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...7.l..........."!..0..............,... ........@.. ...................................`.................................\,..O....@...................(...`.......+..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................,......H........ ......................P ......................................f..;.....z-c..yNI.+."zH:.......F/.+...Z..0.B.G.m.&..ci...7.P....w..u./.l...x...$;..+..i..^......w...T.y.r/KJ..\.-..[.6BSJB............v4.0.30319......`...P...#~..........#Strings....0.......#GUID...@.......#Blob......................3......................................>.........W...............................Y...9.r...j.r.....r.....r.....r.....r.....r...w.r.....r...........#.................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Formats.Asn1.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	197296
Entropy (8bit):	6.6764434252925735
Encrypted:	false
SSDEEP:	3072:PUAdDDJCTXjbEJgiVsD63VpNDaphMMZBWnH5dgOuG4krZAuZAY/0hlRBXHsuA4g4:c2hYUS63VfWNUn2RPJtF
MD5:	AC0C6DF7861CF824E9FC587C76B341B3
SHA1:	FC4129B9A9045A504EC6E238F0D7BA8BD4E683FD
SHA-256:	9984CE1C9F280A9EFE7A1A2FD3E7703A071F72139C7C721E2637FA9974F9E11C
SHA-512:	0FFD8B04A0DF9974561D9227FCF3769531653590A917BC06E57D0B0367270F20D2703C45BDF74A2728AE9B946FE256D31F8D8A9BC10C3AA98F406BA8C36A3AC5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....t..........." .........&......................................................i.....`...@......@............... .......................................N..D........(..........h ..T...............................................................H............text............................... ..`.data....!......."..................@....reloc..............................@..B............................................0...........................H.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...j.....C.o.m.m.e.n.t.s...P.r.o.v.i.d.e.s. .c.l.a.s.s.e.s. .t.h.a.t. .c.a.n. .r.e.a.d. .a.n.d. .w.r.i.t.e. .t.h.e. .A.S.N...1. .B.E.R.,. .C.E.R.,. .a.n.d. .D.E.R. .d.a.t.a. .f.o.r.m.a.t.s...........

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Globalization.Calendars.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16160
Entropy (8bit):	6.797774632542928
Encrypted:	false
SSDEEP:	384:jav7yRqXWDRq40Rqm0Rq7WHG5kHRN7JqHNbZR9zz4pm:yUqKq1qmuqmvJqHFT9z08
MD5:	BC55612F880E4F4E21A481B9600437E4
SHA1:	30BF11928E39A42023A54E6C34FD9EB349B31E31
SHA-256:	ED4A86F196A881815A37CEBBEF68AB94F299CD427A34B32065EF357AF7311A30
SHA-512:	45FE663109BFF71A83EC01561E56F5D1BE2E16F0CC01DE5E8300EC952BE1159285FA19045B066AD6C78204A315BD9F9868E78EDFC588E658D04420AF52D4DBE1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................"!..0..............+... ........@.. ....................................`..................................+..W....@.................. )...`.........8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................+......H........ ......................P ......................................wp.g?9....X.j,.1..^.J..HjF"b...5?M..6.l....=.......~.c...4d..L..yB..9g..F...Y[.+/...;~...Qp..toO...Nk)D......^......ib.<BSJB............v4.0.30319......`.......#~......$...#Strings....0.......#GUID...@.......#Blob......................3................................................"...........;...........f.......,.................H...!.H.....H...[.H.....H.....H.....H...B.H...O.H...v.............

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Globalization.Extensions.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15520
Entropy (8bit):	6.809418308503623
Encrypted:	false
SSDEEP:	384:zl3RPWYRgHRp0RjW9Tb2HRN71I7uDX+iR9znZt:zTNapu2/i1KuDuO9zZt
MD5:	43DE906961E8C803140328CD771F8835
SHA1:	BC02616BABCA85DE7098B795BB719793287D3735
SHA-256:	7357AA126220B47344771CDB7771D93A1D8E6EF964198D6874E15CAB4CB81694
SHA-512:	C0FBF8F06DD4EC6444872A3DC01EAE0F32F13318839B8959AF0A9C026FB9EE068A9CDB6DD21F81ADC1E276C5A2D7F8E43B676D2CDD8D542EC3493ED9924EAE90
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...J............"!..0..............)... ........@.. ....................................`.................................h)..S....@...................(...`.......(..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H........ ......................P .......................................&...(.[E.B..VH^.....M..f.d$J....Ka.5....9K.3N-..i......>u..le.A....g.M..O.E.U..LsE8.o2(......_v1.v.[.r..<........O...BSJB............v4.0.30319......`.......#~..@.......#Strings....$.......#GUID...4.......#Blob......................3..................................................P.....P...3.=...p.....^.....a.......%.....%...w.%.....%.....%...w.%.....%.....%...G.%...I.P.................7.....

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Globalization.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16160
Entropy (8bit):	6.741858192968759
Encrypted:	false
SSDEEP:	384:vmQFAjRLWdRM2RA0RHW3W5kHRN7w2IR9z5u+Y:vmQFQ0/Auy/zU9zlY
MD5:	06011864A0142E136E1F4BE2D37C1D23
SHA1:	1C1A512D18F29B58B60A992C1A68AAAEC928B082
SHA-256:	5B2C57DA4CA752CC5F77796FC3B34A5E22301A7340EA7C2EE3CB897855CA6D8D
SHA-512:	67ECA70D8CB18C8D4EBF82E4F9ED45F7EB6DDD6E7FD3F191E759E707D2BE98CEF5A23E8B106EEE143D6375B4A0A34F07E551177105ADD41B1F5A9F5565582A58
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...^.~..........."!..0..............+... ........@.. ...............................=....`....................................K....@.................. )...`.........8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................*......H........ ..D...................P ......................................m.Zd..>.`.iv.....<....I.\|= .f..G....t......:_...Y6=...X@.......G2..]......:mq/...{`..8...K.y\|l.^P...4.A5r...6:.cW.8/..N.YyBSJB............v4.0.30319......`.......#~..........#Strings............#GUID...........#Blob......................3......................................).........3.K.....K...L.....k.....w.......B.....,.....,.....^...2.^.....^...l.^.....^.....^.....^...S.^...`.^.....K...........

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.IO.Compression.Brotli.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	72864
Entropy (8bit):	6.523982681895704
Encrypted:	false
SSDEEP:	1536:LozKjflqr5dSOyXb23bCgrEp8RKFiY/zG:LY4flW5zyXb23vrO5K
MD5:	25DD441FF54B19AE384D833BD51398E4
SHA1:	83AE7F7104FFC99362462CEE793BD69429CF22F3
SHA-256:	58742679A8360C54A1F3B34BC67131ED7D8F45BA8D726F34A2C114AEF06E563F
SHA-512:	EE83DB7C82BA217DCFDEAB53B7C45D1EB4CF51B002366F67321819F09A90F5527493FC5E956CFE605D31134078F4447902D567ED4842D7842135BA8233953952
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....v............" ......................................................... ............`...@......@............... ..................................P...<)...........(......l.......T...........................................................P...H............text...D........................... ..`.data...............................@....reloc..l...........................@..B............................................0.......................@.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........X.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...4.....0.0.0.0.0.4.b.0.....d...C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.IO.Compression.FileSystem.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16032
Entropy (8bit):	6.701906410240242
Encrypted:	false
SSDEEP:	192:nOPr95zGNaWu1mW1uWXebPpUNTQHnhWgN7aIWbQfbTseUfX01k9z3AfY:OP32aWu1mW1Tb2HRN7/f/6fR9zcY
MD5:	2ADE336AF4F6083E0AF43CCECF6151D8
SHA1:	4C228421795CA33A0DCCF2CC6E34AF2E3A90FBE1
SHA-256:	BCC963058188BB6E5F8BBB307CF3E2F8285DC2112DF1495A8A41283C0C233035
SHA-512:	307E034AA6B6C1B4E241556D24C3EAECF4C160663E3068D97F7464AD1AB86921D8275DDD5C02C77547C1AB2E869C3C7B68F8205EF74D30A5613FD74EC8180DE2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...'0............" ..0................. ...@....... ...................................`.................................9..O....@...................(...`......@)..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................m*......H.......P ..p....................(......................................BSJB............v4.0.30319......l.......#~..t... ...#Strings............#US.........#GUID...........#Blob............T.........3....................................................I...........k...................[...+.....7...................................i...........x...........Q.........................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y......... .............

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.IO.Compression.Native.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	826032
Entropy (8bit):	6.111701834793984
Encrypted:	false
SSDEEP:	12288:KJhYe83Gfyv7vrkasX8LZ6dA9NWYIAHhlyR8ZXTw05nmZfRtp:gYXv7vr5dx9IAniAmZfRb
MD5:	1CF5392D52B4557625183195B8E4BBDE
SHA1:	B325EC222B9E2C6CD8930ECE2D0C3428259970CE
SHA-256:	E79DEF2CB9362409D36D2148083539FB60032064B8FE7A02D99C3E153DC6AE37
SHA-512:	9A4BAEFFFF120BB78957880E3A30C78687D997673628786D69FBEE96FB88735084F28360C0CEC00CB57E297D434EE392B549045C9912761920A651EF197293B4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......,.ORh.!.h.!.h.!.a..d.!... .k.!.h. .).!.:.$.w.!.:.%.b.!.:.".`.!...).F.!...!.i.!.....i.!...#.i.!.Richh.!.................PE..d...d..e.........." ................................................................F.....`A.........................................V..<...<Y..x.......h....p.......r...(...........&..p...........................0'..8............................................text............................... ..`.rdata..._.......`..................@..@.data...,....`.......H..............@....pdata.......p.......L..............@..@_RDATA...............j..............@..@.rsrc...h............l..............@..@.reloc...............p..............@..B................................................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.IO.Compression.ZipFile.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	39688
Entropy (8bit):	6.5084673574586605
Encrypted:	false
SSDEEP:	384:NWPrIWJR7Xg7g1al2Yd5zDN2bDHGgMdOIbcY4XpOJFH9CEUoGdqtHfStGU0Bpu+J:eFw7f4nGjIYyosEUtcdpXf/i6U09zEO
MD5:	9450563B3ECE6D6DF5ADD71666CCE4DF
SHA1:	A218C7CBC05E89FE435286D8143AEBB818421F37
SHA-256:	E275A81C64905968009F2D1AB28207C7919EC596DBEF793F0A068238B95B35F3
SHA-512:	37B21154704BE1BFA9EA46BEACA40E8A2142C1A7D3231F8D0B4EC1ADB66206149737C8442413ADCBF138A606BD5938A6A37C4741543C024C9954254FEC0B9E06
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d..............." .....d................................................................`...@......@............... ..................................P.......4....r...)..............T...........................................................P...H............text....b.......d.................. ..`.data...e............f..............@....reloc...............p..............@..B............................................0.......................@.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........X.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...4.....0.0.0.0.0.4.b.0.....d...C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.IO.Compression.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	266928
Entropy (8bit):	6.68188630017297
Encrypted:	false
SSDEEP:	3072:I4KZvvaCA+vGaqdwc/WZrw5fRweBICHhPXaedBwPv+NWlN/B1xikUbwn+3GEcLpp:ON9nQJdBI6PXKqWlJB1xI5kllOk5oyKm
MD5:	C89774566CBBE28FFDC15EEB5559528E
SHA1:	0C525F589E2099E5B3C9CF929CEB38CE1AE9D8EA
SHA-256:	17109BA64D084D3A099EF03927DE9AD2854A79DB0610CC87040A607A4B5C4E6C
SHA-512:	78F3051B074A7C6F471E979EF69F0BD683A77A91CBFCDE9B40042B9B95611E0FF701E6DBB3442DFB3C1C555E95486C034F19F30CE05AF618807CFC4F02D893CE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d................." .........>............................................................`...@......@............... .................................. ....k..H........(......0....'..T........................................................... ...H............text...9........................... ..`.data....7.......8..................@....reloc..0...........................@..B............................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........(.....S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0.....d...C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.IO.FileSystem.AccessControl.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	93872
Entropy (8bit):	6.563668717348081
Encrypted:	false
SSDEEP:	1536:rYRXrisp5JwUkPuIYiXxs6+gvXY6FBNgviFdQVzw:rYRXrVpdI5oQtCIkk
MD5:	11A1378F3628AE0FF876096B38D4F13F
SHA1:	EA8F37065B93C2528AB84CBD0FD9FE0998E91583
SHA-256:	3AA9CE4286BC435447D87A65CEB8F37C4B8D70B16A64D5E128F36FB094562868
SHA-512:	30E813EE0599B78E7D7139CE9BC612E9744366EE2A59440889BC071754C4EC2F30EC595C7FCE2E445F24379B43D04E73C48A0ADC6FB03B560B6503A6200BA210
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...w2g..........." .....(...................................................p.......=....`...@......@............... ..................................t...T/.......F...(...`......H...T...........................................................x...H............text...w&.......(.................. ..`.data........@.......*..............@....reloc.......`.......B..............@..B............................................0.......................d.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........\|.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...X.....0.0.0.0.0.4.b.0.....d...C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.IO.FileSystem.DriveInfo.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	42656
Entropy (8bit):	6.436692779669451
Encrypted:	false
SSDEEP:	384:GWUZyWDKDVCHWl2Yd5zwNi4XKTmRIYfZKG46JdicX+zu6CVy1/8KcY5eYs+dLFSt:+Yf/V36JwcXKLkKcYz1b/iormoQ9zYa
MD5:	CB905F7FF179600BF0CD9184DB485A7D
SHA1:	61EFE924E60D3D230BFA185404E705DCA69AA7F5
SHA-256:	38C316D401FFE6CAABCCE9D3B71D044F3760FF17BE75496242F489D849432414
SHA-512:	A66FF625181F60A918572392A90ECC0FEA7D4EAC5CB49E3E02363D7B40B33E1207DAD518A8DA4DD93DF5B999C59649A2BE945AA8E22BA355F0B6287CEE142CCC
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....A............" .....p................................................................`...@......@............... ..................................\............~...(..............T...........................................................`...H............text....n.......p.................. ..`.data...s............r..............@....reloc...............\|..............@..B............................................0.......................L.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........d.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...@.....0.0.0.0.0.4.b.0.....d...C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.IO.FileSystem.Primitives.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15520
Entropy (8bit):	6.800424356112854
Encrypted:	false
SSDEEP:	192:7hYrx9xiW/xqWrsuWXebPpUNTQHnhWgN7awWhG1MDoSJj+iX01k9z3AgIvVIX:709xiW/xqWATb2HRN7ulDX+iR9znOIX
MD5:	5B122C740FAD2DA56D428C5D1A1E029D
SHA1:	249A4D57F880B0CA4BF3CCCC62197EE0F18C0C14
SHA-256:	5FA128315268A07FBC40BE62EC490481E97E8D08A119BFF76F40DFA48F8D9E0E
SHA-512:	ECD1849218325EC76D128433033A8B8329C00D91824442A1C3922F90D1D9BCA60D3AC6E8AA1E895598E3AD3215D9D10B503D857A1A0CE09114444098F1CFF19A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...>.K..........."!..0..............)... ........@.. ..............................^.....`.................................`)..K....@...................(...`.......(..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H........ ......................P ......................................_;..&gP]r...3/.......{.9..sc.E.'..0...........:)<..y.G...8.h....?.{F..jp!t2....x.O.J.'/.....:,?>.. ...7..H...1.H51P.&b..WuGBSJB............v4.0.30319......`.......#~..L.......#Strings............#GUID...,.......#Blob......................3................................................!.J.....J..._.7...j.......................E...........Z.......................A.....s.....u.J.................1.....

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.IO.FileSystem.Watcher.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	72352
Entropy (8bit):	6.53364688010635
Encrypted:	false
SSDEEP:	1536:WAuxk2A2SMqILBZ2ds7lg2dqI0bWW4i7zM:WFxXzVlZh7lD0I0bRTA
MD5:	4AAC527FB269F34FAB0157B4B4C39667
SHA1:	2204F03BDAA15EAC7D8F0BC3FAE23F58615E40CD
SHA-256:	D9D94290BE46119DC46AC03544D63215AB26AFD84AF7C37C446227F4DE773B24
SHA-512:	C87F7E842D5A5F91A072B423131D7217D776014AF85925F1AC3903DF52129143878784DAF01A645BC764CA19B5701DAD6907E880CD20C47738CF4976CEA44AA9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....s............" ......................................................... ............`...@......@............... ..................................P...d(...........(......p.......T...........................................................P...H............text............................... ..`.data...............................@....reloc..p...........................@..B............................................0.......................@.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........X.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...4.....0.0.0.0.0.4.b.0.....d...C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.IO.FileSystem.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	24224
Entropy (8bit):	6.332614754853582
Encrypted:	false
SSDEEP:	384:85aPWc+mFnJ85Zu+m2sqjd5z5nNkoLM2LchMWyV2W8YTb2HRN7yIpDX+iR9zn9:PP7Fn8dPfVquMlsd/iBDuO9z9
MD5:	F039C3D8D88649821B4733BDCD67E877
SHA1:	AF30723242EFDF3C0BB0142501DE2BAC9573B5CF
SHA-256:	8EF7B32A95065F05A249FAEB7EDD97D1D7205A430607ED77C989BEC5E404A77C
SHA-512:	52860ADD7F0161A96610300AD0B76739457A4AAB90F4DB0B199B3A9317C170913E580DBF65B4788A7C295942776D145A9FCD9DAFD896FE4429416D2905C4AC24
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....y..........."!..0..,..........NJ... ........@.. ....................................`..................................I..S....`...............6...(..........LI..8............................................ ............... ..H............text...T... ...,.................. ..`.rsrc........`......................@..@.reloc...............4..............@..B................0J......H.......h?..............P .......>.....................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....9.......PADPADP..7../...........S.t...p..T...3.2...0.J.M..=.0....bAA. .e......"....N..~..s...@].Sew.s.t.7.4...5.......x..........]..Q~........#n..'.<.+2]./...0...2.W.4...4>..5q..:...>(.3OL"PP^..V~..VV..eRaDf.3.f7..f..fj.Hpj.1.j..&u

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.IO.IsolatedStorage.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	83632
Entropy (8bit):	6.493353702791645
Encrypted:	false
SSDEEP:	1536:1hZy9nJBC5wB0dSqbHCHWibapdNeS+M33TSZ2LVesGzmfx:1ynJBC5JSqbiHt2pdNeA33TSG8jg
MD5:	289B846F1A9D91DC74C63AA4584BE4E4
SHA1:	91EFFB4680D2422F05B31901B2D59AD08466DA47
SHA-256:	86CE5DCFB6C2CC1A027974B1D6BD2527D3D19739894D115FCC55D6C1B3E04886
SHA-512:	4099EAC59775B843DD75FD8C3576449E2C4E49358FA5E3ACA2CD9997889FF02B52A2E5725576D411B703B8E368B23E4E97E8F8CD8490979848283D594D877FAA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...1............." .........................................................P......;.....`...@......@............... ..................................8....,...........(...@..........T...........................................................8...H............text............................... ..`.data...}.... ......................@....reloc.......@......................@..B............................................0.......................(.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........@.....S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0.....d...C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.IO.MemoryMappedFiles.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	69280
Entropy (8bit):	6.409572224535147
Encrypted:	false
SSDEEP:	1536:Zsl04KblOrgQqy2gYSxycVFldDg0TwKHiTzPT:ZslUlO2y2gYMXVTdDg0TwKEP
MD5:	DC1056000F65129700F57F63E9BA314D
SHA1:	3DF5C025B5ECED3DB2E825C68EAB37163AA7C116
SHA-256:	1918FBCF02B4208181AF2BC23F0AF5F513FDC90ED8E8066B915EE435551E54A9
SHA-512:	CF1E39997545CEC52D2A8A838855C1D6F69DC8C9819A0A9578CF9F3CEA5F487B7E3E0535655346BE86FDE288C4AA339130EC8AC5E66D295B229AB6F22B9F39CE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...XE..........." .................................................................[....`...@......@............... ..................................D...@%...........(..............T...........................................................H...H............text............................... ..`.data...h...........................@....reloc..............................@..B............................................0.......................4.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........L.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...(.....0.0.0.0.0.4.b.0.....d...C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.IO.Pipes.AccessControl.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16544
Entropy (8bit):	6.784660498735636
Encrypted:	false
SSDEEP:	384:58seeKW3W+CPWdTb2HRN7hzBmo8R9zbcM:58seB9K/ih1moQ9zYM
MD5:	5889448375188A7A4593C69A1AC6E041
SHA1:	CC2742B8E4923CD62591CF7B70A466D3342EFB02
SHA-256:	7D215E20CFCC6B5DD937CD05F83D159E9BC6B3568F7B4B5063C399EB56753286
SHA-512:	C2C65B2CA5742739AF35517B4CFDA5D9997823CC06FE4B2BF83C034E38A1B0B1BBD82326378F3CEE3BE961C8FB4CF3FE8BF521408411506E443189B08D5C91B3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...V.r..........."!..0..............-... ........@.. ...............................!....`.................................4-..W....@..T................(...`......p,..8............................................ ............... ..H............text........ ...................... ..`.rsrc...T....@......................@..@.reloc.......`......................@..B................p-......H........"..............P ......h"...........................................<linker>.. <assembly fullname="System.IO.Pipes.AccessControl" feature="System.Resources.UseSystemResourceKeys" featurevalue="true">.. System.Resources.UseSystemResourceKeys removes resource strings and instead uses the resource key as the exception message -->.. <resource name="FxResources.System.IO.Pipes.AccessControl.SR.resources" action="remove" />.. <type fullname="System.SR">..

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.IO.Pipes.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	136352
Entropy (8bit):	6.501328128870902
Encrypted:	false
SSDEEP:	3072:EkyC1MdLwfRi66/VOOceCM+0eZe6Cl5k87bVuoX:I0jXOOOJu0FPVH
MD5:	86548465AD17003541C7A6E07B94FDA0
SHA1:	642C55D5536D99CE2C0F820011746C3978761A7C
SHA-256:	7296C5A65212448538173F72A67995B838416E3BF7C1DD101064FA0A405C3F80
SHA-512:	4959FB41E3FC101B2D3892FF8D3E012A31AED1E612F4A1DD2B4190582CFA550914CFEF230AAB90BC5C4A01C534F804753416D6EB96C094DF3B8E98F82005E180
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...hF6..........." .........(............................................... ......0:....`...@......@............... ......................................@;...........(..............T...............................................................H............text............................... ..`.data....".......$..................@....reloc..............................@..B............................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0.....d...C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.IO.UnmanagedMemoryStream.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15536
Entropy (8bit):	6.819671559927594
Encrypted:	false
SSDEEP:	192:QUgaXwuxx06Wjt+WZ3WT56Os1HnhWgN7awWfhI8HNsAX01k9z3AakHM0:/wU+6Wjt+Ws5kHRN7+tHNsAR9zmb
MD5:	D073D03C38450724A656778E71A60136
SHA1:	B74940E3F2887B51D48B72D38D52C517A85AE7E5
SHA-256:	986ADB1FA6D8210A92841928281C0B7514BBB0AD6144F5DFB578F2D3153BBF45
SHA-512:	0391A7CF395FE2521C0743B6985CD5D2B314C57AEEF35D25EF67A3817F733EDF23AFE0248015CF55C75A836C1FE7C4781F2E5F721B7D02C530B277BC2E7F0D5E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................"!..0..............)... ........@.. ..............................z.....`..................................)..K....@...................(...`.......(..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H........ ......................P ......................................p.......<....<.Z..,.W.E....c..w..a.j..7..h.CeU=..Q.\|p..].2n..`.e......m.5k{].C...l........X..8U...T^.N.......@.~.`T..eN.>BSJB............v4.0.30319......`.......#~..<.......#Strings....,.......#GUID...<.......#Blob......................3................................................,...........E...........p.......W.................^...+.^.....^...e.^.....^.....^.....^...L.^...Y.^.................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.IO.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16032
Entropy (8bit):	6.663843910164276
Encrypted:	false
SSDEEP:	384:sbn83NYsW2GbWZTb2HRN7DeZ/6fR9zc+h:8ncMq/iDz9zHh
MD5:	D383E34CA3BF8CE03B1B3CC92C61E736
SHA1:	0413C38237D63A933E03DE97CE790282EDBB3BEC
SHA-256:	01449C235F333CC9B64E566EC6AE887E3A77A70694521249B55AFCF789505B03
SHA-512:	6E8CA31709A478040737BDF57FDF1B027793EB58E31608132F73F89CE78FA2F5621A30DEC77063AEAB1D45A3A3563062F9BBABADF6D798C27003F2F5B91264B4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...'............."!..0.............~... ........@.. ...................................`.................................0..K....@..(................(...`.......)..8............................................ ............... ..H............text........ ...................... ..`.rsrc...(....@......................@..@.reloc.......`......................@..B................`......H........ ......................P ......................................&7..QX0.{.n..<.bO2.>v.MF......Y........Fa..Y:...Q...i.......hZ ^..:...R }...x.....}s.y:...%T.<r.@i.p^..q..B)m!..J.M(ki.dBSJB............v4.0.30319......`.......#~......8...#Strings....,.......#GUID...<.......#Blob......................3............................................................=.....).....h.....k...........#...........8.............................Q.....S.........................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Linq.Expressions.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3857584
Entropy (8bit):	6.692035773716683
Encrypted:	false
SSDEEP:	49152:1jUvs9EF12lJuMgmxY25xOMy/BM2svblg72zv553P77zbr7jrgro+f9NHXUJ:VAss2ljK2bG2T52ro+FNHXUJ
MD5:	198A1B1ADF726BFA2E8F883972DB6632
SHA1:	EEF3880698E2391A4991D406493E6849E488E66B
SHA-256:	17EE1F449E66BB57B727D99171ACB6B5F505C34A77F15CE397E7FEF67AD01F48
SHA-512:	2EF30D959758EDE4E9EF733F57F65709C653660B2231D14EE0EB7FECC19A8605EE83E53D84F4F9EC48A30570E912A2A48EC870AD7594233D3FC79889517A20E2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d................" .....H4..j................................................:.....Y.:...`...@......@............... ......................................()........:..(...p:..b..Hx..T...............................................................H............text...PF4......H4................. ..`.data........`4......J4.............@....reloc...b...p:..d...P:.............@..B............................................0...........................<.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o...x.....0.0.0.0.0.4.b.0...H.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...L.i.n.q...E.x.p.r.e.s.s.i.o.n.s...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...X.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Linq.Parallel.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	849168
Entropy (8bit):	6.795087320782585
Encrypted:	false
SSDEEP:	12288:v0Ct06sSDBdYi9SyhyIHDoXjc1++XSNC5SlgM4tHqsXAYlv0avzx0BfeY9p:CAdYsSyhyIQjc1rH58oPlvbOfeS
MD5:	C53066F77E110703AA387778E1C863A8
SHA1:	88C179070F71AED65225A80CCB9F3513E924347C
SHA-256:	82A4A4BA6D7256CF455D4147CF4D20F528A0162D4F7DD0A822336FE28F482B33
SHA-512:	AA68F325787BEF01DA708F7657160C2A20E162E9EB75D2A09D3A1935998602B686207C944069F86481718E28E3FEB6BF9ED70D480029DBE57642A6DDEA44570D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....TO..........." .....X...r.......................................................*....`...@......@............... ..........................................8p.......)......P...8...T...............................................................H............text....V.......X.................. ..`.data....X...p...Z...Z..............@....reloc..P...........................@..B............................................0.......................t...,.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o...h.....0.0.0.0.0.4.b.0...B.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...L.i.n.q...P.a.r.a.l.l.e.l.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...R.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.e.m.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Linq.Queryable.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	228512
Entropy (8bit):	6.510046883025044
Encrypted:	false
SSDEEP:	1536:4l5IDykrf39YTBFWNR4be9Dw5CwBVOe0slziI/8n148/JE87MZzgiqGMLSwT905r:4layKf3+fWb4beOAwn0cKn5/gg9Gif2V
MD5:	D1B119C7EF36BEA389A68B00501F6C04
SHA1:	1540CFD8C77F2FB9AC1F7A90924164F1A48303AF
SHA-256:	7AF2E2E1D38304C9F698745C47C9EDD825D2F0AC329905365193A06F73260714
SHA-512:	6970A1AC4C37E85425E86F8E4A7D31B24790C782654EB4DE05A1CDEADD96D49162DE9B46C72B746A5704390E68775044005B343165E697B9DA8AF2477CF03F2C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d................." .........z...............................................p...........`...@......@............... .......................................4.......T...(...`......h...T...............................................................H............text............................... ..`.data....n.......p..................@....reloc.......`.......J..............@..B............................................0.......................t...,.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o...h.....0.0.0.0.0.4.b.0...D.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...L.i.n.q...Q.u.e.r.y.a.b.l.e...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...T.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.e.m.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Linq.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	537760
Entropy (8bit):	6.825575081948942
Encrypted:	false
SSDEEP:	6144:vLvqrD97IbzrSLW5iIEobS5lEPsypTcenKskBvYvvyejaQO02Kuqlz8J1J4+PDx7:TSrZ7Im65iIET5mYIKsk8HQSUASxWQ
MD5:	CB8FB3A1F08073B05BDF584702992EA3
SHA1:	0F2BB7B78408D8F5DE65FD9CB1A7C6CECAD968F0
SHA-256:	CFE8EA1B22D7AC973EA20CD7B730564B30E648D99E9B934C2207D4E809FF7331
SHA-512:	4A7446F3A3125DA705DFEEE62D26B8284710B78CC15E044FED8A5FC4D9B9045459337985FCF23A0C10D4A0267E24D1836C5F9B489D3A84672F349A2CDBA5878C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....q............" .....`................................................... ......5.....`...@......@............... ..................................4...$...8F.......(..............T...........................................................8...H............text...._.......`.................. ..`.data.......p.......b..............@....reloc..............................@..B............................................0.......................$.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........<.....S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...0.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...L.i.n.q...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...@.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.e.m...L.i.n.q...>.....F.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Memory.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	173728
Entropy (8bit):	6.7936069058104795
Encrypted:	false
SSDEEP:	3072:KZRPN4ab6HEuCKvSwOy6fM/vfovpPh/h/tmlIYrAMS1jUgMEU:et+GKjtGPh/hwlUMtH
MD5:	631C4EA4F455AA0FE7B7B320F2552D24
SHA1:	C809BCEDD4C86F26A1A1B4E9B4D32A98067586B4
SHA-256:	87B46960B1E56EB2F7F021014EF77FDEC8265D6154926B799BE5B3654A1959C6
SHA-512:	E9BFBEF71FE18F281B6036C37F9EB929115404B7197E9C7609B63659778478C3C918906BEA775347FAABAC2B135743514C6982C8BEEFDF4229A78F2FDFCF0C84
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...j`............" .....P...,......................................................<{....`...@......@............... ..................................D...d<.......~...(..............T...........................................................H...H............text....N.......P.................. ..`.data....'...`...(...R..............@....reloc...............z..............@..B............................................0.......................4.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........L.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...(.....0.0.0.0.0.4.b.0...4.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...M.e.m.o.r.y...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...D.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.e.m...M.e.m.o.r.y...

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Net.Http.Json.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	82096
Entropy (8bit):	6.569877686686517
Encrypted:	false
SSDEEP:	1536:kFm17OHiPum1nVzbcB0ARlK0XB5YjbwlHUfECN7K+GvfmVzS:kFm1SHiPu6nhbmK0x5YjbwZCo+R+
MD5:	E06030584DBB06D8CCF4A40D93277FE0
SHA1:	351B45E62DCEB390CA5EC15B1671A75C89097A2D
SHA-256:	675AFF838D377EFE62077D802AA76612428CB8E1636B3499AA77B4807BB911D3
SHA-512:	C25AEF168ADC8E024923E5568E397235AB575861180BFB09EFFC80BF12D65A654CB8186F8D789E387BE4C419C62BAF86259C0DD23D6DF92A12585A8A7BBFB072
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...+............." .........&...............................................@............`...@......@............... .......................................*...........(...0......(...T...............................................................H............text............................... ..`.data....".......$..................@....reloc.......0......................@..B............................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0.....D...C.o.m.m.e.n.t.s...P.r.o.v.i.d.e.s. .e.x.t.e.n.s.i.o.n. .m.e.t.h.o.d.s. .f.o.r. .S.y.s.t.e.m...N.e.t...H.t.t.p...H.t.t.p.C.l.i.e.n.t. .a.n.d. .S.y.s.t.e.m...N.e.t...H.t.t.p...H.t.t.p.C.o.n.t.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Net.Http.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1807024
Entropy (8bit):	6.728537950306912
Encrypted:	false
SSDEEP:	24576:scEZm+RuCUVpPcTPui76qNPd8e4Qt7b91doDn8Tuq1Vx:scExRMcKi76qNV8e4cpg87b
MD5:	D1E7A24EAF1E019CD90570C6C17E16FD
SHA1:	372E3295B7BF6AB9A53B8889FF3D732C21788B10
SHA-256:	5917DDBEC3E744FF9760038DD69FD5AEB3BFC2C73DAF10B83C9F56B959017DCA
SHA-512:	7DE1B52318D506E54B21B396D3159899C3AA263EC1CA95C748AFA04C247DE3B3CB4F68B6D8748ABE8AA06F6AB0CB8952DC11E4C241375B6951FB54D65A73A6D0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....a..........." .....^..........................................................Pt....`...@......@............... .......................................t.......j...(...`..,...8u..T...............................................................H............text....\.......^.................. ..`.data........p.......`..............@....reloc..,....`.......L..............@..B............................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0.....d...C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Net.HttpListener.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	639136
Entropy (8bit):	6.677725086346212
Encrypted:	false
SSDEEP:	12288:PEGkNR/REK9xyl0r82LMqMLp0FTgXdSfMR9XmljQKwS9gaX:PBkJ9E2/MqUXdYkKN
MD5:	72B043F622FBADBC4AE9BE4373128C62
SHA1:	B98905C7D65AD7A2E5E7E464A356D5AFDC289BE9
SHA-256:	703296261C642B5075667230FB9E978DCE6918A2B70215AC94A9C4D48A4F1C3B
SHA-512:	9FF86D949EAB57EDCC16F6ED601FFBB95A1CD64C6DA3C1EE28127D6FC57BC3973D8E65C256BC54B47134882838FA4EE56BBD3108E3DA17B766ADE6E2F0933FD5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...^.U..........." ................................................................{.....`...@......@............... ..................................,...$...p;.......(..........(3..T...........................................................0...H............text............................... ..`.data...............................@....reloc..............................@..B............................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........4.....S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0.....d...C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Net.Mail.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	552096
Entropy (8bit):	6.67938374349305
Encrypted:	false
SSDEEP:	12288:o+E2aYtImBnF7Ac/4Hj52MvPTUkhY5JqPBuZFBTOQ:o+7XF73AMMgHJ
MD5:	6986F6261683C23F6A0C23AB4B01E1F5
SHA1:	42544FBE07308C8CB595A39D732B1BAB0DA5B9A2
SHA-256:	0D951E4C78BF6BBF11D70CD4F394FA08BEECB652149DA8190CB4DAD85D266FC7
SHA-512:	6A8117ACA313C4CFABED56AFBBC9D6835CAA5C999EE20AEC4B3F74E203D2CEAB4C36465052654B59662F6AF411B89B7463CB3B73A3549EA583366DC880CF1C00
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...<..........." .........................................................`............`...@......@............... ...........................................@...D...(...P..T...@2..T...............................................................H............text............................... ..`.data...Qz.......\|..................@....reloc..T....P.......8..............@..B............................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0.....d...C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Net.NameResolution.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	101040
Entropy (8bit):	6.582502725798627
Encrypted:	false
SSDEEP:	1536:1M8vYfE0vU1RW02ErDDCTUxyBKPGmxRo/mpiAJc1I0CzYT:1M8vuc1002ErnCoxyBQfoOpir1lCsT
MD5:	6F03BFDE2193B0A3E204DE1C74B92D56
SHA1:	F431F86179E9411D646C2C7C53336920AE828E9D
SHA-256:	119A2499FBFB7CF08EB7CEE2BEE8BC6A56FBB82331E58A3876C0FA4E07EC2C44
SHA-512:	332064ABF34954D0F212A643300249DA5962C6A2FC8701D5891DEDF5A635CEDD1C4070E96E704BBADE4062257F22FDCA79A9627F212B5EB2E7910DF7C0A12007
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...U+-..........." .....8...(......................................................Hj....`...@......@............... ..................................8...P2..(....b...(..........P...T...........................................................8...H............text....7.......8.................. ..`.data....#...P...$...:..............@....reloc...............^..............@..B............................................0.......................(.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........@.....S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0.....d...C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Net.NetworkInformation.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	150704
Entropy (8bit):	6.571448690309174
Encrypted:	false
SSDEEP:	3072:/LLrWH4xdxGKZOB1jG9LysLUYxPZLVXQ2Vfsynb7D+1z+K8C4:vr+4rxGb1SLUY5vnK1aJn
MD5:	7655001D0BD38D5AB48CB8F12DB65CF3
SHA1:	0B08099444B5F0DC4E32B5AB330BACC290486369
SHA-256:	5E7F2848AEDCC48FBF7F0549811EAC7619F1C7E544A41D56812118B9D2D57001
SHA-512:	BFC4F2FB320DF53DF884CB73F06E2A18E9BBCBB8E06E80F85F72F43CB36D7B9E78558DA02AF9839A7F874F0853FF1D88F3D67703512D0381ACEB68D179BFCC7D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....h..........." .........0...............................................P............`...@......@............... ..................................P...p;.......$...(...@..h...0...T...........................................................P...H............text............................... ..`.data...L*.......,..................@....reloc..h....@....... ..............@..B............................................0.......................@.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........X.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...4.....0.0.0.0.0.4.b.0.....d...C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Net.Ping.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	79008
Entropy (8bit):	6.582389951148044
Encrypted:	false
SSDEEP:	1536:HbfB1YRHHRfzBjCV+oU6ZMg4m5rq2SvKBpKe9wWiezR7:HXuHHlzhGD48rqepKA59
MD5:	FD060E11438CE1C9E4D919A266E4A442
SHA1:	79F3016379C79011BCB847194D7EC925C3CAC81A
SHA-256:	705BA32DDA7B47BE62410C80BF4C7340D0CE88AFDC95F759A9ED7B5D84FE335B
SHA-512:	61083959F8BF666470EFE1EB8A17FA98C111BE153D57A1A4DE802BE566ABA87EB698A210B2C14BAA1169A96FB890FB9A63AAF5D23D633F0510B033C3C12283ED
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...M............." .........................................................0............`...@......@............... .......................................,..D........(... ......@...T...............................................................H............text............................... ..`.data...............................@....reloc....... ......................@..B............................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0.....d...C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Net.Primitives.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	214176
Entropy (8bit):	6.6921953780754695
Encrypted:	false
SSDEEP:	3072:BmggvFEWdRza8pLnesj/qLBCmA4HX7T1sWkN6OcE/64BWm1Y2us+6M6eURooS74:bCFEWDDjeB+w+pfwT6eSooSs
MD5:	DDAF424C54E90C76316BE73F1F15F970
SHA1:	00F80DA472A1EE01B4138F4AA57570DBB9E9B1A0
SHA-256:	DC1D3A0987347C688B3047A405967D51F4A1A32AAF2885A7BDABDB412CAAFAFF
SHA-512:	B3FCA795BC35C47D0BCF0BD17D01685428F53C8F5063557EFB66B113AF02B4E94752315170527F49274E7EA3ED19E22BE0E43BD1ECA3074069F06700C2467497
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...n.^..........." .........:...............................................@.......<....`...@......@............... .................................. ...\V..<........(...0.. ....!..T........................................................... ...H............text............................... ..`.data....3.......4..................@....reloc.. ....0......................@..B............................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........(.....S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0.....d...C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Net.Quic.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	293536
Entropy (8bit):	6.634464424482067
Encrypted:	false
SSDEEP:	6144:RMDEi4Jc8FmkBelCUPpuLdNnbRw6WSLqlXea5H:YEiIPClCEpuLPbIlXNV
MD5:	B9F1E47413CBD9AFA77D00DA45267018
SHA1:	3FDD8EFC59F549D03A4E062DA657EEF453BFC765
SHA-256:	CD4DBF8C9379A02F6CF50E1C1FE5C122F29F1A53C0311A22B67F3B214312C796
SHA-512:	61C7F64A72164EA5B905FBBF887ECE6D36F29F388B36BA0CE34DA9BCE93181C6773925BF09E3D0888544D49E8D0668853A3C4CFB7B0520F3C846B4A7C230282E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d................." .........n............................................................`...@......@............... .......................................w..\|....R...(...p......`&..T...............................................................H............text...#........................... ..`.data...Re.......f..................@....reloc.......p.......J..............@..B............................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0.....d...C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Net.Requests.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	349344
Entropy (8bit):	6.624107570678427
Encrypted:	false
SSDEEP:	6144:xWsrUOUhfxGWRQE1yFk1bsPOWe5G8eopHFAycl:xzUPhfxGG1l16waPl
MD5:	A04C9C006ABB589793DE138904497209
SHA1:	1536DD1C987DC2EAB05D2D1550FCCE37A7475F40
SHA-256:	2E9A0FC3B089EBABAD9E7D097BF6E82383FFA7C4FF3864288DFB71ACC78CF8F2
SHA-512:	5551898BE7039B81B61FCD4AED4085BFF57953F987A661A1909FE17410CE0119709B599FACBA8ADB77B330FAAE1B831798777EF2F288DA0EB1BFD60B6E4F2F51
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...,}x..........." .........p...............................................P......H.....`...@......@............... ..........................................*...,...(...@...... ,..T...............................................................H............text..._........................... ..`.data....g.......h..................@....reloc.......@.......$..............@..B............................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0.....d...C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Net.Security.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	685728
Entropy (8bit):	6.822180954474917
Encrypted:	false
SSDEEP:	12288:qaJz0+veUK58CPhDfPT755GgvlGgPMBe+jPvK/3LP1eVSMGy:qajvK5thDHnWAxmhN
MD5:	5551D7AAA4D9AE82540A2328BDAD438C
SHA1:	731E2B2EF16D97D0DB98285D358E693648CAF51D
SHA-256:	0B77A5B9100A0F58C7900318E69093747EE73FDE5C087015CFFE3027812AB055
SHA-512:	7CB98ECC52B6265CB6D65D5D3B0906FAE0CBB7736BB2B5F86C5DAC6EE8F7B204C5145B072034E52B4A0B7F2439A95E333AEC978CC4D311FE1D4BCF29AA3F955C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....f............" .........................................................p.......y....`...@......@............... ...........................................<...N...(...`..<...(-..T...............................................................H............text...e........................... ..`.data...............................@....reloc..<....`.......B..............@..B............................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0.....d...C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Net.ServicePoint.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	37024
Entropy (8bit):	6.495689494391897
Encrypted:	false
SSDEEP:	768:3b0xAyM9aWrAD9wgg9swexO/i2DuO9zKfD:3b0WyMgWrAD9wgbMiIzKfD
MD5:	68A0A99C8DF5BE32465E23A84E0A40E0
SHA1:	58C23679F8717F1A2C334C737A8D7F426E431B20
SHA-256:	5944CDF25E32F364CE87A818D3ACA8F0DCAFF2A7C4C8AD76D74B52E5200F9D0B
SHA-512:	D1C7EDFEF15199F76AE07F857AC040574A4861E1341958B5004936BCEE57904974203E9906109DD4F294CD63C99C95CF012ED77CC31C3FB4364DD83352E42DAF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....\..........." .....\................................................................`...@......@............... ..........................................`....h...(..........H...T...............................................................H............text...KZ.......\.................. ..`.data........p.......^..............@....reloc...............f..............@..B............................................0...........................<.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o...x.....0.0.0.0.0.4.b.0...H.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...N.e.t...S.e.r.v.i.c.e.P.o.i.n.t...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...X.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Net.Sockets.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	506544
Entropy (8bit):	6.739164652415746
Encrypted:	false
SSDEEP:	6144:r72hSkKlJ1dDD6u/S9szDiL1ru21pcIzL9wYopW+t+dRcZB2:r72jKf/f6u6Aiccow+t+dRc72
MD5:	F43C83C2C08D855EBE2B6F77CECE33D9
SHA1:	5EADD0725698192C9B7E5DC0A943D26E453255A0
SHA-256:	DCE9BB8602FD5BE68A7B3C3350794932B9C3F115783C81F789294F5FE5370784
SHA-512:	24E07DB9AD794B748D5044CF97BB56FE11EDD79AC39D2C7C66C382E3A0C6EAE9D8FCF7E4C1877A521021853BCCBE861435CD761FAA272D2E3547DDE0AC4F3BD6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...*6W..........." .........~.......................................................U....`...@......@............... ...........................................6.......(..........p4..T...............................................................H............text............................... ..`.data....s...0...t..................@....reloc..............................@..B............................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0.....d...C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Net.WebClient.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	166560
Entropy (8bit):	6.644685069759792
Encrypted:	false
SSDEEP:	3072:ItJ5rC2/yfNU9rAcz7qu8R2iVY3qwJhliB3UMlusCOR+8qf:cHrC26f69rAczOu8R2+CsCf82
MD5:	12B9B2AEF9DCC3DD932D97EB4E2BA932
SHA1:	0BDA5C0E4BC81022E7B5EFFC454F8FD5A3D98CCE
SHA-256:	03B99113C469D90D1859315535534F92085B9A877894F2555DB230ED31C5DD59
SHA-512:	25D1F82B50CA28ED637E341F75E7A7E7FFC27ED39C3EAC62F2640D9C56CA5648EA6BE97ACA04DFC47997BA6FA7F5C388A4B2C87E3C4CFEDD4CF43D7CD1C87DBB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....r..........." ....."...>............................................................`...@......@............... ......................................$L..p....b...(......x...P...T...............................................................H............text.... .......".................. ..`.data....6...@...8...$..............@....reloc..x............\..............@..B............................................0.......................t...,.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o...h.....0.0.0.0.0.4.b.0...B.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...N.e.t...W.e.b.C.l.i.e.n.t.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...R.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.e.m.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Net.WebHeaderCollection.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	60592
Entropy (8bit):	6.529930344978332
Encrypted:	false
SSDEEP:	1536:rkfRro26ymnXsUOTwE93VulTTTTTTTTTTTTTTTTTTTTTTTTTbNQCzKzg:rcricUSwg3VC2COg
MD5:	6E7C43CB0822F8F9A370CF158DCC51E6
SHA1:	925F1A11B06168EA53DBD57B218E5E45F6918EB8
SHA-256:	4EFC8744E24E5727E579FAF3764842A0995E6EB1BC80017903FB54E5F616ED4F
SHA-512:	F47A3A00EBD6337D9986509A9A547FC545C7A533DCF038FFFAB154019C5CA1C5C20C0D084A78E46AF0AD3B1735949360B2690969814CE08E4C41B752CB979F03
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d................." .................................................................}....`...@......@............... ......................................."...........(..............T...............................................................H............text.............................. ..`.data...9...........................@....reloc..............................@..B............................................0...........................\|.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...V.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...N.e.t...W.e.b.H.e.a.d.e.r.C.o.l.l.e.c.t.i.o.n.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...f.....F.i.l.e.D.e.s.c.r.i.p.t.i.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Net.WebProxy.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	31904
Entropy (8bit):	6.542271640578904
Encrypted:	false
SSDEEP:	384:P3WpDwWZEk/0bccZA2VUi6VGt1QWKlL/95f1VqOMHR0Tb2HRN7p/6fR9zcYjM:P64k/0bw2Vd1HHTx0/iK9zjM
MD5:	A54DE7C6529F014154D2E889FE8EDE29
SHA1:	907886DFA9DDA9A307544A398215D0B62D3D4183
SHA-256:	21351042DF4599B851668ACEE45B24A0A3906FDDFBA4F8011F34689F4AF73BD5
SHA-512:	0AFC1FB76F0374B3ED37F2EDDFB75F653DE211F257481B935FA5F191C8AB650895FF2A85565A2A54D92A3C3EB608CBD5190A8C69E593C6228086AD35BF454D58
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....{............" .....H................................................................`...@......@............... ..................................t............T...(...p..........T...........................................................x...H............text..._F.......H.................. ..`.data...i....`.......J..............@....reloc.......p.......R..............@..B............................................0.......................d.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........\|.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...X.....0.0.0.0.0.4.b.0...@.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...N.e.t...W.e.b.P.r.o.x.y...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...P.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.e.m...N.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Net.WebSockets.Client.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	76448
Entropy (8bit):	6.4796545632769655
Encrypted:	false
SSDEEP:	1536:eNZSMIHHUICmd73OK7nhuY9YLOXCNLlcqQbIlm3W9ifzVl:aYnUIj53B7nhuY9YLNhlcqQMbWhl
MD5:	6CE3FA2C9EBD770E7DFE4ACB9335CB62
SHA1:	7F60AEF947135A6844F14A1FE7B2DF7B661329AA
SHA-256:	7BE3917C58C8E81604000E7E54C612FB8891F270920ACE31DEF90BC30C0D9D4F
SHA-512:	A8E650D8DBB7A7CC598975579B5B8C2F6CCD1F82C5EF593F150B10F3A387829AEA5EA0CD178A249A0B1DC20CB3356209FE0458CEF4E358FE2E074CC71E78BC0D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....t............" .........................................................0............`...@......@............... ......................................@(...........(... ..........T...............................................................H............text...1........................... ..`.data...............................@....reloc....... ......................@..B............................................0...........................l.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...R.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...N.e.t...W.e.b.S.o.c.k.e.t.s...C.l.i.e.n.t.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...b.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Net.WebSockets.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	182032
Entropy (8bit):	6.639888612233683
Encrypted:	false
SSDEEP:	3072:M3J1yGe/XWqtFo6P6G3ll44/V2JUyaq87repROM8KnXWRDYZbQLmvhfst/Oo1BVJ:eyGMtZPpWZ87rijNXWrmvhEt31O/fRhg
MD5:	0677E710D1104453BE4DE270036F654A
SHA1:	A9A2E928172E376B043CC78498FD117C229F1B3E
SHA-256:	239CE4C8B324555BAABDAD8144AC25D4E8766859729927A4463490593FCA9DF4
SHA-512:	FE34356C2D8A81CCAD2BA231416131D463D5EEAED250788152720642FBDA54324D31225D0F4870B2695253B868675D7BFA16A2FA6F227AFB30E46F5C79BF92F6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....89..........." .....d...8............................................................`...@......@............... .................................. ....O..`........)..........H...T........................................................... ...H............text....b.......d.................. ..`.data....3.......4...f..............@....reloc..............................@..B............................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........(.....S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0.....d...C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Net.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18096
Entropy (8bit):	6.567224389721672
Encrypted:	false
SSDEEP:	384:IV6EWw13dN8BhWoDVaWZ5kHRN7k6DX+iR9znSgT:IV6Er13dK0VDuO9zSW
MD5:	C5410F9398AD703493814C0C539983D5
SHA1:	F50A29651E2D9878AC8DF977FF816177612D0CC0
SHA-256:	87F94839E0A7BF2B0713AF9565717F608444D82E902B5F25E6A1B02DDFCBDD1A
SHA-512:	77A81EAE4EA373137594182FEAE15B16ED89C91C2E6CE8707926AB8D2F9C92FD8930E019F993EF0D41DE2A9164E4BE7AB30EBC570A7440C7382958FFB709BD72
Malicious:	true
Yara Hits:	Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Net.dll, Author: Joe Security
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0..............2... ...@....... ..............................12....`.................................92..O....@..8................(...`......l1..T............................................ ............... ..H............text........ ...................... ..`.rsrc...8....@......................@..@.reloc.......`......................@..B................m2......H.......P .......................0......................................BSJB............v4.0.30319......l...X...#~..........#Strings....D.......#US.H.......#GUID...X...D...#Blob............T.........3....................................6.................l...\|.l.....Y...............M.......m.....m...c.m.....m.....m.....m...'.m.....m.....m...^.............n...5.l.................S.....S.....S...).S...1.S...9.S...A.S...I.S...Q.S...Y.S...a.S...i.S...q.S...y.S.....S. ...S.....S...

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Numerics.Vectors.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16136
Entropy (8bit):	6.69789111486107
Encrypted:	false
SSDEEP:	192:bySO61rpiLoxx9FUWaIBWYuWXebPpUNTQHnhWgN7acWMkKDUX01k9z3AQ3T+Oq1:bkGHjiWaIBWYTb2HRN77kpR9zzXq1
MD5:	D7358C16B1104186BF3F390FC3A9BEA0
SHA1:	E564DBB2DB235BF0804163681C443A373C9852CF
SHA-256:	EFB6A646E8C56504607C47CB7EE682B3DAEF7990C48D1F483D1DCB35DF708872
SHA-512:	B1AA9DE98B40BE77677766920DC260A96C05DFBF4BF819E03C9515F934CD132852FDD2C8156C777FEC2A407BF4973A6938D2712317147B013A51B8E70FD6689C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................."!..0.............N... ........@.. ....................................`..................................)..W....@...................)...`......D)..8............................................ ............... ..H............text...T.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................0......H........ ..t...................P ........................................v...&lv.e....JoH..w.[Wh.X`$\|.. K._."Ywp. .......y6w\|...>.!"l4..RH.....A.q.YtJ..u./.......K*p..eAUOJD.(%...r..!..&.<......gBSJB............v4.0.30319......`...<...#~..........#Strings............#GUID...........#Blob......................3......................................D.........]...........v...................`...8.....0.......r...\.r.....r.....r.....r.....r.....r...}.r.....r...........6.....

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Numerics.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16032
Entropy (8bit):	6.676795905133218
Encrypted:	false
SSDEEP:	192:VYaDsyPWe8NWoCuWXebPpUNTQHnhWgN7awWRPGoDoSJj+iX01k9z3AgI9:3YyPWe8NWbTb2HRN7+GoDX+iR9znU
MD5:	93922CD77ED8FB8DD4716417E0B5BBC1
SHA1:	A2B02A3E040519D600E5CA38B238F817F5A73799
SHA-256:	5C3D7ACA342B10E182F6A6A5A625F11AC2DF54C1233D74C6B43A85F452A9F0BA
SHA-512:	87D6D8BE3DBC6A6BFE3883BFEBE3E5CEE7997A2851D7D50A97A0A4147249908DCBF1E949BF70933B99C0B3028746F0A9B72BFEBF1821ED9E5EA37A5618ECC62D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...v.x..........." ..0................. ...@....... ...............................t....`....................................O....@..X................(...`.......)..T............................................ ............... ..H............text........ ...................... ..`.rsrc...X....@......................@..@.reloc.......`......................@..B.................*......H.......P ......................<)......................................BSJB............v4.0.30319......l...\|...#~......@...#Strings....(.......#US.,.......#GUID...<.......#Blob............T.........3..........................................0.........]...............................D...?.e...K.e.....e.....e...".e.....e.....e...}.e.....e...V...........e.............-...........................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y......... .............

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.ObjectModel.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	91296
Entropy (8bit):	6.550536641013447
Encrypted:	false
SSDEEP:	1536:DUZs3lSIb6yupq8IMnOQcdDW5qSsixzrp:DimlSIbWuDW5hh
MD5:	92FC3D1C1CDA10E78C9B58014F6F4AC3
SHA1:	852A7E3EB7BCC3DAA94CEF9A8B981CD5B019D1ED
SHA-256:	6AA94D4C005857A607FD2B1B99E463202EFA9F36DC8E04D2397CF15E568D30A7
SHA-512:	396ABAD6C9A128999921C48C8D7ACB2FE31C75EE09FE1A2ED6E75BA1980AE637794156A476EF59827E0BD4B2647DE8EAC82DB6113035CCD455B28D529A1AF071
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...%............." ..... ...................................................`......__....`...@......@............... ..................................t....).......<...(...P..........T...........................................................x...H............text............ .................. ..`.data...H....0......."..............@....reloc.......P.......:..............@..B............................................0.......................d.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........\|.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...X.....0.0.0.0.0.4.b.0...>.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...O.b.j.e.c.t.M.o.d.e.l.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...N.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.e.m...O.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Private.CoreLib.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	10636960
Entropy (8bit):	6.839765238984815
Encrypted:	false
SSDEEP:	98304:FQkYiiZU0WH7nZu+MR0lVVKPq/SPJ5VDEo4zDCeUtQoqS0iB0mwSvFh:d/MU0WHTZu+MR0RKPq/aJfDboeYivX
MD5:	C1FF9B80B06C2C7CFDDFAA6778EE7747
SHA1:	C6AB2AE934DB8DCEC41EEBE7BA7D54096CA31C7D
SHA-256:	6BAA4A98795C72B72EE307A5BA61199448F371BAF27842D63DEEC4EC2D89DC76
SHA-512:	C9D6E11F8CB2FC53F14DC7026A1E4BE72FBE485BB96A39261161FB9BDD110FD7201D2A68427CE30724E62EAF8D8E90F63AB7CCA58AF08C56D538283CF3B74A48
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...A.E..........." ........F...............................................P......H.....`...@......@............... ...............................................&...(.....\|r......T...............................................................H............text...<......................... ..`.data...[..........................@....reloc..\|r......t..................@..B............................................0...........................<.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o...x.....0.0.0.0.0.4.b.0...F.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...P.r.i.v.a.t.e...C.o.r.e.L.i.b.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...V.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Private.DataContractSerialization.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2077344
Entropy (8bit):	6.727346929047273
Encrypted:	false
SSDEEP:	49152:GrxCRhQp4ag3NMUSsdt1V8g4P1YnnpP2m5SqsVkKtODPPL82DLoL0c:egAD/L0c
MD5:	25C54D74C69402C4C96808AC7248C17F
SHA1:	ADE854BB2465086200630163A9620350377D2348
SHA-256:	91115EE5B27B0143B2078897BD39BF4AC17D24E23BE36390DCC7FDDD007724F0
SHA-512:	035AB66EE638384692ACCA812FDB13A32736C81F901125F2F396F0C5457CAD128103D9945BEAF42C19B3C06B04A83C57649506920133ED4EFE65335D55BCEDE1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...Yx............" .................................................................. ...`...@......@............... ..................................H...X`..8........(......,!.....p...........................................................H...H............text............................... ..`.data...s\|.......~..................@....reloc..,!......."...h..............@..B............................................0.......................8.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........P.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...,.....0.0.0.0.0.4.b.0...j.)...C.o.m.m.e.n.t.s...S.y.s.t.e.m...P.r.i.v.a.t.e...D.a.t.a.C.o.n.t.r.a.c.t.S.e.r.i.a.l.i.z.a.t.i.o.n.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...z.)...F.i.l.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Private.Uri.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	252576
Entropy (8bit):	6.794336733665072
Encrypted:	false
SSDEEP:	6144:bZmKz/L8ZiVT1y2uAMEi5jN8lcw3cFZejsPg:VRz/2uXIRB+lcQcFQjso
MD5:	638AE490B1F192AAFFC0459C4EDF8986
SHA1:	3FF69EEEE615D02E61EE1A3E8ADAFEA11B8BE160
SHA-256:	249A48F52345865172DF680EAD42F0BD65D5A34EF0F6AA17D702A3F093BCB0BE
SHA-512:	66B2B598972ABE7D488E98A924AB8699A52F520237C2A6C3D4FCD9BB28E5580CE8DF4C81743D346715C2FA6C2B4ECF627A54379AB799F6BCB658C5A4F6226512
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...\|m............" .........&............................................................`...@......@............... ..................................8....V...........(..........(...T...........................................................8...H............text...c........................... ..`.data.... ......."..................@....reloc..............................@..B............................................0.......................(.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........@.....S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0.....d...C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Private.Xml.Linq.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	405168
Entropy (8bit):	6.712002628807697
Encrypted:	false
SSDEEP:	6144:trH/Hb7EddcJZFy5BpI88/wHOlKPmSMQpt:tr/bDJZwr8/wHOG1Mm
MD5:	63524D37F22815DBA14868742070443F
SHA1:	D795BC1D765E6EE2DB40B844D10DFE6A0A667DE9
SHA-256:	5F7E5D5239EE2BCD0743B7C48B46E42C7EA32B7891B92D2C1F207DDA98814363
SHA-512:	288AB152DC8270CE013871821F57C522DF56373D9C356276A3EACAF089F92C2D0333D3EAE01435E82677191E9054DEF14E75B352F121100B6EFB8D7EF82DAE57
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...p............." .........j...............................................0............`...@......@............... ......................................D....0.......(... ......(+..T...............................................................H............text...2........................... ..`.data...O`.......b..................@....reloc....... ......................@..B............................................0...........................`.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...H.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...P.r.i.v.a.t.e...X.m.l...L.i.n.q...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...X.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Private.Xml.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	8506128
Entropy (8bit):	6.820931148801105
Encrypted:	false
SSDEEP:	98304:yO1SGKozFD9mm42Sua0TaFqZlHZ5WnEedQnX+:Y6FD9/PSudYQ55WEe+nu
MD5:	F6DDF16C51B5F08B437CDA25A76763F1
SHA1:	3A09521A65F1165897CFD2C47AB314654AA3BF70
SHA-256:	699F56B15B411FAA139683CEE0F8CC2097F5C806769495F30F5A7657B6EFB814
SHA-512:	3476CCE8478293DB395F2A7F6DD1A568312B15970E1843411CE32C6B3454BA8ADB00186FBA55E8EB614D1ABAAE98385753FD08AF99C69365783F8D2BA2DEE8B5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....VW..........." ......\|..........................................................h....`...@......@............... ..................................8...L...8R.......)...`..X_......T...........................................................8...H............text.....\|.......\|................. ..`.data...8"...0\|..$....\|.............@....reloc..X_...`...`...B..............@..B............................................0.......................(.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........@.....S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0.....d...C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Reflection.DispatchProxy.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	66224
Entropy (8bit):	6.574503968728899
Encrypted:	false
SSDEEP:	1536:3JGqf6POkymbnA0be+s8cu5BivUxbIuKmVazWdIR:3JxfU/ymbAiy8Biv59mA4IR
MD5:	FC52F593BB9E164126006B3B70EEAF3C
SHA1:	92DD99471283B99CC01981FABF20330918A5F1C7
SHA-256:	66487AA13070F7D77F7E94C586B83E5C46540099D1F11691510B8B2DC7441A36
SHA-512:	74FFA42FC56E7079FE32739C4D2C8BD2965D604C1CC0EF71C88A318925103367B6CD827ABC90694258AA8C6C46E9FF39942B9453EC6F200AC6C04570BB28DDBB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...ZJ............" ................................................................ \|....`...@......@............... .......................................%...........(......0.......T...............................................................H............text............................... ..`.data...............................@....reloc..0...........................@..B............................................0...........................\|.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...X. ...C.o.m.m.e.n.t.s...S.y.s.t.e.m...R.e.f.l.e.c.t.i.o.n...D.i.s.p.a.t.c.h.P.r.o.x.y...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...h. ...F.i.l.e.D.e.s.c.r.i.p.t.i.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Reflection.Emit.ILGeneration.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16144
Entropy (8bit):	6.727495276158911
Encrypted:	false
SSDEEP:	192:fLXW5xxS/WV/UWAuWXebPpUNTQHnhWgN7agWh+qLfKUSIX01k9z3AEXzXl:fLmjI/WV/UWATb2HRN7o+qb2IR9z5p
MD5:	AB76192CDC1676946798F95CC77B176E
SHA1:	027CC4E660DBBDE2823DA4BA96B6B1EBBDEE6BB5
SHA-256:	CD6EFB6344907B5A948242C8539C3AD298088B7E1D07916F073A5E340DE1B2C8
SHA-512:	6091AC166514B55C89FE574F8127DAF6EA10535510ED993FB833E7970B91D62F8E370C589D4EA69F14EBC989024692925B88513A54CCCC4B29559342B00D4455
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................."!..0.............n... ........@.. ...............................c....`....................................S....@...................)...`......P)..8............................................ ............... ..H............text...t.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................P*......H........ ......................P ......................................#..de....'...k.V.w.)dQ...$.7.7.\|.ek5X.YH+.[...m.$.......`..'..}$\...j..:.!.>B...&...W.II.).f...9.tc..n.%....Nf.s.:..c..H.BSJB............v4.0.30319......`.......#~..t...D...#Strings............#GUID...........#Blob......................3................................................"...........;...........f.......7.................b...!.b.....b...[.b.....b.....b.....b...B.b...O.b...v.............

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Reflection.Emit.Lightweight.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16032
Entropy (8bit):	6.691633771791216
Encrypted:	false
SSDEEP:	384:9Qfj/DWxgVJWyTb2HRN7bH3bBmo8R9zbcfAy:YFz/ijtmoQ9zY4y
MD5:	D9140022D44ECEDE36C14C0C1B7D1060
SHA1:	488E44A702ECFA93635A800DB90F52CA06B972D5
SHA-256:	48A4F528965FB029BF7412766FD484F2BDB3E12DFD11BAFA902A709924712E39
SHA-512:	38CDA94BFEE4D2E71E28B5B8AAA65C585F910B0108091ABF8F89DF6F682BE8B58C9641ABD99679CDBCD2C8191F08AD2B47BE49E774A05B4B8E529F2485904F5F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....f3..........."!..0..............)... ........@.. ..............................\_....`..................................)..K....@...................(...`.......(..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H........ ......................P ........................................ >..=..<].../f.[lI\qL..^.zV....=.9....bLn....sk.*U..=\V.[i...<.JfuhvY............DC..@...\|.....ge....z.x{0.=..i.....r,6HWBSJB............v4.0.30319......`.......#~..H.......#Strings....P.......#GUID...`.......#Blob......................3................................................2...........K.m.........v.......@.................G...1.G.....G...k.G.....G.....G.....G...R.G..._.G.................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Reflection.Emit.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16144
Entropy (8bit):	6.728917502633844
Encrypted:	false
SSDEEP:	384:/lx9u8VLLW6M4RWgTb2HRN7Z89R9zkw1x:5umx/iZk9z7x
MD5:	9AE3646E556CE64EB0FF31443009E739
SHA1:	FD53C3EF4C8237303E4E3F54F437007FCC8092CF
SHA-256:	30DD6B8C9BB8E749017C759F42DC766DA935C078AC53A0CED3996189BE1677F7
SHA-512:	8C45829E6D92C1E1B27AB71DEB1DD4FD177AC3C095EF0D7A098BAD55D8177907BECEC77CE694BEA658E97739BA275F14152D17CFE40BF639BA69EA4625BCC46F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....r..........."!..0................. ........@.. ...............................Q....`.................................d..W....@...................)...`.......)..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.......................H........ ......................P ........................................Z...IB%...\...5.S......C...d...;..../.4Or.]".<.=c....j....c.....E.r.#C#.,I .r*Uc......Fs...n.V........d&.1.!..xIb.BSJB............v4.0.30319......`...X...#~......p...#Strings....(.......#GUID...8.......#Blob......................3................................................"...........;.....2.....f.......$.................+...!.+.....+...[.+.....+.....+.....+...B.+...O.+...v.............

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Reflection.Extensions.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15520
Entropy (8bit):	6.782841373640162
Encrypted:	false
SSDEEP:	192:iBjg9xJ8WKFWWrbuWXebPpUNTQHnhWgN7awWU+xpBm+0U8X01k9z3AYLjEQLX1e:iaJ8WKFWWXTb2HRN7ELBmo8R9zbcQLc
MD5:	FCC4667473E85B6AED489951A45C8DB5
SHA1:	A7402B54EB442BF7801F8712A638EFD3DE1BD59B
SHA-256:	8C2CB7E59AAA6CEF0FB37C225EE93B17453DD23D6266E6182CB7C3BF9A486CA6
SHA-512:	2807899EAFD114ED4A83B9E4C7C2640CFC010E401E07BF7B779EF4155A0BE117E912061A4ECA419F42270968B39FC0543C8458ABEA80F53B89611D7A8869A1A4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....+............"!..0.............n)... ........@.. ............................../#....`..................................)..O....@...................(...`......`(..8............................................ ............... ..H............text...t.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................P)......H........ ......................P ......................................#.SX..._8..~of.....4O..wUhy..{L;.;.......K.j.*.H.hx%.E.k...."...KiJ-!...V..B.+........8...w..A..L..5._..H.`..ew1;. `.hA....N+BSJB............v4.0.30319......`.......#~..0.......#Strings............#GUID...........#Blob......................3..................................................,.....,...3.....L.....^.....a.................w.................w.................G.....I.,.......................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Reflection.Metadata.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1130672
Entropy (8bit):	6.719129658785067
Encrypted:	false
SSDEEP:	12288:nW29Ut+zGRZUtKCS6gHPNfucZbq9M/UUnyqM8kJjaJlB9vNDpphH8OQgoVODztyb:JxKnNP8SYM/JMpO/H38dCDzw2Ul+4
MD5:	BB7DBC89ECF8BC954D1AE5FD0F396BF2
SHA1:	6A5629C772F3F02BAE6E2C6C1FAC100C8C061E45
SHA-256:	184C417FC656A21D5F6BD3512F92D64A2993C9222C1EC37FBF69CE87A091ECDB
SHA-512:	49854EDD394CFF4D90903FD7CD9680B9C7522B5C6253BFD6D68B5081DD8B71DBEFAED6E07E9DECF2AE872B6F81F3CBA0AE2B036F71A7F0BA9A5DF2DBE5297755
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...=Jr..........." .....4...................................................@......L.....`...@......@............... ..................................h...............(... ..h...XW..T...........................................................h...H............text....2.......4.................. ..`.data........P.......6..............@....reloc..h.... ......................@..B............................................0.......................X.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........p.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...L.....0.0.0.0.0.4.b.0.........C.o.m.m.e.n.t.s...T.h.i.s. .p.a.c.k.a.g.e.s. .p.r.o.v.i.d.e.s. .a. .l.o.w.-.l.e.v.e.l. ...N.E.T. .(.E.C.M.A.-.3.3.5.). .m.e.t.a.d.a.t.a. .r.e.a.d.e.r. .a.n.d. .w.r.i.t.e.r... .I.t.'.s. .g.e.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Reflection.Primitives.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16048
Entropy (8bit):	6.749176090812988
Encrypted:	false
SSDEEP:	192:drP0CNxxk+WSd+WY3WT56Os1HnhWgN7aIWf+KuowcLK+X01k9z3ATxDE:l0wW+WSd+WV5kHRN7XR6R9zA9E
MD5:	6A0FAA50F2DD7F6D62980851A3846F6E
SHA1:	7414C9AE60B8B4E4121403234CAFD8AB54F5AA97
SHA-256:	679A3E676D892D3E51574BB75BF1F0CFA2CC122998E4299AE314A6BE108E77E6
SHA-512:	215D9739DE4BD064455841CBCE0C36F45856AD4E887B69D520B4606C66A548CD1D13E5E8A503834C9636FC6A9ABA6D22F2C43CF9240C8A56CC62A7A42E781B91
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....?V..........."!..0.............^+... ........@.. ...............................t....`..................................+..K....@...................(...`......T..8............................................ ............... ..H............text...d.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................@+......H........ ......................P ......................................%....Qv.1.@C..L../@..m.7...f....'!I...Qs.m.jz..k..@q..Zx..1.....a.E..x...r..y..\..Qd....q.#...........1..i..BRc....../..L...0BSJB............v4.0.30319......`.......#~..........#Strings............#GUID...........#Blob......................3......................................3.........@...........Y...................`.................g...?.g.....g...y.g.....g.....g.....g...`.g...m.g.................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Reflection.TypeExtensions.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33440
Entropy (8bit):	6.472431574879607
Encrypted:	false
SSDEEP:	768:FUklxcLEAwcc1+Wc+bV/PLfe/iJC+29zuQ:Gklxcqcc1+Wc+bV/jf+iNCzx
MD5:	6BBBAF93CE310567D20E91B6A3766C9C
SHA1:	F922155A45D49E58BD2B551E24FE7CA56DA70C66
SHA-256:	598901E9BB0977363394D5E4A5309D4B5DBFDE211F879B8AE27218E7D60CC751
SHA-512:	7CFD1441D634DA07420EF7E0AA713410D1D8BE7E81BD6E7CAEB1C215D8F53464E03B610E64745734AAF7AD3CD402306F7F970B626D6DE98EC1B3BA4CE59EDC6F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d................" .....P................................................................`...@......@............... ......................................D........Z...(...p..........T...............................................................H............text....N.......P.................. ..`.data........`.......R..............@....reloc.......p.......X..............@..B............................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...Z.!...C.o.m.m.e.n.t.s...S.y.s.t.e.m...R.e.f.l.e.c.t.i.o.n...T.y.p.e.E.x.t.e.n.s.i.o.n.s.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...j.!...F.i.l.e.D.e.s.c.r.i.p.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Reflection.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16672
Entropy (8bit):	6.721405337366538
Encrypted:	false
SSDEEP:	192:l2e1MZK+DxxYljWhZCWRV3WT56Os1HnhWgN7agWf6RyfKUSIX01k9z3AEXzbuu:hEXiljWhZCWRg5kHRN7a2IR9z5fuu
MD5:	4121D87AB0635BA58DB50FF629480B2A
SHA1:	29C4500BDC29362B049105B073A112AFD0AE5501
SHA-256:	4DF31522C0E73B6FC53310A84773956D5F7F4C90D34379DF13BA29E60AC64A58
SHA-512:	4DB8FC22B735679D3622517729DFCB250E5147EB63DB56EFB0FA5244C26E9413B421E72DF7B7E1176CAE0153FBD19088B843252DCB89E8E4977D9CF5A995165F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...r.8..........."!..0..............-... ........@.. ..............................=.....`.................................8-..S....@..h............... )...`.......,..8............................................ ............... ..H............text........ ...................... ..`.rsrc...h....@......................@..@.reloc.......`......................@..B................p-......H........ ......................P ........................................_Nv...U.n..:`....;jT...{.]bB... {..[.b.y...V..kd.md.-^~1.[.d.?....(.=..Y.vv..-........=?....?pu.Hl.gKN.Q.....S.l.rSL_BSJB............v4.0.30319......`.......#~..........#Strings............#GUID... .......#Blob......................3................................#.....a.........z.<.....<.........\.......3.....w...U.....M.....7.....y.................................................<...........

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Resources.Reader.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15536
Entropy (8bit):	6.762417958171301
Encrypted:	false
SSDEEP:	192:5/FP0oxKUW4q3Ws3WT56Os1HnhWgN7aIWf2uhowcLK+X01k9z3ATAI:bPHKUW4q3WR5kHRN7pA6R9zAL
MD5:	02E77FAE4F31717D7845D97A8FE3FEA2
SHA1:	2771E51CE139C4D2DB19056ECA99CC155EC2B24C
SHA-256:	2C42F394495CCAD8F0596FF38C2FDAD40F4CDC81F490187A41C7CF7C1092F770
SHA-512:	91ADABC596E20D718D582CA13B371EA64B56FCC731EA1EFAE6565AFA0099EDDF767DDCD9D6EF2C2DA1CEAED2C696E88D99A9C48B81EC2A67EC4D4387A28A2EA7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...K............."!..0..............)... ........@.. ..............................5.....`..................................(..K....@...................(...`.......(..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H........ ..@...................P ......................................wk....v...H\.c..L...3...^e.]S....G.7.>81(BQx......~.w.xl).......n.2.M.\...h.M.XQO.I..-..9..A....R.n.]I.../.j9s....t.i../.O#&BSJB............v4.0.30319......`.......#~..........#Strings............#GUID...........#Blob......................3..................................................=.....=...3.*...n.....^.....a.................w.................w.................G.....I.=.................$.....

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Resources.ResourceManager.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16160
Entropy (8bit):	6.773079747602628
Encrypted:	false
SSDEEP:	192:7JMERZxxBxOovWVOzWH4D3WT56Os1HnhWgN7agWfOToyttuX01k9z3A2ab:emDLHvWVOzWHv5kHRN7rZSR9zfM
MD5:	4D5C88F0EEDD6C165742A8D04BE03C89
SHA1:	B0759EBB5102031A243200769EAA7599F6A88CD1
SHA-256:	44C4D17BC3F4D734F003E95C7C755B806E68283D2463AA519C4ECC9B7AD7FE22
SHA-512:	4437A86652229209592867FAAABCCEC6B32ABD33F7E664F5F141672CCB1EBE3A6B8DB969EC16CE8142B0DD0777286F822CB8ECAFE546DA8FB8CCCD1C6E5CB2AD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.... ............"!..0.............^+... ........@.. ..............................!%....`..................................+..O....@.................. )...`......H*..8............................................ ............... ..H............text...d.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................@+......H........ ..x...................P ......................................a\.`..l{.L...Ms.f.........N{.!\...Q1....x..c1...g..XE<PH...!.J~...%'..>.gc.....3\|.Y.nla..h...q./F........o<V...5.8.l.J.!cBSJB............v4.0.30319......`...h...#~..........#Strings............#GUID...........#Blob......................3......................................M.........f...........].l.................r...A.....9.....#.....!.........................................q...................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Resources.Writer.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	45216
Entropy (8bit):	6.545369092902376
Encrypted:	false
SSDEEP:	768:lNTgn2Gqe3UgLSaT6jIjfG8lZERb/i2w9zLI:lVgn2GZUgPTocfGUci24zk
MD5:	3794B6E33C8157D1EBE3F7E31E89FE5A
SHA1:	4F2E4B89C5B3CF1EADD9989832663F49C65E292C
SHA-256:	4EB7BEFFE59497A4B316557B0E042A779CFEDD58379AD2BD7DD41D9D5176122F
SHA-512:	9C4CAB0913178A334DA6A772F4F5A254384454833AACCE89738CF695DA9A2F526E5D2415CE349D81BD476C622B9E3F1749340CCAAC67314E28471F6648FABD41
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....t..........." .....v................................................................`...@......@............... ......................................\|...@........(..............T...............................................................H............text....u.......v.................. ..`.data................x..............@....reloc..............................@..B............................................0...........................<.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o...x.....0.0.0.0.0.4.b.0...H.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...R.e.s.o.u.r.c.e.s...W.r.i.t.e.r...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...X.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.CompilerServices.Unsafe.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22688
Entropy (8bit):	6.409048993884484
Encrypted:	false
SSDEEP:	384:/Wg12WW5PPGmDOWWWfPWonSTb2HRN7bMu1DX+iR9znpM:5QHGmDv8/ibM8DuO9za
MD5:	6C32F48422BABDA7950EAF75135B68C9
SHA1:	F0DC1C32F1B70B70C53D6BCCD3113EEE0446D7F3
SHA-256:	895EEEC164504E4CA175E31DD2EF319E7E99966C9BD4BB299EE7EBC454974554
SHA-512:	5D4042675F281D3D0FFDFDCE20C223870BD5930F2D94ADA1B524ACB422AE2F219D2942443B405AD7920E992305B5DD3C2EA3AC84892CD7D550AF34BD4D3509C3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......e.........." ........................................................`......jR....`...@......@............... ......................................$........0...(...P..........8...............................................................H............text...o)......................... ..`.data...=....@.......,..............@....reloc.......P......................@..B............................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...f.'...C.o.m.m.e.n.t.s...S.y.s.t.e.m...R.u.n.t.i.m.e...C.o.m.p.i.l.e.r.S.e.r.v.i.c.e.s...U.n.s.a.f.e.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...v.'...F.i.l.e.D.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.CompilerServices.VisualC.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20144
Entropy (8bit):	6.584770569001369
Encrypted:	false
SSDEEP:	384:JWsWLWtUIrR/Tvna1EcOL5kHRN7bC/6fR9zckx:8WUq/Tvna1j19zfx
MD5:	84DF08D5D5E0BB15FDFFFAA00EA83B45
SHA1:	7C89DA0C66C29E5195505267B479E6DB05D66B8A
SHA-256:	F0A5440C8ABB9FC52E3E06851BB8BF8AB8C43C4FE1B926F79B8EDF6EF3D5D1BC
SHA-512:	3DB8E882D12DCCC63288F1822095EED7B405C3D6F587406E3FB2F9E58F5E8B61034810C17C1973E67CBE1AAE84956DDFD410B4623EC0A1CADA99602372895250
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d................" ..... ...................................................P............`...@......@............... ...............................................&...(...@..........T...............................................................H............text...`........ .................. ..`.data...D....0......."..............@....reloc.......@.......$..............@..B............................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...h.(...C.o.m.m.e.n.t.s...S.y.s.t.e.m...R.u.n.t.i.m.e...C.o.m.p.i.l.e.r.S.e.r.v.i.c.e.s...V.i.s.u.a.l.C...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...x.(...F.i.l.e.D.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.Extensions.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18080
Entropy (8bit):	6.604387664983145
Encrypted:	false
SSDEEP:	384:z5y7UByGe9xCEe6uW8MNWvTb2HRN7HsBmo8R9zbcfT1:daUByGeoQO/iHamoQ9zYZ
MD5:	E13CDC3C21F35A383EE0108C74707B28
SHA1:	8B786E5F1B10C7AB4153EDAB74C20976E22404EC
SHA-256:	498EF5E8C662AE7AC4F99FECD7833350FFBAE3DBCFF35908B60B5CC84A1EBA77
SHA-512:	D544CFA11B9564E9190A463FDF4EFF08C3E7C2204FB6B87A70425A89F269BD606199492E2CD4CCDFB290B394E7C271BF7A1317DB60F9B596CE62875D69BF22A4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....^}..........."!..0..............3... ........@.. ...............................&....`.................................<3..O....@...................(...`.......2..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................p3......H........ ......................P .......................................%...".!.z}....9Lk...:MG..5\h[>.<.....S...a`4.J..ZS.#;{..$Vl...X.'ve.}....y5d.u.X....o.:....y.&.6.QV....%......`..C..'u.,BSJB............v4.0.30319......`...$...#~......l...#Strings............#GUID...........#Blob......................3................................O...............Z.............m.........,.W.........5.............p.....p.....p.....p.....p...E.p...b.p...z.p.....p.................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.Handles.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15536
Entropy (8bit):	6.809706225336175
Encrypted:	false
SSDEEP:	192:T6x15AIWAFmWKX3WT56Os1HnhWgN7agWfgq0CjVi6KrIX01k9z3AYJvG0G5O:Tg15AIWAFmWK+5kHRN7hJ49R9zDJu09
MD5:	5B1A2A75BE30FABA12F9A2394C3C51E8
SHA1:	77A6F89BF28DC04DB132E66D0948C5D164E71750
SHA-256:	2EA3C0D949D36ECA1A4E73BF04B293BA353956356C2617DBB411E83EEC3DDCB2
SHA-512:	0569C28215C194C95E9C57A1ECFD62199B417CA4DBF8925E1133AE99404697E02E640B2CB795EE5DED14D894F732C75AAAF8FA11293177569DB4486C7CEB687C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....X..........."!..0..............)... ........@.. ...............................F....`.................................\|)..O....@...................(...`.......(..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H........ ......................P ......................................PY..Vq...Ry..<...ju..q.W\|.<...M...._.....S..Ct..].>L...0.t.S.........=<...Y..&+?.@.t.8.q.a..<?.t....i.G.J.8.ej3rRl...E~.BBSJB............v4.0.30319......`.......#~..L.......#Strings....P.......#GUID...`.......#Blob......................3................................................(.x.....x...f.F.................'.........L...........a.......................H.....z.....\|.x.................@.....

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.InteropServices.RuntimeInformation.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	31904
Entropy (8bit):	6.439463513354935
Encrypted:	false
SSDEEP:	384:ZWHvUWx75cQURw3IG6KMWFYpmGRvOu+Rp7Tb2HRN76QBmo8R9zbcAyDD:OmzKMWFkmGRn+r/iDmoQ9zYB
MD5:	E4FCAA9468FADB78AE62F5D259F3E006
SHA1:	7377E3E978B9F87123DDEFA7E1C7791AF9BD208D
SHA-256:	3C6E160A458D93930C7F76460AAB17483D52AAC32D45906EE28AE8BC78074F70
SHA-512:	60281E7530F5E5AC5A94E08EB7E9D334183D76FCC635072C8822307C11E6699BCBAF256FB6AA5C3F438ADDF27472853D580FB72A17855ACC8E12C83B371D319F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...l............." .....H................................................................`...@......@............... ......................................P........T...(...p..p... ...T...............................................................H............text....F.......H.................. ..`.data........`.......J..............@....reloc..p....p.......R..............@..B............................................0...........................p.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0.....d...C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.InteropServices.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	51872
Entropy (8bit):	6.470790651488434
Encrypted:	false
SSDEEP:	768:qpoK6fK5IPMWW/z2rg8Z61rvZqhwFLTFMjlYuPkU/igmoQ9zY1:qpoW5IP8z2r1GqhwFvFMjlPPk0igmVzU
MD5:	A147E61B8809679D431BE7E14D5CE499
SHA1:	E8486750C6C7BFBB736DD194BB6DBC32A7B1A263
SHA-256:	CCFA61BE6685A4E2A1425F7C1949E86FCCD5C3396C3F32731E1C4C1763FE275C
SHA-512:	0B2F0AADF5047720434E86513CCC1372B921FCFC955BDE33D4329C007AFD17798B06C1D060AFDA1BE44826043DA467F98E787536927154C50369A25DE563F579
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....q............" ................................................................".....`...@......@............... ....................................... ..P........(..............T...............................................................H............text............................... ..`.data...............................@....reloc..............................@..B............................................0...........................\|.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...V.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...R.u.n.t.i.m.e...I.n.t.e.r.o.p.S.e.r.v.i.c.e.s.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...f.....F.i.l.e.D.e.s.c.r.i.p.t.i.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.Intrinsics.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16560
Entropy (8bit):	6.657742238983935
Encrypted:	false
SSDEEP:	192:A9nrJMPlTWmGLWDV3WT56Os1HnhWgN7aIWfIhowcLK+X01k9z3ATJmAfd:61MtTWmGLWc5kHRN7x6R9zAJmAfd
MD5:	0A05B1ED73E47CDB513566D5D813D246
SHA1:	FE4077E4898EDCC71BEA9D7D379D92DFC4C23BF6
SHA-256:	BEEEBDD14ED8E5A865121418E71694AFA91464506E2D98104C3990E90EAD14E0
SHA-512:	6F2EB6648763551DB7BA49E37D3E11EF48A9DB68438C1FF2DB467ACC641C50A22BE16F0A3F02D8AAA56058DEA41588472699315E1B2C4D33C5051F542CEFEEDA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................."!..0..............-... ........@.. ..............................=Q....`.................................d-..W....@...................(...`.......,..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................-......H........ ......................P ......................................^{.".`.MS....RP...L....yy....n..l .p..:.V..F.....w.-..X<z.p"..@.g.W!.L....@y1[.1......t.({.=.=..S....3E...(.....C..Z..''.BSJB............v4.0.30319......`.......#~..<.......#Strings....$.......#GUID...4.......#Blob......................3................................9.............................p.........?.....g...................1.....1...}.1...4.1.....1...X.1...u.1.....1...(.1...O.............

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.Loader.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16136
Entropy (8bit):	6.721576750277045
Encrypted:	false
SSDEEP:	192:Ga0SQawxxoZsW5FGWyQuWXebPpUNTQHnhWgN7acWyqhHssDX01k9z3AaSL:GwQL6qW5FGWhTb2HRN7tqFDR9z9E
MD5:	E64BAA913355301A4B1592908494E84F
SHA1:	F9B6A37B92E414054FEDADFDF31FB94D58A26AD7
SHA-256:	CA668E1C634F7BD7BBFB3B971DA3C4442C55BFF12C2DBE20289B78D8DA6D3AAD
SHA-512:	373BBC4995D731758813031A8F38ABBAC8A107CE638DD4BFC6726D7CC15F8FF7DCB8873C266BAB87084882EC994F9FF0445B7322DBA5B1E07A6BD288EFDA729A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................."!..0................. ........@.. ...............................[....`.................................8..S....@...................)...`.......)..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................p*......H........ ......................P ........................................I. h.....s..l.%...4X(..fX\|.g?.{ge.....3.+.6O.e....}....:u.KO?_..?..DKT{.......Z.#...p..Tc.......S{K........JT.K...(.K.BSJB............v4.0.30319......`... ...#~..........#Strings............#GUID...........#Blob......................3..................................................,...4.,...p.....L.......R.........t.....l.....V.....V.................................................,...........

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.Numerics.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	221872
Entropy (8bit):	6.87085184067019
Encrypted:	false
SSDEEP:	6144:EYW13qjzkOGjMDDjUqFEJri+LXuDcWrDR:niqjz1GgDvpFEJumuDcWh
MD5:	4A7DE5AE8A63C7F612B59B0696D94583
SHA1:	538F0E4C91B5742F5EE6E4957CFE18CD8FD8C8CF
SHA-256:	3B06B0890034CE5E129EC278A05E4F1CEFA858703B68D05F35657999FAAB90AF
SHA-512:	8F22B8FC75362C0D9A2E3A60AF3563E1FBAB70B4B53B6F47DBC141776CE05DF7D7AAC3505E082AF0DA8C65F36635BD1F635E211FF69E801396298D7B8B1DD332
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d................" ......... ...............................................`.......l....`...@......@............... .......................................T..x....:...(...P......X...T...............................................................H............text...1........................... ..`.data...P....0......................@....reloc.......P.......6..............@..B............................................0...........................<.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o...x.....0.0.0.0.0.4.b.0...H.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...R.u.n.t.i.m.e...N.u.m.e.r.i.c.s...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...X.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.Serialization.Formatters.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	322720
Entropy (8bit):	6.687464872165687
Encrypted:	false
SSDEEP:	6144:TUxVzI5Kk30Oy5G4ArVFAC0W6YqdKfV8wXg3xBc/H14CFYTfu:OsNyw4ArVFAClriOsBctdwu
MD5:	ED7496F85669AE92F3576ED3CFDD24E5
SHA1:	48C7A0B5B7BB260A85ADDE449E972182923CB73E
SHA-256:	DFC771DE7B7576024AFD1C3EA867B2AF223E0462DF9EFEF9BA2D2AEAB87FAB2A
SHA-512:	5DCEC88BDE0C29D070D9F72291F44DAC71F670432EA200A21CB567FEFCF525BC91FF2CEAE2D0276558D594705B7E7A2BD8C6469D6C919F9D7C45CF55B5FEF248
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...&.a..........." .....p...R............................................................`...@......@............... .......................................o...........(......(....&..T...............................................................H............text....n.......p.................. ..`.data....I.......J...r..............@....reloc..(...........................@..B............................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...h.(...C.o.m.m.e.n.t.s...S.y.s.t.e.m...R.u.n.t.i.m.e...S.e.r.i.a.l.i.z.a.t.i.o.n...F.o.r.m.a.t.t.e.r.s...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...x.(...F.i.l.e.D.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.Serialization.Json.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16032
Entropy (8bit):	6.712741166923777
Encrypted:	false
SSDEEP:	384:mYSqqyVWbu0dB5WETb2HRN7YBmo8R9zbcDboK:m1JyW5dBZ/i+moQ9zYDn
MD5:	F6BA150184F255DF77FB27CFC125F78F
SHA1:	16E2FBDD1ACFCB6016478937831B6DC0D3420D20
SHA-256:	972457F825FA38D20EA99F591C4DDAE20C66415F0ADDBE9E2BAAC23E0683D475
SHA-512:	56EFE0559EAFBAA47020605E18D8790A8E7D00C3073EB26342E8DDBC36A5550A0EE6F308DD4314B30AC00281F64CCB87A7F9599A6E096B9C623F46D7B8268D6E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....0n..........."!..0.............~... ........@.. ..............................G.....`.................................,..O....@...................(...`......h)..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................`*......H........ ......................P .......................................J}.?..e....(w.x...v.:.LG41........4f.....J.QP6..........^...L.....Q...W..CI..P..D}/m.z.....(..t.....4..=..c@nw.L._.i....BSJB............v4.0.30319......`.......#~..\|...d...#Strings............#GUID...........#Blob......................3............................................................3...........^.....a.......O.....O...w.O.....O.....O...w.O.....O.....O...G.O...I.........................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.Serialization.Primitives.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	28832
Entropy (8bit):	6.454149304923409
Encrypted:	false
SSDEEP:	384:5HWFIGJBrWHRtrwhvKH0sdbnMbKF+87makO2akSMHHDbEHs3bEbsTb2HRN7tqoYT:5qtJB4RtreiOW+8dAbN/itl/9z1O
MD5:	D2FDD897D1FDA8DA84320BC8F58F5202
SHA1:	4E68A0BBE17AADE882AE5E70DC21A5335512F1C0
SHA-256:	0DCE66126AED76B307708246273A5DE704142EE9100971F471708CF0A7AD1131
SHA-512:	77C6F48CBE6C0A6F6CB5D082280E921A03FB607F0348FF240D98081E7E2DF1DC3747E9D18C080EF08FCACB014016151CCE1C1238DBC63C9E054ED0576D45921B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....<..........." .....@...................................................p......P7....`...@......@............... ...............................................H...(...`..(.......T...............................................................H............text....>.......@.................. ..`.data........P.......B..............@....reloc..(....`.......F..............@..B............................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...h.(...C.o.m.m.e.n.t.s...S.y.s.t.e.m...R.u.n.t.i.m.e...S.e.r.i.a.l.i.z.a.t.i.o.n...P.r.i.m.i.t.i.v.e.s...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...x.(...F.i.l.e.D.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.Serialization.Xml.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16544
Entropy (8bit):	6.7433480964793295
Encrypted:	false
SSDEEP:	384:EhYklmI8NQvkRMWsBTBBgWtTb2HRN7P/6fR9zc5:ECklmI8NQcRi1BBH/iI9zY
MD5:	E4B977B34EFC6E4CBE011101CAB08FBF
SHA1:	0AF291AC0ED06AA6A97A6AB244274F1B8A6CB820
SHA-256:	F8E1CC706049B904E1B2F83F170879F0FF05DDC057013F644D69DAE50C26446C
SHA-512:	FBDF5A137ADEBC4210EF72DED4E1FE9366DCB50AC9C00D4323FF70747C85F7AC8BBDF06F6835D53AB2DC79EF10086DB5DE1761A622AC9F77B2D135BAA13F77CD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...d.@..........."!..0..............-... ........@.. ..............................[.....`.................................p-..K....@...................(...`.......,..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................-......H........ ......................P ......................................+U...<tC.G..B..&a_...1...b_(ztOS..@..hq!\.+O..g..$.{..j]R..h.[_....~..\....~~.7..O......0.......x....;...C..W...?.a_G)>.'W.BSJB............v4.0.30319......`...d...#~......d...#Strings....(.......#GUID...8.......#Blob......................3..................................................f.....f...W.;.................Q.........=...........R.......................9.....k.....m.f.......................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.Serialization.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	17568
Entropy (8bit):	6.609386239994472
Encrypted:	false
SSDEEP:	384:K6EvDj8NKOLWgM34BHWLTb2HRN7kk/6fR9zcM6:K6EvDj8NpPk4BU/iO9zw
MD5:	03A4D7413A5D5C953744063760337048
SHA1:	9745FA99B929CC7C0E9C1DCC33A432AD219E477A
SHA-256:	01C68D9B56C5CBF0F9FD5C865988130E85DC447637D1E1F14EBC1F796EC17D93
SHA-512:	D57A0E6EB1A8653E7CBB4D5FCAB8A011B6CDAB0002871EC74DD443CC8E159D10FDA715967CFF9F77C9C238673C9CD561661F9C78035693F7E81441A4A2ADB98C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....i..........." ..0..............0... ...@....... ....................................`..................................0..O....@...................(...`......./..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................0......H.......P ......................./......................................BSJB............v4.0.30319......l...\|...#~..........#Strings............#US.........#GUID...........#Blob............T.........3....................................,.....................f.......t...............7.......t...=.t...M.t.....t...B.t.....t.....t.....t.....t...e.w...&.w...r.........................T.....T.....T...).T...1.T...9.T...A.T...I.T...Q.T...Y.T...a.T...i.T...q.T...y.T.....T. ...T.....T...

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Runtime.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	42760
Entropy (8bit):	5.815194352133291
Encrypted:	false
SSDEEP:	768:qBV0jdpFKYl5f4bGRi2xVbcVT4p7OR/izD9zN:uedGYl5f4bGR3G0ROxizpzN
MD5:	26279D53343FFC6DE168882285B50458
SHA1:	CBA98CE575BB04E779F36F7538F3696ABE2BF42B
SHA-256:	10D7F5A27992B9BC3FFCA8DE481F50603F6324AED1F929CD9C8FA10DD148233E
SHA-512:	6F4442C836A5DD017278BA8DAA4B1252D6A30608B8A3C4CC55EE1165B500A0F7307FC066836842F8CD91AB872C200BBC75C59016BBBBC3B4EF06F57012EA40F0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....T..........."!..0..t..........^.... ........@.. ...............................a....`.....................................W.......X............~...)..........d...8............................................ ............... ..H............text...dr... ...t.................. ..`.rsrc...X............v..............@..@.reloc...............\|..............@..B................@.......H........ ...p..................P ......................................6K..d`.bm.=u.(..y...>.gK..(T3.0..F.h....;..^n....2.h.\|(..5k.4T0....=..$...~.8..!f..\<.%.AD.{.T........gE.=........d.\BSJB............v4.0.30319......`...l0..#~...0...=..#Strings.....m......#GUID....m......#Blob......................3................................T...............'.[3..".[3.....2...3....e.....>.. ....<3....<3....j!....j!....j!....j!....j!..q.j!....j!....j!..R.j!..&.[3..........

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Security.AccessControl.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	215200
Entropy (8bit):	6.693299135935751
Encrypted:	false
SSDEEP:	3072:kXFAFB57n+5zYVfrXBkbb3p6lZnFW2iBeVICTiupU8TVUnVZ5nDMXZo1cQtSck/M:x7+58fLB46lZoOXZrRM
MD5:	C9FA43F8344280362C916015197870E4
SHA1:	84A3BBA86F013DDB9DE47F86950B331AA3A47971
SHA-256:	7DAEEE5E32B7B8F6E965ABD1EDAA90AACB51BB30A66E54AA1379F0C009F211FE
SHA-512:	FD26899A76CA848BC0C76AE1EA25ED17A347A734F5C3F9F3946E5B8F2D0EF6E19ED68A3588DD6F4EEB2661D7E59E800B5A346EBADF3B6D7FC25B342E93A7F07A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d................." .........$...............................................@............`...@......@............... ......................................@W..p.... ...(...0.......#..T...............................................................H............text............................... ..`.data...n........ ..................@....reloc.......0......................@..B............................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0.........C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Security.Claims.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	94368
Entropy (8bit):	6.445850611926574
Encrypted:	false
SSDEEP:	1536:lsNWv95xttKvsq85yOuX3upafbqb9h8kGOQwQ7rzUU3q2bP60OVKFigz4:lscv95VKscOuX3upEbqbaOVyU
MD5:	D3CEFAEBB4EE2F582489350E53EAB171
SHA1:	07DEC078ADAA2D0A581E98C7DC976D7700C4C9CC
SHA-256:	A13993EBE6D3A1D32DAA20735E7B702143DCB29156EB044278F1062651EF3D33
SHA-512:	EF5A8E501B3B1EC0D7ADEA84E588BC5459E77EBF1A7161AF616345900169E90A302DB2C382E6DB4EF5D073F0F546091AC40A0155C50C7237B154958EAB97609B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....s..........." .....4...................................................p.......R....`...@......@............... ......................................$-..<....H...(...`..<...p...T...............................................................H............text...T2.......4.................. ..`.data...!....P.......6..............@....reloc..<....`.......F..............@..B............................................0...........................<.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o...x.....0.0.0.0.0.4.b.0...F.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...S.e.c.u.r.i.t.y...C.l.a.i.m.s.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...V.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Security.Cryptography.Algorithms.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	806576
Entropy (8bit):	6.6660203090336125
Encrypted:	false
SSDEEP:	12288:FVibtU1f9rNV8nubZRqUBQscZqSxQHDcVnAMSL:FEoxbPpaZFxQH/L
MD5:	BB0F852183831482367D41F45FD42FE9
SHA1:	1CA88A5A0BF6E07AB7A2B43813CD1FD1B42321C2
SHA-256:	08ED853C863F85E711FD8766BC1175D0553E0D255A70CBF0AD6241E6EDBBBCAC
SHA-512:	914F4E7B4BCDB3E66F205669B8334E9320F0FE4F54977963680A2F5C72CB605A48B2874C93B8174728FE4F235D1D916ECFDC28F88441C8A64803686216113225
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....#..........." .........................................................@.......V....`...@......@............... .......................................(...Y...&...(...0.......C..T...............................................................H............text...[........................... ..`.data....}.......~..................@....reloc.......0......................@..B............................................0.......................\|...4.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o...p.....0.0.0.0.0.4.b.0.....d...C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Security.Cryptography.Cng.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	486576
Entropy (8bit):	6.685990474336849
Encrypted:	false
SSDEEP:	12288:DWhGfkKh0qqkz33jawROU0BEuUWZeh8Mxh/loL:DWYkCzHjsU0BEuUWoh8Mxhq
MD5:	B06C8870AAE8A13FE651D2F868E5FFB0
SHA1:	775F50C4DCA02847DD2148E23776E4E7D1B158D5
SHA-256:	618F3B513BF023FD81513669183B32316A249F02A489FD15BCA217458A8D4CC2
SHA-512:	BE7AF1C6AE613D2D8DC519663783AB2CF084299794F65BB1E897D0014ECE779CC4F19207F03DB3CAD5803533A078374161403603B109BBA5359445D32B630351
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...q\|............" .........Z...............................................p............`...@......@............... ..................................h........2...D...(...`......X0..T...........................................................h...H............text...E........................... ..`.data....P.......R..................@....reloc.......`.......<..............@..B............................................0.......................X.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........p.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...L.....0.0.0.0.0.4.b.0.....d...C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Security.Cryptography.Csp.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	189600
Entropy (8bit):	6.633360671258718
Encrypted:	false
SSDEEP:	3072:aryDFmWBHH04xLUCgsM2L56mLNqXeF9JN/8BWAUQ335Botb1qKaMJDByfUB1n:aHWBH3xAkRUBotnJMfUBR
MD5:	E2EA1BCD92FB824B4965E1A27163CDAF
SHA1:	1F6053C97CCB69C71C008C8B07A1F82C6C75ABD0
SHA-256:	FD3EE47565A4A3EB37FF35A532E1BE56123E63FEDCB07915D23170392394EC82
SHA-512:	935F5E372C3BC92A2BAF878F52E2EFEFFAEC166730A34E7AF411E414DA0D631977FB7E65016715833907EF38517920B32DDC006AE3F2D38020E81A840FB7416D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d..............." .....................................................................`...@......@............... ..................................h...lO..X........(..........."..T...........................................................h...H............text.............................. ..`.data....).......*..................@....reloc..............................@..B............................................0.......................X.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........p.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...L.....0.0.0.0.0.4.b.0.....d...C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Security.Cryptography.Encoding.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	93856
Entropy (8bit):	6.40727167326787
Encrypted:	false
SSDEEP:	1536:KiaT10Sd5c0Q7wxwcZLyoOeSRzDIGvYQ7ivmVzq:K1SGc0Q7rkLyheSRzDNvY4u
MD5:	EC61D6E44EAE70B8DAFE229BC113FD15
SHA1:	0F494F4FD9CF951814B1F2AFE100D3DB5D179A7F
SHA-256:	D4DD4E6789546B4F5D95EDEDDF81B9E57A0840BBFEFB9C885E243860F787F101
SHA-512:	CBFD07E2CE23A760F3D23EC17D2D1A34236CDAB35692B6D9426E7ED3AF6FBD9E491029908F592856166E4FAEE3417BF2139B209AA43C0EDC70423853245103C6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...n............." .....&...................................................p......2.....`...@......@............... .......................................*..\....F...(...`..(.......T...............................................................H............text...C%.......&.................. ..`.data........@.......(..............@....reloc..(....`.......D..............@..B............................................0.......................p...(.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o...d.....0.0.0.0.0.4.b.0.....d...C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Security.Cryptography.OpenSsl.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	31920
Entropy (8bit):	6.236094601677653
Encrypted:	false
SSDEEP:	384:CW9WAm9ijRWZ1bwPV0D/F/pQ+1+HCeqtwl1ImxNOcVuFNlYeF5kHRN7qUL/6fR9T:lEeqyl1Im71VuhYvqUE9zQq
MD5:	D99674D33E5911A02C7A898151A8A4DA
SHA1:	044A6BA1259AE9BBAA0D39DB833CFD0DF6285D56
SHA-256:	3589A29DF384EC920B3634E65ED2BEC50244C3D0661F73688405D67B90D56A68
SHA-512:	4CE0C5E3F63E60ED1B4D4309C6BF73DCE35B9D2991E8B7E9B048ACB75FD0CE30200F26DC494F810BD44333A6F053BD2EBE46A80506778B4264D150C8C594EAB2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d................." .....N...........................................................F....`...@......@............... ......................................@........T...(...p..........T...............................................................H............text...'L.......N.................. ..`.data........`.......P..............@....reloc.......p.......R..............@..B............................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...b.%...C.o.m.m.e.n.t.s...S.y.s.t.e.m...S.e.c.u.r.i.t.y...C.r.y.p.t.o.g.r.a.p.h.y...O.p.e.n.S.s.l.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...r.%...F.i.l.e.D.e.s.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Security.Cryptography.Primitives.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	134832
Entropy (8bit):	6.564959879252127
Encrypted:	false
SSDEEP:	3072:6UpRXR2yHE5hvb/UVMM+JbVUoPd0hcbGWbrrrrrrrrrrrrrrrrrrrrrrrrrrrrrw:HRXRPk/MZcbGuo
MD5:	63674D71268196803E86D50B384BFFC2
SHA1:	6A5EECF0BA3AACFDC53E95E50F0B4E731194197C
SHA-256:	0EBA6120939A6A3638D2F691CE0F2A8B3888918267A11272930BE0885D769097
SHA-512:	0F4340C494113DE0F38AC28CE3ED208A26D8E9FAD4F6FDA8CC135B9C2AC8B31476A9DA9D98F25DF4753AF721D1B2D344C7FF16AE1202BA92A933AFAA0DA99490
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....?,..........." .........(......................................................N.....`...@......@............... .......................................;...........(......d.......T...............................................................H............text...T........................... ..`.data....".......$..................@....reloc..d...........................@..B............................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...h.(...C.o.m.m.e.n.t.s...S.y.s.t.e.m...S.e.c.u.r.i.t.y...C.r.y.p.t.o.g.r.a.p.h.y...P.r.i.m.i.t.i.v.e.s...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...x.(...F.i.l.e.D.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Security.Cryptography.X509Certificates.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	568992
Entropy (8bit):	6.700188111835567
Encrypted:	false
SSDEEP:	12288:qM3CgawK+N3hOQAgB+TJMLpcp7nwGVXfV1HxmBVWvw7nzNZAN:13CgVKCO/RhXfV1HxmfWvwrTs
MD5:	DB3ED279066812D2C4169F664FBEE41D
SHA1:	C6285542AE670AC10F5E1D1DC60EDA20BC8C850D
SHA-256:	FE81C87E807F954C8CE5A6C47CB9BE6CACE832987F5B73720911E64682754C71
SHA-512:	7897A44FF7B43513C73E2794AD695B11D7415369C55D4D328FF8B0CF393E6CC0C5F9EDE33165D8FAA4B8ECBE6DC80979E29F300EA4580479386089F27C36C293
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d................" ......................................................................`...@......@............... ......................................`...@8.......(..........x4..T...............................................................H............text...]........................... ..`.data...............................@....reloc...............z..............@..B............................................0...........................X.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0.....d...C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Security.Principal.Windows.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	151712
Entropy (8bit):	6.659464660529735
Encrypted:	false
SSDEEP:	3072:L+UeF+0avwdpa+2XrSieyTsuA1HpTcyeEov:DelO3kGsuWf8
MD5:	261D8B5ACDA68A3AB2FDBAB16467253F
SHA1:	12D667925D66634B96523EEBFFD465B9218D7991
SHA-256:	24B45934145C4F0CCDE78F44FB596015B74A364F06F57813F46EB4709603D061
SHA-512:	E3C2E7E83EC8A0EDBC8570C81B83DA4DB8E789EDB2D89F5CF41801838E22F04EA8826128BEF65620CD66D67667DE79E04FB5831F8B6C4ECFDBFE31770C9B5B2A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...^............." .........$...............................................P......yb....`...@......@............... ..................................h....F.......(...(...@......x...T...........................................................h...H............text...e........................... ..`.data...U.... ... ..................@....reloc.......@.......$..............@..B............................................0.......................X.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........p.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...L.....0.0.0.0.0.4.b.0.....d...C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Security.Principal.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15624
Entropy (8bit):	6.8285369216527885
Encrypted:	false
SSDEEP:	192:WUtyidxx1ujWVUSfWVuWXebPpUNTQHnhWgN7acWvmdxwVIX01k9z3AT1Jj2ri+ih:WUJ/sWiSfWVTb2HRN7JDR9z2dld
MD5:	5FD2CEE51B6BF5B2C46F0654240C4483
SHA1:	1EDA42FDC45A527D88916013E378A3389E2E86B8
SHA-256:	69A43DCBCA5A890030C32A1E49A5A98DF16593490272E63FB13D573F18CB44F3
SHA-512:	5BB3814CF1CB2DD33F4247E9020286E84CFE73FF39C6603C0845ECD354DCEA64AD772FEB1B17C531FE6FFB47D04F0665877F64C3E672F7525B74E8E949885812
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................."!..0..............)... ........@.. ..............................."....`..................................)..S....@...................)...`.......(..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H........ ......................P ......................................*U...l.K.3....@8....S....LX......,..IXt[.$....<..........v.J}..ee...?N.I=G\.m......0}f.....C3.9......4.h......Ej.J..2BSJB............v4.0.30319......`.......#~..X.......#Strings....X.......#GUID...h.......#Blob......................3......................................F........."...........;...........f.......d.................k...!.k.....k...[.k.....k.....k.....k...B.k...O.k...v.............

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Security.SecureString.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15520
Entropy (8bit):	6.803191686081093
Encrypted:	false
SSDEEP:	384:CZerNiSW163WLTb2HRN7XmBmo8R9zbc93:cerNn4/iXsmoQ9zYh
MD5:	06C896C8031354AF4AFD97A168CD9E81
SHA1:	F1E5D89A95FE3F49302F0D2791DE545F8C6090AD
SHA-256:	F582B331B175069B1F2E9E3236192EC475A1BD52EC8E2825CA837FE7883D202B
SHA-512:	DBDB5F015348FA45C7846BC180B7AF19929618A1B5172010409AD2A4895C1FD82E1C383B06625070368AD120B89E32980699B99FDD9F562BA3A2CD3106A315E3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...X.'..........."!..0..............)... ........@.. ...............................%....`..................................)..K....@...................(...`.......(..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H........ ......................P .................................................u\|.....-.tM.....l.)...j..-.a..\.!..Z.........\A.@..'{.}.=.>.."US.sj..wRod..{#....V..5.[B .........x..C.p...@.yvBSJB............v4.0.30319......`.......#~..P.......#Strings....4.......#GUID...D.......#Blob......................3......................................2.....................3.r.........^.......S.................Z.....Z.....Z...S.Z.....Z...w.Z.....Z...:.Z...G.Z...n.............

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Security.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18608
Entropy (8bit):	6.594018401167664
Encrypted:	false
SSDEEP:	192:XR+ru0XHkP3jDvupZFi5yJTx2JM53WseDW33WT56Os1HnhWgN7aIWfhbTseUfX0I:B+rueDXL53WseDWe5kHRN7u/6fR9zcI
MD5:	214615A762BFA540D0B7254E5158D4A3
SHA1:	508D01A24DF859F7788ED5396E0338778A235740
SHA-256:	5EB8B51991F88F1F91E2DAE3DE3E9A7013679F7A6DBDCFE45CE2D5B04E14D082
SHA-512:	66F265240BCFA0DD7BF4D51CF183BAF9BEADD439366F0AABF9D3624CC711D80A1A13CE898AF8BA97BB0755C881F3A5EACD9B164FBC3742A009C4C1B7DE3E6AC8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.............^5... ...@....... ....................................`..................................5..O....@..X............ ...(...`......44..T............................................ ............... ..H............text...d.... ...................... ..`.rsrc...X....@......................@..@.reloc.......`......................@..B................?5......H.......P ..d....................3......................................BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID.......H...#Blob............T.........3....................................O.................p...~.p.....;...............O.=.....}.....}...e.}.....}.....}...'.}...D.}.....}.....}...n.................7.p.................'.....'.....'...).'...1.'...9.'...A.'...I.'...Q.'...Y.'...a.'...i.'...q.'...y.'.....'. ...'.....'...

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.ServiceModel.Web.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	17672
Entropy (8bit):	6.6079067296786915
Encrypted:	false
SSDEEP:	192:EiSEs6760DX88/CgOYYWGlg5WVuWXebPpUNTQHnhWgN7acW8ecWYHhHssDX01k90:Ex2VORWyg5WVTb2HRN7kEFDR9z9shcO
MD5:	C8A013FBCCAB122F5E7B5645EE27D06F
SHA1:	739D6A8DEFD3A760A9409B937FA5D795BBC73ADC
SHA-256:	7F9AD18549388685E019037648ECA5CA96A5A738DEF6C295EFD15304F81503D5
SHA-512:	4B07B81C03E47E46FA74DBE229C978C5C10A8FBA2673CA1D819ECA8E7C0211745FA39A3A36E473063F73D8A64086815248B8AE1E27ACA6F6DCB317490E439C64
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..............0... ...@....... ....................................`................................../..O....@...................)...`..........T............................................ ............... ..H............text... .... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................./......H.......P ......................`.......................................BSJB............v4.0.30319......l.......#~......,...#Strings............#US.........#GUID.......P...#Blob............T.........3....................................&.................................%.....?.....^.......S.....S...t.S...+.S.....S...X.S...u.S.....S...(.S...D.H.....H.........F.......{...........................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y......... .............

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.ServiceProcess.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16656
Entropy (8bit):	6.713419005212109
Encrypted:	false
SSDEEP:	192:a9x2orZF1pWnialpFWruWXebPpUNTQHnhWgN7agW5fyefKUSIX01k9z3AEXzsy6W:AlrZfpWnialpFWrTb2HRN7582IR9z5Yq
MD5:	9F047D61E454CE452CFBF8746CD43EF5
SHA1:	762BA66614DF74BF82213A84648A04A597D1C070
SHA-256:	341F2A7A3FDEC0AAEE6C2A51045C0BBECCAFD642FA72A8FEADA2AC570CF46D1D
SHA-512:	48024C278DFD9BC9BE3C1F853CCB152C2C89DE169B4035575333B916A52838622E9922887BAF8E3D66FA6CEF3323710BF44B00F0A6A78B60222FA655202B890C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....q..........." ..0..............,... ...@....... ..............................w.....`..................................,..O....@...................)...`.......+..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................,......H.......P ......................H+......................................BSJB............v4.0.30319......l.......#~..<...X...#Strings............#US.........#GUID.......P...#Blob............T.........3..........................................o...........w...7.w...v.d...........U.........~.....B.................a...................................".....\.H.....w.................^.....^.....^...).^...1.^...9.^...A.^...I.^...Q.^...Y.^...a.^...i.^...q.^...y.^.....^. ...^.....^...

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Text.Encoding.CodePages.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	871176
Entropy (8bit):	7.5041221541059455
Encrypted:	false
SSDEEP:	12288:Q47xn7kZQ6kliVreJIHHr0tRYbKr2KtG9VKABC6rPnnPWiAk1CiyhRWj:QK9km6k/IwRYbiBeKGCsnPkgybe
MD5:	AA219DB45D81CBAC778F42059BA37283
SHA1:	6FD5E2AA14A9415868AE20F1DE2D4556DFCFC725
SHA-256:	B838FE55573020A4E1F63FDB2018CEFB7949DBDD77B8E2761706CD45DB5F2235
SHA-512:	D21DF48513CAF46D5585506B18729CCFFFD8C05E48D00EAF9F5F5A258470B3EC472E931C156A271E0EC949AD1B4AB3315F33F3E9447E0D7C9A30A316E3C202D6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d................." .........&...............................................P......M4....`...@......@............... ......................................LJ..L...."...)...@......."..T...............................................................H............text............................... ..`.data.... ......."..................@....reloc.......@......................@..B............................................0...........................D.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0.........C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Text.Encoding.Extensions.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16032
Entropy (8bit):	6.7158596949737905
Encrypted:	false
SSDEEP:	384:D0RvZX4W6AJWUTb2HRN7HXDX+iR9znEIdqg:YzfV/iHXDuO9ztd5
MD5:	520A7974006947D532BDDD392330B896
SHA1:	4E531CC1704B7750511FB72BAB706E32620FDF0A
SHA-256:	75AEC0100534C2F43DE70523C53A6901AA021AFC482BCFC7E5727464501AE933
SHA-512:	8E396996E6481E59645E8B6C7C363D4C376E7D51F7B899B2104058113B7F94A664B504F3250249DB3DB3F49EA0EF133EE42CEFD7802092AFE620172BE3116389
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...s............"!..0.............n... ........@.. ....................................`....................................O....@...................(...`......\)..8............................................ ............... ..H............text...t.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................P*......H........ ......................P ...................................... 7\..4`.F(-..%kx........G..V.{.s...[...@..M>.....W....P.....LI.N>..dI.6.h....[.{..+..Nx^..7n..`.\|....&..Vd..."......Z....BSJB............v4.0.30319......`... ...#~......H...#Strings............#GUID...........#Blob......................3......................................v.........I...........b.............H.........$.....b...........H...................................i.....v...................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Text.Encoding.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16160
Entropy (8bit):	6.771378140439015
Encrypted:	false
SSDEEP:	192:4x+gBIo5xxXYWfMNWHm3WT56Os1HnhWgN7akWf26TQfKUSIX01k9z3AEXzDOmM:4xnNYWfMNWHn5kHRN7n2IR9z5OmM
MD5:	78DAB1B609171A73D6C11403B4D58BBE
SHA1:	5BA7B260D5DD99D4520B4713444374FD1765060A
SHA-256:	B4426116DAACB34C7F24A4CC688FA431709D1C37B0A7DCAE731B63EF8B4098B2
SHA-512:	DDFD3A5B737FACBC77EC82D204261E3D6A02196A5033967D6C83F4D79D3F8EAFDB365B0D6459AF2F1C1EAB52196F05987F18C237EF970932839C40D9144F334E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................."!..0..............+... ........@.. ....................................`.................................P+..K....@.................. )...`.......*..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................+......H........ ......................P ......................................s..-\{.La{Ohal)&..u6...@&{...t..=..,.n....8.2q.Ix....W...].a..4.n.].^b-M....!.b..g{..]]...D.l.v..C......i.........h.Z.s.... ...BSJB............v4.0.30319......`.......#~..........#Strings............#GUID...,.......#Blob......................3................................................"...........;...........f.............................!...........[.......................B.....O.....v.............

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Text.Encodings.Web.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	131232
Entropy (8bit):	6.508508237494909
Encrypted:	false
SSDEEP:	1536:dF6tkh7B8PdZL153A7NjNc2aBor8c5qUCNN6iAoAnlJH1RCtFAwynBRg9o7kiMzV:dF6UiPXHZxSwKqoOAlXRv1nzg9oMp
MD5:	844274A63D9665844684E85D1C0957E3
SHA1:	5D8EC6D7C0E7D3C9E2E03D94AE286F3B93632D7D
SHA-256:	37829A2D3D0F190D08AE8FF9BE4568839C727D33FDA2F89D65127E1248FAB6C8
SHA-512:	3E98DA79CC1661F931B047875AD6439F3E478444CCAD5CA0389F3591FA8B030482A24854FAF61AC9EF825B84B6ECF17EA48EB0D53B7892486940CD6FEB913CE6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d................." ................................................................>.....`...@......@............... .......................................0...........(......,...p...T...............................................................H............text............................... ..`.data...K...........................@....reloc..,...........................@..B............................................0...........................\.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...Z.!...C.o.m.m.e.n.t.s...P.r.o.v.i.d.e.s. .t.y.p.e.s. .f.o.r. .e.n.c.o.d.i.n.g. .a.n.d. .e.s.c.a.p.i.n.g. .s.t.r.i.n.g.s. .f.o.r. .u.s.e. .i.n. .J.a.v.a.S.c.r.i.p.t.,. .H.y.p.e.r.T.e.x.t. .M.a.r.k.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Text.Json.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1482928
Entropy (8bit):	6.816746556011059
Encrypted:	false
SSDEEP:	24576:3ZgXsw+Y2+4rGR/chOLt61QN1TGupbh4kHiBh:pgXKYeGqot6eza4C
MD5:	E8D6202E9734CBB42C89CD037A289E05
SHA1:	AED3830587C3113AAF3BDE594CC413C7CEFD35DA
SHA-256:	4F10EA95D15354BFB3A94758F3D413FCF390B5C2591F6D914F095CB84E15109F
SHA-512:	66038A90057DBC70994023D535C5E1C5689EEB1F97D6A56F604A02972D344FD999A4DF9EF5D1E22DCC3EB82AA0D5608F81C43AA2A31B7791CCE84912B792BE8A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....y............" .........H......................................................c.....`...@......@............... ..............................................x...(...p.......P..T...............................................................H............text....-.......................... ..`.data...&-...@.......0..............@....reloc.......p.......^..............@..B............................................0...........................\|.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0.....I...C.o.m.m.e.n.t.s...P.r.o.v.i.d.e.s. .h.i.g.h.-.p.e.r.f.o.r.m.a.n.c.e. .a.n.d. .l.o.w.-.a.l.l.o.c.a.t.i.n.g. .t.y.p.e.s. .t.h.a.t. .s.e.r.i.a.l.i.z.e. .o.b.j.e.c.t.s. .t.o. .J.a.v.a.S.c.r.i.p.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Text.RegularExpressions.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	530080
Entropy (8bit):	6.779018748281179
Encrypted:	false
SSDEEP:	12288:dT+rZQ1cpZBzFiTnbV/ntVtDUubNrm+MPH4HhiKpwR44cMPVZ22MP+yLARw:CQ1yoTnbV/ntVtDUuJrm3QHhMPVZ2vrp
MD5:	6A9185BEC9BBD9111ACCCAD1BBCB400C
SHA1:	911D4B251C742AC79D65C4F95239B2F24BDF14D0
SHA-256:	E9654E34339323B5E30F8C8308209A70A089DE96BE865FBA619943C168793EBE
SHA-512:	50C440A3B66F10FBC6B2568966D7D28E2E6B08925C162AB48E207CD617D7055EA3E139A3A9AB41133D13E72B1F11BBCDF2A3621B4F84052E2B3E6F93B4B5BECE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....3P..........." .....\|...p............................................................`...@......@............... ......................................\|...\|).......(..........0)..T...............................................................H............text....z.......\|.................. ..`.data....f.......h...~..............@....reloc..............................@..B............................................0...........................\|.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...V.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...T.e.x.t...R.e.g.u.l.a.r.E.x.p.r.e.s.s.i.o.n.s.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...f.....F.i.l.e.D.e.s.c.r.i.p.t.i.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Threading.Channels.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	125104
Entropy (8bit):	6.68953220227179
Encrypted:	false
SSDEEP:	3072:V/bHXIhrk8aiG9fxBFXRPxlhzKhtTwg8AHWDV5yrG4:p3J395BFXRplhOzwDDOb
MD5:	807D817CF8C8B7660878E580CA5D1233
SHA1:	92D2FA80002FF3651CFAFB73765342CAEB1E45A7
SHA-256:	BFC16F54F995644EB03BE4216D1ECC6544C65BCD84122BFA6395D80403FBA057
SHA-512:	D4B9B79BB401D4E7F4516B5C68D84A8906823BAF83C0C0174C58DE3058D4C72700334D02F5719BC2F8776DC60819B3B96D6FC805CDC3C29AE0A74C77731887FD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d..._............" .........*............................................................`...@......@............... ......................................T7...........(..............T...............................................................H............text............................... ..`.data....%.......&..................@....reloc..............................@..B............................................0...........................8.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o...t.....0.0.0.0.0.4.b.0...8.....C.o.m.m.e.n.t.s...P.r.o.v.i.d.e.s. .t.y.p.e.s. .f.o.r. .p.a.s.s.i.n.g. .d.a.t.a. .b.e.t.w.e.e.n. .p.r.o.d.u.c.e.r.s. .a.n.d. .c.o.n.s.u.m.e.r.s...........C.o.m.m.o.n.l.y. .U.s.e.d. .T.y.p.e.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Threading.Overlapped.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16032
Entropy (8bit):	6.709666796876371
Encrypted:	false
SSDEEP:	384:MP+HYCHwXuHVZHDHOWcaHWfTb2HRN7LDX+iR9znPY:SOg/iLDuO9zPY
MD5:	B12D243CEC1687D917E6AE55BD2D80D0
SHA1:	A75473E35CF824D0F4A0837EB2C9DD8898607BFA
SHA-256:	209250CAE5059871AE34227550409AA9DBB9C29F1199275C0ABD756D665DFC1D
SHA-512:	A362D9DCEF9B1758322B0BBF5FAE32F2045F872E97BE52621DB8D1BF8ECDEB3B54F055389E2A0DF264E81F57E6591E26936187C62EC3B5E8EC459D4205320293
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L... .Z..........."!..0.............n... ........@.. ...............................0....`....................................W....@...................(...`......\)..8............................................ ............... ..H............text...t.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................P*......H........ ......................P .......................................N......o..T XI.mW.....k.,&(..1]BjnR.%..p9.d~.Qb..Q.p.........q0k.:O.KY....?...8..w9.k....\.W...lC.F..7'K.}r....Ym..]a.....BSJB............v4.0.30319......`.......#~..x...H...#Strings............#GUID...........#Blob......................3......................................................4...........7.......c.........t.....}.......c...V.....{.................9.....................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Threading.Tasks.Dataflow.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	505504
Entropy (8bit):	6.775848565142763
Encrypted:	false
SSDEEP:	6144:J5Enovc03uPIhST/NO/bT8jM5REzxEiRChwMeVB8v3Gu/L2SJESGskfT5v3PIm9r:J5s0YChwMyB8fGdSSvBb5v3heN2V
MD5:	DC6EE4B4267F464648E65B0BABD2D85D
SHA1:	0F4396ECCA40ECEAC7F4015E75FE39248D8544E8
SHA-256:	FA96FF100A8D665A6B7FD6956CAE729EC8CFB67B7F66CB22AEB637B3F7296E23
SHA-512:	4BDD5035EEEAA09A4A75A579243F23A004FACF7BF5782C866396DD5E4AAD0C83EBAC2D8D6296CA4BEF0B87067FED387A6A307D16E515EE804EA50159E5566874
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d................." ................................................................\|.....`...@......@............... ..................................l.......HB.......(..........x"..T...........................................................p...H............text............................... ..`.data...J...........................@....reloc..............................@..B............................................0.......................\.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........t.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...P.....0.0.0.0.0.4.b.0.........C.o.m.m.e.n.t.s...T.P.L. .D.a.t.a.f.l.o.w. .p.r.o.m.o.t.e.s. .a.c.t.o.r./.a.g.e.n.t.-.o.r.i.e.n.t.e.d. .d.e.s.i.g.n.s. .t.h.r.o.u.g.h. .p.r.i.m.i.t.i.v.e.s. .f.o.r. .i.n.-.p.r.o.c.e.s.s. .m.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Threading.Tasks.Extensions.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16136
Entropy (8bit):	6.806252090528503
Encrypted:	false
SSDEEP:	384:Cbz05p091rcmvDOR+GWS6XWlTb2HRN7M/7R9zW2EKea0o:CbgAlHe/iMF9zzeaJ
MD5:	9B55D29DDEFD8AD4EC4912D585A5A816
SHA1:	7DC1E184C95A9F8D812D81733C60A8928F26CB77
SHA-256:	35F83BF4AB15E84750A9C0F36F98479D5BE8C09DD182EC9BEF9900A0173E2CEC
SHA-512:	2F09DF30E000F9019808417E61E788973BBB199C384A6FE4048873965CE591788F774B64EEB553FC9B5E0B67FABC9116D2AFD5952758CA46C365DAA27CD16D9D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...:.P..........."!..0..............+... ........@.. ...............................8....`..................................+..K....@...................)...`.......*..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................+......H........ ......................P ......................................G.^...R...2b....g~.....+...?N...l.H.. .x[....d..S.S=....Z.y...~$.1y6.-..5..-.z].....'...8....YL...6..3.z..P....B.=.o.`.h.BSJB............v4.0.30319......`.......#~......8...#Strings....(.......#GUID...8.......#Blob......................3..................................................z...v.z.....H...............G.......[.....[...............]..........._...........9................./.z.....p.....

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Threading.Tasks.Parallel.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	139016
Entropy (8bit):	6.701224587129732
Encrypted:	false
SSDEEP:	3072:X7HDis5anqPF55D/ZX3LBzdQZK/FJg9V5jR29/5Pup+pN:LjF5tPn5TZFzKZvUxuY
MD5:	B863E4787E619D65794B729771869E86
SHA1:	532DB8EE30B115C4015DFB73EEA187C96C6516B4
SHA-256:	C252E669A53DF2A56029D767117B8FB15427573EBE889B04F5DB44518D9DC464
SHA-512:	2AA01974DFE63A47CA1B4C3B81B451511D16BE1FC9A92603E28BA12A004D051537F5DFC1E1420DC5BDA0E6B5A5D940DE57ED04F10B25DFF19F88C8C9ECEFC331
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....j..........." .........*............................................... ......v7....`...@......@............... .......................................;..(........)..............T...............................................................H............text...b........................... ..`.data....%.......&..................@....reloc..............................@..B............................................0...........................\|.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...X. ...C.o.m.m.e.n.t.s...S.y.s.t.e.m...T.h.r.e.a.d.i.n.g...T.a.s.k.s...P.a.r.a.l.l.e.l...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...h. ...F.i.l.e.D.e.s.c.r.i.p.t.i.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Threading.Tasks.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	17184
Entropy (8bit):	6.712259182993975
Encrypted:	false
SSDEEP:	384:AvCj4AG3tNKauqFLTs9WHuzWbD5kHRN7uPNbZR9zz4pl:ECj4LN9uLaGkFT9z0b
MD5:	40AB00EC761F21B36383EBB1DEE8FB31
SHA1:	ECD8605E047B3928B038CF6D8E873499405A4461
SHA-256:	8F117279324EC6F8E4C0CC59D6F866C2AE1476691E086F8FCAAD8D2752265FD7
SHA-512:	0E05981AF4BA4435C71D4468A36CAFE06667B7BE568F5F96A3B80F0E5B6434CB57EAFA126884452F16A1CB99448BF33241A089578D6AC73FC6DF6D56B627950C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....U............"!..0............../... ........@.. ...............................S....`.................................h/..S....@.................. )...`..........8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................./......H........ ......................P ........................................"...ZA...:.6!,..........5Z..~.....YP.A.\|0Q...b.....J.;C.`4...T.ztj..F..^......g%U..q..>8.A_$.......V......>s..#../`b.~BSJB............v4.0.30319......`...P...#~......\|...#Strings....,.......#GUID...<.......#Blob......................3................................/.....Y.........\.7.....7...u.....W.......&.....t...7.....@...........[...................................\|.............7...........

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Threading.Thread.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16160
Entropy (8bit):	6.755909748860832
Encrypted:	false
SSDEEP:	384:Hz2EUZVNDlWcW7Wn05kHRN7MgSR9zfBQ6:T8uGBZe9zZd
MD5:	DC5634F8DF287AC4F89F8A9D2170139F
SHA1:	209DAF8CD9F21814D7561BB23F463B02092DC1E4
SHA-256:	FAF059B32A29B0C120F0E90DAEBD69CE390420BAEA964463C9415DE9DB51FEC8
SHA-512:	827A8432EFF113AEDF774C2ABF6C536581DBEA028DDD23BED2047FF601F843F73FAE8D01A206F4654EF81210B2F98D48777198E7439EFCE5E7B9C183001FC058
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....]..........."!..0.............>+... ........@.. ...............................f....`....................................W....@.................. )...`......4..8............................................ ............... ..H............text...D.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................ +......H........ ..d...................P .......................................'.e...b.8:.D..B...Z.ct...p9..&a%P.:.mu[..'.X...n....a.!B..ci~..4U,_F3B......c.P...Y....~l..ZZ.3)3..<5.3.k_.........6....R.BSJB............v4.0.30319......`.......#~..........#Strings............#GUID...........#Blob......................3......................................].........U.@.....@...n.....`.............y...0.!...9.!.........T...................................u.............@...........

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Threading.ThreadPool.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16032
Entropy (8bit):	6.695567468379491
Encrypted:	false
SSDEEP:	384:wJ92dRThBtWESvWlTb2HRN70Bmo8R9zbcJ:w8q6/iSmoQ9zYJ
MD5:	A2637EC6F02668828992AFAF04555104
SHA1:	86509DFAE1EF1BCE16882C365999A28B38992A60
SHA-256:	276B5DE35D1FF905421E25B2FFC4A151EB6D7046C329147D06FAE3B24BD5A305
SHA-512:	635EFFAFB5871A3543729668605BC1BC78AF068BD51511777C0E9E234633B5C76A835C3A5311CBA397DD4DA3B8FC020B710CA1ECA19BBA2673802E50F3764CCA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................"!..0................. ........@.. ..............................9.....`..................................)..O....@...................(...`.......)..8............................................ ............... ..H............text...$.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.......................H........ ..D...................P .......................................N....[1....x^4...{..2I.L;.xnH.:+2....s...#....%.\|..F.e.j....^...9Mf.=..7D...T.....X.%.O..\M..^18..QN.M$......u[.N....K.FBSJB............v4.0.30319......`.......#~..d... ...#Strings............#GUID...........#Blob......................3......................................P.........7...........P...........{.............................6...........p.......................W.....d...................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Threading.Timer.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15520
Entropy (8bit):	6.795086498779825
Encrypted:	false
SSDEEP:	384:6Df6HuqMrMJMWsJCW5Tb2HRN7EapBmo8R9zbcs:6Ou59/i9zmoQ9zYs
MD5:	C01ADEDF7CED47AFAECA2A11F53670D4
SHA1:	677F972F7729911F95A91D126AD29ED9DCDD6B27
SHA-256:	1446EE259B88B7CF5D03024D190BDBE348FDF8246D2566DBE4E95C4E85393BAA
SHA-512:	88D109E72A9E29E885ADB30C9F3F4D6EF31DACDE72A5EBC258B0E41E4A3853A927DBF33D9C722705770599D23B1EDAC7D905351BCAF7E290587FBD3A6CE81126
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................."!..0..............)... ........@.. ..............................R.....`.................................T)..W....@...................(...`.......(..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H........ ......................P .......................................;.m."B........]...E.:..t3@.}...X.a.s..^J.....x....6...>.,.m..n...o.Ku.Z.U{....g.Ny...Nf.6......~t.9-@........z.$=......?BSJB............v4.0.30319......`.......#~..<.......#Strings............#GUID...(.......#Blob......................3......................................(........."...........;.y.........f.......C.................J...!.J.....J...[.J.....J.....J.....J...B.J...O.J...v.............

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Threading.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	80048
Entropy (8bit):	6.547184357019931
Encrypted:	false
SSDEEP:	768:c/jJLt3hjPHS7z1BMC7Ku+yDqumnIrU8n7aXN9shuvOEoXz2udFb1BfRAi7CBWG5:cV5R27Ku+ydo98uGxdFJRRH7AveUxz5L
MD5:	7CDE713D668645EF994A6323486699C2
SHA1:	95BDE17DAA1F95C30BC131ADC229286FEF92E014
SHA-256:	FE6BF116A647E455101785AAD86B68229E611C9B1D5A6BE00D53385DA4FD11D2
SHA-512:	FE709D9305AE96F5223640231A64A12CC0936CC04D87522AD8576E6D949A490ED97EC20454516597E48F84B1DE4B4F867ADBF726F5DBA5E5B18C1441AA207B60
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....mk..........." .........................................................0............`...@......@............... ..................................d....*..\........(... ..$.......T...........................................................h...H............text...K........................... ..`.data...............................@....reloc..$.... ......................@..B............................................0.......................T.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........l.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...H.....0.0.0.0.0.4.b.0...:.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...T.h.r.e.a.d.i.n.g.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...J.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.e.m...T.h.r.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Transactions.Local.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	351496
Entropy (8bit):	6.645827068115457
Encrypted:	false
SSDEEP:	6144:gXQASVcxfSelpxZvc/sQQHrnAIgBUotQKm9+:gg1qfSel9cSre2sj
MD5:	EC28A727775863CC9004DB7D8F11B328
SHA1:	9E078E6ED1CD8065FA22E49DEC47E0671B0D7894
SHA-256:	9F83A858D6C212BF573944D09EC0807D706956F35588D335834352484EF168C7
SHA-512:	42175EF939A6B72B59AC17FD59D5139DD2D307AF7B3855C281B151C6BE7D546BAFE1E0E9616E3C747C159542162469EFC386467863C1A3CC091EEE75F2254187
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....}..........." .........X...............................................P......Y.....`...@......@............... .......................................z...3...4...)...@.......*..T...............................................................H............text...N........................... ..`.data....O.......P..................@....reloc.......@.......,..............@..B............................................0...........................L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...L.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...T.r.a.n.s.a.c.t.i.o.n.s...L.o.c.a.l...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...\.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Transactions.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	17072
Entropy (8bit):	6.660825267432608
Encrypted:	false
SSDEEP:	192:O5uFRybaoXWz5iWt3WT56Os1HnhWgN7aIWf0a7KIjwX01k9z3A35DR:O5uFRKaoXWz5iWo5kHRN7VPHR9zI5R
MD5:	103A5ED29A9BC11D2F4F8E0E39A1C6A4
SHA1:	FE83BBA396EF98AFB42AC4F10824FBBE388877A8
SHA-256:	9B534CC58EE0DD1FF144554DA44B823BC908F8EDECE395D5616ED3397044377A
SHA-512:	AB1FE3FE2EBBBC482B3E6049C6C4FBC198AEDF8F728A50751216D0D4CB093681C764F0AA4309FBD3F50ADA351A73B34D67BF8F777C85741B82A6EDF2B91ABE90
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....$..........." ..0.............j/... ...@....... ...............................)....`................................../..O....@..x................(...`......8...T............................................ ............... ..H............text...p.... ...................... ..`.rsrc...x....@......................@..@.reloc.......`......................@..B................K/......H.......P ..h....................-......................................BSJB............v4.0.30319......l.......#~..d...4...#Strings............#US.........#GUID...........#Blob............T.........3....................................$...............f.O.....O...^.<...o.................H.....*.................+.......................r.....,...........D.$.....O.................6.....6.....6...).6...1.6...9.6...A.6...I.6...Q.6...Y.6...a.6...i.6...q.6...y.6.....6. ...6.....6...

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.ValueTuple.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15520
Entropy (8bit):	6.801708330699184
Encrypted:	false
SSDEEP:	384:PpJCdceR3WtVGWnTb2HRN7QF9RDX+iR9znp3rA:PpJ1ZP/i8DuO9zlrA
MD5:	6F57BE5E458142D2AB6C3BF17583D317
SHA1:	78CCCF14EB03373ACC86E2D4F6DC16DD61E9A237
SHA-256:	66E104EEAC5BFA3C7550BF773C52AEA54545057D576F917DA8A15BD4CA8CD3AE
SHA-512:	70A28507674335B69ED284C0DA1E6375E6389504DD6509C8EFF6D5BA78B2DEE498A544DA74C97E545B9E5B3535E6889F398CA372A9F529D18932ED510990829E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...M............."!..0..............)... ........@.. ....................................`..................................)..K....@..h................(...`.......(..8............................................ ............... ..H............text........ ...................... ..`.rsrc...h....@......................@..@.reloc.......`......................@..B.................)......H........ ..,...................P ............................................Z..I..5O..lYdV].9E....@..lk..r....D.!..:.6........U'.....P..+u.........m.].2n..P..j.......P<E.I.k*...-..../.D.8!1.BSJB............v4.0.30319......`...@...#~..........#Strings............#GUID...........#Blob......................3......................................]...............%...................C.....s...Q.z.....z.....z.....z...4.z.....z.....z.....z.....z...........i.................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Web.HttpUtility.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	52912
Entropy (8bit):	6.682966332363621
Encrypted:	false
SSDEEP:	768:MXO4xc+vjER94QgxWAJDHyjuc97Qk7Y32Qtt7X/XHXJIEYcPli8b29zM:MXORWEZ8yjFQk7Y32OpPXScPs8bCzM
MD5:	EFF9FF3FFE44B51215E04293BEC16173
SHA1:	141EA402993812C8F542B41486D3DC20E4DEE696
SHA-256:	55E28BFBD338BA879759B301F705E2D4B66D56D8AB6820BB9022C3193A227A97
SHA-512:	B90213999C31A34DB1EE31F25417723E1530152CE145CC0F2AA29696132B87D0127061BAF7F574B6ADEA8541BC436B734AABFA5094DA9DF102FF430FC1FECDE1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...2.C..........." ................................................................jR....`...@......@............... ......................................\!...........(..........8...T...............................................................H............text.............................. ..`.data...&...........................@....reloc..............................@..B............................................0...........................<.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o...x.....0.0.0.0.0.4.b.0...F.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...W.e.b...H.t.t.p.U.t.i.l.i.t.y.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...V.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....S.y.s.t.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Web.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16048
Entropy (8bit):	6.693921746812127
Encrypted:	false
SSDEEP:	384:LECNDdGWVDo9Wi5kHRN78h70G3tHNsAR9zmnfuR:L5mC8dXdts89zJ
MD5:	A0A8EEE143116B280F3957DC87EACE34
SHA1:	8C49A0187412C355D4E03F2788C6C4985D4D6AF5
SHA-256:	473BF5E172CF4AFA342103D6DA3F379DB65E688B5AFE6AF5D11E53D81D57420D
SHA-512:	16D2BFAB61A5244884FD5E9D42C327421AE08C83CB0908181D11C3267722FF6B5D01C4E3455C6DC7BCD82A6A3265E00E876D027E05C0462A3DD936FF9A464899
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.............z... ...@....... ....................................`.................................%..O....@..8................(...`......X)..T............................................ ............... ..H............text........ ...................... ..`.rsrc...8....@......................@..@.reloc.......`......................@..B................Y*......H.......P .......................(......................................BSJB............v4.0.30319......l.......#~..d.......#Strings....0.......#US.4.......#GUID...D...D...#Blob............T.........3....................................................6.Y.....Y...X.F...y.......................$...........o.......................V.....l.................>.......Y.................@.....@.....@...).@...1.@...9.@...A.@...I.@...Q.@...Y.@...a.@...i.@...q.@...y.@.....@. ...@.....@...

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Windows.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16544
Entropy (8bit):	6.656856461610316
Encrypted:	false
SSDEEP:	384:cyaMtZ0vWE5SWsTb2HRN7pt/6fR9zcGoVL:iYWQ/ik9z8L
MD5:	900CAB4BE62B1A84C9C3654AEA13C873
SHA1:	6F83EDA80857E6DB9C88675227B4A87E494A2546
SHA-256:	E9CF5C3032F07E3E77579550F58FDF883CB8DFC9355825D774E61972EE7AF3BB
SHA-512:	3ED32DDF06EFE9EAE5D4B85EBA05D86435600977FDCE104234BDF1A786F3468B85B4AEFFE9B3258822E88E5E7F64636DFE3F3657CBBA23D1CFD2777792680003
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....-V..........." ..0..............,... ...@....... ..............................].....`..................................+..O....@..X................(...`.......+..T............................................ ............... ..H............text...4.... ...................... ..`.rsrc...X....@......................@..@.reloc.......`......................@..B.................,......H.......P ..4....................*......................................BSJB............v4.0.30319......l...h...#~..........#Strings............#US.........#GUID.......@...#Blob............T.........3......................................................Q...&.Q.....>...q.......D.........m.....y.................P...................................4.............Q..... ...........8.....8.....8...).8...1.8...9.8...A.8...I.8...Q.8...Y.8...a.8...i.8...q.8...y.8.....8. ...8.....8...

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Xml.Linq.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16544
Entropy (8bit):	6.651132570134836
Encrypted:	false
SSDEEP:	192:tDhMv7hhW1b4WKMuWXebPpUNTQHnhWgN7aIW/e+ibTseUfX01k9z3AfarHG1/:k1hW1b4WKMTb2HRN74eL/6fR9zcaTGd
MD5:	7851C8261A0E809C0E071D18296CA374
SHA1:	DC550CAAAAF67EDCC72F7A45A45117780F77BBBB
SHA-256:	C16C26AD8E9472E2C691898FF9F19A8296FFF9965B0D723C57E94EF9E95C704C
SHA-512:	35876137336909EC6ABB1E1866F69835C9D3E5AA16ACB44854BD6CBF6E799C01DB82837DBD4860D403CE2DADD5061A61CECD9AD45E2C66B482ECF837D1D69BD8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....(m..........." ..0..............,... ...@....... ....................................`..................................,..O....@..X................(...`.......+..T............................................ ............... ..H............text........ ...................... ..`.rsrc...X....@......................@..@.reloc.......`......................@..B.................,......H.......P ......................(+......................................BSJB............v4.0.30319......l...l...#~......<...#Strings............#US.........#GUID...(.......#Blob............T.........3..........................................f...........+.....+.........K.......;.....z...d.....p.................G...................................+.......).....+.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y......... .............

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Xml.ReaderWriter.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22192
Entropy (8bit):	6.352141428856668
Encrypted:	false
SSDEEP:	384:F125qkxK67ex4FCauAW1TAWL5kHRN78qBmo8R9zbcUb:TKLdek8ImoQ9zYI
MD5:	262AF6888AEE27937F3A546CF9ECE8DA
SHA1:	F6133D2435609795BEB8FA5F108C593ECC43B678
SHA-256:	F1504342C4BBCD6486097D2792BD88C9EB7BA63D8C6B5F787986D78B8422E4F1
SHA-512:	6FB7C3586D8FB989C9072E4344BBEB3DABCD9791BC035C449266D5033F8F85B876FAC99BDDD10DD27E6512D4830A94F3A5548C11209178AA54B09AFF09478D7B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................"!..0..$...........B... ........@.. ...............................G....`.................................LB..O....`...................(...........A..8............................................ ............... ..H............text...."... ...$.................. ..`.rsrc........`.......&..............@..@.reloc...............,..............@..B.................B......H........ ... ..................P ......................................V[O.O.!..L..W.[W.O;.......&...c........L..._...H..S\|......V..K.i....9..$yR."/..}'G.:.;.i.A.Q..x...$......`.....6MT...._'.}BSJB............v4.0.30319......`.......#~......8...#Strings............#GUID...(.......#Blob......................3............................................................G..... .......b.....i...f.....-.........................................[...............................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Xml.Serialization.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16544
Entropy (8bit):	6.7191065924125715
Encrypted:	false
SSDEEP:	192:Wr2xQLW7MUEqHW0uWXebPpUNTQHnhWgN7aIWIbTseUfX01k9z3Af43:WKQLW7MUEqHW0Tb2HRN73/6fR9zc43
MD5:	5C634F491A7EBC5DD4B45ECC63622AE1
SHA1:	5F4F6A47F023243F3AF8DB284AF1188E253A7D96
SHA-256:	CAE2B55ADEACF030B6AC968F58E79742D7E98BE8FAA43AF572E20660CA7776B8
SHA-512:	1874CBCA45E2BC6BBCACF0F0264D9DDDDB5AE91D7D16C47AD754BFCB1A95C9FF2FFA42E4D571E49F152DF09CC8CA3C0A8568C77CAFDB88C6F8B13768B03FDD05
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....k..........." ..0..............-... ...@....... ..............................).....`..................................-..O....@...................(...`.......,..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................-......H.......P .......................,......................................BSJB............v4.0.30319......l...x...#~..........#Strings............#US.........#GUID...........#Blob............T.........3..........................................p.........$.F.....F...r.....\|.......<...............*...........]...........0.....M.....D.................s.....D.....x.F.................................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y......... .............

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Xml.XDocument.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16032
Entropy (8bit):	6.74992671839239
Encrypted:	false
SSDEEP:	192:SA0zxpnjW/8dWRuWXebPpUNTQHnhWgN7aIWTxtBbTseUfX01k9z3AfRmwL:SDpjW/8dWRTb2HRN7aR/6fR9zcRmwL
MD5:	B025C72B7FCBAF4F2C8E5922FE37156B
SHA1:	3A1AA60B5600FDAE34D2AE2ACAA2E992D1068D87
SHA-256:	B9F4EEB946FEBD0D8CEFE34B7E3234722A766B9F7EE1A1540662BC115F8D3A39
SHA-512:	869C71BEEEB0E7354CFB55152E944F516C0C56A737B6C3901D87DA120D35B5F2C728004C3F21EAD3563904AFAD63E8DA682215387AA9C6D5042BC2AB06D2E23E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...._............"!..0..............+... ........@.. ...................................`.................................L+..O....@...................(...`.........8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................+......H........ ......................P ......................................I.-..m........mW......nmH..4=.....F..\|.3I#.gt.Ir.*.[ty:.!"....?nG..V...v.;k...'^..F.c\|gn.^..7..b...z,....:...['..../..W.BSJB............v4.0.30319......`.......#~..l.......#Strings............#GUID...,.......#Blob......................3................................................L...............................8.....L...p.L.....L.....L.....L.....L.....L...l.L.....L.............................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Xml.XPath.XDocument.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18080
Entropy (8bit):	6.634515176200433
Encrypted:	false
SSDEEP:	384:NW0NeWF4ATUVGoTb2HRN7zPBmo8R9zbcGQbp:vF4AgJ/i1moQ9zYZbp
MD5:	1EBB819E6EC4AFF410BBB0AD9960FC58
SHA1:	B9DF4E65271EC2EE9FC43F332350CD81E84FC6F7
SHA-256:	724BA8263995AE735195AC0C14BFB3781E26B577A5AE68535687D694C30C470F
SHA-512:	539D3A1D592357C5A796FC07B8A66D85F7736EFBB9BF5E96A41C7DBA6314E539B658A06E4299E66222C6E8992E58B8BD1997BF74A2AFF02E24C839D4B00EE0AA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d................" .........................................................P............`...@......@............... ......................................0...H........(...@......P...T...............................................................H............text............................... ..`.data...?....0......................@....reloc.......@......................@..B............................................0...........................\.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...N.....C.o.m.m.e.n.t.s...S.y.s.t.e.m...X.m.l...X.P.a.t.h...X.D.o.c.u.m.e.n.t.....L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...^.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Xml.XPath.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16032
Entropy (8bit):	6.704717115398796
Encrypted:	false
SSDEEP:	384:tv/lRiAaDKDWBivWiTb2HRN7+i//XBmo8R9zbc+H:HPaCd/i+i//xmoQ9zYG
MD5:	277CF1146BED5535AB328B9CFE8732CA
SHA1:	F4B088225726C81F8263F16C2882339A07630012
SHA-256:	F502D5473B429AA859458040504FD119BAFD1DC3B4688D4205393B36D6537931
SHA-512:	96F0F7A03091037EC757CB842354BEDE28B06E10E15B508F2D80D9346D99EE3BF5A0F2AFDAD32C08AFCE6AC105B4D13D7E0B30328CB378D3258F5BED98E4D553
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...../..........."!..0................. ........@.. ..............................Mu....`.................................\|..O....@..h................(...`.......)..8............................................ ............... ..H............text........ ...................... ..`.rsrc...h....@......................@..@.reloc.......`......................@..B.................*......H........ ......................P .......................................S(..Kt.-t....Fl..;@D..,...}....[.x.@.T.CC@t.h.fN....1X......yZ...;.oS.}..$..\.C..?.3:.v>qn.......y.5...m.;C.gQE.E2<..$.8BSJB............v4.0.30319......`.......#~......\...#Strings....X.......#GUID...h.......#Blob......................3......................................'.........C...............................d...%.{...g.{.....{...\|.{.....{.....{.....{...c.{.....{.............................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Xml.XmlDocument.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16032
Entropy (8bit):	6.761524352125516
Encrypted:	false
SSDEEP:	192:rRixGf214WA9nnPUWduWXebPpUNTQHnhWgN7aIWYpbTseUfX01k9z3AfukL:9oGf2iWensWdTb2HRN7lp/6fR9zcV
MD5:	DFA8EEB084BDD8184C071E6BAACAF597
SHA1:	29600D48A14C1753518AA221F8076DDADF5E3354
SHA-256:	70B4E80072C4B0CA455BC8D88AFBE0E783ED37AE6A3B315D3815AE4AA139E2E0
SHA-512:	A918542169E64473D9390A8DBD55238D0DB4A3656F2FD76CAFAE26492A459BC3783E61825852048AA046B0EF54E339AF39C18EC11441F7ED617E3AEA093C32E1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....~............"!..0..............+... ........@.. ...................................`.................................\|+..O....@...................(...`.......*..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................+......H........ ......................P ......................................A..s..-.EN/.....i.=.s.G.5.W.$r......f.z.O.#g.......m..z..f'...eK...d.....@.+q.........~...6o......~.~....Om.'.^..[=.p.l..BSJB............v4.0.30319......`.......#~..\.......#Strings....H.......#GUID...X.......#Blob......................3......................................#.........P./...../.........O.............\...2.....g...................................p............./.......................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Xml.XmlSerializer.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18096
Entropy (8bit):	6.602610340080174
Encrypted:	false
SSDEEP:	192:+jLgTJNT5xhGjWpivW33WT56Os1HnhWgN7aIWfdf8bTseUfX01k9z3AfmXA:q8rjhaWpivWe5kHRN788/6fR9zcCA
MD5:	33AB9F2C7F8ED9DC0C0B5CD0361674B1
SHA1:	DB444906FC365B9160671F9D837E4E021C485F15
SHA-256:	7F58B96D176FAC24A69CE895DD295D04FE1D5606182CDC125907E96880980C9D
SHA-512:	387A749EBE366E97B2EC63219065A813F6BE64887F5F7D985E94472CBE44EFD160915608BDF8BDDEDEE0097AAA687A2610FB6D35FA47E0657C8AA3CACA927345
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...}v............"!..0..............3... ........@.. ...............................u....`..................................2..W....@...................(...`...... 2..8............................................ ............... ..H............text...4.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................3......H........ ..P...................P ..........................................usi(..3P.Q%qUJ....._....e....\nQ)..$..p...n.*1..{#..=.VP.4OjI...4...6.G.L..5..]..Y..{/A..6..@&.HX.t...8Y..3.\.3.6.=5-BSJB............v4.0.30319......`.......#~..(...p...#Strings............#GUID...........#Blob......................3................................J.................................+.....F...........N.....H.........................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.Xml.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	24736
Entropy (8bit):	6.19655909242854
Encrypted:	false
SSDEEP:	384:IV/Mc95qohA8bhUVGZOUHWKDjsWITb2HRN7iJBmo8R9zbcVq:IV0chOSu/iiTmoQ9zYVq
MD5:	F5867A06219AC23874BE565DFE707742
SHA1:	8B5A8141DCE8BBF97432794CAED7064BF4038628
SHA-256:	0AD5184C455F0CE156C91533976B696A63A098301F1BB2B74DAC58C221BB0D1E
SHA-512:	37777C45AA657A56306E1C85E62F1B72BB133117844BBDAA0F26B5A8E55F801C418A0993F6F504CECE4CA8E85D374B934F11924C863386D6EAA03305C7841BFA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..............L... ...`....... ...............................s....`..................................K..O....`..8............8...(...........J..T............................................ ............... ..H............text....,... ...................... ..`.rsrc...8....`.......0..............@..@.reloc...............6..............@..B.................K......H.......P ...*..................lJ......................................BSJB............v4.0.30319......l...@...#~..........#Strings....L'......#US.P'......#GUID...`'......#Blob............T.........3..........................................P............... .................k.....H...........S.................G...................................+.....m.S...0...................x.....x.....x...).x...1.x...9.x...A.x...I.x...Q.x...Y.x...a.x...i.x...q.x...y.x.....x. ...x.....x...

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	50848
Entropy (8bit):	5.735088633015434
Encrypted:	false
SSDEEP:	768:QQuoy1c6A2ZX8TRNH5JVbOd502zq1TntVA12/inEmoQ9zYN7:QQuoO3ZX8Q5jzC3AMinEmVzM7
MD5:	79F3A869735E68ACB84CEAA83089ECC3
SHA1:	395C438746D6204FF4014BABB9E9F21B933278A9
SHA-256:	8B272FD8AB5D492F57729F3600DA532840D5FD01CEC93FF5C834F7BD8DDF30B2
SHA-512:	346230177F5D6909B5099058D9FFF1DD3C244B2CAB00E2731125E1DD8EB99AD5669091506D1842064BD464CD363600B4BEDD103EC3DEC145099D480B91A9ACB1
Malicious:	true
Yara Hits:	Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\System.dll, Author: Joe Security
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.................. ........... ....................................`.....................................O........................(.............T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H.......P ......................`.......................................BSJB............v4.0.30319......l...$;..#~...;...R..#Strings....4.......#US.8.......#GUID...H.......#Blob............T.........3................................/......................=.....=....J=...=......V...}.....h.. ..... ..... ..J.. ..... ..... ..... ..1.. ..j.. .., AF..a.AF.....R..e..=.................;.....;.....;..)..;..1..;..9..;..A..;..I..;..Q..;..Y..;..a..;..i..;..q..;..y..;.....; ....;.....;..

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\WindowsBase.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	17072
Entropy (8bit):	6.6657315731872915
Encrypted:	false
SSDEEP:	384:TpmduasEWQ3EqmWVXcWC5kHRN72Y/6fR9zcRA6:T0dJnJ52/9z36
MD5:	7A74AFF294789DAA26FA0F218A2C1AD5
SHA1:	3963A776D7F3AF1BB606FE309DD4E89445BBAB11
SHA-256:	2088FCE73A532A994DFE2B33A5361C7695A6B892E304FF157C0EC071D65BD16E
SHA-512:	E9A244CDE20DA37EB8396CF092281BEB1812F44DEED28E25471ECF3E9B5333E2CAEF901BD2AD37FD3EA6CBFB38AEF68EC5BECCE79C042DF113878C5C4DBE04E4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....ti..........." ..0............../... ...@....... ...............................!....`.....................................O....@..8................(...`.......-..T............................................ ............... ..H............text........ ...................... ..`.rsrc...8....@......................@..@.reloc.......`......................@..B........................H.......P .. ...................p-......................................BSJB............v4.0.30319......l.......#~..$.......#Strings............#US.........#GUID.......D...#Blob............T.........3..........................................f.........3.................'.....0.......v.....................l...........I.....f.....S.............i.....i................. ...........................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y......... .............

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-console-l1-1-0.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20944
Entropy (8bit):	4.459775574843526
Encrypted:	false
SSDEEP:	192:SOQWvhW/WYnO/VWQ4SWc0NsxZAqnajT9CJIC:SjWvhWvUsNs/Al39AL
MD5:	681C84FB102B5761477D8DA2D68CD834
SHA1:	FD96CF075A956FBC2B74E1ECC3E7958163B58832
SHA-256:	F0F7CB2A9FFCCB43400DB88D6BF99F2FCC3161DE1AC96C48501D4D522C48C2CA
SHA-512:	C41A62F8D10290215B8A7F0DDCC27A1CF12A7453C2DAABEF75BD2CE87C4FFC87D74EDC8CAA1771BEDA0BFA26249CFE3C94D4AF50B22A5DECB6D282BD8A2C4BDD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d...B4............" .........0...............................................@............`A........................................p...,............0...............0...!..............p............................................................................rdata..t...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-console-l1-2-0.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20960
Entropy (8bit):	4.499619700582879
Encrypted:	false
SSDEEP:	192:L6WvhWFWYnO/VWQ4SWssAtkqnaj6M07i5CK:+WvhW1UslWMui57
MD5:	039D612693E56CCF32AE81C99443EA77
SHA1:	0487AA5E7D283A8840F3005D1E24E8C9ED140974
SHA-256:	4E978EE035B72032D0B7693E09EED6E112DCED6965780BC3E6B8E024EA2366AB
SHA-512:	FFA56C73E977FFCEF7890AB6C3EC52E9827AF28B0552F11C48BB7CA16D37C2B7069FB7E03CEFB89F8679E3755BCC8C47344D0D9B91416C6D92CA7DB28C20240A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d.....=.........." .........0...............................................@...........`A........................................p................0...............0...!..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-datetime-l1-1-0.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20952
Entropy (8bit):	4.308560743366262
Encrypted:	false
SSDEEP:	192:1WvhW/WYnO/VWQ4yWxK2fvXqnajeCqN+6:1WvhWvU8XlX0
MD5:	2A8065DC6E6E60FB90B4B3F9E6BA7288
SHA1:	400A1F44CD4354DEA0117E79EC04B006D6141B36
SHA-256:	55E5F10D0DD9C85FF1C6DC7798E46B3A4422FB7EBC583BB00D06A7DF2494397B
SHA-512:	787E033E35AA357263639D97FDFE8A2EBC9F17865579BE13C14C0A4C2ED99432ED8EA79C5046D1B4B783BF5FCF7B713EFDD70FCA8445A7AFCB91CFDDC7F9D442
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d...FBe..........." .........0...............................................@.......,....`A........................................p................0...............0...!..............p............................................................................rdata..X...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-debug-l1-1-0.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20944
Entropy (8bit):	4.314779945585029
Encrypted:	false
SSDEEP:	192:JWvhWiWYnO/VWQ4mWAyTIl1PXEKup3JdqnajKsztG2:JWvhWYUQI/PX7aJdlGsztG2
MD5:	720DB2235C4193151FF8987F8A729135
SHA1:	038648798892203B506AB4664BAECA25F78BC43C
SHA-256:	092B72832C47F9C4EDCDE61F1A111C20EB73452984E0A6109482DE74EB03C34D
SHA-512:	CAAC89DC4FE10E7752B6F248623B34A47A77A750E62F0A558C760A8AD672D980AFC966A9E5696BA5C916E722FD221D305C4D2C49D5DDA0E4A768855886D4F3CA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d...@4............" .........0...............................................@............`A........................................p................0...............0...!..............p............................................................................rdata..d...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-errorhandling-l1-1-0.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20944
Entropy (8bit):	4.363620943088422
Encrypted:	false
SSDEEP:	192:9m7xeiImxD3exWvhW5WWYnO/VWQ4mWACJXEKup3JdqnajKsztJ30:9m7xeiIFxWvhWuUkX7aJdlGsztd0
MD5:	ECDD006AAE56427C3555740F1ABFA8D6
SHA1:	7DFAB7AD873544F627B42C7C4981A8700A250BD4
SHA-256:	13BC8B3F90DA149030897B8F9F08D71E5D1561E3AE604472A82F58DAB2B103F9
SHA-512:	A9B37E36F844796A0FE53A60684BE51AB4013750BB0B8460C261D25FA5F3DE6CE3380044DDC71116825D130A724DF4BA351C2CFFCBF497EF1B6C443545E83F1C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d......v.........." .........0...............................................@.......p....`A........................................p................0...............0...!..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-fibers-l1-1-0.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20944
Entropy (8bit):	4.2939305898439235
Encrypted:	false
SSDEEP:	192:8gWvhWliWYnO/VWQ4mWCkJZH2vArqnajKsbTYjtZ:NWvhWlYUDuH24rlGsbTY5Z
MD5:	EB065ED1B5CABDBB90E2403B8564778F
SHA1:	5B511215EE0E347734FB727FAD6A0A959FF81BF1
SHA-256:	BB2D740333AFAEA2A73A163F95FA102D018CCD68DEF28B6815A2BE0696AB57DB
SHA-512:	E5FF38F28253FB31BF583131E23EF58AF60020AD1FB329986C8789FE351F4B73CB06109FBC4220678D93191B04DB353466F728534AA1FEBEDF150C491B8E7C65
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d.....cc.........." .........0...............................................@.......o....`A........................................p................0...............0...!..............p............................................................................rdata..0...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-file-l1-1-0.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	25048
Entropy (8bit):	4.628757275210407
Encrypted:	false
SSDEEP:	192:1mtaNYPvVX8rFTsvWvhWmWYnO/VWQ4yW9AfvXqnajeCqKW:8PvVXhWvhWMU7XlX7W
MD5:	36277B52C64CC66216751AAD135528F9
SHA1:	F2A6740BA149A83E4E58E1E331429FA3EB44FBA0
SHA-256:	F353B6C2DF7AADB457263A02BCE59C44BBAB55F98AE6509674CFBC3751F761B9
SHA-512:	BE729194A0A3C4D70A6FFA8DE5C7F8BB3DDA1F54772F9AEFF4B9AA1D6756720D149613C5DCB911286B6C0181A264A4A2A8A4EB848C09AC30BA60B6FD10DD64C9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d...!..e.........." .........@...............................................P............`A........................................p................@...............@...!..............p............................................................................rdata..L........ ..................@..@.data........0......................@....rsrc........@.......0..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-file-l1-2-0.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20960
Entropy (8bit):	4.328858083322922
Encrypted:	false
SSDEEP:	192:IAIEWvhWLIQWYnO/VWQ4eWletp80Hy5qnajsBk9:I5EWvhWLI+UJpslE8
MD5:	D92E6A007FC22A1E218552EBFB65DA93
SHA1:	3C9909332E94F7B7386664A90F52730F4027A75A
SHA-256:	03BD3217EAE0EF68521B39556E7491292DB540F615DA873DD8DA538693B81862
SHA-512:	B8B0E6052E68C08E558E72C168E4FF318B1907C4DC5FC1CD1104F5CAE7CC418293013DABBB30C835A5C35A456E1CB22CC352B7AE40F82B9B7311BB7419D854C7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d................" .........0...............................................@......p.....`A........................................p...L............0...............0...!..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-file-l2-1-0.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20960
Entropy (8bit):	4.41968362445382
Encrypted:	false
SSDEEP:	192:lC+WvhWRWYnO/VWQ4SWHvD480Hy5qnajsBkffy2:4+WvhWRUGEslECl
MD5:	50ABF0A7EE67F00F247BADA185A7661C
SHA1:	0CDDAC9AC4DB3BF10A11D4B79085EF9CB3FB84A1
SHA-256:	F957A4C261506484B53534A9BE8931C02EC1A349B3F431A858F8215CECFEC3F7
SHA-512:	C2694BB5D103BAFF1264926A04D2F0FE156B8815A23C3748412A81CC307B71A9236A0E974B5549321014065E393D10228A0F0004DF9BA677F03B5D244A64B528
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d.....mR.........." .........0...............................................@............`A........................................p................0...............0...!..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-handle-l1-1-0.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20944
Entropy (8bit):	4.329081455517674
Encrypted:	false
SSDEEP:	192:ZfWvhWPWYnO/VWQ4SWR7me4qdsxZAqnajT9CRixc:ZfWvhW/UNezs/Al39wiO
MD5:	3039A2F694D26E754F77AECFFDA9ACE4
SHA1:	4F240C6133D491A4979D90AFA46C11608372917F
SHA-256:	625667EA50B2BD0BAE1D6EB3C7E732E9E3A0DEA21B2F9EAC3A94C71C5E57F537
SHA-512:	D2C2A38F3E779AC84593772E11AE70FC8BCFD805903E6010FE37D400B98E37746D4D00555233D36529C53DD80B1DF923714530853A69AA695A493EC548D24598
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d......0.........." .........0...............................................@......=.....`A........................................p...`............0...............0...!..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-heap-l1-1-0.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20960
Entropy (8bit):	4.447714045651854
Encrypted:	false
SSDEEP:	192:gxlAWvhW5EWYnO/VWQ4SWArSZBUuUgxfzfqnajmGYjB:gxlAWvhW5yUbSsIrlStjB
MD5:	2EDC82C3DA339A4A138B4E84DC11E580
SHA1:	E88F876C9E36D890398630E1B30878AF92DF5B59
SHA-256:	E36B72EAFFFFFB09B3F3A615678A72D561B9469A09F3B4891ABA9D809DA937A5
SHA-512:	6C1B195B2FABE4D233724133AE3BDF883F287B5ECD9639A838AD558159A07E307E7AE5E5407CE9229DCCDE4BE2CC39EC59506A5FB73B45D04B80330B55E2B85C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d...)\Ix.........." .........0...............................................@............`A........................................p................0...............0...!..............p............................................................................rdata..L...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-interlocked-l1-1-0.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20944
Entropy (8bit):	4.368970650031484
Encrypted:	false
SSDEEP:	192:ODWvhWJWYnO/VWQ4mWbAcH2vArqnajKsbTY3:ODWvhWJUrcH24rlGsbTY3
MD5:	215E3FA11BE60FEAAE8BD5883C8582F3
SHA1:	F5BF8B29FA5C7C177DFEC0DE68927077E160C9AB
SHA-256:	FBB9032835D0D564F2F53BBC4192F8A732131B8A89F52F5EF3FF0DAA2F71465F
SHA-512:	C555698F9641AF74B4C5BB4CA6385B8D69D5A3D5D48504E42B0C0EB8F65990C96093687BC7EE818AA9C24432247AFAD7DF3BF086010A2EFCD3A1010B2FCD6A31
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d......d.........." .........0...............................................@......5.....`A........................................p................0...............0...!..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-libraryloader-l1-1-0.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20944
Entropy (8bit):	4.601897142725442
Encrypted:	false
SSDEEP:	192:pTvuBL3BBLxWvhWcWYnO/VWQ4mW74j21EhqnajKsxX+:pTvuBL3BXWvhWKUBqslGsxu
MD5:	9A8AB7FE8C4CC7604DFF1FBFA57458AA
SHA1:	68ED7B6B5191F53B50D6A1A13513DB780AB19211
SHA-256:	E9A3D7F8A08AB5BC94ACB1EC1BFFDA90469FEC3B7EECDF7CF5408F3E3682D527
SHA-512:	05DAEABBCDE867E63FDE952213FFF42AF05E70AE72643C97060A90DCEA2A88B75947B6F503CB2C33938AFE36AD1BAFBA5008C1BBE839F6498CDA27DA549DAEE9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d...P.1..........." .........0...............................................@............`A........................................p................0...............0...!..............p............................................................................rdata..`...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-localization-l1-2-0.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20960
Entropy (8bit):	5.116096564588074
Encrypted:	false
SSDEEP:	384:6naOMw3zdp3bwjGzue9/0jCRrndbDWvhWfUCBoliM:POMwBprwjGzue9/0jCRrndbwIJY
MD5:	DE5695F26A0BCB54F59A8BC3F9A4ECEF
SHA1:	99C32595F3EDC2C58BDB138C3384194831E901D6
SHA-256:	E9539FCE90AD8BE582B25AB2D5645772C2A5FB195E602ECDBF12B980656E436A
SHA-512:	DF635D5D51CDEA24885AE9F0406F317DDCF04ECB6BFA26579BB2E256C457057607844DED4B52FF1F5CA25ABE29D1EB2B20F1709CF19035D3829F36BBE31F550F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d.....3..........." .........0...............................................@............`A........................................p................0...............0...!..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-memory-l1-1-0.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20944
Entropy (8bit):	4.483681194749599
Encrypted:	false
SSDEEP:	192:WqfWvhWoWYnO/VWQ4mWKNe4XEKup3JdqnajKsztPO/B:WGWvhWWU9X7aJdlGsztP2
MD5:	7DDDA921E16582B138A9E7DE445782A0
SHA1:	9B2D0080EDA4BA86A69B2C797D2AFC26B500B2D3
SHA-256:	EF77B3E4FDFF944F92908B6FEB9256A902588F0CF1C19EB9BF063BB6542ABFFF
SHA-512:	C2F4A5505F8D35FBDD7B2ECA641B9ECFCB31FE410B64FDE990D57B1F8FD932DFF3754D9E38F87DB51A75E49536B4B6263D8390C7F0A5E95556592F2726B2E418
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d...dIx..........." .........0...............................................@.......:....`A........................................p...l............0...............0...!..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-namedpipe-l1-1-0.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20960
Entropy (8bit):	4.417647805455514
Encrypted:	false
SSDEEP:	192:RWvhW0WYnO/VWQ4SWKeE+Ztc80Hy5qnajsBkUqS:RWvhWiUxslE5qS
MD5:	BF622378D051DB49BDC62ACA9DDF6451
SHA1:	EFD8445656A0688E5A8F20243C2419984BB7743E
SHA-256:	0BFEDB0D28E41E70BF9E4DA11E83F3A94C2191B5CD5DD45D9E9D439673B830CE
SHA-512:	DF32D34C81FDE6EEF83A613CE4F153A7945EECFB1EC936AC6ED674654A4E167EC5E5436185B8064177F5F9273D387CA226C3C9529591180250A9C5C581EC6F70
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d....2............" .........0...............................................@.......p....`A........................................p................0...............0...!..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-processenvironment-l1-1-0.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20944
Entropy (8bit):	4.6126507489483375
Encrypted:	false
SSDEEP:	192:qF3qWvhWQWYnO/VWQ4SWL7JJsxZAqnajT9CgsLam:qF6WvhW+UA7s/Al39wR
MD5:	A56E3E2AA6398CCB355C7CDE81CCB6E5
SHA1:	A26273DD41DB7B63D3A79ACF6F4F3CF0381A8F02
SHA-256:	25AF1BC31C4A3FB9F1036C9AA51CB0AE8899C499B3EEF4CF7281515C1EA27B47
SHA-512:	3D5CEC9E5B42724794282974F637B1FDA8C26ADF01ED19DD2EC4F940E01CD43BDC42E46DC3E62704E62553DE96D3FEA1616C9650AF73CDB557DFCA1B52051A64
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d................" .........0...............................................@............`A........................................p...H............0...............0...!..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-processthreads-l1-1-0.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20944
Entropy (8bit):	4.978924663768967
Encrypted:	false
SSDEEP:	384:Hck1JzNcKSIGqAWvhWTUpDX7aJdlGsztMs:3cKSswKz7aJGps
MD5:	82159E8D92E38C4F287EB9420DCF1F9F
SHA1:	2E4436DBE18D943416A388777D05BFE5CB553DE7
SHA-256:	0D22CE9D987EFD6886A8DE66A6A678C287D29B15963B4373F73D79DDE42C9827
SHA-512:	DCEF1E0C7916C8CD08148962949A996FFC5D46B899CD82DFBCD9BB1BC614622BC8997F1E7D3C4E3D75F2DF07540A4C17F39477CFE97BA7F0BD280CDD52E06F91
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d......Y.........." .........0...............................................@.......K....`A........................................p................0...............0...!..............p............................................................................rdata..4...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-processthreads-l1-1-1.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20944
Entropy (8bit):	4.513848472591714
Encrypted:	false
SSDEEP:	192:pwQpUwzDfIeOWvhW9WYnO/VWQ4+WWXtplsxZAqnajT9CGl:pZDfIeOWvhWNUFbls/Al39Hl
MD5:	74C264CFFC09D183FCB1555B16EA7E4B
SHA1:	0B5B08CDF6E749B48254AC811CA09BA95473D47C
SHA-256:	A8E2FC077D9A7D2FAA85E1E6833047C90B22C6086487B98FC0E6A86B7BF8BF09
SHA-512:	285AFBCC39717510CED2ED096D9F77FC438268ECAA59CFF3CF167FCC538E90C73C67652046B0EE379E0507D6E346AF79D43C51A571C6DD66034F9385A73D00D1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d...%p_W.........." .........0...............................................@............`A........................................p................0...............0...!..............p............................................................................rdata..,...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-profile-l1-1-0.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20944
Entropy (8bit):	4.293598211920456
Encrypted:	false
SSDEEP:	192:dWvhW/WYnO/VWQ4SWYujPUsxZAqnajT9Cl36:dWvhWvUgMs/Al39Eq
MD5:	D6F37B232E3F2E944EBCF53A662E852F
SHA1:	C10839E941444ED79C2314F90DA34E5742F4E514
SHA-256:	5E6AD9502C8411F29BC072EFD08C4FCD09BC3367814269DEDA74A78536FB8375
SHA-512:	6E0CF1021EF3FF31895D2B6A9E72084EBE52DE4201D317B12FB8B05A7B1946FDEF65D2B046F8FB25189D3A94F70726121F2E8EAC8239C00EE02EF5EAF57F21C5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d................" .........0...............................................@............`A........................................p................0...............0...!..............p............................................................................rdata.. ...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-rtlsupport-l1-1-0.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20960
Entropy (8bit):	4.469567491280211
Encrypted:	false
SSDEEP:	192:aGeVTg6WvhWGWYnO/VWQ4SWupBd80Hy5qnajsBkt2NjY:aGeVTg6WvhWsUldslE8+Y
MD5:	6397D5CC116D884D31552F613F748556
SHA1:	B76B19FE4D3D5D26D2DEE1983D384E26D961180E
SHA-256:	40EB38D84DFD13C8A58211B8273C4B4965148742F08EB6FE8B0830392C37ABC1
SHA-512:	4449DA9BAA3F722EB274AC527125F5918A17BC94B243849A0A44F3463E35F368339A58A6AA1E08B83D54D13538C0D52BFCB452A48B8B9A52961BF136256D220E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d.....C}.........." .........0...............................................@.......T....`A........................................p...<............0...............0...!..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-string-l1-1-0.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20960
Entropy (8bit):	4.375396134710155
Encrypted:	false
SSDEEP:	192:v0yyMvJWvhW4WYnO/VWQ4SWQwwV80Hy5qnajsBkrfFIf:zyMvJWvhWmUAIslEAfFI
MD5:	D2D7458AB838E738B54FB4D6FA490BF6
SHA1:	0CFC5659B23A35C987B96CABBC0D10325316385D
SHA-256:	285A481D7BA9859CC28BEDEDD8F05A90BD648A34D66B8C797118920B40E15E4E
SHA-512:	62E0ABB2E59D360D6A066E73289AA1B880E7C1A0B7E6C695F40B1E0F2CB11DEB9E54DEBA4045D2454B911AF109EC198F11073874A8F023EB1B71A16A74354A1E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d....%fN.........." .........0...............................................@............`A........................................p................0...............0...!..............p............................................................................rdata..<...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-synch-l1-1-0.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20944
Entropy (8bit):	4.889960536352825
Encrypted:	false
SSDEEP:	384:lQMwidv3V0dfpkXc0vVaLnWvhWTULrX7aJdlGsztzO1:xHdv3VqpkXc0vVagQ2L7aJGqO1
MD5:	255B18FE8AB465C87FB8AD20D9A63AAC
SHA1:	645823B0332ADDABA5E4EF40D421B2DA432FDA5E
SHA-256:	E050E1BFBB75A278412380C912266225C3DEE15031468DAE2F6B77FF0617AA91
SHA-512:	19244B084AC811B89E0E6A77F9308D20CF4FBB77621D34EEDC19FCD5C8775A33B2D9ADA3F408CBE5806C39745B30C1C1CC25D724DB9377B437D771AE0BF440B1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d....>F..........." .........0...............................................@......Re....`A........................................p...X............0...............0...!..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-synch-l1-2-0.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20944
Entropy (8bit):	4.557349562243787
Encrypted:	false
SSDEEP:	192:ctZ3ZtIWvhW9NWYnO/VWQ4SWndusxZAqnajT9CMCz4:ctZ3wWvhW9dUds/Al39pCz4
MD5:	0A2432A420640A79FAAFF044AB054EF6
SHA1:	15688BF3C9330309EC5EA602C0AD5AF1FD68BC30
SHA-256:	9DFD114E4182662A669A3B9054DD2A24D96DD66ED96A8B2AC05601928B2084D5
SHA-512:	090D6D5046AEFE9006B319FC3F9740426BC93E50CF262CE65857449891CA69D2A235421CFEA3FB178D3F8B1E3F640B8678AA9D8F6E67B8A17985913BEBFB3FDD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d................" .........0...............................................@............`A........................................p...x............0...............0...!..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-sysinfo-l1-1-0.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20944
Entropy (8bit):	4.617444368323971
Encrypted:	false
SSDEEP:	192:UgdKIMFemVWvhWNWYnO/VWQ4mWY1tcQIj21EhqnajKsxN:JH0WvhWdUDIqslGsxN
MD5:	E1A7B1F8CDB24324D0E44B0078DB8BD1
SHA1:	B6C2FE32AE5FA1398F7AE6245C405378E32A7897
SHA-256:	45D4F1E398E4CC73FD1AAAD80219D2A9D3205A228167C819EB6787D7B01FC186
SHA-512:	144AFE1CB812DE93FBDD08658AFEB4C95480A8E504C5DCF909FF226400CA2D0F48395CF71954FBD1B3DD93A49CBA39EC0DB3FC34A05804C93FD9A48B0A1749CA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d......d.........." .........0...............................................@.......A....`A........................................p...H............0...............0...!..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-timezone-l1-1-0.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20944
Entropy (8bit):	4.549935038939539
Encrypted:	false
SSDEEP:	192:+cWvhWoWYnO/VWQ4mWRhXEKup3JdqnajKsztzy:+cWvhWWUqX7aJdlGsztzy
MD5:	CB39EEA2EF9ED3674C597D5F0667B5B4
SHA1:	C133DC6416B3346FA5B0F449D7CC6F7DBF580432
SHA-256:	1627B921934053F1F7D2A19948AEE06FAC5DB8EE8D4182E6F071718D0681F235
SHA-512:	2C65014DC045A2C1E5F52F3FEA4967D2169E4A78D41FE56617CE9A4D5B30EBF25043112917FF3D7D152744DDEF70475937AE0A7F96785F97DCEFAFE8E6F14D9C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d................" .........0...............................................@............`A........................................p...H............0...............0...!..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-core-util-l1-1-0.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20944
Entropy (8bit):	4.319450964936577
Encrypted:	false
SSDEEP:	192:MPWvhWRWYnO/VWQ4SWiIsxZAqnajT9CDH:yWvhWRUCs/Al39OH
MD5:	5B6C46F42ED6800C54EEB9D12156CE1F
SHA1:	66CE7A59B82702875D3E7F5B7CF8054D75FF495F
SHA-256:	2631CADCE7F97B9A9E6DF4E88F00F5A43EF73B070EE024ED71F0B447A387FF2F
SHA-512:	38FF6745BB5597A871B67AA53FCC8426BC2CDD16B6497A0EB7B59C21D8716F1ABB1F7C7A40A121AD1BD67B5490FEF5CF82EE8FD0BF848F27DCA27FC5D25DEC61
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d......#.........." .........0...............................................@...........`A........................................p...<............0...............0...!..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-conio-l1-1-0.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20944
Entropy (8bit):	4.6478341719136145
Encrypted:	false
SSDEEP:	192:y0WvhW3WYnO/VWQ4mW8iTH2vArqnajKsbTYk:FWvhWnUIH24rlGsbTYk
MD5:	A68D15CAB300774D2A20A986EE57F9F4
SHA1:	BB69665B3C8714D935EE63791181491B819795CB
SHA-256:	966DDBF59E1D6C2A80B8ABBF4A30D37475DE097BF13FB72BA78684D65975CD97
SHA-512:	AC040F92560631CA5162C7559173BDFE858E282225967AB1ADC0A038D34943B00DB140D44319CD2CDC2864295A098AB0BA634DFAA443E1D1782FA143AE4C217D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d...8.?;.........." .........0...............................................@......5.....`A........................................P................0...............0...!..............p............................................................................rdata..@...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-convert-l1-1-0.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	25056
Entropy (8bit):	4.647238720605179
Encrypted:	false
SSDEEP:	192:3jQ/w8u4cy1WvhWb9WYnO/VWQ4SWANsAlosytkqnaj6Md:fy1WvhWhUNsilWMd
MD5:	0E35E369165875D3A593D68324E2B162
SHA1:	6A1FF3405277250A892B79FAED01DCDC9DBF864A
SHA-256:	14694879F9C3C52FBD7DDE96BF5D67B9768B067C80D5567BE55B37262E9DBD54
SHA-512:	D496F0C38300D0EED62B26A59C57463A1444A0C77A75C463014C5791371DECA93D1D5DD0090E8E324C6A09BD9CFF328F94947272CA49018C191C12732E805EE8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d....A............" .........@...............................................P......4.....`A........................................P................@...............@...!..............p............................................................................rdata..>........ ..................@..@.data........0......................@....rsrc........@.......0..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-environment-l1-1-0.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20944
Entropy (8bit):	4.454858890873412
Encrypted:	false
SSDEEP:	192:PLGju+OXWvhW+eWYnO/VWQ4mWPiNbj21EhqnajKsxy:PLGjuJWvhWFUztqslGsxy
MD5:	DACF383A06480CA5AB70D7156AECAB43
SHA1:	9E48D096C2E81A7D979F3C6B94315671157206A1
SHA-256:	00F84C438AAB40500A2F2DF22C7A4EC147A50509C8D0CDAC6A83E4269E387478
SHA-512:	5D4146A669DDB963CF677257EC7865E2CFCB7960E41A38BBD60F9A7017474ED2F3291505FA407E25881CBF9E5E6B8055FF3BD891043284A0A04E3FE9CFAD9817
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d................." .........0...............................................@......w.....`A........................................P..."............0...............0...!..............p............................................................................rdata..r...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-filesystem-l1-1-0.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20944
Entropy (8bit):	4.950541424159939
Encrypted:	false
SSDEEP:	192:RSnWlC0i5CtWvhWJKWYnO/VWQ4SWuMasxZAqnajT9CQMDt:RSnWm5CtWvhWWUyas/Al39ODt
MD5:	D725D87A331E3073BF289D4EC85BD04D
SHA1:	C9D36103BE794A802957D0A8243B066FA22F2E43
SHA-256:	30BCF934CBCC9ED72FF364B6E352A70A9E2AFA46ECEADEA5C47183CB46CFD16E
SHA-512:	6713FF954221C5DD835C15556E5FA6B8684FA7E19CE4F527A5892E77F322B3DAE7199A232040B89AD4A9575C8D9788D771892D2294F3C18DA45E643EB25FDB08
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d......0.........." .........0...............................................@............`A........................................P................0...............0...!..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-heap-l1-1-0.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20944
Entropy (8bit):	4.591111522505104
Encrypted:	false
SSDEEP:	192:PUFY17aFBRIWvhWrWYnO/VWQ4mWCJH2vArqnajKsbTYxj:8Q1WvhWLUrH24rlGsbTY5
MD5:	9151E83B4FDFA88353B7A97AE7792678
SHA1:	B46152E70D5D3D75D61D4CCDB50403BD08BB9354
SHA-256:	6C0E0D22B65329F4948FCF36C8048A54CCCCBF6C05B330B2C1A686F3E686EED0
SHA-512:	4D4210474957E656D821E1DC5934A4BFBF7E73DD61D696A1AB39914F887810C8FBE500DBB1E23782B40807F25820F35C9665E04DCDC2FD0F6C83046A4AECB86B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d...G..d.........." .........0...............................................@............`A........................................P................0...............0...!..............p............................................................................rdata..f...........................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-locale-l1-1-0.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20944
Entropy (8bit):	4.54281367075804
Encrypted:	false
SSDEEP:	192:g8yWvhWVWYnO/VWQ4mWWeUDj21EhqnajKsxRIM9:gtWvhWFUtDqslGsxRIG
MD5:	EBC168D7D3EA7C6192935359B6327627
SHA1:	AECEB7C071CF1BB000758B6CEEBEFEEC91AD22BD
SHA-256:	C048A3D7AB951DCE1D6D3F5F497B50353F640A1787C6C65677A13C55C8E99983
SHA-512:	891D252ECD50BDED4614547758D5E301BDF8E71FBB1023FF89F8DE2F81927CC7CC84B98985D99E8FA8DCBF361E5117D9C625DC0D36983AFC3F2AA48A54CE3D48
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d....h\..........." .........0...............................................@......}.....`A........................................P...e............0...............0...!..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-math-l1-1-0.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	29144
Entropy (8bit):	4.946641263598223
Encrypted:	false
SSDEEP:	384:MQM4Oe59Ckb1hgmLJWvhWdUN8HOhlxAnY:rMq59Bb1jeanOunY
MD5:	7A235962DBAB1E807C6EC7609FC76077
SHA1:	148DDD11A0D366313F75871007057B3F0485AB33
SHA-256:	F7C5D7394643C95FE14C07773A8A206E74A28DB125F9B3976F9E1C8C599F2AF1
SHA-512:	25B21EE7BB333E5E34D2B4A32D631A50B8FFAF1F1320D47C97C2A4DFF59FA2A2703CDF30638B46C800D3150EFAA4A2518C55E7B2A3B2E4273F43DD5CA83AE940
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d...J..R.........." .........P...............................................`............`A........................................P....%...........P...............P...!..............p............................................................................rdata...&.......0..................@..@.data........@......................@....rsrc........P.......@..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-multibyte-l1-1-0.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	29136
Entropy (8bit):	4.764408242494898
Encrypted:	false
SSDEEP:	384:VA/kPLPmIHJI6/CpG3t2G3t4odXLJWvhWSUwlmX7aJdlGszti:y/kjPmIHJI6AFc7aJGT
MD5:	B3B4A0F3FCE120318E71DE3AFB6BB1AA
SHA1:	D3349409EC717F942769BA67FECA40557C1423D0
SHA-256:	A38E6786DC8EC6D2717343DBE00BB2FDDA008D87935BBD9371AE94E7E004270B
SHA-512:	4A130674DDBB05949665F6F7A070B25E82C34047D1E62EC60C73F815CED39A9041D972BE4E8C505F9B13C5BCDC114F3479BF8D69D7D9CF9987D39A6F5DB7F560
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d....T............" .........P...............................................`............`A........................................P.... ...........P...............P...!..............p............................................................................rdata..D".......0..................@..@.data........@......................@....rsrc........P.......@..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-private-l1-1-0.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	74192
Entropy (8bit):	5.1227875842071615
Encrypted:	false
SSDEEP:	1536:LLraHgDe5c4bFe2JyhcvxXWpD7d3334BkZnjPgB/P5W:baHgDe5c4bFe2JyhcvxXWpD7d3334Bkb
MD5:	7033AB91EA4F0593E4D6009D549E560F
SHA1:	4951CE111CA56994D007A9714A78CDADEEB0DACF
SHA-256:	BE7901AA1FACEA8E1FD74A62BDE54CC3BD8E898B52E76FABB70342B160989B80
SHA-512:	8BC3B880E31EBE3BC438A24D2AF249C95E320AC3C7A501027EF634F55AAB6FAC4F6D1090A00C29A44657A34EBADCD62023F2E947D31C192072698B645F8651ED
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d.....+..........." ................................................................e.....`A........................................P....................................!..............p............................................................................rdata..............................@..@.data...............................@....rsrc...............................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-process-l1-1-0.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20944
Entropy (8bit):	4.608840616484201
Encrypted:	false
SSDEEP:	192:4adyqjd7VWvhWpWYnO/VWQ4mWB8nXEKup3JdqnajKszt0CkD:4aQ0WvhWpUnX7aJdlGszt0r
MD5:	55463244172161B76546DC2DE37F42BD
SHA1:	C10A5360AD5E340D59C814E159EA1EFCBF5BF3EE
SHA-256:	4166A32551989F960DAC7C0E296FFB28092F45F6539E7C450FA04BF17612BE73
SHA-512:	EACEC78FF95F60DEF6F7F27BDA4A84F1DD2DFA386EFC4F6DA770C37268DF83C5B402693EA5C29F54D48026579F3843DB26ADD4D6448EA10CBF7F14D4D14A72FD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d....w>..........." .........0...............................................@......M.....`A........................................P...x............0...............0...!..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-runtime-l1-1-0.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	25040
Entropy (8bit):	4.795732177662406
Encrypted:	false
SSDEEP:	192:oHUW9MPrpJhhf4AN5/KiZWvhWMWYnO/VWQ4mWLz8Y5H2vArqnajKsbTYCkI:oHUZr7PWvhW6UeH24rlGsbTYCx
MD5:	27C4A3BCC0F1DBA2DE4C2242CD489F3B
SHA1:	A704FD91E3C67108B1F02FD5E9F1223C7154A9CC
SHA-256:	315DED39D9E157CEC05D83711C09858C23602857C9D8C88BEEF121C24C43BE84
SHA-512:	793E74DFB1052C06AB4C29E7B622C795CC3122A722382B103940B94E9DAC1E6CA8039DF48C558EFCC5D952A0660393AE2B11CED5ADE4DC8D5DD31A9F5BB9F807
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d...4{.+.........." .........@...............................................P............`A........................................P...4............@...............@...!..............p............................................................................rdata........... ..................@..@.data........0......................@....rsrc........@.......0..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-stdio-l1-1-0.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	25040
Entropy (8bit):	5.082770273323341
Encrypted:	false
SSDEEP:	192:DA2uWYFxEpahrWvhW/nWYnO/VWQ4mWSmRkH2vArqnajKsbTYMlBzK:DIFVhrWvhWfUERkH24rlGsbTYx
MD5:	306608A878089CB38602AF693BA0485B
SHA1:	59753556F471C5BF1DFEF46806CB02CF87590C5C
SHA-256:	3B59A50457F6B6EAA6D35E42722D4562E88BCD716BAE113BE1271EAD0FEB7AF3
SHA-512:	21B626E619AAF4EDA861A9C5EDF02133C63ADC9E893F38FEDE72D90A6E8BE0E566C117A8A24CA4BAB77928083AE4A859034417B035E8553CC7CCFB88CB4CBD9C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d...+b............" .........@...............................................P......'l....`A........................................P...a............@...............@...!..............p............................................................................rdata........... ..................@..@.data........0......................@....rsrc........@.......0..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-string-l1-1-0.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	25040
Entropy (8bit):	5.075489018611419
Encrypted:	false
SSDEEP:	768:dozmT5yguNvZ5VQgx3SbwA71IkFPaPA6XHPe:dozmT5yguNvZ5VQgx3SbwA71IAaP7XH2
MD5:	EC1381C9FDA84228441459151E7BADEA
SHA1:	DB2D37F3C04A2C2D4B6F9B3FD82C1BE091E85D2C
SHA-256:	44DDAB31C182235AC5405D31C1CBA048316CC230698E392A732AC941EC683BAD
SHA-512:	EE9EBBDC23E7C945F2B291FDE5EB68A42C11988182E6C78C0AB8FA9CB003B24910974A3291BCDAA0C8D1F9DFA8DF40293848FB9A16C4BE1425253BED0511A712
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d....w.e.........." .........@...............................................P......0.....`A........................................P................@...............@...!..............p............................................................................rdata../........ ..................@..@.data........0......................@....rsrc........@.......0..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-time-l1-1-0.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20944
Entropy (8bit):	5.000234308172749
Encrypted:	false
SSDEEP:	192:SNDKWvhW/WYnO/VWQ4mWVx2RoXEKup3JdqnajKsztg/J:RWvhWvUexqoX7aJdlGsztgx
MD5:	4CF70855444F38E1EB71F9C3CD1C6E86
SHA1:	D06AEC4008D397756EE841F0E7A435D1C05B5F07
SHA-256:	A409E25A9D3C252CC0A5AF9DF85D3733E946087B06CD1FB2CF1BF640EB0D49BA
SHA-512:	A13A80645E679343AC5638E8AA6A03012F16200CB3A4637BE52A01AA3BEF854324A8ED1882CA91B304B9C47B6351B1FC1671F4DEDE5BE77BC208A71FE6029064
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d.....p..........." .........0...............................................@............`A........................................P................0...............0...!..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\api-ms-win-crt-utility-l1-1-0.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20944
Entropy (8bit):	4.5308703760687745
Encrypted:	false
SSDEEP:	192:6PjfHQduHWvhWjWYnO/VWQ4mWEwXBXEKup3JdqnajKsztqOT+:QfxWvhWjUoXBX7aJdlGsztqx
MD5:	FCD6B29932D6FB307964B2D3F94E6B48
SHA1:	BE560F8A63C8E36A7B3FA48FF384F99F69A5D4F7
SHA-256:	CFB2EE4E426BB00B76163C1A66CF8CFEF8D7450CBF9BBCE3BC9EB2053F51E0E5
SHA-512:	3EDFCF559F1E21870277358E6D266A1A0CEA68B163B11C73108F3B6A56006D20B51410A3B4EA39BF80906BF6C9D573E1072697CFCD6A3D37E3679EA54757C69F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.....v...v...v...~...v...v...v...r...v.....v...t...v.Rich..v.................PE..d...w............." .........0...............................................@............`A........................................P...^............0...............0...!..............p............................................................................rdata..............................@..@.data........ ......................@....rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\clretwrc.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	304800
Entropy (8bit):	4.234108633116713
Encrypted:	false
SSDEEP:	3072:FJX9Xit++0PJSKtOJsgI3mwNdmLZ8mTQfsqxotv:H9xacWIfsqm
MD5:	3468E7CD6306C99931942A6B34242559
SHA1:	D7C8A15B458C52DF942B955A11B980CBB9B7F784
SHA-256:	90A5BD8EF1CE4E9363F21FE7FBAC8E57767C62B49E457A7F6C8345829C5B29FC
SHA-512:	50589B8824E89F14EFB13FF91E1847E57E0037715A21A72165F573098202CD67A472863EAA199BB8085CA4C3DF982D741A3D6FC745EDDF4AD03250555BF3E235
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........j=.E.S.E.S.E.S..~..D.S..~Q.D.S.RichE.S.PE..d...q..e.........." .........\|............................................................`.......................................................... ..xx...........~...(..............T............................................................................rdata..X...........................@..@.rsrc...xx... ...z..................@..@....q..e........l...l...l.......q..e........................q..e........l...................................RSDS..c....K.IB?........D:\a\_work\1\s\artifacts\obj\coreclr\windows.x64.Release\dlls\clretwrc\clretwrc.pdb.............................T....rdata..T........rdata$voltmd...l........rdata$zzzdbg.... .......rsrc$01.....!..hw...rsrc$02....................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\clrjit.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1436848
Entropy (8bit):	6.483765795533588
Encrypted:	false
SSDEEP:	24576:jLtbu58TIu2rlMBDr0PZYRhVj95f1L7Zr5/z/5ccUYXIBXzkTVsHgWolUZbGbqfm:jLtHAcX0PZuhVDh7ZN7/6YXIBjkBsHgT
MD5:	774A2C4D5C0BAB2ECD036634C8B0AF35
SHA1:	B67C780C5585004204CED83752EAD278EC582CCC
SHA-256:	DFA21AA945A3E907F012DC4160BB410C4B12FDD373A913B534C4CBE1D677C87B
SHA-512:	C3BE20CCD9BCCB846F2FB4FD900567C83DACC310B6A0FB2F2A0E4A0BF5CC963955173CCABAD00DDDD6B3741A8F2476F3DE5BECF3B4802F7F3C783BD35C188D84
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........OO..OO..OO..F7..CO...=..HO..OO...O...:..nO...:..AO...:..FO...:..$O...:..NO...:y.NO...:..NO..RichOO..........PE..d......e.........." .....,................................................... ............`A............................................t....................0..@........(......\|.......p....................k..(...@...8............@...............................text....*.......,.................. ..`.rdata.......@.......0..............@..@.data....<..........................@....pdata..@....0......................@..@_RDATA..............................@..@.rsrc...............................@..@.reloc..\|...........................@..B........................................................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\coreclr.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5124768
Entropy (8bit):	6.551720463907053
Encrypted:	false
SSDEEP:	49152:BRr7UBwP7cnaobhMSNMLim0GfbH6a9+Txioy4DCZ74jVs+Xh4ef4UDhrNmudZK/n:BRStMSNMLYk4oZoRAo0xk/8
MD5:	4F92DC84380E2B3A1284F83EAE60506F
SHA1:	AA38F10F73BD53B4FC603966BD8CC1628A8EA880
SHA-256:	2C8617625B8CE05A1EA7D3D678D970727B1A465CF4D2EE84C9395454B769FE31
SHA-512:	74226C64C3B997AE6E34A3D7FEDC73F7747E8D12D6A647FD2ED1440F9A3798DC1D1B37B424F160F3CB4F70872A5C352A12111C539ECB041BA98C81E40A6AE56B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......../)*.NGy.NGy.NGy.6.y.NGy`<Cx.NGy`<Fx.NGy.NFy.OGy.;Bx.NGy.;Cx.NGy.;Dx.NGyz;Dx.NGyz;IxfOGyz;Gx.NGyz;.y.NGyz;Ex.NGyRich.NGy........................PE..d......e.........." ......<...................................................O......=N...`A.........................................LI.D...$NI......`O...... K.,.....N..(...pO.Pa..p.>.p.....................?.(...p.=.8.............<......KI.`....................text....<.......<................. ..`.CLR_UEF\.....<.......<............. ..`.rdata........<.......<.............@..@.data.........I..:...NI.............@....pdata..,.... K.......I.............@..@.didat..8.....N......fL.............@...Section.......N......hL.............@..._RDATA...3... N..4...jL.............@..@.rsrc........`O.......M.............@..@.reloc..Pa...pO..b....M.............@..B................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\createdump.exe

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	57680
Entropy (8bit):	6.359671639648818
Encrypted:	false
SSDEEP:	768:rQ6XULhGj8TzwsoeZwVAsuEIBh8v61X3eQdjB/ieFT9z01Yd:5CVbTGkiWvJBieTz2Yd
MD5:	B29C6E51C59410DC30691E7EC4E7129D
SHA1:	A5A6808ED28F337AF47C13D206AF7AED16B19EEC
SHA-256:	995F078AFAC713BF5FE9F34FF5FE396C5D9183148C34D18EC26104CC8F7CE735
SHA-512:	738280AFFAEEED506CB0417C71B561FB084EDA6B3A5332487E639437A6A22E335C0391D7AFDBEA7E3AF5037FDEBCE97A0FBD73D21F23EA0B2DC238EA1D0AEC85
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l............uU.....x.....x.....x.................x.....x9.....x....Rich...........PE..d...a..e.........."......f...N......p).........@..........................................`.....................................................................P.......P)......d.......T...............................8............................................text....e.......f.................. ..`.rdata...6.......8...j..............@..@.data...............................@....pdata..P...........................@..@_RDATA..............................@..@.rsrc...............................@..@.reloc..d...........................@..B................................................................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\dbgshim.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	140560
Entropy (8bit):	6.414436929636117
Encrypted:	false
SSDEEP:	1536:tXY8Ja8dy1+iLfBcGPUZZceOiU8mJ/QQc962jqc413OUgrxkwFHxi0zj1:BLgDL+vU8mpcoOUgrxkCF9
MD5:	2CE2A97987332B07C0C794FD0FB8D791
SHA1:	55D5DBF93A39641C32981DC2F29EE17D8FB4A63C
SHA-256:	DA1AD73AE280A27E5055DB4EC05F2952F03481633D9DF8130ED22952B8E5C5E4
SHA-512:	BC6EB3C0001A9BC065665C57CCAB07311D41AE05F31F2C57150278F15B01805DFD2AFF67798962B23A6DEB4968F9906C8F62C9E5BA78C00CE318D4ED18A58D15
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........@......................+.......*.......-......./......./.t.....'......................,.....Rich............................PE..d...v..e.........." .....^..........P........................................P.......#....`A............................................(...(........0..........\|........)...@..........p.......................(... ...8............p...............................text....\.......^.................. ..`.rdata..Tx...p...z...b..............@..@.data...............................@....pdata..\|...........................@..@_RDATA....... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\hostpolicy.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	393904
Entropy (8bit):	6.313197442488823
Encrypted:	false
SSDEEP:	6144:DhSOCeu885yRJVGcteMtFxRkOmF+H8E6R8r977PRFriOc:DhSleL84RRtFxRkOrJfV+H
MD5:	BB638B8571B5A353099F6E5582652753
SHA1:	5E8DBD4E16BE920F08F376C493551413E5F43A8C
SHA-256:	90B2B5C30EBFF92B95E3BF5CBC65ACD7DCD7FCCF2C16507BCF60CE2B8CB3157D
SHA-512:	845D3615219BED70A2D1215DF524B3C18E83A4D5DF3EBCE2A02DF72EC0AAE251972573C4FAE1EE1B1C3053E484B097F3B522C76BFED49B161946CA72DF087C7F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........uxjO..9O..9O..9.a.8E..9.a.8E..9.a.8...9Fl.9]..9.f.8J..9O..9...9.a.8R..9.a.8N..9.a.9N..9.a.8N..9RichO..9........................PE..d...b..e.........." .....B...................................................@......t.....`A............................................ ........... ..........<0.......(...0..........p.......................(... ...8............`...............................text...<A.......B.................. ..`.rdata..nF...`...H...F..............@..@.data...............................@....pdata..<0.......2..................@..@_RDATA..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\mscordaccore.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1320352
Entropy (8bit):	6.372890407074511
Encrypted:	false
SSDEEP:	24576:F30cAqMN7SL3FexdwXSu+I6wnWdqv6InSITDfeZKh:FTW7SAOSXGn+qyIn7TzNh
MD5:	3143FFCFCC9818E0CD47CB9A980D2169
SHA1:	72F1932FDA377D3D71CB10F314FD946FAB2EA77A
SHA-256:	B7FB9547E4359F6C116BD0DBE36A8ED05B7A490720F5A0D9013284BE36B590B7
SHA-512:	904800D157EB010E7D17210F5797409FEA005EED46FBF209BCA454768B28F74FF3FF468EAAD2CFD3642155D4978326274331A0A4E2C701DD7017E56DDFE5424B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......oK..+..+..+.."R..!..y_.....y_..$..y_..!...X../...X.. ..+......_......_....._B...._..*..Rich+..........PE..d......e.........." .....(...................................................P.......l....`A........................................p...p............ .......`...........%...0..L...Pd..p....................f..(....d..8............@...............................text....'.......(.................. ..`.rdata..p....@.......,..............@..@.data....!...0......................@....pdata.......`.......*..............@..@_RDATA..............................@..@.rsrc........ ......................@..@.reloc..L....0......................@..B................................................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\mscordaccore_amd64_amd64_6.0.2824.12007.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1320352
Entropy (8bit):	6.372890407074511
Encrypted:	false
SSDEEP:	24576:F30cAqMN7SL3FexdwXSu+I6wnWdqv6InSITDfeZKh:FTW7SAOSXGn+qyIn7TzNh
MD5:	3143FFCFCC9818E0CD47CB9A980D2169
SHA1:	72F1932FDA377D3D71CB10F314FD946FAB2EA77A
SHA-256:	B7FB9547E4359F6C116BD0DBE36A8ED05B7A490720F5A0D9013284BE36B590B7
SHA-512:	904800D157EB010E7D17210F5797409FEA005EED46FBF209BCA454768B28F74FF3FF468EAAD2CFD3642155D4978326274331A0A4E2C701DD7017E56DDFE5424B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......oK..+..+..+.."R..!..y_.....y_..$..y_..!...X../...X.. ..+......_......_....._B...._..*..Rich+..........PE..d......e.........." .....(...................................................P.......l....`A........................................p...p............ .......`...........%...0..L...Pd..p....................f..(....d..8............@...............................text....'.......(.................. ..`.rdata..p....@.......,..............@..@.data....!...0......................@....pdata.......`.......*..............@..@_RDATA..............................@..@.rsrc........ ......................@..@.reloc..L....0......................@..B................................................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\mscordbi.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1268240
Entropy (8bit):	6.353705631552934
Encrypted:	false
SSDEEP:	12288:aZdZVIOfVMIVAeZeSuIN5R2kMfmZmogeOaypw7ZSryE0BbdIUtVL0GUix+VgFAoK:aZdZVIcj9cSuINr2JeOayeFbpo7iE8A
MD5:	21748772B86822F16B092685D5FF3122
SHA1:	5B61792411E4388A4FF290E629CDAECF6DCA041E
SHA-256:	5A13874B3D1630F509B8AB704376786D93DD9C45F652C85230E8E28ED870C223
SHA-512:	F9A293B739E0EA256123A40A3359FC49F5663902A0EDD35CC1EC5186283EC40D7A9664B119337F84ADA9E259746057DD89687AB85549A1116EC9D7C9D59B16CF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........'.jit.jit.jit...t.jit..lu.jit..mu.jit..ju.jit?.mu.jit?.hu.jit.jht#jit%.ju.jit%.`u.jit%.iu.jit%..t.jit%.ku.jitRich.jit................PE..d......e.........." .....n...........................................................8....`A.........................................n..`....p.......`..........D....4...&...p......`...p.......................(......8............................................text...5l.......n.................. ..`.rdata...............r..............@..@.data...x............t..............@....pdata..D...........................@..@_RDATA.......P......................@..@.rsrc........`......................@..@.reloc.......p......................@..B................................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\mscorlib.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	58632
Entropy (8bit):	5.651536783230316
Encrypted:	false
SSDEEP:	768:w8zO+8uP8x/A15A4HI4gJl01Qa7ICltVdDV/i4S6l9zj:hzO+8uA/A15A4o4gJq1DI+dD9i433zj
MD5:	8D8798DA9C5CDE3330CDF4637288724E
SHA1:	DE5BCBB3597C53AE8873748C7A0E0385FBCD423F
SHA-256:	6477317493B215AFDC3F1F94C08EDA501A661533F67AE5D6AD70ECC383D7917F
SHA-512:	F0C99CAACA8A07F9BAD208DAF8678489B42691076D09C419F18079B717CE4C1C6C84605DF04B4E8349B124C499594A9A41BB49093F84F8A310E1CC2D9E9522E7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.................. ........... ....................... ......Q.....`.................................l...O.......(................)..............T............................................ ............... ..H............text....... ...................... ..`.rsrc...(...........................@..@.reloc..............................@..B........................H.......P .............................................................BSJB............v4.0.30319......l...pL..#~...L..._..#Strings............#US.........#GUID...........#Blob............T.........3....................................,.....*-.........#.M...&.M.....M...M....h..)...$'....".2.....2...&.2..v$.2... .2.....2.....2...$.2..x..2...1.S.....S..5..]...$.M.................L.....L.....L..)..L..1..L..9..L..A..L..I..L..Q..L..Y..L..a..L..i..L..q..L..y..L.....L ....L.....L..

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\mscorrc.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	147216
Entropy (8bit):	3.872084410168772
Encrypted:	false
SSDEEP:	1536:LYxZms10iHvh7x8SKJlZ4vCCk7nw55IvZ4MgSZctpoEXXZigzL:LYxZ/aSKlZ4ZGnwmUS4ScVP
MD5:	BF0B53DF00207A4D8EDE3DDB85005C98
SHA1:	C4EC5873A65C65DEEBEDB292679C7CAB77EB5104
SHA-256:	FB2EAC5B06274C138699F39E3B4E863CC084417C35BAE20A4F35F43C9361C77F
SHA-512:	FE27424EAC89E6A2B873A9CF8FD1D89457350087673D151CFD74937AEAAAA228C1A77D9945BD41695974291D411CD882C15A24D1F18727A5CA03129746D66E2E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........j=.E.S.E.S.E.S..~..D.S..~Q.D.S.RichE.S.PE..d...~..e.........." .........................................................@......B.....`.......................................................... ..`................)..............T............................................................................rdata..X...........................@..@.rsrc...`.... ......................@..@....~..e........j...l...l.......~..e........................~..e........l...................................RSDSrk&s.}H.../.......D:\a\_work\1\s\artifacts\obj\coreclr\windows.x64.Release\dlls\mscorrc\mscorrc.pdb...............................T....rdata..T........rdata$voltmd...l........rdata$zzzdbg.... .......rsrc$01.....;.......rsrc$02....................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\msquic.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	517032
Entropy (8bit):	6.327188439808119
Encrypted:	false
SSDEEP:	6144:DD4t2kjj3Ueh/9WoJcDSdiA9HuUrUb9KcvYCxe3Rw42SISaVGxQJyRMq1KsLGjrT:DDrkjjUoJcDSdiw4QcO3RoS9MV
MD5:	B5D0F85E7C820DB76EF2F4535552F03C
SHA1:	91EFF42F542175A41549BC966E9B249B65743951
SHA-256:	3D6D6E7A6F4729A7A416165BEABDA8A281AFFF082EBB538DF29E8F03E1A4741C
SHA-512:	5246EBEAF84A0486FF5ADB2083F60465FC68393D50AF05D17F704D08229CE948860018CBE880C40D5700154C3E61FC735C451044F85E03D78568D60DE80752F7
Malicious:	false
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.................................................................................7...2......2......2.7....._....2......Rich............................PE..d.....Mb.........." .................E.......................................0.......H....`A........................................0y..\|....y....... ..h........>.......'... ..........T...............................8............... ............................text...z........................... ..`.rdata...{.......\|..................@..@.data...p2...........r..............@....pdata...>.......@...~..............@..@_RDATA..............................@..@.rsrc...h.... ......................@..@.reloc....... ......................@..B........................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\netstandard.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	101552
Entropy (8bit):	5.500652766817866
Encrypted:	false
SSDEEP:	1536:7iTrnaN0HjO8MZYq5V4bgDHsPdPpwSJ5L3Akcg9QjXsYCz8:iaN8qZYe4bgDUnNKTJCQ
MD5:	EC674DF7342B4E911173DA0C56B21581
SHA1:	4D08F07966A71D9992D47A93369CB2E7B7AB423C
SHA-256:	2627CBFD0F6F1C49796F94D1EF9FE878B8B88C56D2B50D0BC8F012F303AAA06A
SHA-512:	F45E4E6091555469C889D1CD82DEA505D7422E53507968A8171633936DB6CBA8FB017017B1AF41500E258DB2CCB45F45C01D800C3968A03A9813C7CAF5671946
Malicious:	true
Yara Hits:	Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\netstandard.dll, Author: Joe Security
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..Z..........6x... ........... ....................................`..................................w..O.......8............d...(...........w..T............................................ ............... ..H............text...<X... ...Z.................. ..`.rsrc...8............\..............@..@.reloc...............b..............@..B.................x......H.......P ..DV...................v......................................BSJB............v4.0.30319......l.......#~..,.......#Strings.....R......#US..R......#GUID....R..P...#Blob............T.........3................................U...(......H.........5....;....'8.........., A...7.J..P4U..5#U...:U..n7U..&1U....U.../U..(7U...(U...T-..../-...i&....7................./...../...../...)./...1./...9./...A./...I./...Q./...Y./...a./...i./...q./...y./...../. .../...../...

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.NETCore.App\6.0.28\ucrtbase.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1122768
Entropy (8bit):	6.6466118295886165
Encrypted:	false
SSDEEP:	24576:CJG2BrB3ZQAq0AT2jS9HKHdK6AccMs1wmxvSZX0ypFi:0VGrT6SAk3ei
MD5:	3B337C2D41069B0A1E43E30F891C3813
SHA1:	EBEE2827B5CB153CBBB51C9718DA1549FA80FC5C
SHA-256:	C04DAEBA7E7C4B711D33993AB4C51A2E087F98F4211AEA0DCB3A216656BA0AB7
SHA-512:	FDB3012A71221447B35757ED2BDCA6ED1F8833B2F81D03AABEBD2CD7780A33A9C3D816535D03C5C3EDD5AAF11D91156842B380E2A63135E3C7F87193AD211499
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........T...:K..:K..:K..K..:K..;K..:KK..K..:KK.:J..:KK.9J..:KK.?J..:KK.>J.:KK.4J..:KK..K..:KK.8J..:KRich..:K........PE..d................" .....0..........0^...............................................N....`A................................................................. ...........!...... .......p............................Z..8..............(............................text...X .......0.................. ..`.rdata......@.......@..............@..@.data....&....... ..................@....pdata....... ......................@..@.rsrc...............................@..@.reloc.. ...........................@..B................................................................................................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\Accessibility.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21264
Entropy (8bit):	6.55781631435111
Encrypted:	false
SSDEEP:	384:UBmy0h6gSGRqOcHiLW2f/W8Tb2HRN7vs6cTR9zu1:pS1OcH4X/ivsnV9zY
MD5:	0F55ECB5829C6F0F6D1B0C533A7A7072
SHA1:	6B25EEEE0FD69CAC566C79089750F5F2C6E8B3AF
SHA-256:	E30574CF3B5FC9BD267A42F736523775A2A21A2BB50A5C5FE5C1CC6C11CF119D
SHA-512:	5D0947745EEDC7A1004A8B827D3DAF1F8707AAE730EBA208F3E8432E31E04BECE6A03BDF28B6D85257FE402DDD3EFDF71A3D291BAF350F4818602AF0C4CAE428
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Q.e...........!..... ...........?... ...@....... ....................................@..................................>..O....@...............*...)...`....................................................... ............... ..H............text........ ... .................. ..`.rsrc........@......."..............@..@.reloc.......`.......(..............@..B.................>......H........ ......................P ......................................Q.g_.]E.4k.J:..&n.k.....Au.$...m.Iu....._..X....P..."".s.=.2Pu-...Y...3.>.I}m.7...GWQ.^.......U. F....N.aV`.....t.%....e.6CBSJB............v4.0.30319......l...,...#~..........#Strings............#US. .......#GUID...0.......#Blob...........W.........%3........!...........7...................t...3..................................... ...............^.?...y.r...........?...............-.....D.....d.....

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\D3DCompiler_47_cor3.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4916728
Entropy (8bit):	6.398031738914566
Encrypted:	false
SSDEEP:	49152:hCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRN1:oG2QCwmHjnog/pzHAo/Ayc
MD5:	A7B7470C347F84365FFE1B2072B4F95C
SHA1:	57A96F6FB326BA65B7F7016242132B3F9464C7A3
SHA-256:	AF7B99BE1B8770C0E4D18E43B04E81D11BDEB667FA6B07ADE7A88F4C5676BF9A
SHA-512:	83391A219631F750499FD9642D59EC80FB377C378997B302D10762E83325551BB97C1086B181FFF0521B1CA933E518EAB71A44A3578A23691F215EBB1DCE463D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........\|3..]...]...]..e\...]...\.5.]..e...]..wX...]..wY...]..e^...]..eX.y.]..eY...]..e]...]..eU./.]..e....]..e_...].Rich..].................PE..d.....Ne.........." ......8..........<).......................................K......JK...`A........................................`%G.x....(G.P.....J.@.....H.......J..%....J.....p.D.p....................S<.(...pR<.@............S<.(............................text.....8.......8................. ..`.rdata...F....8..P....8.............@..@.data...`....@G......@G.............@....pdata........H......@H.............@..@.rsrc...@.....J......@J.............@..@.reloc........J......PJ.............@..B........................................................................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\DirectWriteForwarder.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	524976
Entropy (8bit):	6.877666682529178
Encrypted:	false
SSDEEP:	12288:nBEcmMNPavXwNWxrIvmrQfvfC0lqBk6+9+T:B6MNPW3mOrifLqC6p
MD5:	C84602C46CBFF601D2055E52864A63B3
SHA1:	21FCC9BB06112C479838D62DB80FCF8031A17D3A
SHA-256:	505F5CAD269EECBC070E5C07740BFAAA1267587B7BA02C426E2910FA6CC5FBA5
SHA-512:	FDA38C35CF39BEA4CAF074C3A0CC995E1AF129431318DEE30EDC184FBE86C9EE2305D9C0AD7C8EA4F84F05765BB47DB0372D50F329CE58E537F3B96358F37A2A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....k.e.........." .........,.......................................................`....`...@......@............... ..................................$... k...*.......(..........@&..............................................................(...H............text............................... ..`.data....&.......(..................@....reloc..............................@..B.................... .......8.......................P.......................h.....................................................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................b.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...>.....0.4.0.9.0.4.b.0...R.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....D.i.r.e.c.t.W.r.i.t.e.F.o.r.w.a.r.d.e.r.......A...F.i.l.e.V.e.r.s.i.o.n.....6.,.0.,.2.8.2.4.,.1.2.0.0.2. .@.C.o.m.m.i.t.:. .4.b.b.3.a.1.d.8.e.c.3.7.e.d.a.5.2.1.b.b.f.9.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\Microsoft.VisualBasic.Forms.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	243360
Entropy (8bit):	6.569784522481297
Encrypted:	false
SSDEEP:	3072:+BJ+u+NYp6ODBOoFgzoPB6sS/D0fJGel+zXYZbDmvTb2KO9G2WZreMrO7bgI/58a:L2p6ZoEABcooel+SbDm2LlW1RyQ2
MD5:	34B105A77E9FCD20CECD8BA94CF5E001
SHA1:	D63A6D1FCDAA918B6CC3245D010DF940FA2B1B3B
SHA-256:	E6EBAD2F8C1F82035F6C14922944B2A98BE8DA80446DE8ED445A69A2520F04F2
SHA-512:	C260B2C7E20EC66D01B3BD756B36DE12860241F830FD907C92127014603D927D39A6E7CE8B769B51F5BDB2271B7B77118AE9B196B3DDC710C5A55634BE8BA55E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....B............" .........^......................................................=.....`...@......@............... .......................................[...........(......X....#..p...............................................................H............text....-.......................... ..`.data....T...@...V...0..............@....reloc..X...........................@..B............................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...P.....C.o.m.m.e.n.t.s...M.i.c.r.o.s.o.f.t...V.i.s.u.a.l.B.a.s.i.c...F.o.r.m.s...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...`.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\Microsoft.VisualBasic.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	19104
Entropy (8bit):	6.514788417568709
Encrypted:	false
SSDEEP:	384:SWUP0hxLfGM3FxWmH6o9QdWhTb2HRN7d5V/6fR9zcj5:GsleM3tF/iW9zA
MD5:	74B8CFE06D56410C9B740F9CEDA76A26
SHA1:	502DD39E851D02AAA4A849354EED449CF0DBBD3B
SHA-256:	C9EA31B213B8C0BF21CBA3D988FCE9091DB961814085FF0C9C8E76FD0E78470A
SHA-512:	EBF28E2BC159BC1AC1A5FE3AFC7EE863748967E039A1E27AB1EC3267A6DF509BA863B0AB01AB922DC145C900606D55B694F85DA551651A8822AD61B3EA065099
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....v............" ..0..............7... ...@....... ...............................s....`..................................6..O....@..............."...(...`...... 6..8............................................ ............... ..H............text... .... ...................... ..`.rsrc........@......................@..@.reloc.......`....... ..............@..B.................6......H.......P ..P....................5......................................BSJB............v4.0.30319......l...(...#~......P...#Strings............#US.........#GUID.......X...#Blob......................3................................w.....X...........z...v.z.....................].....v.................3.....P.................,.....a....... ...........................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y.........................#.....+.-...3.H...;.U...C.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\Microsoft.Win32.Registry.AccessControl.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	26888
Entropy (8bit):	6.543439986512364
Encrypted:	false
SSDEEP:	384:f3WFl2rW/M0XZ7VHxQdT6pNFeZFonnI3Cq1Tb2HRN77jpR9zziF:fxYzJ7xxSTiCZinI71/i7jD9zi
MD5:	96E5C4B6F79276A11FCCA7B6A983FD09
SHA1:	E39EF463230998E513C36291A012285EDEB5ABAD
SHA-256:	593E7D1DC9238CED37397260FBFD3BD8C65CBC3689E8585B8DF04BB58B21FA8D
SHA-512:	5299F31612C313ACA4CE5BA7E66F7370B565BF576BEC47AD2590CFB85FA1C81B95BBAE8548078A8C82D1428CD96AB22309C4DEE3F5CE2D3DAB9C48B40C4B5F17
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d................." .....8...................................................p.......+....`...@......@............... ......................................\|........@...)...`..@.......p...............................................................H............text...\7.......8.................. ..`.data...:....P.......:..............@....reloc..@....`.......>..............@..B............................................0...........................H.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0.....n...C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\Microsoft.Win32.SystemEvents.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	87312
Entropy (8bit):	6.549369983785718
Encrypted:	false
SSDEEP:	1536:HJvBZ6xKUembHsRN5Soun+oGUbsrGpXSb2tioTzG:HhKmKHsHBufMGpXN7Ta
MD5:	14BE94161E109E99E680E170967F2057
SHA1:	F0C3A8163360CAB6A3F8C113C573EDA8E632E977
SHA-256:	B423BC774541EDDB79B2006BC2024E7ABCC0EB2EDFD2814E3E575B6AABBD4D1E
SHA-512:	A4D76B9C8D0C491CF41EB8DB6A01074B54789FE7223CC7499AC38A8EBCF9B26596CE34089F9389133190EC2E93A03A19BCF3F5E2BFBF494B62B2DC3A37DC1A0E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...K............" .........................................................`......7.....`...@......@............... ..................................,....).......,...)...P..L...0...p...........................................................0...H............text............................... ..`.data........0......................@....reloc..L....P.......*..............@..B............................................0.............................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........4.....S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0.........C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\Microsoft.WindowsDesktop.App.deps.json

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	31122
Entropy (8bit):	4.2475955303344595
Encrypted:	false
SSDEEP:	384:+TV7VQJilprFKIXMmXMkXM3n8qXILHchS+hX2eSs9Xw67nTxqOB01nEE7D/NG61u:+T5VjFKzN/M14hBhX2e5K9mPlF5
MD5:	36C6C8FB7242A828647DDEBE3AC6DFE4
SHA1:	BAEA3660970721095C0549190C72E6EFDB6998AC
SHA-256:	B1785E02E722CE37EDD0C18E37BA1A411D030C99D54A556890F01AF8BA398409
SHA-512:	426BBF590005911808A71EEE5E5C0634546AAFFBE95CAA4831CA1599238F9861BAAB96B1A660E57A3EF770E5A135E38A279A7188267C79AD83BA7619D9FAD0EA
Malicious:	false
Preview:	{.. "runtimeTarget": {.. "name": ".NETCoreApp,Version=v6.0/win-x64",.. "signature": "".. },.. "compilationOptions": {},.. "targets": {.. ".NETCoreApp,Version=v6.0": {},.. ".NETCoreApp,Version=v6.0/win-x64": {.. "Microsoft.WindowsDesktop.App.Runtime.win-x64/6.0.28": {.. "runtime": {.. "System.Diagnostics.EventLog.Messages.dll": {.. "assemblyVersion": "6.0.0.0",.. "fileVersion": "0.0.0.0".. },.. "Accessibility.dll": {.. "assemblyVersion": "4.0.0.0",.. "fileVersion": "6.0.2824.12004".. },.. "Microsoft.VisualBasic.dll": {.. "assemblyVersion": "10.1.0.0",.. "fileVersion": "6.0.2824.12004".. },.. "System.Design.dll": {.. "assemblyVersion": "6.0.2.0",.. "fileVersion": "6.0.2824.12004".. },.. "System.Drawing.Design.dll": {.. "assemblyVersion": "6.0.2.0",.. "fileVersion": "6.0.28

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\Microsoft.WindowsDesktop.App.runtimeconfig.json

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	4.65930434594071
Encrypted:	false
SSDEEP:	6:3Hp/hdNyhAkv3Oqo/XCkyFNOJeZS12ZeQ6NOCUo+K8EkNTy:dFkv3OqJ5MeU1Ohex+K8Es2
MD5:	9B02A2A9F1859FFF4CBAA263ACBF3304
SHA1:	B8AB9373D2214B78CE5003ADA2B351C0CFDE148B
SHA-256:	33FA9034B259DC353E9D07973FF55984688B11E68377D48431093DD412F14D8C
SHA-512:	3292BC83BA19E05248916A332B5EB3F2ECB1B9DA3F1D4D7B3491743A3122538E703760957720E9BC16C10097D7C74319AA1CCAB7C71BF6062CC51210DFD98A32
Malicious:	false
Preview:	{.. "runtimeOptions": {.. "tfm": "net6.0",.. "rollForward": "LatestPatch",.. "framework": {.. "name": "Microsoft.NETCore.App",.. "version": "6.0.28".. },.. "configProperties": {.. "System.Reflection.Metadata.MetadataUpdater.IsSupported": false.. }.. }..}

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\PenImc_cor3.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	162056
Entropy (8bit):	6.203378913848965
Encrypted:	false
SSDEEP:	3072:EzAUq2kMBlUb8BQNBzDUw7aaHSuEmM+PuoATZ+AiRvUY42tXQ:EzHkMTvmNtDUw2huEmb2LbYvHQ
MD5:	48CAD7A6BEE621AAE486202BBEC314FD
SHA1:	EDF5987FD4B44124995656CA9A5FC7D4FEBBFAF9
SHA-256:	CBBA5D94849DC64FB3D3A18111D6DE7140A88E1773893C8282FCF7FBD602656E
SHA-512:	30621EA55149928EFA8E61F662E6AF23645F0F924DB1993675134A212FE86B469122C2DF4E86CAE07059B82A5BA2F9FFFEE07B1A9BA5D5406483F1982133FD38
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........9d.pW7.pW7.pW7...7.pW7.pW7.pW7h.R6.pW7h.S6.pW7h.T6.pW7..S6.pW7..V6.pW7.pV7.pW7.._6.pW7..W6.pW7..7.pW7.p.7.pW7..U6.pW7Rich.pW7........PE..d....k.e.........." ...'.V...........2..............................................t.....`A.........................................................p.. -...@.......P...)......0.......p.......................(...p...@...............h............................text....S.......T.................. ..`.orpc........p.......X.............. ..`.rdata..............Z..............@..@.data........ ......................@....pdata.......@......................@..@_RDATA.......`......................@..@.rsrc... -...p......................@..@.reloc..0............J..............@..B........................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\PresentationCore.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	8665248
Entropy (8bit):	6.779821728682111
Encrypted:	false
SSDEEP:	98304:dhGR8C+zcurHdO0ejqCCrST8AmUzSjMBdEJBY:PGRUrk0ejyr+7mUWjwdEJW
MD5:	7A8325C4DC0E28389B5D3C339A164C30
SHA1:	7E4406EEAE544599CE927A7752C1C5FD6B33A6EA
SHA-256:	485765F4576315FFF7FD99DDF93937B599A00C00B9DD85B7600B7D7CD7BEE08F
SHA-512:	56B23F4F5C91A6E231BDF66669CAF0C31F5E27D794F35DB72A073297F507D6D7953D1D8795DA78FB55D3CC656BD8B0E7BD21CC186105AB331A0328A35DBFA86E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...!['..........." ......}..N............................................... .......B....`...@......@............... ..................................P...@...8........(.......~...i..T...........................................................P...H............text...2.}.......}................. ..`.data.........}.......}.............@....reloc...~..........................@..B............................................0.......................@.....4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n.........X.....S.t.r.i.n.g.F.i.l.e.I.n.f.o...4.....0.0.0.0.0.4.b.0...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...J.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....P.r.e.s.e.n.t.a.t.i.o.n.C.o.r.e.....>.....F.i.l.e.V.e.r.s.i.o.n.....6...0...2.8.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\Microsoft.VisualBasic.Forms.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	25776
Entropy (8bit):	6.344873817525461
Encrypted:	false
SSDEEP:	384:Py6YXSXRaRgGYXdXxa3HNDQuEFX2h3DhT3HvCNsz2aWYHn4hQ5WZ5kHRN7QQHR9s:Py6jG7tEpsX76yewQm9zmkq
MD5:	2F53396891B9E8F4819692DF145D3539
SHA1:	96362BFB348D6CDD501BEC1D8BAF92A2023D7586
SHA-256:	563D9C25E54BFEC1937739DB60752CF45AA1F4C5527372F09F4DA967C745B377
SHA-512:	46EB4EEB22E21939B4446B85DD61F6DC00DD689763B802FA1E9B3C6138A3A218CD015CF7B0377296FF79740297912D3CF926EED7119EBD4C745E37BC83D61234
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0..2...........P... ...`....... ...................................@.................................<P..O....`...............<...(.......... P............................................... ............... ..H............text....0... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............:..............@..B................pP......H.......P ..(...........x&..()...O......................................BSJB............v4.0.30319......l...\...#~......x...#Strings....@.......#US.D.......#GUID...T.......#Blob......................3....................................../.......................q...f.......Y.....Y.....Y...D.Y...a.Y.....Y...-.Y.................k.....k.....k...).k...1.k...9.k...A.k...I.k...Q.k...Y.k.......................#.....+.....3.@...;.a...C.u...K.....S.@...................@...............

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\PresentationCore.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	108808
Entropy (8bit):	5.558792458664072
Encrypted:	false
SSDEEP:	3072:2l1iZdK2xPb47PG3vvyf7okbqva3DOn3u:a1i22xT47PG3vvyf7o4i6q+
MD5:	E847545F5B0C5479CB8B4F7781CD2DB6
SHA1:	8E8DE80DEB8321CB65A337E9AFD3D89D8A293FF9
SHA-256:	FEF2C3661653B6C1F2A27713F2C16EA6DBA5FD37977B6E1D7A5E85AF9043AF48
SHA-512:	FC9F7FEB65D94FEC7E5688F8E9301971E6C529DCAA9CC353DEC47D8676C15214761CF7DE17A6B0196ADED4782B3CC6048C14ADD4408F65C84C14353CC091D66A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....!@..........." ..0..v..........N.... ........... ....................................@.....................................O.......\|................)........................................................... ............... ..H............text...Tt... ...v.................. ..`.rsrc...\|............x..............@..@.reloc...............~..............@..B................0.......H.......P ..8............%...m..`.......................................BSJB............v4.0.30319......l...0...#~..........#Strings....p.......#US.t.......#GUID...........#Blob......................3..................................................\.....\.....I...........1.....1...D.1...a.1.....1...-.1.................C.....C.....C...).C...1.C...9.C...A.C...I.C...Q.C.......................#.....+.....3.@...;.T...C.....K.....................\|.Y...............................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\PresentationFramework.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	197392
Entropy (8bit):	5.435195840653667
Encrypted:	false
SSDEEP:	3072:a0ZbHPmNMzn4KIr62w7irW9gmOlkOVujQi1oDdJQmRagCRvZe8tSwv0T8b7y:DTROlkOVujQi1oDlbeZeJr
MD5:	E7488D4F284082FB50CE3D59BE7EC3A6
SHA1:	040E53FD0E49C1AFE88D9294FFF4FD483439C6F7
SHA-256:	B71078212178C175224CEB61CE2B0F8EEC58DAAC891F5795B1DDE099577ACEF3
SHA-512:	B9FC5EC4F0A6DAE671BC410D1DC3376C1F57121B65A0C048C2F1BF46D03F4023A83AB99F57D5AFD0F00020E578B4181F7CDCFA628B36B39160364D39C1FBE0B7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...21............" ..0.................. ........... .......................@......~.....@.................................@...O........................)... ......$................................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B................t.......H.......P ..L............%..............................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................a.....a.....N...........6.....6...D.6...a.6.....6...-.6.................H.....H.....H...).H...1.H...9.H...A.H...I.H...Q.H.......................#.....+.....3.@...;.T...C.....K.......................^...............................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\PresentationUI.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	45832
Entropy (8bit):	5.792662959550018
Encrypted:	false
SSDEEP:	768:1Qh+UU5rEkDGt95ZHI7Q+COorA23FgdAbyJsZTd7miF4NORagVLA9O3n/itF9z6:q7U5rEkfk+COorA23FuAbyJsZTd7mEaI
MD5:	BCAE3F42651A29B3C96A3DE586499EC3
SHA1:	8833F4DC40B4105D8E686028CFA94A9E34D9EA35
SHA-256:	6F4B63EAEC91BA5D221204D7FCE81F5B628A96A03A7D482DA0F48A65FE3AF49E
SHA-512:	C791A558694BF8168F04C844F20F444D3E503846119714A8DC5C7DE9F42697513ECEEE6F4192DAA52B8903011BA87C42EB3A7B4A970514DE6BA38B177A1D24AB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....9..........." ..0.............>.... ........... ..............................kl....@....................................O.......l................).......................................................... ............... ..H............text...D~... ...................... ..`.rsrc...l...........................@..@.reloc..............................@..B................ .......H.......P ..0............%...w..P.......................................BSJB............v4.0.30319......l...0...#~..........#Strings....l.......#US.p.......#GUID...........#Blob......................3..................................................Z.....Z.....G.........../...../...D./...a./...../...-./.................A.....A.....A...).A...1.A...9.A...A.A...I.A...Q.A.......................#.....+.....3.@...;.T...C.....K.....................z.W...............................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\ReachFramework.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	39200
Entropy (8bit):	5.904566039205823
Encrypted:	false
SSDEEP:	768:ih+SzmZ9ewDSc2PpTzggPY2hn3sK3jjRsODMhlOLYIfUVrRGKUPGm4hFf7YrT+C5:aFzmZ9ewDScDyciF29Hazr
MD5:	91500FB1FC6FFC1A1956C4484E4C2AA3
SHA1:	B326389F967D90B1AFDC7BC4AC91C77E09E610D3
SHA-256:	3C00B1422E52BD8889B36B4F1974F50CB29594B07A1DE1786325601A01F61A56
SHA-512:	0E5E8AB4AC59FD9A2B553690AF4C26DFDE2954BFBB7F8622CC7C13F3163381772B11532D5E7BD0F197507EAFF60B2919A00656669A73E9123BE43C6263107A45
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....:............" ..0..f..........F.... ........... ..............................$z....@....................................O.......l............p.. ).......................................................... ............... ..H............text...Ld... ...f.................. ..`.rsrc...l............h..............@..@.reloc...............n..............@..B................(.......H.......P ..X............%...]..X.......................................BSJB............v4.0.30319......l...<...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................Z.....Z.....G.........../...../...D./...a./...../...-./.................A.....A.....A...).A...1.A...9.A...A.A...I.A...Q.A.......................#.....+.....3.@...;.T...C.....K.....................z.W...............................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\System.Windows.Controls.Ribbon.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18608
Entropy (8bit):	6.575766790999198
Encrypted:	false
SSDEEP:	192:rDRzQ+7n8yzrEoEW1IneWGVL3WT56Os1HnhWgN7aIWfzqowcLK+X01k9z3ATKKS2:Xh5hznPWGVa5kHRN78e6R9zApS2
MD5:	9F3962947D19ED512FD7B3CCCC041BA0
SHA1:	943B937695C0892DFD565B9FAB0A0746DA935B39
SHA-256:	9B605C9F2CF25E4450C7CF70B9721B1E87CCF3EFBBAA52268057B42C556CB7F7
SHA-512:	37155607FB616D334EBBCCEF4B9CEA39A7F5F9D33A439EBCCB1117917FF03D0026F07C96D0D16452AB5A88EA103B4CEABCBC84656BD67D79AB72319CB4FFCB0C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...+6............" ..0..............5... ...@....... ....................................@..................................4..O....@............... ...(...`.......4............................................... ............... ..H............text...$.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................5......H.......P ..............0%......04......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID.......0...#Blob......................3..................................................j.....j.....W...........?.....?...D.?...a.?.....?...-.?.................Q.....Q.....Q...).Q...1.Q...9.Q...A.Q...I.Q...Q.Q......./.....8.....W...#.`...+.{...3.....;.....C.....K.......................g...............................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\System.Windows.Forms.Design.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	142600
Entropy (8bit):	5.531872471263953
Encrypted:	false
SSDEEP:	3072:BKR9MtbGzbtyHZ/I11DKdwWorcP4IVCcPU9yn8ZCeLo98bB2Y3eRhwvMhAUlEL3M:BZEL3eAVR6Ne3nzdeU8
MD5:	A89B64A01282317C294CED398C97C08E
SHA1:	EB692C8D60128424A97FA4C9F03F08E06459B8E5
SHA-256:	CA88710954106CB4C4F9210D6096B1234EEB7DF657132430165A83887E278B56
SHA-512:	891D27B15D12243295F55A7B575D59F9EBDFC99E107A5B1D04AB60FD941B0BDFB879D0A78C503A0116973BD0FFCDA25D9E0D07D9C82D94580ADB16B7DE645742
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....6..........." ..0.............b.... ... ....... .......................`......lR....@.....................................O.... ...................)...@....................................................... ............... ..H............text...h.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................D.......H.......P ..T............'......t.......................................BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID.......D...#Blob......................3....................................../.......................q...........Y.....Y.....Y...D.Y...a.Y.....Y...-.Y.................k.....k.....k...).k...1.k...9.k...A.k...I.k...Q.k...Y.k......./.....8.....W...#.`...+.{...3.....;.....C.....K.+...S.....................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\System.Windows.Forms.Primitives.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15520
Entropy (8bit):	6.771617005071524
Encrypted:	false
SSDEEP:	192:Sg34WuQiWrySuWXebPpUNTQHnhWgN7awWIy4OhyrBm+0U8X01k9z3AYLjEhzHk:934WuQiWRTb2HRN7PximBmo8R9zbcVk
MD5:	C72AC1F0389C3F74F45D73D9F5446C8C
SHA1:	55764ECC0AAF904483362D070C1EC259A492B338
SHA-256:	3C83C55A3B3FFA1CC1FA49EE8676B8272F4251E94031FDC65D97BAD1575A4E3E
SHA-512:	65F7682940FABAFBA479683D966FB68C02663017A51D72A29D39C416EB78C56C3FFA8C5ACA3BA7B646022B8A47FC2E4EF1EFB060FA778E73D78EC454C5AEC32C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...%It..........." ..0.............^)... ...@....... ..............................E.....@..................................)..O....@..$................(...`.......(............................................... ............... ..H............text...d.... ...................... ..`.rsrc...$....@......................@..@.reloc.......`......................@..B................@)......H.......P ..(...........x%......p(......................................BSJB............v4.0.30319......l...D...#~..........#Strings............#US.........#GUID.......H...#Blob......................3....................................../.......................u...........].....].....]...D.]...a.].....]...-.].................o.....o.....o...).o...1.o...9.o...A.o...I.o...Q.o...Y.o......./.....8.....W...#.`...+.{...3.....;.....C.....K./...S.....................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\System.Windows.Forms.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	359088
Entropy (8bit):	5.389484825049395
Encrypted:	false
SSDEEP:	6144:893jF6Lh0dj5lBWZ48i2sj0ReraGwYXPixp8cKgPRXl0Y9rniVTSqAv:8xSbAY8JgPRXl0Y9hv
MD5:	3101603DBCE642C6323CCCA6D65E57FA
SHA1:	022C5DE4F8F339B728DE6897FB172B402DA50FDA
SHA-256:	34C36EF23583089A0CF947FDE4A9CBA9DAB708E7CBD7D6012B75DD9B65BC151A
SHA-512:	3A1C587DEC7DC8E7C10E7E72293E8CA1403A548DDBB2BCC75275AE210E3834F74732F992FD3BA4C2CC137AD9430DDDD6C632FB08B2E547F9120BFB08279C50CA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..H...........g... ........... ....................................@.................................xg..O....................R...(..........\g............................................... ............... ..H............text....G... ...H.................. ..`.rsrc................J..............@..@.reloc...............P..............@..B.................g......H.......P ..d............%..(A...f......................................BSJB............v4.0.30319......l...\...#~......L...#Strings............#US.........#GUID...(...<...#Blob......................3....................................../...........}.....}.....j...:.......R.....R.....R...D.R...a.R.....R...-.R.................d.....d.....d...).d...1.d...9.d...A.d...I.d...Q.d...Y.d......./.....8.....W...#.`...+.{...3.....;.....C.....K.$...S.......................z.............

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\System.Windows.Input.Manipulations.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16544
Entropy (8bit):	6.683511154304881
Encrypted:	false
SSDEEP:	192:E4YIbsX+tJ4EjCH99ojs66fWWZkuWXebPpUNTQHnhWgN7aIWbNBapbTseUfX01ke:POmGyVoWWZkTb2HRN7aw/6fR9zcagv
MD5:	BA24106AEAE48349AFDEE6AF448E3A8D
SHA1:	AF4D7CC33556A8E5E523C62D946F72DBF0B0081C
SHA-256:	38E6C1F669BBBD8544A6A510C01305A086BD41C1C3FA01EA434D3D2749CC4A55
SHA-512:	C5BE884E5B81A17B690BA3D3F3F6BFE219FA45C43BB4D4B36AA2E61B9E3DF0F925600B12D37E0CEF2162D553E5D3EA5CFB6F0A7AE72422E8ABFF5342B3C6E4E1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..............." ..0..............,... ...@....... ...............................k....@..................................,..O....@...................(...`.......,............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................,......H.......P ..............@%.......,......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID.......4...#Blob......................3..................................................n.....n.....[...........C.....C...D.C...a.C.....C...-.C.................U.....U.....U...).U...1.U...9.U...A.U...I.U...Q.U......./.....8.....W...#.`...+.{...3.....;.....C.....K.......................k...............................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\System.Xaml.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	65184
Entropy (8bit):	5.832536546968813
Encrypted:	false
SSDEEP:	768:5oOCK7e4VKEoT/pba9wcfRm+3l1fF/gD/F4oGiYspNqHMK/xExeCh4o6Nx+tVx0g:7ljVKK3fFC/4i3p6xV8ws/7Wi5mVzzFm
MD5:	C642D8A08DCA0238404276788D0F2462
SHA1:	2092839C5511F77ABFF1AF841C5A467C9F08E847
SHA-256:	D58EAA3347F803A299DBDF12F93B44126A77014664804258D5AFB25A6DA25A09
SHA-512:	C3803A94981F50C234843ACA01E15D2EEE35ACA4373C71C7D7ECC8E6B1E8A710AC315B539B887AA4449F0DFFB4CBE64688F1DDCEE03AEC967637752860E6C92E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...H............." ..0.................. ........... .......................@............@.....................................O.......L................(... ....................................................... ............... ..H............text........ ...................... ..`.rsrc...L...........................@..@.reloc....... ......................@..B........................H.......P ...............$..8...........................................BSJB............v4.0.30319......l...0...#~..........#Strings....`.......#US.d.......#GUID...t.......#Blob......................3..................................................W.....W.....D...........,.....,...D.,...a.,.....,...-.,.................>.....>.....>...).>...1.>...9.>...A.>...I.>...Q.>......./.....8.....W...#.`...+.{...3.....;.....C.....K.....................w.T...............................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\UIAutomationClient.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20232
Entropy (8bit):	6.541981321403289
Encrypted:	false
SSDEEP:	384:qUG1fl/3YTo9rbJTTHWWwJIWWSJd+Tb2HRN7/eMR9z8cU0gsV/:qUG1l/3c0TbWWfc+/i/h9zk0dF
MD5:	BB3A3FF0A385E326B8A55BFD09B25E96
SHA1:	016214734B22CF43E2C94037D6F352709E7C1FCB
SHA-256:	1A25688748623EFC48A885924B484BEBFD08FC4A3DCA4A1E7652BD8F3E4D85CD
SHA-512:	9D0B24EC340E66BEA93DE44B42990475AD7954388A48F0DCE591C83AF287D4C7884F76603DBC05D1830C98AB26ADAA11C781364B993BDB4E2C857A4052240385
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..............:... ...@....... ...................................@..................................:..O....@...............&...)...`......h:............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B.................:......H.......P ..@............%..X....9......................................BSJB............v4.0.30319......l...0...#~..........#Strings....x.......#US.\|.......#GUID...........#Blob......................3..................................................^.....^.....K...........3.....3...D.3...a.3.....3...-.3.................E.....E.....E...).E...1.E...9.E...A.E...I.E...Q.E.......................#.....+.....3.@...;.T...C.....K.......................[.............................~.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\UIAutomationClientSideProviders.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21152
Entropy (8bit):	6.356455710528298
Encrypted:	false
SSDEEP:	384:tNAMEXIoYk1fkvFAw1WOCbTb2HRN7rBmo8R9zbcmH:PAMExYk1fkNANb/i9moQ9zYq
MD5:	E61A19BE30DA19C2A3346B06437F836F
SHA1:	528D0A631F97B01AC7BC7DE2792A68866CD51B03
SHA-256:	5FA6B84900F4597CEDD1FD2DF0D4D036C3F78884A3C1986C1805A320ADDF05A3
SHA-512:	0602ED0B668E8BBF94FF3A8A15D00D63AF9F1DCF38179D9F4B836433013AA252C7B7AD461541618F4E7411CD43A4795031E699412FA4604FBF2FA73C17BEB4C0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....."..........." ..0.. ...........>... ...@....... ..............................\.....@.................................D>..O....@...............*...(...`......(>............................................... ............... ..H............text........ ... .................. ..`.rsrc........@......."..............@..@.reloc.......`.......(..............@..B................x>......H.......P ..............0%..x....=......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID.......0...#Blob......................3..................................................k.....k.....X...........@.....@...D.@...a.@.....@...-.@.................R.....R.....R...).R...1.R...9.R...A.R...I.R...Q.R......./.....8.....W...#.`...+.{...3.....;.....C.....K.......................h...............................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\UIAutomationProvider.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15648
Entropy (8bit):	6.707716448710332
Encrypted:	false
SSDEEP:	192:N9r3Z3rEWHRFOdWMtoUg3WT56Os1HnhWgN7agWfo0irfKUSIX01k9z3AEXzx:bTlQ2odWMto85kHRN730e2IR9z5V
MD5:	2B81FF1172E3E1883DDD2E10B22F89A8
SHA1:	F7B6F3D6A556618025D088BA7EFCED89C1230F0A
SHA-256:	FC7669B4F51AFC9F83FE913A13104FBB6E29BBE25F77715C7B2D94B094B5273C
SHA-512:	F1532E6C93745FB10EB641B2549D159F508B46C5A1CC9755FF2D328A37B874509BC025B0A545186FD67DBE6C9122AB6F48D9B56A266666BB97D6DFE1A9A46E4E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0.............&(... ...@....... ..............................$s....@..................................'..O....@.................. )...`.......'............................................... ............... ..H............text...,.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P ..H............%......8'......................................BSJB............v4.0.30319......l...0...#~..........#Strings....\|.......#US.........#GUID...........#Blob......................3..................................................`.....`.....M...........5.....5...D.5...a.5.....5...-.5.................G.....G.....G...).G...1.G...9.G...A.G...I.G...Q.G.......................#.....+.....3.@...;.T...C.....K.......................]...............................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\UIAutomationTypes.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18720
Entropy (8bit):	6.506543974135334
Encrypted:	false
SSDEEP:	384:2EgBHqQrFh3Wl3tbZ5kHRN7hqNbZR9zQoMF:RIHLCtbgsFT9zo
MD5:	EC436D80BD64C25994F29B41F5636E4C
SHA1:	CD8FF0380F0061DD9545DF2DBBD0495FCD358BDF
SHA-256:	BB106190B384F4E69F19EFBEEB4A2EDE07AA16415588841C174B8ADB9C4F7342
SHA-512:	82AD5E5FD7DE0EE9149A56C1653D7E24684ED1D43B4B1E7EB574009331543019FC71160356B38A141F1EF607DE8364584D4AFEB7CCF55CA98E5ED40F3ED9CF71
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....-..........." ..0..............4... ...@....... ..............................w5....@..................................4..O....@..\|............ .. )...`......t4............................................... ............... ..H............text........ ...................... ..`.rsrc...\|....@......................@..@.reloc.......`......................@..B.................4......H.......P ..<............%..h....3......................................BSJB............v4.0.30319......l...0...#~..........#Strings....t.......#US.x.......#GUID...........#Blob......................3..................................................].....].....J...........2.....2...D.2...a.2.....2...-.2.................D.....D.....D...).D...1.D...9.D...A.D...I.D...Q.D.......................#.....+.....3.@...;.T...C.....K.......................Z.............................}.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\WindowsBase.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	87328
Entropy (8bit):	5.627600753907484
Encrypted:	false
SSDEEP:	1536:08D1u7XRzwAFWsY6kmnmmUIaRQoZk67eEPPdVYFW647azZl:08U7XRzwAFKmUOwdPsVDNl
MD5:	F99BC62EDE862959B6F134547A34731F
SHA1:	5915D88AD4D5BBAEFE0E7D7C3A3AA0FA52374B3F
SHA-256:	51405B4BB8322266E68D75960E4420722F77F1284EBB9233851B449F5BDDD9F6
SHA-512:	CADFBEB5B110F60994EE1AA3D90A74907A07B6E23C71F4688C170A4621AAB5C5A9054D7CFB8F5A9B450AEFF0870D82E9CC1FDC4C172724E26E959735694A3555
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...G............" ..0.."..........^@... ...`....... ..............................7.....@..................................@..O....`..L............,.. )...........?............................................... ............... ..H............text...d ... ...".................. ..`.rsrc...L....`.......$..............@..@.reloc...............*..............@..B................@@......H.......P .. ...........p%......p?......................................BSJB............v4.0.30319......l...0...#~..........#Strings....`.......#US.d.......#GUID...t.......#Blob......................3..................................................W.....W.....D...........,.....,...D.,...a.,.....,...-.,.................>.....>.....>...).>...1.>...9.>...A.>...I.>...Q.>.......................#.....+.....3.@...;.T...C.....K.....................w.T...............................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\cs\WindowsFormsIntegration.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16144
Entropy (8bit):	6.745020004850399
Encrypted:	false
SSDEEP:	384:6K83LFLHsoW2DWW/DeTb2HRN7m2IR9z5B:+bZHsF2/e/i5U9zb
MD5:	517E3E33ACB60CA61D259ECCE804979B
SHA1:	94A98EE072B683B82923891F37CDDB7ECD040198
SHA-256:	D96C7978F84BDA8BBCC725EF133E3695F33AFF6F479A775D2089F2BC66F7BE77
SHA-512:	2893845715E027A2E8733ABA3042FE95514C3F10743817B1F94D8FADD864DE8013A7352F059DB15393C0B3E4119BD45D72E9D6F6FF05D4E4C9733DF7E07C0E7D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...~q:..........." ..0..............+... ...@....... ....................................@....................................O....@...................)...`...................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.......................H.......P ..P............%......(......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................c.....c.....P...........8.....8...D.8...a.8.....8...-.8.................J.....J.....J...).J...1.J...9.J...A.J...I.J...Q.J.......................#.....+.....3.@...;.T...C.....K.......................`...............................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\de\Microsoft.VisualBasic.Forms.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	25760
Entropy (8bit):	6.339133557739763
Encrypted:	false
SSDEEP:	384:WrXSXRaRmIPXdXxa9G/Quw22zdXhY//QxpsJp9aWYHn4hQ5WDTb2HRN7R3yBmo8F:WQIOGIR3o/oenz/iemoQ9zYoSQ
MD5:	FB4F5E2D46FDD36EEA6A1D7B52CCFBF3
SHA1:	C5A128DF6F4F739987D2CF73543691BDAFD1D245
SHA-256:	F61AFDF4A1C28DE573FD2A506AD2A9D56086EA49F3C85FBE8D78846B5ADC11FA
SHA-512:	AE2CE299968CC82398647517937DD5944B5884A9D0B1BD86EDBDEB509570F08256487BC9786A503671E5F83C6D4EC01B3F72ECEEDB0FEFA97C15A3BF69FE6360
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...i............." ..0..2..........nQ... ...`....... ....................................@..................................Q..O....`...............<...(...........Q............................................... ............... ..H............text...t1... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............:..............@..B................PQ......H.......P ..(...........x&...*...P......................................BSJB............v4.0.30319......l...\...#~......x...#Strings....@.......#US.D.......#GUID...T.......#Blob......................3......................................2.......................t...i.......\.....\.....\...G.\...d.\.....\...0.\.................n.....n.....n...).n...1.n...9.n...A.n...I.n...Q.n...Y.n.......................#.....+.....3.@...;.a...C.u...K.....S.@...................C...............

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\de\PresentationCore.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	114440
Entropy (8bit):	5.428602104943458
Encrypted:	false
SSDEEP:	3072:p/1iIo6VUKq2tQhQA/R4gXE+ipMzYbiEjaFEg68s:x1iJ6VE2tQF/R4gXE+iyzYbiEOF/A
MD5:	2FC0116E96A310FCF0C5A208B4EEACB7
SHA1:	ED1EC97CE858A8493C788F709E9F7EF5B13DD93E
SHA-256:	DC9F0D6A551C27768929A26EE3846E0E4B532EF6F64BE4EBB89B4EC34DA89AB8
SHA-512:	2078633C53DEE3FDABFAE5ABBAAF58EB2896032511EE0FEEE9A798E45519E32760B40CBEF6BBB6C49617B1C32EB733E0424241961466034AB9A7FEDC9A6FF68D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....)..........." ..0.............r.... ........... ..............................0.....@................................. ...O.......\|................)........................................................... ............... ..H............text...x.... ...................... ..`.rsrc...\|...........................@..@.reloc..............................@..B................T.......H.......P ..<............%..............................................BSJB............v4.0.30319......l...0...#~..........#Strings....t.......#US.x.......#GUID...........#Blob......................3.................................................._....._.....L...........4.....4...G.4...d.4.....4...0.4.................F.....F.....F...).F...1.F...9.F...A.F...I.F...Q.F.......................#.....+.....3.@...;.T...C.....K.......................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\de\PresentationFramework.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	214192
Entropy (8bit):	5.289663129348695
Encrypted:	false
SSDEEP:	3072:xBZ3pPMKCjcKNI3DPzjPZTBS6fZquXuWHnTdTm+P2rM2fhpHLzZYWApy7eLgArcb:LfhquXuWHnTdK/RhhZYWApUegn3
MD5:	04C339FFBA3980327F14AA4CCB26ED8D
SHA1:	A61C3DB5E43D04A036B05E8E47CCCCD232515A19
SHA-256:	C4E4C6D2EFAC839018418BE171A95B9E1737EF993005BE2CACB42B4771F88C61
SHA-512:	F528DE87E759A3656235BD6088B69C30F5DF1152C01F0FC0C446B2053A2F3D1B108262A67858AB07A7A89729586C53E8B2BDFBABF76F1278A3CE3248BFDE8D16
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...(............." ..0.............V0... ...@....... ..............................[.....@..................................0..O....@...................(...`......./............................................... ............... ..H............text...\.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................80......H.......P ..P............%......h/......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................d.....d.....Q...........9.....9...G.9...d.9.....9...0.9.................K.....K.....K...).K...1.K...9.K...A.K...I.K...Q.K.......................#.....+.....3.@...;.T...C.....K.......................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\de\PresentationUI.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	47392
Entropy (8bit):	5.674477563566661
Encrypted:	false
SSDEEP:	768:fLp4ICj0Yq+OlNxbf49Re1sqwa3DsFDOgvOeX0e+W7goew5BmPm3hOnWhW9pnGUI:f94ICj0YGvsqwa3DsFDOEOeX0e+W7go/
MD5:	A839BFBB84C4B6DA8DABE04C0675D7C1
SHA1:	0CE5A438D8B2A58B5666B452744847266299726C
SHA-256:	CCBA49C63F4723B830F22F357B247B596409839C39C15F2F58E2BB1ACDB474AC
SHA-512:	19084DF7EFC8AD11A1527B9F7AF3A985EBABAAE4342E9B0EC9A28DC8C365AEF7E4CAC1C578FCE395B12E670D68C38ACFD969AC2B6064DB22CC5ED9F0E93EC899
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...}.J..........." ..0.............6.... ........... ....................................@....................................O.......l............... ).......................................................... ............... ..H............text...<.... ...................... ..`.rsrc...l...........................@..@.reloc..............................@..B........................H.......P ..0............%...}..H.......................................BSJB............v4.0.30319......l...0...#~..........#Strings....l.......#US.p.......#GUID...........#Blob......................3..................................................].....].....J...........2.....2...G.2...d.2.....2...0.2.................D.....D.....D...).D...1.D...9.D...A.D...I.D...Q.D.......................#.....+.....3.@...;.T...C.....K.....................}.................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\de\ReachFramework.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	39712
Entropy (8bit):	5.85295463508747
Encrypted:	false
SSDEEP:	768:8QO/ENueEDeiW9c/Fb5P+2Hi45s7j5fF9zw1EOb4mjpbjlhewSRACReCHXH2FT9z:8r/ENueEDeiKnACReCH32Tz3
MD5:	6307413FA9D7FE36C251CFE50BC9D3A5
SHA1:	B54D960B056ECE9B619C8EC234B2C1E6F09165CC
SHA-256:	314AACF247408342513689BF8DE7C649924FB89D22D098CF32CA13A2385CE35C
SHA-512:	0EBA5BB0DBE6C803B54C6B4EF5FE0A1A59C7535DAA31D9D9621074C35A0D894BEF4477CA5E1FFD70F1C606EE08777F1D273B9B7A51CD2F30792AC5A6641F67C6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.../............" ..0..h............... ........... ....................................@.................................P...O.......l............r.. )..........4................................................ ............... ..H............text....g... ...h.................. ..`.rsrc...l............j..............@..@.reloc...............p..............@..B........................H.......P ..\............%...a..........................................BSJB............v4.0.30319......l...<...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................].....].....J...........2.....2...G.2...d.2.....2...0.2.................D.....D.....D...).D...1.D...9.D...A.D...I.D...Q.D.......................#.....+.....3.@...;.T...C.....K.....................................................}.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\de\System.Windows.Controls.Ribbon.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18592
Entropy (8bit):	6.5609813262887275
Encrypted:	false
SSDEEP:	384:jXhihsp18WGVfTb2HRN7jiBmo8R9zbc3Y:9qsof/ismoQ9zYI
MD5:	8C57B5667FA1B9C2E111A7E951B1187E
SHA1:	D16DB4D7EC63A3C500AA3CB8BF138C8B82B7F9E8
SHA-256:	48B9572848F88B343F3FABEEC014B70C7F470A4970BC08B4F0FB66D199BF44A1
SHA-512:	609C2ACDC34B68ED3FFA933184291E54A3B4D16FF7C8B0A078D60BF1FFB0629F6D19BBBBFA87C388C0E8B71C44D8077A697818A09CCFC57285291BB999AECF33
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Y............." ..0.............F5... ...@....... ....................................@..................................4..O....@............... ...(...`.......4............................................... ............... ..H............text...L.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................(5......H.......P ..............0%..(...X4......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID.......0...#Blob......................3..................................................m.....m.....Z...........B.....B...G.B...d.B.....B...0.B.................T.....T.....T...).T...1.T...9.T...A.T...I.T...Q.T......./.....8.....W...#.`...+.{...3.....;.....C.....K.......................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\de\System.Windows.Forms.Design.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	143008
Entropy (8bit):	5.446164201891781
Encrypted:	false
SSDEEP:	3072:7R9MtbGzbtyHZ/I11DKdwWorcP4IVCnEpyf6pu39kP4TCTEWFy5VuJ27/A0NwMeN:FNwMeyXv4He1P9O
MD5:	27D7C2C67EF174E1CB7E2DE3F4AC9D58
SHA1:	1EE0FDAD9BC5C7112FD50D6017D232BB8AB616F8
SHA-256:	3D99A678A87C92124ECDF611A08BA4F75DE4CC72CD22F130636514C6AFE72C0D
SHA-512:	3A947C603F8337BB59B7E715C319E1C4306A7C6B52C1B80F09BE3B4F18C441E50B7F2E090914BA67D8A6205B44F4E6955C9340BC22C25EDABEAD2E16D1A79ACD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....hQ..........." ..0.............n.... ... ....... .......................`............@.....................................O.... ...................(...@....................................................... ............... ..H............text...t.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................P.......H.......P ..X............'..............................................BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID.......D...#Blob......................3......................................2.......................t...........\.....\.....\...G.\...d.\.....\...0.\.................n.....n.....n...).n...1.n...9.n...A.n...I.n...Q.n...Y.n......./.....8.....W...#.`...+.{...3.....;.....C.....K.+...S.....................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\de\System.Windows.Forms.Primitives.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15520
Entropy (8bit):	6.759989046243527
Encrypted:	false
SSDEEP:	192:+js4lgWuQiWOS8uWXebPpUNTQHnhWgN7awWEyKVyDoSJj+iX01k9z3AgIDc0ut:+gCgWuQiWOPTb2HRN7wKVyDX+iR9zn40
MD5:	71E9B3430FC62284A62E3DEB8FC4600E
SHA1:	1308A1BF203D3E40CF2C4FEF0779B8CF0B4EC67E
SHA-256:	2259B1F7A817A337AAF8BC3982215085B9208B65D13A741831E37CAC7D4A31A6
SHA-512:	5902B7F5A69E05D52581D437BD3B41CB2E9CEC670E42C39685BEA6AC9430548EE3693332A286A60477DCEDBC34CE3B36A4C8860CBBCC60CDE24DFAC6A11C36CF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....@_..........." ..0.............r)... ...@....... ....................................@................................. )..O....@..$................(...`.......)............................................... ............... ..H............text...x.... ...................... ..`.rsrc...$....@......................@..@.reloc.......`......................@..B................T)......H.......P ..,...........\|%.......(......................................BSJB............v4.0.30319......l...D...#~...... ...#Strings............#US.........#GUID.......H...#Blob......................3......................................2.......................x...........`.....`.....`...G.`...d.`.....`...0.`.................r.....r.....r...).r...1.r...9.r...A.r...I.r...Q.r...Y.r......./.....8.....W...#.`...+.{...3.....;.....C.....K./...S.....................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\de\System.Windows.Forms.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	366768
Entropy (8bit):	5.152769320466278
Encrypted:	false
SSDEEP:	6144:r93oM9Qk9gZb3elz7jrhXaCsMaC/Cq0OaRBTJ9Q5fYW+d/Pc1Hr6rz:ry+okfYW+1z
MD5:	17E4A43527ABA41186F5F899888D39B8
SHA1:	238DF44CC53B48ECED787A3F8464B5EC12FC2F97
SHA-256:	A0AA41DADF7E4FDCFCD59394E30B16E739B0BB9BB49E7CF4A5AACF5F0E6B98C2
SHA-512:	759CCDA37814F43E5325001250C2DB389E4AA03D93CE14EEA176F0966C1C95820E9BFDC8F260583518A21002B4E9F91E337CCE2BFC4745CF143998F6C7EB90BE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..f............... ........... ..............................<.....@.................................H...O....................p...(..........,................................................ ............... ..H............text....e... ...f.................. ..`.rsrc................h..............@..@.reloc...............n..............@..B................\|.......H.......P ..d............%...^..........................................BSJB............v4.0.30319......l...\...#~......L...#Strings............#US.........#GUID...(...<...#Blob......................3......................................2.......................m...=.......U.....U.....U...G.U...d.U.....U...0.U.................g.....g.....g...).g...1.g...9.g...A.g...I.g...Q.g...Y.g......./.....8.....W...#.`...+.{...3.....;.....C.....K.$...S.....................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\de\System.Windows.Input.Manipulations.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16544
Entropy (8bit):	6.689603110358144
Encrypted:	false
SSDEEP:	384:4e/9pWtHpWWZqTb2HRN7kKBmo8R9zbcx2k:9WtH5q/ikomoQ9zYkk
MD5:	A6FF2B77CDA768DFB70FB64B952F4385
SHA1:	039A4B7516767AD80BA3834F8AEB10A442B03222
SHA-256:	370C4E89A140304520CD704205FCAFA9B3A38F4C1D14462797F2FC837B793061
SHA-512:	E5291A4164D4BE9E6D176DD77DCD2F8896308673692E1269FA0A2E44A36AA5717A8567C372E6C7B9A76641E6CF48F24B67F2016CB804B75EA84FFAB7E0D7AD4A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...6nW..........." ..0.............F-... ...@....... ....................................@..................................,..O....@...................(...`.......,............................................... ............... ..H............text...L.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................(-......H.......P ..............@%......X,......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID.......4...#Blob......................3..................................................q.....q.....^...........F.....F...G.F...d.F.....F...0.F.................X.....X.....X...).X...1.X...9.X...A.X...I.X...Q.X......./.....8.....W...#.`...+.{...3.....;.....C.....K.......................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\de\System.Xaml.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	68768
Entropy (8bit):	5.702550963276784
Encrypted:	false
SSDEEP:	768:gIoOCK7e4oCTW5li8Al/ENwaJt7+0wdMBmXAQbzmV3rOIBG1QmNudV/iLe/DuO9t:bljokE9JoMKz6Gbud9iCbzKe
MD5:	D8C5BB9A4C27E4403CAA686A5ACE3ADB
SHA1:	3CE19F6514514BFCAC874EFB11C2F5551E605694
SHA-256:	86D38B89510324FBB72429C398DB58CB4A89E76FF82A987D5174BE7C92CDDF38
SHA-512:	A099931B3F1EF8935B1991CE9BF0AFE63CAAE0FC8BCAF7576962D0DCD332B9E0469881C7EC4060F9A5425697785F48B1BAD935135A1737AA91816B29F7BB6D19
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....#..........." ..0.................. ........... .......................@............@.....................................O.......L................(... ......d................................................ ............... ..H............text........ ...................... ..`.rsrc...L...........................@..@.reloc....... ......................@..B........................H.......P ...............$..............................................BSJB............v4.0.30319......l...0...#~..........#Strings....d.......#US.h.......#GUID...x.......#Blob......................3..................................................Z.....Z.....G.........../...../...G./...d./...../...0./.................A.....A.....A...).A...1.A...9.A...A.A...I.A...Q.A......./.....8.....W...#.`...+.{...3.....;.....C.....K.....................................................z.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\de\UIAutomationClient.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20256
Entropy (8bit):	6.535741090923168
Encrypted:	false
SSDEEP:	384:9afSv3yPYTz3rdWHWSJdzC5kHRN7fjN/cSR9zfRSa:9ISv3K4AXzDBEe9z5L
MD5:	B43D55AD22854D86BC671DA22A1F54E1
SHA1:	873B09C5412B87307D94BE687C06FC139A87F615
SHA-256:	43898910EECA4DDD8ABDCBB702A46AC9CA9E179102CA0A46622B96643E226706
SHA-512:	89759433BA2CD72C735AEBB7A0D052F27F4C3E1C2A0BA2E122CD23FB9006EA48138748E1885E6A644391A835B34C8246C81F1143770F93AA0B50E5DEACF71D76
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.............n;... ...@....... ....................................@..................................;..O....@...............&.. )...`.......;............................................... ............... ..H............text...t.... ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B................P;......H.......P ..@............%.......:......................................BSJB............v4.0.30319......l...0...#~..........#Strings....x.......#US.\|.......#GUID...........#Blob......................3..................................................a.....a.....N...........6.....6...G.6...d.6.....6...0.6.................H.....H.....H...).H...1.H...9.H...A.H...I.H...Q.H.......................#.....+.....3.@...;.T...C.....K.......................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\de\UIAutomationClientSideProviders.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21168
Entropy (8bit):	6.372810033822026
Encrypted:	false
SSDEEP:	192:2x6V9P3c+zA95Fe9+s+lD1IpkaZiYWOCr3WT56Os1HnhWgN7aIWfiowcLK+X01kf:Lo950+sQCfQYWOC65kHRN7/6R9zANA
MD5:	DE925B13C7833102DE90D91114DEB91B
SHA1:	E4A5FE628BDFE4586B0489EE91A1BB2EDEA2F26A
SHA-256:	B333CC7E25D3859807CB77F988D44C3C8D348159A397A530A22CAF632263D631
SHA-512:	2DAEDFB23651CA230E984ADB74354CD2DE8E8CA804A4DEE41B52AD6956EA6592E650D86D619835F64C85FB68F78FD80F482498E3DC116D3BE35AB7B32320BBCC
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....z..........." ..0.. ..........Z?... ...@....... ..............................S.....@..................................?..O....@...............*...(...`.......>............................................... ............... ..H............text...`.... ... .................. ..`.rsrc........@......."..............@..@.reloc.......`.......(..............@..B................<?......H.......P ..............4%..8...l>......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID.......0...#Blob......................3..................................................n.....n.....[...........C.....C...G.C...d.C.....C...0.C.................U.....U.....U...).U...1.U...9.U...A.U...I.U...Q.U......./.....8.....W...#.`...+.{...3.....;.....C.....K.......................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\de\UIAutomationProvider.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15624
Entropy (8bit):	6.695145829644345
Encrypted:	false
SSDEEP:	192:Ug08B3+o3mWHrfWMtBuWXebPpUNTQHnhWgN7acWtLrp0KBQfX01k9z3A6x9Ra:n08tbmkfWMtBTb2HRN76RxB+R9zpxXa
MD5:	DACBE3079AE548C4A8B3E4A509F5E075
SHA1:	450603EE3108C83AAF9575FAF5D799CDF25CFA77
SHA-256:	A7AFA27FCB8B32540DF1BF2704D3939AFEEE5D66C9D75E90641B001C2280AA4C
SHA-512:	950A707C30810EB8900B79A382FBC4EE82A629C2667BF9BAC21936DE14F0115C990568F2CA06604BE59D79547BFB685F4984D62228A2F96BA7CF6B60EAB13975
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...o............." ..0..............(... ...@....... ..............................i.....@..................................'..O....@...................)...`.......'............................................... ............... ..H............text... .... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......P ..L............%......,'......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................c.....c.....P...........8.....8...G.8...d.8.....8...0.8.................J.....J.....J...).J...1.J...9.J...A.J...I.J...Q.J.......................#.....+.....3.@...;.T...C.....K.......................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\de\UIAutomationTypes.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18704
Entropy (8bit):	6.473137375527397
Encrypted:	false
SSDEEP:	192:tInZaJYT2YzEZOxd9GITjzWLJxRBJhuWXebPpUNTQHnhWgN7agWz8RwX01k9z3A0:t0ZaJGPI2GcWl3JTb2HRN7Y9R9zkwfn
MD5:	78B63F2A3364B5516AB3CF93FDC8E631
SHA1:	85A908C0F00E596F91D876ED68C666DF5707D813
SHA-256:	1A64D3B188A5F312DE2E45FAB353315497D160D5946D1EA1C13178B7507ECFCA
SHA-512:	AEB86CFEF32F73C6F1FB185B0D940A9C021E34870934B8EAA53088C383E11EA60F45D5C65091DC5CBE45E7F24A40EE0B27857E1C578D2EBAF88055539D38DA36
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....l..........." ..0..............4... ...@....... ..............................._....@.................................\|4..O....@..\|............ ...)...`......`4............................................... ............... ..H............text........ ...................... ..`.rsrc...\|....@......................@..@.reloc.......`......................@..B.................4......H.......P ..@............%..P....3......................................BSJB............v4.0.30319......l...0...#~..........#Strings....x.......#US.\|.......#GUID...........#Blob......................3..................................................`.....`.....M...........5.....5...G.5...d.5.....5...0.5.................G.....G.....G...).G...1.G...9.G...A.G...I.G...Q.G.......................#.....+.....3.@...;.T...C.....K.......................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\de\WindowsBase.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	91936
Entropy (8bit):	5.4773476727629395
Encrypted:	false
SSDEEP:	1536:BkD19QyqEOcQmg81PrZMWHT6NSR/fGxTEhmJEJGGG0TzR:BkQyqEOcQf81zpWNSR/ffhmCgGzTF
MD5:	3DF0A80564D153BFAC4C9FA305BAD290
SHA1:	FC0D7570A5E7FFDF7E4161793801D797F6D64BD3
SHA-256:	5A3E9330F764D8575613300C8247C5F517896059EE799949EBD2623FC78B892F
SHA-512:	9AC2F9EBC8BE1FD9AC1BCDDCD15FE1EE84F9F3C3B3E7003B171B55C49515B630817B46CBA549C75A7CF34A89A504F0D20FAB688BDF32023595C02C2E65A65ABA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..4...........R... ...`....... ....................................@..................................Q..O....`..L............>.. )...........Q............................................... ............... ..H............text....2... ...4.................. ..`.rsrc...L....`.......6..............@..@.reloc...............<..............@..B.................Q......H.......P ..$...........t%...+...Q......................................BSJB............v4.0.30319......l...0...#~..........#Strings....d.......#US.h.......#GUID...x.......#Blob......................3..................................................Z.....Z.....G.........../...../...G./...d./...../...0./.................A.....A.....A...).A...1.A...9.A...A.A...I.A...Q.A.......................#.....+.....3.@...;.T...C.....K.....................................................z.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\de\WindowsFormsIntegration.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16160
Entropy (8bit):	6.765493462114974
Encrypted:	false
SSDEEP:	192:mxSL4yLYzeWsPzGVVQW/Def3WT56Os1HnhWgN7agWfwvyttuX01k9z3A2bs:YSL4yLYyWsrFW/De25kHRN7PaSR9zfY
MD5:	73063D28494C2680C4D76F24D25EA57F
SHA1:	5053F4EB32CA528048CA26FD7592480C1FAD31DB
SHA-256:	0FD323460DC445C0DAD2AA5ACA970BE6D84FE1B6BCBC4BFD26EC90AD1B00E177
SHA-512:	6D6B3FD6E2DCC21A59FD2E711909F8E7D354A010AB0FBF7D0D53BB2BCAD053D3E9542A6B2A5997D5B27F95A1F8A9C20B4747F2178B7EFEE4A1F7B0787B4A5A9A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....m............" ..0.............r+... ...@....... ...............................M....@................................. +..O....@.................. )...`.......+............................................... ............... ..H............text...x.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................T+......H.......P ..T............%.......*......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................f.....f.....S...........;.....;...G.;...d.;.....;...0.;.................M.....M.....M...).M...1.M...9.M...A.M...I.M...Q.M.......................#.....+.....3.@...;.T...C.....K.......................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\es\Microsoft.VisualBasic.Forms.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	25776
Entropy (8bit):	6.309296975438988
Encrypted:	false
SSDEEP:	384:SyGZ/XSXRaRmILXdXxahTKQuCb32DXlhpiYwqcjdhaWYHn4hQ5Wn5kHRN7/t6R90:SyGZkIUTROHMDqc5Sl29zI
MD5:	9B65FD9A85F99D807382BD7B5AE29976
SHA1:	8C6237829797DF866232B3432C16BD793AC2B508
SHA-256:	A0AA2F1E0B2F1E2E91A6BE38E19008D8ECB5E94167519CB762CD2385ECC2E283
SHA-512:	40852CB46D0CA0A87106E3ECE17309BE8D1655CC50966F912C2F886FA0A2BBFDF18F60114245180AFB7CEF4145BD58036B100DFB86DBDB1FC5A72DDC8D2C321B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....W............" ..0..2...........P... ...`....... ...............................!....@..................................P..O....`...............<...(..........xP............................................... ............... ..H............text....0... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............:..............@..B.................P......H.......P ..(...........x&...)...O......................................BSJB............v4.0.30319......l...\...#~......x...#Strings....@.......#US.D.......#GUID...T.......#Blob......................3....................................../.......................q...f.......Y.....Y.....Y...D.Y...a.Y.....Y...-.Y.................k.....k.....k...).k...1.k...9.k...A.k...I.k...Q.k...Y.k.......................#.....+.....3.@...;.a...C.u...K.....S.@...................@.r.............

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\es\PresentationCore.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	110344
Entropy (8bit):	5.363850333804221
Encrypted:	false
SSDEEP:	1536:iC61jOxA7X72xbpIzqq8HfTQcN0TcdKVt4v0TIrYJfJrBSc4/zX1AhZsTBv6MKSa:ih1iib72xbpIzqq8HfTQcNycsqrLPtty
MD5:	928E222D222A84117E126D425FFE7312
SHA1:	DBF85383A1796C7F54DEC80C1635C3DAB345BB74
SHA-256:	89A5E2E9CC9CEF45BCC7190456162050B3F68869F982ADB5BD974381CA666C0C
SHA-512:	252EB6CC211E91F8460E5B448DFF08839E88611E711AC0CDD6BA70BE38CCD40F40EAFFB5BEC869162204F708380B7733DFDB517258AA7CECEFA4F1BDAE48767E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....(6..........." ..0..\|............... ........... ..............................$,....@.................................4...O.......\|................)........................................................... ............... ..H............text....z... ...\|.................. ..`.rsrc...\|............~..............@..@.reloc..............................@..B................h.......H.......P ..8............%...t..........................................BSJB............v4.0.30319......l...0...#~..........#Strings....p.......#US.t.......#GUID...........#Blob......................3..................................................\.....\.....I...........1.....1...D.1...a.1.....1...-.1.................C.....C.....C...).C...1.C...9.C...A.C...I.C...Q.C.......................#.....+.....3.@...;.T...C.....K.....................\|.................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\es\PresentationFramework.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	203528
Entropy (8bit):	5.208743608402715
Encrypted:	false
SSDEEP:	3072:sWZyOPnY+nF7eILDlMJBoWB0nih8obFgdA+RBLQ851mkusNFxCeDNsXldp6:D4uih8obFgdAQXikDE8
MD5:	034DE7C68FD28C0B48A1FBBF854FEA14
SHA1:	5CA4431F85B7DADAFDD486922A306530983B733B
SHA-256:	83F3AC93FF8723DD92AB7F6972135FA7C8BC78EE31213FDF7DCAB9E725717906
SHA-512:	7060E6294D723EA0730B96C34A5CEE363CABB4F95C9C9C34A97B3A828B28D7BA3D6C736036370B572BE8EDC6698E2C2035DD6D334334160BEEDFA96C38EDAFD2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...r^............" ..0.................. ... ....... .......................`......Y.....@.....................................O.... ...................)...@......t................................................ ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H.......P ..L............%..X...........................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................a.....a.....N...........6.....6...D.6...a.6.....6...-.6.................H.....H.....H...).H...1.H...9.H...A.H...I.H...Q.H.......................#.....+.....3.@...;.T...C.....K.......................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\es\PresentationUI.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	45728
Entropy (8bit):	5.63174280044617
Encrypted:	false
SSDEEP:	768:wQG5M39t/Km+ku/uCaXiHpNhX6JgH8t4HVxjwtgkgrv1YXCmU/QSDAg/immoQ9zT:daM39t/KSXiHpNhX6JI8t4HVxjwtgNrm
MD5:	AEA162F2532BC8AF117FB4F3D38F8F9C
SHA1:	EBADB7EA73B227C35987CC7F6DB52D3A35FE8B7A
SHA-256:	DCBF09E553D48F191CEC47C2F92D7AFD932518B577DCF6B914B5165622094013
SHA-512:	1CA44E8F6F079D354BDE8A7A2E5630B6D9C7AFB245C23B00A6FFB29D0E3AF004FE5EB479FBCF177F5CAD99166E2AA936EBC76A8BA7828E898C50DE6C5B464CA1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....i..........." ..0.............n.... ........... ..............................b.....@.....................................O.......l................(........................................................... ............... ..H............text...t~... ...................... ..`.rsrc...l...........................@..@.reloc..............................@..B................P.......H.......P ..0............%...x..........................................BSJB............v4.0.30319......l...0...#~..........#Strings....l.......#US.p.......#GUID...........#Blob......................3..................................................Z.....Z.....G.........../...../...D./...a./...../...-./.................A.....A.....A...).A...1.A...9.A...A.A...I.A...Q.A.......................#.....+.....3.@...;.T...C.....K.....................z.................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\es\ReachFramework.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	39696
Entropy (8bit):	5.8014677755178825
Encrypted:	false
SSDEEP:	768:oh4rDN4Ne0KwlXSpLioFOPl2iQnYuMjvDSaR2y4ObZgji/WdrYYz3tdhW1acyZD0:MqDN4Ne0KwltARYYz3syZDEubihazQV
MD5:	80D89B417F74DFB3C4F326B656929DDA
SHA1:	0CD3013650D2FEB0EA0D95CA3238A0C4FE42ED5B
SHA-256:	13A15CE4997291C98B4CC804318A4CE2A20F2D9A5E067FAB5EC822BD70B2B1AA
SHA-512:	3C623DD9C61179F868D8C7A4CDEB1150BEBB09B17C4C197AAECD46D0EC9F70B1E8A8EACEBF521B921D141B0C326F4FBD23573A64676885CF44ED3580DBB40FBD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....6............" ..0..h............... ........... ..............................2u....@.....................................O.......l............r...)........................................................... ............... ..H............text....f... ...h.................. ..`.rsrc...l............j..............@..@.reloc...............p..............@..B.......................H.......P ..X............%..``..........................................BSJB............v4.0.30319......l...<...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................Z.....Z.....G.........../...../...D./...a./...../...-./.................A.....A.....A...).A...1.A...9.A...A.A...I.A...Q.A.......................#.....+.....3.@...;.T...C.....K.....................z.................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\es\System.Windows.Controls.Ribbon.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18592
Entropy (8bit):	6.552773453838169
Encrypted:	false
SSDEEP:	384:YhEZhxs80Li7WGVaTb2HRN7gS/6fR9zcwV:QcGLsa/im9zn
MD5:	CFA65D12DA910F9064F2F9C5A3D0AFC3
SHA1:	32C8634E5AE9455DEEACE212E5C330C49D297FCA
SHA-256:	8BA6467B1935D7BA7A52707B7184F1A2F8FE1F1793316FEBCF361CD883F608A2
SHA-512:	2734E34C61740DBA908448820D8AD6A9DAD7E7AA490DE6D516E82B9DC70B1DB007A847ABF39681E879F3D56EA7D8A31D5FAF07F4B9F90008C69F269B185F31D7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..............." ..0.............N5... ...@....... ..............................`i....@..................................4..O....@............... ...(...`.......4............................................... ............... ..H............text...T.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................05......H.......P ..............0%..0...`4......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID.......0...#Blob......................3..................................................j.....j.....W...........?.....?...D.?...a.?.....?...-.?.................Q.....Q.....Q...).Q...1.Q...9.Q...A.Q...I.Q...Q.Q......./.....8.....W...#.`...+.{...3.....;.....C.....K.......................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\es\System.Windows.Forms.Design.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	142496
Entropy (8bit):	5.439663044948722
Encrypted:	false
SSDEEP:	3072:z/R9MtbGzbtyHZ/I11DKdwWorcP4IVCnEpyfbYlmaDglETAHZf7xx43kZ8GG9sFr:z89sFfp3OKvaeo/k
MD5:	5615E3630FEF8CFFC595AD21EF75F207
SHA1:	C93EF28DCA5A9E3594C217374488F3C7E10DE8B6
SHA-256:	DE2815FE992391EA92FB6786E545852099DCAE040CC4F2F4176FFAA59D02CF9D
SHA-512:	828D7BABAD54CB9EF348A9A515FE4CAB0BCA0269DA6B43261E23D8EE1B0FC80A1032C2DA4D356833CC72FF4099738BF777275C595C26B09D93430F3859295B3E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0.................. ... ....... .......................`......6[....@.................................h...O.... ...................(...@......L................................................ ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H.......P ..T............'..(...........................................BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID.......D...#Blob......................3....................................../.......................q...........Y.....Y.....Y...D.Y...a.Y.....Y...-.Y.................k.....k.....k...).k...1.k...9.k...A.k...I.k...Q.k...Y.k......./.....8.....W...#.`...+.{...3.....;.....C.....K.+...S.....................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\es\System.Windows.Forms.Primitives.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15520
Entropy (8bit):	6.76199669991714
Encrypted:	false
SSDEEP:	384:iHEu94kWuQiWKTb2HRN7vrYBmo8R9zbczS2:SEu+n2/ivr+moQ9zY+2
MD5:	976E3D09DE3BFD959C4957B6AE697399
SHA1:	B73BC8848D18EECFF1D9E8059007FE325EB05BBD
SHA-256:	53B66AFA01B4137E5655C99890CB5153CC62D17D6CDB3F714270EC5246A21872
SHA-512:	7433E4CD67216EE71DDC8C37AF1DACBE9CAC5D0B504D1F9C198FDE834949F4FA0903C485C95D3984C159B6CFE96859F43214DECBF57B9090425612CB4EEEA5DF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....3)..........." ..0.............^)... ...@....... ..............................3.....@..................................)..O....@..$................(...`.......(............................................... ............... ..H............text...d.... ...................... ..`.rsrc...$....@......................@..@.reloc.......`......................@..B................@)......H.......P ..(...........x%......p(......................................BSJB............v4.0.30319......l...D...#~..........#Strings............#US.........#GUID.......H...#Blob......................3....................................../.......................u...........].....].....]...D.]...a.].....]...-.].................o.....o.....o...).o...1.o...9.o...A.o...I.o...Q.o...Y.o......./.....8.....W...#.`...+.{...3.....;.....C.....K./...S.....................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\es\System.Windows.Forms.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	359584
Entropy (8bit):	5.064341981865139
Encrypted:	false
SSDEEP:	6144:L93D3b9lQZyfiaFjoWFcUY9O04K91jw6V1Ut/:LxwjV1Ut/
MD5:	A03A44FDD96C2A4C5F591A6BA6186890
SHA1:	B889B72364D2D4804B4E461DEBB72A1597E5DC8A
SHA-256:	48F8BD56E69D396FF84F1E23C8E7652A58D89DEFF2D5A78593AC75BF6C4E7FA8
SHA-512:	EF5E9F1CFC2E9F026DD1517AE51942F67677A81A62B47E1EB84985CF1063DF2B56EB334E8A0F4A267DF672C6CC21D4AE6B3455F7A680A4E41DA6B62D5AFAE5C0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....w..........." ..0..J..........Ji... ........... ....................................@..................................h..O....................T...(...........h............................................... ............... ..H............text...PI... ...J.................. ..`.rsrc................L..............@..@.reloc...............R..............@..B................,i......H.......P ..d............%...B..\h......................................BSJB............v4.0.30319......l...\...#~......L...#Strings............#US.........#GUID...(...<...#Blob......................3....................................../...........}.....}.....j...:.......R.....R.....R...D.R...a.R.....R...-.R.................d.....d.....d...).d...1.d...9.d...A.d...I.d...Q.d...Y.d......./.....8.....W...#.`...+.{...3.....;.....C.....K.$...S.......................F.............

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\es\System.Windows.Input.Manipulations.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16544
Entropy (8bit):	6.653099141075473
Encrypted:	false
SSDEEP:	384:aLrbX6yRsozWWZqTb2HRN7Q/6fR9zcDaJ:Xorq/iH9z6aJ
MD5:	DFD16B4AEE55E3010101FEA483721231
SHA1:	8AC4A3713C39898A8B269B45A8898CBCADA55233
SHA-256:	48E6B32BB5C6373F516C0163370B077C0F388B7B0498249E16211CDD4D30F469
SHA-512:	038BCD3F0C49988B9113833D46CD743EEEF6A5A2346BACC7C9422CD8FA380E41BDFA5247474737E568DC41C87F359EEEA7AF339CFC7868D13C4B3B3CA47BD3D9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....'8..........." ..0..............,... ...@....... ....................................@..................................,..O....@...................(...`......h,............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................,......H.......P ..............@%.......+......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID.......4...#Blob......................3..................................................n.....n.....[...........C.....C...D.C...a.C.....C...-.C.................U.....U.....U...).U...1.U...9.U...A.U...I.U...Q.U......./.....8.....W...#.`...+.{...3.....;.....C.....K.......................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\es\System.Xaml.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	66208
Entropy (8bit):	5.611938779955186
Encrypted:	false
SSDEEP:	1536:vljlfGaKic94N4FfC5YWMvmGPaacjohSN8qgpMyi4mVzD:vljl18qVn
MD5:	CA24E54B75F7D375EFFEAC2592E3D3F8
SHA1:	FE6CDD8978843809381EBFDA247E0226AE4F9089
SHA-256:	619469169033E9A1526EC8A7FABE26F2C4632EF4D06B2CCC67F940D46C85834C
SHA-512:	EC72D22690D14F5B8C9A69400B190D0BEEFAB9FF5612870CAF9E09861C6553F1AD11AE1763B4CFFA3218803C73C3ECCDD81D98C6B8A13066181C6292C514AE71
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...n............." ..0.................. ........... .......................@......s"....@.................................d...O.......L................(... ......H................................................ ............... ..H............text........ ...................... ..`.rsrc...L...........................@..@.reloc....... ......................@..B........................H.......P ...............$..............................................BSJB............v4.0.30319......l...0...#~..........#Strings....`.......#US.d.......#GUID...t.......#Blob......................3..................................................W.....W.....D...........,.....,...D.,...a.,.....,...-.,.................>.....>.....>...).>...1.>...9.>...A.>...I.>...Q.>......./.....8.....W...#.`...+.{...3.....;.....C.....K.....................w.................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\es\UIAutomationClient.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20232
Entropy (8bit):	6.462094902241366
Encrypted:	false
SSDEEP:	384:rkGGfH03Jl+28mqJlAWSJdPTb2HRN73v2R9zdj:rkGcH03L+2gJEP/ifK9z5
MD5:	EA6AAFC0815D7FB963BE0BB14AFB5EBF
SHA1:	78FC7889FAF182ED534ECFB40CC0C77823EAE995
SHA-256:	C29C1FF179FF4F46EF914601E5223DC3F4C1BA391AE34D14B69CB24CDE0C76D0
SHA-512:	451E4B29D35B1DA9A3C14162D6E7D70B1EEBB6F806A89E999BBAAF2AA79F15D1EAC65C0B3FF3F6469EFB62BB4FD27D3D809F533DC8D262908261E3D447D40FB1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....>..........." ..0.............f:... ...@....... ....................................@..................................:..O....@...............&...)...`.......9............................................... ............... ..H............text...l.... ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B................H:......H.......P ..@............%......x9......................................BSJB............v4.0.30319......l...0...#~..........#Strings....x.......#US.\|.......#GUID...........#Blob......................3..................................................^.....^.....K...........3.....3...D.3...a.3.....3...-.3.................E.....E.....E...).E...1.E...9.E...A.E...I.E...Q.E.......................#.....+.....3.@...;.T...C.....K.....................................................~.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\es\UIAutomationClientSideProviders.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21152
Entropy (8bit):	6.320382530912625
Encrypted:	false
SSDEEP:	384:qSuxD4SCqDWGVgtWOClTb2HRN7jmBmo8R9zbcGg:8xD4SCqDWD+l/iAmoQ9zYl
MD5:	DDB18E7D357785097DDC9E4C2A279AF3
SHA1:	8374501D3327EA1DF05C1EEF91B9162E9907FBAB
SHA-256:	FC72C8EE37A9BCB2A691C1875F65C69525ED030475244D09BA27DAFA327659AE
SHA-512:	31168BDCFD8A26788BE9AD149AE0A256FC649B611915E469F92F456DE2155AD0DC39F0BC19B1BD255A5C29C9972BF025EFCFE80F38805CD545D4EC5BA17BE7F2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.. ...........>... ...@....... ...............................h....@.................................D>..O....@...............*...(...`......(>............................................... ............... ..H............text........ ... .................. ..`.rsrc........@......."..............@..@.reloc.......`.......(..............@..B................x>......H.......P ..............0%..x....=......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID.......0...#Blob......................3..................................................k.....k.....X...........@.....@...D.@...a.@.....@...-.@.................R.....R.....R...).R...1.R...9.R...A.R...I.R...Q.R......./.....8.....W...#.`...+.{...3.....;.....C.....K.......................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\es\UIAutomationProvider.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15648
Entropy (8bit):	6.702423237390909
Encrypted:	false
SSDEEP:	192:S9C3Z3rCWHpFXWMtwv3WT56Os1HnhWgN7agWfTyI5fKUSIX01k9z3AEXzEg:oYlueJWMtwm5kHRN7pI12IR9z5x
MD5:	45D8ED7151F49FD29207A31FA273BB57
SHA1:	FD577D601D6FF65EB9E2D48D586948D85874E59E
SHA-256:	C69DECCDDB64D8B1BDF5583008E19C251C53D0E908666F3E29483ACBC46FA3D6
SHA-512:	B0D49FDB8533694A5F0032E72DE1BBAB9C6CBD7623F02B598A63F76D713E7BDFBE48D87A676369806CEAD5EFCC388B57F7A2FA6DEAAF6D5A3CA5BAFBABEFB65E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..............(... ...@....... ....................................@..................................'..O....@.................. )...`.......'............................................... ............... ..H............text...$.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P ..H............%......0'......................................BSJB............v4.0.30319......l...0...#~..........#Strings....\|.......#US.........#GUID...........#Blob......................3..................................................`.....`.....M...........5.....5...D.5...a.5.....5...-.5.................G.....G.....G...).G...1.G...9.G...A.G...I.G...Q.G.......................#.....+.....3.@...;.T...C.....K.......................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\es\UIAutomationTypes.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18696
Entropy (8bit):	6.4902469350936185
Encrypted:	false
SSDEEP:	192:X0CfQ1LEcM4OWLJxRBJduWXebPpUNTQHnhWgN7acWlmD6x6RMySX01k9z3Affchx:tfQ1fOWl3VTb2HRN7GmDJMR9z8c/
MD5:	ACB2D38D4F3167A49D79881807B8886C
SHA1:	3749A62F35E2DDEF7FBEEF652957A4DDB7F204E1
SHA-256:	E9A4CF5BF4C4075B025FE49FE4C457AC3E2FEFD8A493D302ADEABD053E49968E
SHA-512:	2670F17A29FBFBEFD6BA09C6C2827ADFB090E7639DC8840CE52B2C6DB00CD40222C5B97E9F45A97D98E02C1C2E7B900786D49EF0BE30029F9606870D59E3AD44
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...@.(..........." ..0..............5... ...@....... ....................................@..................................4..O....@..\|............ ...)...`.......4............................................... ............... ..H............text... .... ...................... ..`.rsrc...\|....@......................@..@.reloc.......`......................@..B.................4......H.......P ..<............%......,4......................................BSJB............v4.0.30319......l...0...#~..........#Strings....t.......#US.x.......#GUID...........#Blob......................3..................................................].....].....J...........2.....2...D.2...a.2.....2...-.2.................D.....D.....D...).D...1.D...9.D...A.D...I.D...Q.D.......................#.....+.....3.@...;.T...C.....K.....................................................}.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\es\WindowsBase.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	89760
Entropy (8bit):	5.395863468649567
Encrypted:	false
SSDEEP:	1536:bsD1dSUEgf8HshlaoTHTPC1YUU4e7DPYPWsoJo7fi8k/nvwM25KOlLG9Mw56huRr:bsiUEgf8Hshvsy+Stpleg7
MD5:	EAD11558B6313E6D01138048C32D9158
SHA1:	BA6400D25638F0B995FF1A70061572116000F55D
SHA-256:	18150BC6E8DBE0627392F0AC4C8681519491F8AF76D5065CD3E491A851612C6E
SHA-512:	2F5564803540549C5119262E17366D5E06077837790FDFFC0F9481BAC7AF135CF2A5DC23F619AA2502A8FF4C571D7B60C84B4A17D89D16A2FA1D0830CA22B1D6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..,...........K... ...`....... ..............................9.....@.................................LK..O....`..L............6...(..........0K............................................... ............... ..H............text....+... ...,.................. ..`.rsrc...L....`......................@..@.reloc...............4..............@..B.................K......H.......P .. ...........p%..@%...J......................................BSJB............v4.0.30319......l...0...#~..........#Strings....`.......#US.d.......#GUID...t.......#Blob......................3..................................................W.....W.....D...........,.....,...D.,...a.,.....,...-.,.................>.....>.....>...).>...1.>...9.>...A.>...I.>...Q.>.......................#.....+.....3.@...;.T...C.....K.....................w.................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\es\WindowsFormsIntegration.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16160
Entropy (8bit):	6.733883437008606
Encrypted:	false
SSDEEP:	384:XK8QLFLHBWWWeHRGkoW/D6R5kHRN7V2IR9z5ja:XUZHBLtHRGM6I0U9z8
MD5:	39463366F746E2831CDE78ACDFCB2894
SHA1:	2FE5EE449F02F41528AF56D5132CE53F1DD58F28
SHA-256:	9B74C18C483CABE05E96E727829917C7E2C74C18E5DFB1FA024097EE9EF7918F
SHA-512:	23B77A351F6421A5D8C4904BC25271C71C1DF4BBB3C28D835D469AE5506219E868472757269946F1A3E0C4F96C7813415DFC1E85F5671B491A7F6C7CCFC5E9B1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...q.~..........." ..0..............+... ...@....... ....................................@....................................O....@.................. )...`...................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.......................H.......P ..P............%......(......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................c.....c.....P...........8.....8...D.8...a.8.....8...-.8.................J.....J.....J...).J...1.J...9.J...A.J...I.J...Q.J.......................#.....+.....3.@...;.T...C.....K.......................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\fr\Microsoft.VisualBasic.Forms.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	25760
Entropy (8bit):	6.336377495072634
Encrypted:	false
SSDEEP:	384:5ThXSXRaRmIZXdXxaSiG7eQu0a27bVhr1FEhrcaWYHn4hQ5WNTb2HRN76DX+iR9H:5TeIzvB1LJFERMd/i6DuO9zD
MD5:	101964FCF086DBDDCBD7F6684D732432
SHA1:	0E9FB93F8CCCE79E364269024F98A8281ADF34EB
SHA-256:	98314F5176063B82B0C2E99A8ADFA1AFE3B150CB50B37232BE76426248B3E3A6
SHA-512:	06B7BB0AE0B40D6D961ED1003BB0BCA197B64C3A827A6D2DAD1C95FA990372A659197A918E1457265E908D2B453AA21EBB08E0472D6B77F38AF8655B7BF18F32
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...:............." ..0..2..........^Q... ...`....... ....................................@..................................Q..O....`...............<...(...........P............................................... ............... ..H............text...d1... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............:..............@..B................@Q......H.......P ..(...........x&...)..pP......................................BSJB............v4.0.30319......l...\...#~......x...#Strings....@.......#US.D.......#GUID...T.......#Blob......................3....................................../.......................t...i.......Y.....Y.....Y...D.Y...a.Y.....Y...-.Y.................n.....n.....n...).n...1.n...9.n...A.n...I.n...Q.n...Y.n.......................#.....+.....3.@...;.a...C.u...K.....S.@...................C.k.............

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\fr\PresentationCore.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	113328
Entropy (8bit):	5.392985449795303
Encrypted:	false
SSDEEP:	3072:GF1iFSVCiSArfEhGf+k+1nZ2C5HByINpCn:a1i8VC5ArfEhGf+kMZ2CdBTpk
MD5:	1E726C899B09D66116B538FE928462A7
SHA1:	EF1658A8E742E85F96CE0FD029BB45A5F95314F2
SHA-256:	0748B384E7DC91F648D6E65349D358AD198FE89F0556CD3B2EAE9D72323E8A9F
SHA-512:	2C6D897B32A2F0F2B49790CFD4E595594559634C83003912A5E8271EAC8BA944CFF54280320BC29979315AD68B7A10AD39C72BEF392E0850E0D8CB0ED500D167
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...>#............" ..0.............Z.... ........... ...............................q....@.....................................O.......\|................(.......................................................... ............... ..H............text...`.... ...................... ..`.rsrc...\|...........................@..@.reloc..............................@..B................<.......H.......P ..<............%......l.......................................BSJB............v4.0.30319......l...0...#~..........#Strings....t.......#US.x.......#GUID...........#Blob......................3.................................................._....._.....L...........1.....1...D.1...a.1.....1...-.1.................F.....F.....F...).F...1.F...9.F...A.F...I.F...Q.F.......................#.....+.....3.@...;.T...C.....K.......................C...............................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\fr\PresentationFramework.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	207536
Entropy (8bit):	5.263101737789501
Encrypted:	false
SSDEEP:	6144:IZa9TYjFbY2Ek61lSEkxJfOAOdRlLhpBo0caIP:IBY0EkxJfOAOHlLhpBoDaIP
MD5:	EDE96EBFA4A0A90B72E4728BDD2B657A
SHA1:	73AADB83AFACFE2A51BC92BDBC098AC71C275199
SHA-256:	BE92741DFE3FA0F4D2BADD5FEEA1AB241EDD71EF115A351276B3065C3B6483BE
SHA-512:	2F405F57B353389917E58F52206946ED869B018C65A6DE69EE22DB5B8C9ED6687A79ACD446113BB5542590D2F2B76127EDE37AD67407B1DC70DB31BBDF6C7E05
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...s............." ..0.............^.... ... ....... .......................`.......#....@.....................................O.... ...................(...@....................................................... ............... ..H............text...d.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................@.......H.......P ..P............%......p.......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................d.....d.....Q...........6.....6...D.6...a.6.....6...-.6.................K.....K.....K...).K...1.K...9.K...A.K...I.K...Q.K.......................#.....+.....3.@...;.T...C.....K.......................H...............................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\fr\PresentationUI.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	46768
Entropy (8bit):	5.687596978052965
Encrypted:	false
SSDEEP:	768:G4+pAJgb7iRNnCU0ZPx7LZ7m8cqj3ufSgIPZxXYJmR4D89qPiDdbkW69zD+:GB2Jgb7ik/m8cqj3ufSrPZxXYJmR4DwL
MD5:	0DF051E6AD4F5AE017ABF17CD964B80B
SHA1:	528328EF98BA3DAA94A8E2E16DE293EC9DB62E55
SHA-256:	1F0DF30D7CEBE88A59B1EC6748F50E1BAF54F2CE5FAD07CA0E15FE10EE64EE04
SHA-512:	9E89101935B71BDF30D85FB0D30074071F23BB8532EDCCB4A0FB08025D33974BC4DB7083711DF0D036895EDFD11AFBAF545B7937AFF5BB0E64A2F93276409535
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...5=............" ..0.................. ........... ...................................@.................................T...O.......l................(..........8................................................ ............... ..H............text........ ...................... ..`.rsrc...l...........................@..@.reloc..............................@..B........................H.......P ..0............%..8}..........................................BSJB............v4.0.30319......l...0...#~..........#Strings....l.......#US.p.......#GUID...........#Blob......................3..................................................].....].....J.........../...../...D./...a./...../...-./.................D.....D.....D...).D...1.D...9.D...A.D...I.D...Q.D.......................#.....+.....3.@...;.T...C.....K.....................}.A...............................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\fr\ReachFramework.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	40112
Entropy (8bit):	5.823769174935358
Encrypted:	false
SSDEEP:	768:K4VipgsqCekJO+Ym5hLgEPH2UpYsMoj4KYwqxxSOHpVCNDJuLwt3YHZts0/rshzV:JVmgsqCekJO+1Ym3Y5tspSgcO3X2jxzG
MD5:	A4B9691F858BD787A4E7C576149ABDE1
SHA1:	E24B0BB89FA6382ACE98739471F5EDCF248650D7
SHA-256:	356467B44E30FA7A97230260B05A82B0E4F8C0388B712DB50B28178D8FC07040
SHA-512:	6AAFC12888A1E906C9F429543E786C345CDCD12EE0DAE8318FF668F4ED8FABF07ACA98D932DF4A1D4CEA8D689E8B3B773949A64ADCAB85036B51B98C282CB61F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..._............." ..0..j..........b.... ........... ....................................@.....................................O.......l............t...(.......................................................... ............... ..H............text...hi... ...j.................. ..`.rsrc...l............l..............@..@.reloc...............r..............@..B................D.......H.......P ..\............%...b..t.......................................BSJB............v4.0.30319......l...<...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................].....].....J.........../...../...D./...a./...../...-./.................D.....D.....D...).D...1.D...9.D...A.D...I.D...Q.D.......................#.....+.....3.@...;.T...C.....K.....................}.A...............................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\fr\System.Windows.Controls.Ribbon.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18592
Entropy (8bit):	6.5427104744640685
Encrypted:	false
SSDEEP:	192:MQvRzIP99cLEsEYE1/UOWGVguWXebPpUNTQHnhWgN7aIWzMQnCbTseUfX01k9z36:Nhg6wbWGVgTb2HRN7SrC/6fR9zc/
MD5:	AF3126E613AF8FE1E890354E6AB53166
SHA1:	58C9C73C101FE3FE379A735D38B7361148E6084E
SHA-256:	0645EA8883907F90B43098C3D67563EC297C24B933650B9FDE5ADA6DACE27E46
SHA-512:	5550462A9126443E67B451CD544A2222F952139B5733B8E2673C48B661EDA522F317F256DBC55890691768943E7C15183B250FE0F2D60BB81665105CFE47C1AF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....e............" ..0..............4... ...@....... ....................................@..................................4..O....@............... ...(...`.......4............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................4......H.......P ..............0%.......4......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID.......0...#Blob......................3..................................................m.....m.....Z...........?.....?...D.?...a.?.....?...-.?.................T.....T.....T...).T...1.T...9.T...A.T...I.T...Q.T......./.....8.....W...#.`...+.{...3.....;.....C.....K.......................Q...............................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\fr\System.Windows.Forms.Design.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	143536
Entropy (8bit):	5.456834818283048
Encrypted:	false
SSDEEP:	3072:1R9MtbGzbtyHZ/I11DKdwWorcP4IVCcPU9yhCfAcGtexgVyUL+5pEbY1jGxWjPqG:gWjPPZAYtye+mPP
MD5:	DB97FB21893D9430B058B9ADAF04DE05
SHA1:	BFF437EAECE9E05DBC2FCE0F78000B61EA52916A
SHA-256:	9863A7EDE5BF14A50F02D918575D00DB5C450781D3B4DE2C4C7718630C1DF8A0
SHA-512:	994E398D8323CD024324B5BB1F7B2D9CED8CE7F683CFCBF75A486C81548EDC776E538432C784C59F5686D62B27512D05D4551B389299FD3C5DA58447C2573DDB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....qC..........." ..0.............6.... ... ....... .......................`.......'....@.....................................O.... ...................(...@....................................................... ............... ..H............text...<.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H.......P ..X............'......H.......................................BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID.......D...#Blob......................3....................................../.......................t...........Y.....Y.....Y...D.Y...a.Y.....Y...-.Y.................n.....n.....n...).n...1.n...9.n...A.n...I.n...Q.n...Y.n......./.....8.....W...#.`...+.{...3.....;.....C.....K.+...S.......................k.............

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\fr\System.Windows.Forms.Primitives.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15520
Entropy (8bit):	6.7679053965743545
Encrypted:	false
SSDEEP:	192:HP/frLlBWWuQiWnvuWXebPpUNTQHnhWgN7awWrBm+0U8X01k9z3AYLjEOTx:vXflBWWuQiWvTb2HRN7OBmo8R9zbcOTx
MD5:	9E82D5DD49A30B49A857F887D7E7779F
SHA1:	99C1C0DC04159D658356511F82797FDCC967D3D4
SHA-256:	D394CB076269203088F097F49F0D28EF51CAEAA0CC477244FDA0B811871BDC15
SHA-512:	182F5F7701D33649B6195BA48C34F21B1550E105E2754EAD94BA6205C33EB2380B6773F18EF5F1DB32F16C2BFC9AD62FAC7C6E404D061EDA1B2E568B502A6A87
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....6..........." ..0.............z)... ...@....... ..............................:.....@.................................()..O....@..$................(...`.......)............................................... ............... ..H............text........ ...................... ..`.rsrc...$....@......................@..@.reloc.......`......................@..B................\)......H.......P ..,...........\|%.......(......................................BSJB............v4.0.30319......l...D...#~...... ...#Strings............#US.........#GUID.......H...#Blob......................3....................................../.......................x...........].....].....]...D.]...a.].....]...-.].................r.....r.....r...).r...1.r...9.r...A.r...I.r...Q.r...Y.r......./.....8.....W...#.`...+.{...3.....;.....C.....K./...S.......................o.............

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\fr\System.Windows.Forms.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	365728
Entropy (8bit):	5.148567299999694
Encrypted:	false
SSDEEP:	6144:V93FOlvDJVzWZiCgUGHtVaDgvE6WsETYnSFZOt8LT+hw+nBMcG+/0:V//SETgS7Ot8T+hvn+cG+/0
MD5:	FDBE03B1714A01DFE5F82D6741630469
SHA1:	477096282748D6881851141CD646DFF93506BD05
SHA-256:	3B6248F81E11501F79607E73A6F39F277B4C3E593364890C7CB409D556977033
SHA-512:	496EFF3CBF17285B4A8D1B8D3A0E5554F6D77D02EFC9DBA3688D6F8BCD8FFC62C36E854661C104C22EC5CF9D511E35309B2E44C78052E0FDCF6C1ECA264790FE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....#..........." ..0..b............... ........... ..............................R.....@.................................`...O....................l...(..........D................................................ ............... ..H............text....a... ...b.................. ..`.rsrc................d..............@..@.reloc...............j..............@..B........................H.......P ..d............%...[.........................................BSJB............v4.0.30319......l...\...#~......L...#Strings............#US.........#GUID...(...<...#Blob......................3....................................../.......................m...=.......R.....R.....R...D.R...a.R.....R...-.R.................g.....g.....g...).g...1.g...9.g...A.g...I.g...Q.g...Y.g......./.....8.....W...#.`...+.{...3.....;.....C.....K.$...S.......................d.............

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\fr\System.Windows.Input.Manipulations.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16560
Entropy (8bit):	6.6919534749353025
Encrypted:	false
SSDEEP:	192:bzqbot0UNfZG2CEuxuhWWZO3WT56Os1HnhWgN7aIWfMowcLK+X01k9z3ATn8FC:b+YZqUWWZf5kHRN7t6R9zAn8I
MD5:	18DA6F9ADFBD27E9C8706DBA262DB0E6
SHA1:	969E662EA8BBDDC3C5522B68B45CA8035F460569
SHA-256:	3046F5D8C89A897644A3A4DD1173AA81D60AB21D0FB774275357601600685B87
SHA-512:	C26F25AB52E9E6FB895DDB6DCC4283231CEF7CC62A2548F4AFF757E743A6792D459978E450B322BA8B3570A280D3BCA113E34909CEAF374A1C629E8B33D05EF9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...23-..........." ..0.............6-... ...@....... ..............................N.....@..................................,..O....@...................(...`.......,............................................... ............... ..H............text...<.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................-......H.......P ..............@%......H,......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID.......4...#Blob......................3..................................................q.....q.....^...........C.....C...D.C...a.C.....C...-.C.................X.....X.....X...).X...1.X...9.X...A.X...I.X...Q.X......./.....8.....W...#.`...+.{...3.....;.....C.....K.......................U...............................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\fr\System.Xaml.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	67744
Entropy (8bit):	5.659742431892323
Encrypted:	false
SSDEEP:	768:9NoOCK7e48Rva+O3yc01mDJTYHCX1l1/qC2Od1pRQXi/2iWDo/iUgDuO9zHj:1lj8f01l1yC0S1Sgi7zD
MD5:	28AC9D48ED71B77948A6E0A182763B6F
SHA1:	E0411EABDEC60CD95BC00426D8818BD2C652F725
SHA-256:	11BC5AEB1CEF22C3A5DF14EC6A538320B9EDE723B79479657B6A4C6905DD1A56
SHA-512:	2AE03EAE19302B6432617942F372D0B5D147C528929B8DFC68C059EC430D23112694C524DBAC3906A59CF2E659F9F4126FC1B7A85D0942D52CC0F0263DC057E5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0.............2.... ........... .......................@......w.....@.....................................O.......L................(... ....................................................... ............... ..H............text...8.... ...................... ..`.rsrc...L...........................@..@.reloc....... ......................@..B........................H.......P ...............$..`...D.......................................BSJB............v4.0.30319......l...0...#~..........#Strings....d.......#US.h.......#GUID...x.......#Blob......................3..................................................Z.....Z.....G...........,.....,...D.,...a.,.....,...-.,.................A.....A.....A...).A...1.A...9.A...A.A...I.A...Q.A......./.....8.....W...#.`...+.{...3.....;.....C.....K.....................z.>...............................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\fr\UIAutomationClient.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20232
Entropy (8bit):	6.500617443203649
Encrypted:	false
SSDEEP:	384:XfPIkfwP3cgks1u161ZMpWSJdnTb2HRN7QTMR9z8c4ar:XfQywP3rks1u161ZMJn/iQs9zIu
MD5:	037D3615FDB027FAAB0D69D75922A446
SHA1:	089D96D5CF6A11DA5152691F1D73597F02921E11
SHA-256:	D8440FD237407C7A632812A86D29AB5D43060306E78160DC68857C44C71B5B0B
SHA-512:	3D10B928F4FD8CCB8C941BB389651BD9F37F8A15D2EE769F46AFF09F1CEDC1A8375F51211225FD546E9CD41C6BBCF2F76E3BBF5CC9CE6C3734A44C810B0FD08E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B&B..........." ..0..............:... ...@....... ...................................@..................................:..O....@...............&...)...`......p:............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B.................:......H.......P ..@............%..`....9......................................BSJB............v4.0.30319......l...0...#~..........#Strings....x.......#US.\|.......#GUID...........#Blob......................3..................................................a.....a.....N...........3.....3...D.3...a.3.....3...-.3.................H.....H.....H...).H...1.H...9.H...A.H...I.H...Q.H.......................#.....+.....3.@...;.T...C.....K.......................E...............................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\fr\UIAutomationClientSideProviders.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21168
Entropy (8bit):	6.36429867297839
Encrypted:	false
SSDEEP:	384:l+Zyw6I5/Eo49WOCo5kHRN7+qWDX+iR9zn1o:4Zyw68FN+qWDuO9z1o
MD5:	8E2F185346103577DA9748166B2EEA4F
SHA1:	30ED9DCD170B3819B6F3A0931B96A36AD007BABB
SHA-256:	ED7D55F08B268DACA9649D43F738DC7680873874ED238A3DFE610A9F5A5FF57F
SHA-512:	DD4BFFE8310FEA42485D0FAF8FA824DB4BDDCB1BEC65708E83B7A1B32A483EEB0531B148A2C25F415717A7D3A87417C656EDC639E1A0683186F0EA2E78FD129F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...r.q..........." ..0.. ..........j?... ...@....... ..............................J.....@..................................?..O....@...............*...(...`.......>............................................... ............... ..H............text...p.... ... .................. ..`.rsrc........@......."..............@..@.reloc.......`.......(..............@..B................L?......H.......P ..............4%..H...\|>......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID.......0...#Blob......................3..................................................n.....n.....[...........@.....@...D.@...a.@.....@...-.@.................U.....U.....U...).U...1.U...9.U...A.U...I.U...Q.U......./.....8.....W...#.`...+.{...3.....;.....C.....K.......................R...............................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\fr\UIAutomationProvider.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15632
Entropy (8bit):	6.695704518969438
Encrypted:	false
SSDEEP:	192:fR87353rpWHtgWMt5uWXebPpUNTQHnhWgN7agWbfKUSIX01k9z3AEXzJP9yAk:J8jFFagWMt5Tb2HRN7U2IR9z5NPvk
MD5:	DD2A15E79AE2B543DD39CEEFC238CA85
SHA1:	91557BC44A94972A4511FBCA31482B8B821A2B87
SHA-256:	BB0723A9202460966F2B9B8080BCC6C16D8BC397A75BF35BD61A4560F0F0D51D
SHA-512:	698BEBDAC4A9ADD24F605101BFA8AD6E5EDBAF0E31A8D18D1A14F57A6AF81F6EF7371FDE147D2D80D1EB5654926B34C97007184CFE9850AE3CE962EA583088E8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...=^............" ..0..............(... ...@....... ..............................gH....@..................................'..O....@...................)...`.......'............................................... ............... ..H............text... .... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......P ..L............%......,'......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................c.....c.....P...........5.....5...D.5...a.5.....5...-.5.................J.....J.....J...).J...1.J...9.J...A.J...I.J...Q.J.......................#.....+.....3.@...;.T...C.....K.......................G...............................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\fr\UIAutomationTypes.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18720
Entropy (8bit):	6.48438627912794
Encrypted:	false
SSDEEP:	384:sNWYfeDRPDYO7Wl3JH5kHRN7z2IR9z5rQg:ssY2DAJiCU9zJQg
MD5:	38867060992EA03A43109580F8A9DA14
SHA1:	4AD0B656A29B79F4E9215EC577D9730AE5037E96
SHA-256:	E07C3A42C07613F48DCA6C878AC94BA5CEB7260D38F4D9DA38597D61665490CB
SHA-512:	C11AD6EE2398DA1884A0197FC4F619E7A8A0C70AB934B02786261D76865990F2BE35FFB3F00FC935BA507C1E71AD37A3FAE678E420118B301850C363B6CE2C0D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...I............." ..0..............4... ...@....... ...............................P....@..................................4..O....@..\|............ .. )...`......x4............................................... ............... ..H............text........ ...................... ..`.rsrc...\|....@......................@..@.reloc.......`......................@..B.................4......H.......P ..@............%..h....3......................................BSJB............v4.0.30319......l...0...#~..........#Strings....x.......#US.\|.......#GUID...........#Blob......................3..................................................`.....`.....M...........2.....2...D.2...a.2.....2...-.2.................G.....G.....G...).G...1.G...9.G...A.G...I.G...Q.G.......................#.....+.....3.@...;.T...C.....K.......................D...............................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\fr\WindowsBase.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	90784
Entropy (8bit):	5.4580241332474895
Encrypted:	false
SSDEEP:	1536:4tD1915SaOoaHCCURoRawCDsgWFtXp6wwykCTGsLxLwzu2FawKCPX+vdkitXqJiw:4t/SaOoaHCCUwBasLxSkY0G
MD5:	8DCE6FC8FDBE6BE1E8D9DA48DF57C650
SHA1:	C968163988ED9D88E9C9042A69E68485D73D24FC
SHA-256:	1716B5DEA46DB3CB2D01D64387BC178FF88DE194D5B7254BABD74CD926C5A204
SHA-512:	5375596FBFA1CB6ADAC8BC0613E42CBB1553DA71D067D6AF5C41E62DB1EBD38F2BE63B698170CC154DCC15560494CDC386CC46A9EE94050E431CE22E0D7684C4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....a............" ..0..0..........bO... ...`....... ....................................@..................................O..O....`..L............:...(...........N............................................... ............... ..H............text...h/... ...0.................. ..`.rsrc...L....`.......2..............@..@.reloc...............8..............@..B................DO......H.......P ..$...........t%...)..tN......................................BSJB............v4.0.30319......l...0...#~..........#Strings....d.......#US.h.......#GUID...x.......#Blob......................3..................................................Z.....Z.....G...........,.....,...D.,...a.,.....,...-.,.................A.....A.....A...).A...1.A...9.A...A.A...I.A...Q.A.......................#.....+.....3.@...;.T...C.....K.....................z.>...............................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\fr\WindowsFormsIntegration.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16160
Entropy (8bit):	6.767933925060647
Encrypted:	false
SSDEEP:	384:S4lLFLHbeWDYMW/Dew5kHRN7iyJQNbZR9zQoeg:Z5ZHbjDYBeF7yFT9zWg
MD5:	29E628A1531222010DCC590781342F2B
SHA1:	6B70B6981299C01699214A564D8BB86A020D6020
SHA-256:	755973538076DDF9CEB84B5C7B6D465C2956900F3725BB32CAC71DF822AE554F
SHA-512:	1CEBB759DF39F1551BC8A45009724134EBE4166BA484E8D145388F1A86D75D68ABBC18A9C67380FC704DE94C94DE50EDAB6AED556B31E57B4B4C818EA037C857
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0.............r+... ...@....... ..............................>2....@................................. +..O....@.................. )...`.......+............................................... ............... ..H............text...x.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................T+......H.......P ..T............%.......*......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................f.....f.....S...........8.....8...D.8...a.8.....8...-.8.................M.....M.....M...).M...1.M...9.M...A.M...I.M...Q.M.......................#.....+.....3.@...;.T...C.....K.......................J...............................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\it\Microsoft.VisualBasic.Forms.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	25760
Entropy (8bit):	6.281088747062257
Encrypted:	false
SSDEEP:	384:hyUhXSXRaRmI7FXdXxa+yTQuvB2NCMhS4Yl4x/aWYHn4hQ5WpTb2HRN7lGDX+iRi:hyUeI77yUnzvYE5/iEDuO9zk
MD5:	2A948C366F2D6B628C15616C8916DB2E
SHA1:	67DE9022029874916898AD7163299EC423BF47F6
SHA-256:	35ACEB8706F3ECAEB825D8E9347427C4C1B3A55895130A02579D4CB8AC1BA689
SHA-512:	FD37CBD547BDDCE16AB0D019FBE96BEB5413458078301142130B7DB43D73A449BBEA216A1689AD895AA29B2D04B8D15ABCE957DB696C4F9C0E858FA7DECC0CE8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....W..........." ..0..2..........6P... ...`....... ....................................@..................................O..O....`...............<...(...........O............................................... ............... ..H............text...<0... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............:..............@..B.................P......H.......P ..(...........x&...(..HO......................................BSJB............v4.0.30319......l...\...#~......x...#Strings....@.......#US.D.......#GUID...T.......#Blob......................3....................................../.......................q...f.......Y.....Y.....Y...D.Y...a.Y.....Y...-.Y.................k.....k.....k...).k...1.k...9.k...A.k...I.k...Q.k...Y.k.......................#.....+.....3.@...;.a...C.u...K.....S.@.....................u.............

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\it\PresentationCore.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	111368
Entropy (8bit):	5.360402152051346
Encrypted:	false
SSDEEP:	1536:o861jOkdyNdGaJUTLigAwD38EQ09PngGaDZg3iPC4dezFG:or1ikdyNdGaJKLigAwD38EQkgvg2IQ
MD5:	6A975BC5603E1CBFD1CECF35A1BF6E1F
SHA1:	C2D8989A3562494C9DFE4E722A02D1477BAE7D28
SHA-256:	FB70C93A69E7D848C11F0BEFA3AA50225CAFF99D5B944A910ADA51534E7D6E15
SHA-512:	020F87FEAB1348FDCC5837F9416B510C013E2F2B27E15F1A18E3343DAA9473023E354211412A7E3F9914F5C004CC2B3F2FAD9AD4F9096EC40396121591711E07
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....^X..........." ..0.................. ........... ...................................@.....................................O.......\|................)........................................................... ............... ..H............text........ ...................... ..`.rsrc...\|...........................@..@.reloc..............................@..B.......................H.......P ..<............%...y..........................................BSJB............v4.0.30319......l...0...#~..........#Strings....t.......#US.x.......#GUID...........#Blob......................3..................................................\.....\.....I...........1.....1...D.1...a.1.....1...-.1.................C.....C.....C...).C...1.C...9.C...A.C...I.C...Q.C.......................#.....+.....3.@...;.T...C.....K.....................\|.................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\it\PresentationFramework.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	206088
Entropy (8bit):	5.2168861267134
Encrypted:	false
SSDEEP:	3072:KNZdCPEAgU+pzmIr1ERg9wRK6kwFvJwL5iQRZJAybVHTKbySu6Ri6JhMrvL+E1fx:OrpLwFvJwL5iQR15TgHRi6JhMmE1fpX
MD5:	129CC570F4EAEFB45BF8C0A89B8627DB
SHA1:	982B49D3C0A184B6A2AA3104E15F4DDBCC59F1EB
SHA-256:	BCD65FA7C8CCEF10D5BE41EED769841F44FC4E14F2773BF2B6DDB853FB5BC132
SHA-512:	CC592328DE2EEC4B938DA91D42E4E551901C03426934561B000FDEC7B4FBCF0866B1022D2B4394DFE2B44F5FAE48642D89FEC8D9E082468FCF23CCC12566DFF0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....$..........." ..0.................. ... ....... .......................`............@.................................d...O.... ...................)...@......H................................................ ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H.......P ..P............%..(...........................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................a.....a.....N...........6.....6...D.6...a.6.....6...-.6.................H.....H.....H...).H...1.H...9.H...A.H...I.H...Q.H.......................#.....+.....3.@...;.T...C.....K.......................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\it\PresentationUI.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	45744
Entropy (8bit):	5.62839233836172
Encrypted:	false
SSDEEP:	768:1QgwjC3+TmwA//4Ag2nXBvxEBJWI1EjgpTZSi+RD7Ng9PTGFVQL4NjKk9zmhx:qpjC3+T0FX9xEBJWI1EjyTZSi+RHNg9z
MD5:	8A24C61879B7125654F85EA6FFC0BDC6
SHA1:	0A7C7C30910B709DD0F46229D984F5B683AEAB88
SHA-256:	B2505F467204A8FD2D1C1E6F019FE96536DC7382A98E84D395CD27AE39BA1648
SHA-512:	65F708357BFFAAA88C79F7C62BB4FFA282BEA8B73B6E483A67A5A23AB6593F0A6E8BDA86D258CFF303145FA44D0E13F0973ED7B45B0E63FF0F968AAE7F93594B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.................. ........... ....................................@.................................d...O.......l................(..........H................................................ ............... ..H............text....~... ...................... ..`.rsrc...l...........................@..@.reloc..............................@..B........................H.......P ..0............%..Hx.........................................BSJB............v4.0.30319......l...0...#~..........#Strings....l.......#US.p.......#GUID...........#Blob......................3..................................................Z.....Z.....G.........../...../...D./...a./...../...-./.................A.....A.....A...).A...1.A...9.A...A.A...I.A...Q.A.......................#.....+.....3.@...;.T...C.....K.....................z.................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\it\ReachFramework.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	39688
Entropy (8bit):	5.791333079366547
Encrypted:	false
SSDEEP:	768:gh8/33OL9ecIZSmd9O3a7Pp2Ifgn9HjFmLH1nKZpOdnwwtw1ZhbBUmS4h/i6D9z6:k033OL9ecIZSyMjhi6pz6
MD5:	F95376DBE10AE4D7054786B97F6296C0
SHA1:	9CC2AF269F05290C7897EB20AF917A39D47E2D2B
SHA-256:	EF094FDB0FF891DC935F2C7292BDBCF0425B2D9DC3FE390145AB6D768D1FBED4
SHA-512:	A2149BC248DA158C0F16DC37538C16F94B0EFA133D1311D4A9F8703BB95B2F367E26C3545D42C47C2D94E002A5678FC8C1296347EB4AAF753FD42427A37D8723
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...]8............" ..0..h............... ........... ...................................@.....................................O.......l............r...)........................................................... ............... ..H............text....g... ...h.................. ..`.rsrc...l............j..............@..@.reloc...............p..............@..B.......................H.......P ..\............%..p`..........................................BSJB............v4.0.30319......l...<...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................Z.....Z.....G.........../...../...D./...a./...../...-./.................A.....A.....A...).A...1.A...9.A...A.A...I.A...Q.A.......................#.....+.....3.@...;.T...C.....K.....................z.................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\it\System.Windows.Controls.Ribbon.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18696
Entropy (8bit):	6.5358622203976955
Encrypted:	false
SSDEEP:	384:YhFryUeTIfWGVqTb2HRN7I4VXC4deR9zVj7E3:QFWUe8jq/i1VXC4dC9zVjA3
MD5:	25DDAA32BF9D08D043935F2C23A57030
SHA1:	91F294BC20CED1B29C199BB77D47FB19B9697F6B
SHA-256:	D493BAFA70C8D0DB09178FE389E63DB93D9254B6848ED1F04151EA85964FF7EE
SHA-512:	00AAE311ABF6A2A1B6CD199A9321DADCECD427B138ED86AFBE5F0A010F852AF07A6BE63AD9A907A4AAE1F7B787E5408B26B8C9EDB99B714798BB3EBCB2F760D6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...}............." ..0..............4... ...@....... ...............................c....@..................................4..O....@............... ...)...`......h4............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................4......H.......P ..............0%.......3......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID.......0...#Blob......................3..................................................j.....j.....W...........?.....?...D.?...a.?.....?...-.?.................Q.....Q.....Q...).Q...1.Q...9.Q...A.Q...I.Q...Q.Q......./.....8.....W...#.`...+.{...3.....;.....C.....K.......................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\it\System.Windows.Forms.Design.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	143520
Entropy (8bit):	5.427805001881734
Encrypted:	false
SSDEEP:	3072:xcR9MtbGzbtyHZ/I11DKdwWorcP4IVCnEpyfbYlma8HgbaJeQEwR1yli/h+JsjVa:xPsjVHJ57imrLeMiHtap+ndujCDD
MD5:	A5EE8ED440C4DDC73E6F914E7F6ACE1C
SHA1:	A9E7F7DE598A0E298384B612D6446DDF51BAB5C5
SHA-256:	BBDB5BE22E7BDF536F1DC337529F16B2A23074A70CF77ECDF34F9D6B37F1C5DF
SHA-512:	214D8812C911C28DAC9E37EF5EE2359AD8341B57135F7CB4619EC06E138B0693A2CC85F41A6D9766BFF0ABA65FCA6EB85CDEBACEE2F316B29AD9EB585B34B5BE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.............~.... ... ....... .......................`............@.................................,...O.... ...................(...@....................................................... ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................`.......H.......P ..X............'..............................................BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID.......D...#Blob......................3....................................../.......................q...........Y.....Y.....Y...D.Y...a.Y.....Y...-.Y.................k.....k.....k...).k...1.k...9.k...A.k...I.k...Q.k...Y.k......./.....8.....W...#.`...+.{...3.....;.....C.....K.+...S.....................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\it\System.Windows.Forms.Primitives.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15520
Entropy (8bit):	6.755394145536536
Encrypted:	false
SSDEEP:	192:mh7N+0MWuQiW/LuWXebPpUNTQHnhWgN7awWlOeiMDoSJj+iX01k9z3AgIADq:oNbMWuQiWTTb2HRN78DzDX+iR9znpDq
MD5:	35A0659762D62154CC961B7600CCE78A
SHA1:	DD64D26974C90FDB9D92968AA40E33408D696508
SHA-256:	714CA2B5639802940476E5AD428ABD5331133165CDD17024E55BAAF6D14EF850
SHA-512:	F13C0A46F1898CD3D1C247B7C70EDDD1551825E3B171EEEE7BFB7FC993EB653FFAF260C58C3BADB9C324ABD65E059F8ECDADDD20AA0F65CE137F74EB9EB3A7B4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...o.m..........." ..0.............b)... ...@....... ...............................C....@..................................)..O....@..$................(...`.......(............................................... ............... ..H............text...h.... ...................... ..`.rsrc...$....@......................@..@.reloc.......`......................@..B................D)......H.......P ..,...........\|%......t(......................................BSJB............v4.0.30319......l...D...#~...... ...#Strings............#US.........#GUID.......H...#Blob......................3....................................../.......................u...........].....].....]...D.]...a.].....]...-.].................o.....o.....o...).o...1.o...9.o...A.o...I.o...Q.o...Y.o......./.....8.....W...#.`...+.{...3.....;.....C.....K./...S.....................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\it\System.Windows.Forms.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	361632
Entropy (8bit):	5.061468622375213
Encrypted:	false
SSDEEP:	6144:o935s9SaujD1ITpHJ//OPJfl89yQzcpvA/NgkYhyGkuy4f9NEzFWKXlkE:oz6Cw
MD5:	064F6435A9FDCC27442439E30EC6B6CE
SHA1:	A870009830C4157600C3327924E89BB5D96C9A9C
SHA-256:	A468BEF944BFD2269EAC9FDFDB79F9C3EEEBE9E1FB1E4A10B8475085A91D9408
SHA-512:	7B144E7A4FAAD54A059091BC911F38FF4F1687ABACE14323271B776940891968CC7250D63BCBABA0B4F39826BA16D24B44D597D8388523292430B1A37625690D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....p..........." ..0..R...........q... ........... ..............................NN....@..................................q..O....................\...(..........dq............................................... ............... ..H............text....Q... ...R.................. ..`.rsrc................T..............@..@.reloc...............Z..............@..B.................q......H.......P ..d............%..0K...p......................................BSJB............v4.0.30319......l...\...#~......L...#Strings............#US.........#GUID...(...<...#Blob......................3....................................../...........}.....}.....j...:.......R.....R.....R...D.R...a.R.....R...-.R.................d.....d.....d...).d...1.d...9.d...A.d...I.d...Q.d...Y.d......./.....8.....W...#.`...+.{...3.....;.....C.....K.$...S.......................I.............

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\it\System.Windows.Input.Manipulations.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16560
Entropy (8bit):	6.666623181921748
Encrypted:	false
SSDEEP:	384:6htFrGdWWZT5kHRN7NYT23DX+iR9znAQb:zW2T23DuO9zF
MD5:	8B16EC9EACAE5226976557D3C87D0338
SHA1:	4879ADD3DC23252E945CF6084F75DA138B9CBC42
SHA-256:	02E67475EDD784F3731A1A805D8E0ABBE2DCF5EB8E446342EB72F35E7E294AF3
SHA-512:	B8FBABC0D580449BB2B9663AD49282FCA84D7766A7B541183E7546DB5ABABCDF5EE218DA41E978F0F243FA5EAFC2D031C1C4EDD80864395F8FA4B237BBC140D9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....fd..........." ..0..............-... ...@....... ..............................&.....@..................................,..O....@...................(...`.......,............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................,......H.......P ..............@%...... ,......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID.......4...#Blob......................3..................................................n.....n.....[...........C.....C...D.C...a.C.....C...-.C.................U.....U.....U...).U...1.U...9.U...A.U...I.U...Q.U......./.....8.....W...#.`...+.{...3.....;.....C.....K.......................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\it\System.Xaml.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	66736
Entropy (8bit):	5.606912288646207
Encrypted:	false
SSDEEP:	768:MoOCK7e4KRzqPthDd4EqfEJ2zGxTKnVic/f7inlNixCA8IMDuO9zz:uljKsamKV5f7uA8I6zz
MD5:	65B811FA784ECFBF462A8EBDD652C56B
SHA1:	B8F559C049848B05AEE19200F6861895592C130B
SHA-256:	D58E0A9609B684B1631DA14976EB5C96C06EA3392C7BD64D58250DF87866ABFA
SHA-512:	6EA65C0EF5DD64BE7CB2BBDD5046C98D5DC4773A7F6F7F0BA325E666FBC2DF7AE5D196CA6E5162A9AEC381FAC49F39720BBDF4A046C826FDC5112C2B5A00C7DC
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...a;............" ..0.............2.... ........... .......................@...........@.....................................O.......L................(... ....................................................... ............... ..H............text...8.... ...................... ..`.rsrc...L...........................@..@.reloc....... ......................@..B........................H.......P ...............$..`...D.......................................BSJB............v4.0.30319......l...0...#~..........#Strings....d.......#US.h.......#GUID...x.......#Blob......................3..................................................W.....W.....D...........,.....,...D.,...a.,.....,...-.,.................>.....>.....>...).>...1.>...9.>...A.>...I.>...Q.>......./.....8.....W...#.`...+.{...3.....;.....C.....K.....................w.................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\it\UIAutomationClient.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20232
Entropy (8bit):	6.489083323528247
Encrypted:	false
SSDEEP:	384:iEG0fiG3QULQsz1XWWSJdoTb2HRN7A9HMR9z8czBd3:iEGiiG3DLQsz1Mo/iA9g9zjf3
MD5:	5098A38D835CA422A6A0C9E473795323
SHA1:	649AB5320FA3B341EDF6E6A8B82ECBF424BEF7A2
SHA-256:	7F253F81DD074590C214A588E195FBF6BB965ED4257626F2F0F3A7CE789DD809
SHA-512:	55260BAD13EA3F907F54EC83628C9A8946BB52DD97E98677CC1F2045799C08D0CEE5D7AE147F52F568DC59EEB014597CD0C45E59AAFB32279B75442281457BB6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..............:... ...@....... ....................................@..................................:..O....@...............&...)...`......x:............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B.................:......H.......P ..@............%..h....9......................................BSJB............v4.0.30319......l...0...#~..........#Strings....x.......#US.\|.......#GUID...........#Blob......................3..................................................^.....^.....K...........3.....3...D.3...a.3.....3...-.3.................E.....E.....E...).E...1.E...9.E...A.E...I.E...Q.E.......................#.....+.....3.@...;.T...C.....K.....................................................~.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\it\UIAutomationClientSideProviders.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21168
Entropy (8bit):	6.335402398895817
Encrypted:	false
SSDEEP:	384:ZXhFYm5+RlBgyEjWOCX5kHRN7g49R9zDJUP:RhFn5+RlpPyg69zD8
MD5:	81CF9470EE9C331C9C0D5E017A2B3871
SHA1:	4D207E5FD429D082AAD2D79AEB7830E4482C3571
SHA-256:	E14F9254F210F3E2BAD8054DBF7B58F8A14387319EA4431EFF631A93C832CDE7
SHA-512:	FC8BD6CCE831F26940646161377C923E3E3413F0A598C9265266FA0480BF76EBDD3609A2318B12403F6D9CDD20E6655DA2A5F3FDEE577D7C72D5F0E17C229E69
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...n............" ..0.. ...........?... ...@....... ..............................Ev....@..................................>..O....@...............*...(...`.......>............................................... ............... ..H............text........ ... .................. ..`.rsrc........@......."..............@..@.reloc.......`.......(..............@..B.................>......H.......P ..............4%.......>......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID.......0...#Blob......................3..................................................k.....k.....X...........@.....@...D.@...a.@.....@...-.@.................R.....R.....R...).R...1.R...9.R...A.R...I.R...Q.R......./.....8.....W...#.`...+.{...3.....;.....C.....K.......................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\it\UIAutomationProvider.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15648
Entropy (8bit):	6.698101117038315
Encrypted:	false
SSDEEP:	192:3993Z3rAWHx2WMtMt3WT56Os1HnhWgN7agWfszRU+fKUSIX01k9z3AEXzXW:tRlEW2WMtMo5kHRN7Lac2IR9z5q
MD5:	992A09D8044C231EC6769799E8EC225D
SHA1:	D2B81A62994BA2E2775E951491230E100C274CE9
SHA-256:	EF783FE8C85EDF3EEA470B91A3D3EE36292B7EC12EF2A959CF38E9FA5BF9F033
SHA-512:	4207E77A929B7D75BDD3A8C7529FF2F0873A1829519CFE4768B58206B8CA2EA888E27F6708C131CAE27F6946B7DC12C48BC49282DFA49FB763B042100BA166CA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Ne..........." ..0..............(... ...@....... ....................................@..................................'..O....@.................. )...`.......'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......P ..L............%.......'......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................`.....`.....M...........5.....5...D.5...a.5.....5...-.5.................G.....G.....G...).G...1.G...9.G...A.G...I.G...Q.G.......................#.....+.....3.@...;.T...C.....K.......................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\it\UIAutomationTypes.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18592
Entropy (8bit):	6.468496165764615
Encrypted:	false
SSDEEP:	192:SSCJC5i02h6/8VlpWLJxRBJsduWXebPpUNTQHnhWgN7awW1YfBm+0U8X01k9z3Aq:GJC5K6/kWl3wTb2HRN7QYfBmo8R9zbcy
MD5:	D3DD5256C3C09DD40D40002CE7B3791D
SHA1:	83D1B57480DD4C67D44434995AE9AF97BCA6A81C
SHA-256:	25C052F88B51E883395020D380E1A59430ACBA50A6504DBA90F56A42E812A751
SHA-512:	9A16EAEE835D376B72504704495D693C03B085127B7549FC3243E5D388879BDD755F1BDC4CA4E879340EC230FF21F2A8CCE8C0C2428E54928AB14E921A5EDBFA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..............5... ...@....... ....................................@..................................4..O....@..\|............ ...(...`.......4............................................... ............... ..H............text...$.... ...................... ..`.rsrc...\|....@......................@..@.reloc.......`......................@..B.................5......H.......P ..@............%......04......................................BSJB............v4.0.30319......l...0...#~..........#Strings....x.......#US.\|.......#GUID...........#Blob......................3..................................................].....].....J...........2.....2...D.2...a.2.....2...-.2.................D.....D.....D...).D...1.D...9.D...A.D...I.D...Q.D.......................#.....+.....3.@...;.T...C.....K.....................}.................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\it\WindowsBase.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	91936
Entropy (8bit):	5.402047387768019
Encrypted:	false
SSDEEP:	1536:ZBD18vHwqbwBqAbBdQsj8uwrCeW28AN0Tz:ZBIQqUBqAbnq2xFT
MD5:	A9D8814477FE7589659B3D908B792858
SHA1:	0AAE040D99A4EBF5D26155038B1747794C835A21
SHA-256:	B06D53317B781D1E944B63F90BEB36C33B76AEBCCA9F604AE0C030B1522AF326
SHA-512:	D58D443D89C1E09468ED24EC4764CBFA807D65040E80AAD90CDA20E8727541D3A62E6394614052BB0A54921339B060F083F63C15039FA617A00D28A1CD707650
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...a............." ..0..4..........bR... ...`....... ....................................@..................................R..O....`..L............>.. )...........Q............................................... ............... ..H............text...h2... ...4.................. ..`.rsrc...L....`.......6..............@..@.reloc...............<..............@..B................DR......H.......P ..$...........t%...,..tQ......................................BSJB............v4.0.30319......l...0...#~..........#Strings....d.......#US.h.......#GUID...x.......#Blob......................3..................................................W.....W.....D...........,.....,...D.,...a.,.....,...-.,.................>.....>.....>...).>...1.>...9.>...A.>...I.>...Q.>.......................#.....+.....3.@...;.T...C.....K.....................w.................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\it\WindowsFormsIntegration.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16032
Entropy (8bit):	6.713630493743973
Encrypted:	false
SSDEEP:	384:xK8/LFLH7+WBAW/DVTb2HRN7AaYDX+iR9zne:tzZH7DB1V/i6DuO9ze
MD5:	8DBFFC4166CE516BA4AEFF99354DCF28
SHA1:	09FE2E04F0E971636F68171DBEF0FEC87185ED4E
SHA-256:	B7A174D56AE7BDFF55874ADD845260CE2AECAEE707C8D0E98C98449E12CC29F9
SHA-512:	D87405E834765213397D2A0D8BC79B74F3FF55594322597E6D2143340B25BE050E74415977F7E1883BD88AA0611A8379485A9708150A38A8E8D81B690D8BCB76
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....aX..........." ..0..............+... ...@....... ....................................@....................................O....@...................(...`...................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.......................H.......P ..T............%......$......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................c.....c.....P...........8.....8...D.8...a.8.....8...-.8.................J.....J.....J...).J...1.J...9.J...A.J...I.J...Q.J.......................#.....+.....3.@...;.T...C.....K.......................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ja\Microsoft.VisualBasic.Forms.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	26288
Entropy (8bit):	6.498243184215581
Encrypted:	false
SSDEEP:	384:JJXSXRaRmITXdXxaDgdQuHC2/bN/hsMS8waWYHn4hQ5WFld5kHRN7GEe6R9zAP:JGIKg2CvZzoIS29zM
MD5:	44547EF0FF0E884C541644830824CB2F
SHA1:	B792362C52999ADE83C19551BA4819A22BD68247
SHA-256:	553113C32B90A38CFF89C9994D0E4D8442CAB40AA6432179554114A5F5F7BD1F
SHA-512:	C271AB71862EF424B37DA8D0ED4863EDD71AD60E6A5BBF15733378ED470885212FBDF93C71F21D595086714599EBCF33B4FD1259A6B33B592146E485B0E37180
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..4..........nS... ...`....... ...............................x....@..................................S..O....`...............>...(...........S............................................... ............... ..H............text...t3... ...4.................. ..`.rsrc........`.......6..............@..@.reloc...............<..............@..B................PS......H.......P ..(...........x&...,...R......................................BSJB............v4.0.30319......l...\...#~......x...#Strings....@.......#US.D.......#GUID...T.......#Blob......................3......................................2.......................t...i.......\.....\.....\...G.\...d.\.....\...0.\.................n.....n.....n...).n...1.n...9.n...A.n...I.n...Q.n...Y.n.......................#.....+.....3.@...;.a...C.u...K.....S.@...................C...............

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ja\PresentationCore.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	122544
Entropy (8bit):	5.859919525983532
Encrypted:	false
SSDEEP:	1536:Nh61jOJ2B8ongmeN0n3NIHE96PPWANyPruTn96e5zhc:N81iq8ongmeN0n3NIHE9qPWayjuT9NO
MD5:	FA1A4F8B5439DF9BB35A8ECB28B1F0DD
SHA1:	C7292A92E660A74AF958BC68C546785BA980DFF2
SHA-256:	522DB1CD6D055CB1B22C4952B02E2AA3EE09854575EB82828821E164CC37EA96
SHA-512:	CA89B82A46A0A5EE4C7AFC482C501A2F162558DA213F1367506884C0D2902CE08F4401D9BBA3DA861BCDCF78759BDA2F43CEA00A44704A83B26871C77F0AADFF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....+O..........." ..0.............b.... ........... ....................... ............@.....................................O.......\|................(........................................................... ............... ..H............text...h.... ...................... ..`.rsrc...\|...........................@..@.reloc..............................@..B................D.......H.......P ..<............%.....t.......................................BSJB............v4.0.30319......l...0...#~..........#Strings....t.......#US.x.......#GUID...........#Blob......................3.................................................._....._.....L...........4.....4...G.4...d.4.....4...0.4.................F.....F.....F...).F...1.F...9.F...A.F...I.F...Q.F.......................#.....+.....3.@...;.T...C.....K.......................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ja\PresentationFramework.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	226976
Entropy (8bit):	5.782166157460221
Encrypted:	false
SSDEEP:	3072:usZ7TxP+FVBHOLIW1JSKkPkfsRvpI6LXVV/KgSDghzGXVQMgCJja7tCftJI09DFo:THIvpI6LXVV/Kgxh+T3Jja7aI09DfOo8
MD5:	21BDA9FFD08EE314EB5E21F721EDCB4E
SHA1:	5D5FC44E44735E3BD4FAD4211B7313235DBBFF09
SHA-256:	795C92FE26EC5F33D6CBA986CCF584F0526871337DD6882351D757B022808A78
SHA-512:	A77F0C04134CA4D2F0EAEAEA196E7F73BA5C70FDA67A2DB4F3532F2B895A0E315D9C2BC1ADE13B1F1BAE2B0203804DC862DB3D7B292F5DED583463F5992824DC
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....w............" ..0..D..........Fb... ........... ..............................0.....@..................................a..O....................N...(...........a............................................... ............... ..H............text...LB... ...D.................. ..`.rsrc................F..............@..@.reloc...............L..............@..B................(b......H.......P ..P............%...;..Xa......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................d.....d.....Q...........9.....9...G.9...d.9.....9...0.9.................K.....K.....K...).K...1.K...9.K...A.K...I.K...Q.K.......................#.....+.....3.@...;.T...C.....K.......................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ja\PresentationUI.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	49440
Entropy (8bit):	6.087063634892961
Encrypted:	false
SSDEEP:	1536:KZkcX2TzfJJv7dq9umYxE627qGIdsHoacRzf:K4GIdsxML
MD5:	93005BF2D1FD3B68D5EDE94E4FC8311C
SHA1:	173795E300B89694B431E3675D4F25B6C0F0D3AB
SHA-256:	2A24056857DFBDA6C6E936BE3F9BAE9E8FD9A311349D441D0D785DE3A6D7B9C3
SHA-512:	A7CE03CA0D58D17FC4ADD4BC7B6345C8E8C86B49659393AC474E158A40841D3B621A975C3C8B985C07E343B300ADF0CA5C402FB118D91EEA362DFAB49D841D71
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...IW............" ..0................. ........... ..............................(.....@.................................t...O.......l............... )..........X................................................ ............... ..H............text....... ...................... ..`.rsrc...l...........................@..@.reloc..............................@..B........................H.......P ..0............%..X..........................................BSJB............v4.0.30319......l...0...#~..........#Strings....l.......#US.p.......#GUID...........#Blob......................3..................................................].....].....J...........2.....2...G.2...d.2.....2...0.2.................D.....D.....D...).D...1.D...9.D...A.D...I.D...Q.D.......................#.....+.....3.@...;.T...C.....K.....................}.................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ja\ReachFramework.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	42248
Entropy (8bit):	6.146562160170882
Encrypted:	false
SSDEEP:	768:Rj9y33n4eb43ixJFkPlRPq2Z8VZHOj0mncTcjxOfjbTNe/L+hsgP+jN3yHl/i9VF:Rjk33n4eb43i9SLf4tiXC4dezFq
MD5:	D56AEF192C5F61AD53FCA3EA882BA367
SHA1:	4D93BE0422B1C73D699FB4C5525593D7B0D91C07
SHA-256:	515FE28D42F1E8A0B498A39542CC8E17B3CE20E647AF70A048B6B3824819913C
SHA-512:	4CA2A9E6ACE52C71242B053A7DEEE75B145A3E1C2EF8C6A32D96703230F82FD90BB209162768F68E7D7F75C1F1C15DDBC600C6EBCDABD1C0B6A9B329DBEAD99B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....N..........." ..0..r............... ........... ....................................@.................................h...O.......l............\|...)..........L................................................ ............... ..H............text....p... ...r.................. ..`.rsrc...l............t..............@..@.reloc...............z..............@..B........................H.......P ..\............%.. j.........................................BSJB............v4.0.30319......l...<...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................].....].....J...........2.....2...G.2...d.2.....2...0.2.................D.....D.....D...).D...1.D...9.D...A.D...I.D...Q.D.......................#.....+.....3.@...;.T...C.....K.....................................................}.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ja\System.Windows.Controls.Ribbon.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	19120
Entropy (8bit):	6.623032690940092
Encrypted:	false
SSDEEP:	192:xOURzE/Pf87EzEwt19UYsWGV8Z3WT56Os1HnhWgN7aIWfCTowcLK+X01k9z3AT0G:MUhWfOhWGVV5kHRN7h6R9zAQaL
MD5:	99864F571C0434E635E1E4DFBBF78950
SHA1:	BF8A5FAF76C9C6D9C9B873DBDB428CE64A5D5F1A
SHA-256:	53CDC193C22A3632CC114E9E489D8330D3FF5600CC6E87F58F9679009F5A4961
SHA-512:	FB7F118D63C58E17E59DA7D87C17C84CFD8E43544CB4B90074778AE201FC8421985892F8168FBA37AC045AC8BA53D7E2D5B500A719A7467689527E3B3BFC041F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.............v6... ...@....... ..............................\|.....@.................................$6..O....@..............."...(...`.......6............................................... ............... ..H............text...\|.... ...................... ..`.rsrc........@......................@..@.reloc.......`....... ..............@..B................X6......H.......P ..............0%..X....5......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID.......0...#Blob......................3..................................................m.....m.....Z...........B.....B...G.B...d.B.....B...0.B.................T.....T.....T...).T...1.T...9.T...A.T...I.T...Q.T......./.....8.....W...#.`...+.{...3.....;.....C.....K.......................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ja\System.Windows.Forms.Design.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	148128
Entropy (8bit):	5.813489965074303
Encrypted:	false
SSDEEP:	3072:WR9MtbGzbtyHZ/I11DKdwWorcP4IVCUncl6ShW/lxyH+VcbOruHtVy7sykRtXusM:YtXuspMczTeYjqOS
MD5:	B8463A1224C6F724C30D7AB749B36538
SHA1:	49149CC0FCBBECF126C4EBC0909E4197DF5CB129
SHA-256:	7B54121C86A775517F9A33BCB442C369FA446D0EEAE1D04F1869A95A32C11A2C
SHA-512:	9CFE1FE2129DBD0CB6A72B5E483F11B6155FC48D1836C4A343EA60CA8F2E994E3EB547B28C2655AACEF5AE3666C9728CE0D02E3594720713EC6F295339B2B68F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....8..........." ..0.............F/... ...@....... ..............................M\|....@.....................................O....@...................(...`....................................................... ............... ..H............text...L.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................(/......H.......P ..X............'......X.......................................BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID.......D...#Blob......................3......................................2.......................t...........\.....\.....\...G.\...d.\.....\...0.\.................n.....n.....n...).n...1.n...9.n...A.n...I.n...Q.n...Y.n......./.....8.....W...#.`...+.{...3.....;.....C.....K.+...S.....................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ja\System.Windows.Forms.Primitives.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16032
Entropy (8bit):	6.730424604140958
Encrypted:	false
SSDEEP:	192:kts42zWuQiWGcuWXebPpUNTQHnhWgN7awWsSDoSJj+iX01k9z3AgIX9:VhzWuQiW3Tb2HRN78DX+iR9zns
MD5:	F071F17DBF3DFF45F4C222276ECCA6FE
SHA1:	668863B4195EE007C6C8D34C259FE016A07436EC
SHA-256:	8AFE10773269D714CB92AD9C635726339D6BE0ACB9EF4A6A10DF48A51AF294E4
SHA-512:	3E469A537C26BB769D9D9675A50915C4FA26C7C24069C1DC69C472BEB9E60C21C42FE209D86D39D059B4320EAF5EA11D02EB62715A904D953F28EC1B303E0969
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....!............" ..0.............*... ...@....... ....................................@..................................)..O....@..$................(...`.......)............................................... ............... ..H............text...0.... ...................... ..`.rsrc...$....@......................@..@.reloc.......`......................@..B.......................H.......P ..,...........\|%......<)......................................BSJB............v4.0.30319......l...D...#~...... ...#Strings............#US.........#GUID.......H...#Blob......................3......................................2.......................x...........`.....`.....`...G.`...d.`.....`...0.`.................r.....r.....r...).r...1.r...9.r...A.r...I.r...Q.r...Y.r......./.....8.....W...#.`...+.{...3.....;.....C.....K./...S.....................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ja\System.Windows.Forms.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	401056
Entropy (8bit):	5.680790205461259
Encrypted:	false
SSDEEP:	6144:4932KC3tQwomGKgdPo9k1i83iAdzMhHtPJRIDQie:4kKC9R9r2DQie
MD5:	4081BE35096DC180CD044C3736B58C8E
SHA1:	D10012C22A6F8D69706BAF3BF0F32D8CF418CE8B
SHA-256:	A1798D16B6A3DEE72D34396049130B8572C8AAD33957CDF3CC16164299583B75
SHA-512:	4348327E2AEC8DFC4761CC1E646B91CF324C8B113E6EC963E5A949CC5615E83BD84A94C3BCED8F70275D27E19DAD50848D003CB3D3E0E6E1366982E86D8F3E7D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....[............" ..0.............J.... ... ....... .......................`............@.....................................O.... ...................(...@....................................................... ............... ..H............text...P.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................,.......H.......P ..d............%......\.......................................BSJB............v4.0.30319......l...\...#~......L...#Strings............#US.........#GUID...(...<...#Blob......................3......................................2.......................m...=.......U.....U.....U...G.U...d.U.....U...0.U.................g.....g.....g...).g...1.g...9.g...A.g...I.g...Q.g...Y.g......./.....8.....W...#.`...+.{...3.....;.....C.....K.$...S.....................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ja\System.Windows.Input.Manipulations.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16560
Entropy (8bit):	6.81264468280849
Encrypted:	false
SSDEEP:	192:pAKIQb1xleKCxAIchWWZJ3WT56Os1HnhWgN7akWfvaBowcLK+X01k9z3AT3aU:3TxrWWZ85kHRN7Jx6R9zA3r
MD5:	88A9AAA55F0FFC09B8F4907228B8E56D
SHA1:	A9258D69EBA87241D62D798C7F597EA8EBB5EDD9
SHA-256:	F5DAF1D69F14BE51FB9FE3127FA7E57DADB158E7DA45A0A32D5807F993AD9EFE
SHA-512:	B810467049864435D67D9E7C93C65800CDBCEA3FDCDA5645B8529CAB00CAF6D3CCBF30D68F23E7C8718192021410410030ADE2D868FFC2E978E993E789CA52A0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....TM..........." ..0..............-... ...@....... ....................................@..................................-..O....@...................(...`......p-............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................-......H.......P ..............@%.......,......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID.......4...#Blob......................3..................................................q.....q.....^...........F.....F...G.F...d.F.....F...0.F.................X.....X.....X...).X...1.X...9.X...A.X...I.X...Q.X......./.....8.....W...#.`...+.{...3.....;.....C.....K.......................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ja\System.Xaml.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	74400
Entropy (8bit):	6.115691664835862
Encrypted:	false
SSDEEP:	768:EoOCK7e4waPm7miIFkK1qiQqNpqMJpFg+PgDA0wJG6la8/iH9zb:GljwPbug+Pg80cGp8idzb
MD5:	78A6EEECB25CB1A0E372B57BA582047C
SHA1:	69BE2B5065ECAAA8364FA760BBACCBCBBE025B71
SHA-256:	0E6EB552A873F839E4C00A9B7519D38A2B13FA9720C08E5C71F516EFD35CB804
SHA-512:	537B44E566E81DCA3EB35156DCCDF7EA96404CF988F3FCF912C47414713D677B8D0C937BDC4A61AB317CBD08359D3F2B83154A297CA781BFA129C989B2CA820B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0.................. ... ....... .......................`............@.....................................O.... ..L................(...@......l................................................ ............... ..H............text........ ...................... ..`.rsrc...L.... ......................@..@.reloc.......@......................@..B........................H.......P ...............$..............................................BSJB............v4.0.30319......l...0...#~..........#Strings....d.......#US.h.......#GUID...x.......#Blob......................3..................................................Z.....Z.....G.........../...../...G./...d./...../...0./.................A.....A.....A...).A...1.A...9.A...A.A...I.A...Q.A......./.....8.....W...#.`...+.{...3.....;.....C.....K.....................................................z.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ja\UIAutomationClient.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20744
Entropy (8bit):	6.661048200325101
Encrypted:	false
SSDEEP:	384:iQfyg3QMTCeH+qWSJdnTb2HRN7ssFDR9z9Y1:iGyg3vuC+on/isQl9zy
MD5:	90C6AC25536C59CCB6AA1023D9408D7F
SHA1:	BAEED6CD8ECB1A86C2670BF7D0A8DDB7785682B6
SHA-256:	E56C6F2550D69A028CB31E5A088ED8F29CCA26EDCE8619990993E5EC613AC467
SHA-512:	512EB9B5B7C127E2B399A514EC8F0224F58FB327027753A0EA93B345ED9021883248EF44388FEDB737D74719D82AD687AB9DBD7549FE9E89C55C96E60DDC56C3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..............=... ...@....... ...................................@..................................<..O....@...............(...)...`.......<............................................... ............... ..H............text........ ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......&..............@..B.................<......H.......P ..@............%...... <......................................BSJB............v4.0.30319......l...0...#~..........#Strings....x.......#US.\|.......#GUID...........#Blob......................3..................................................a.....a.....N...........6.....6...G.6...d.6.....6...0.6.................H.....H.....H...).H...1.H...9.H...A.H...I.H...Q.H.......................#.....+.....3.@...;.T...C.....K.......................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ja\UIAutomationClientSideProviders.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21664
Entropy (8bit):	6.425661341129119
Encrypted:	false
SSDEEP:	384:NJ3Oci4RytWWOCLTb2HRN7pDX+iR9znMO:X+ciPtrL/ipDuO9zP
MD5:	E239A5B8846D7D5BC2190BA0C4397BA8
SHA1:	1F872339E591484FA8F3960DDC367AE93BEDC42B
SHA-256:	ED46CA8CB5D111E37D8BFD8ECD2D310A2D0267A2F8E83B2E7A38F55139A8AFFF
SHA-512:	70CF2889CEE21B4A36A3ABB257769E575CEB32F0E876DA6F1BB3D8367662B976F1B6E29C3703D2DE31B93F3C4783E5C7CF6CE5CC8B2759D5EDC34A887726E9B3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...51............" ..0.."...........@... ...`....... ..............................\w....@..................................?..O....`...............,...(...........?............................................... ............... ..H............text.... ... ...".................. ..`.rsrc........`.......$..............@..@.reloc...............*..............@..B.................?......H.......P ..............4%.......?......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID.......0...#Blob......................3..................................................n.....n.....[...........C.....C...G.C...d.C.....C...0.C.................U.....U.....U...).U...1.U...9.U...A.U...I.U...Q.U......./.....8.....W...#.`...+.{...3.....;.....C.....K.......................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ja\UIAutomationProvider.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15648
Entropy (8bit):	6.723099582151397
Encrypted:	false
SSDEEP:	192:Ng0833+23TWHVWWMt0R3WT56Os1HnhWgN7agWfo46tgfKUSIX01k9z3AEXzWhaDM:e08HFTSWWMt005kHRN7dw2IR9z5yQDM
MD5:	7AD960CDCBE5B49A8C429130C8E20032
SHA1:	062D61C945917E58F06957A6C15F939952C8E02D
SHA-256:	DFC7000A61A94F017AF0CF86A0F61A8AF3F91D7AE425D53EC25CAD5CCF6A42F5
SHA-512:	DBEEBAB7828A3E4AFD25BEA7C0CB1CBA15E82DC0FC5E4539ACC31B88C514EFD786E2AF3E3A83F14EDD6C7F68359D972311877EA8E025EC3686A3EFB37E046249
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....1............" ..0.............B(... ...@....... ...............................$....@..................................'..O....@.................. )...`.......'............................................... ............... ..H............text...H.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................$(......H.......P ..L............%......T'......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................c.....c.....P...........8.....8...G.8...d.8.....8...0.8.................J.....J.....J...).J...1.J...9.J...A.J...I.J...Q.J.......................#.....+.....3.@...;.T...C.....K.......................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ja\UIAutomationTypes.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18720
Entropy (8bit):	6.583135802834586
Encrypted:	false
SSDEEP:	192:An6Wo7grBqpvWLJxRBJmE3WT56Os1HnhWgN7agWfA4jNVAv+cQ0GX01k9z3ARo1C:86WocMvWl3eZ5kHRN7ujNbZR9zQo1Hi
MD5:	A96F8CAB1E887A94738CFA88A6C42C87
SHA1:	A2DB28CA72CCD883AC551AB7D0F7B59717758101
SHA-256:	3262EFAF341E09157F528581D72D7AEDDF5AC06108C7851AAD208EC91300BCCE
SHA-512:	E606E5FEA3C0ACAC29185572A1C35A3C18828783A2CD3A1C01FF5566A0B6490DC1B63DDADD1D15B1E17BF692C97ED6B16EA1D7D45D7A17E8818D219362B531F2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...PZ9..........." ..0.............^5... ...@....... ...............................j....@..................................5..O....@..\|............ .. )...`.......4............................................... ............... ..H............text...d.... ...................... ..`.rsrc...\|....@......................@..@.reloc.......`......................@..B................@5......H.......P ..@............%......p4......................................BSJB............v4.0.30319......l...0...#~..........#Strings....x.......#US.\|.......#GUID...........#Blob......................3..................................................`.....`.....M...........5.....5...G.5...d.5.....5...0.5.................G.....G.....G...).G...1.G...9.G...A.G...I.G...Q.G.......................#.....+.....3.@...;.T...C.....K.......................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ja\WindowsBase.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	99592
Entropy (8bit):	5.9214249604676015
Encrypted:	false
SSDEEP:	1536:giD1ylH/KKPc1unoDtpcy6C3eCQ1sJaui9C4dezFe:giQlH/KKPc1u6iQKQatIM
MD5:	7E18A62A42B3C59AFA0796C979F1A9E6
SHA1:	2B7A51ABB274570434645B10DBEF2888D79D4C0F
SHA-256:	FA6F3561A228D0D85C41D709E005D0690DA666BD15330D8B4F3A17B0EDAEDF84
SHA-512:	894B19D2BE101217E90200F5A231C8E8CAB94C05E81CFEB261288337EA4609ADC19144ADBBDEE1A045328AA36EDCF838AA0B2AC7F54DC39A88A7061DB1EE8D75
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0..R..........bq... ........... ....................................@..................................q..O.......L............\...)...........p............................................... ............... ..H............text...hQ... ...R.................. ..`.rsrc...L............T..............@..@.reloc...............Z..............@..B................Dq......H.......P ..$...........t%...K..tp......................................BSJB............v4.0.30319......l...0...#~..........#Strings....d.......#US.h.......#GUID...x.......#Blob......................3..................................................Z.....Z.....G.........../...../...G./...d./...../...0./.................A.....A.....A...).A...1.A...9.A...A.A...I.A...Q.A.......................#.....+.....3.@...;.T...C.....K.....................................................z.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ja\WindowsFormsIntegration.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16648
Entropy (8bit):	6.732712504342106
Encrypted:	false
SSDEEP:	192:OxwL40LAgWPUW/D8uWXebPpUNTQHnhWgN7acWbyxhHssDX01k9z3Aa1N:QwL40LAgWPUW/D8Tb2HRN7TFDR9z91N
MD5:	40268728E67554E1A81AA62EFFFF1438
SHA1:	92BEAD71DC91CDE419D2526C856402C27C82E79B
SHA-256:	B653347E79B6238E8D71F904F9A9C6ACEB4C7D551933BB58BA71D7D87CB37E6D
SHA-512:	08990F668796B674C26FB42776E21A95180880B31445A44B0D9A01B8FDFE9E81CCA1823319D17A99FFEE7A5FEFC990EEC697C77C185D18821D3CB4147F49CF1F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....-8..........." ..0..............,... ...@....... ..............................S\....@..................................+..O....@...................)...`.......+............................................... ............... ..H............text... .... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................+......H.......P ..T............%......,+......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................f.....f.....S...........;.....;...G.;...d.;.....;...0.;.................M.....M.....M...).M...1.M...9.M...A.M...I.M...Q.M.......................#.....+.....3.@...;.T...C.....K.......................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ko\Microsoft.VisualBasic.Forms.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	25760
Entropy (8bit):	6.515078453211216
Encrypted:	false
SSDEEP:	384:S36XSXRaRmIHXdXxaWnNQufc92wOZhloWTVYdaWYHn4hQ5WuvTb2HRN7cDX+iR9R:S33Itnm6nrqWTVYH+v/icDuO9z9
MD5:	4F1E69D59552E7EF8DABCA1198C91C94
SHA1:	E9D9FC2E7BABA3E687904270B6E3247FDC508288
SHA-256:	0868F87255AECB1565365196318B1A5B58F83D6FC2491E27C1CBCAE5A113CBDA
SHA-512:	3FC3F11D4A388B8D78007F9AADFB92DBD7AEC22D38E31400CB4B0EEFA2E20F38E1B86B2E28CEC5F618B7B78D5F6F955EEEEF77972030B686EA1F8A97CF83F274
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....5C..........." ..0..2..........~Q... ...`....... ..............................p3....@.................................,Q..O....`...............<...(...........Q............................................... ............... ..H............text....1... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............:..............@..B................`Q......H.......P ..(...........x&...*...P......................................BSJB............v4.0.30319......l...\...#~......x...#Strings....@.......#US.D.......#GUID...T.......#Blob......................3....................................../.......................t...i.......Y.....Y.....Y...D.Y...a.Y.....Y...-.Y.................n.....n.....n...).n...1.n...9.n...A.n...I.n...Q.n...Y.n.......................#.....+.....3.@...;.a...C.u...K.....S.@...................C.k.............

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ko\PresentationCore.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	114336
Entropy (8bit):	5.986030620785223
Encrypted:	false
SSDEEP:	3072:SN1iiMPQlYZaOz+0w8etM4ckqpVHNYSL5nImvNWwSTLp/NfpxbR2uL:m1ivPQ2ZaOz+0w8etYkqpVHNYSL5n7VG
MD5:	2E7F28959C9D63C1BF24727DD3750836
SHA1:	B471A88C129859CB4BC4EB1AAC10291003D9BD49
SHA-256:	754A970226F98BDB513BDC5C43BB4C3F9E9306A46C142CAE53F3A0AC9B03D23F
SHA-512:	9FBD6AA9589FF1AEC9D832F0072DB535761EF275F6E66C5FE62CCB2F34554146DE45C7D44BEB1C0181C4358EC1004BDDC4199F779AEC9E07B5708E38F44F4564
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0.................. ........... ....................................@.................................`...O.......\|................(..........D................................................ ............... ..H............text........ ...................... ..`.rsrc...\|...........................@..@.reloc..............................@..B........................H.......P ..<............%..8..........................................BSJB............v4.0.30319......l...0...#~..........#Strings....t.......#US.x.......#GUID...........#Blob......................3.................................................._....._.....L...........1.....1...D.1...a.1.....1...-.1.................F.....F.....F...).F...1.F...9.F...A.F...I.F...Q.F.......................#.....+.....3.@...;.T...C.....K.......................C...............................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ko\PresentationFramework.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	211616
Entropy (8bit):	5.916474699195189
Encrypted:	false
SSDEEP:	6144:ZNXtUQDKdzaIKaNWOgtu3GjmqEuGbMq4k/YS3CuREcGFSbpF80iSosN5QWuJKf6T:Zka/neGjmqEuGbMq4k/YS3CuREcGFSbY
MD5:	454FE161D6ACD650CA4D0A0711BC8D9E
SHA1:	2A05E7D4DCC160E6354AE5FD858A85E3770C85AC
SHA-256:	3324719E741AB753D46A2FBC80A92E6F8846FC3A261222A2A7BB5AE8C2222144
SHA-512:	1DC13AD1DB5664153647D5E0D9172938B8C2537C9D83A176EA6EAD72A4AE8E329681DB4659B7A764AFFD08D13AE5219BD89DCF3ED2AC9EED243889991CD442A8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...\.8..........." ..0..............'... ...@....... .............................. .....@.................................\|'..O....@...................(...`......`'............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......P ..P............%..@....&......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................d.....d.....Q...........6.....6...D.6...a.6.....6...-.6.................K.....K.....K...).K...1.K...9.K...A.K...I.K...Q.K.......................#.....+.....3.@...;.T...C.....K.......................H...............................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ko\PresentationUI.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	46344
Entropy (8bit):	6.093589277808508
Encrypted:	false
SSDEEP:	768:TwIBRV2DtGZcxaQ2TR6zQWFK4/W1ZgG7Asq+h8FhhYAuSoXU6oO5j/iQ5EK9zFCT:TJBRV2DGtMzQWFK4/W1Zx7Asq+2Fhhmo
MD5:	E079BF8B9BFDB95D0C90FFA44E840AD4
SHA1:	E4A19EF1AED4604A28D806FFC73D99EB4C807CFE
SHA-256:	460081783E0E841957C2035E80039E65883E9FA5A5DCA9694D9E67AF20E8DD40
SHA-512:	0E97C8395A1CF96807FF20595895C3D1C60494F0C2DA244DF2D3FDEBD275A78C48BAFC84C96916D9464412569EFD8B5838F77852577394F8E5B5E2C6BE416A99
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.............~.... ........... ....................................@.................................,...O.......l................)........................................................... ............... ..H............text........ ...................... ..`.rsrc...l...........................@..@.reloc..............................@..B................`.......H.......P ..0............%...z..........................................BSJB............v4.0.30319......l...0...#~..........#Strings....l.......#US.p.......#GUID...........#Blob......................3..................................................].....].....J.........../...../...D./...a./...../...-./.................D.....D.....D...).D...1.D...9.D...A.D...I.D...Q.D.......................#.....+.....3.@...;.T...C.....K.....................}.A...............................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ko\ReachFramework.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	40624
Entropy (8bit):	6.1680878429722075
Encrypted:	false
SSDEEP:	768:kZ5JShuaekc+o52KBCwsPN2CMRUw6cjzrcrrEcJOCm2NRJ0jn7X2sh+9NzZ6YAk6:k5Shuaekc+ogb4njWC1ezC
MD5:	FEB8DFB35EB75187F4D150E935BD49CC
SHA1:	A678FD889B7D96039BD3F8918721E220E14A6A66
SHA-256:	91D0EFF44ABE877C612F040D380E4239F74C672B08A27A5DB8079436250ED02D
SHA-512:	0AB4380D87F5DA88DB878F71FA7280F339508F8CA91E90A9BF32E1CBF67D280D9FC160EB373EAF39E807FAFB9F97CBE012731175B73B656E62D9A0A30E43B10B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....z............" ..0..l..........B.... ........... ...............................!....@.....................................O.......l............v...(.......................................................... ............... ..H............text...Hj... ...l.................. ..`.rsrc...l............n..............@..@.reloc...............t..............@..B................$.......H.......P ..\............%...c..T.......................................BSJB............v4.0.30319......l...<...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................].....].....J.........../...../...D./...a./...../...-./.................D.....D.....D...).D...1.D...9.D...A.D...I.D...Q.D.......................#.....+.....3.@...;.T...C.....K.....................}.A...............................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ko\System.Windows.Controls.Ribbon.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18608
Entropy (8bit):	6.710527166548232
Encrypted:	false
SSDEEP:	384:mheYEyUWGVj5kHRN7B/0Bmo8R9zbcNHE9:y8y2m4moQ9zYNHE9
MD5:	2BEF87C30020FF10BF7BF5B92B1167B3
SHA1:	1F350D89A65A56E9916C7CF0725B3035CAF778F3
SHA-256:	BBF3D61B4190215028065D55E13E26CDDAE04143BA6B71F236001F1E78825314
SHA-512:	477F2544A3D2E139B3E5E145205BB6E277AB219323883A12103E4ABB5E6BAF33ABC95C0965B6AADFBE565479E0F6F4331E3340501AD77E14D85240D346082F0B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....."..........." ..0..............5... ...@....... ....................................@.................................L5..O....@............... ...(...`......05............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................5......H.......P ..............0%.......4......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID.......0...#Blob......................3..................................................m.....m.....Z...........?.....?...D.?...a.?.....?...-.?.................T.....T.....T...).T...1.T...9.T...A.T...I.T...Q.T......./.....8.....W...#.`...+.{...3.....;.....C.....K.......................Q...............................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ko\System.Windows.Forms.Design.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	144544
Entropy (8bit):	5.795825438551663
Encrypted:	false
SSDEEP:	3072:1R9MtbGzbtyHZ/I11DKdwWorcP4IVCLAFmbTwNOi74NsLGB41svN5O3Qsu3tvzYN:rtvzY0chFuxeyBzrHcBBo2BEI20d
MD5:	4213F7D14B5EABBF361354DB40E10210
SHA1:	6790E0FF67C8F6CE1FA1FF0B068DEB829E45B433
SHA-256:	D0B6A2E8C84EF80AAB49420F6DCF5152AC46BFD85F77FEFF0DB3CA507F7B055F
SHA-512:	697DFEF6CB13B89075F6E8DB2BABDAE1706370D275CAE6771E04BEF44484B8962C14FAAED46CB7AF83095C2904C54A6A18957590A127E48E3E6445CD9E381651
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...=............." ..0.............V ... ...@....... ...............................b....@.................................. ..O....@...................(...`....................................................... ............... ..H............text...\.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................8 ......H.......P ..X............'......h.......................................BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID.......D...#Blob......................3....................................../.......................t...........Y.....Y.....Y...D.Y...a.Y.....Y...-.Y.................n.....n.....n...).n...1.n...9.n...A.n...I.n...Q.n...Y.n......./.....8.....W...#.`...+.{...3.....;.....C.....K.+...S.......................k.............

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ko\System.Windows.Forms.Primitives.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15520
Entropy (8bit):	6.836079147760379
Encrypted:	false
SSDEEP:	192:eP/099WuQiWvuWXebPpUNTQHnhWgN7aIWE4bTseUfX01k9z3AfARjo/:SK9WuQiWvTb2HRN7+/6fR9zcAS
MD5:	1280523515A18FCF030C6AB0E8BF8F53
SHA1:	35E0D9C712D44A9D3F90F733BE3F299AB79A2624
SHA-256:	F5E01BC8C2221B285FD0A3D701714415A5ACDBFCAEB1C7F25FA746D932EFECDC
SHA-512:	54792223BFE2DDB401F693473F82FBCCFA3BF4DF3C7E421C207029463E9BDA237FD5012EAF5805F60AB316F533ACDF4E7CE71E1780BE4FDCCE183C7EE5A61D0B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..."............." ..0..............)... ...@....... ....................................@.................................h)..O....@..$................(...`......L)............................................... ............... ..H............text........ ...................... ..`.rsrc...$....@......................@..@.reloc.......`......................@..B.................)......H.......P ..,...........\|%..P....(......................................BSJB............v4.0.30319......l...D...#~...... ...#Strings............#US.........#GUID.......H...#Blob......................3....................................../.......................x...........].....].....]...D.]...a.].....]...-.].................r.....r.....r...).r...1.r...9.r...A.r...I.r...Q.r...Y.r......./.....8.....W...#.`...+.{...3.....;.....C.....K./...S.......................o.............

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ko\System.Windows.Forms.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	364192
Entropy (8bit):	5.848068340976214
Encrypted:	false
SSDEEP:	6144:A93NYfeBkZ5Zp13/NIq6P1jLun4W4814WUB9JUqA/fmOit+DBiKw6BtBGxLS6vOA:AzXp8mt9PA/JiKfw6BtBGxLS6vOc/tlz
MD5:	49D318FC09699B64098707B6A75FA6E3
SHA1:	218373C8DB252DE8B08242F1A3025D9534B51C60
SHA-256:	D176280E4EBE7F7D06B6DDDA787627423A7BE999DD18CE5C47E677572989DF3A
SHA-512:	76120D87830C9DC9B20AE08A62F5EA0F21265F444107E53D55D76AFF67974CD5EE81D24F3303907D524762351576387C8DA5FBB189C925BEA63A84320B914A9D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...y,............" ..0..\..........B{... ........... ..............................%.....@..................................z..O....................f...(...........z............................................... ............... ..H............text...H[... ...\.................. ..`.rsrc................^..............@..@.reloc...............d..............@..B................${......H.......P ..d............%...T..Tz......................................BSJB............v4.0.30319......l...\...#~......L...#Strings............#US.........#GUID...(...<...#Blob......................3....................................../.......................m...=.......R.....R.....R...D.R...a.R.....R...-.R.................g.....g.....g...).g...1.g...9.g...A.g...I.g...Q.g...Y.g......./.....8.....W...#.`...+.{...3.....;.....C.....K.$...S.......................d.............

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ko\System.Windows.Input.Manipulations.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16544
Entropy (8bit):	6.764115460721112
Encrypted:	false
SSDEEP:	192:bqb+vJeew3Oc8IUU1zX3WWZXuWXebPpUNTQHnhWgN7aIWfabTseUfX01k9z3AfIj:Gle+AUJWWZXTb2HRN7R/6fR9zcIj
MD5:	7BC30CFD2E42B29DEBB251139466599A
SHA1:	26AB8BBD297AAEB4999354FFB3343BD6F367C9A0
SHA-256:	8BB43A059B98C127FB8F099EBBC2715DCD8AABD79142D5B7CB9BB8F484E55DE7
SHA-512:	9692A6D5ADA2FB44082CC8D6D6664A3145390FDB66F5002BBECD28B30B0D2A7B0EC57BB05DC4880D5657B70865A94057D60C5E628960BB908E42CB5BAA8215AB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0..............-... ...@....... ....................................@..................................,..O....@...................(...`.......,............................................... ............... ..H............text...4.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................-......H.......P ..............@%......@,......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID.......4...#Blob......................3..................................................q.....q.....^...........C.....C...D.C...a.C.....C...-.C.................X.....X.....X...).X...1.X...9.X...A.X...I.X...Q.X......./.....8.....W...#.`...+.{...3.....;.....C.....K.......................U...............................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ko\System.Xaml.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	69808
Entropy (8bit):	6.2318671003867685
Encrypted:	false
SSDEEP:	1536:FljTq2XvafM8qMQRQsMpbYSlHPGpQVPQh9kldIcCzz:FljTEfM8ppbYSJeQJQh2ld5C/
MD5:	91F21575CE5792B9393D47138E26BE72
SHA1:	11DE128595CFEF3D46863EEDD1F603598460BD3F
SHA-256:	695A9EFA282219040D4DA618C469ED0E699854C0818EB7B6C41D7FEEAF2AE3F7
SHA-512:	B9B4679F75262C4EBE29FE38B9F2A74D861AA523B398CD7F72A9B653B2A47A694C52586546B939B60416C06511D35F75E901A3A840DAB6FE64F3E69B61D5EDFF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u.v..........." ..0.................. ........... .......................@............@.....................................O.......L................(... ....................................................... ............... ..H............text........ ...................... ..`.rsrc...L...........................@..@.reloc....... ......................@..B........................H.......P ...............$..0...........................................BSJB............v4.0.30319......l...0...#~..........#Strings....d.......#US.h.......#GUID...x.......#Blob......................3..................................................Z.....Z.....G...........,.....,...D.,...a.,.....,...-.,.................A.....A.....A...).A...1.A...9.A...A.A...I.A...Q.A......./.....8.....W...#.`...+.{...3.....;.....C.....K.....................z.>...............................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ko\UIAutomationClient.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20144
Entropy (8bit):	6.718124598092593
Encrypted:	false
SSDEEP:	384:mIYfsi3FncDD8nLJmWSJdQ5kHRN74i6R9zAutm:Zusi3mDbl4i29zs
MD5:	4E019D4B977348DC41F0BA0AA00177EB
SHA1:	B1383F74DAD71772BC655DFF56DB4469F2645829
SHA-256:	25E72B79A3368B122DEBAA340159E4F8F53078B5E0454532FD171A49CF96A30B
SHA-512:	111180946FD9C8E30C94C45611F7E4573ED89DFA797BA2A8CE0873D759F6BB9CC4C8AF5336C41239831E3970030F3AD4B4BA8ED46AE7F99502EA6B8D9981A09C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...4,M..........." ..0..............;... ...@....... ..............................+P....@.................................T;..O....@...............&...(...`......8;............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B.................;......H.......P ..@............%..(....:......................................BSJB............v4.0.30319......l...0...#~..........#Strings....x.......#US.\|.......#GUID...........#Blob......................3..................................................a.....a.....N...........3.....3...D.3...a.3.....3...-.3.................H.....H.....H...).H...1.H...9.H...A.H...I.H...Q.H.......................#.....+.....3.@...;.T...C.....K.......................E...............................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ko\UIAutomationClientSideProviders.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21152
Entropy (8bit):	6.465431819707922
Encrypted:	false
SSDEEP:	384:aYW4+GtWNWOC/Tb2HRN7vGBmo8R9zbcVGa:jW4Oe//ivMmoQ9zYVJ
MD5:	6CD1E1FF03A1EE04E6E0E414E0913141
SHA1:	1B57A974AC899916D9125D3A05D64C535A6B6E44
SHA-256:	E59613CDD1DD879DFF7E0A86EA285D013B98C12E0F22AFF79713B41A8B45C0A5
SHA-512:	E639846EF832BC71DE5963A398058C4F308B849A62E002484802C3F7718F3F98E1C11B1C281980FE8F02D85887AE2F243EC299D2B589DAAB996B974430B8F32D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....b..........." ..0.. ...........>... ...@....... ..............................zM....@..................................>..O....@...............*...(...`......d>............................................... ............... ..H............text........ ... .................. ..`.rsrc........@......."..............@..@.reloc.......`.......(..............@..B.................>......H.......P ..............4%.......=......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID.......0...#Blob......................3..................................................n.....n.....[...........@.....@...D.@...a.@.....@...-.@.................U.....U.....U...).U...1.U...9.U...A.U...I.U...Q.U......./.....8.....W...#.`...+.{...3.....;.....C.....K.......................R...............................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ko\UIAutomationProvider.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15520
Entropy (8bit):	6.698070912168037
Encrypted:	false
SSDEEP:	192:9R8d3E33zWHYjZWMtKcnuWXebPpUNTQHnhWgN7awWTBRDoSJj+iX01k9z3AgIaVH:D8x4znlWMtVTb2HRN7ifDX+iR9znYyCO
MD5:	4B5479BC65E7329B73991727ECA93B0A
SHA1:	4F7B1D5983C74057888B8B55674A246DA056F058
SHA-256:	97226CA8037C4C10BD0EE44973D5139371449BBEE2EC2F670D357C3D69F2DFF2
SHA-512:	14E9750CD74171BED58DEB36711AD9C0D82975E64E467115784DDF1FDBFDF0AB07BB8B5AF9D12EDE88B248F35B59EF15DF5F5DAFAC3F636B91930CDCDEA1BCDD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....C..........." ..0.............2(... ...@....... ....................................@..................................'..O....@...................(...`.......'............................................... ............... ..H............text...8.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................(......H.......P ..L............%......D'......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................c.....c.....P...........5.....5...D.5...a.5.....5...-.5.................J.....J.....J...).J...1.J...9.J...A.J...I.J...Q.J.......................#.....+.....3.@...;.T...C.....K.......................G...............................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ko\UIAutomationTypes.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18592
Entropy (8bit):	6.50379234646238
Encrypted:	false
SSDEEP:	192:Nz5ryLODk8G1a+WLJxRBJfuWXebPpUNTQHnhWgN7aIWq8GebTseUfX01k9z3AfYE:V1yLXa+Wl3XTb2HRN7CGe/6fR9zcb9
MD5:	7F663A765510B12D05FB16AB60E428D4
SHA1:	62F8C0B3ADE855B70BDC57D042411EF1DC7757C4
SHA-256:	FE58BE752C1A36F227C5F8A2CA6CE45D1241B865348715F13C3994E079A9B6EC
SHA-512:	BE9E07B8AF9DC09A863366AF913591962CB8B3F3B67FCD5B30ECA54F0A78AD916B26654940190F51E483A1B56422B51FDF4B8D9D1DD03AAC070139B7506B3655
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...o............" ..0..............4... ...@....... ....................................@.................................44..O....@..\|............ ...(...`.......4............................................... ............... ..H............text........ ...................... ..`.rsrc...\|....@......................@..@.reloc.......`......................@..B................h4......H.......P ..@............%.......3......................................BSJB............v4.0.30319......l...0...#~..........#Strings....x.......#US.\|.......#GUID...........#Blob......................3..................................................`.....`.....M...........2.....2...D.2...a.2.....2...-.2.................G.....G.....G...).G...1.G...9.G...A.G...I.G...Q.G.......................#.....+.....3.@...;.T...C.....K.......................D...............................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ko\WindowsBase.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	92432
Entropy (8bit):	6.051348024400036
Encrypted:	false
SSDEEP:	1536:mOD1INwyCoNWhi72pUwTO+R//4smPsEM/o1fiEzQ:mOCPCoNWhi7uUU5U1r0
MD5:	B939CDBFDC9E0D641743A75FD1EF0BC7
SHA1:	F2D187318B679E83AA0D70A3DD47222235C3D036
SHA-256:	9B617B2258BC3845E219434F3F6420A2D7A8F08B6B6919E605FCB40FAE9D2A17
SHA-512:	5093AA39CE4323649C4070A3C30FA823820CBE6AC44BA469F8E0B422FFB19DE4F0596CFB8E2EC3EB7E047D4178A5D698CB7DF683EC5F83FACA0796ABE9E42142
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...w............." ..0..6...........U... ...`....... ...............................%....@.................................8U..O....`..L............@...)...........U............................................... ............... ..H............text....5... ...6.................. ..`.rsrc...L....`.......8..............@..@.reloc...............>..............@..B................lU......H.......P ..$...........t%..(/...T......................................BSJB............v4.0.30319......l...0...#~..........#Strings....d.......#US.h.......#GUID...x.......#Blob......................3..................................................Z.....Z.....G...........,.....,...D.,...a.,.....,...-.,.................A.....A.....A...).A...1.A...9.A...A.A...I.A...Q.A.......................#.....+.....3.@...;.T...C.....K.....................z.>...............................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\ko\WindowsFormsIntegration.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16032
Entropy (8bit):	6.806009749377199
Encrypted:	false
SSDEEP:	384:U4lLPLHPQWwQW/DGTb2HRN7d0RBmo8R9zbcZ0p:L5DHPdwFG/iermoQ9zYZ0p
MD5:	48383C14394B39CC685456E5F555302B
SHA1:	D98B4BB743F2AA175D73A718B6CD5BA13FCB22BF
SHA-256:	2DC6D5D40FB6C05554C017D815943646D82C09F8B1B4A3D03F0E69AD3CEFCF65
SHA-512:	A3D60F1EE3F61FC71F70F13A2D0CD32B6165A5CF5406300D333B02C03DE37F7C89032BB2926896E285F633365B991B845C099415C14940A1F32015384BEC49F2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.............r+... ...@....... ...............................b....@................................. +..O....@...................(...`.......+............................................... ............... ..H............text...x.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................T+......H.......P ..T............%.......*......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................f.....f.....S...........8.....8...D.8...a.8.....8...-.8.................M.....M.....M...).M...1.M...9.M...A.M...I.M...Q.M.......................#.....+.....3.@...;.T...C.....K.......................J...............................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\pl\Microsoft.VisualBasic.Forms.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	25760
Entropy (8bit):	6.3516448822145755
Encrypted:	false
SSDEEP:	384:2KGXSXRaRmI6XdXxaFhHQuOX2gyKh7BedahaWYHn4hQ5WKTb2HRN7UUBmo8R9zbZ:HTIHhw0iAs6/iUymoQ9zY4
MD5:	CC1201663E8C078986C23A555DCBB542
SHA1:	BCA1BB2DCA82DE4D4FEF423FBD74DED6636A8578
SHA-256:	D75F4B032B390985DFAE9D622820DD8FAAA0675E0C2BEB09991F9FDBA031489C
SHA-512:	4AC9610E7B3ED3502729F61C742D5FEDC9B1B15204B618DBE6A1CFC54B1D604E82ECAD3EDDD6CB6A4D3AF83EC12854D9614EAADEF2FF3C30455790221265F04B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...%t............" ..0..2...........P... ...`....... ...............................V....@..................................P..O....`...............<...(...........P............................................... ............... ..H............text....0... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............:..............@..B.................P......H.......P ..(...........x&...)...P......................................BSJB............v4.0.30319......l...\...#~......x...#Strings....@.......#US.D.......#GUID...T.......#Blob......................3....................................../.......................t...i.......\.....\.....\...D.\...a.\.....\...-.\.................n.....n.....n...).n...1.n...9.n...A.n...I.n...Q.n...Y.n.......................#.....+.....3.@...;.a...C.u...K.....S.@...................C.Y.............

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\pl\PresentationCore.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	113416
Entropy (8bit):	5.58797876738131
Encrypted:	false
SSDEEP:	3072:551irnusDdI0nAl/FUIz3dMQMZgQEsOpE:b1irusDO0nAl/FUIz3mrZgQE+
MD5:	23E7DABD1F55576C874A944C02AEBEB6
SHA1:	A9F6D42FC941B918E2CFA9A09697F3AEC14BEF9C
SHA-256:	383A8E01286152CBAB1A4CA3C9A0A1B37072D530171FEF5BA6567DF061C926A9
SHA-512:	014ECABA55F07BFE48869DB74BBC958CDF85763738156038687EA287475AD185930B0EDD9F6E523BFD370F782FB01C603153DFC0F757A20262B1356D4FF3E66C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....p..........." ..0................. ........... ............................../.....@.....................................O.......\|................)..........l................................................ ............... ..H............text........ ...................... ..`.rsrc...\|...........................@..@.reloc..............................@..B........................H.......P ..<............%..`..........................................BSJB............v4.0.30319......l...0...#~..........#Strings....t.......#US.x.......#GUID...........#Blob......................3.................................................._....._.....L...........4.....4...D.4...a.4.....4...-.4.................F.....F.....F...).F...1.F...9.F...A.F...I.F...Q.F.......................#.....+.....3.@...;.T...C.....K.......................1...............................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\pl\PresentationFramework.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	210096
Entropy (8bit):	5.4656660684238965
Encrypted:	false
SSDEEP:	3072:cCZDHP/j1dCXWIRvcpwCjz3DWeOgPxe+jT87MA1TzEwrAPgUj96HoC3DswtmosXA:fd5OgPxe+jT8oA1qZjdC3GoN2KNKB9Q
MD5:	17118AB0C5FAF632161D845924B098F9
SHA1:	35543F4AEB50D4D737C33335591E878C2F968313
SHA-256:	30075A61F3753861C440D32AE39A525169643325AB60C310FA3664553E92C70E
SHA-512:	B59ECB2856481FDAD8BA89674F6239E51A9838B07DE556225034E79C0F6CDE157B16EB68B3742F24EACBBB61AEDCC3AD8AE214770DD80FCEE7A9E661316B3A2F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....z............" ..0.............v ... ...@....... ...............................N....@.................................$ ..O....@...................(...`....... ............................................... ............... ..H............text...\|.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................X ......H.......P ..P............%..............................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................d.....d.....Q...........9.....9...D.9...a.9.....9...-.9.................K.....K.....K...).K...1.K...9.K...A.K...I.K...Q.K.......................#.....+.....3.@...;.T...C.....K.......................6...............................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\pl\PresentationUI.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	46240
Entropy (8bit):	5.771107676441675
Encrypted:	false
SSDEEP:	768:W2exIgxhW7mPK63Mxj0HubXqbNGmiylgaD2nBqW0Tr9XL9nG+0WMMR/icmoQ9zYR:WvxIgxhWGKnvbXqbNGmiyltD2nBqW0Tb
MD5:	5C77054B8D4B2013A1BC47D8762C7145
SHA1:	AE939FDCC8B2BDE1B86DEB7C717B4E023CD50E0C
SHA-256:	A48EB6D7268081FC9CD751656904D1FD428D25DCE10E40611914252FE2A1557B
SHA-512:	686A24274415FF4AD5815A98592EFF99A7742F114D168BCC485CDD66AE9546EF6DA9567290835147FC85E6DAB51A52EA789A478922142BC7DC7EC75DA875B59B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...4.H..........." ..0................. ........... ..............................k.....@.....................................O.......l................(..........h................................................ ............... ..H............text....... ...................... ..`.rsrc...l...........................@..@.reloc..............................@..B........................H.......P ..0............%..hz.........................................BSJB............v4.0.30319......l...0...#~..........#Strings....l.......#US.p.......#GUID...........#Blob......................3..................................................].....].....J...........2.....2...D.2...a.2.....2...-.2.................D.....D.....D...).D...1.D...9.D...A.D...I.D...Q.D.......................#.....+.....3.@...;.T...C.....K.....................}./...............................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\pl\ReachFramework.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	40096
Entropy (8bit):	5.905435723438472
Encrypted:	false
SSDEEP:	768:opLCP1lvkeXf5gNwXfhFwePQ2IMSrRujl3lt/4//ODMGJW9I6h/upcy5NNL7X4M4:SLQ1lvkeXf5gBx6NZr1Gihtzu
MD5:	32E4717F0E4A0D95D5884D28F4A65AE7
SHA1:	4FDDF0614C6529608A84D2B1BCED6708487EA528
SHA-256:	F27A6B0793DAAB854C276DD6796575E48DC8AA852B2079AA27559B09D94ADBB7
SHA-512:	4A63D112FFAB51DE18C6E2A4456F088E6898E1A936B867EE300C45E053207786EDEE4D568D9B208215304A840323146F67BA9E00EC1A8F1FB3E4B251AD6918DE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..j.............. ........... ..............................j.....@.................................p...O.......l............t...(..........T................................................ ............... ..H............text....h... ...j.................. ..`.rsrc...l............l..............@..@.reloc...............r..............@..B........................H.......P ..\............%..(b.........................................BSJB............v4.0.30319......l...<...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................].....].....J...........2.....2...D.2...a.2.....2...-.2.................D.....D.....D...).D...1.D...9.D...A.D...I.D...Q.D.......................#.....+.....3.@...;.T...C.....K.....................}./...............................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\pl\System.Windows.Controls.Ribbon.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18592
Entropy (8bit):	6.5986698612051615
Encrypted:	false
SSDEEP:	384:xNhB7SAhE3CrWGVvTb2HRN7rB1O/6fR9zceC:ZxFE32v/irBT9zfC
MD5:	1208033BA7F326F3D407F2A270C15312
SHA1:	15BC86218C656C6EC0A439981F36D86B7AC3566B
SHA-256:	597EA9661CC25477686036C36D85863F687FB9DD748123130D7526F6597A3883
SHA-512:	D23E23FE00EC2EA6DDD932033595FAA13E0C3C1DF956463697B6A01BD7551ABFEFBCCB4ABE408E4F575B570B9CFF728342F97F19E19A08C9DB6836429A3F6C9B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..... ..........." ..0..............5... ...@....... ...............................a....@.................................45..O....@............... ...(...`.......5............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................h5......H.......P ..............0%..h....4......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID.......0...#Blob......................3..................................................m.....m.....Z...........B.....B...D.B...a.B.....B...-.B.................T.....T.....T...).T...1.T...9.T...A.T...I.T...Q.T......./.....8.....W...#.`...+.{...3.....;.....C.....K.......................?...............................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\pl\System.Windows.Forms.Design.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	142496
Entropy (8bit):	5.502520038340304
Encrypted:	false
SSDEEP:	3072:KR9MtbGzbtyHZ/I11DKdwWorcP4IVCQrQhubYlmaelG5YUzVTFpFWROTNpWJu7qd:q7qzJOTzsPemorw
MD5:	C3F0AEF2C37B4F110A6EE09F419EFDC5
SHA1:	F8015284CEB6886A14AF586B485EBD00309A3BCD
SHA-256:	2FC8CF1816766FAB626A1456F5F13F4FD3C170FB0FD41A2F7FCF386832B94710
SHA-512:	DE36550566373C5BEFDBED7449A4779CA0B35EA772AF9CF1F8C0E4BF60AC4D5EA66751C0B6751827F7477AA842742A32888FA71741D86DDFF7EC4F3C92B9F404
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....+............" ..0.................. ... ....... .......................`............@.....................................O.... ...................(...@....................................................... ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H.......P ..X............'..p...........................................BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID.......D...#Blob......................3....................................../.......................t...........\.....\.....\...D.\...a.\.....\...-.\.................n.....n.....n...).n...1.n...9.n...A.n...I.n...Q.n...Y.n......./.....8.....W...#.`...+.{...3.....;.....C.....K.+...S.......................Y.............

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\pl\System.Windows.Forms.Primitives.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15632
Entropy (8bit):	6.788420450339631
Encrypted:	false
SSDEEP:	384:o/5nS6Y/WuQiWdHTb2HRN7WfEc/cTR9zuSC4Z:o/JS6Y6V/iW3kV9zE0
MD5:	59FE578776CDAC873E27C2971807D4A6
SHA1:	42DBC9BA2ADD55BCACD3B179208C7867E3365BFC
SHA-256:	A396584316A517C5768DBD5EF8DD2339399122149474C7C1CF33C9DA8D5912DA
SHA-512:	CED103546DB255C2F0A3895DF6C3730AD9F0B0F5E8486DED39ADDD023FB9E23F33FA5A23C88081562015193D5E99ABC68AF1E95C2E7E924FE5743FC970713DF8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....8............" ..0.............j)... ...@....... ...............................y....@..................................)..O....@..$................)...`.......(............................................... ............... ..H............text...p.... ...................... ..`.rsrc...$....@......................@..@.reloc.......`......................@..B................L)......H.......P ..,...........\|%......\|(......................................BSJB............v4.0.30319......l...D...#~...... ...#Strings............#US.........#GUID.......H...#Blob......................3....................................../.......................x...........`.....`.....`...D.`...a.`.....`...-.`.................r.....r.....r...).r...1.r...9.r...A.r...I.r...Q.r...Y.r......./.....8.....W...#.`...+.{...3.....;.....C.....K./...S.......................].............

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\pl\System.Windows.Forms.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	359584
Entropy (8bit):	5.330880768550209
Encrypted:	false
SSDEEP:	6144:V933hgdoIdvGHcsw19aJfhHGVrCBFkuP907p4OJ0l:V5kmv9Slg
MD5:	38AE48A6EDE5A824D309712DAB8BEFF0
SHA1:	CD716257915D2D976EE8C9115B89EF13FD4BC5DB
SHA-256:	89EEC59DD28DCCCC17BF3833FE7338D29F83F8677651B796E81FD6E1A8C309AA
SHA-512:	12E1143DDE63ACC34EA4353DBC5ABA1A530393C01224B06221C6211B99635F7C159E777503EB3D423192484D28D1CE4770F8ECF0B47812743E58E403437E9ECA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....v............" ..0..J...........i... ........... ..............................Y.....@..................................i..O....................T...(..........li............................................... ............... ..H............text....I... ...J.................. ..`.rsrc................L..............@..@.reloc...............R..............@..B.................i......H.......P ..d............%..8C...h......................................BSJB............v4.0.30319......l...\...#~......L...#Strings............#US.........#GUID...(...<...#Blob......................3....................................../.......................m...=.......U.....U.....U...D.U...a.U.....U...-.U.................g.....g.....g...).g...1.g...9.g...A.g...I.g...Q.g...Y.g......./.....8.....W...#.`...+.{...3.....;.....C.....K.$...S.......................R.............

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\pl\System.Windows.Input.Manipulations.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16544
Entropy (8bit):	6.730724613821478
Encrypted:	false
SSDEEP:	384:Y+WNw/jWWZ7Tb2HRN7zSAUDX+iR9zn2QGVI:YNy77/iDUDuO9z21e
MD5:	37A882D98408133535E7103684E429F9
SHA1:	8100A14CDFAEBC115D6B9D02B532BD08372958B1
SHA-256:	83941C8E85CF46D570293DBBAB9904ABF150CBBC8D22C630D5286A689AD159E3
SHA-512:	4A66F8030A81036ABE64123C875E9034E0CF486BA4443A4B0AADDA3FE29AB23C61154D81DE3FCEBEB0E42D055A3FEA5BA791A7EECDBF1B40EEFDAD37203C7FEE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.............~-... ...@....... ...............................K....@.................................,-..O....@...................(...`.......-............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................`-......H.......P ..............@%..P....,......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID.......4...#Blob......................3..................................................q.....q.....^...........F.....F...D.F...a.F.....F...-.F.................X.....X.....X...).X...1.X...9.X...A.X...I.X...Q.X......./.....8.....W...#.`...+.{...3.....;.....C.....K.......................C...............................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\pl\System.Xaml.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	69792
Entropy (8bit):	5.864735126072338
Encrypted:	false
SSDEEP:	768:i8oOCK7e46Nd0tyOJ1232W1ZzF4M2zt192dlI5QOu7HC3laevjX9/iIDuO9zZ:Vlj6h2M2R+l85w2laAFiezZ
MD5:	3799D0A9791D6BB81EFEDC3D892ABB24
SHA1:	3D1532A4DC811EF537396A551F11F610DBF72999
SHA-256:	48916F916D78A41A9C2438F70F6FB927A50BD8255B415B39DF3B8A199EA2FE59
SHA-512:	DEDFFB88E3F55CEFB8F9767DCDB30DF92DB84B229A535D9E2024D9137CD351B4D8D088BDD9CCD80A7179C14D4B49886C20730CC41FAD2C5CB7D187EE4CC9DD4C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..............." ..0.................. ........... .......................@.......W....@.................................0...O.......L................(... ....................................................... ............... ..H............text........ ...................... ..`.rsrc...L...........................@..@.reloc....... ......................@..B................d.......H.......P ...............$..............................................BSJB............v4.0.30319......l...0...#~..........#Strings....d.......#US.h.......#GUID...x.......#Blob......................3..................................................Z.....Z.....G.........../...../...D./...a./...../...-./.................A.....A.....A...).A...1.A...9.A...A.A...I.A...Q.A......./.....8.....W...#.`...+.{...3.....;.....C.....K.....................z.,...............................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\pl\UIAutomationClient.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	20128
Entropy (8bit):	6.565302855536174
Encrypted:	false
SSDEEP:	384:PcQufSY3abpo4sWSJdVTb2HRN7+hH/6fR9zcC:EQkSY3epo4KV/iEQ9zb
MD5:	DC359D8A12ED9FEED965CB1ABCA32237
SHA1:	DAE172408B33702F1D3F3C6E132B0C3EB45A65CE
SHA-256:	D16885D1A3C654A707C7256E83DAF36E8D73BBD67EBAAE1FD3E16CDA0B830262
SHA-512:	818FB21999E7F8791D2B94B709B241FE1C5390BD7015D20E623A28F6AD9E7D84BEAE04AA39A1F5AA8A9CEB93A099606FF6F1D33796C6ADC6AD6EEDB8A246ED5D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...._..........." ..0.............f;... ...@....... ..............................(.....@..................................;..O....@...............&...(...`.......:............................................... ............... ..H............text...l.... ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B................H;......H.......P ..@............%......x:......................................BSJB............v4.0.30319......l...0...#~..........#Strings....x.......#US.\|.......#GUID...........#Blob......................3..................................................a.....a.....N...........6.....6...D.6...a.6.....6...-.6.................H.....H.....H...).H...1.H...9.H...A.H...I.H...Q.H.......................#.....+.....3.@...;.T...C.....K.......................3...............................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\pl\UIAutomationClientSideProviders.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21256
Entropy (8bit):	6.374892372268319
Encrypted:	false
SSDEEP:	384:sQJgYTXXbVQlhfWOCJTb2HRN7opR9zzSsSGBY:OYTXXnJ/ioD9zVq
MD5:	97BF0C0EDF697A98D257061B6DABA7D4
SHA1:	C6FBBA2A714B15E0CA5A3E6B27DCAA93FA5E1559
SHA-256:	6066E69F6978E4F2AE94FB23E7D69D7B100816D26681A740EFC69C4947315928
SHA-512:	5A110B61EE2669175DAB14CF45E4F03D7EEA2C33C87C3FEF665E2E98B16537028AE6E2E42C53949293355BA7D778F2D1471D1394330B6869E0C80AE6C4AB37BA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...g............." ..0.. ...........>... ...@....... ...............................{....@..................................>..O....@...............*...)...`.......>............................................... ............... ..H............text........ ... .................. ..`.rsrc........@......."..............@..@.reloc.......`.......(..............@..B.................>......H.......P ..............4%.......>......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID.......0...#Blob......................3..................................................n.....n.....[...........C.....C...D.C...a.C.....C...-.C.................U.....U.....U...).U...1.U...9.U...A.U...I.U...Q.U......./.....8.....W...#.`...+.{...3.....;.....C.....K.......................@...............................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\pl\UIAutomationProvider.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15624
Entropy (8bit):	6.710540588751488
Encrypted:	false
SSDEEP:	192:afuK8D3ih3BWHxYIWMtUuWXebPpUNTQHnhWgN7acW2DubwKUWX01k9z3AmZSlby:nK8LMBWzWMtUTb2HRN7fL2R9zdV
MD5:	7D547E75B64C2AFE2228EF4D4FAB0788
SHA1:	3C34B0E87916E119043CAF4DBA74BDF5E1ED1495
SHA-256:	3FE3797C2E22ABB8655C0123099C26570CEFA599E7DEBB8ACD5F245857D5628C
SHA-512:	4A024A168FF7D85F9F8864C51589DB8B92CDECB3E79439DDB86CD297B4A7957B2750DDC65E7A81442453000EB73A2319C0925FE93CE40502C90BA7B1DCE519F5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0.............J(... ...@....... ....................................@..................................'..O....@...................)...`.......'............................................... ............... ..H............text...P.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................,(......H.......P ..L............%......\'......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................c.....c.....P...........8.....8...D.8...a.8.....8...-.8.................J.....J.....J...).J...1.J...9.J...A.J...I.J...Q.J.......................#.....+.....3.@...;.T...C.....K.......................5...............................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\pl\UIAutomationTypes.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	18696
Entropy (8bit):	6.475952031831242
Encrypted:	false
SSDEEP:	192:CdX7c4p7GhO2nPd2buIWLJxRBJNuWXebPpUNTQHnhWgN7acWmBPjx6RMySX01k9Z:Wc4ghAbuIWl3lTb2HRN7ZeMR9z8cQT4l
MD5:	628DEDEE1D188EB48391E27ABF9E38C4
SHA1:	9124598F6F777F265FC114591449D09BA93DAABA
SHA-256:	19DB0FF1B5E581DA69445C3B0711DC22DF4853A1C7F9F21568B1BC804CFE5EFE
SHA-512:	60FFD54D319735DF1173E877D440E1958F3A6524163A22BB56967F9E34EBC69F7DFB80837DFE41AC877537723E76B20ADFC3A25A964213DB8E7AAF89297DB5B4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...-............." ..0..............4... ...@....... ..............................?"....@.................................l4..O....@..\|............ ...)...`......P4............................................... ............... ..H............text........ ...................... ..`.rsrc...\|....@......................@..@.reloc.......`......................@..B.................4......H.......P ..@............%..@....3......................................BSJB............v4.0.30319......l...0...#~..........#Strings....x.......#US.\|.......#GUID...........#Blob......................3..................................................`.....`.....M...........5.....5...D.5...a.5.....5...-.5.................G.....G.....G...).G...1.G...9.G...A.G...I.G...Q.G.......................#.....+.....3.@...;.T...C.....K.......................2...............................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\pl\WindowsBase.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	90896
Entropy (8bit):	5.6277712062461775
Encrypted:	false
SSDEEP:	1536:NHD1Vph3cu8ZPoAg8EExNWAJo/m9X3M1AmGwCxMqsdaNk84SKCq2aS3iznzO:NHNh3cu8ZuOLo/m60aSmni
MD5:	3D036B14EA0C1F67D5BAB9406911E6B2
SHA1:	EE39E17C725261367D16CB1943A11C9AEEBAFD8A
SHA-256:	13786B738B77FB4995F9ACCDE58D75190861EFA322B32635EC2BB88FECB2B78D
SHA-512:	2A9463B874F1FDEDA2E340957B796A228923CBB54B3FD95615C123774EC6F9207584A7239EA7C324282BBFD04D4545C41A36312AF89D88555C65986F580F2C4F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..."ds..........." ..0..0...........N... ...`....... ..............................e.....@.................................XN..O....`..L............:...)..........<N............................................... ............... ..H............text........ ...0.................. ..`.rsrc...L....`.......2..............@..@.reloc...............8..............@..B.................N......H.......P ..$...........t%..H(...M......................................BSJB............v4.0.30319......l...0...#~..........#Strings....d.......#US.h.......#GUID...x.......#Blob......................3..................................................Z.....Z.....G.........../...../...D./...a./...../...-./.................A.....A.....A...).A...1.A...9.A...A.A...I.A...Q.A.......................#.....+.....3.@...;.T...C.....K.....................z.,...............................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\6.0.28\pl\WindowsFormsIntegration.resources.dll

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16160
Entropy (8bit):	6.774945938302682
Encrypted:	false
SSDEEP:	384:QhL8NLRJWF0OW/D+I5kHRN79PKNbZR9zQoBJnN:QV8xRQF0L+tYFT9zpJN
MD5:	013A8DE7A0394F3ED12535FF84782655
SHA1:	6952B909FFFB9D1ABC8531DFDFA06530D5D2534D
SHA-256:	C7D24C646B124118D2D99973A3809A7A04862DF05D0A00AD09E96A62CE552C23
SHA-512:	B9AF5AD9EED3354426F1900F46BD308252B210F0F958EAD7A8ED593CB0F54E4F403446680439855573831D76543B3ACD1782013ADD865642A252301BCC41FA98
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0.............R+... ...@....... ...............................i....@..................................+..O....@.................. )...`...................................................... ............... ..H............text...X.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................4+......H.......P ..T............%......d......................................BSJB............v4.0.30319......l...0...#~..........#Strings............#US.........#GUID...........#Blob......................3..................................................f.....f.....S...........;.....;...D.;...a.;.....;...-.;.................M.....M.....M...).M...1.M...9.M...A.M...I.M...Q.M.......................#.....+.....3.@...;.T...C.....K.......................8...............................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\dotnetpkgtmp\version.dat

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8
Entropy (8bit):	2.75
Encrypted:	false
SSDEEP:	3:e:e
MD5:	252273CAE5F02561FF2DDEB75FA65FDB
SHA1:	364EF6ABCB1DA2189DC29D61F5EBFD2CF1F6D4C6
SHA-256:	D5E34425372A6A1AE0F0B222632CDBF58B29B3F9AF3D75AC5CCAD0AF99221C9E
SHA-512:	F2128A6030BE3EFC9CD28AA4057C961CA045A8A14E3F1CA25777F4BDA6DA3133D9E80DCE77AD94A4485E85E8DED7230CB18E6D71941828D6AA63AE0BB731CF14
Malicious:	false
Preview:	6.0.28..

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\servicepkg.7z

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	7-zip archive data, version 0.4
Category:	dropped
Size (bytes):	1812025
Entropy (8bit):	7.999917737204925
Encrypted:	true
SSDEEP:	24576:ekxlEZQA3Fhn1DnFUZnXoRfIj8nZf21Ckin/veONBR1X5bjYZrOTnkhMY3FfARfL:eSexUZnYRbZ+Eve+dB4inkhMIS20z
MD5:	927D42FA5B00A0BDA8E9604E74F25979
SHA1:	28AE8D3A7591F57DC20CA3F253E0D41831F0B299
SHA-256:	31CEEE1C53AC486B38C7D9C5FC62ED9928BC331DBA406113703720442EB309DD
SHA-512:	81F0508627BC78AF78793D6A04BAEC30E88A6DBF436E1BAD29A51974AC7BFE1BA8563FD6E6AC00B9DA6427899D5F22047ACC3D6A00E74356D732EFF224EDBC25
Malicious:	false
Preview:	7z..'.....H.........$.........a..j.?.].. .d..........&p].`..2#S_I...G^~._.I.!?.=fV.}y.P..Z.2Ae..u..$e.......v.....r....P..q.%...3.K...c....-.(B...2..l.>P..k.aL..FLi8.HG...@.k.fn..D...8{-.....]..L...d.M....t.gA.@.}.v.O.._.k..T{.h.v.KD..AB....d.K.n.Yy4h.\....Q.((..Byzd..E.).E.=kXB...........p..G.....4.)xUK.X7}..4...]...0ABT....q.I..1L.sO`..il{ng...,.....].-.'.Y.8E.._Gy..1..].~...... .<1.=.?/.....J......rO........Kr....j...7.......o.A..(...U..5..5.AK..8&.d-.QE4.p....D.$%U......`k\....EMS]\..<.w.Rz...'.eq.7..H..........t.Q.h.+...1.z.......pUYH@...n.z0"K..x.:_.5:.i..q=.;....%V._......5.=..k..nK..<.<..j.&W.Q.......+(.c..W......G$.]q.%..G.F....X..../X..uR(...M.2.L.S.@....'.....aE.ma&.aM.,8s`...Z....c.MAN{}........N.......[.l}.E.w......>.#.t....e.B.-..C.....}8./N.%J'...3)..%E..aY..K7..f......(.=.<..;....?..t+.%...".Vte88...o..r*Q-(:.`b.k.X...)M9.p....c......:.@1\|..v...=...%.KW.N.K.%L.a....;6..S1PGo.....z.]..)/..p...`4..,!..h.....f...Bl ......-<S.t

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\servicepkg\BaltimoreCyberTrustRoot.crt

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PEM certificate
Category:	dropped
Size (bytes):	1282
Entropy (8bit):	5.92352767181311
Encrypted:	false
SSDEEP:	24:LrRCemxg0k6qVKiBaegdIuMcI6OW1r+psbW6RP2GhS6/BeSA:Lr/yxk6IKWS+8IOxZRP22nY
MD5:	379A301592736712C9A60676C50CF19B
SHA1:	C103790503BF8C2FF3F119ADEE027EBB429B9D21
SHA-256:	CC7400692BD90E1B5FC44E11C8DD7C788CBB462F52EA3F3DECB579E4D51EB268
SHA-512:	DEC25A31F2930EB575A43E654C29F170C261C1C4516767C0E71CC172AD6AD115914FB58D9CD79F681FF3D7C6BAA6B7C0D6DE99DE09D7582C9807AE436F15572F
Malicious:	false
Preview:	-----BEGIN CERTIFICATE-----..MIIDdzCCAl+gAwIBAgIEAgAAuTANBgkqhkiG9w0BAQUFADBaMQswCQYDVQQGEwJJ..RTESMBAGA1UEChMJQmFsdGltb3JlMRMwEQYDVQQLEwpDeWJlclRydXN0MSIwIAYD..VQQDExlCYWx0aW1vcmUgQ3liZXJUcnVzdCBSb290MB4XDTAwMDUxMjE4NDYwMFoX..DTI1MDUxMjIzNTkwMFowWjELMAkGA1UEBhMCSUUxEjAQBgNVBAoTCUJhbHRpbW9y..ZTETMBEGA1UECxMKQ3liZXJUcnVzdDEiMCAGA1UEAxMZQmFsdGltb3JlIEN5YmVy..VHJ1c3QgUm9vdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKMEuyKr..mD1X6CZymrV51Cni4eiVgLGw41uOKymaZN+hXe2wCQVt2yguzmKiYv60iNoS6zjr..IZ3AQSsBUnuId9Mcj8e6uYi1agnnc+gRQKfRzMpijS3ljwumUNKoUMMo6vWrJYeK..mpYcqWe4PwzV9/lSEy/CG9VwcPCPwBLKBsua4dnKM3p31vjsufFoREJIE9LAwqSu..XmD+tqYF/LTdB1kC1FkYmGP1pWPgkAx9XbIGevOF6uvUA65ehD5f/xXtabz5OTZy..dc93Uk3zyZAsuT3lySNTPx8kmCFcB5kpvcY67Oduhjprl3RjM71oGDHweI12v/ye..jl0qhqdNkNwnGjkCAwEAAaNFMEMwHQYDVR0OBBYEFOWdWTCCR1jMrPoIVDaGezq1..BE3wMBIGA1UdEwEB/wQIMAYBAf8CAQMwDgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3..DQEBBQUAA4IBAQCFDF2O5G9RaEIFoN27TyclhAO992T9Ldcw46QQF+vaKSm2eT92..9hkTI7gQCvlYpNRhcL0EYWoSihfVCr3FvDB81ukMJY2GQE/

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\servicepkg\DigiCertEVRoot.crt

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PEM certificate
Category:	dropped
Size (bytes):	1390
Entropy (8bit):	5.911184813749117
Encrypted:	false
SSDEEP:	24:LrisNQ5g1nVDS0kvDjMeDGF3KgipYH4IHyIixpSJPo8WKlFoEEhA:LrjqiDHkvDjBDG1KcH4ISIi3SJPHo3i
MD5:	D25E0F479B9601EDF2C9C2DAD7BA2706
SHA1:	2F1D0001E47394F4C4DEEC9645C5F2DF99F91A95
SHA-256:	63FF360AAFDE5FF959FB9671EC27002F99CBFAE4907B410046B6A1B0F51CBA9E
SHA-512:	3BA164DAD3CADF1EA9F0C555695E4D39CBA47612599F547D0D0D59014577995C0DDBFF0EF6A5E436867454DA02D500136B54C034C2223586271B26108B2CFB5E
Malicious:	false
Preview:	-----BEGIN CERTIFICATE-----..MIIDxTCCAq2gAwIBAgIQAqxcJmoLQJuPC3nyrkYldzANBgkqhkiG9w0BAQUFADBs..MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3..d3cuZGlnaWNlcnQuY29tMSswKQYDVQQDEyJEaWdpQ2VydCBIaWdoIEFzc3VyYW5j..ZSBFViBSb290IENBMB4XDTA2MTExMDAwMDAwMFoXDTMxMTExMDAwMDAwMFowbDEL..MAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3..LmRpZ2ljZXJ0LmNvbTErMCkGA1UEAxMiRGlnaUNlcnQgSGlnaCBBc3N1cmFuY2Ug..RVYgUm9vdCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMbM5XPm..+9S75S0tMqbf5YE/yc0lSbZxKsPVlDRnogocsF9ppkCxxLeyj9CYpKlBWTrT3JTW..PNt0OKRKzE0lgvdKpVMSOO7zSW1xkX5jtqumX8OkhPhPYlG++MXs2ziS4wblCJEM..xChBVfvLWokVfnHoNb9Ncgk9vjo4UFt3MRuNs8ckRZqnrG0AFFoEt7oT61EKmEFB..Ik5lYYeBQVCmeVyJ3hlKV9Uu5l0cUyx+mM0aBhakaHPQNAQTXKFx01p8VdteZOE3..hzBWBOURtCmAEvF5OYiiAhF8J2a3iLd48soKqDirCmTCv2ZdlYTBoSUeh10aUAsg..EsxBu24LUTi4S8sCAwEAAaNjMGEwDgYDVR0PAQH/BAQDAgGGMA8GA1UdEwEB/wQF..MAMBAf8wHQYDVR0OBBYEFLE+w2kD+L9HAdSYJhoIAu9jZCvDMB8GA1UdIwQYMBaA..FLE+w2kD+L9HAdSYJhoIAu9jZCvDMA0GCSqGSIb3DQEBBQU

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\servicepkg\DigiCertGlobalRootCA.crt

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PEM certificate
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	5.941090669891607
Encrypted:	false
SSDEEP:	24:LrgANQ5gS6yWTVdUbcfQZxZTmBx/bsbN4a3newc4ROT9WPNwT//Uzubfy3On1VU8:LrgAq/1emNPZaaNRc4RAMlwz/Uz26nXs
MD5:	C89852063EA71D38DD5B6C5C6294B26E
SHA1:	1DFAC17ADF3867C9A28ACB329DE8D16D8B412D8B
SHA-256:	F024A876236935DCD7232D5D5D747823FE75B51F9F108B2A8E5BACDCF818A07E
SHA-512:	2FF14B1B67AC9AD24EBFE6E2F4A01711651361F09E3AFD59BD69D9701D3BBF8802E6B9759E1ADF5E22194F43AB064299519479C241AAEB319BA79D5445318AAC
Malicious:	false
Preview:	-----BEGIN CERTIFICATE-----..MIIDrzCCApegAwIBAgIQCDvgVpBCRrGhdWrJWZHHSjANBgkqhkiG9w0BAQUFADBh..MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3..d3cuZGlnaWNlcnQuY29tMSAwHgYDVQQDExdEaWdpQ2VydCBHbG9iYWwgUm9vdCBD..QTAeFw0wNjExMTAwMDAwMDBaFw0zMTExMTAwMDAwMDBaMGExCzAJBgNVBAYTAlVT..MRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5j..b20xIDAeBgNVBAMTF0RpZ2lDZXJ0IEdsb2JhbCBSb290IENBMIIBIjANBgkqhkiG..9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4jvhEXLeqKTTo1eqUKKPC3eQyaKl7hLOllsB..CSDMAZOnTjC3U/dDxGkAV53ijSLdhwZAAIEJzs4bg7/fzTtxRuLWZscFs3YnFo97..nh6Vfe63SKMI2tavegw5BmV/Sl0fvBf4q77uKNd0f3p4mVmFaG5cIzJLv07A6Fpt..43C/dxC//AH2hdmoRBBYMql1GNXRor5H4idq9Joz+EkIYIvUX7Q6hL+hqkpMfT7P..T19sdl6gSzeRntwi5m3OFBqOasv+zbMUZBfHWymeMr/y7vrTC0LUq7dBMtoM1O/4..gdW7jVg/tRvoSSiicNoxBN33shbyTApOB6jtSj1etX+jkMOvJwIDAQABo2MwYTAO..BgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUA95QNVbR..TLtm8KPiGxvDl7I90VUwHwYDVR0jBBgwFoAUA95QNVbRTLtm8KPiGxvDl7I90VUw..DQYJKoZIhvcNAQEFBQADggEBAMucN6pIExIK+t1EnE9SsPT

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\servicepkg\MBAMService.exe

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	8884840
Entropy (8bit):	5.980130191818927
Encrypted:	false
SSDEEP:	49152:zSRXrjOYBuH25NgUc8xAv7aruVoUhZBM+Je9yXFXmbuumsgBJhqyjQD+DZhg3uQj:MsW/iZHvy2hqycD+NW+GarO3XhnR3
MD5:	B9251F9808C8ADE391E452F12F87E20D
SHA1:	954410042B92A87CD9383995B52F76F5148DA386
SHA-256:	21E69DB89F7E409E000BA45A020F24FA99903B7A1CFB1FE998F1C5815BCCDA04
SHA-512:	142E93C83748DBE7E978BBA3F82677E7E69AE02B25B196647644DC964E1B1D63CFD967729765A9E90261226026483D5C29B29D6DF5B2E924A2FCE9EF673C671A
Malicious:	false
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......q.bT5...5...5...~...=...~.......5...4...3v..&...3v..'...3v..X...~........w......[v.. ...5... ...~.......[v..}...[v......[v..4...5...7...[v..4...Rich5...........................PE..d...O..e.........."....&.nJ...:.....toC........@..........................................`...................................................x......`.. k....\|..E.....h...........no.T....................po.(....lo.@.............J..............................text...NmJ......nJ................. ..`.rdata..&.-...J...-..rJ.............@..@.data........Px.."...:x.............@....pdata...E....\|..F...\{.............@..@_RDATA.......P......................@..@.rsrc... k...`...l..................@..@.reloc.............................@..B........................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\servicepkg\SectigoRootCA.crt

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PEM certificate
Category:	dropped
Size (bytes):	1542
Entropy (8bit):	5.941736373473161
Encrypted:	false
SSDEEP:	48:LrNF4xUoh2XnooKkEvRldemX+TrtEv+Q7vQmvt:LrLnoo/E5q6A0Qi
MD5:	B821EE78C10EDA973C40A382FA5CA457
SHA1:	F40C413C6D17C4C4195D30A9A1454D186710727C
SHA-256:	028FD01CCC988386D6718EDA921F6131044A61C06E0F84574D4911918E4659F3
SHA-512:	EA4B9B5E8D7EA4E9C137FC21B36112C01905AAD771AD09C408AB94D7EB7D0458A60F3730B5A5AF6CBFE8D6167C28132483B68900E7C8DB55A4430E7BBD56D61F
Malicious:	false
Preview:	-----BEGIN CERTIFICATE-----..MIIEMjCCAxqgAwIBAgIBATANBgkqhkiG9w0BAQUFADB7MQswCQYDVQQGEwJHQjEb..MBkGA1UECAwSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYDVQQHDAdTYWxmb3JkMRow..GAYDVQQKDBFDb21vZG8gQ0EgTGltaXRlZDEhMB8GA1UEAwwYQUFBIENlcnRpZmlj..YXRlIFNlcnZpY2VzMB4XDTA0MDEwMTAwMDAwMFoXDTI4MTIzMTIzNTk1OVowezEL..MAkGA1UEBhMCR0IxGzAZBgNVBAgMEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UE..BwwHU2FsZm9yZDEaMBgGA1UECgwRQ29tb2RvIENBIExpbWl0ZWQxITAfBgNVBAMM..GEFBQSBDZXJ0aWZpY2F0ZSBTZXJ2aWNlczCCASIwDQYJKoZIhvcNAQEBBQADggEP..ADCCAQoCggEBAL5AnfRu4ep2hxxNRUSOvkbIgwadwSr+GB+O5AL686tdUIoWMQua..BtDFcCLNSS1UY8y2bmhGC1Pqy0wkwLxyTurxFa70VJoSCsN6sjNg4tqJVfMiWPPe..3M/vg4aijJRPn2jymJBGhCfHdr/jzDUsi14HZGWCwEiwqJH5YZ92IFCokcdmtet4..YgNW8IoaE+oxox6gmf049vYnMlhvB/VruPsUK6+3qszWY19zjNoFmag4qMsXeDZR..rOme9Hg6jc8P2ULimAyrL58OAd7vn5lJ8S3frHRNG5i1R8XlKdH5kBjHYpy+g8cm..ez6KJcfA3Z3mNWgQIJ2P2N7Sw4ScDV7oL8kCAwEAAaOBwDCBvTAdBgNVHQ4EFgQU..oBEKIz6W8Qfs4q8p74Klf9AwpLQwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQF..MAMBAf8wewYDVR0fBHQwcjA4oDagNIYyaHR0cDovL2NybC5

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\servicepkg\arwversion.dat

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.6612262562697895
Encrypted:	false
SSDEEP:	3:B6Iv:B6Iv
MD5:	C7AD3A6C5EC3F35E2E492196EAD8B6F3
SHA1:	67615A4D0987C1387FF1FED5FDF65546CA5CABB3
SHA-256:	5C65D545BABF5A5DF5FEE50C765D21AD1DC83BB3D6ED0EB616007976C7DC605F
SHA-512:	A0E1EB34718A6E67B0FE2A498C148B159459F98F2B3C80D9B56B406BEADE3FC34CE87EBC2B5F1AC28AEE6B34A6298FFB63E9DAA926FF712B4A328C05B96DEDBB
Malicious:	false
Preview:	0.9.19.109 ..

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\servicepkg\mbamelam.cat

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	data
Category:	dropped
Size (bytes):	11087
Entropy (8bit):	7.300621627947781
Encrypted:	false
SSDEEP:	192:2jijKjmjlydFvJCjvyyKwnsFWQFJFMFETTbbrmjX01k9z3AzsGpZH:OvornsFRnWFE3X+R9zusGpZH
MD5:	60608328775D6ACF03EAAB38407E5B7C
SHA1:	9F63644893517286753F63AD6D01BC8BFACF79B1
SHA-256:	3ED5A1668713EF80C2B5599B599F1434AD6648999F335CF69757EA3183C70C59
SHA-512:	9F65212121B8A5D1A0625C3BAA14EF04A33B091D26F543324333E38DCDB903E02CCC4D009E22C2E85D2F61D954E0B994C2896E52F685003A6EF34758F8A650C7
Malicious:	false
Preview:	0.+K..*.H........+<0.+8...1.0...`.H.e......0.....+.....7......0...0...+.....7.....B....^.F...D.#.\..220328224342Z0...+.....7.....0..X0.... R.G..)..O...o..f.M..Q.....y1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........m.b.a.m.e.l.a.m...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... R.G..)..O...o..f.M..Q.....y0.... y6&.@.....x.\|....$x...y...2.A...1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........m.b.a.m.e.l.a.m...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... y6&.@.....x.\|....$x...y...2.A...0.....c4..X2.XO.t......m1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........m.b.a.m.e.l.a.m...i.n.f...0...........F.2.j/M..hA1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........m.b.a.m.e.l.a.m...s.y.s......C0..?0J.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\servicepkg\mbamelam.inf

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	2163
Entropy (8bit):	5.19841611544481
Encrypted:	false
SSDEEP:	48:u/xqgH4uUeM6O/aC5Hho1eMnoByFzsYlr:uJqgFUN6OTHhohsOplr
MD5:	C481AD4DD1D91860335787AA61177932
SHA1:	81633414C5BF5832A8584FB0740BC09596B9B66D
SHA-256:	793626D240FD8EEFC81B78A57C8DFE12EA247889B6F07918E9FD32A7411AA1C3
SHA-512:	D292E028936412F07264837D4A321ECFA2F5754D4048C8BCF774A0E076E535B361C411301558609D64C71C1CE9B19E6041EFA44D201237A7010C553751E1E830
Malicious:	false
Preview:	;;;..;;; MbamElam..;;;....[Version]..Signature = "$Windows NT$"..Class..= "MalwarebytesElam"..ClassGuid.= {dfcb9a84-a210-465c-8e8f-7f3f2e64458d}..Provider = %ManufacturerName%..DriverVer = 03/02/2016,3.1.0.10..CatalogFile = MbamElam.cat....[DestinationDirs]..DefaultDestDir = 12..MiniFilter.DriverFiles = 12 ;%windir%\system32\drivers....[SignatureAttributes]..MbamElam.sys=SignatureAttributes.Elam....[SignatureAttributes.Elam]..Elam=true ..;;..;; Default install sections..;;....[DefaultInstall]..OptionDesc = %ServiceDescription%..CopyFiles = MbamElam.CopyDriverFiles..[DefaultInstall.Services]..AddService = %ServiceName%,,MbamElam.Service....;;..;; Default uninstall sections..;;..[DefaultUninstall]..DelFiles = MbamElam.DelDriverFiles....[DefaultUninstall.Services]..DelService = %ServiceName%,0x200 ;Ensure service is stopped before deleting..;..; Services Section..;..[MbamElam.Service]..DisplayName = MbamElam..Description

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\servicepkg\mbamelam.sys

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	21480
Entropy (8bit):	6.332949178488545
Encrypted:	false
SSDEEP:	384:HO/iZbhL/Uqqn2+s/+8gpUad+JR9zuspd:PtUR2h5adk9zuK
MD5:	9E77C51E14FA9A323EE1635DC74ECC07
SHA1:	A78BDE0BD73260CE7AF9CDC441AF9DB54D1637C2
SHA-256:	B5619D758AE6A65C1663F065E53E6B68A00511E7D7ACCB3E07ED94BFD0B1EDE0
SHA-512:	A12CCF92BEAD694F5D3CBA7FF7E731A2F862198EFC338EFC7F33A882FE0EB7499FB3FB533538D0A823E80631A7CA162962FBDFD78E401E3255672910B7140186
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%^c.a?.Ha?.Ha?.H.Y.Ib?.H.Y.Id?.H.Y.Ie?.H.Y.If?.Ha?.Ht?.H.W.I`?.H.W.H`?.H.W.I`?.HRicha?.H........................PE..d....2Bb.........."............................@..........................................`A................................................dQ..P....`..H....@...........%...p..$.... ..8............................!............... ...............................text............................... ..h.rdata..0.... ......................@..H.data........0......................@....pdata.......@......................@..HINIT....\....P...................... ..b.rsrc...H....`......."..............@..B.reloc..$....p.......,..............@..B........................................................................................................................................................................................................................

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\servicepkg\mbtun.crt

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PEM certificate
Category:	dropped
Size (bytes):	1872
Entropy (8bit):	5.923041130965695
Encrypted:	false
SSDEEP:	48:LrZ2q90OQTn03S6DsKfugdVSVhZy90tixV3bcnRl:Lr3h40i6nfFs690tOl+
MD5:	999947F703B1F6B7550C3C61709676D7
SHA1:	8A56B23385CEF7DEE59321A7DB0BB4E737A36BC0
SHA-256:	015FF65C00D6D109B034685987D2E4892158D893677855255F9CF52E7BE60188
SHA-512:	A5D3A54B1D0CD45EB79F5B4BCC8379169BB471A9007EE5A0CABCA36E02F48F4229AB3185D5C7E7575269C5CD078C7156FC62E83DF51AA4B10C1C6AD4E55206AF
Malicious:	false
Preview:	-----BEGIN CERTIFICATE-----..MIIFIjCCBAqgAwIBAgIQCKLsTnignhdLGS5VNZhLWTANBgkqhkiG9w0BAQUFADBv..MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3..d3cuZGlnaWNlcnQuY29tMS4wLAYDVQQDEyVEaWdpQ2VydCBBc3N1cmVkIElEIENv..ZGUgU2lnbmluZyBDQS0xMB4XDTE5MDcwMzAwMDAwMFoXDTIxMDgyMDEyMDAwMFow..bjELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3JuaWExFDASBgNVBAcTC1Nh..bnRhIENsYXJhMRkwFwYDVQQKExBNYWx3YXJlYnl0ZXMgSW5jMRkwFwYDVQQDExBN..YWx3YXJlYnl0ZXMgSW5jMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA..nfCyP+mQ1KSN4DsR6h0HmFvwAhsHFWEz1MM3slqrDYQePKP6TE4pCq2mx7M116VA..2QJUr3klmt7nZ4xLYC1x25AWLBFZnUQanYuWIorSFAk74h+WoSxgkQxaS5gc/R4V..JDywm+8t+2Cwj3eRDkSCU/ywdyCO+pMyyqybY5RxpokncMhXb7gwTdtuIhjBtgrs..0nsfwdwfaoyjYvayQS8k0mccOQji4aNy3jsu9MrCoQmXBn68yY2H6aLFXffkVZqo..nsf9BjlnI6+OMJEVA/wqSq+8zcNS8gzOcq2R+eN3Ws5k2yyhA7tfd16AU8Hje1ZA..OkBVyRihunxzadK+oj3FZwIDAQABo4IBuTCCAbUwHwYDVR0jBBgwFoAUe2jOKarA..F75JeuHlP9an90WPNTIwHQYDVR0OBBYEFCIv60e10kaKxU4TkY4tKR6JgWP+MA4G..A1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzB

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\servicepkg\msrootca2020.crt

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PEM certificate
Category:	dropped
Size (bytes):	2102
Entropy (8bit):	5.999282179616516
Encrypted:	false
SSDEEP:	48:LrXubslmwU3Ex7OuNpHdXbykprkRWKhW26b2wKVrNjNHPnbbmwUFIyxmVhJ:LrX+uYC7OufdrykprmHI7FK1PnH37PzJ
MD5:	77AC2A1AE404C2E29334C4D0CE29AC0E
SHA1:	C8EECD58D3B43A2DDEC5054EF9EACDF0C2940E62
SHA-256:	626727D3F4FB4C4EF816648217966D5EB2A028AFE03C801788B1834A456B48E8
SHA-512:	40BF30C83DB166803798FDFBDCBC04D6D01BCE7EC569D2F24089BF1B6D81F8694876D43C29CE78359D1101D40386044A0B9F11AEDABB3A6348EB1A7DA6762FD9
Malicious:	false
Preview:	-----BEGIN CERTIFICATE-----..MIIFzDCCA7SgAwIBAgIQVJjS0dRbGZVIE3nIEcCHmTANBgkqhkiG9w0BAQwFADB3..MQswCQYDVQQGEwJVUzEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMUgw..RgYDVQQDEz9NaWNyb3NvZnQgSWRlbnRpdHkgVmVyaWZpY2F0aW9uIFJvb3QgQ2Vy..dGlmaWNhdGUgQXV0aG9yaXR5IDIwMjAwHhcNMjAwNDE2MTgzNjE2WhcNNDUwNDE2..MTg0NDQwWjB3MQswCQYDVQQGEwJVUzEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBv..cmF0aW9uMUgwRgYDVQQDEz9NaWNyb3NvZnQgSWRlbnRpdHkgVmVyaWZpY2F0aW9u..IFJvb3QgQ2VydGlmaWNhdGUgQXV0aG9yaXR5IDIwMjAwggIiMA0GCSqGSIb3DQEB..AQUAA4ICDwAwggIKAoICAQCzkSoHgwZn/Z6d4MfAt6TmQgR/D6bbX/vVWtdFoPt3..C/CA86ZtWk15U9ighoRXRSDHolT7x6K/isduNfOiFcQvTuNKhZZJDf++mdgU9rwn..B+5Cmyv1C5IG5P1pE2WokXLymITrgz0O5NdxEkghyw3t9kdJt5v5yccXtoRP/7is..mtdzZ0mF44a9N0DQJYbU3rXCbWJq1al4vC1vSfnlbBQU/RTH02UWN97LbrxeKY39..YpsVLNYF5rmJMjOjYsfX1lJnCMQu9FYrnguHzOyntKaq6wXNGVelOgsEJxyRZ54t..Yi0vHr7awCDLBBnKM/uJvpjicqByNb554ZyDb+RtF2+Q8z0AhnU4jtDgSZq729P4..MMrVV4hoTXLTv21/cdj9vQ2ukmRIt1tveSa1zZuVIYTR7w8yPXtXjPNFB0x84F4Y..DjV2i22eyzZ0qwX44HNdMlaUZ5clCsY1PZSX58FEi4D9wfj

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\servicepkg\srvversion.dat

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	2.4193819456463714
Encrypted:	false
SSDEEP:	3:ekg2:eX2
MD5:	35789C7AD83C065167201F3824B71A39
SHA1:	1C7A9B3214D58CB93ED2BC856431083DF2B6D674
SHA-256:	E02D0BF83E0533A612AFAB6BEF6E564DA94D0F9D2F7A5379F65E563399C08AAE
SHA-512:	86AF0B7DA8A43781AE8FA98D085CE4BC4C3A8240A99578963F1BBD87B0655523E48E9E374B5CD68EECC70328628AE08C237969AFD7AEF4D60FC08A0D22DD8167
Malicious:	false
Preview:	5.1.2.109

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\servicepkg\starfieldClass2CA.crt

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PEM certificate
Category:	dropped
Size (bytes):	1492
Entropy (8bit):	5.965208387944303
Encrypted:	false
SSDEEP:	24:LrgtDQ2XXkZwdiNLikQLrcXkZraeOpAhscUb862NOI7/JIOhUosXsWHXa9G8KPoR:LriQ2nkuYNOkQPkk5aeOpAhsGN595hU8
MD5:	7FE5FAFC33CE6E6F97E73BC5071BC3CE
SHA1:	9EA40194CD3610F746F9FADEE86D8E57E7905D2E
SHA-256:	64E8C4BF59964857ADCD42001E719C1764A7F060D52B170982504E07BD26246B
SHA-512:	4578F75AA7BD65E5932C9D851299F1EC71BCC6C3E70361A9DF76053532F246E026DE1CBFDFDC8AC285BC5C9EB32FCC39CDCD405995734F3D3256C61CFBAECA09
Malicious:	false
Preview:	-----BEGIN CERTIFICATE-----..MIIEDzCCAvegAwIBAgIBADANBgkqhkiG9w0BAQUFADBoMQswCQYDVQQGEwJVUzEl..MCMGA1UEChMcU3RhcmZpZWxkIFRlY2hub2xvZ2llcywgSW5jLjEyMDAGA1UECxMp..U3RhcmZpZWxkIENsYXNzIDIgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMDQw..NjI5MTczOTE2WhcNMzQwNjI5MTczOTE2WjBoMQswCQYDVQQGEwJVUzElMCMGA1UE..ChMcU3RhcmZpZWxkIFRlY2hub2xvZ2llcywgSW5jLjEyMDAGA1UECxMpU3RhcmZp..ZWxkIENsYXNzIDIgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwggEgMA0GCSqGSIb3..DQEBAQUAA4IBDQAwggEIAoIBAQC3Msj+6XGmBIWtDBFk385N78gDGIc/oav7PKaf..8MOh2tTYbitTkPskpD6E8J7oX+zlJ0T1KKY/e97gKvDIr1MvnsoFAZMej2YcOadN..+lq2cwQlZut3f+dZxkqZJRRU6ybH838Z1TBwj6+wRir/resp7defqgSHo9T5iaU0..X9tDkYI22WY8sbi5gv2cOj4QyDvvBmVmepsZGD3/cVE8MC5fvj13c7JdBmzDI1aa..K4UmkhynArPkPw2vCHmCuDY96pzTNbO8acr1zJ3o/WSNF4Azbl5KXZnJHoe0nRrA..1W4TNSNe35tfPe/W93bC6j67eA0cQmdrBNj41tpvi/JEoAGrAgEDo4HFMIHCMB0G..A1UdDgQWBBS/X7fRzt0fhvRbVazc1xDCDqmI5zCBkgYDVR0jBIGKMIGHgBS/X7fR..zt0fhvRbVazc1xDCDqmI56FspGowaDELMAkGA1UEBhMCVVMxJTAjBgNVBAoTHFN0..YXJmaWVsZCBUZWNobm9sb2dpZXMsIEluYy4xMjAwBgNVBAs

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\servicepkg\starfieldrootcag2_new.crt

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	Certificate, Version=3 Certificate, Version=00
Category:	dropped
Size (bytes):	993
Entropy (8bit):	7.262246702070581
Encrypted:	false
SSDEEP:	24:jM1niUl251niUlZ7iXNFf0fKG3cBf3KA0:YniU4niUzinoEfaA0
MD5:	D63981C6527E9669FCFCCA66ED05F296
SHA1:	B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E
SHA-256:	2CE1CB0BF9D2F9E102993FBE215152C3B2DD0CABDE1C68E5319B839154DBB7F5
SHA-512:	5FADA52FF721F4F7F14F5A70500531FA7B131D1203EABB29B5C85A39D67CF358287D9D5B9104C8517B9757DBA58DF9527D07DC9A82F704B8961F8473CDD92AE7
Malicious:	false
Preview:	0...0..........0....H........0..1.0...U....US1.0...U....Arizona1.0...U....Scottsdale1%0#..U....Starfield Technologies, Inc.1200..U...)Starfield Root Certificate Authority - G20...090901000000Z..371231235959Z0..1.0...U....US1.0...U....Arizona1.0...U....Scottsdale1%0#..U....Starfield Technologies, Inc.1200..U...)Starfield Root Certificate Authority - G20.."0....H.............0..................o[.H.y..aV..G...=5..C..i..... ..Iw2)V....".r.'a...Z..n...,.[.t.k_...R.FU..u....T.K.UrW....qY..(.t.H.l.....d7y...F^..mSLb....c.:...y..at.&.@c.rj......u.7....Y.b._._e0...MvZ.v^4..V........21\|..._..k.I\....c[.v.Vb.Kt...&...Y.................B0@0...U.......0....0...U...........0...U......\|.2...0..}h.b....['0....H..............Y.%O.o..;....9.v..^.(.mb]....u8.4j...&Q.,..-n. J...g{1.g....&.C.J1.......7."....{R.k.;..yQN..g...<Fz..}.X.m.0..$...........B.7..dY. w8.2>8.u.s.h.........~.~...-.......J...(...Tx.!q..}.....a=..."..{..dE.;@..}\|2...X.}.Ysd.6t^%..f...9..*.P...i.

C:\Windows\Temp\MBInstallTemp1a8fa81bfc8a11eeb05cecf4bbea1588\servicepkg\wintun.crt

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
File Type:	PEM certificate
Category:	dropped
Size (bytes):	2050
Entropy (8bit):	5.897164467880051
Encrypted:	false
SSDEEP:	48:LrehYqqlF3oWikiYxQjZrtJ/OKhDRnrJZn0GlzPd3A05:Lr3ykxsNeKvJZn0GBPdd5
MD5:	AE3215591B7683F321AD9225078A83CA
SHA1:	F46509C1B148971613A21F6D974A88CF5A243FB4
SHA-256:	902BE7B0C43F00B84CCBF56B21860F981667BF95F9B98BDEEC7613D265614699
SHA-512:	6C80A527273DFDAEBEC3CF4911DBA42B5D86E1BC4F1A9DAF04FA75A0E573BAA04EAE2AA5037EB20F7033F814BB92A486EE407938E3E5E1BD0C44C4218C37685E
Malicious:	false
Preview:	-----BEGIN CERTIFICATE-----..MIIFpTCCBI2gAwIBAgIQBmPV/KcoiC82/xvfXYXwujANBgkqhkiG9w0BAQsFADBs..MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3..d3cuZGlnaWNlcnQuY29tMSswKQYDVQQDEyJEaWdpQ2VydCBFViBDb2RlIFNpZ25p..bmcgQ0EgKFNIQTIpMB4XDTE4MTIxMDAwMDAwMFoXDTIxMTIxNDEyMDAwMFowgb8x..EzARBgsrBgEEAYI3PAIBAxMCVVMxFTATBgsrBgEEAYI3PAIBAhMET2hpbzEdMBsG..A1UEDwwUUHJpdmF0ZSBPcmdhbml6YXRpb24xEDAOBgNVBAUTBzQyMjc5MTMxCzAJ..BgNVBAYTAlVTMREwDwYDVQQIEwhDb2xvcmFkbzEQMA4GA1UEBxMHQm91bGRlcjEW..MBQGA1UEChMNV2lyZUd1YXJkIExMQzEWMBQGA1UEAxMNV2lyZUd1YXJkIExMQzCC..ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKbQKm0zJEAXF1TPUoDaQzsZ..FJtpbLfOX9vNS3Ulg4QSIefftYIlYGShe5MPFF0aPeipKG1IFcvLu2xJ+Me3LtfK..2vWrAvmI7lOSatlFv7yQKk9c1hOdLxpTMXqKGaViAExk8L5ZR2w4V/rz/ooVZVBI..mULtd+5zjhVwVBxikI8N0wQK58rf+uhiZffBTIlEs/AeV/sPG1GatUOnyJQ/xZxK..wxIR25qfPPpvlNrtWRzWRI5Wa/xQzCsb/+mylOkfaFS/dDbSHrfOzk70sH95Ohvx..x3zIAEZJIAvxtp5tU1uHYrCcPY4Ze8Lco/lrqx54zEu/eIyjtt2K7Nihks2YGQEC..AwEAAaOCAe0wggHpMB8GA1UdIwQYMBaAFI/ofvBtMmoABSP

C:\Windows\Temp\mb_errors999.log

Process:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	337
Entropy (8bit):	4.949067307959279
Encrypted:	false
SSDEEP:	6:1CgWO937yEsLCulGZI4Cx9V1fLCulGZI4Cx9V1fLWjI4Cdm9//8hgOBFsT8jI4C7:1CgW84LKXCxFfLKXCxFfLCZCI//CoMZO
MD5:	B3DBE2F07CC77CBD5EB6CC099961837A
SHA1:	AC183401D1F747E20891DA681CE76A1E2C4EA2FD
SHA-256:	F9B8414592FF88462F6F04B0376F3B51E9AF00BD9DDEFC18F331AC69B23EF4C4
SHA-512:	8A6CC61FB6A85FFB62FD693F86341C24F59440BB23F88F3B9A2F2CC91C8AF67F7B7E639AB148A263134CB16487080E53420E74EA9F6DDC73D7C8BDD351262F1D
Malicious:	false
Preview:	2024-04-17T09:15:17.474403+02:00 : Uninstalling service: MBAMService..2024-04-17T09:15:17.490033+02:00 : Installing service: MBAMService..2024-04-17T09:15:17.490033+02:00 : Installing ELAM driver..2024-04-17T09:15:17.646288+02:00 : successfully installed ELAM driver..2024-04-17T09:15:17.693152+02:00 : CreateProtectedService succeeded..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.0522420857261565
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	MBSetup.exe
File size:	2'589'624 bytes
MD5:	b6d8b7e6f74196f62caba2ca77a7ae91
SHA1:	6ac9c99f084b5772440e2f135b8d5365f7f45314
SHA256:	74b0bf9c17091ab1c6c61af0aefbc599f1ecc0fff6dee0144a3dfd5cd1f5e18f
SHA512:	ad58bc7b626a13606e3f44df7188b2420e0f31ecb55632eac4b6a05dc1574f1ec1b0ef6b52e11832713c6f8f91c807fe3a815699d0748284993ecc54f2823044
SSDEEP:	49152:/5wZat2ranBQjvaq/Gtl8StQyfvE0Z3R0nxiIq2ddBzOnX:/5wZauUBQjvL0SKtQRq2cnX
TLSH:	24C58D21B2D14124E5B3D631297DB7EB4A76BC256F35418F32D8B63C0B72AC09D36B26
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........Lo.."<.."<.."<..!=.."<..'=[."<..!=.."<..&=.."<..'=l."<..&=.."<..$=.."<..#=.."<..#< ."<H.+=.."<H..<.."<...<.."<H. =.."<Rich.."

File Icon


Icon Hash:	70e8abaa8eccf830

Static PE Info

General

Entrypoint:	0x46ee6e
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x65F9D006 [Tue Mar 19 17:48:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	63ccd71a76a39a85385ce6d1810f26c1

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=Sectigo RSA Code Signing CA 2, O=Sectigo Limited, C=GB
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	23/03/2022 00:00:00 16/03/2025 23:59:59
Subject Chain	CN=Malwarebytes Inc., O=Malwarebytes Inc., S=California, C=US
Version:	3
Thumbprint MD5:	ECA3BD5C57433237AA1CE99AD78E0A95
Thumbprint SHA-1:	0A5E143F869DA652384B3EC6E735F6A7D9ADCD41
Thumbprint SHA-256:	DBD30BD9BD76C363B669665083A37B462F3F71F5DB2AB069965F9C7BECEF87D9
Serial:	00A657F778B31AE523D667131718D16EB2

Entrypoint Preview

Instruction
call 00007F3CD54313DAh
jmp 00007F3CD5430B2Fh
mov ecx, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], ecx
pop ecx
pop edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
push ecx
ret
mov ecx, dword ptr [ebp-10h]
xor ecx, ebp
call 00007F3CD54301CEh
jmp 00007F3CD5430C90h
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [004E606Ch]
xor eax, ebp
push eax
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax
ret
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [004E606Ch]
xor eax, ebp
push eax
mov dword ptr [ebp-10h], eax
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax
ret
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [004E606Ch]
xor eax, ebp
push eax
mov dword ptr [ebp-10h], esp
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xe4e84	0x64	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xec000	0x1790e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x26ca00	0xb9b8
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x266000	0xaa60	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xd4ca0	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xd4d10	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xbcc98	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xb9000	0x2ec	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0xe34d4	0x1a0	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xb7176	0xb7200	0bcd0b63a788c5045bafe1a702069ac3	False	0.4951738481228669	data	6.591464716657871	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xb9000	0x2cfd8	0x2d000	abc5fe1d45f9a7de85a94cb431abc237	False	0.3821940104166667	data	5.051474947374988	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xe6000	0x5bdc	0x4600	3d0a1c376e9427186aae54ffd515142d	False	0.21964285714285714	DOS executable (block device driver pyright)	4.695809721090909	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xec000	0x1790e0	0x179200	89fd5a692f5e405dbb1ec8adb3fbd385	False	0.602910331040769	data	7.129603492160749	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x266000	0xaa60	0xac00	fbabbe59a77eae86d1bb46d0e27e3cad	False	0.6624727470930233	data	6.680862239273161	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
BINARY	0x1b31d0	0x28da8	TrueType Font data, 18 tables, 1st "GDEF", 13 names, Microsoft, language 0x409, Copyright 2011 Google Inc. All Rights Reserved.RobotoBoldRoboto BoldVersion 2.137; 2017Roboto-Bo	English	United States	0.5296768178993163
BINARY	0x1dbf78	0x29144	TrueType Font data, 18 tables, 1st "GDEF", 13 names, Microsoft, language 0x409, Copyright 2011 Google Inc. All Rights Reserved.RobotoRegularVersion 2.137; 2017Roboto-RegularRob	English	United States	0.5236776417449186
PNG	0x111260	0x2514	PNG image data, 109 x 101, 8-bit/color RGBA, non-interlaced	English	United States	1.001158870627897
PNG	0x113778	0x3005	PNG image data, 134 x 124, 8-bit/color RGBA, non-interlaced	English	United States	1.0008948181892134
PNG	0x116780	0x40f6	PNG image data, 164 x 152, 8-bit/color RGBA, non-interlaced	English	United States	1.0009621166566447
PNG	0x11a878	0x61fe	PNG image data, 218 x 202, 8-bit/color RGBA, non-interlaced	English	United States	1.0005182173323766
PNG	0x120a78	0x15b	PNG image data, 32 x 32, 8-bit colormap, non-interlaced	English	United States	0.9971181556195965
PNG	0x120bd8	0x49a	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced	English	United States	1.0093378607809846
PNG	0x121078	0x5ef	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced	English	United States	1.0072416063199474
PNG	0x121668	0x215	PNG image data, 64 x 64, 8-bit colormap, non-interlaced	English	United States	1.0168855534709194
PNG	0x121880	0x1967	PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced	English	United States	1.0016915269875442
PNG	0x1231e8	0x24b8	PNG image data, 100 x 101, 8-bit/color RGBA, non-interlaced	English	United States	1.0011702127659574
PNG	0x1256a0	0x30f6	PNG image data, 120 x 121, 8-bit/color RGBA, non-interlaced	English	United States	1.0008776128929313
PNG	0x128798	0x4fb0	PNG image data, 160 x 160, 8-bit/color RGBA, non-interlaced	English	United States	1.0007843137254901
PNG	0x12d748	0x156d	PNG image data, 81 x 80, 8-bit/color RGBA, non-interlaced	English	United States	1.0020054694621696
PNG	0x12ecb8	0x1d9a	PNG image data, 101 x 101, 8-bit/color RGBA, non-interlaced	English	United States	1.0014515703351807
PNG	0x130a58	0x27ae	PNG image data, 121 x 121, 8-bit/color RGBA, non-interlaced	English	United States	1.0010828903327427
PNG	0x133208	0x3f4a	PNG image data, 161 x 160, 8-bit/color RGBA, non-interlaced	English	United States	1.0006789285273423
PNG	0x137158	0x340	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced	English	United States	1.0084134615384615
PNG	0x137498	0x3d0	PNG image data, 30 x 30, 8-bit/color RGBA, non-interlaced	English	United States	1.0112704918032787
PNG	0x137868	0x488	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced	English	United States	1.0094827586206896
PNG	0x137cf0	0x612	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced	English	United States	1.007078507078507
PNG	0x138308	0x1375	PNG image data, 111 x 70, 8-bit/color RGBA, non-interlaced	English	United States	1.0022083918891789
PNG	0x139680	0x2272	PNG image data, 167 x 105, 8-bit/color RGBA, non-interlaced	English	United States	1.0012474484009979
PNG	0x13b8f8	0x2272	PNG image data, 167 x 105, 8-bit/color RGBA, non-interlaced	English	United States	1.0012474484009979
PNG	0x13db70	0x31bd	PNG image data, 222 x 140, 8-bit/color RGBA, non-interlaced	English	United States	1.0008638969606534
PNG	0x140d30	0x114	PNG image data, 13 x 11, 8-bit/color RGBA, non-interlaced	English	United States	1.0072463768115942
PNG	0x140e48	0x13f	PNG image data, 17 x 14, 8-bit/color RGBA, non-interlaced	English	United States	1.0125391849529781
PNG	0x140f88	0x169	PNG image data, 20 x 16, 8-bit/color RGBA, non-interlaced	English	United States	1.0221606648199446
PNG	0x1410f8	0x192	PNG image data, 26 x 21, 8-bit/color RGBA, non-interlaced	English	United States	1.027363184079602
PNG	0x141290	0x1e2d	PNG image data, 222 x 190, 8-bit/color RGBA, non-interlaced	English	United States	0.9800647249190938
PNG	0x1430c0	0x2643	PNG image data, 278 x 238, 8-bit/color RGBA, non-interlaced	English	United States	0.9742725880551302
PNG	0x145708	0x2f01	PNG image data, 333 x 285, 8-bit/color RGBA, non-interlaced	English	United States	0.9673398155073548
PNG	0x148610	0x3d85	PNG image data, 444 x 380, 8-bit/color RGBA, non-interlaced	English	United States	0.9634262492856689
PNG	0x14c398	0x36fd	PNG image data, 222 x 190, 8-bit/color RGBA, non-interlaced	English	United States	0.987781487532855
PNG	0x14fa98	0x4b8b	PNG image data, 279 x 238, 8-bit/color RGBA, non-interlaced	English	United States	0.9896064946481203
PNG	0x154628	0x62b6	PNG image data, 334 x 285, 8-bit/color RGBA, non-interlaced	English	United States	0.9856351404827859
PNG	0x15a8e0	0x9877	PNG image data, 444 x 380, 8-bit/color RGBA, non-interlaced	English	United States	0.981834951705055
PNG	0x164158	0x2351	PNG image data, 222 x 190, 8-bit/color RGBA, non-interlaced	English	United States	0.9826346643070457
PNG	0x1664b0	0x32bb	PNG image data, 278 x 238, 8-bit/color RGBA, non-interlaced	English	United States	0.977977977977978
PNG	0x169770	0x4345	PNG image data, 333 x 285, 8-bit/color RGBA, non-interlaced	English	United States	0.9784565356251089
PNG	0x16dab8	0x6870	PNG image data, 444 x 380, 8-bit/color RGBA, non-interlaced	English	United States	0.97348144823459
PNG	0x174328	0x2ec1	PNG image data, 222 x 190, 8-bit/color RGBA, non-interlaced	English	United States	0.9812849862143872
PNG	0x1771f0	0x3eb9	PNG image data, 278 x 238, 8-bit/color RGBA, non-interlaced	English	United States	0.9794482157314567
PNG	0x17b0b0	0x5176	PNG image data, 334 x 285, 8-bit/color RGBA, non-interlaced	English	United States	0.9782775486717177
PNG	0x180228	0x7a0a	PNG image data, 444 x 380, 8-bit/color RGBA, non-interlaced	English	United States	0.9715127072530568
PNG	0x187c38	0x2f93	PNG image data, 222 x 190, 8-bit/color RGBA, non-interlaced	English	United States	0.9830035306675425
PNG	0x18abd0	0x4203	PNG image data, 279 x 238, 8-bit/color RGBA, non-interlaced	English	United States	0.9791111900112432
PNG	0x18edd8	0x5771	PNG image data, 334 x 285, 8-bit/color RGBA, non-interlaced	English	United States	0.9775742684833594
PNG	0x194550	0x8a78	PNG image data, 444 x 380, 8-bit/color RGBA, non-interlaced	English	United States	0.9728898668472128
PNG	0x19cfc8	0x47e	PNG image data, 66 x 66, 8-bit/color RGBA, non-interlaced	English	United States	1.0095652173913043
PNG	0x19d448	0x958	PNG image data, 81 x 81, 8-bit/color RGBA, non-interlaced	English	United States	1.004598662207358
PNG	0x19dda0	0xaf7	PNG image data, 98 x 98, 8-bit/color RGBA, non-interlaced	English	United States	1.0039187744923406
PNG	0x19e898	0x901	PNG image data, 131 x 131, 8-bit/color RGBA, non-interlaced	English	United States	1.004772234273319
PNG	0x19f1a0	0x175b	PNG image data, 142 x 142, 8-bit/color RGBA, non-interlaced	English	United States	0.9998327479511624
PNG	0x1a0900	0x1efd	PNG image data, 178 x 178, 8-bit/color RGBA, non-interlaced	English	United States	1.0013866128828943
PNG	0x1a2800	0x23e7	PNG image data, 213 x 213, 8-bit/color RGBA, non-interlaced	English	United States	0.9859645305189859
PNG	0x1a4be8	0x3156	PNG image data, 284 x 284, 8-bit/color RGBA, non-interlaced	English	United States	0.9855898653998416
PNG	0x1a7d40	0x1524	PNG image data, 142 x 142, 8-bit/color RGBA, non-interlaced	English	United States	1.0020325203252032
PNG	0x1a9268	0x1b36	PNG image data, 178 x 178, 8-bit/color RGBA, non-interlaced	English	United States	1.0015790984783233
PNG	0x1aada0	0x1fb5	PNG image data, 213 x 213, 8-bit/color RGBA, non-interlaced	English	United States	0.9963040532216336
PNG	0x1acd58	0x2bd8	PNG image data, 284 x 284, 8-bit/color RGBA, non-interlaced	English	United States	0.9932287954383464
PNG	0x1af930	0x493	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced	English	United States	1.0093936806148591
PNG	0x1afdc8	0x596	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced	English	United States	1.0076923076923077
PNG	0x1b0360	0x68a	PNG image data, 60 x 60, 8-bit/color RGBA, non-interlaced	English	United States	1.0065710872162486
PNG	0x1b09f0	0x8c7	PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced	English	United States	1.0048954161103694
PNG	0x1b12b8	0x469	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced	English	United States	1.0097431355181576
PNG	0x1b1728	0x701	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced	English	United States	1.0061349693251533
PNG	0x1b1e30	0x945	PNG image data, 60 x 60, 8-bit/color RGBA, non-interlaced	English	United States	1.0046354825115886
PNG	0x1b2778	0xa56	PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced	English	United States	1.00151171579743
RESOURCEFILE	0x205aa0	0xf5ee	HTML document, Unicode text, UTF-8 text, with very long lines (3413), with CRLF line terminators	Russian	Russia	0.2705136757838559
RESOURCEFILE	0x215090	0xeb64	HTML document, Unicode text, UTF-8 text, with very long lines (1295), with CRLF line terminators	Russian	Russia	0.2268503153003651
RT_BITMAP	0x223bf8	0x2ae8	Device independent bitmap graphic, 152 x 24 x 24, image size 10944, resolution 3780 x 3780 px/m	Russian	Russia	0.2274217042971595
RT_BITMAP	0x2266e0	0x4330	Device independent bitmap graphic, 190 x 30 x 24, image size 17160, resolution 3780 x 3780 px/m	Russian	Russia	0.19284883720930232
RT_BITMAP	0x22aa10	0x5f38	Device independent bitmap graphic, 225 x 36 x 24, image size 24336, resolution 3780 x 3780 px/m	Russian	Russia	0.16212668198227764
RT_BITMAP	0x230948	0xb104	Device independent bitmap graphic, 307 x 49 x 24, image size 45276, resolution 3780 x 3780 px/m	Russian	Russia	0.12234089504810663
RT_ICON	0xeeec0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.62677304964539
RT_ICON	0xef328	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.5315573770491804
RT_ICON	0xefcb0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.4699812382739212
RT_ICON	0xf0d58	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.3537344398340249
RT_ICON	0xf3300	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.28206188001889465
RT_ICON	0xf7528	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 38016	English	United States	0.20238595753626235
RT_ICON	0x1009d0	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	English	United States	0.17061989826097243
RT_DIALOG	0x2050c0	0x110	data	English	United States	0.45588235294117646
RT_DIALOG	0x2051d0	0x178	data	English	United States	0.3882978723404255
RT_DIALOG	0x205348	0x104	data	English	United States	0.47692307692307695
RT_DIALOG	0x205450	0x1f0	data	English	United States	0.3286290322580645
RT_DIALOG	0x205640	0x180	data	English	United States	0.3541666666666667
RT_DIALOG	0x2057c0	0xd8	data	English	United States	0.44907407407407407
RT_DIALOG	0x205898	0xe4	data	English	United States	0.5219298245614035
RT_DIALOG	0x205980	0x120	data	English	United States	0.5972222222222222
RT_STRING	0x23ba50	0x48	data	German	Germany	0.6666666666666666
RT_STRING	0x23fe88	0x4e	data	English	United States	0.6794871794871795
RT_STRING	0x247b48	0x48	data	French	France	0.6666666666666666
RT_STRING	0x24c030	0x48	data	Italian	Italy	0.6666666666666666
RT_STRING	0x250758	0x48	data	Dutch	Netherlands	0.6666666666666666
RT_STRING	0x2547a0	0x48	data	Polish	Poland	0.6666666666666666
RT_STRING	0x258620	0x4e	data	Portuguese	Brazil	0.6923076923076923
RT_STRING	0x260798	0x48	data	Russian	Russia	0.6666666666666666
RT_STRING	0x25c6a0	0x4e	data	Portuguese	Portugal	0.6923076923076923
RT_STRING	0x243920	0x48	data			0.6388888888888888
RT_STRING	0x23ba98	0x158	Matlab v4 mat-file (little endian) a, numeric, rows 0, columns 0	German	Germany	0.48546511627906974
RT_STRING	0x23fed8	0x116	Matlab v4 mat-file (little endian) a, numeric, rows 0, columns 0	English	United States	0.5
RT_STRING	0x247b90	0x17a	Matlab v4 mat-file (little endian) s, numeric, rows 0, columns 0	French	France	0.4312169312169312
RT_STRING	0x24c078	0x15c	Matlab v4 mat-file (little endian) o, numeric, rows 0, columns 0	Italian	Italy	0.4454022988505747
RT_STRING	0x2507a0	0x15e	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	Dutch	Netherlands	0.44571428571428573
RT_STRING	0x2547e8	0x136	Matlab v4 mat-file (little endian) r, numeric, rows 0, columns 0	Polish	Poland	0.4774193548387097
RT_STRING	0x258670	0x14e	Matlab v4 mat-file (little endian) s, numeric, rows 0, columns 0	Portuguese	Brazil	0.45808383233532934
RT_STRING	0x2607e0	0x16a	Matlab v4 mat-file (little endian) 0\004A\004B\0045\004@\004 , numeric, rows 0, columns 0	Russian	Russia	0.5220994475138122
RT_STRING	0x25c6f0	0x178	Matlab v4 mat-file (little endian) s, numeric, rows 0, columns 0	Portuguese	Portugal	0.4441489361702128
RT_STRING	0x243968	0x168	Matlab v4 mat-file (little endian) s, numeric, rows 0, columns 0			0.4444444444444444
RT_STRING	0x23bbf0	0x20a	data	German	Germany	0.4674329501915709
RT_STRING	0x23fff0	0x1b8	data	English	United States	0.4772727272727273
RT_STRING	0x247d10	0x250	data	French	France	0.4172297297297297
RT_STRING	0x24c1d8	0x282	data	Italian	Italy	0.40654205607476634
RT_STRING	0x250900	0x22e	data	Dutch	Netherlands	0.4121863799283154
RT_STRING	0x254920	0x1f8	data	Polish	Poland	0.501984126984127
RT_STRING	0x2587c0	0x20a	data	Portuguese	Brazil	0.46934865900383144
RT_STRING	0x260950	0x22e	data	Russian	Russia	0.5
RT_STRING	0x25c868	0x202	data	Portuguese	Portugal	0.4474708171206226
RT_STRING	0x243ad0	0x216	data			0.45131086142322097
RT_STRING	0x23be00	0x140	data	German	Germany	0.43125
RT_STRING	0x2401a8	0x144	data	English	United States	0.41975308641975306
RT_STRING	0x247f60	0x144	data	French	France	0.4691358024691358
RT_STRING	0x24c460	0x142	data	Italian	Italy	0.4472049689440994
RT_STRING	0x250b30	0x140	data	Dutch	Netherlands	0.453125
RT_STRING	0x254b18	0x182	data	Polish	Poland	0.42487046632124353
RT_STRING	0x2589d0	0x12c	data	Portuguese	Brazil	0.4666666666666667
RT_STRING	0x260b80	0x15c	data	Russian	Russia	0.45977011494252873
RT_STRING	0x25ca70	0x12c	data	Portuguese	Portugal	0.4866666666666667
RT_STRING	0x243ce8	0x134	data			0.4837662337662338
RT_STRING	0x23bf40	0x142	data	German	Germany	0.5900621118012422
RT_STRING	0x2402f0	0x130	data	English	United States	0.6085526315789473
RT_STRING	0x2480a8	0x14c	data	French	France	0.5933734939759037
RT_STRING	0x24c5a8	0x13a	data	Italian	Italy	0.6050955414012739
RT_STRING	0x250c70	0x140	data	Dutch	Netherlands	0.603125
RT_STRING	0x254ca0	0x130	data	Polish	Poland	0.6348684210526315
RT_STRING	0x258b00	0x148	data	Portuguese	Brazil	0.5945121951219512
RT_STRING	0x260ce0	0x140	data	Russian	Russia	0.65
RT_STRING	0x25cba0	0x14c	data	Portuguese	Portugal	0.5843373493975904
RT_STRING	0x243e20	0x14e	data			0.5748502994011976
RT_STRING	0x23c088	0x29e	data	German	Germany	0.34626865671641793
RT_STRING	0x240420	0x23c	data	English	United States	0.3409090909090909
RT_STRING	0x2481f8	0x2d2	data	French	France	0.3268698060941828
RT_STRING	0x24c6e8	0x2f2	data	Italian	Italy	0.3116710875331565
RT_STRING	0x250db0	0x28e	data	Dutch	Netherlands	0.3195718654434251
RT_STRING	0x254dd0	0x268	data	Polish	Poland	0.36688311688311687
RT_STRING	0x258c48	0x28a	data	Portuguese	Brazil	0.3384615384615385
RT_STRING	0x260e20	0x212	data	Russian	Russia	0.37735849056603776
RT_STRING	0x25ccf0	0x28a	data	Portuguese	Portugal	0.3415384615384615
RT_STRING	0x243f70	0x294	data			0.3212121212121212
RT_STRING	0x23c328	0x156	data	German	Germany	0.564327485380117
RT_STRING	0x240660	0x10c	data	English	United States	0.5746268656716418
RT_STRING	0x2484d0	0x144	data	French	France	0.5308641975308642
RT_STRING	0x24c9e0	0x138	data	Italian	Italy	0.5416666666666666
RT_STRING	0x251040	0x12c	data	Dutch	Netherlands	0.5466666666666666
RT_STRING	0x255038	0x124	data	Polish	Poland	0.565068493150685
RT_STRING	0x258ed8	0x13c	data	Portuguese	Brazil	0.5379746835443038
RT_STRING	0x261038	0x126	data	Russian	Russia	0.5578231292517006
RT_STRING	0x25cf80	0x13e	data	Portuguese	Portugal	0.5566037735849056
RT_STRING	0x244208	0x136	data			0.5612903225806452
RT_STRING	0x23c480	0x2d0	data	German	Germany	0.45555555555555555
RT_STRING	0x240770	0x262	data	English	United States	0.46885245901639344
RT_STRING	0x248618	0x2f0	data	French	France	0.46808510638297873
RT_STRING	0x24cb18	0x280	data	Italian	Italy	0.4828125
RT_STRING	0x251170	0x27a	data	Dutch	Netherlands	0.4589905362776025
RT_STRING	0x255160	0x294	data	Polish	Poland	0.49242424242424243
RT_STRING	0x259018	0x27a	data	Portuguese	Brazil	0.48580441640378547
RT_STRING	0x261160	0x2e6	data	Russian	Russia	0.4865229110512129
RT_STRING	0x25d0c0	0x2c8	data	Portuguese	Portugal	0.47752808988764045
RT_STRING	0x244340	0x29a	data			0.481981981981982
RT_STRING	0x23c750	0x1cc	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	German	Germany	0.4891304347826087
RT_STRING	0x2409d8	0x16c	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	United States	0.4835164835164835
RT_STRING	0x248908	0x1b8	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	French	France	0.4636363636363636
RT_STRING	0x24cd98	0x1aa	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	Italian	Italy	0.4694835680751174
RT_STRING	0x2513f0	0x1b2	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	Dutch	Netherlands	0.44930875576036866
RT_STRING	0x2553f8	0x15a	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	Polish	Poland	0.5115606936416185
RT_STRING	0x259298	0x184	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	Portuguese	Brazil	0.4690721649484536
RT_STRING	0x261448	0x1b2	Matlab v4 mat-file (little endian) A\004B\0040\004=\004>\0042\004:\0040\004., numeric, rows 0, columns 0	Russian	Russia	0.5368663594470046
RT_STRING	0x25d388	0x1aa	Matlab v4 mat-file (little endian) , numeric, rows 0, columns 0	Portuguese	Portugal	0.45539906103286387
RT_STRING	0x2445e0	0x18e	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0			0.4949748743718593
RT_STRING	0x23c920	0x826	data	German	Germany	0.37056567593480344
RT_STRING	0x240b48	0x776	data	English	United States	0.35287958115183243
RT_STRING	0x248ac0	0x8a6	data	French	France	0.34733514001806687
RT_STRING	0x24cf48	0x8ec	data	Italian	Italy	0.3450087565674256
RT_STRING	0x2515a8	0x818	data	Dutch	Netherlands	0.3503861003861004
RT_STRING	0x255558	0x7a0	data	Polish	Poland	0.38934426229508196
RT_STRING	0x259420	0x888	data	Portuguese	Brazil	0.3557692307692308
RT_STRING	0x261600	0x81e	data	Russian	Russia	0.4095283926852743
RT_STRING	0x25d538	0x894	data	Portuguese	Portugal	0.35063752276867033
RT_STRING	0x244770	0x890	data			0.3471715328467153
RT_STRING	0x23d148	0xa2c	data	German	Germany	0.31835637480798773
RT_STRING	0x2412c0	0x98e	data	English	United States	0.30498773507767785
RT_STRING	0x249368	0xb80	data	French	France	0.29347826086956524
RT_STRING	0x24d838	0xb9a	data	Italian	Italy	0.28888888888888886
RT_STRING	0x251dc0	0xa84	data	Dutch	Netherlands	0.29977711738484397
RT_STRING	0x255cf8	0x9dc	data	Polish	Poland	0.3272583201267829
RT_STRING	0x259ca8	0xb90	PDP-11 UNIX/RT ldp	Portuguese	Brazil	0.29493243243243245
RT_STRING	0x261e20	0xa06	data	Russian	Russia	0.34918160561184725
RT_STRING	0x25ddd0	0xb58	data	Portuguese	Portugal	0.29338842975206614
RT_STRING	0x245000	0xb74	data			0.29229195088676674
RT_STRING	0x23db78	0x17a	data	German	Germany	0.42592592592592593
RT_STRING	0x241c50	0x110	data	English	United States	0.5073529411764706
RT_STRING	0x249ee8	0x17e	data	French	France	0.45287958115183247
RT_STRING	0x24e3d8	0x1dc	Matlab v4 mat-file (little endian) , numeric, rows 0, columns 0	Italian	Italy	0.3760504201680672
RT_STRING	0x252848	0x13a	data	Dutch	Netherlands	0.49363057324840764
RT_STRING	0x2566d8	0x13e	data	Polish	Poland	0.5094339622641509
RT_STRING	0x25a838	0x140	data	Portuguese	Brazil	0.471875
RT_STRING	0x262828	0x11c	data	Russian	Russia	0.528169014084507
RT_STRING	0x25e928	0x134	data	Portuguese	Portugal	0.45454545454545453
RT_STRING	0x245b78	0x148	data			0.4603658536585366
RT_STRING	0x23dcf8	0x5f8	data	German	Germany	0.3147905759162304
RT_STRING	0x241d60	0x504	data	English	United States	0.3161993769470405
RT_STRING	0x24a068	0x58a	data	French	France	0.32863187588152326
RT_STRING	0x24e5b8	0x68c	data	Italian	Italy	0.2834128878281623
RT_STRING	0x252988	0x53e	data	Dutch	Netherlands	0.3181818181818182
RT_STRING	0x256818	0x4fa	data	Polish	Poland	0.33830455259026687
RT_STRING	0x25a978	0x54a	data	Portuguese	Brazil	0.3124076809453471
RT_STRING	0x262948	0x4d4	data	Russian	Russia	0.37216828478964403
RT_STRING	0x25ea60	0x53e	data	Portuguese	Portugal	0.31296572280178836
RT_STRING	0x245cc0	0x5bc	data			0.30381471389645776
RT_STRING	0x23e2f0	0x234	data	German	Germany	0.4397163120567376
RT_STRING	0x242268	0x1d4	data	English	United States	0.4230769230769231
RT_STRING	0x24a5f8	0x216	data	French	France	0.45318352059925093
RT_STRING	0x24ec48	0x216	data	Italian	Italy	0.41947565543071164
RT_STRING	0x252ec8	0x216	data	Dutch	Netherlands	0.40636704119850187
RT_STRING	0x256d18	0x1ca	data	Polish	Poland	0.48253275109170307
RT_STRING	0x25aec8	0x1f0	data	Portuguese	Brazil	0.4334677419354839
RT_STRING	0x262e20	0x1fc	data	Russian	Russia	0.5255905511811023
RT_STRING	0x25efa0	0x1fa	data	Portuguese	Portugal	0.43280632411067194
RT_STRING	0x246280	0x21a	data			0.41263940520446096
RT_STRING	0x23e528	0xd0	data	German	Germany	0.5673076923076923
RT_STRING	0x242440	0xac	data	English	United States	0.5872093023255814
RT_STRING	0x24a810	0xf2	data	French	France	0.5165289256198347
RT_STRING	0x24ee60	0xf2	data	Italian	Italy	0.49586776859504134
RT_STRING	0x2530e0	0xe0	data	Dutch	Netherlands	0.5535714285714286
RT_STRING	0x256ee8	0xc8	data	Polish	Poland	0.575
RT_STRING	0x25b0b8	0xb4	data	Portuguese	Brazil	0.5777777777777777
RT_STRING	0x263020	0x98	data	Russian	Russia	0.6578947368421053
RT_STRING	0x25f1a0	0xba	data	Portuguese	Portugal	0.5752688172043011
RT_STRING	0x2464a0	0xbc	data			0.5319148936170213
RT_STRING	0x23e5f8	0xe0	data	German	Germany	0.53125
RT_STRING	0x2424f0	0xc6	data	English	United States	0.5151515151515151
RT_STRING	0x24a908	0xde	data	French	France	0.5225225225225225
RT_STRING	0x24ef58	0xee	data	Italian	Italy	0.5084033613445378
RT_STRING	0x2531c0	0xde	data	Dutch	Netherlands	0.5
RT_STRING	0x256fb0	0xc4	data	Polish	Poland	0.5867346938775511
RT_STRING	0x25b170	0xdc	data	Portuguese	Brazil	0.5181818181818182
RT_STRING	0x2630b8	0xae	data	Russian	Russia	0.5344827586206896
RT_STRING	0x25f260	0xca	data	Portuguese	Portugal	0.5099009900990099
RT_STRING	0x246560	0xde	data			0.49099099099099097
RT_STRING	0x23e6d8	0x16c	data	German	Germany	0.4340659340659341
RT_STRING	0x2425b8	0x124	AmigaOS bitmap font "x", fc_YSize 30720, 17664 elements, 2nd "t", 3rd	English	United States	0.4863013698630137
RT_STRING	0x24a9e8	0x186	data	French	France	0.44358974358974357
RT_STRING	0x24f048	0x168	data	Italian	Italy	0.425
RT_STRING	0x2532a0	0x14a	data	Dutch	Netherlands	0.45151515151515154
RT_STRING	0x257078	0x12a	data	Polish	Poland	0.5302013422818792
RT_STRING	0x25b250	0x126	data	Portuguese	Brazil	0.5034013605442177
RT_STRING	0x263168	0x136	data	Russian	Russia	0.5161290322580645
RT_STRING	0x25f330	0xf0	data	Portuguese	Portugal	0.49166666666666664
RT_STRING	0x246640	0x126	data			0.4897959183673469
RT_STRING	0x23e848	0x116	data	German	Germany	0.5287769784172662
RT_STRING	0x2426e0	0xfc	data	English	United States	0.5119047619047619
RT_STRING	0x24ab70	0x110	data	French	France	0.5514705882352942
RT_STRING	0x24f1b0	0x128	data	Italian	Italy	0.5067567567567568
RT_STRING	0x2533f0	0x112	data	Dutch	Netherlands	0.5583941605839416
RT_STRING	0x2571a8	0xec	data	Polish	Poland	0.6016949152542372
RT_STRING	0x25b378	0x104	data	Portuguese	Brazil	0.5692307692307692
RT_STRING	0x2632a0	0xf0	data	Russian	Russia	0.6458333333333334
RT_STRING	0x25f420	0xfe	data	Portuguese	Portugal	0.5748031496062992
RT_STRING	0x246768	0xf8	data			0.5483870967741935
RT_STRING	0x23e960	0x11c	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	German	Germany	0.5176056338028169
RT_STRING	0x2427e0	0x102	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	United States	0.4844961240310077
RT_STRING	0x24ac80	0x116	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	French	France	0.5287769784172662
RT_STRING	0x24f2d8	0x144	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	Italian	Italy	0.49691358024691357
RT_STRING	0x253508	0x11c	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	Dutch	Netherlands	0.5176056338028169
RT_STRING	0x257298	0xf6	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	Polish	Poland	0.5772357723577236
RT_STRING	0x25b480	0x10e	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	Portuguese	Brazil	0.5555555555555556
RT_STRING	0x263390	0xfa	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	Russian	Russia	0.652
RT_STRING	0x25f520	0x108	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	Portuguese	Portugal	0.5568181818181818
RT_STRING	0x246860	0xf8	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0			0.532258064516129
RT_STRING	0x23ea80	0x16e	data	German	Germany	0.5327868852459017
RT_STRING	0x2428e8	0x112	data	English	United States	0.5474452554744526
RT_STRING	0x24ad98	0x158	data	French	France	0.4738372093023256
RT_STRING	0x24f420	0x162	data	Italian	Italy	0.4830508474576271
RT_STRING	0x253628	0x154	data	Dutch	Netherlands	0.5029411764705882
RT_STRING	0x257390	0x144	data	Polish	Poland	0.5555555555555556
RT_STRING	0x25b590	0x142	data	Portuguese	Brazil	0.5093167701863354
RT_STRING	0x263490	0x166	data	Russian	Russia	0.5893854748603352
RT_STRING	0x25f628	0x192	data	Portuguese	Portugal	0.48258706467661694
RT_STRING	0x246958	0x172	data			0.4648648648648649
RT_STRING	0x23ebf0	0x78	data	German	Germany	0.6666666666666666
RT_STRING	0x242a00	0x70	data	English	United States	0.625
RT_STRING	0x24aef0	0x86	data	French	France	0.6343283582089553
RT_STRING	0x24f588	0x80	AmigaOS bitmap font "a", 20480 elements, 2nd, 3rd	Italian	Italy	0.6328125
RT_STRING	0x253780	0x88	data	Dutch	Netherlands	0.6691176470588235
RT_STRING	0x2574d8	0x96	data	Polish	Poland	0.6866666666666666
RT_STRING	0x25b6d8	0x82	data	Portuguese	Brazil	0.6076923076923076
RT_STRING	0x2635f8	0x86	AmigaOS bitmap font "5\0042\0045\004@\004=\004K\0049\004 ", 7428 elements, 2nd, 3rd	Russian	Russia	0.6940298507462687
RT_STRING	0x25f7c0	0x82	data	Portuguese	Portugal	0.6461538461538462
RT_STRING	0x246ad0	0xae	data			0.5919540229885057
RT_STRING	0x23ec68	0x492	data	German	Germany	0.26324786324786326
RT_STRING	0x242a70	0x352	data	English	United States	0.30117647058823527
RT_STRING	0x24af78	0x3ee	data	French	France	0.2823061630218688
RT_STRING	0x24f608	0x4a8	0420 Alliant virtual executable not stripped	Italian	Italy	0.27348993288590606
RT_STRING	0x253808	0x2f2	data	Dutch	Netherlands	0.3076923076923077
RT_STRING	0x257570	0x44c	data	Polish	Poland	0.28909090909090907
RT_STRING	0x25b760	0x382	data	Portuguese	Brazil	0.2984409799554566
RT_STRING	0x263680	0x356	data	Russian	Russia	0.319672131147541
RT_STRING	0x25f848	0x36e	OpenPGP Secret Key	Portuguese	Portugal	0.296127562642369
RT_STRING	0x246b80	0x38a	data			0.2924944812362031
RT_STRING	0x23f100	0x84	Matlab v4 mat-file (little endian) a, numeric, rows 0, columns 0	German	Germany	0.5681818181818182
RT_STRING	0x242dc8	0x84	Matlab v4 mat-file (little endian) a, numeric, rows 0, columns 0	English	United States	0.5681818181818182
RT_STRING	0x24b368	0x84	Matlab v4 mat-file (little endian) a, numeric, rows 0, columns 0	French	France	0.5681818181818182
RT_STRING	0x24fab0	0x84	Matlab v4 mat-file (little endian) a, numeric, rows 0, columns 0	Italian	Italy	0.5681818181818182
RT_STRING	0x253b00	0x84	Matlab v4 mat-file (little endian) a, numeric, rows 0, columns 0	Dutch	Netherlands	0.5681818181818182
RT_STRING	0x2579c0	0xb4	Matlab v4 mat-file (little endian) a, numeric, rows 0, columns 0	Polish	Poland	0.5888888888888889
RT_STRING	0x25bae8	0x84	Matlab v4 mat-file (little endian) a, numeric, rows 0, columns 0	Portuguese	Brazil	0.5681818181818182
RT_STRING	0x2639d8	0x84	Matlab v4 mat-file (little endian) a, numeric, rows 0, columns 0	Russian	Russia	0.5681818181818182
RT_STRING	0x25fbb8	0x84	Matlab v4 mat-file (little endian) a, numeric, rows 0, columns 0	Portuguese	Portugal	0.5681818181818182
RT_STRING	0x246f10	0x8a	Matlab v4 mat-file (little endian) a, numeric, rows 0, columns 0			0.5869565217391305
RT_STRING	0x23f188	0xe8	data	German	Germany	0.625
RT_STRING	0x242e50	0xd8	data	English	United States	0.6018518518518519
RT_STRING	0x24b3f0	0xf4	data	French	France	0.5819672131147541
RT_STRING	0x24fb38	0xde	data	Italian	Italy	0.6216216216216216
RT_STRING	0x253b88	0xe0	data	Dutch	Netherlands	0.6071428571428571
RT_STRING	0x257a78	0xda	data	Polish	Poland	0.6330275229357798
RT_STRING	0x25bb70	0xee	data	Portuguese	Brazil	0.6050420168067226
RT_STRING	0x263a60	0x116	data	Russian	Russia	0.6438848920863309
RT_STRING	0x25fc40	0xdc	data	Portuguese	Portugal	0.6090909090909091
RT_STRING	0x246fa0	0xf4	data			0.5860655737704918
RT_STRING	0x23f270	0x4b8	data	German	Germany	0.34602649006622516
RT_STRING	0x242f28	0x374	data	English	United States	0.3778280542986425
RT_STRING	0x24b4e8	0x42a	data	French	France	0.34615384615384615
RT_STRING	0x24fc18	0x416	data	Italian	Italy	0.3441682600382409
RT_STRING	0x253c68	0x44c	data	Dutch	Netherlands	0.33
RT_STRING	0x257b58	0x428	data	Polish	Poland	0.37218045112781956
RT_STRING	0x25bc60	0x394	data	Portuguese	Brazil	0.3548034934497817
RT_STRING	0x263b78	0x378	data	Russian	Russia	0.4189189189189189
RT_STRING	0x25fd20	0x3ce	data	Portuguese	Portugal	0.3480492813141684
RT_STRING	0x247098	0x3c6	data			0.35714285714285715
RT_STRING	0x23f728	0x55c	data	German	Germany	0.3629737609329446
RT_STRING	0x2432a0	0x4e6	data	English	United States	0.33811802232854865
RT_STRING	0x24b918	0x536	data	French	France	0.3613193403298351
RT_STRING	0x250030	0x538	data	Italian	Italy	0.34880239520958084
RT_STRING	0x2540b8	0x53e	data	Dutch	Netherlands	0.3502235469448584
RT_STRING	0x257f80	0x4b4	data	Polish	Poland	0.3920265780730897
RT_STRING	0x25bff8	0x4ee	data	Portuguese	Brazil	0.3589540412044374
RT_STRING	0x263ef0	0x4f0	data	Russian	Russia	0.4185126582278481
RT_STRING	0x2600f0	0x4ee	data	Portuguese	Portugal	0.358161648177496
RT_STRING	0x247460	0x526	data			0.3482549317147193
RT_STRING	0x23fc88	0x1fa	data	German	Germany	0.4762845849802372
RT_STRING	0x243788	0x194	data	English	United States	0.504950495049505
RT_STRING	0x24be50	0x1e0	data	French	France	0.49583333333333335
RT_STRING	0x250568	0x1ee	data	Italian	Italy	0.4797570850202429
RT_STRING	0x2545f8	0x1a2	data	Dutch	Netherlands	0.5311004784688995
RT_STRING	0x258438	0x1e4	data	Polish	Poland	0.5351239669421488
RT_STRING	0x25c4e8	0x1b6	data	Portuguese	Brazil	0.5091324200913242
RT_STRING	0x2643e0	0x1de	data	Russian	Russia	0.5648535564853556
RT_STRING	0x2605e0	0x1b4	data	Portuguese	Portugal	0.5114678899082569
RT_STRING	0x247988	0x1be	data			0.4910313901345291
RT_GROUP_ICON	0x1111f8	0x68	data	English	United States	0.7403846153846154
RT_VERSION	0x2645c0	0x2f8	data	English	United States	0.4644736842105263
RT_MANIFEST	0x2648b8	0x822	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (2022), with CRLF line terminators	English	United States	0.3121998078770413

Imports

DLL	Import
KERNEL32.dll	LeaveCriticalSection, RaiseException, EnterCriticalSection, GetLastError, MultiByteToWideChar, SizeofResource, LoadResource, FindResourceW, LoadLibraryExW, GetModuleFileNameW, InitializeCriticalSectionEx, DeleteCriticalSection, IsWow64Process, GetCurrentProcess, VerifyVersionInfoW, VerSetConditionMask, GetSystemDirectoryW, CreateFileW, DeviceIoControl, CloseHandle, GetCurrentThreadId, SetLastError, Sleep, DeleteFileW, GlobalFree, LockResource, FindResourceExW, LocalFree, FormatMessageW, LocalAlloc, CallNamedPipeW, GetWindowsDirectoryW, SetCurrentDirectoryW, GetCommandLineW, lstrcmpiW, CreateMutexW, GetNativeSystemInfo, GetDiskFreeSpaceExW, FindFirstFileW, FindClose, CreateProcessW, FindNextFileW, WideCharToMultiByte, GlobalAlloc, GlobalLock, SetThreadUILanguage, LoadLibraryW, CreateDirectoryW, GetLogicalDrives, GetTempPathW, MoveFileExW, InitializeProcThreadAttributeList, UpdateProcThreadAttribute, DeleteProcThreadAttributeList, OpenProcess, ResumeThread, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, K32GetModuleFileNameExW, GetCurrentDirectoryW, GetCurrentProcessId, GetModuleFileNameA, OutputDebugStringW, SetEndOfFile, WriteConsoleW, SetStdHandle, GetProcAddress, GetModuleHandleW, FreeLibrary, GetProcessHeap, HeapAlloc, HeapFree, HeapReAlloc, HeapSize, HeapDestroy, DecodePointer, MulDiv, SetEnvironmentVariableW, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetOEMCP, GetACP, IsValidCodePage, GetTimeZoneInformation, ReadConsoleW, EnumSystemLocalesW, GetUserDefaultLCID, IsValidLocale, GetTimeFormatW, GetSystemInfo, VirtualProtect, VirtualQuery, LoadLibraryExA, GetStringTypeW, FindFirstFileExW, GetFileAttributesW, GetFileAttributesExW, GetFileInformationByHandle, RemoveDirectoryW, AreFileApisANSI, CopyFileW, DuplicateHandle, WaitForSingleObjectEx, SwitchToThread, GetCurrentThread, QueryPerformanceCounter, TryEnterCriticalSection, EncodePointer, InitializeCriticalSectionAndSpinCount, CreateEventW, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetSystemTimeAsFileTime, GetTickCount, CompareStringW, LCMapStringW, GetLocaleInfoW, GetCPInfo, IsDebuggerPresent, InitializeSListHead, InterlockedPopEntrySList, InterlockedPushEntrySList, FlushInstructionCache, IsProcessorFeaturePresent, VirtualAlloc, VirtualFree, SetEvent, ResetEvent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, CreateTimerQueue, SignalObjectAndWait, CreateThread, SetThreadPriority, GetThreadPriority, GetLogicalProcessorInformation, CreateTimerQueueTimer, ChangeTimerQueueTimer, DeleteTimerQueueTimer, GetNumaHighestNodeNumber, GetProcessAffinityMask, SetThreadAffinityMask, RegisterWaitForSingleObject, UnregisterWait, GetThreadTimes, FreeLibraryAndExitThread, GetModuleHandleA, GetVersionExW, ReleaseSemaphore, InterlockedFlushSList, QueryDepthSList, UnregisterWaitEx, RtlUnwind, ExitProcess, GetModuleHandleExW, GetCommandLineA, ExitThread, GetStdHandle, WriteFile, GetFileType, FlushFileBuffers, GetConsoleCP, GetConsoleMode, ReadFile, SetFilePointerEx, GetFileSizeEx, GetDateFormatW
dwmapi.dll	DwmGetWindowAttribute
CRYPT32.dll	CryptMsgClose, CertCloseStore, CertFreeCertificateContext, CertGetNameStringW, CertFindCertificateInStore, CryptMsgGetParam, CryptQueryObject
RPCRT4.dll	UuidToStringW, RpcStringFreeW, UuidCreate

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States
Russian	Russia
German	Germany
French	France
Italian	Italy
Dutch	Netherlands
Polish	Poland
Portuguese	Brazil
Portuguese	Portugal

Target ID:	0
Start time:	09:13:58
Start date:	17/04/2024
Path:	C:\Users\user\Desktop\MBSetup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\MBSetup.exe"
Imagebase:	0x750000
File size:	2'589'624 bytes
MD5 hash:	B6D8B7E6F74196F62CABA2CA77A7AE91
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	2
Start time:	09:14:17
Start date:	17/04/2024
Path:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"
Imagebase:	0x7ff783900000
File size:	10'102'920 bytes
MD5 hash:	CC91FBC5E424154388AFBE808DE25FF6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Target ID:	5
Start time:	09:15:01
Start date:	17/04/2024
Path:	C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe" /installmbtun
Imagebase:	0x7ff7514b0000
File size:	3'073'888 bytes
MD5 hash:	46F875F1FE3D6063B390E3A170C90E50
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	6
Start time:	09:15:01
Start date:	17/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	7
Start time:	09:15:15
Start date:	17/04/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	8
Start time:	09:15:15
Start date:	17/04/2024
Path:	C:\Windows\System32\drvinst.exe
Wow64 process (32bit):	false
Commandline:	DrvInst.exe "4" "9" "C:\Program Files\Malwarebytes\Anti-Malware\mbtun\mbtun.inf" "9" "4ba9030c7" "0000000000000158" "Service-0x0-3e7$\Default" "0000000000000168" "208" "C:\Program Files\Malwarebytes\Anti-Malware\mbtun"
Imagebase:	0x7ff645c60000
File size:	337'920 bytes
MD5 hash:	294990C88B9D1FE0A54A1FA8BF4324D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	9
Start time:	09:15:17
Start date:	17/04/2024
Path:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe" /Service /Protected
Imagebase:	0x7ff7e2100000
File size:	8'884'840 bytes
MD5 hash:	B9251F9808C8ADE391E452F12F87E20D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	10
Start time:	09:15:18
Start date:	17/04/2024
Path:	C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"
Imagebase:	0x7ff7e2100000
File size:	8'884'840 bytes
MD5 hash:	B9251F9808C8ADE391E452F12F87E20D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	14
Start time:	09:15:34
Start date:	17/04/2024
Path:	C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe" nowindow
Imagebase:	0x7ff767090000
File size:	295'928 bytes
MD5 hash:	F78BA9ED5C75BA595C2C73483C06EB06
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	15
Start time:	09:15:35
Start date:	17/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C timeout /t 1 & "C:\Program Files\Mozilla Firefox\firefox.exe" -install -extension "C:\Users\user\AppData\Local\Temp\{242af0bb-db11-4734-b7a0-61cb8a9b20fb}.xpi"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	16
Start time:	09:15:35
Start date:	17/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	17
Start time:	09:15:35
Start date:	17/04/2024
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout /t 1
Imagebase:	0x8b0000
File size:	25'088 bytes
MD5 hash:	976566BEEFCCA4A159ECBDB2D4B1A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	18
Start time:	09:15:36
Start date:	17/04/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -install -extension "C:\Users\user\AppData\Local\Temp\{242af0bb-db11-4734-b7a0-61cb8a9b20fb}.xpi"
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	19
Start time:	09:15:36
Start date:	17/04/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -install -extension C:\Users\user\AppData\Local\Temp\{242af0bb-db11-4734-b7a0-61cb8a9b20fb}.xpi --attempting-deelevation
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	20
Start time:	09:15:36
Start date:	17/04/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -install -extension C:\Users\user\AppData\Local\Temp\{242af0bb-db11-4734-b7a0-61cb8a9b20fb}.xpi
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	21
Start time:	09:15:37
Start date:	17/04/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	22
Start time:	09:15:37
Start date:	17/04/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2308 -parentBuildID 20230927232528 -prefsHandle 2244 -prefMapHandle 2236 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d6a919bd-c3c7-4ef4-a914-d79422c03b0c} 2948 "\\.\pipe\gecko-crash-server-pipe.2948" 13b7a26d310 socket
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	23
Start time:	09:15:44
Start date:	17/04/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1484 -parentBuildID 20230927232528 -prefsHandle 1172 -prefMapHandle 4036 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {98e93150-a637-4ba5-a6bb-da042e33bf31} 2948 "\\.\pipe\gecko-crash-server-pipe.2948" 13b0a834310 rdd
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Target ID:	24
Start time:	09:15:48
Start date:	17/04/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5232 -parentBuildID 20230927232528 -sandboxingKind 0 -prefsHandle 5272 -prefMapHandle 5244 -prefsLen 33043 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2eae8c4e-3b3b-4929-bb0e-9deade986469} 2948 "\\.\pipe\gecko-crash-server-pipe.2948" 13b126ed110 utility
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false