Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'Malwarebytes Anti-Malware' = '%ProgramFiles%\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\MBAMProtector] 'ImagePath' = '<DRIVERS>\mbam.sys'
- [<HKLM>\SYSTEM\ControlSet001\Services\MBAMService] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\MBAMService] 'ImagePath' = '"%ProgramFiles%\Malwarebytes' Anti-Malware\mbamservice.exe"'
- [<HKLM>\SYSTEM\ControlSet001\Services\MBAMScheduler] 'ImagePath' = '"%ProgramFiles%\Malwarebytes' Anti-Malware\mbamscheduler.exe"'
- [<HKLM>\SYSTEM\ControlSet001\Services\SCCommService] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\SCCommService] 'ImagePath' = '"%ProgramFiles%\Malwarebytes' Managed Client\SCComm.exe"'
- [<HKLM>\SYSTEM\ControlSet001\Services\MBAMScheduler] 'Start' = '00000002'
Malicious functions:
Executes the following:
- '%ProgramFiles%\Malwarebytes' Anti-Malware\mbamapi.exe' /set notifyinstallprogram off
- '%ProgramFiles%\Malwarebytes' Anti-Malware\mbamapi.exe' /set downloadprogram off
- '%ProgramFiles%\Malwarebytes' Anti-Malware\mbamscheduler.exe'
- '%ProgramFiles%\Malwarebytes' Anti-Malware\mbamapi.exe' /set limitedusermode off
- '%ProgramFiles%\Malwarebytes' Anti-Malware\mbamapi.exe' /set fullsilentmode on
- '%ProgramFiles%\Malwarebytes' Anti-Malware\mbamapi.exe' /proxy
- '%ProgramFiles%\Malwarebytes' Anti-Malware\mbamapi.exe' /schedule /scan -full -log -terminate -remove /once /starting 08/09/2013 14:52:00 /every 0 /recover 0 /silent /xml
- '%ProgramFiles%\Malwarebytes' Anti-Malware\mbamapi.exe' /set detectpum 1
- '%ProgramFiles%\Malwarebytes' Anti-Malware\mbamapi.exe' /set detectpup 2
- '%ProgramFiles%\Malwarebytes' Anti-Malware\mbamapi.exe' /set alwaysscanarchives on
- '%ProgramFiles%\Malwarebytes' Anti-Malware\mbamapi.exe' /unschedule /all
- '%ProgramFiles%\Malwarebytes' Anti-Malware\mbamapi.exe' /set language english.lng
- '%ProgramFiles%\Malwarebytes' Anti-Malware\mbamapi.exe' /set detectp2p 0
- '%ProgramFiles%\Malwarebytes' Anti-Malware\mbamapi.exe' /set autoquarantine on
- '%ProgramFiles%\Malwarebytes' Anti-Malware\mbamapi.exe' /update
- '%ProgramFiles%\Malwarebytes' Anti-Malware\mbamapi.exe' /protection -start
- '%ProgramFiles%\Malwarebytes' Anti-Malware\mbamservice.exe'
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%WINDIR%\TEMP\RESF.tmp" "%WINDIR%\Temp\CSCE.tmp"
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\csc.exe' /noconfig /fullpaths @"%WINDIR%\TEMP\t_8jrfo2.cmdline"
- '%ProgramFiles%\Malwarebytes' Anti-Malware\mbamgui.exe' /starttray
- '%ProgramFiles%\Malwarebytes' Anti-Malware\mbamapi.exe' /protection -install
- '%ProgramFiles%\Malwarebytes' Anti-Malware\mbamapi.exe' /set delayguistart off
- '%ProgramFiles%\Malwarebytes' Anti-Malware\mbamapi.exe' /set disableipblocking off
- '%ProgramFiles%\Malwarebytes' Anti-Malware\mbamapi.exe' /set autoquarantinenotify on
- '%ProgramFiles%\Malwarebytes' Anti-Malware\mbamapi.exe' /set silentipmode off
- '%ProgramFiles%\Malwarebytes' Anti-Malware\mbamapi.exe' /set startipdisabled off
- '%ProgramFiles%\Malwarebytes' Anti-Malware\mbamapi.exe' /set startfsdisabled off
- '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles%\Malwarebytes' Anti-Malware\ssubtmr6.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles%\Malwarebytes' Anti-Malware\mbamext.dll"
- '%TEMP%\is-43GHQ.tmp\coreinst.tmp' /SL5="$600E6,9752448,54272,%ProgramFiles%\Malwarebytes' Managed Client\coreinst.exe" /NOICONS /tasks="" /verysilent /SUPPRESSMSGBOXES /NORESTART /RESTARTEXITCODE=101
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\csc.exe' /noconfig /fullpaths @"%WINDIR%\TEMP\7kvpam1l.cmdline"
- '%ProgramFiles%\Malwarebytes' Managed Client\SCComm.exe'
- '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles%\Malwarebytes' Anti-Malware\vbalsgrid6.ocx"
- '%ProgramFiles%\Malwarebytes' Managed Client\Coreinst.exe' /NOICONS /tasks="" /verysilent /SUPPRESSMSGBOXES /NORESTART /RESTARTEXITCODE=101
- '<SYSTEM32>\msiexec.exe' -Embedding 7D548E7115A8F1D047F5B281C7854017
- '<SYSTEM32>\msiexec.exe' /V
- '<SYSTEM32>\msiexec.exe' /i "%TEMP%\ClientSetup.msi" /qn /norestart Reboot=ReallySuppress
- '<SYSTEM32>\msiexec.exe' -Embedding 226000246E46C0DD86714D57B1035E5C M Global\MSI0000
- '<SYSTEM32>\rundll32.exe' "%WINDIR%\Installer\MSI5.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_156609 17 SC.Client.Setup.CustomOperation!SC.Client.Setup.CustomOperation.CustomActions.CheckCommService
- '<SYSTEM32>\rundll32.exe' "%WINDIR%\Installer\MSI3.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_152265 8 SC.Client.Setup.CustomOperation!SC.Client.Setup.CustomOperation.CustomActions.HideCancelButton
- '%WINDIR%\Microsoft.NET\Framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%WINDIR%\TEMP\RESC.tmp" "%WINDIR%\Temp\CSCB.tmp"
- '%ProgramFiles%\Malwarebytes' Anti-Malware\mbamapi.exe' /set alwaysscanfiles on
- '%ProgramFiles%\Malwarebytes' Anti-Malware\mbamapi.exe' /set alwaysscanmemory on
- '%ProgramFiles%\Malwarebytes' Anti-Malware\mbamapi.exe' /set alwaysscanregistry on
- '%ProgramFiles%\Malwarebytes' Anti-Malware\mbamapi.exe' /set advancedHeuristics on
- '%ProgramFiles%\Malwarebytes' Anti-Malware\mbamapi.exe' /set alwaysscanstartups on
- '%ProgramFiles%\Malwarebytes' Anti-Malware\mbamapi.exe' /set alwaysscanheuristics on
- '%ProgramFiles%\Malwarebytes' Anti-Malware\mbamapi.exe' /set updatewarndays 7
- '%ProgramFiles%\Malwarebytes' Anti-Malware\mbamapi.exe' /set reportthreats off
- '%ProgramFiles%\Malwarebytes' Anti-Malware\mbamapi.exe' /set autosavelog on
- '%ProgramFiles%\Malwarebytes' Anti-Malware\mbamapi.exe' /set terminateie off
- '%ProgramFiles%\Malwarebytes' Anti-Malware\mbamapi.exe' /set updatewarn on
- '%ProgramFiles%\Malwarebytes' Anti-Malware\mbamapi.exe' /set openlog on
- '%ProgramFiles%\Malwarebytes' Anti-Malware\mbamapi.exe' /set contextmenu on
Modifies file system:
Creates the following files:
- %ProgramFiles%\Malwarebytes' Anti-Malware\Chameleon\is-O7FI5.tmp
- %ProgramFiles%\Malwarebytes' Anti-Malware\is-0L6U6.tmp
- %ProgramFiles%\Malwarebytes' Anti-Malware\Chameleon\is-URQB5.tmp
- %ProgramFiles%\Malwarebytes' Anti-Malware\Chameleon\is-NGB9V.tmp
- %ProgramFiles%\Malwarebytes' Anti-Malware\Chameleon\is-SRMID.tmp
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Configuration\is-HLLP8.tmp
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Configuration\is-61DL2.tmp
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Configuration\is-S58ME.tmp
- %ProgramFiles%\Malwarebytes' Anti-Malware\is-8KK7R.tmp
- %ProgramFiles%\Malwarebytes' Anti-Malware\is-ON2HK.tmp
- %ProgramFiles%\Malwarebytes' Anti-Malware\Chameleon\is-17G9Q.tmp
- %ProgramFiles%\Malwarebytes' Anti-Malware\Chameleon\is-02OL1.tmp
- %ProgramFiles%\Malwarebytes' Anti-Malware\Chameleon\is-CUMSV.tmp
- %ProgramFiles%\Malwarebytes' Anti-Malware\Chameleon\is-NG06T.tmp
- %ProgramFiles%\Malwarebytes' Anti-Malware\Chameleon\is-L3HL3.tmp
- %ProgramFiles%\Malwarebytes' Anti-Malware\Chameleon\is-CVRFB.tmp
- %ProgramFiles%\Malwarebytes' Anti-Malware\Chameleon\is-2T0VV.tmp
- %ProgramFiles%\Malwarebytes' Anti-Malware\Chameleon\is-O8E2F.tmp
- %ProgramFiles%\Malwarebytes' Anti-Malware\Chameleon\is-ES8NN.tmp
- %ProgramFiles%\Malwarebytes' Anti-Malware\Chameleon\is-55Q1A.tmp
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Configuration\is-F0702.tmp
- %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\is-OQC6P.tmp
- %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\is-UVKGI.tmp
- %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\is-C4TE1.tmp
- %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\is-EF1TP.tmp
- %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\is-UI1BK.tmp
- %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\is-DOVIB.tmp
- %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\is-OAGNB.tmp
- %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\is-G8LON.tmp
- %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\is-K92EC.tmp
- %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\is-G38KP.tmp
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Configuration\is-43A7N.tmp
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Configuration\is-3EJAF.tmp
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Configuration\is-8NNG9.tmp
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Configuration\is-O21P4.tmp
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Configuration\is-RS7AC.tmp
- %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\is-ASQUM.tmp
- %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\is-GFDFT.tmp
- %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\is-CM8DQ.tmp
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\is-2GBKR.tmp
- %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\is-DI6JP.tmp
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\rules.ref
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\ignore.dat
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Configuration\database.conf
- %WINDIR%\Temp\t_8jrfo2.0.cs
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\protection-log-2017-07-23-683212.txt
- %WINDIR%\Installer\{2C992168-FB07-4D3E-884D-924DB7DFD2E8}\_853F67D554F05449430E7E.exe
- %WINDIR%\Installer\240bc.msi
- %TEMP%\~DF5DFB.tmp
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Configuration\custom.conf
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Configuration\local.conf
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\exclusions.dat
- %WINDIR%\Temp\tempSysLog_56a51b7c-531f-44da-bba8-19c12f12d1af.txt
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\protection-log-2017-07-23.txt
- %WINDIR%\Temp\tempSysLog_8eeed859-7beb-4579-99f5-a1427246d6e5.txt
- %ALLUSERSPROFILE%\Application Data\sccomm\isthzlir.newcfg
- %WINDIR%\Temp\t_8jrfo2.out
- %WINDIR%\Temp\t_8jrfo2.cmdline
- %WINDIR%\Temp\CSCE.tmp
- %WINDIR%\Temp\t_8jrfo2.dll
- %WINDIR%\Temp\RESF.tmp
- %WINDIR%\Temp\7kvpam1l.dll
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\rules.new
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\version.check
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\rules.new.yaml
- %ALLUSERSPROFILE%\Application Data\sccomm\omvkhslx.newcfg
- %ProgramFiles%\Malwarebytes' Managed Client\gpix8ltm.newcfg
- %ProgramFiles%\Malwarebytes' Anti-Malware\unins000.dat
- %ProgramFiles%\Malwarebytes' Anti-Malware\unins000.msg
- %TEMP%\coreinst.result
- %ALLUSERSPROFILE%\Application Data\sccomm\ClientVersion.txt
- %ALLUSERSPROFILE%\Application Data\sccomm\Policy.xml
- %WINDIR%\Temp\7kvpam1l.cmdline
- %WINDIR%\Temp\7kvpam1l.0.cs
- %WINDIR%\Temp\7kvpam1l.out
- %WINDIR%\Temp\RESC.tmp
- %WINDIR%\Temp\CSCB.tmp
- %WINDIR%\Installer\MSI9.tmp
- %ProgramFiles%\Malwarebytes' Managed Client\SC.Client.Setup.CustomAtion.InstallState
- %ProgramFiles%\Malwarebytes' Managed Client\SCComm.InstallState
- %ALLUSERSPROFILE%\Application Data\sccomm\sccomm.log
- %WINDIR%\Installer\MSIA.tmp
- %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\is-IVLJ6.tmp
- %WINDIR%\Installer\240ba.ipi
- %WINDIR%\Installer\MSI5.tmp-\CustomAction.config
- %TEMP%\~DFDC83.tmp
- C:\Config.Msi\240bb.rbs
- %WINDIR%\Installer\MSI6.tmp
- %WINDIR%\Installer\MSI4.tmp
- %WINDIR%\Installer\MSI3.tmp-\CustomAction.config
- %WINDIR%\Installer\MSI5.tmp
- %WINDIR%\Installer\MSI5.tmp-\Microsoft.Deployment.WindowsInstaller.dll
- %WINDIR%\Installer\MSI5.tmp-\SC.Client.Setup.CustomOperation.dll
- %ProgramFiles%\Malwarebytes' Managed Client\SCComm.exe.config
- %ProgramFiles%\Malwarebytes' Managed Client\Microsoft.Web.Services3.dll
- %ProgramFiles%\Malwarebytes' Managed Client\SC.Common.dll
- %ProgramFiles%\Malwarebytes' Managed Client\Coreinst.exe
- %WINDIR%\Installer\MSI8.tmp
- %ProgramFiles%\Malwarebytes' Managed Client\SCComm.exe
- %ProgramFiles%\Malwarebytes' Managed Client\SC.Client.Setup.CustomAtion.dll
- %ProgramFiles%\Malwarebytes' Managed Client\MBAMHelper.exe
- %ProgramFiles%\Malwarebytes' Managed Client\SC.WseBase.dll
- %ProgramFiles%\Malwarebytes' Managed Client\mee_main.bmp
- %WINDIR%\Installer\MSI3.tmp-\Microsoft.Deployment.WindowsInstaller.dll
- %TEMP%\rules.ref
- %TEMP%\mbam.check.database
- %TEMP%\rules.ref.yaml
- %TEMP%\MBAMHelper.exe
- %TEMP%\Coreinst.exe
- %TEMP%\coreinst.xml
- %TEMP%\ClientSetup.msi
- %TEMP%\policy.xml
- %TEMP%\ClientVersion.txt
- %TEMP%\SCComm.xml
- %WINDIR%\Installer\MSI1.tmp
- %WINDIR%\Installer\240b8.msi
- %TEMP%\CFG2.tmp
- %WINDIR%\Installer\MSI3.tmp-\SC.Client.Setup.CustomOperation.dll
- %WINDIR%\Installer\MSI3.tmp
- %TEMP%\Microsoft.Web.Services3.dll
- %TEMP%\setup.exe
- %TEMP%\SC.Common.dll
- %TEMP%\MSI23b3a.LOG
- %TEMP%\SC.WseBase.dll
- %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\is-HFEOM.tmp
- %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\is-5ITE6.tmp
- %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\is-DBFSA.tmp
- %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\is-C5HFU.tmp
- %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\is-8HHQM.tmp
- %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\is-67G4T.tmp
- %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\is-ON2EG.tmp
- %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\is-TMOF9.tmp
- %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\is-E64A5.tmp
- %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\is-OMT6D.tmp
- %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\is-JDADF.tmp
- %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\is-DH6ER.tmp
- %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\is-I2IRO.tmp
- %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\is-MG0P0.tmp
- %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\is-FLCDD.tmp
- %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\is-5PSLH.tmp
- %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\is-FR5CA.tmp
- %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\is-8JSBS.tmp
- %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\is-0MUFV.tmp
- %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\is-N7R4R.tmp
- %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\is-3TCB2.tmp
- %ProgramFiles%\Malwarebytes' Anti-Malware\is-9OMPB.tmp
- %ProgramFiles%\Malwarebytes' Anti-Malware\is-A17HP.tmp
- %ProgramFiles%\Malwarebytes' Anti-Malware\is-18R9D.tmp
- %ProgramFiles%\Malwarebytes' Anti-Malware\is-9GRVC.tmp
- %ProgramFiles%\Malwarebytes' Anti-Malware\is-PHJD1.tmp
- %ProgramFiles%\Malwarebytes' Anti-Malware\is-H2AQB.tmp
- %ProgramFiles%\Malwarebytes' Managed Client\coreinst.xml
- <DRIVERS>\is-5GPL3.tmp
- %ProgramFiles%\Malwarebytes' Anti-Malware\is-1BPKH.tmp
- %ProgramFiles%\Malwarebytes' Anti-Malware\is-QF694.tmp
- %ProgramFiles%\Malwarebytes' Anti-Malware\is-I69LI.tmp
- %ProgramFiles%\Malwarebytes' Anti-Malware\is-QE0OA.tmp
- %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\is-3SHVV.tmp
- %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\is-6G2EE.tmp
- %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\is-QSEDB.tmp
- %ProgramFiles%\Malwarebytes' Anti-Malware\is-GFDJ8.tmp
- %ProgramFiles%\Malwarebytes' Anti-Malware\is-UMUSA.tmp
- %ProgramFiles%\Malwarebytes' Anti-Malware\is-QQ054.tmp
- %ProgramFiles%\Malwarebytes' Anti-Malware\is-VAQKN.tmp
- %ProgramFiles%\Malwarebytes' Anti-Malware\is-27HQR.tmp
Deletes the following files:
- %WINDIR%\Installer\MSI6.tmp
- %WINDIR%\Installer\MSIA.tmp
- %WINDIR%\Installer\240b8.msi
- C:\Config.Msi\240bb.rbs
- %WINDIR%\Temp\7kvpam1l.out
- %WINDIR%\Temp\7kvpam1l.0.cs
- %WINDIR%\Temp\7kvpam1l.dll
- %WINDIR%\Temp\7kvpam1l.cmdline
- %WINDIR%\Temp\t_8jrfo2.cmdline
- %WINDIR%\Temp\t_8jrfo2.out
- %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\ignore.dat
- %WINDIR%\Temp\t_8jrfo2.dll
- %WINDIR%\Temp\RESF.tmp
- %WINDIR%\Installer\240ba.ipi
- %WINDIR%\Temp\t_8jrfo2.0.cs
- %WINDIR%\Temp\CSCE.tmp
- %WINDIR%\Temp\CSCB.tmp
- %WINDIR%\Installer\MSI4.tmp
- %WINDIR%\Installer\MSI3.tmp
- %WINDIR%\Installer\MSI5.tmp-\Microsoft.Deployment.WindowsInstaller.dll
- %WINDIR%\Installer\MSI5.tmp-\CustomAction.config
- %WINDIR%\Installer\MSI3.tmp-\CustomAction.config
- %WINDIR%\Installer\MSI1.tmp
- %WINDIR%\Installer\MSI3.tmp-\SC.Client.Setup.CustomOperation.dll
- %WINDIR%\Installer\MSI3.tmp-\Microsoft.Deployment.WindowsInstaller.dll
- %WINDIR%\Installer\MSI8.tmp
- %TEMP%\is-43GHQ.tmp\coreinst.tmp
- %WINDIR%\Temp\RESC.tmp
- %WINDIR%\Installer\MSI9.tmp
- %WINDIR%\Installer\MSI5.tmp
- %WINDIR%\Installer\MSI5.tmp-\SC.Client.Setup.CustomOperation.dll
- %TEMP%\is-NMLMR.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-NMLMR.tmp\mbam.dll
Moves the following files:
- from %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Configuration\is-RS7AC.tmp to %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Configuration\news.conf
- from %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Configuration\is-O21P4.tmp to %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Configuration\html.conf
- from %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Configuration\is-8NNG9.tmp to %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Configuration\custom.conf
- from %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Configuration\is-3EJAF.tmp to %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Configuration\config.conf
- from %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Configuration\is-43A7N.tmp to %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Configuration\build.conf
- from %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Configuration\is-F0702.tmp to %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Configuration\database.conf
- from %ProgramFiles%\Malwarebytes' Anti-Malware\is-ON2HK.tmp to %ProgramFiles%\Malwarebytes' Anti-Malware\7z.dll
- from %ProgramFiles%\Malwarebytes' Anti-Malware\is-8KK7R.tmp to %ProgramFiles%\Malwarebytes' Anti-Malware\ssubtmr6.dll
- from %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Configuration\is-S58ME.tmp to %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Configuration\local.conf
- from %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Configuration\is-61DL2.tmp to %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Configuration\manifest.conf
- from %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Configuration\is-HLLP8.tmp to %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Configuration\messaging.conf
- from %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\is-C4TE1.tmp to %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\slovak.lng
- from %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\is-UI1BK.tmp to %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\slovenian.lng
- from %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\is-OQC6P.tmp to %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\serbian.lng
- from %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\is-K92EC.tmp to %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\romanian.lng
- from %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\is-UVKGI.tmp to %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\russian.lng
- from %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\is-EF1TP.tmp to %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\spanish.lng
- from %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\is-DI6JP.tmp to %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\vietnamese.lng
- from %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\is-2GBKR.tmp to %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\rules.ref
- from %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\is-CM8DQ.tmp to %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\turkish.lng
- from %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\is-GFDFT.tmp to %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\swedish.lng
- from %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\is-ASQUM.tmp to %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\thai.lng
- from %ProgramFiles%\Malwarebytes' Anti-Malware\Chameleon\is-NG06T.tmp to %ProgramFiles%\Malwarebytes' Anti-Malware\Chameleon\rundll32.exe
- from %ProgramFiles%\Malwarebytes' Managed Client\gpix8ltm.newcfg to %ProgramFiles%\Malwarebytes' Managed Client\SCComm.exe.config
- from %ProgramFiles%\Malwarebytes' Anti-Malware\Chameleon\is-L3HL3.tmp to %ProgramFiles%\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
- from %ProgramFiles%\Malwarebytes' Anti-Malware\Chameleon\is-17G9Q.tmp to %ProgramFiles%\Malwarebytes' Anti-Malware\Chameleon\firefox.scr
- from %ProgramFiles%\Malwarebytes' Anti-Malware\Chameleon\is-CUMSV.tmp to %ProgramFiles%\Malwarebytes' Anti-Malware\Chameleon\iexplore.exe
- from %ALLUSERSPROFILE%\Application Data\sccomm\omvkhslx.newcfg to %ALLUSERSPROFILE%\Application Data\sccomm\SCComm.xml
- from %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\protection-log-2017-07-23.txt to %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\archived-protection-log-2017-07-23.txt
- from %WINDIR%\Temp\tempSysLog_8eeed859-7beb-4579-99f5-a1427246d6e5.txt to %ALLUSERSPROFILE%\Application Data\sccomm\txsyslog\tempSysLog_8eeed859-7beb-4579-99f5-a1427246d6e5.txt
- from %ALLUSERSPROFILE%\Application Data\sccomm\isthzlir.newcfg to %ALLUSERSPROFILE%\Application Data\sccomm\SCComm.xml
- from %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\protection-log-2017-07-23-683212.txt to %ALLUSERSPROFILE%\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\archived-protection-log-2017-07-23-683212.txt
- from %WINDIR%\Temp\tempSysLog_56a51b7c-531f-44da-bba8-19c12f12d1af.txt to %ALLUSERSPROFILE%\Application Data\sccomm\txsyslog\tempSysLog_56a51b7c-531f-44da-bba8-19c12f12d1af.txt
- from %ProgramFiles%\Malwarebytes' Anti-Malware\Chameleon\is-SRMID.tmp to %ProgramFiles%\Malwarebytes' Anti-Malware\Chameleon\mbam-chameleon.exe
- from %ProgramFiles%\Malwarebytes' Anti-Malware\Chameleon\is-NGB9V.tmp to %ProgramFiles%\Malwarebytes' Anti-Malware\Chameleon\mbam-chameleon.com
- from %ProgramFiles%\Malwarebytes' Anti-Malware\Chameleon\is-URQB5.tmp to %ProgramFiles%\Malwarebytes' Anti-Malware\Chameleon\mbam-killer.exe
- from %ProgramFiles%\Malwarebytes' Anti-Malware\is-0L6U6.tmp to %ProgramFiles%\Malwarebytes' Anti-Malware\vbalsgrid6.ocx
- from %ProgramFiles%\Malwarebytes' Anti-Malware\Chameleon\is-O7FI5.tmp to %ProgramFiles%\Malwarebytes' Anti-Malware\Chameleon\chameleon.chm
- from %ProgramFiles%\Malwarebytes' Anti-Malware\Chameleon\is-2T0VV.tmp to %ProgramFiles%\Malwarebytes' Anti-Malware\Chameleon\mbam-chameleon.pif
- from %ProgramFiles%\Malwarebytes' Anti-Malware\Chameleon\is-ES8NN.tmp to %ProgramFiles%\Malwarebytes' Anti-Malware\Chameleon\firefox.com
- from %ProgramFiles%\Malwarebytes' Anti-Malware\Chameleon\is-02OL1.tmp to %ProgramFiles%\Malwarebytes' Anti-Malware\Chameleon\firefox.pif
- from %ProgramFiles%\Malwarebytes' Anti-Malware\Chameleon\is-55Q1A.tmp to %ProgramFiles%\Malwarebytes' Anti-Malware\Chameleon\firefox.exe
- from %ProgramFiles%\Malwarebytes' Anti-Malware\Chameleon\is-CVRFB.tmp to %ProgramFiles%\Malwarebytes' Anti-Malware\Chameleon\mbam-chameleon.scr
- from %ProgramFiles%\Malwarebytes' Anti-Malware\Chameleon\is-O8E2F.tmp to %ProgramFiles%\Malwarebytes' Anti-Malware\Chameleon\svchost.exe
- from %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\is-G38KP.tmp to %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\portuguesePT.lng
- from %ProgramFiles%\Malwarebytes' Anti-Malware\is-QE0OA.tmp to %ProgramFiles%\Malwarebytes' Anti-Malware\license.rtf
- from %ProgramFiles%\Malwarebytes' Anti-Malware\is-I69LI.tmp to %ProgramFiles%\Malwarebytes' Anti-Malware\changes.txt
- from %ProgramFiles%\Malwarebytes' Anti-Malware\is-VAQKN.tmp to %ProgramFiles%\Malwarebytes' Anti-Malware\mbam.chm
- from %ProgramFiles%\Malwarebytes' Anti-Malware\is-QQ054.tmp to %ProgramFiles%\Malwarebytes' Anti-Malware\mbamapi.exe
- from %ProgramFiles%\Malwarebytes' Anti-Malware\is-27HQR.tmp to %ProgramFiles%\Malwarebytes' Anti-Malware\mbamhelper.exe
- from %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\is-3SHVV.tmp to %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\arabic.lng
- from %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\is-ON2EG.tmp to %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\catalan.lng
- from %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\is-67G4T.tmp to %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\chineseSI.lng
- from %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\is-3TCB2.tmp to %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\bulgarian.lng
- from %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\is-QSEDB.tmp to %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\belarusian.lng
- from %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\is-6G2EE.tmp to %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\bosnian.lng
- from %ProgramFiles%\Malwarebytes' Anti-Malware\is-1BPKH.tmp to %ProgramFiles%\Malwarebytes' Anti-Malware\mbam.dll
- from %ProgramFiles%\Malwarebytes' Anti-Malware\is-A17HP.tmp to %ProgramFiles%\Malwarebytes' Anti-Malware\mbamcore.dll
- from %ProgramFiles%\Malwarebytes' Anti-Malware\is-QF694.tmp to %ProgramFiles%\Malwarebytes' Anti-Malware\mbamext.dll
- from %ProgramFiles%\Malwarebytes' Anti-Malware\is-H2AQB.tmp to %ProgramFiles%\Malwarebytes' Anti-Malware\unins000.exe
- from <DRIVERS>\is-5GPL3.tmp to <DRIVERS>\mbam.sys
- from %ProgramFiles%\Malwarebytes' Anti-Malware\is-9OMPB.tmp to %ProgramFiles%\Malwarebytes' Anti-Malware\mbamnet.dll
- from %ProgramFiles%\Malwarebytes' Anti-Malware\is-UMUSA.tmp to %ProgramFiles%\Malwarebytes' Anti-Malware\mbamscheduler.exe
- from %ProgramFiles%\Malwarebytes' Anti-Malware\is-GFDJ8.tmp to %ProgramFiles%\Malwarebytes' Anti-Malware\mbampt.exe
- from %ProgramFiles%\Malwarebytes' Anti-Malware\is-9GRVC.tmp to %ProgramFiles%\Malwarebytes' Anti-Malware\mbamservice.exe
- from %ProgramFiles%\Malwarebytes' Anti-Malware\is-18R9D.tmp to %ProgramFiles%\Malwarebytes' Anti-Malware\mbam.exe
- from %ProgramFiles%\Malwarebytes' Anti-Malware\is-PHJD1.tmp to %ProgramFiles%\Malwarebytes' Anti-Malware\mbamgui.exe
- from %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\is-JDADF.tmp to %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\italian.lng
- from %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\is-I2IRO.tmp to %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\japanese.lng
- from %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\is-DH6ER.tmp to %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\indonesian.lng
- from %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\is-N7R4R.tmp to %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\hebrew.lng
- from %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\is-0MUFV.tmp to %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\hungarian.lng
- from %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\is-FLCDD.tmp to %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\korean.lng
- from %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\is-DOVIB.tmp to %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\polish.lng
- from %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\is-G8LON.tmp to %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\portugueseBR.lng
- from %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\is-OAGNB.tmp to %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\norwegian.lng
- from %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\is-MG0P0.tmp to %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\latvian.lng
- from %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\is-IVLJ6.tmp to %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\lithuanian.lng
- from %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\is-5ITE6.tmp to %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\danish.lng
- from %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\is-HFEOM.tmp to %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\dutch.lng
- from %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\is-E64A5.tmp to %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\czech.lng
- from %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\is-TMOF9.tmp to %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\chineseTR.lng
- from %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\is-OMT6D.tmp to %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\croatian.lng
- from %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\is-DBFSA.tmp to %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\english.lng
- from %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\is-5PSLH.tmp to %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\german.lng
- from %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\is-8JSBS.tmp to %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\greek.lng
- from %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\is-FR5CA.tmp to %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\french.lng
- from %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\is-8HHQM.tmp to %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\estonian.lng
- from %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\is-C5HFU.tmp to %ProgramFiles%\Malwarebytes' Anti-Malware\Languages\finnish.lng
Network activity:
Connects to:
- 'lo#####p11.adslocal.net':18457
UDP:
- DNS ASK lo#####p11.adslocal.net
- DNS ASK st###.#bamupdates.com
Miscellaneous:
Searches for the following windows:
- ClassName: '#32770' WindowName: 'Malwarebytes'
- ClassName: '#32770' WindowName: 'Malwarebytes Managed Client'
- ClassName: 'MsiDialogCloseClass' WindowName: 'Malwarebytes Managed Client'
- ClassName: 'MsiDialogCloseClass' WindowName: 'Malwarebytes'
