Analysis
- max time kernel
133s - max time network
152s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
24/04/2026, 16:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-24_01a29ef2d540a6a0ec4e190f02ce1748_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
36 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-24_01a29ef2d540a6a0ec4e190f02ce1748_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
Resource
win11-20260130-en
windows11-21h2-x64
31 signatures
150 seconds
General
- Target 2026-04-24_01a29ef2d540a6a0ec4e190f02ce1748_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe
- Size 3.2MB
- Sample260424-twypjset4t
- SHA256 825b78484d8f2ef709223e0222d36923801ffc5f5769ebd30ec8a7122b668cdd
- MD5 01a29ef2d540a6a0ec4e190f02ce1748
- SHA1 62e55dbc518b1db0b6c790a3592d201b37e1822b
- SHA512 7cfe951f01d145c24d0daff1044fc218d637c2d53d4cbdaf8215a49ea401b32c8e3e509c88d9a491c8c54ef00f6133e530bb919d73fba94940de20f32069445c
- SSDEEP 49152:ZUgNqjSWrbs3E5C4tAwAeyfvE0Z3R0Tnxn1o2d581Kk2LlOpbeZB7m:Z/6SWrbs3yC4AeKtwnW2EHycv
- TLSH T149F5AF31B2918120E5F39370297EB7EA5B75BC256F76408F32D8BA390B725C09D35B26
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs
resource yara_rule behavioral2/files/0x001100000002b92a-3009.dat INDICATOR_SUSPICIOUS_Binary_References_Browsers - Detects executables built or packed with MPress PE compressor 2 IoCs
resource yara_rule behavioral2/files/0x001900000002b39a-2332.dat INDICATOR_EXE_Packed_MPress behavioral2/files/0x001100000002b92d-3015.dat INDICATOR_EXE_Packed_MPress - Detects executables packed with ConfuserEx Mod 1 IoCs
resource yara_rule behavioral2/files/0x001900000002b39a-2332.dat INDICATOR_EXE_Packed_ConfuserEx - Detects executables packed with Themida 1 IoCs
resource yara_rule behavioral2/files/0x001900000002b39a-2332.dat INDICATOR_EXE_Packed_Themida - Downloads MZ/PE file 2 IoCs
flow pid Process 4 1488 2026-04-24_01a29ef2d540a6a0ec4e190f02ce1748_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe 21 1488 2026-04-24_01a29ef2d540a6a0ec4e190f02ce1748_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe - Drops file in Drivers directory 5 IoCs
description ioc Process File created C:\Windows\system32\DRIVERS\MbamElam.sys MBAMService.exe File opened for modification C:\Windows\system32\DRIVERS\MbamElam.sys MBAMService.exe File opened for modification C:\Windows\SysWOW64\drivers\mbamtestfile.dat 2026-04-24_01a29ef2d540a6a0ec4e190f02ce1748_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File created C:\Windows\SysWOW64\drivers\mbamtestfile.dat 2026-04-24_01a29ef2d540a6a0ec4e190f02ce1748_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File created C:\Windows\system32\drivers\mbae.sys MBAMInstallerService.exe - Patched UPX-packed file 1 IoCs
Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
resource yara_rule behavioral2/files/0x001900000002b39a-2332.dat patched_upx - Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 2026-04-24_01a29ef2d540a6a0ec4e190f02ce1748_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 2026-04-24_01a29ef2d540a6a0ec4e190f02ce1748_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion MBAMService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate MBAMService.exe - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 7 IoCs
pid Process 2396 MBAMInstallerService.exe 2564 MBVpnTunnelService.exe 3060 MBVpnTunnelService.exe 2416 MBAMService.exe 4124 MBAMService.exe 4784 MbamElam.sys 1420 MBAMService.exe - Impair Defenses: Safe Mode Boot 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\MBAMService MBAMInstallerService.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\MBAMService\ = "Service" MBAMInstallerService.exe - Loads dropped DLL 9 IoCs
pid Process 2396 MBAMInstallerService.exe 2396 MBAMInstallerService.exe 2564 MBVpnTunnelService.exe 3060 MBVpnTunnelService.exe 3060 MBVpnTunnelService.exe 1420 MBAMService.exe 1420 MBAMService.exe 1420 MBAMService.exe 1420 MBAMService.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: MBAMService.exe File opened (read-only) \??\R: MBAMService.exe File opened (read-only) \??\Y: MBAMService.exe File opened (read-only) \??\A: MBAMService.exe File opened (read-only) \??\I: MBAMService.exe File opened (read-only) \??\K: MBAMService.exe File opened (read-only) \??\L: MBAMService.exe File opened (read-only) \??\M: MBAMService.exe File opened (read-only) \??\S: MBAMService.exe File opened (read-only) \??\B: MBAMService.exe File opened (read-only) \??\G: MBAMService.exe File opened (read-only) \??\Q: MBAMService.exe File opened (read-only) \??\U: MBAMService.exe File opened (read-only) \??\X: MBAMService.exe File opened (read-only) \??\J: MBAMService.exe File opened (read-only) \??\N: MBAMService.exe File opened (read-only) \??\P: MBAMService.exe File opened (read-only) \??\T: MBAMService.exe File opened (read-only) \??\V: MBAMService.exe File opened (read-only) \??\W: MBAMService.exe File opened (read-only) \??\Z: MBAMService.exe File opened (read-only) \??\E: MBAMService.exe File opened (read-only) \??\H: MBAMService.exe - ConfuserEx .NET packer 1 IoCs
Detects ConfuserEx .NET packer.
resource yara_rule behavioral2/files/0x001900000002b39a-2332.dat ConfuserEx - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\System32\DriverStore\FileRepository\ykinx64.inf_amd64_0bbd8466b526ef26\ykinx64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\nett4x64.inf_amd64_54eacac1858c78ab\nett4x64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\net8187bv64.inf_amd64_bc859d32f3e2f0d5\net8187bv64.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EF7234CDBB1649702229F955C785C39F MBAMService.exe File created C:\Windows\System32\DriverStore\FileRepository\usbnet.inf_amd64_5229ee1dac1c624e\usbnet.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netvg63a.inf_amd64_9f5493180b1252cf\netvg63a.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netwlv64.inf_amd64_0b9818131664d91e\netwlv64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\net8192su64.inf_amd64_66c8bfc7a4b1feed\net8192su64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\rt640x64.inf_amd64_6150ccb5b6a4c3cd\rt640x64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\usbncm.inf_amd64_6686e5d9c8b063ef\usbncm.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netimm.inf_amd64_8b2087393aaef952\netimm.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\ndisimplatformmp.inf_amd64_206e9e544d84356f\ndisimplatformmp.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netrasa.inf_amd64_1ed57daf97af7063\netrasa.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\Temp\{10d63918-0794-c64a-b269-d7939682f375}\SET517D.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\net7500-x64-n650f.inf_amd64_cc87c915f33d1c27\net7500-x64-n650f.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netwew00.inf_amd64_325c0bd6349ed81c\netwew00.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\net8192se64.inf_amd64_167684f9283b4eca\net8192se64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\rtwlanu_oldic.inf_amd64_1a82423cc076e882\rtwlanu_oldic.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{10d63918-0794-c64a-b269-d7939682f375}\SET518D.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\netax88179_178a.inf_amd64_a8bb8a6e92764769\netax88179_178a.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netefe3e.inf_amd64_7830581a689ef40d\netefe3e.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\rtucx21x64.inf_amd64_d70642620058e2a4\rtucx21x64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netmlx4eth63.inf_amd64_3809a4a3e7e07703\netmlx4eth63.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\bcmdhd64.inf_amd64_e0bae6831f60ea5f\bcmdhd64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\qcwlan64.inf_amd64_71c84e1405061462\qcwlan64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netr28ux.inf_amd64_d5996f2a9d9aa9e3\netr28ux.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netrtwlane.inf_amd64_35c52a008b0fba12\netrtwlane.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netg664.inf_amd64_84cd7b2798e0a666\netg664.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netwtw04.inf_amd64_c8f5ae6576289a2d\netwtw04.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netwtw08.inf_amd64_62f41b89e0dc2537\netwtw08.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netrndis.inf_amd64_bccd4c0a924862b1\netrndis.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\mwlu97w8x64.inf_amd64_23bc3dc6d91eebdc\mwlu97w8x64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netv1x64.inf_amd64_30040c3eb9d7ade4\netv1x64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\net8185.inf_amd64_7a30f5a9441cd55b\net8185.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\net44amd.inf_amd64_450d4b1e35cc8e0d\net44amd.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\mbtun.inf_amd64_add82795013a7c3b\mbtun.cat DrvInst.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50 MBAMService.exe File created C:\Windows\System32\DriverStore\FileRepository\netwns64.inf_amd64_162bb49f925c6463\netwns64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\b57nd60a.inf_amd64_77a731ab08be20a5\b57nd60a.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\86844F70250DD8EF225D6B4178798C21_44AD5D0C299F1D4EE038B125B5E5863A MBAMService.exe File created C:\Windows\System32\DriverStore\FileRepository\net7800-x64-n650f.inf_amd64_178f1bdb49a6e2fd\net7800-x64-n650f.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netwbw02.inf_amd64_1c4077fa004e73b4\netwbw02.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\bcmwdidhdpcie.inf_amd64_977dcc915465b0e9\bcmwdidhdpcie.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\net8187se64.inf_amd64_99a4ca261f585f17\net8187se64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\wceisvista.inf_amd64_3aa3e69e968123a7\wceisvista.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 MBAMService.exe File created C:\Windows\System32\DriverStore\FileRepository\netl1e64.inf_amd64_8d5ca5ab1472fc44\netl1e64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netmyk64.inf_amd64_1f949c30555f4111\netmyk64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netrtwlanu.inf_amd64_1815bafd14dc59f0\netrtwlanu.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\bthpan.inf_amd64_a31306bfdf7135b0\bthpan.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{10d63918-0794-c64a-b269-d7939682f375}\SET517D.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\netloop.inf_amd64_09e02e589e7afd83\netloop.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\rtux64w10.inf_amd64_a39ece60dbc76c55\rtux64w10.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{10d63918-0794-c64a-b269-d7939682f375}\SET518E.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{10d63918-0794-c64a-b269-d7939682f375}\mbtun.sys DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\netwtw02.inf_amd64_42e02bae858d0fbd\netwtw02.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netbc63a.inf_amd64_7ba6c9cea77dd549\netbc63a.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\net2ic68.inf_amd64_23084e964d79333d\net2ic68.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netelx.inf_amd64_7812e4e45c4a5eb1\netelx.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netwmbclass.inf_amd64_1fab0fd8cb4d7dee\netwmbclass.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\msux64w10.inf_amd64_749854ac3f28f846\msux64w10.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netavpna.inf_amd64_b98aa91c766be0ea\netavpna.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netvwifimp.inf_amd64_bfb9fd6f3a078899\netvwifimp.PNF MBVpnTunnelService.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.Private.Xml.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\Microsoft.Win32.SystemEvents.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\Microsoft.Extensions.DependencyInjection.Abstractions.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.ComponentModel.DataAnnotations.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.Console.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\ja\UIAutomationTypes.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\Serilog.Sinks.File.dll MBAMInstallerService.exe File created C:\Program Files (x86)\mbamtestfile.dat 2026-04-24_01a29ef2d540a6a0ec4e190f02ce1748_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File created C:\Program Files\Malwarebytes\Anti-Malware\408757fe-9368-47e1-9cc8-f6f3a80c84c9 2026-04-24_01a29ef2d540a6a0ec4e190f02ce1748_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.Drawing.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\es\ReachFramework.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\System.Diagnostics.PerformanceCounter.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\System.ServiceProcess.ServiceController.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\13b5e36d-cc93-4ede-8805-7135e3e21170 2026-04-24_01a29ef2d540a6a0ec4e190f02ce1748_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\api-ms-win-crt-locale-l1-1-0.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.IO.Compression.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.Net.ServicePoint.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\ja\System.Windows.Forms.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\ko\PresentationCore.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\pt-BR\System.Windows.Forms.Primitives.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\malwarebytes_assistant.deps.json MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.ObjectModel.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\ko\System.Windows.Forms.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\pl\PresentationCore.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\PresentationFramework-SystemDrawing.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\MWACControllerImpl.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\SwissarmyShim.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\Microsoft.EntityFrameworkCore.Sqlite.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\Microsoft.Extensions.Caching.Abstractions.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.Net.WebClient.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.Reflection.Primitives.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\fr\System.Windows.Input.Manipulations.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\PresentationNative_cor3.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\pt-BR\PresentationFramework.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\System.DirectoryServices.AccountManagement.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\sentrynativesdk.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\mbam.manifest.json MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.Private.CoreLib.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\ja\Microsoft.VisualBasic.Forms.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\ko\System.Windows.Controls.Ribbon.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\PresentationFramework.AeroLite.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\af4c968b-ec2e-4d80-9342-fb25b483cdde 2026-04-24_01a29ef2d540a6a0ec4e190f02ce1748_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\api-ms-win-crt-string-l1-1-0.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.Resources.ResourceManager.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.Threading.Tasks.Parallel.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\pl\WindowsFormsIntegration.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\tr\UIAutomationProvider.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\BrowserSDKDLLShim.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\System.Text.Encodings.Web.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\api-ms-win-crt-runtime-l1-1-0.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.Net.NameResolution.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.Security.Principal.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\pt-BR\System.Windows.Forms.Design.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\pt-BR\System.Xaml.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\pt-BR\WindowsBase.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\ru\UIAutomationClientSideProviders.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\pkgvers.dat MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.IO.Compression.ZipFile.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.Private.Uri.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.Xml.Linq.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\de\WindowsFormsIntegration.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\es\System.Windows.Forms.Primitives.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\Serilog.Extensions.Logging.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\PresentationFramework-SystemCore.dll MBAMInstallerService.exe - Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.dev.log MBVpnTunnelService.exe File opened for modification C:\Windows\INF\setupapi.dev.log svchost.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\inf\oem3.inf DrvInst.exe File created C:\Windows\inf\oem3.inf DrvInst.exe - Event Triggered Execution: Netsh Helper DLL 1 TTPs 1 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh MBVpnTunnelService.exe - Modifies trusted root certificate store through registry 1 TTPs 13 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F6108407D6F8BB67980CC2E244C2EBAE1CEF63BE\Blob = 030000000100000014000000f6108407d6f8bb67980cc2e244c2ebae1cef63be2000000001000000f6010000308201f230820178a0030201020213066c9fd7c1bb104c2943e5717b7b2cc81ac10e300a06082a8648ce3d0403033039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412034301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f7420434120343076301006072a8648ce3d020106052b8104002203620004d2ab8a374fa3530dfec18a7b4ba87b464b63b062f62d1bdb087121d200e863bd9a27fbf0396e5dea3da5c981aaa35b2098455d16dbfde8106de39ce0e3bd5f8462f3706433a0cb242f70ba88a12aa075f881ae6206c481db396e29b01efa2e5ca3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414d3ecc73a656ecce1da769a56fb9cf3866d57e581300a06082a8648ce3d040303036800306502303a8b21f1bd7e11add0ef58962fd6eb9d7e908d2bcf6655c32ce328a9700a470ef0375912ff2d9994284e2a4f354d335a023100ea75004e3bc43a941291c958469d211372a7889c8ae44c4adb96d4ac8b6b6b49125333add7e4be24fcb50a76d4a5bc10 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\1C58A3A8518E8759BF075B76B750D4F2DF264FCD\Blob = 0300000001000000140000001c58a3a8518e8759bf075b76b750d4f2df264fcd2000000001000000c2040000308204be308203a6a003020102021006d8d904d5584346f68a2fa754227ec4300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3231303431343030303030305a170d3331303431333233353935395a304f310b300906035504061302555331153013060355040a130c446967694365727420496e633129302706035504031320446967694365727420544c53205253412053484132353620323032302043413130820122300d06092a864886f70d01010105000382010f003082010a0282010100c14bb3654770bcdd4f58dbec9cedc366e51f311354ad4a66461f2c0aec6407e52edcdcb90a20eddfe3c4d09e9aa97a1d8288e51156db1e9f58c251e72c340d2ed292e156cbf1795fb3bb87ca25037b9a52416610604f571349f0e8376783dfe7d34b674c2251a6df0e9910ed57517426e27dc7ca622e131b7f238825536fc13458008b84fff8bea75849227b96ada2889b15bca07cdfe951a8d5b0ed37e236b4824b62b5499aecc767d6e33ef5e3d6125e44f1bf71427d58840380b18101faf9ca32bbb48e278727c52b74d4a8d697dec364f9cace53a256bc78178e490329aefb494fa415b9cef25c19576d6b79a72ba2272013b5d03d40d321300793ea99f50203010001a38201823082017e30120603551d130101ff040830060101ff020100301d0603551d0e04160414b76ba2eaa8aa848c79eab4da0f98b2c59576b9f4301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030106082b06010505070302307606082b06010505070101046a3068302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304006082b060105050730028634687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274476c6f62616c526f6f7443412e63727430420603551d1f043b30393037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274476c6f62616c526f6f7443412e63726c303d0603551d2004363034300b06096086480186fd6c02013007060567810c01013008060667810c0102013008060667810c0102023008060667810c010203300d06092a864886f70d01010b050003820101008032ce5e0bdd6e5a0d0aafe1d684cbc08efa8570edda5db30cf72b7540fe850afaf33178b7704b1a8958ba80bdf36b1de97ecf0bba589c59d490d3fd6cfdd0986db771825bcf6d0b5a09d07bdec443d82aa4de9e41265fbb8f99cbddaee1a86f9f87fe74b71f1b20abb14fc6f5675d5d9b3ce9ff69f7616cd6d9f3fd36c6ab038876d24b2e7586e3fcd8557d26c21177df3e02b67cf3ab7b7a86366fb8f7d89371cf86df7330fa7babed2a59c842843b11171a52f3c90e147da25b7267ba71ed574766c5b8024a65345e8bd02a3c209c51994ce7529ef76b112b0d927e1de88aeb36164387ea2a63bf753febdec403bb0a3cf730efebaf4cfc8b3610733ef3a4 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8DA7F965EC5EFC37910F1C6E59FDC1CC6A6EDE16\Blob = 0300000001000000140000008da7f965ec5efc37910f1c6e59fdc1cc6a6ede162000000001000000450300003082034130820229a0030201020213066c9fcf99bf8c0a39e2f0788a43e696365bca300d06092a864886f70d01010b05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412031301e170d3135303532363030303030305a170d3338303131373030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f74204341203130820122300d06092a864886f70d01010105000382010f003082010a0282010100b2788071ca78d5e371af478050747d6ed8d78876f49968f7582160f97484012fac022d86d3a0437a4eb2a4d036ba01be8ddb48c80717364cf4ee8823c73eeb37f5b519f84968b0ded7b976381d619ea4fe8236a5e54a56e445e1f9fdb416fa74da9c9b35392ffab02050066c7ad080b2a6f9afec47198f503807dca2873958f8bad5a9f948673096ee94785e6f89a351c0308666a14566ba54eba3c391f948dcffd1e8302d7d2d747035d78824f79ec4596ebb738717f2324628b843fab71daacab4f29f240e2d4bf7715c5e69ffea9502cb388aae50386fdbfb2d621bc5c71e54e177e067c80f9c8723d63f40207f2080c4804c3e3b24268e04ae6c9ac8aa0d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604148418cc8534ecbc0c94942e08599cc7b2104e0a08300d06092a864886f70d01010b0500038201010098f2375a4190a11ac57651282036230eaee628bbaaf894ae48a4307f1bfc248d4bb4c8a197f6b6f17a70c85393cc0828e39825cf23a4f9de21d37c8509ad4e9a753ac20b6a897876444718656c8d418e3b7f9acbf4b5a750d7052c37e8034bade961a0026ef5f2f0c5b2ed5bb7dcfa945c779e13a57f52ad95f2f8933bde8b5c5bca5a525b60af14f74befa3fb9f40956d3154fc42d3c7461f23add90f48709ad9757871d1724334756e5759c2025c266029cf2319168e8843a5d4e4cb08fb231143e843297262a1a95d5e08d490aeb8d8ce14c2d055f286f6c49343776661c0b9e841d7977860036e4a72aea5d17dba109e866c1b8ab95933f8ebc490bef1b9 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0D44DD8C3C8C1A1A58756481E90F2E2AFFB3D26E\Blob = 0300000001000000140000000d44dd8c3c8c1a1a58756481e90f2e2affb3d26e2000000001000000ba010000308201b63082015ba0030201020213066c9fd5749736663f3b0b9ad9e89e7603f24a300a06082a8648ce3d0403023039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412033301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f7420434120333059301306072a8648ce3d020106082a8648ce3d030107034200042997a7c6417fc00d9be8011b56c6f252a5ba2db212e8d22ed7fac9c5d8aa6d1f73813b3b986b397c33a5c54e868e8017686245577d44581db337e56708eb66dea3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414abb6dbd7069e37ac3086079170c79cc419b178c0300a06082a8648ce3d0403020349003046022100e08592a317b78df92b06a593ac1a98686172fae1a1d0fb1c7860a64399c5b8c40221009c02eff1949cb396f9ebc62af8b62cfe3a901416d78c6324481cdf307dd5683b MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\2AD974A775F73CBDBBD8F5AC3A49255FA8FB1F8C\Blob = 0300000001000000140000002ad974a775f73cbdbbd8f5ac3a49255fa8fb1f8c2000000001000000620400003082045e30820346a0030201020213077312380b9d6688a33b1ed9bf9ccda68e0e0f300d06092a864886f70d01010b05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412031301e170d3232303832333232323132385a170d3330303832333232323132385a303c310b3009060355040613025553310f300d060355040a1306416d617a6f6e311c301a06035504031313416d617a6f6e205253412032303438204d303130820122300d06092a864886f70d01010105000382010f003082010a0282010100eb712ca9cb1f8828923230af8a570f78b73725955587ac675c97d322c8daa214676b7cf067dae2032ab356125dc6b547f96708a7937a9592180fb4f9f910369a7f2f80b64fba134ec75d531ee0dd96330720d396bc12e4745042a1051373b54f9b4424fe2d7fedbc2285ec362133977506ce271882dce3d9c582078d5e26012626671fd93f13cf32ba6bad7864fcaaff0e023c07df9c0578728cfdea75b7032884dae86e078cd05085ef8154b2716eec6d62ef8f94c35ee9c4a4d091c02e249198caeeba258ed4f671b6fb5b6b38064837478d86dcf2ea06fb76377d9eff424e4d588293cfe271c278b17aab4b5b94378881e4d9af24aef872c565fb4bb451e70203010001a382015a3082015630120603551d130101ff040830060101ff020100300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030106082b06010505070302301d0603551d0e0416041481b80e638a891218e5fa3b3b50959fe6e5901385301f0603551d230418301680148418cc8534ecbc0c94942e08599cc7b2104e0a08307b06082b06010505070101046f306d302f06082b060105050730018623687474703a2f2f6f6373702e726f6f746361312e616d617a6f6e74727573742e636f6d303a06082b06010505073002862e687474703a2f2f6372742e726f6f746361312e616d617a6f6e74727573742e636f6d2f726f6f746361312e636572303f0603551d1f043830363034a032a030862e687474703a2f2f63726c2e726f6f746361312e616d617a6f6e74727573742e636f6d2f726f6f746361312e63726c30130603551d20040c300a3008060667810c010201300d06092a864886f70d01010b05000382010100ad00de0205232e063262b46bb19416e41140de2bfa59c135efe0aa8f2b41b9d1f38739001df23db5a7470c0606c691f3075702d4edbd17c1909abf4875a2074f30dd4a6a42b50d3d15c00ffe845bc63c99cc5752b1d86e12d59692934b94e507e88982086a7a34d49e64e13d876a92909a63a14bf88fb6ea34d305be20c2de06e28c9f738b9f4d3985cace19369d85c99ec9f8503fb67e88a1efca84068b50b40a5ca61c44f1fdc8614060f26125aa07f4c7c27375e40c0b428d04e55f4448995b7b898196a7889d4b0d62e804c4d7feb4e8b26dcaecc01cbc385b1ddf85ce5b7ae3494b6cb9a7ddf405b249ade1c5146bc2ccebcd7fd65869bac3207e7fb0b8 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 040000000100000010000000be954f16012122448ca8bc279602acf5140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a2030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa20f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e1900000001000000100000009f687581f7ef744ecfc12b9cee6238f12000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 MBAMService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 5c0000000100000004000000001000001900000001000000100000009f687581f7ef744ecfc12b9cee6238f10f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa2140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a2040000000100000010000000be954f16012122448ca8bc279602acf52000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 MBAMService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E\Blob = 030000000100000014000000b51c067cee2b0c3df855ab2d92f4fe39d4e70f0e2000000001000000e1030000308203dd308202c5a003020102020100300d06092a864886f70d01010b050030818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a30818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bdedc103fcf68ffc02b16f5b9f48d99d79e2a2b703615618c347b6d7ca3d352e8943f7a1699bde8a1afd13209cb44977322956fdb9ec8cdd22fa72dc276197eef65a84ec6e19b9892cdc845bd574fb6b5fc589a51052894655f4b8751ce67fe454ae4bf85572570219f8177159eb1e280774c59d48be6cb4f4a4b0f364377992c0ec465e7fe16d534c62afcd1f0b63bb3a9dfbfc7900986174cf26824063f3b2726a190d99cad40e75cc37fb8b89c159f1627f5fb35f6530f8a7b74d765a1e765e34c0e89656998ab3f07fa4cdbddc32317c91cfe05f11f86baa495cd19994d1a2e3635b0976b55662e14b741d96d426d4080459d0980e0ee6defcc3ec1f90f10203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147c0c321fa7d9307fc47d68a362a8a1ceab075b27300d06092a864886f70d01010b050003820101001159fa254f036f94993b9a1f828539d47605945ee128936d625d09c2a0a8d4b07538f1346a9de49f8a862651e62cd1c62d6e95204a9201ecb88a677b31e2672e8c9503262e439d4a31f60eb50cbbb7e2377f22ba00a30e7b52fb6bbb3bc4d379514ecd90f4670719c83c467a0d017dc558e76de68530179a24c410e004f7e0f27fd4aa0aff421d37ed94e5645912207738d3323e3881759673fa688fb1cbce1fc5ecfa9c7ecf7eb1f1072db6fcbfcaa4bfd097054abcea18280290bd5478092171d3d17d1dd916b0a9613dd00a0022fcc77bcb0964450b3b4081f77d7c32f598ca588e7d2aee90597364f936745e25a1f566052e7f3915a92afb508b8e8569f4 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa22000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\5A8CEF45D7A69859767A8C8B4496B578CF474B1A\Blob = 0300000001000000140000005a8cef45d7a69859767a8c8b4496b578cf474b1a2000000001000000450500003082054130820329a0030201020213066c9fd29635869f0a0fe58678f85b26bb8a37300d06092a864886f70d01010c05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412032301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f74204341203230820222300d06092a864886f70d01010105000382020f003082020a0282020100ad969f2d9c4a4c4a81795199ec8acb6b605113bc4d6d06fcb0088ddd19106ac7260c35d8c06f2084e994b19b8503c35bdb4ae8c8f89076d95b4fe34ce806364dcc9aac3d0c902b92d4061960ac374479858182ad5a37e00dcc9da64c5276ea439db704d150f655e0d5d2a64985e937e9ca7eae5c954d489a3fae205a6d8895d934b8521a4390b0bf6c05b9b678b7ead0e43a3c125362ff4af27bbe3505a91234e3f36474622c3d00495a28fe3244bb87dd652702713bda4af71fdacdf72155904f0fecae82e19f6bd945d3bbf05f87ed3c2c3986da3fdeec7255eb79a3addbdd7cb0ba1ccefcde4f3576cf0ff8781f6a36514627615be99ecff0a2557d7c258a6f2fb4c5cf842e2bfd0d51106cfb5f1bbc1b7ec5ae3b98013192ff0b57f49ab2b957e9abef0d76d1f0eef4ce86a7e06ee9b469a1df69f633c6692e97139ea587b057108137c953b3bb7ff692d19cd018f4926eda834fa663994ca5fb5eef21647a205f6c648515cb37e9620c0b2a16dc012e32da3e4bf59e3af6174094ef9e910886fabe63a85a33eccb744395f96c695236c7296ffc55035c1ffb9fbd47ebe74947950b4e89220949e0f5611ef1bf2e8a726e8059ff573af97532a34e5feced2862d94d73f2cc811760edcdebdcdba7cac57e02bdf2540854fdb42d092c17544a98d154e1516708d2ed6e7e6f3fd22d81592966cb903995111e7427feddebaf0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414b00cf04c30f405580248fd33e552af4b84e36652300d06092a864886f70d01010c05000382020100aaa8808f0e78a3e0a2d4cde6f5987a3bea0003b0970e93bc5aa8f62c8c7287a9b1fc7f73fd637178a58759cf30e10d10b2135a6d82f56ae6809fa0050b68e4476bc76adfb6fd773272e518fa09f4a0932c5dd28c75857665900c0379b7312363ad788309866884cafff9cf269a9279e7cd4bc5e761a717cbf3a91293936ba7e82f5392c46058b0cc0251185b858d625963b6adb4de9afb26f70027c05d55377499c9507fe3592e44e32c25eeec4c3277b49f1ae94b5d20c5dafd1c8716c643e8d4bb269a45705ea90b3753e2467b27fde046f289b7cc42b6cb28266ed9a5c93ac8411360f7508c15aeb26d1a151a5778e6922ad96590823f6c02afae123a27963604d71da28063a99bf1e5bab47c14b04ec9b11f745f38f651ea9bfa2ca211d4a92d271a45b1afb24e710dc05846d66906cb53cbb3fe6b41cd417e7d4c0f7c72797a59cd5e4a0eac9ba99873797cb4f4ccb9b8070cb2745cb8c76f88a190a7f4aaf9bf673af41a15621eb79fbe3db129af67a112f25810195303301bb81a89f69cbd97038ea309f31d8b21f1b4dfe41cd19f650206ea5cd613b384efa2a55c8c7729a768c06bae40d2a8b4eacdf08d4b389c199a1b2854b88990efca75813e1ef26424c718af4eff479e07f63565a4d30a56fff517646cefa822254993b6df0017da587e5deec51bb0d1d15f2110c7f9f3ba020a2707c5f1d6c7d3e0fb09606c MBAMInstallerService.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-24_01a29ef2d540a6a0ec4e190f02ce1748_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe - Checks SCSI registry key(s) 3 TTPs 26 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION MBAMInstallerService.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Malwarebytes.exe = "11000" MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION MBAMService.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\mbam.exe = "11000" MBAMService.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\mbamtray.exe = "11000" MBAMService.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\15.0 MBAMInstallerService.exe Set value (str) \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:\ MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\Software MBAMInstallerService.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:\ MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Malwarebytes MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0 MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Malwarebytes\FirstRun = "false" MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\15.0\Common MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\16.0\Common\Security MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\16.0\Common MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:\ MBAMInstallerService.exe Set value (str) \REGISTRY\USER\S-1-5-19\Software\Malwarebytes\FirstRun = "false" MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Malwarebytes MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0\Common MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\16.0 MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\16.0\Common MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Malwarebytes MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\15.0\Common\Security MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft MBAMInstallerService.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:\ MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\15.0\Common\Security MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\16.0\Common\Security MBAMInstallerService.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8C842243-BDAD-4A93-B282-93E3FCBC1CA4}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EBA4A79D-9F4E-4E7A-AC00-49ECE23C20B6}\TypeLib\Version = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3C0ECFDC-317D-406B-ADF5-C0E8217E244F} MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8FF168C7-A609-4237-A076-E461334BF4EA} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{34544A67-823A-484D-8E18-371AFEAEC02E}\TypeLib\Version = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MB.ScanController.1\CLSID MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B3B24818-1CC9-4825-96A9-1DB596E079C8}\ = "_ILogControllerEvents" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F927AD37-BA5F-4B86-AE22-FE2371B12955}\TypeLib\Version = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{63A6AB57-4679-4529-B78D-143547B22799}\ProxyStubClsid32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{78FA6928-BE8F-4D5D-89EB-761D364A909E}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A583D5DD-F005-4D17-B564-5B594BB58339}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F36AD0D0-B5F0-4C69-AF08-603D177FEF0E}\ = "MBAMServiceController Class" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9DAB0CA5-AE19-41AE-955C-41DD44C52697}\Version MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A82D6A8-59F8-4B47-BBD0-8F5E5DBB3C7D}\ProxyStubClsid32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0B14402F-4F35-443E-A34E-0F511098C644}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0AB5C774-8EB7-4C1B-9BBB-5AC3E2C291DD}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2650A9C4-A53C-4BEF-B766-7405B4D5562B}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8CB653AC-F9CF-4277-BFB1-C0ED1C650F56}\ = "IRTPControllerV11" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E95BF32A-DE84-4E41-B836-E2A7BAB962AF}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MB.RTPController\CurVer\ = "MB.RTPController.1" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7EF16D72-5906-4045-86BC-16826F6212FE}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{563D4D90-1666-4949-AC2E-E39DB953DF70}\TypeLib\ = "{5709DEEB-F05E-4D5C-8DC4-3B0D924EE08F}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C0CEAFA7-4F65-418C-8A61-92B2048115EE}\TypeLib\ = "{F5BCAC7E-75E7-4971-B3F3-B197A510F495}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DE6A4256-97CD-4DBB-9D4A-3054B0BB0F8B}\TypeLib\ = "{F5BCAC7E-75E7-4971-B3F3-B197A510F495}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CFFF19F6-ECFE-446D-ACAD-8DC525DA2563} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{956AEAEB-8EA2-4BE1-AAD0-3BE4C986A1CC}\TypeLib\ = "{A82129F1-32E1-4D79-A39F-EBFEE53A70BF}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8CB653AC-F9CF-4277-BFB1-C0ED1C650F56}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4E0F1EE6-E7CA-4BEE-8C08-0959842DA615}\TypeLib\ = "{783B187E-360F-419C-B6DA-592892764A01}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4D6484EE-AA00-472F-A4F0-18D905C71EA3}\ = "IScanParametersV12" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{108E7F3D-FB06-4024-94FB-3B8E687587E4} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB54E87D-D7DB-400E-AFF1-0182D7378E0F}\ = "ICleanControllerV17" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2DFD7E94-47E6-483A-B4FD-DC586A52CE5D}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C8952062-7422-4BAD-8A60-94E21F5CFE7C}\TypeLib\ = "{FFB94DF8-FC15-411C-B443-E937085E2AC1}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1C510D99-F27D-457F-9469-CFC179DBE0C7}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E385EBF3-7773-4E68-91C8-E046E54AF071}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9CFA1689-38D3-4AE9-B1E8-B039EB7AD988} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{66328184-6592-46BE-B950-4FDA4417DF2E}\TypeLib\ = "{F5BCAC7E-75E7-4971-B3F3-B197A510F495}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DAD5232C-6E05-4458-9709-0B4DCB22EA09}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{08927360-710B-483B-BEEC-17E51FF84AF9}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FA484BC6-E101-4A87-AAF3-B468B3F2C6BB}\ = "IUpdateControllerV7" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6CE18DD5-2BD7-4844-B9AD-DF6A995750A1}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2154AF09-DC0A-49CD-9D82-22D867C16F67}\ = "IMBAMServiceControllerV13" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9F0067A5-A8F1-46BF-AA32-F418656FDE6F}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{71B13605-3569-4F4A-B971-08FF179A3A60}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F81B1882-A388-42E5-9351-05C858E52DDC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AA226B90-F6FF-4618-8AE6-1114E82CB162}\ProxyStubClsid32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B3407030-27D0-4E19-AA4C-82418407E774}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAB53395-8218-47FF-91B7-144994C0AD83}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8640989C-20B4-41BE-BFE1-218EF5B076A6}\TypeLib\ = "{EEC295FA-EC51-4055-BC47-022FC0FC122F}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{278637DA-FDFB-45C7-8CD8-F2D8A9199AB0}\Programmable MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E1AC7139-D1FF-4DE9-84A4-92E2B47F5D2A}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DE03E614-112D-43E0-8E15-E7236CC32108}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3498D9E4-6476-4AC0-B53A-75BC9955EF37}\ = "IMBAMServiceControllerV3" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{78E69E6F-EC12-4B84-8431-1D68572C7A61} MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{226C1698-A075-4315-BB5D-9C164A96ACE7}\1.0\0 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AFC6D7FD-62B9-4016-9674-53BAC603E9FC}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FB81F893-5D01-4DFD-98E1-3A6CB9C3E63E}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31A02CB9-6064-4A3B-BCB4-A329528D4648}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3F656FD9-2597-4587-8F05-781C11710867}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BEC0DCF8-0D31-4C14-98BD-EF370C347B09}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3F967173-2B83-4B7F-A633-074B06FD0C64}\ProxyStubClsid32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A7FB145-B72D-466E-A3AC-21599BBE9E8C} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{01222402-A8AB-4183-8843-8ADBF0B11869}\ = "IMWACControllerV11" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C3249828-A4B2-4146-A323-EA5FD2F2FC75}\ProxyStubClsid32 MBAMService.exe - Modifies system certificate store 2 TTPs 12 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8DA7F965EC5EFC37910F1C6E59FDC1CC6A6EDE16 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\5A8CEF45D7A69859767A8C8B4496B578CF474B1A MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0D44DD8C3C8C1A1A58756481E90F2E2AFFB3D26E MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F6108407D6F8BB67980CC2E244C2EBAE1CEF63BE MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\1C58A3A8518E8759BF075B76B750D4F2DF264FCD MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\2AD974A775F73CBDBBD8F5AC3A49255FA8FB1F8C MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2 MBAMService.exe - Suspicious behavior: EnumeratesProcesses 32 IoCs
pid Process 1488 2026-04-24_01a29ef2d540a6a0ec4e190f02ce1748_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe 1488 2026-04-24_01a29ef2d540a6a0ec4e190f02ce1748_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe 2396 MBAMInstallerService.exe 2396 MBAMInstallerService.exe 2396 MBAMInstallerService.exe 2396 MBAMInstallerService.exe 2396 MBAMInstallerService.exe 2396 MBAMInstallerService.exe 2396 MBAMInstallerService.exe 2396 MBAMInstallerService.exe 2396 MBAMInstallerService.exe 2396 MBAMInstallerService.exe 2396 MBAMInstallerService.exe 2396 MBAMInstallerService.exe 2396 MBAMInstallerService.exe 2396 MBAMInstallerService.exe 2396 MBAMInstallerService.exe 2396 MBAMInstallerService.exe 2396 MBAMInstallerService.exe 2396 MBAMInstallerService.exe 2396 MBAMInstallerService.exe 2396 MBAMInstallerService.exe 2396 MBAMInstallerService.exe 2396 MBAMInstallerService.exe 2396 MBAMInstallerService.exe 2396 MBAMInstallerService.exe 2396 MBAMInstallerService.exe 2396 MBAMInstallerService.exe 2396 MBAMInstallerService.exe 2396 MBAMInstallerService.exe 2396 MBAMInstallerService.exe 2396 MBAMInstallerService.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2396 MBAMInstallerService.exe Token: SeDebugPrivilege 2396 MBAMInstallerService.exe Token: SeDebugPrivilege 2396 MBAMInstallerService.exe Token: SeDebugPrivilege 2396 MBAMInstallerService.exe Token: SeDebugPrivilege 2396 MBAMInstallerService.exe Token: SeDebugPrivilege 2396 MBAMInstallerService.exe Token: SeDebugPrivilege 2396 MBAMInstallerService.exe Token: SeDebugPrivilege 2396 MBAMInstallerService.exe Token: SeDebugPrivilege 2396 MBAMInstallerService.exe Token: SeDebugPrivilege 2396 MBAMInstallerService.exe Token: SeDebugPrivilege 2396 MBAMInstallerService.exe Token: SeDebugPrivilege 2396 MBAMInstallerService.exe Token: SeDebugPrivilege 2396 MBAMInstallerService.exe Token: SeDebugPrivilege 2396 MBAMInstallerService.exe Token: SeDebugPrivilege 2396 MBAMInstallerService.exe Token: SeDebugPrivilege 2396 MBAMInstallerService.exe Token: SeDebugPrivilege 2396 MBAMInstallerService.exe Token: SeDebugPrivilege 2396 MBAMInstallerService.exe Token: SeDebugPrivilege 2396 MBAMInstallerService.exe Token: SeDebugPrivilege 2396 MBAMInstallerService.exe Token: SeDebugPrivilege 2396 MBAMInstallerService.exe Token: SeDebugPrivilege 2396 MBAMInstallerService.exe Token: SeDebugPrivilege 2396 MBAMInstallerService.exe Token: SeDebugPrivilege 2396 MBAMInstallerService.exe Token: SeDebugPrivilege 2396 MBAMInstallerService.exe Token: SeDebugPrivilege 2396 MBAMInstallerService.exe Token: SeDebugPrivilege 2396 MBAMInstallerService.exe Token: SeDebugPrivilege 2396 MBAMInstallerService.exe Token: SeDebugPrivilege 2396 MBAMInstallerService.exe Token: SeDebugPrivilege 2396 MBAMInstallerService.exe Token: SeDebugPrivilege 2396 MBAMInstallerService.exe Token: SeDebugPrivilege 2396 MBAMInstallerService.exe Token: SeDebugPrivilege 2396 MBAMInstallerService.exe Token: SeDebugPrivilege 2396 MBAMInstallerService.exe Token: SeDebugPrivilege 2396 MBAMInstallerService.exe Token: SeDebugPrivilege 2396 MBAMInstallerService.exe Token: SeDebugPrivilege 2396 MBAMInstallerService.exe Token: SeDebugPrivilege 2396 MBAMInstallerService.exe Token: SeDebugPrivilege 2396 MBAMInstallerService.exe Token: SeDebugPrivilege 2396 MBAMInstallerService.exe Token: SeDebugPrivilege 2396 MBAMInstallerService.exe Token: SeDebugPrivilege 2396 MBAMInstallerService.exe Token: SeDebugPrivilege 2396 MBAMInstallerService.exe Token: SeDebugPrivilege 2396 MBAMInstallerService.exe Token: SeDebugPrivilege 2396 MBAMInstallerService.exe Token: SeDebugPrivilege 2396 MBAMInstallerService.exe Token: SeDebugPrivilege 2396 MBAMInstallerService.exe Token: SeDebugPrivilege 2396 MBAMInstallerService.exe Token: SeDebugPrivilege 2396 MBAMInstallerService.exe Token: SeDebugPrivilege 2396 MBAMInstallerService.exe Token: SeDebugPrivilege 2396 MBAMInstallerService.exe Token: SeDebugPrivilege 2396 MBAMInstallerService.exe Token: SeDebugPrivilege 2396 MBAMInstallerService.exe Token: SeDebugPrivilege 2396 MBAMInstallerService.exe Token: SeDebugPrivilege 2396 MBAMInstallerService.exe Token: SeDebugPrivilege 2396 MBAMInstallerService.exe Token: SeDebugPrivilege 2396 MBAMInstallerService.exe Token: SeDebugPrivilege 2396 MBAMInstallerService.exe Token: SeDebugPrivilege 2396 MBAMInstallerService.exe Token: SeDebugPrivilege 2396 MBAMInstallerService.exe Token: SeDebugPrivilege 2396 MBAMInstallerService.exe Token: SeDebugPrivilege 2396 MBAMInstallerService.exe Token: SeDebugPrivilege 2396 MBAMInstallerService.exe Token: SeDebugPrivilege 2396 MBAMInstallerService.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1488 2026-04-24_01a29ef2d540a6a0ec4e190f02ce1748_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2396 wrote to memory of 2564 2396 MBAMInstallerService.exe 82 PID 3396 wrote to memory of 2176 3396 svchost.exe 88 PID 2396 wrote to memory of 2416 2396 MBAMInstallerService.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_01a29ef2d540a6a0ec4e190f02ce1748_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-24_01a29ef2d540a6a0ec4e190f02ce1748_amadey_darkgate_elex_luca-stealer_lynx_metamorfo_njrat.exe"1⤵
- Downloads MZ/PE file
- Drops file in Drivers directory
- Checks BIOS information in registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:1488
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies trusted root certificate store through registry
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe" /installmbtun2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
PID:2564
-
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe" /Service /Protected2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Modifies registry class
PID:2416
-
-
C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Event Triggered Execution: Netsh Helper DLL
PID:3060
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "9" "C:\Program Files\Malwarebytes\Anti-Malware\mbtun\mbtun.inf" "9" "4ba9030c7" "0000000000000150" "Service-0x0-3e7$\Default" "0000000000000160" "208" "C:\Program Files\Malwarebytes\Anti-Malware\mbtun"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:2176
-
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"1⤵
- Executes dropped EXE
PID:4124
-
C:\Windows\system32\DRIVERS\MbamElam.sysC:\Windows\system32\DRIVERS\MbamElam.sys1⤵
- Executes dropped EXE
PID:4784
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"1⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Modifies trusted root certificate store through registry
- Modifies Internet Explorer settings
- Modifies system certificate store
PID:1420 -
C:\ProgramData\Malwarebytes\MBAMService\rmode\mbrescue.exe"C:\ProgramData\Malwarebytes\MBAMService\rmode\mbrescue.exe" /rescuemode "C:\Program Files\Malwarebytes\Anti-Malware" "C:\ProgramData\Malwarebytes\MBAMService"2⤵PID:3948
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k AppReadiness -p -s AppReadiness1⤵PID:3304
-
C:\Windows\system32\DRIVERS\mbamswissarmy.sysC:\Windows\system32\DRIVERS\mbamswissarmy.sys1⤵PID:1628
-
C:\Windows\system32\DRIVERS\MbamChameleon.sysC:\Windows\system32\DRIVERS\MbamChameleon.sys1⤵PID:1184
Network
MITRE ATT&CK Enterprise v16
Persistence
Event Triggered Execution
2Component Object Model Hijacking
1Netsh Helper DLL
1Privilege Escalation
Event Triggered Execution
2Component Object Model Hijacking
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
1Safe Mode Boot
1Modify Registry
2Subvert Trust Controls
2Install Root Certificate
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\PROGRA~1\MALWAR~1\ANTI-M~1\mbtun\mbtun.cat
- Size 10KB
- SHA256 9ceb410494b95397ec1f8fa505d071672bf61f81cc596b8eccd167a77893c658
- MD5 8abff1fbf08d70c1681a9b20384dbbf9
- SHA1 c9762e121e4f8a7ad931eee58ee60c8e9fc3ecb6
- SHA512 37998e0aee93ff47fe5b1636fce755966debe417a790e1aebd7674c86c1583feef04648a7bc79e4dedaabb731051f4f803932ac49ea0be05776c0f4d218b076f
- SSDEEP 192:gM6dynJCSEJOL7yKnUi8rFWQFIGjl8zjEswYt1FfRM/GX01k9z3AeOlFa:gqS4CFRWGjl8M8/fi/GR9z/OlFa
- TLSH T1B43208E1897D84C2ED87A87147E8E5977C3C1BCB2C5055A911ABF7600AA33C6E71853D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\PROGRA~1\MALWAR~1\ANTI-M~1\mbtun\mbtun.sys
- Size 107KB
- SHA256 6903e60784b9fa5d8b417f93f19665c59946a4de099bd1011ab36271b267261c
- MD5 83d4fba999eb8b34047c38fabef60243
- SHA1 25731b57e9968282610f337bc6d769aa26af4938
- SHA512 47faab5fff3e3e2d2aea0a425444aa2e215f1d5bf97edee2a3bb773468e1092919036bcd5002357594b62519bf3a8980749d8d0f6402de0e73c2125d26e78f1e
- SSDEEP 1536:k0h5S895dQOYJaryTmbMc6uqkZUcmSl47AjpdAyDCYJqUufIfmNn3VzwZ6Dh7Q9y:C895uOYJar1MLcmSlrSgC6Duls2t
- TLSH T174B36C9DA1783089DE42A6B482B98793EFB4357A2B1177BF01E1C1748F537C0DB29DA4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\7z.dll
- Size 1.6MB
- SHA256 623e628393bc4b8131c1f4302b195429dfa67e890d3325ceaa56940660052b1b
- MD5 4da585f081e096a43a574f4f4167947e
- SHA1 38c81c6deae0e6d35c64c060b26271413a176a49
- SHA512 0fe168bf1661691dbaa103e478dd7e46b476db094bf1938bf1ad12ddb8a8f371bf611ff504d2eb3ac319862444cc64a27ebee8735aa3752aa32a399b09427243
- SSDEEP 24576:a9raURTF/5pe2g5RpBDxSjv9IrqLwRpFEDbt7y0MVoAAlzi8pY:a9hP/5petvSjWZR8DxO0mo5M8pY
- TLSH T16F756D5BF67400A4D5D6C034C5276B1BEAB1B88B8330A7EF12D15A6B6F13BF19979320
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\CloudControllerImpl.dll
- Size 6.9MB
- SHA256 71b6312c8f6bd8e62c7f766ed56dea99f9daca0963039128ba11e4b6842b0922
- MD5 8a15daa8a9ea233265e4dbf5cf2cd9bf
- SHA1 08cd446e2148825fb3b6bce135758b264107284a
- SHA512 6741c89bfb611dc1790116c7ab6ddad5726c68aa22a53921281f0f8ceac6fe02b044b58992941cd3fe997f65880513b853303f70fb4c3496bc71b782ef54ab9b
- SSDEEP 98304:mMoK/6tfchVTu/EKdD3fcXJv9tzjfalW9h/PR:voK/6ZchVyEKdDPc5v9tag9/
- TLSH T160769E6BA6E400A8D8B7D13CCA578503DBB2B81553319BDF06A4967A1F73BE0573EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\LicenseControllerImpl.dll
- Size 7.1MB
- SHA256 0f429a38d88c8057d45e6e31cca2be835bb251efefe0a81b475e409773284272
- MD5 683993771dbfe5f785fbae7710407f58
- SHA1 53bda0355786405b672bc9c4ed4edab372a2ad27
- SHA512 4a2d27692e415061356c41bdb0f8b2736f1de8bae17fc656e09a417ed856e8c2fb191c8c65d4bb3eef539bb72af5af5e2fb31de2d9598246aceee5ae7c685f95
- SSDEEP 98304:JC4WIFDTBnuokflXrWd1ZTF9ptP3f27kG:JDWIVTBn5kdXrWd1Zh9ptPvqkG
- TLSH T1D8769E9AB6E400A8D8B6D13CCA678503D7B2B8154371DBDF06A4967E1F73BE0563EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
- Size 8.8MB
- SHA256 11cba7f877e23c3b449f8ae43c1e59468f6dcc6fa92fcf15241cef5425de8ae3
- MD5 fc71bd97d83d93550fabd552c7e166d1
- SHA1 a786440cd9655fcf68de4623c87ad301918cceed
- SHA512 63dd55fd33faf8a8560119abf4c0e6fffb5e1d620a2facf1f81a612f26b20eaac6b7aa0442bfe0730bebc9dd5a122ce1d60f9d238e37b2496d5246a31c62d3e5
- SSDEEP 98304:7u1fICg55JtkwP3rhReT007kxU+PZCN3RIYNS:72fICs5JttP3FR90761ZCN3R9NS
- TLSH T178969E17A2B900ECD4F6D178CA578A03E776780543B19BDF0790867A2F577E19E3AB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
- Size 10.9MB
- SHA256 9df37d99e5a01bd3eb9c103e70df6452749dd7a323a5005208d5d056a3881b1b
- MD5 f12e4b700087d28428322346409b626d
- SHA1 85650192ec5344d9be8ac378c3784df9497044fb
- SHA512 39ca7031c645f2dadfa0cde0ba8a4b6fbedf6239dfb41fe7d6f60d04d15c1ef7caa62a43fbf15bba0a0501cce6f3949608588051535e2f34066ec35827d20d95
- SSDEEP 98304:eVsatP3HqHwk/nXmDSBZldykiHYCoy/m6:eVdt6wk/nXmDSXldfoYCdm6
- TLSH T17AC6F606B7F951D8F5BAD674A977A52AEE32BC618B3083CF1150560B0F32ED48E39721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
- Size 2.7MB
- SHA256 05d4d87f43646f7ca2e50520d8850e8808748a508c2761838d5fb92d66d6ce35
- MD5 e04e61828c9fffcee59cd90ef155c90f
- SHA1 7a97b65f11d2b3f30d8e2dde4c44bdf16f3d3b24
- SHA512 04792b998628cde88bc2601534678e55b2d6fde290496e5af08a2955a992ca3bb767bd025dca4373abc55141de8d270f62f628e51c887de54035bbee10379ce9
- SSDEEP 49152:honErk5go+mXYlAfm9iNPg9yBb9m84QcVIrn4PdPWU+wgE:POpmIcs4PUU+c
- TLSH T1BFD59E03A2EA41F9DDB7C23C8962D503E7B2B8051370ABDF06A4D5651FA36E15E3E724
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnel_mbtun.dll
- Size 4.2MB
- SHA256 ed2a9ae7540aee752bc3e676bc01bbe1d87a857b8348ed114724956fc431908a
- MD5 a2b3f1d39c4ba202f0bd07aaaf07aecb
- SHA1 b65a67197982ba71b9c892090dcadf1fc3048f00
- SHA512 4098a58e17c620e6864fb1d64661de6690568ec80cb384c911540affc8ae2beb481215a8a470ad36b27ff311040a6a07c7c163b84c65d5c21500034f34aac347
- SSDEEP 49152:VBPD6Io8w4LcTwEDRzTJoeM9YSxjQ5g+o9h6iO0oFjn2Q1Z0NwEIxb:/DG8VQkgRzSeMfn+ofU1d
- TLSH T181164B02F8B205B9F2BEF131C9A963217A31746503327B871F9195692A66FE47E3D313
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe
- Size 291KB
- SHA256 50d84efc73c656b3d175d05a834c59549a641d1b089df576893ce5ac964d4925
- MD5 e33df8cbffc6fa08e4dd123f2b933948
- SHA1 49aa1b37973695594d8b69dcc2f25602310f6f63
- SHA512 fdbceb2f1dcf1a5b60a41e0be9795031d0ca197dfb023f774f5c8c32e84ebb77419c3fe46b917fad4b9c62355ab6c990e6627b50b02a7dea5c07da0d89976026
- SSDEEP 3072:8czkitvo4BpYN/6mBPry8TXROLdW5m4mURh9OOG40klaPOdfj5niUm+:8A4NCmBPry/N2VOOV2OBjIx+
- TLSH T103543A47A2A801B8DDEBA2384D918B46F776385647F346CF235092BA1F72FD0AE75311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\PoliciesControllerImpl.dll
- Size 6.1MB
- SHA256 43b856bc86c2e1d5b6ec95a31d9ac5aac04d6f0bf50d05413b3f66e3d6271b5a
- MD5 80fb1072517626f69c79510d6910a70f
- SHA1 8f62a8e55dcf0f71e9a3f7f47133db39af6bc810
- SHA512 6cb0a963b4dbfe9e7d9351b61d82c13dbe6fb0e204510f20168964ef2681c07c9afb60b5dc0d619165c07ef4a1a50fb619eb250f79a8c02dcbd4fde60736fc8e
- SSDEEP 98304:ZPtcMdJUBukjJ4LUwO8XArit3AG7I1QewpypG:ZPfdJUwMJ4LUwO8writ37c1Ay4
- TLSH T1A1568C2BB6E400A9C8B6D13CCA578613E7B2B815177197CF06A4967A1F73BE05B3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.json
- Size 621B
- SHA256 10aa1c294e6885f5ec50accea8492e1d744e2b32297c745b39f8257a69ddb652
- MD5 c9e98e2650d387e23fe6f1548ffd54e9
- SHA1 b74188eb41ad4f2bebd4abc64401f5fccc2c6731
- SHA512 5d2dfb244b21cdaa351b873d2daf06a047dc7eb11c5a219929a18a447a5e668da7aecc62fd9461f9fc7efc6cea5f14f7bf295e4d4d79d40cc6a63d146a30275e
- TLSH T11EF07822A86F42F746B11A8852A40187FB24D38E1210694FB7B4F991DEF3D289AD2C44
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.json
- Size 784B
- SHA256 60943846494d28cb88dfd1cfdfd5496d49116966aa71c75166c706dbc968e18d
- MD5 d4a47c126e2a3924693f66c33fd8ee59
- SHA1 7b5968db8be27db0b2f64ab498c8d2705357e585
- SHA512 40ffb539c57c802a0f487ca77f4f1ec0c871298274f7322baf9f1a322203997355ffee7ce2b2ecda46e45e8a58d01b1f85ae71ae35131d6046db6a34b73fe13c
- TLSH T10701DC539A2A82BB59B04749546408C6F7B4E34E2200050FB7F8EAD5DEFBC25A3C2D44
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\TelemetryControllerImpl.dll
- Size 7.3MB
- SHA256 2f2fff7f9011d369aeabe115adf065e62c19556258c4bfc2bf91ccce3c03da65
- MD5 612426353d51e285f01950566be51609
- SHA1 e09d909b6f2893e0f4a96896cf2067ffb883c25b
- SHA512 e55b78e87f831acc1877662f0592bbd6f49a6721a6545984ffda69b71792cf1184b8b0ff53ac8e8f9a44f4167fcbdbeb7b884f8b40f346a0eaf8c8437f3ba191
- SSDEEP 98304:c6ljoIiB4ts8xBdxDNQIWgpPRWOabbZtg1eJNw2Zl7e:c6loITts8PDNQIWg5RWlbbZt1O2Z1e
- TLSH T1DC769E5AB6A400E8D4B6D23CCA578513D7B2B8255331DBDF06E0967A1F73BE09A3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\UpdateControllerImpl.dll
- Size 4.5MB
- SHA256 c3cdae166d55e357360aa6399cdd753f0584dfffdcb2e514eeed630531ad87f6
- MD5 bd91b7b26aef4271f3b4603126e823fc
- SHA1 65e49b5e81ebeca8a22597c8f4ddbbf1fc8a8cee
- SHA512 3a84ed9f3c98787abbe7894389297859783b0f2b2602d42144a48aba73a7519af715a43945ca4bf0aac5bf7cc8b2db5e8163943845c1e6d645cd0fcd54e7c8b4
- SSDEEP 49152:G4UNjUD9vRECJJAuKXxSvZHL+FfP67YqC6ZHq84DBhZ8q/kXkEYtnPtZFqdyP/Tp:fNJLMrLZvk0vteYT9p4U
- TLSH T1AC269D17A6E900F9D8B7D23889978917E7B3B8110730DFDF1690866A1F637E05A3B724
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\ctlrvers.dat
- Size 10B
- SHA256 7b33d81df22f4a86fe1ae001a8db779f0c8a0512404a8e90fd1f0b6e276bdd07
- MD5 16bb4518fea0d4b7bafa649c9a1c98c5
- SHA1 dcc8b66786cf2b93b4ab7fdef7e9a5c0943ef873
- SHA512 48f17a7356a6048422ef8110acd0d5573bc374e7a172f950781fcc6ea39b0bd8444cf41edef0ad9af6818658948b55e3bbf1ccc7ef03c1c5ba021ecbee9eb0ce
- MD5 SHA1 SHA512
- Path C:\Program Files\Malwarebytes\Anti-Malware\mb5uns.exe
- Size 2.2MB
- SHA256 2557968c8571a3e8147656ccc537866ec1644ec12ff4dd5d2aed0593c6000fba
- MD5 96891ea1a5d1a5cc24c58dfb8eea750a
- SHA1 af3f28d28320d0d781ec2f8cd3931e251091d939
- SHA512 890a245f71b661adf50dce95859f7dd799ab9850017bbb582073f2af1a5a2a2cf2842a9fb3e45bf73ef077c92ac5caebb85bf91787e52df81febd28f173bef41
- SSDEEP 24576:4EqVu0Si6HB/PJMpQizHvJE0h0lhSMXlUF+Tb6CO3yvoF6cL3XqU6syS2fe5Wa:BqB9G9PJMpQizHvJkkCzgZKUxT2gWa
- TLSH T152B5BF12E2818138C8E561302C7DD7BD2B79FC38AFA6559B73E4BB3509715C0AE35B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll
- Size 3.1MB
- SHA256 8af36217efcc1b2a677accc77839ed3b67ddbfcabfa16caaa42c7e95796b940a
- MD5 d82467d25954c9fbaa91ca97e0de6834
- SHA1 d7da2b4f83acd0d2aaf55de2ae403fa6cc44bfc6
- SHA512 84a38b2d4a1b23439f4c6eca1fc148d618effd1444704f37e5812488877d15789b603944231281299ba332dbd0d3a0e51160c588c0adc1bf338675c62da45aa4
- SSDEEP 49152:zHsR0cmbmDszn14AcKLfC659mLVD+Bjmo+2g5rCdPWD8i51l3z:zHBpmj2Am0D8g3
- TLSH T169E54A227A9540ECF866A23864FB8502F6F27A05236097CB0558727D1EEB7F106BF7D4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\mbtun.dll
- Size 2.8MB
- SHA256 f21a980316bd4c57c70e00840ab76d9ad412092d7d2d6a2cff4f1311f7c05364
- MD5 2bbf63f1dab335f5caf431dbd4f38494
- SHA1 90f1d818ac8a4881bf770c1ff474f35cdaa4fcd0
- SHA512 ebb9834323329dc01ba2c87e5fad1083a4cb86f5ed761cb63299ac5336a9843a1aadd42fbed706797c2295117af1c00f96806422338352653c8e0255fecc2fd5
- SSDEEP 49152:xNrdEZjzdAj9fdc4fDrN1OxOh5PgqdnBq30yPFZP7KVxSL:bBzFRkshaZP2W
- TLSH T136D58C1AA7A800A8EEB6C27CC6578603D7F2B8151771ABDF02A456791F73BE1173E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\mbtun\mbtun.inf
- Size 1KB
- SHA256 4a350fc20834a579c5a58352b7a3aa02a454abbbd9eecd3cd6d2a14864a49cd8
- MD5 5d1917024b228efbeab3c696e663873e
- SHA1 cec5e88c2481d323ec366c18024d61a117f01b21
- SHA512 14b345f03284b8c1d97219e3dd1a3910c1e453f93f51753f417e643f50922e55c0e23aab1d437300e6c196c7017d7b7538de4850df74b3599e90f3941b40ab4a
- TLSH T1CB4140BD48D20AB83C673356671B69C27BDC220145C920ADB2DE8606C88EDDCB905EB9
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\offreg.dll
- Size 140KB
- SHA256 8e6c155a97666c8e6a3f9ea95bfc6f6e4f87beac53dd72164aba3ef33ff88db1
- MD5 1659738d57a15a0983f0373b2faaef45
- SHA1 efd4cd05ff6bd787a2ceabfd11daba1c0e475855
- SHA512 4f62cfe0579e1aeeeb30edd5f42a2b1880446dd1075be051e2e0189da5071f9866e5425ff85547486fd7d952a28efa4e784db0cfdc1fcc428b34eaa89c6a7654
- SSDEEP 1536:kXNnhdTcQOCr7LClg5lSYOurIt/0q9mrf0Xp2N7RibuQusR9YfIZRoU:cnXTcQ57LClMlSYA0q9mrf0XoNHFQZ3
- TLSH T111E39D5A73B420A6E8678678C569875BE776B162232087DF12E5C6B80F037CA7F3C345
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\pkgvers.dat
- Size 78B
- SHA256 3a3d0fde2ae974c074deb2f464af3f63ccc6ab75be043720e2b195badf7de0af
- MD5 6c757d9b0a211a386176624c20c45537
- SHA1 1664ffb5f0e0b7dd775fcf644655a78232095b0f
- SHA512 0f4d22564acb0a82a19d48ad0d465c4aa4d2e5e19c0ed40478ccd3e29034f3d61bb68b8d6e2bee7b7de9840ae6872bb9c0759948ed8a58ddc92d0e02f70b6c05
- TLSH T1D8A02230002E83002A23B0F080F8B0B82203CCA82CC00F2002E2C3BAA33B03832088E3
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\version.dat
- Size 48B
- SHA256 023f439c17056eb6f07dbac5646dc4ee2934a29daf257da39e15ba89e7b8fbcc
- MD5 fc16d62cb4aeed6c6cf0881fae936598
- SHA1 200de0a134e757a755c5e43893d32c3c2e59f667
- SHA512 edd034a1a229c84fc677804af791a526ade7b8a1fd218496f71d0b8f034a2f78c77080cda3a81297582c11249f1a01790f7442db62e01aa9f16154745038b080
- MD5 SHA1 SHA512
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_7bc929283ffa11f180825ea2b5dadc27\7z.dll
- Size 1.6MB
- SHA256 bb01c6fbb29590d6d144a9038c2a7736d6925a6dbd31889538af033e03e4f5fa
- MD5 3430e2544637cebf8ba1f509ed5a27b1
- SHA1 7e5bd7af223436081601413fb501b8bd20b67a1e
- SHA512 91c4eb3d341a8b30594ee4c08a638c3fb7f3a05248b459bcf07ca9f4c2a185959313a68741bdcec1d76014009875fa7cbfa47217fb45d57df3b9b1c580bc889d
- SSDEEP 24576:29raURTF/5pe2g5RpBDxSjv9IrqLwRpFEDbt7y0MVoAAlziG3B:29hP/5petvSjWZR8DxO0mo5MG3B
- TLSH T175756D5BF67400A4D5D6C034C5276B1BEAB1B88B8330A6EF12D15E6B6F13BF19979320
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_7bc929283ffa11f180825ea2b5dadc27\ctlrpkg\Malwarebytes_Assistant.runtimeconfig.json
- Size 372B
- SHA256 1eca0f0c70070aa83bb609e4b749b26dcb4409784326032726394722224a098a
- MD5 d94cf983fba9ab1bb8a6cb3ad4a48f50
- SHA1 04855d8b7a76b7ec74633043ef9986d4500ca63c
- SHA512 09a9667d4f4622817116c8bc27d3d481d5d160380a2e19b8944bdd1271a83f718415ce5e6d66e82e36819e575ec1b55f19c45213e0013b877b8d61e6feb9d998
- TLSH T1CEE02C7BCA10ACB315F52BBAC02AC282FE20232B00004D2A35FC180C2F3AAB30012F49
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_7bc929283ffa11f180825ea2b5dadc27\ctlrpkg\mbae.sys
- Size 155KB
- SHA256 c990dd89b65d35d6c9b34e21c78d96e206ec3bcdd934716ee61ff79da0fa5251
- MD5 fc98ddab2223dc73b950622801b31554
- SHA1 997faaec1dfd18b9dd31e1c216440a28bc4cd612
- SHA512 da08860f8c3d8a9204d1480f33d21f2ab922db5cbbf7734527ed05477c2d9c184deaedb63196876c989c9ff6c1b45b5792661f5bce92212992a7cdb664a793e3
- SSDEEP 3072:hcj/Hk4/53QBvOP8JsUrLx1o6GwzfwKYdkXEnU/H0KBJT2:hc4wNQBvOEJvx1o6GwzfwZqEU/33C
- TLSH T1D3F36C52F3B400F5D8A6C679DB669213E6B2780D2721E7CF076085252F673E4BB39326
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_7bc929283ffa11f180825ea2b5dadc27\ctlrpkg\mbamelam.cat
- Size 11KB
- SHA256 64416d564725416c6869ea951878a2734b1f6940b11f7961a897c45f0d8c6625
- MD5 bd4ceae54af081d6b1dd91ff584c5d61
- SHA1 5ade462d66e042da58bb1447d1b31f1aad901b68
- SHA512 37e7abd312f694ee2c8ea54ecf50ed12c16684f1007c61d9a6d1d01cba958be511c5e4e11cd7393a5cd57349fda1c552bebca42962137e0d11695c195761ebb0
- SSDEEP 192:oBxybp/yRpJCSEbhLxyKR/2FWQFdbiI/Ex6RMySX01k9z3AgEhrZg:oLp+eFRvmoMR9zJug
- TLSH T11A320AE58A6C5083DCA7AC6087E8E5D77C3D67C71D00987921DAFB5409933CAFB2816D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_7bc929283ffa11f180825ea2b5dadc27\ctlrpkg\mbamelam.inf
- Size 2KB
- SHA256 e26c2d3347e5f077da92713c9df3cd3eae438fb7e29810bd5c3afe567d2d3125
- MD5 5d8c05cc4f9b4304d57ea10b87f2dcf0
- SHA1 2cabe3d39aa5ec16c54c7818284a2ee235d2ddbd
- SHA512 55bff23fee9852f229246b71721b3659c916079787935d400a97641449dfda752fc8fbf36f9ea3dc4028f05daeb9006a99660284a61aa5d5a466af0ee966c738
- TLSH T164410454AA538BB8697B35B81E472883BF5412205076384032DEC8C99B6DF0C93757AB
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_7bc929283ffa11f180825ea2b5dadc27\ctlrpkg\mbamelam.sys
- Size 21KB
- SHA256 ded569e249e590314d095f740c6b8934a5a797e4f3edbe0f78eac9d333f12a2a
- MD5 8da81aa1f6b89ce1d2e216e3ea351c59
- SHA1 4baf79cbade9a5584630a540e6368d547579fb12
- SHA512 6d611bbd9d480ef2defd745fd06c4ab86e181267cf689d9d0e124edbaf22fd30fbe2310879cc7bb6dde5bae72c4feea1d329cdecfbf101d95634f85dd0769119
- SSDEEP 192:C7IlO/ZnEc+PbYv6/i0RtPH920QvVUKjnegqdsW++w/y1wVWQ4uW/+O68RwX01kd:wIlO/i8ChLIxUKjnev6+Twc69R9zING
- TLSH T108A23B6549780283F6BBC570C7E4C927BD38F39677408AEB0591E5681DA37C2AB3192D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_7bc929283ffa11f180825ea2b5dadc27\ctlrpkg\srvversion.dat
- Size 9B
- SHA256 2c791d90d14cdd810d8724ef71f05cb175cd884196cca8843d913a7dbe839266
- MD5 c8dae8c00e76c804585b193fa89b670f
- SHA1 5c3752cce3c70b69dc3a9aa199a01744f3ceb120
- SHA512 aa0de4cd0f28b8a72b49610984302a18bf6a304933cd53a6a7ff1b0ab89273e8b5b8b603374bd01ac4a30ef7ac4e48049dfdf16eb03a6b5d927dae9ef18529a5
- MD5 SHA1 SHA512
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_7bc929283ffa11f180825ea2b5dadc27\dbclspkg\MBAMCoreV5.dll
- Size 8.5MB
- SHA256 b13e2559d586be2f439b38610070078b818df891c2f13c77d2f743d0589235ad
- MD5 94d53a6aba2c98404f9199d6295a17b3
- SHA1 77bf99cf975eb35d0d76edac1bef8dadcb703edd
- SHA512 0faee9e835433dfc0933db8d9442f51f12a69f0921fa77973f4c0f04a67e377bbb13753d1730ec5dcf721fef855b8c61a8ae9cec92429ef33b384ebe09e3b718
- SSDEEP 98304:VQq/+cJnOxhczQ8HpKv2HNOd7WF/BVuQ1pw5vX:eqlnOozQ8HpKv2HN67WhBVuQ1p8f
- TLSH T17A967C1BA7A400ABD86AD37889EB4602F773B805537397CF1694A2361F67BD05E3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\Global.nm
- Size 341KB
- SHA256 4562976ca4d37bd9d3c3953466e473ce68cf35b49cb80af72e2464ce50ceeef7
- MD5 b4f59bd76781ee7129344b65828d2079
- SHA1 3078bdcf5ee46c9733fd64fd5f4f2ed66bdadd27
- SHA512 642c0a3f6ba7ea915769691a5786e92a28f5ad55fd3da6e400a957fc9987b89543ff713f56990748f85609a6c957dcae4a32f6b8b523400e5475d46a7bec42dc
- SSDEEP 6144:Uhi/nRdxNOPYlneMEk0vJoB9ruOMGIXWHwpJkBsV0cB4B6yDWcJXg/fSkiR6Ob7C:UhivRdxNOPYlneMEk0vJoB9ruOMGIXW
- TLSH T176748AD167AE2354F5B6EFB41BA0DA25497A6CA6EF00DB99D302144B193DE50CB30F23
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\Global.sr
- Size 23.2MB
- SHA256 f3be446faafc4c799a12a0c6c967cc9a496ef7b095c0109fd76c3f3d40c93501
- MD5 1217af9fba589947551cc0e9beefa3e4
- SHA1 df5bbef4fae12c136c6a75ac24ff95ee7d6c0725
- SHA512 aea0831c46fd2be741c29c6c53e85c16343d132d4ee8c80828ba7c125bcc114195b4fff7e9da9418e7a1883797aa5a2ddc25e0c15d51b11e5b79495144f310f2
- SSDEEP 393216:TRGZxXS2grOJnW2f0sj2/mn+6tT55Iqgp34N:TRGZFErMp4mnRf4p34N
- TLSH T18637126376DA3A9BF412E47F8344E6728597F8167A23C592BAD20B1FC05DC848F61B13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\cfg.bin
- Size 2KB
- SHA256 0a0822976f3e70bc527266c1cabefc852bf3cba3df82e347f15aeb3d01f87bba
- MD5 e9b97ad3a0bda3a9b3d6b84347a86d73
- SHA1 4665128560d330ef633844e0765050dccc242373
- SHA512 5d942d13339668ed68f427e764cdc35e409b0ad52faaf43329df1592abea45fcc8470341c527c323da822bc654de0b4537606c42c0ef9bfe8e79bc84ca3d5187
- TLSH T13341D826BF1077A4D5A72AF0D749771AF92D3B76650309F1171D00F2D6384350532525
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\clean.mbdb
- Size 23KB
- SHA256 9cbd2e498c769a8647a718baa0ddf4802d699b66b8afd2383268a8589b1f2c7c
- MD5 06540a9f1e2edf0b608a113dfa1d75e3
- SHA1 5e2c6b8bde7049b5f67e1c564a9b054668552b6a
- SHA512 6333b8cba25aec5477e7425ac0a674392349d91b611fb20503bea35cc3ec5706dba193751235b536715fb2a75de38b869642a86d462c88ae69196b236d5e9811
- SSDEEP 384:S9Tk1qkC/YqKckTufXW5OU78WWWpmwGoReEM2i/mlYOuEJeVbuWdgOOgMj:+TkDsnPkafIOS8WWWprUEM2RYOJwbu22
- TLSH T1F9B2E1991D32107CE96C2097848DC25EAC9D9DBC5D4BE03AB83C5F8F7D01039E5E5B61
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json
- Size 1KB
- SHA256 c3610a89836e7366aae78d99f457702e8c478a1ca8ed59bb20122e6321fda33e
- MD5 84cdf4868d44f319c55422f8b268e59c
- SHA1 17ee63bf5a63b1727573abba317674da6e4c8dbd
- SHA512 e0371d76bd1d9bda8b07205df827d7491377e4a1c688fdf40b4c62f4a44fa59459e44dc11558b016049ce9eff3aa04c0b101eac75df6c5218682b5b6ca036a0c
- TLSH T16A31C0210D01593E7AB805881CD48A1BFBF1275710DDD82BF9F1E5C8EDB7202514AA7F
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json
- Size 47KB
- SHA256 620550155d235781be227b5dad7eab5a84ee7d12f372346ba8b829ec6c88454c
- MD5 67fbb4f24b5a6daaf4ba8c3e0ec482b1
- SHA1 ff82341d54910e1f2754f64dfabaa1ad65d8c6b4
- SHA512 d185a0219bb88270d02c5c80813418ad642c2697e9f197be539ebe92ff777e13af62b401e64eaf3b4a155961732e70aaaff7de594af5d0738216ca0150a2caaf
- SSDEEP 384:/riPalGB5AWiWq2mhzJUVVqxKS3xV2CjNrBa7gHOykEaf:2UAHiWqn1UVVqx9U7gYEaf
- TLSH T1BC2382BBD9DC0D0B99712694A9B94607FB20036F10980C17BDBEA98DCFB751394C6F1A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json
- Size 66KB
- SHA256 9206a12d70e3276e53caf96423d17739ee5046c0e188647eaf30ac0187a56db6
- MD5 d7a2dfaca6526881dd3d4efae94be5de
- SHA1 d62f367eb73bcdbf680f24249ca4b465446161cb
- SHA512 1d167dad85d18df5a0a34548daf69f75173ccd75f070a6a168159f8a38971fea1ecc308675c2e88698ccb1809519ce557b09d1f1360e4a3216f737d74fe5a5d0
- SSDEEP 384:CriPalGB5AWiWq2mhzJUVVqxKS3xV2CjNrBa7gHOykEajctcxPad:HUAHiWqn1UVVqx9U7gYEaIKod
- TLSH T19363FB76D8DC4D5B857123A4AAB94603FB50036F51880C07BEBDEA8CCFB781295C6F1A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json
- Size 66KB
- SHA256 71c6916f352700c7943911869c9a20dd84699e51f18543656feed28b72b2b7a8
- MD5 f4d8efe698bc5a8b109a61ef110049fc
- SHA1 f730c33c850571e7baccf1b22f41c9e999b7c02d
- SHA512 b1ce407b2f1b0f9d912073f58ec799adc28c87b83ae0beadd337f53e6db61675cf783fc0bff9c4a3683b7f44101ce35f785644b823aa42f842f1065c28761fc9
- SSDEEP 384:2r1PalGB5AWiWq2mhzJUVVqxKS3xV2CjNrBa7gHOykEajctcxPad:cUAHiWqn1UVVqx9U7gYEaIKod
- TLSH T16563FB76D8DC4D5B857123A4AAB94603FB50036F51880C07BEBDEA8CCFB781695C6F1A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\ArwControllerConfig.json
- Size 1KB
- SHA256 6b8f9047ee6fe2cc67d2ef1f77ba4e92b2fed2397d59ec6a93c948960716178c
- MD5 afb3fba43bf8fa9830fc69e789a8be67
- SHA1 32d944cbd3b553beab7585e020f47612b3a6b898
- SHA512 1f4bc7644a4c042d531643117419e38df7722de32af106e4c3eb0b17f1840659afb98fcbc51671f546da867f5068cfe77374c24f25c5d00e5cf8f123b563dad8
- TLSH T12D11E451962019FF95BC9005E8948193CFB057A56408083BF2FDF784ED79573A7C2CD2
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\CleanControllerConfig.json
- Size 949B
- SHA256 33de9253e43dfdff4e82dfc5c186c016a4abd508b7b54210523eb719fc6f4738
- MD5 b78bcbc7f60b8453a67cf2a4e05bbf8a
- SHA1 bf98dd0a782f5451d245f2fbb52484b07afc97ea
- SHA512 98feb83535206ec524028fa97a2b8d1f87c8a98c9b1f570f4a854459f881527776e19788a1e5e05a3c9c7e22587ed66819db06b9d9ed41f83efe1d3767ff2f22
- TLSH T119110A74C40165BE54B9674E88BAD581C350530A38544C9BFFFCC99DEE73432B02BE99
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\CloudConfig.json
- Size 1KB
- SHA256 e188652c236d78b35a1b9e1d89f7fbbfe66a3b957c19ee82d38c43aeebfca278
- MD5 bb1d0821c1d2e4c1284dbd86f6efb595
- SHA1 a4c02eee231a3e3afe1e8f4bd779bd6dca112a34
- SHA512 fed88085aa35f63c41e5404ec780743edab3b2ef0cc8187608da431f957c28d542b70afa5d8b5840d9154084825a67f00e6046a0f62f6c68c13b4daa689b3610
- TLSH T10011B21B9222ADFAD4BD261C5F6E9786C33893131485086B7674C9CCDFBAB16901760F
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json
- Size 12KB
- SHA256 2eef9823e419aad78d9815855094a2910685c161c46ecf03f4ea145083f77f40
- MD5 1fe38a0daed0e3d996121dc235c71ca6
- SHA1 2c1db970ea35255b8a9a320e31f8b4341ff649c0
- SHA512 cdc80f72042b6d3281572cef33af270f8976e657ebb15ed3a5c34f801a293dd7a16fa1f9f03bb21afa2079cf4dc8ea5fee88407d1c0654552ad8c133639890d7
- SSDEEP 192:cZmf/FYgVMzhrgHTb0MAJUKfVgH8BZ8ZF1Px:GmlYgVMzhrgHTb0MAJUKfVgH8BZ8ZF15
- TLSH T1F8425427D1B59EBB66FD627661B40782F364C75F08410C07797CC88C4F7BD2A62C2AA9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json
- Size 12KB
- SHA256 f23c44f1b3217d14573d238543a48c05a9a4ea8d475b2f86de311003b6acd983
- MD5 0711f176c956e3680623c041a3e1b311
- SHA1 9311441bdae745099e4155dab44ebbf6a50ee71c
- SHA512 bb3b04db635b4c6a7996de11e7085eeea3c8e34e6fec8fa583cc816b358f4c2ff182d8c836851b9c4f15bbf2864cd5d3cb9764d468ee423e6f0dbd0093433988
- SSDEEP 192:qZmf/FYgVMzhrgHTb0MAJUKfVgH8BZ8ZFGPx:EmlYgVMzhrgHTb0MAJUKfVgH8BZ8ZFG5
- TLSH T199426426D1B59EBB66FD617661B40782F364C75F08410C077D7CC88C4F7BD2A62C2AA9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json
- Size 12KB
- SHA256 c7bf65b5f7436a7128e9fdc0464fe6fcaf667bf0d02ddf7604edaf8b2337ddbb
- MD5 d008e004528c3a307d8054fa52675e4d
- SHA1 11a48b7501d8be5f393579b432ff349143ce8779
- SHA512 572bd9a74aceb37423e62de0014a48281277d030ce96e53ad03e22039cca9e63e49d62b034a392eca48a47a0506a381093dcaa45bd745d9c9727070cd620d613
- SSDEEP 192:y+m5/FYgVMzhrgHTb0MAJUKfVgH8BZ8ZF5Pd:JmjYgVMzhrgHTb0MAJUKfVgH8BZ8ZF51
- TLSH T1BF427526D1B5DEBB66FC627662B40782F364C75F08410C17797CC48C4F7BD2A62C2AA9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json
- Size 12KB
- SHA256 97cc81ca415f1bbabeac657250e7e40b45f847b9e11e622e741ef46c1ec428b9
- MD5 4e1ed71bcda5fd9224c96181c363da06
- SHA1 da73a1cf9dec05977610181a97cfd071a0575530
- SHA512 acf002854cbe3669fcb6ebaa52093cbc4a2f1dd8883712457c81a1c58077b6b4877aebc5b0e092ff66ea11effb0e1dd2f674be2085213f134964af1703ef9a18
- SSDEEP 192:5+m1/FYgVMzhrgHTb0MAJUKfVgH8BZ8ZFOPV:smnYgVMzhrgHTb0MAJUKfVgH8BZ8ZFOt
- TLSH T1BC427527D1B59EBB66FC627662B40782F364C75F08400C17797CC48C4F7BD2A62C2AA9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json.bak
- Size 12KB
- SHA256 86c5fb3a911b4d0ac0b12368a2edd43e8daeb66df46af95ec0abbeaac6bf2d11
- MD5 49bae524915ca629bf63b146cc7b7beb
- SHA1 70f8c8905dc6eef29f729db834930cfbab99a4cb
- SHA512 84d1d868f9f761230286c12d16a6319956924006999a03925e5fe85c6e053fd58790e22d0d0bde2321970ca5d538e854b31a25a4323d2d33e1828c6c8406bb17
- SSDEEP 192:X/mf/FYgVMzhrgHTb0MAJUKfVgH8BZ8ZFePx:PmlYgVMzhrgHTb0MAJUKfVgH8BZ8ZFe5
- TLSH T1C8426426D1B59EBB66FC617661B40782F360CB5F08410C177D7CC88C4F7BD2A62C2AA9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json.bak
- Size 12KB
- SHA256 00b93ee765b323d1e65619d74137759d94a9385580ae2d63910a2c61bc47d6f1
- MD5 e74efa3b84f30052fd878748cd03708d
- SHA1 1c41fea4377bfabc4845dcb4730dd7e756095c13
- SHA512 8164f0fd98d7a8b2303ae9c96e561672a693d2c6a683c623ccaed934c58c51e30288a1f615fb827c97a23f9ceed3398d1b627c8957b7fd04735fa0644f7ee069
- SSDEEP 192:IXmf/FYgVMzhrgHTb0MAJUKfVgH8BZ8ZFePx:qmlYgVMzhrgHTb0MAJUKfVgH8BZ8ZFe5
- TLSH T103426426D1B5DEBB66FD617661B40782F364C75F08410C17797CC88C4F3BD2A62C2AA9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\MwacControllerConfig.json
- Size 2KB
- SHA256 69f98fc3351d9ee26bbea54c94c1b21a40737b164b81e01c51a0a836b2116c66
- MD5 a4d2f5e5560aedfa2f9b29ac12071e3c
- SHA1 352f157090ef0578a1fb223c2ad9b77f9f111e42
- SHA512 dc1862caa6c7c5ba4181e38a5dbdf4c63c5a68284cf1e5299d8a17cf5716b8ad3c798f4e1ad108badf86b530a52a4aa6c27836e284083cf8218211b6d8ec8c26
- TLSH T16841E632D5686DBF19F452677D994252F641971F415808A3FABCC96C4FF6C12200AF1F
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\MwacControllerConfig.json.bak
- Size 2KB
- SHA256 84e9b356192f2b23474b4740f8c5ff39c75da6aa1d5c8b640b8e3b22722c90c7
- MD5 8a0d8827c353d34fb8c8957600fe0a8d
- SHA1 b804c44d525ac8090344bb5d04d581934063de5d
- SHA512 d8231de863f9d00d5ab1139911ab5e52c2f9cef335edad1f0ccec0e693efd330f38514d33e5bb261527846bbde42cfc350d39387659c3577816fcffc95459fa7
- TLSH T1B1512832D5A86CBF09F85266BDA94252F651871F41580CA3FABCC57C5FBAC12200AF5F
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\PoliciesConfig.json
- Size 814B
- SHA256 fec64d475951b5fb10a225240addf8eefaddf6e48624c2173a060e61f5e9f741
- MD5 3b8913fbb9cf2746507efa9192de11a7
- SHA1 fd6126514b02d1a665290204707c1bb8f6ee3677
- SHA512 9ec0426389e0e9ffd57b2552131d0205e35b4d079cbf15bf89fd73f3a7391b8f9a8d3bdc40aa65f0dda3774babea28a753e70043ed7c46c46f6aef4dd8bcf0b5
- TLSH T127014766988080FE297C81688137D8C2F351874634281C2FB7FAEA0DEDB793B2582D95
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\PoliciesConfig.json
- Size 814B
- SHA256 83face5c1bb0c920af9239aba8395ca1850fec242a6130086187bb91d5ee8c72
- MD5 32727b51400b615f34a0dd1e6b261f27
- SHA1 c392dae3392c3d3461ab51bb8c73f47ee530b2c7
- SHA512 e44cb1fdd5580466db220875a60e47ccdf055d2ec96e97f3f13b348f286eadb2320c1ccf4cc6a770e7e861bc3ef91d114a3a4247fdeb53e345c82f5bb2ad65c3
- TLSH T1EC01476A988080FD297C416C8127D8C2F351835634190C2FB7F9EE0EFDB793B2181D86
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\RtpConfig.json
- Size 2KB
- SHA256 8ceea7e89f0ae40b831f832b2e4c3b8eeb86e6a802dd56a96f8496e00c6e431c
- MD5 e398f082d7475de180defbebf0363500
- SHA1 038f87a7e035ecc5c29efccb79767da873b3147e
- SHA512 9c3e0ee442fd1597c5c3b6e267b7d9fae79de461e622c9093bf3754fb2094b6c2195b3a671828a8692bf35eb0614f86d37e364d584b1fe68f885482a6010606d
- TLSH T188513421AA40A87D4CB9C1199C7C518ADB245B61160A187B72FFC83DCDBBA737BC5CC2
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json
- Size 2KB
- SHA256 cc7a53249fee620482fceb8a4647dd20cea9a60e424c3ed8908c589496f1c3d5
- MD5 94f7fa38c6c110f92f3a5fe8a239f425
- SHA1 b6d1620664a258dd62c3321604fca4665fe2cc1c
- SHA512 367efeca39ee7f2e07d090133f1c9bbd5d8c50a53fa6176debf80e533f6216db31c93d33d94b49d0bce1aa6b0165543812144d756078f1e42727df676e254d44
- TLSH T115515A16D91058FE08B8E25EDC288086E72087971602187FB2FDC65C9FF76377686EE5
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json
- Size 5KB
- SHA256 1bf6bcfded0db1f8cb552dfe920fd6e3f998f183ac3b2f3196d1c831c4be1983
- MD5 a730dabc3170a0cb077446aa4deaa258
- SHA1 04501cef043ee7315a9fcb8fecf4ec7533214708
- SHA512 bbb277a40074c10e21719dc80b9bcf9e85c6fec50a83636a86514ecb63224482d9748b35a52ebe8032fe6c49a54dbfc1a3315bacff3f70ce396c075c49e1feeb
- SSDEEP 96:zITZOfK5k9JykfGwYiYDXKBs9RsAf3wsaA:UlOi59JHiiaBIgsR
- TLSH T13CC17D16D9105CFE18B8E25EDC288186EB3183972202187FB5FD865C5FB76333686EE5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\SpConfigFile.json
- Size 11KB
- SHA256 1492e1e5d743f8ac33778e8eb24429b2220b8f989ee931c7e8d75e384ca6d22b
- MD5 70823ea9618bd43c75d324a1bffefcf9
- SHA1 7b758196bb05ed472d82e01efff1168780912895
- SHA512 bd7d80da8be4b666cd3343bb0257d488f248c71f1d922bd58a86945a9b5d9cff9df26405a864de73b05174fd1e991bf508a94d7b4c98ec68a106b077704c83ac
- SSDEEP 192:c8+xwb8fkY/sDpS8t7SSdUCExUYS9oFfJ7MLPi5LnDjufzqoA+8xRj81offZJZte:c8+xwb8fkY/sDY8t7SSdUCExUYS9oFfq
- TLSH T1CF42F61EE0A84867887626901F7A95A2E334526BC1435C6775FCF12CCFB7483C49AF9E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json
- Size 1KB
- SHA256 df0c2642db18ea8b054c6855c371d5ed0b21cd8bd78d2e66f8744475b508b74b
- MD5 dbf0d621cb26222c4c5d442a8eea5536
- SHA1 1ebfbd0d65d2588af4abaed15d8c0c8e222a22c2
- SHA512 4cd0b951062be883f6a1d3d233176cd52a18f00cabab344d695c99be2a7ab10773d4db69a6b9b32155c820992ee12a68c46f6bf434ec903582b460cfe59a9982
- TLSH T12A3135128A2845FF28FDD144C9B8871BE7A0431B62161C1FFAF8DE58DE3707227E1999
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json
- Size 1KB
- SHA256 3c5a0556e4a5ed8335ffc82dcb2be61c1fd0b8f9c99bf3590c4be71200400bfc
- MD5 47943244b7705d19448daeb5d36f6707
- SHA1 61f4b2a8e44a5b41f67d1ea634b2eb9f9085a93a
- SHA512 49a22e334ca67793594d3b780c702445b260a61a322d29e284a28f685554fc6f5c7adc1d47bd17e7b341b6504236306643d4886de4fb578dcc58f49170fb0004
- TLSH T1C93104128A2445FF28FDD158C9B88717E7A0531B61161C1FFAFCDA58DF3707226E2A88
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json.bak
- Size 1KB
- SHA256 3a94504b61e168a96b2efebca8ff41820ac45b5eb3f8e036487f22c422f04f9d
- MD5 8aa3c12adddce05c17974ca506bc2f04
- SHA1 20038dc0867ccb039569f0ebd30c86a1220e5be4
- SHA512 f15d35ce7c79ab8a530d97cd1916f5e00caf9cf26d54c4294d7257aa17546ef571d00572a46c8e8a89ff87eb22fce48cd197a3a502b9962bcb0c1e187eccc73d
- TLSH T1453105124A2845FF28FDD148D9B8871BE7A0531B61161C1FFAF8DA98DE3707227E1988
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json
- Size 1KB
- SHA256 b294410e1237b7c3882e56e28c024b16e05d43d0ecd79c1d41b39fbc837271f8
- MD5 367431b83f99beda77c56758763822bc
- SHA1 b3a52fefa82b015df3e37ce9bad79b89fdf1d9fe
- SHA512 c4089698b63e981fe12f127329b3ca36b0117bafc1fec906042678eb12f39de228230504cb2df64fbcf1b3733fe317a0bbebee630014d2bb4263d7f15e428be8
- TLSH T1E5313622893888BF12759B8D89B48002E760438E66A0596FB3F8D844DDB3D752487B4D
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json
- Size 1KB
- SHA256 c2e44a6cb65e8acf1fa56885bc2f8ecfe5b96b9c51ee92d6b10365ab421a5940
- MD5 30bd390fde7ecf9ecd17efc998fddbb1
- SHA1 e9bc6ce41248aa66f327deabaadb637e13165398
- SHA512 8e694ddb18c113822bb2107b6f53be0969c68dba4b666c3f138a1b2af98d6fc19bdd434e0eee771ee0f9bb07db0078219cc69a726637a4e894321f918939f05d
- TLSH T1A2315922853988BF22B9974D99B88102D7A0438F66A09D6FB3FCD948DD739741087A4D
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json
- Size 1KB
- SHA256 97fac1ff2ea8e1c96bb4718c52bf133a36567be5146ada613f8057e56713a1fd
- MD5 a34e33a03585644340f157b61300779a
- SHA1 4023608a0be6c7acb4e92b03aad4d8599f1c8b60
- SHA512 cd4b2fcfa3838a7b0307064057eab8b1a48c418d7ce1c7809c6d7a74521a7b1fb612b02a58e306bf01e36ad48365d7fcc6937f2dd0a8e84d1e8f44bc8aa7b425
- TLSH T1E5313922897D88BF1176974DD9B48102E7A0838F66B09D6FB3FCD948DD739742087A4D
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json.bak
- Size 1KB
- SHA256 89d84d173633ecadf6af8829d1e1c89b7ca518516f70732999dcb7f6849e3e31
- MD5 8d0f80816970e629c6b418e0f1b715a1
- SHA1 7bd0a531a256c46a5d1bedce0bb931eb55bfda37
- SHA512 0cc175ab4901fcf2f174ae76ab7a01177c8b537e4ff9b92fba1d16a2622a248d4b31919d95d2be67b03d2d28447b43e09e4adf2ec24df9cda1ea2b5597242d57
- TLSH T129313422897888BF12B5978DD9B48002E760438F26A05D6FB3FCD848DDB3D746487A4E
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json.bak
- Size 1KB
- SHA256 270fa0692732d3459d564cf9c64f45af3803f16dac0fd4409bc08d1c4cf40ed0
- MD5 2fceeaa9c28298927b253f4cee0efa32
- SHA1 3b94f4baa123f3e811fa6cd641a790c3b04780c8
- SHA512 0434db9b06faaf8cf33ebf2523540a4e8806d5796604a7d3ec6149fb3f586fc6e772a26651bf807ffa3ec5ed9c9b7784262864715ad9d106129f93eed0e45628
- TLSH T1273128228939C8BF2275974DD9B48102E7A0838F66A05D6FB3FCD848DD73D742587A4D
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json.bak
- Size 1KB
- SHA256 7247c804a16e6a3a18394adfa3c201295992e263b6f036108c36e0c1fde26ae2
- MD5 9349237cc7adf11d1fb5e56de91aefdf
- SHA1 87344906bfd587a0eb8f70eaab47c697309fedc7
- SHA512 84ce5cefab26cecba5353676028bcf799b4bc3db38f0724e8e3515b5d8c14b13669134c9e530c49e577ec045c595dd9d871e3b10b44897d7b98db896d0080f2f
- TLSH T1283178228938C8BF2275974DD9B48002E760439F26A08D6FB3FCD848DDB3934648BA4D
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json.bak
- Size 1KB
- SHA256 352f59a5059d419f04a8f23657283584acfe6f91ab9814d2916fa58bb0dd311c
- MD5 550f631686345bcf580c9bfdc84e05b4
- SHA1 bb02bde4f58d0bd75177cbdb59721035df831d0b
- SHA512 b8e79f66d0209f3a549881b92ad80181f5305a8b029aaba18995b56311d1536c6fc2df3e4f051cedcb53527f25dafbe5c30a12e54ddda45d47c1966a352f5dda
- TLSH T1EA315922853988BF2279974DD9B48102E760438F66A05D6FB3FCD848DD7393824C7A4D
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json.bak
- Size 1KB
- SHA256 78923ce27f7e8046204ee80263b92fdec0cb67b7cb0ffb9a296571a54afee5cf
- MD5 1f1d67292151b10b64e0d2c86ca37b48
- SHA1 740820706ed76443ba31ec041d98c5d74a0eb69a
- SHA512 539ecd59cd35bf67f609dc1ea70edef1410fee8e69630883fb903db3ada8d25938ef75ce262c4973ce8f44baa8196362b468bb7c1642d7f0094b706627329c5b
- TLSH T1BC3159228979D8BF1279974DD9B88042E7A0438F66B09D6FB3FCD808DD739341487A4D
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json.bak
- Size 1KB
- SHA256 65d41e122ea00936597fca2568b2d6d1dd67f96dbffeae6e9edc8406c67e46cf
- MD5 893eeb7cc2f1e7e9f0ad9f24ed52496e
- SHA1 dc83d615a823168e4f2ffc61f1fa8d486460f44f
- SHA512 c2cfd761f94517386dac0a6497baca04110a1a0ced00c471384773bd0605dff45e5544c71784475991964a68de9dc328fb75b4572f7c1dfc5422b5719c38298a
- TLSH T1753139228579C8BF2179974DC9B48142D760838F66A0496FB3FCD848DD7397454C7A4D
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\VPNControllerConfig.json
- Size 1KB
- SHA256 93b7f47ea58fdabadd2c9304ad2698b8c8e4d23da96ad56269d9fc22e0bbb3a5
- MD5 f12e92c1e18b1d8eb8f5dff6afaf8aeb
- SHA1 e148bde081a792600645e419a3bbe0c3dec7ab9c
- SHA512 a671d8fb5769197238f06c2ccec9823a1d25cf4ef924998ecc5aedfa10fc081cdbb5ca80d88faec5c96533c9b736488a6c64fe4212ef450e05a5ecc658e635be
- TLSH T16A216B62B1A110F96D7E9A9B6C7C8240F270530F12D98B42BFFCE014CEB7594A160F9A
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\VPNControllerConfig.json
- Size 1KB
- SHA256 70409c13ad3731c3a699edd25dc8532def923e6d19a08aed951370913ff24e69
- MD5 9b055e6f2ad631f438c861bae4b42bb8
- SHA1 01f9b60c108dc32dea1eed771181d712901f690c
- SHA512 3795a36d586404124fe4786023ac96e37aff9dd80c96e3f66b82c52be1e587444ef28b264bed636092f0ed07249e2f9e6b0646f992790be7632538dd35a636b4
- TLSH T13C217F32B09010F56E7D969B6C7C8205F270534F11DD8B42BFFCE110CDB65A4A161F99
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\VPNServerListConfig.json
- Size 125B
- SHA256 6dd0c1b173a02d9b2cb0b25abf3d383ff53d9fd2884afa914ca3612a40018145
- MD5 f92650b773f8ddbfc77180caba1df474
- SHA1 ef825e36ee6badc4b6374d306c605e1bb705aba8
- SHA512 7078b3a61ad1d072d126a3a37137fbceb6662fc103451debbb451de5fa96acb2e342816dd50ef8e560d78c686604076b0631c9973e50ee8bf26a8db83660880b
- TLSH T10DB02B15306009F407201F362D400900F2B0F900414C425C312C05C95BB02644C11E3E
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\dbmanifest2.dat
- Size 924B
- SHA256 48f48e0f4658a3026cfc14ac009e9341b7c128c1aaaebfd1e44d96be13448f08
- MD5 de4f7023af8849a8ac2b4c68ff64638e
- SHA1 bdb4816257f204f49f00a31ec572f4b5b5a1a7b0
- SHA512 da823bf570e2d83df48d74c2b8be27e2e9b4bac2910c59b5a47162d279b51deba33a4335aeaaee773dedd23ffbe177f8ca4e7c034e594cf4ca0cc59a4e7e5d99
- TLSH T1D611C8C9C21D62C195383F9BE005301F857B8CAB85881B95AD5E4844990A16C0C1915B
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\dynconfig.dat
- Size 39KB
- SHA256 008254ca1f4d6415da89d01a4292911de6135b42833156720a841a22685765dc
- MD5 10f23e7c8c791b91c86cd966d67b7bc7
- SHA1 3f596093b2bc33f7a2554818f8e41adbbd101961
- SHA512 2d1b21371ada038323be412945994d030ee8a9007db072484724616c8597c6998a560bc28886ebf89e2c8919fb70d76c98338d88832351823027491c98d48118
- SSDEEP 384:jNOT68xDvtG9ObE7L8u8sXNVkIfvs4FRj:ay8u8KVkIXsWRj
- TLSH T15603A21266FA1001B1B36588AEF28570DB2B74D965399EBF00C5464A4BEEE40BC53FF7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\exclusions.txt
- Size 23KB
- SHA256 9e87e4c9da3337c63b7f0e6ed0eb71696121c74e18a5da577215e18097715e2f
- MD5 aef4eca7ee01bb1a146751c4d0510d2d
- SHA1 5cf2273da41147126e5e1eabd3182f19304eea25
- SHA512 d31d21e37b0048050b19600f8904354cff3f3ec8291c5a7a54267e14af9fb88dfb6d11e74a037cc0369ade8a8fb9b753861f3b3fb2219563e8ec359f66c042db
- SSDEEP 384:OpHJUPIIawosLqVqmv4EHUtVbUQIKiKn6p+C+vNCMSP+TyHS7ivS/6:mYmsGfvSp/6pzgH4cyH9E6
- TLSH T1B5B2D73A1CBD123751B4C6AACFD58877F640E1A7316A183A64D7874987CBE4329C31BE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\lkg_db\Actions.dll
- Size 6.1MB
- SHA256 d513f3a50ec070bbd74f78d27d79b6cb60aff48310283c74ebeb204aacf375a4
- MD5 923a9fe2404277f490bc959493f48e72
- SHA1 563c8dcc7adf7fcd2c706be7ac56ed79c52aacf9
- SHA512 5bdbe65ffd24380d423c3d2bef220e29c39622551edff942f643e79e50ea582439b9e7e91387ef020d44e2462721dda089a83566c76ba1287c2dd917e4fe4194
- SSDEEP 49152:v9x1737qVRJXwMb5WOXz2aXjAr0dcOyccpFZckK/xjDzBE+WjYFJWgP4FNJe5RRe:X97ELkwdchTNOAjYFsG4EGmzqZzhaa
- TLSH T196564B16A7E801A4E0B2C178EEF79103EAB27C255735CBDF0590525E0E73BE09A7BB15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\lkg_db\BrowserSDKDLL.dll
- Size 7.0MB
- SHA256 c72e39709b26ac7577200a76515347ff11c0a9424cf61657762d657e7aecd974
- MD5 36b6cdd3677d6a079cd21768ffacbc7e
- SHA1 e525b6c778d7b59ef06300cc980f63bcf581a24a
- SHA512 e106563a21063eba244b536e67ececf2630415d5857af8aa67bedecabb39a87799324c3024bcf84487fbd9cfb76dc24b27ebb881734b4157a38b5c74d538ec3e
- SSDEEP 49152:8VF1SVg1db+wMSI0nW5xjpvypuDYpsD0VXZTWqls/e9uETWgjB+S/YfbWf2zv7je:s8TeZKT+X6S/Yf6fITlRChya9Fx
- TLSH T113768D17B6A400A9D8BBC17CCA578603EBB2BC06577097CF16A4966E1F73BE0563E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\lkg_db\ig.exe
- Size 1.8MB
- SHA256 4cf711fa15dd870c7957427a80055611ddb621d1b3490b9af602c0c7de5d1d15
- MD5 30bae64b1639f8bd943d676a0c951845
- SHA1 d9048555baea7eef150b4ffcff932a85de7f2494
- SHA512 ed2ebaf07149e703c4640e19f01ff708392e81cf7287fb8b26b35c2f5b7c689aa38b7355b70fa762e935905a01dde84c46b0887d4179a2d761d631bee112be4f
- SSDEEP 24576:2Bpw8j0kcU71dHGvPKN8kP95bLS0pBm2L6y1szQGfthuTVHzw8mvW:2x0kcOnk88kPt7+zQFZw8mvW
- TLSH T15595D820BAB6414FDB9916B82EBCAF9D22AC69490B6059C3738C975D0CF11D344FB376
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\lkg_db\sample.dll
- Size 524KB
- SHA256 431a7419fae308b726a2e4c5d16dbbec1265fcb90574ed08f02e054f42180af2
- MD5 7756d6eb049bfe725fdcedabbb9629a2
- SHA1 d4d09e2271f92115d6e5e4fb34929a3232f09cd6
- SHA512 5a0ac5081a1ca8355a5b6988f93d6d34bb2f78fca3feebb84cd0bf346f73801ad85602cbbddecce5323318b1b2a3089b1124f51f764361529781e04b84248be8
- SSDEEP 12288:UYIAmy9w5vPkTEetmCqryujcqhL0HU5WhjW5/J:UY/VJrqhLcc
- TLSH T191B45C00A760C01CF4F701FA97BA969DA9387970777CD4CB61E1E98A1A609E5EC37B13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\mbdigsig2.dat
- Size 514B
- SHA256 f7bfe947ee38c349de54b3b938ca0d6dc40bfe3465e3cc165679b3e89216fa86
- MD5 6da1ae2c1a2891ea1508eaa463c6855b
- SHA1 e091ea201ef5f0b9d91793bdaf307348dbe4f489
- SHA512 766fb05a0f6d65a374ac33d99f7d45fcef163442341749bdaddabdd4e34eecc97a6d69ae46cd9152185f564164fb34144425640ce34bf0c4445f073a0d8343bc
- TLSH T154F075BC307388C7647F8132D8F8642803102C52355A3A4E45B42881486C5E8AD67C41
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\prot.mbdb
- Size 24B
- SHA256 6089fbf0c0c1413f62e91dc9497bedc6d8a271e9dc761e20adc0dccf6f4a0c1f
- MD5 546d9e30eadad8b22f5b3ffa875144bf
- SHA1 3b323ffef009bfe0662c2bd30bb06af6dfc68e4d
- SHA512 3478f5dcf7af549dd6fe48ad714604200de84a90120b16a32233b6d44fa7240f5f4e5fe803f54b86bbdfd10fa1bfdd88fb85eb6a78e23e426933f98d0a2565ec
- MD5 SHA1 SHA512
- Path C:\ProgramData\Malwarebytes\MBAMService\rdefs.mbdb
- Size 24B
- SHA256 850a4ea37a0fd6f68bf95422d502b2d1257264eb90cc38c0a3b1b95aa375be55
- MD5 2f7423ca7c6a0f1339980f3c8c7de9f8
- SHA1 102c77faa28885354cfe6725d987bc23bc7108ba
- SHA512 e922ac8a7a2cde6d387f8698207cf5efbd45b646986a090e3549d97a7d552dd74179bd7ac20b7d246ca49d340c4c168982c65b4749df760857810b2358e7eb69
- MD5 SHA1 SHA512
- Path C:\ProgramData\Malwarebytes\MBAMService\rmode\mbrescue.exe
- Size 4.3MB
- SHA256 483cd91c0503e1b1de261be0feade262e74e18e36b6d43de71ba8bb42860daf6
- MD5 df438e63f86204f247dcd090e2d08397
- SHA1 87ec76fc8316ca33e96376b023990af5b9ed5b4b
- SHA512 9b67cf23ac2f088a1815e7b843d02e47b039b460c2b815d5b7b8146cab52b7bbf7bfd57dc4890c7d39806a28dd6f34d4d9427478d4d460031fe97115ede1d55a
- SSDEEP 49152:akU6dZOMK/ta0RNgOn6bZCaQSOs6rwDyEKQT1c6K5J3SA/+xjXxvcL4n+dKBCHmq:akpowZa6gr/YzKrEAi9bESWCtU
- TLSH T1CA267D6AA7E401ECD4BBD16CDA065517D7F2B4565370ABDF0AB44AB20F23BE0563EB00
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\rules.mbdb
- Size 14.1MB
- SHA256 753629757cf3fc925c29fccacc27d0e90e7e59e46b6160d1cf5a16a08c16e48b
- MD5 c2dc9f03394d95a5d950d89deeae0427
- SHA1 24f3da8f4528a5a77137d7bd1d24cfb1e57ff671
- SHA512 131b74f3c2fb8ad4876cea94161ca4230bcc2ef85fc883a0bdc8421059128168699af03899147cb9e5b66f10ff2c08278ea2e484247ff9f840399a3453a3fe1e
- SSDEEP 393216:bFeeQ61hluuiTmNSUubff/+hEckaPKtS3BNMN6ORjMH/os:DQ6182S5bfOUaPKtS3BqEOls
- TLSH T133E633F679E646DF768A4337327E3AA3690020B1ADF449C384D8D2D4990BF71C6C99E1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\scan.mbdb
- Size 414KB
- SHA256 18687281462a2d229e1975313ac5c60464f63eb97484f7e8ee07813f30e20422
- MD5 db1072cb02c5d151636d588ec2e10b9f
- SHA1 7b53a360538ce449c84ca21e2519c51d9020554d
- SHA512 574031dd7a2a3bd7abaf5df4b8df85876dfa7fabc859e1ed5282970347ab570f49fb249d8d8ec4e0d4db59db058ca90fb6f3d6f7b1092df82631210d1603c351
- SSDEEP 6144:gWsqo9ucjKnMeJk/PAYyqwxh4ItTTuTDuxUAxTJJ9BvG2yIW7r7cubMwCj12u+hH:gL9T6MeBfGkp3Sl78kC8
- TLSH T100942323360EE4E4A332737E4A85F2E5C5984CB28C509915999FA77C355BBFB85E7003
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\tids.mbdb
- Size 156KB
- SHA256 0d3d97160de0d7e7e0ba014a9c572a631de85bc282834e59c65b1fa0a01baaa0
- MD5 fe2744dc2c747d980e68ba2779364ea7
- SHA1 47098bb0f5d5022c57fa63878b569e2a55d2028a
- SHA512 956dd7ef49cd6a23218d1625c7e5028b67cea8107506d892357cfff4d3e4cbd35afb9d0dcfb6aaf833e9020b77649004c003b97374bce20d58c56d39b5b4166f
- SSDEEP 3072:+2Jbsuoa9adhN5xJnhNJvkNa9zIwoWN5XtOdIokcHlZnYw7INwBBe:+kouoacJxJnlcNaKmTtOdIyHlZn5Cwfe
- TLSH T155F3121B6CD24355E6E3B221126C096DCCE5533F32A8DCF56934BBC9A920C615BBDE31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\wprot2.mbdb
- Size 13.7MB
- SHA256 f55d413fb4657280ad95ded87754539ff1e4af2e3c69b91e42c8091338a58993
- MD5 3936ed55d898d1ca1fd4f3c3d7850f86
- SHA1 41fa2e5347b552124b88c121096a6b1e283b6694
- SHA512 af24b24daaf8e9ce3bf19ae46564508746770217a72218bc2ba943301f797b27df41facfdb0b568662180d23e14c362fb051953134bc1022652a311b23f9706a
- SSDEEP 196608:VewFEFIMjv3wYQI/PEFpIFbMMGWmYnOyKixEvzz18QlpG2VCKJ3:8wypvwYFsFpuMbyZKFzGCC43
- TLSH T196E6122BF914E116CBB6503A1ECAD4D623713B8481628F56B2486B31FD7583D7B2B1BC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\CatRoot2\dberr.txt
- Size 104KB
- SHA256 1f35a32604ade514e35fe4597956f57d1918179b38d27bbd4eea96cbab62c8f6
- MD5 1a2cd9416e62b16ad1d752c8adfc5848
- SHA1 51eca34138870c1c9f807302705f027b76bd7e4d
- SHA512 febac6ed4873e605180f7d855e8c8cce584b6ab0ac793257441a1a857b92b658a5708c0922762e9ac35f75d4b00897dc97da0bbc4cebfb7f494364fd3109fe34
- SSDEEP 1536:S30liopWMM0Ed+fOvzmJACdjkOc3/KZrFCGFwLvBeYimtsy0bd37k0V+P+7gvQz4:S3xsO
- TLSH T16EA34505C0D84699C5B50A72725AEFF0C5AE658B730B2EF930FC62019AC3B157FBA45E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\drivers\mbamswissarmy.sys
- Size 240KB
- SHA256 0cd62ce0cf56289cb0aa1e5330683704dc8e34c08a15407c9fdbc1948f5e12a3
- MD5 8817e3a16320ab5b04d7e05183bcbb6d
- SHA1 135288165990761d7c73ddff24758597722e9233
- SHA512 9e7fce8c85f7748b82dec4d3f3a967bceeb83f83dfdfc19e5824b5be96d7820da3b124b11ab72e224e9f188f9926aad9577e62a5e55e50d05bf5c3c2b1410c60
- SSDEEP 6144:Cnua/aI/vsqYHFtEPWv2S9NeJLBX0WOD7:CjSI3sqQqPuzehO
- TLSH T1CD346C46A3E43966F9B7C17D89A29002E772754A2B31CECF5370C42A2F5B7D0B93534A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\mb_5DE0.tmp
- Size 107KB
- SHA256 ad820dd54edb13e255d34eafacd71f278d6514e2f7e4c2970401f922a774ceb0
- MD5 2df8ff40bec48460845f851a54b76fe8
- SHA1 8e19f3d76c87d590cf1af839ddbe98af381d44e7
- SHA512 2177f5dfd6901f09ae2b8a0d6bea7b5fac3d00a721aa297ca6c35666cf2549d6c8d8655063a332224ccc8e0f00bdc84334636e9f1527862c850cc4ceb96d7d61
- SSDEEP 3072:dAZdoamZdgBjLpSXussssvYssssnC1c9RvZfy74hfp:dW542pSessssgssss7Nea
- TLSH T1B6B3F1F78379B8D9C513DA3B93874B110B28426B2C8A7E45A84DDB158D7E66181C3F8F
- MD5 SHA1 SHA512 SSDEEP TLSH