Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
22/05/2026, 12:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-22_fdb9eecfff6b1dd4a34bfbc4d5a22238_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
39 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-22_fdb9eecfff6b1dd4a34bfbc4d5a22238_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
Resource
win11-20260513-en
windows11-21h2-x64
39 signatures
150 seconds
General
- Target 2026-05-22_fdb9eecfff6b1dd4a34bfbc4d5a22238_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
- Size 3.2MB
- Sample260522-psv22abs5k
- SHA256 7ea1559ba4fa6f649ab800c8d1ed71a111f550be5aae07649a82e44571d88428
- MD5 fdb9eecfff6b1dd4a34bfbc4d5a22238
- SHA1 89f41165e58d14d90009e3c87ae278af003ee45b
- SHA512 cfd130ce0148bf3965b1c85b526a1552321cd24bfbc47ee52aa267eb253b39ca7c6723e11764126922554539d57481df386e807e67508f65918b5f2422871e5c
- SSDEEP 49152:wAo6kArS/0sKDywnwAeyfvE0Z3R0Tnxn1o2d5ZbCkGG0Z9iv71XyEBXOf:qWrS/0s+AAeKtwnW2j0Z9A7c2Of
- TLSH T10EF5AE31B2918120E5B3D370297EB7EA5B79BC256F76408F32D8B6390B725C09D35B26
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs
resource yara_rule behavioral1/files/0x0008000000024523-2859.dat INDICATOR_SUSPICIOUS_Binary_References_Browsers - Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 2 IoCs
resource yara_rule behavioral1/files/0x00070000000244d0-2827.dat INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL behavioral1/files/0x00070000000244d2-2831.dat INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL - Detects executables built or packed with MPress PE compressor 3 IoCs
resource yara_rule behavioral1/files/0x0007000000024984-2846.dat INDICATOR_EXE_Packed_MPress behavioral1/files/0x0008000000024525-2867.dat INDICATOR_EXE_Packed_MPress behavioral1/files/0x0007000000024a85-4096.dat INDICATOR_EXE_Packed_MPress - Detects executables packed with ConfuserEx Mod 1 IoCs
resource yara_rule behavioral1/files/0x0007000000024984-2846.dat INDICATOR_EXE_Packed_ConfuserEx - Detects executables packed with Goliath 1 IoCs
resource yara_rule behavioral1/files/0x0007000000024984-2846.dat INDICATOR_EXE_Packed_Goliath - Detects executables packed with Themida 1 IoCs
resource yara_rule behavioral1/files/0x0007000000024984-2846.dat INDICATOR_EXE_Packed_Themida - Downloads MZ/PE file 1 IoCs
flow pid Process 36 1752 2026-05-22_fdb9eecfff6b1dd4a34bfbc4d5a22238_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe - Drops file in Drivers directory 10 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\drivers\mbamtestfile.dat 2026-05-22_fdb9eecfff6b1dd4a34bfbc4d5a22238_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File created C:\Windows\SysWOW64\drivers\mbamtestfile.dat 2026-05-22_fdb9eecfff6b1dd4a34bfbc4d5a22238_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File created C:\Windows\system32\drivers\mbae.sys MBAMInstallerService.exe File created C:\Windows\system32\DRIVERS\mbamswissarmy.sys MBAMService.exe File created C:\Windows\system32\DRIVERS\MbamChameleon.sys MBAMService.exe File created C:\Windows\system32\DRIVERS\mwac.sys MBAMService.exe File created C:\Windows\system32\DRIVERS\farflt.sys MBAMService.exe File created C:\Windows\system32\DRIVERS\mbam.sys MBAMService.exe File created C:\Windows\system32\DRIVERS\MbamElam.sys MBAMService.exe File opened for modification C:\Windows\system32\DRIVERS\MbamElam.sys MBAMService.exe - Modifies RDP port number used by Windows 1 TTPs
- Patched UPX-packed file 1 IoCs
Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
resource yara_rule behavioral1/files/0x0007000000024984-2846.dat patched_upx - Sets service image path in registry 3 TTPs 4 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MBAMSwissArmy\ImagePath = "\\SystemRoot\\System32\\Drivers\\mbamswissarmy.sys" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mbamchameleon\ImagePath = "\\SystemRoot\\System32\\Drivers\\MbamChameleon.sys" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MBAMFarflt\ImagePath = "\\SystemRoot\\System32\\Drivers\\farflt.sys" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MBAMProtection\ImagePath = "\\SystemRoot\\System32\\Drivers\\mbam.sys" MBAMService.exe - Checks BIOS information in registry 2 TTPs 6 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate mbrescue.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 2026-05-22_fdb9eecfff6b1dd4a34bfbc4d5a22238_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 2026-05-22_fdb9eecfff6b1dd4a34bfbc4d5a22238_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion MBAMService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate MBAMService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion mbrescue.exe - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 35 IoCs
pid Process 4200 alg.exe 5116 DiagnosticsHub.StandardCollector.Service.exe 2468 fxssvc.exe 1084 elevation_service.exe 1460 elevation_service.exe 4148 maintenanceservice.exe 3976 msdtc.exe 4372 OSE.EXE 4536 PerceptionSimulationService.exe 3460 perfhost.exe 3836 locator.exe 4940 SensorDataService.exe 3500 snmptrap.exe 2868 spectrum.exe 1648 ssh-agent.exe 4436 TieringEngineService.exe 668 AgentService.exe 2700 vds.exe 2972 vssvc.exe 536 wbengine.exe 4360 WmiApSrv.exe 4008 SearchIndexer.exe 1036 MBAMInstallerService.exe 6204 MBVpnTunnelService.exe 7060 MBAMService.exe 7092 MBVpnTunnelService.exe 5920 MBAMService.exe 3640 MbamElam.sys 1220 MBAMService.exe 892 MBVpnTunnelService.exe 6616 mbamswissarmy.sys 2132 MbamChameleon.sys 5548 mbrescue.exe 6488 farflt.sys 6248 mbam.sys - Impair Defenses: Safe Mode Boot 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\MBAMService MBAMInstallerService.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\MBAMService\ = "Service" MBAMInstallerService.exe - Loads dropped DLL 42 IoCs
pid Process 1036 MBAMInstallerService.exe 1036 MBAMInstallerService.exe 6204 MBVpnTunnelService.exe 7092 MBVpnTunnelService.exe 7092 MBVpnTunnelService.exe 1220 MBAMService.exe 1220 MBAMService.exe 1220 MBAMService.exe 1220 MBAMService.exe 892 MBVpnTunnelService.exe 1220 MBAMService.exe 892 MBVpnTunnelService.exe 1220 MBAMService.exe 1220 MBAMService.exe 1220 MBAMService.exe 1220 MBAMService.exe 1220 MBAMService.exe 1220 MBAMService.exe 1220 MBAMService.exe 1220 MBAMService.exe 1220 MBAMService.exe 1220 MBAMService.exe 1220 MBAMService.exe 1220 MBAMService.exe 1220 MBAMService.exe 1220 MBAMService.exe 1220 MBAMService.exe 1220 MBAMService.exe 1220 MBAMService.exe 1220 MBAMService.exe 1220 MBAMService.exe 1220 MBAMService.exe 1220 MBAMService.exe 1220 MBAMService.exe 1036 MBAMInstallerService.exe 1220 MBAMService.exe 1220 MBAMService.exe 1220 MBAMService.exe 1220 MBAMService.exe 1036 MBAMInstallerService.exe 1220 MBAMService.exe 1220 MBAMService.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\X: MBAMInstallerService.exe File opened (read-only) \??\I: MBAMService.exe File opened (read-only) \??\J: MBAMService.exe File opened (read-only) \??\O: MBAMService.exe File opened (read-only) \??\W: MBAMService.exe File opened (read-only) \??\J: MBAMInstallerService.exe File opened (read-only) \??\N: MBAMInstallerService.exe File opened (read-only) \??\H: MBAMService.exe File opened (read-only) \??\K: MBAMService.exe File opened (read-only) \??\S: MBAMService.exe File opened (read-only) \??\Z: MBAMService.exe File opened (read-only) \??\B: MBAMInstallerService.exe File opened (read-only) \??\E: MBAMInstallerService.exe File opened (read-only) \??\P: MBAMInstallerService.exe File opened (read-only) \??\B: MBAMService.exe File opened (read-only) \??\G: MBAMService.exe File opened (read-only) \??\Y: MBAMService.exe File opened (read-only) \??\T: MBAMInstallerService.exe File opened (read-only) \??\V: MBAMInstallerService.exe File opened (read-only) \??\Y: MBAMInstallerService.exe File opened (read-only) \??\E: MBAMService.exe File opened (read-only) \??\L: MBAMService.exe File opened (read-only) \??\M: MBAMInstallerService.exe File opened (read-only) \??\Q: MBAMInstallerService.exe File opened (read-only) \??\W: MBAMInstallerService.exe File opened (read-only) \??\Z: MBAMInstallerService.exe File opened (read-only) \??\A: MBAMService.exe File opened (read-only) \??\N: MBAMService.exe File opened (read-only) \??\Q: MBAMService.exe File opened (read-only) \??\A: MBAMInstallerService.exe File opened (read-only) \??\G: MBAMInstallerService.exe File opened (read-only) \??\K: MBAMInstallerService.exe File opened (read-only) \??\O: MBAMInstallerService.exe File opened (read-only) \??\R: MBAMInstallerService.exe File opened (read-only) \??\P: MBAMService.exe File opened (read-only) \??\U: MBAMService.exe File opened (read-only) \??\V: MBAMService.exe File opened (read-only) \??\H: MBAMInstallerService.exe File opened (read-only) \??\U: MBAMInstallerService.exe File opened (read-only) \??\M: MBAMService.exe File opened (read-only) \??\R: MBAMService.exe File opened (read-only) \??\T: MBAMService.exe File opened (read-only) \??\X: MBAMService.exe File opened (read-only) \??\I: MBAMInstallerService.exe File opened (read-only) \??\L: MBAMInstallerService.exe File opened (read-only) \??\S: MBAMInstallerService.exe - ConfuserEx .NET packer 1 IoCs
Detects ConfuserEx .NET packer.
resource yara_rule behavioral1/files/0x0007000000024984-2846.dat ConfuserEx - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\system32\wbengine.exe 2026-05-22_fdb9eecfff6b1dd4a34bfbc4d5a22238_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File created C:\Windows\System32\DriverStore\FileRepository\netwsw00.inf_amd64_24d55504ae3587aa\netwsw00.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\net8192se64.inf_amd64_167684f9283b4eca\net8192se64.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\system32\msiexec.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Windows\System32\DriverStore\FileRepository\netnvm64.inf_amd64_35bbbe80dec15683\netnvm64.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-05-22_fdb9eecfff6b1dd4a34bfbc4d5a22238_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File created C:\Windows\System32\DriverStore\FileRepository\netwbw02.inf_amd64_1c4077fa004e73b4\netwbw02.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netxex64.inf_amd64_ede00b448bfe8099\netxex64.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-05-22_fdb9eecfff6b1dd4a34bfbc4d5a22238_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File created C:\Windows\System32\DriverStore\FileRepository\netwtw02.inf_amd64_42e02bae858d0fbd\netwtw02.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netavpna.inf_amd64_f6f0831ba09dd9f5\netavpna.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netg664.inf_amd64_84cd7b2798e0a666\netg664.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt MBAMService.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-05-22_fdb9eecfff6b1dd4a34bfbc4d5a22238_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File created C:\Windows\System32\DriverStore\FileRepository\netvchannel.inf_amd64_ba3e73aa330c95d6\netvchannel.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netwns64.inf_amd64_162bb49f925c6463\netwns64.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\mbtun.inf_amd64_add82795013a7c3b\mbtun.inf DrvInst.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 2026-05-22_fdb9eecfff6b1dd4a34bfbc4d5a22238_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\system32\fxssvc.exe 2026-05-22_fdb9eecfff6b1dd4a34bfbc4d5a22238_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File created C:\Windows\System32\DriverStore\FileRepository\net7500-x64-n650f.inf_amd64_cc87c915f33d1c27\net7500-x64-n650f.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\nett4x64.inf_amd64_54eacac1858c78ab\nett4x64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\rndiscmp.inf_amd64_81bff1eb756435c6\rndiscmp.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\kdnic.inf_amd64_6649425cdcae9b5f\kdnic.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\msdri.inf_amd64_97bef65a8432edd4\msdri.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{f147f524-b29d-5a41-b565-f41ffd9cafdb}\SET67DA.tmp DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\netloop.inf_amd64_762588e32974f9e8\netloop.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\bcmwdidhdpcie.inf_amd64_977dcc915465b0e9\bcmwdidhdpcie.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\mrvlpcie8897.inf_amd64_07fc330c5a5730ca\mrvlpcie8897.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netvg63a.inf_amd64_9f5493180b1252cf\netvg63a.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-05-22_fdb9eecfff6b1dd4a34bfbc4d5a22238_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File created C:\Windows\System32\DriverStore\FileRepository\e2xw10x64.inf_amd64_04c2ae40613a06ff\e2xw10x64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netrtwlane_13.inf_amd64_992f4f46e65f30d4\netrtwlane_13.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netbxnda.inf_amd64_1fff3bc87a99b0f1\netbxnda.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netl1c63x64.inf_amd64_4d6630ce07a4fb42\netl1c63x64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netl1e64.inf_amd64_8d5ca5ab1472fc44\netl1e64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netnvma.inf_amd64_7080f6b8ea1744fb\netnvma.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netwtw08.inf_amd64_7c0c516fb22456cd\netwtw08.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\System32\SensorDataService.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Windows\System32\DriverStore\FileRepository\netwmbclass.inf_amd64_dba6eeaf0544a4e0\netwmbclass.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netl160a.inf_amd64_e4cbe375963a69e9\netl160a.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\ipoib6x.inf_amd64_ef71073a5867971f\ipoib6x.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\net9500-x64-n650f.inf_amd64_e92c5a65e41993f9\net9500-x64-n650f.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\msux64w10.inf_amd64_5aa81644af5957b3\msux64w10.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt MBAMService.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-05-22_fdb9eecfff6b1dd4a34bfbc4d5a22238_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File created C:\Windows\System32\DriverStore\FileRepository\netrtwlane01.inf_amd64_b02695ef070d7a42\netrtwlane01.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netax88772.inf_amd64_5d1c92f42d958529\netax88772.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netathrx.inf_amd64_220db23f5419ea8d\netathrx.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\net8185.inf_amd64_7a30f5a9441cd55b\net8185.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netrtwlans.inf_amd64_97cd1a72c2a7829c\netrtwlans.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\bthpan.inf_amd64_b06c3bc32f7db374\bthpan.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\netl260a.inf_amd64_783312763f8749c7\netl260a.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\nete1g3e.inf_amd64_af58b4e19562a3f9\nete1g3e.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netrtwlanu.inf_amd64_1815bafd14dc59f0\netrtwlanu.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{f147f524-b29d-5a41-b565-f41ffd9cafdb}\mbtun.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{f147f524-b29d-5a41-b565-f41ffd9cafdb} DrvInst.exe File opened for modification C:\Windows\system32\SgrmBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-05-22_fdb9eecfff6b1dd4a34bfbc4d5a22238_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File created C:\Windows\System32\DriverStore\FileRepository\netax88179_178a.inf_amd64_b6748bc8bb8ccf4d\netax88179_178a.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\net1yx64.inf_amd64_8604d8a50804b9c1\net1yx64.PNF MBVpnTunnelService.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\zh-Hant\PresentationUI.resources.dll MBAMInstallerService.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\api-ms-win-core-string-l1-1-0.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.Runtime.Serialization.Json.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.Threading.Tasks.Parallel.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\ko\Microsoft.VisualBasic.Forms.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\tr\System.Windows.Forms.Primitives.resources.dll MBAMInstallerService.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-05-22_fdb9eecfff6b1dd4a34bfbc4d5a22238_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\es\Microsoft.VisualBasic.Forms.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\ko\UIAutomationClientSideProviders.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\tr\WindowsBase.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\zh-Hant\System.Windows.Forms.resources.dll MBAMInstallerService.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\Microsoft.CSharp.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\netstandard.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\de\System.Windows.Forms.Design.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\System.Windows.Forms.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\ru\UIAutomationTypes.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\Microsoft.EntityFrameworkCore.Sqlite.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\sentrynativesdk.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\tr\System.Windows.Forms.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\ig.exe MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\fr\System.Windows.Forms.resources.dll MBAMInstallerService.exe File opened for modification C:\Program Files\Malwarebytes\Anti-Malware\mbuns.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\cs\UIAutomationClientSideProviders.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\zh-Hans\PresentationUI.resources.dll MBAMInstallerService.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-05-22_fdb9eecfff6b1dd4a34bfbc4d5a22238_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.IO.Compression.Native.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\it\UIAutomationClient.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\System.Diagnostics.EventLog.Messages.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.json.bak MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\dbgshim.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.IO.FileSystem.DriveInfo.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.Net.HttpListener.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\PresentationFramework-SystemDrawing.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\MbamUI.Core.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\SQLitePCLRaw.provider.e_sqlcipher.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.Diagnostics.Process.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\pt-BR\UIAutomationClientSideProviders.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\tr\System.Windows.Forms.Design.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.UI.Controls.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\Microsoft.Extensions.Caching.Abstractions.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.json MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\.version MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.ComponentModel.TypeConverter.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.IO.Pipes.AccessControl.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\ru\System.Windows.Forms.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.Diagnostics.StackTrace.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\es\System.Windows.Input.Manipulations.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\PresentationFramework.Classic.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\zh-Hans\System.Windows.Forms.Design.resources.dll MBAMInstallerService.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 2026-05-22_fdb9eecfff6b1dd4a34bfbc4d5a22238_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\6.0.36\System.Net.Security.dll MBAMInstallerService.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbam.inf MBAMService.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 2026-05-22_fdb9eecfff6b1dd4a34bfbc4d5a22238_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Malwarebytes\Anti-Malware\malwarebytes_assistant.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\ko\PresentationCore.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\6.0.36\System.Design.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\mbamelam.sys MBAMInstallerService.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-05-22_fdb9eecfff6b1dd4a34bfbc4d5a22238_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe - Drops file in Windows directory 8 IoCs
description ioc Process File created C:\Windows\inf\oem3.inf DrvInst.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-05-22_fdb9eecfff6b1dd4a34bfbc4d5a22238_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\INF\setupapi.dev.log MBVpnTunnelService.exe File opened for modification C:\Windows\INF\setupapi.dev.log svchost.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\inf\oem3.inf DrvInst.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 2 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh MBVpnTunnelService.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh MBVpnTunnelService.exe - Modifies trusted root certificate store through registry 1 TTPs 11 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa22000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8DA7F965EC5EFC37910F1C6E59FDC1CC6A6EDE16\Blob = 0300000001000000140000008da7f965ec5efc37910f1c6e59fdc1cc6a6ede162000000001000000450300003082034130820229a0030201020213066c9fcf99bf8c0a39e2f0788a43e696365bca300d06092a864886f70d01010b05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412031301e170d3135303532363030303030305a170d3338303131373030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f74204341203130820122300d06092a864886f70d01010105000382010f003082010a0282010100b2788071ca78d5e371af478050747d6ed8d78876f49968f7582160f97484012fac022d86d3a0437a4eb2a4d036ba01be8ddb48c80717364cf4ee8823c73eeb37f5b519f84968b0ded7b976381d619ea4fe8236a5e54a56e445e1f9fdb416fa74da9c9b35392ffab02050066c7ad080b2a6f9afec47198f503807dca2873958f8bad5a9f948673096ee94785e6f89a351c0308666a14566ba54eba3c391f948dcffd1e8302d7d2d747035d78824f79ec4596ebb738717f2324628b843fab71daacab4f29f240e2d4bf7715c5e69ffea9502cb388aae50386fdbfb2d621bc5c71e54e177e067c80f9c8723d63f40207f2080c4804c3e3b24268e04ae6c9ac8aa0d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604148418cc8534ecbc0c94942e08599cc7b2104e0a08300d06092a864886f70d01010b0500038201010098f2375a4190a11ac57651282036230eaee628bbaaf894ae48a4307f1bfc248d4bb4c8a197f6b6f17a70c85393cc0828e39825cf23a4f9de21d37c8509ad4e9a753ac20b6a897876444718656c8d418e3b7f9acbf4b5a750d7052c37e8034bade961a0026ef5f2f0c5b2ed5bb7dcfa945c779e13a57f52ad95f2f8933bde8b5c5bca5a525b60af14f74befa3fb9f40956d3154fc42d3c7461f23add90f48709ad9757871d1724334756e5759c2025c266029cf2319168e8843a5d4e4cb08fb231143e843297262a1a95d5e08d490aeb8d8ce14c2d055f286f6c49343776661c0b9e841d7977860036e4a72aea5d17dba109e866c1b8ab95933f8ebc490bef1b9 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\5A8CEF45D7A69859767A8C8B4496B578CF474B1A\Blob = 0300000001000000140000005a8cef45d7a69859767a8c8b4496b578cf474b1a2000000001000000450500003082054130820329a0030201020213066c9fd29635869f0a0fe58678f85b26bb8a37300d06092a864886f70d01010c05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412032301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f74204341203230820222300d06092a864886f70d01010105000382020f003082020a0282020100ad969f2d9c4a4c4a81795199ec8acb6b605113bc4d6d06fcb0088ddd19106ac7260c35d8c06f2084e994b19b8503c35bdb4ae8c8f89076d95b4fe34ce806364dcc9aac3d0c902b92d4061960ac374479858182ad5a37e00dcc9da64c5276ea439db704d150f655e0d5d2a64985e937e9ca7eae5c954d489a3fae205a6d8895d934b8521a4390b0bf6c05b9b678b7ead0e43a3c125362ff4af27bbe3505a91234e3f36474622c3d00495a28fe3244bb87dd652702713bda4af71fdacdf72155904f0fecae82e19f6bd945d3bbf05f87ed3c2c3986da3fdeec7255eb79a3addbdd7cb0ba1ccefcde4f3576cf0ff8781f6a36514627615be99ecff0a2557d7c258a6f2fb4c5cf842e2bfd0d51106cfb5f1bbc1b7ec5ae3b98013192ff0b57f49ab2b957e9abef0d76d1f0eef4ce86a7e06ee9b469a1df69f633c6692e97139ea587b057108137c953b3bb7ff692d19cd018f4926eda834fa663994ca5fb5eef21647a205f6c648515cb37e9620c0b2a16dc012e32da3e4bf59e3af6174094ef9e910886fabe63a85a33eccb744395f96c695236c7296ffc55035c1ffb9fbd47ebe74947950b4e89220949e0f5611ef1bf2e8a726e8059ff573af97532a34e5feced2862d94d73f2cc811760edcdebdcdba7cac57e02bdf2540854fdb42d092c17544a98d154e1516708d2ed6e7e6f3fd22d81592966cb903995111e7427feddebaf0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414b00cf04c30f405580248fd33e552af4b84e36652300d06092a864886f70d01010c05000382020100aaa8808f0e78a3e0a2d4cde6f5987a3bea0003b0970e93bc5aa8f62c8c7287a9b1fc7f73fd637178a58759cf30e10d10b2135a6d82f56ae6809fa0050b68e4476bc76adfb6fd773272e518fa09f4a0932c5dd28c75857665900c0379b7312363ad788309866884cafff9cf269a9279e7cd4bc5e761a717cbf3a91293936ba7e82f5392c46058b0cc0251185b858d625963b6adb4de9afb26f70027c05d55377499c9507fe3592e44e32c25eeec4c3277b49f1ae94b5d20c5dafd1c8716c643e8d4bb269a45705ea90b3753e2467b27fde046f289b7cc42b6cb28266ed9a5c93ac8411360f7508c15aeb26d1a151a5778e6922ad96590823f6c02afae123a27963604d71da28063a99bf1e5bab47c14b04ec9b11f745f38f651ea9bfa2ca211d4a92d271a45b1afb24e710dc05846d66906cb53cbb3fe6b41cd417e7d4c0f7c72797a59cd5e4a0eac9ba99873797cb4f4ccb9b8070cb2745cb8c76f88a190a7f4aaf9bf673af41a15621eb79fbe3db129af67a112f25810195303301bb81a89f69cbd97038ea309f31d8b21f1b4dfe41cd19f650206ea5cd613b384efa2a55c8c7729a768c06bae40d2a8b4eacdf08d4b389c199a1b2854b88990efca75813e1ef26424c718af4eff479e07f63565a4d30a56fff517646cefa822254993b6df0017da587e5deec51bb0d1d15f2110c7f9f3ba020a2707c5f1d6c7d3e0fb09606c MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0D44DD8C3C8C1A1A58756481E90F2E2AFFB3D26E\Blob = 0300000001000000140000000d44dd8c3c8c1a1a58756481e90f2e2affb3d26e2000000001000000ba010000308201b63082015ba0030201020213066c9fd5749736663f3b0b9ad9e89e7603f24a300a06082a8648ce3d0403023039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412033301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f7420434120333059301306072a8648ce3d020106082a8648ce3d030107034200042997a7c6417fc00d9be8011b56c6f252a5ba2db212e8d22ed7fac9c5d8aa6d1f73813b3b986b397c33a5c54e868e8017686245577d44581db337e56708eb66dea3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414abb6dbd7069e37ac3086079170c79cc419b178c0300a06082a8648ce3d0403020349003046022100e08592a317b78df92b06a593ac1a98686172fae1a1d0fb1c7860a64399c5b8c40221009c02eff1949cb396f9ebc62af8b62cfe3a901416d78c6324481cdf307dd5683b MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F6108407D6F8BB67980CC2E244C2EBAE1CEF63BE\Blob = 030000000100000014000000f6108407d6f8bb67980cc2e244c2ebae1cef63be2000000001000000f6010000308201f230820178a0030201020213066c9fd7c1bb104c2943e5717b7b2cc81ac10e300a06082a8648ce3d0403033039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412034301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f7420434120343076301006072a8648ce3d020106052b8104002203620004d2ab8a374fa3530dfec18a7b4ba87b464b63b062f62d1bdb087121d200e863bd9a27fbf0396e5dea3da5c981aaa35b2098455d16dbfde8106de39ce0e3bd5f8462f3706433a0cb242f70ba88a12aa075f881ae6206c481db396e29b01efa2e5ca3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414d3ecc73a656ecce1da769a56fb9cf3866d57e581300a06082a8648ce3d040303036800306502303a8b21f1bd7e11add0ef58962fd6eb9d7e908d2bcf6655c32ce328a9700a470ef0375912ff2d9994284e2a4f354d335a023100ea75004e3bc43a941291c958469d211372a7889c8ae44c4adb96d4ac8b6b6b49125333add7e4be24fcb50a76d4a5bc10 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\1C58A3A8518E8759BF075B76B750D4F2DF264FCD\Blob = 0300000001000000140000001c58a3a8518e8759bf075b76b750d4f2df264fcd2000000001000000c2040000308204be308203a6a003020102021006d8d904d5584346f68a2fa754227ec4300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3231303431343030303030305a170d3331303431333233353935395a304f310b300906035504061302555331153013060355040a130c446967694365727420496e633129302706035504031320446967694365727420544c53205253412053484132353620323032302043413130820122300d06092a864886f70d01010105000382010f003082010a0282010100c14bb3654770bcdd4f58dbec9cedc366e51f311354ad4a66461f2c0aec6407e52edcdcb90a20eddfe3c4d09e9aa97a1d8288e51156db1e9f58c251e72c340d2ed292e156cbf1795fb3bb87ca25037b9a52416610604f571349f0e8376783dfe7d34b674c2251a6df0e9910ed57517426e27dc7ca622e131b7f238825536fc13458008b84fff8bea75849227b96ada2889b15bca07cdfe951a8d5b0ed37e236b4824b62b5499aecc767d6e33ef5e3d6125e44f1bf71427d58840380b18101faf9ca32bbb48e278727c52b74d4a8d697dec364f9cace53a256bc78178e490329aefb494fa415b9cef25c19576d6b79a72ba2272013b5d03d40d321300793ea99f50203010001a38201823082017e30120603551d130101ff040830060101ff020100301d0603551d0e04160414b76ba2eaa8aa848c79eab4da0f98b2c59576b9f4301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030106082b06010505070302307606082b06010505070101046a3068302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304006082b060105050730028634687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274476c6f62616c526f6f7443412e63727430420603551d1f043b30393037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274476c6f62616c526f6f7443412e63726c303d0603551d2004363034300b06096086480186fd6c02013007060567810c01013008060667810c0102013008060667810c0102023008060667810c010203300d06092a864886f70d01010b050003820101008032ce5e0bdd6e5a0d0aafe1d684cbc08efa8570edda5db30cf72b7540fe850afaf33178b7704b1a8958ba80bdf36b1de97ecf0bba589c59d490d3fd6cfdd0986db771825bcf6d0b5a09d07bdec443d82aa4de9e41265fbb8f99cbddaee1a86f9f87fe74b71f1b20abb14fc6f5675d5d9b3ce9ff69f7616cd6d9f3fd36c6ab038876d24b2e7586e3fcd8557d26c21177df3e02b67cf3ab7b7a86366fb8f7d89371cf86df7330fa7babed2a59c842843b11171a52f3c90e147da25b7267ba71ed574766c5b8024a65345e8bd02a3c209c51994ce7529ef76b112b0d927e1de88aeb36164387ea2a63bf753febdec403bb0a3cf730efebaf4cfc8b3610733ef3a4 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\2AD974A775F73CBDBBD8F5AC3A49255FA8FB1F8C\Blob = 0300000001000000140000002ad974a775f73cbdbbd8f5ac3a49255fa8fb1f8c2000000001000000620400003082045e30820346a0030201020213077312380b9d6688a33b1ed9bf9ccda68e0e0f300d06092a864886f70d01010b05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412031301e170d3232303832333232323132385a170d3330303832333232323132385a303c310b3009060355040613025553310f300d060355040a1306416d617a6f6e311c301a06035504031313416d617a6f6e205253412032303438204d303130820122300d06092a864886f70d01010105000382010f003082010a0282010100eb712ca9cb1f8828923230af8a570f78b73725955587ac675c97d322c8daa214676b7cf067dae2032ab356125dc6b547f96708a7937a9592180fb4f9f910369a7f2f80b64fba134ec75d531ee0dd96330720d396bc12e4745042a1051373b54f9b4424fe2d7fedbc2285ec362133977506ce271882dce3d9c582078d5e26012626671fd93f13cf32ba6bad7864fcaaff0e023c07df9c0578728cfdea75b7032884dae86e078cd05085ef8154b2716eec6d62ef8f94c35ee9c4a4d091c02e249198caeeba258ed4f671b6fb5b6b38064837478d86dcf2ea06fb76377d9eff424e4d588293cfe271c278b17aab4b5b94378881e4d9af24aef872c565fb4bb451e70203010001a382015a3082015630120603551d130101ff040830060101ff020100300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030106082b06010505070302301d0603551d0e0416041481b80e638a891218e5fa3b3b50959fe6e5901385301f0603551d230418301680148418cc8534ecbc0c94942e08599cc7b2104e0a08307b06082b06010505070101046f306d302f06082b060105050730018623687474703a2f2f6f6373702e726f6f746361312e616d617a6f6e74727573742e636f6d303a06082b06010505073002862e687474703a2f2f6372742e726f6f746361312e616d617a6f6e74727573742e636f6d2f726f6f746361312e636572303f0603551d1f043830363034a032a030862e687474703a2f2f63726c2e726f6f746361312e616d617a6f6e74727573742e636f6d2f726f6f746361312e63726c30130603551d20040c300a3008060667810c010201300d06092a864886f70d01010b05000382010100ad00de0205232e063262b46bb19416e41140de2bfa59c135efe0aa8f2b41b9d1f38739001df23db5a7470c0606c691f3075702d4edbd17c1909abf4875a2074f30dd4a6a42b50d3d15c00ffe845bc63c99cc5752b1d86e12d59692934b94e507e88982086a7a34d49e64e13d876a92909a63a14bf88fb6ea34d305be20c2de06e28c9f738b9f4d3985cace19369d85c99ec9f8503fb67e88a1efca84068b50b40a5ca61c44f1fdc8614060f26125aa07f4c7c27375e40c0b428d04e55f4448995b7b898196a7889d4b0d62e804c4d7feb4e8b26dcaecc01cbc385b1ddf85ce5b7ae3494b6cb9a7ddf405b249ade1c5146bc2ccebcd7fd65869bac3207e7fb0b8 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E\Blob = 030000000100000014000000b51c067cee2b0c3df855ab2d92f4fe39d4e70f0e2000000001000000e1030000308203dd308202c5a003020102020100300d06092a864886f70d01010b050030818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a30818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bdedc103fcf68ffc02b16f5b9f48d99d79e2a2b703615618c347b6d7ca3d352e8943f7a1699bde8a1afd13209cb44977322956fdb9ec8cdd22fa72dc276197eef65a84ec6e19b9892cdc845bd574fb6b5fc589a51052894655f4b8751ce67fe454ae4bf85572570219f8177159eb1e280774c59d48be6cb4f4a4b0f364377992c0ec465e7fe16d534c62afcd1f0b63bb3a9dfbfc7900986174cf26824063f3b2726a190d99cad40e75cc37fb8b89c159f1627f5fb35f6530f8a7b74d765a1e765e34c0e89656998ab3f07fa4cdbddc32317c91cfe05f11f86baa495cd19994d1a2e3635b0976b55662e14b741d96d426d4080459d0980e0ee6defcc3ec1f90f10203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147c0c321fa7d9307fc47d68a362a8a1ceab075b27300d06092a864886f70d01010b050003820101001159fa254f036f94993b9a1f828539d47605945ee128936d625d09c2a0a8d4b07538f1346a9de49f8a862651e62cd1c62d6e95204a9201ecb88a677b31e2672e8c9503262e439d4a31f60eb50cbbb7e2377f22ba00a30e7b52fb6bbb3bc4d379514ecd90f4670719c83c467a0d017dc558e76de68530179a24c410e004f7e0f27fd4aa0aff421d37ed94e5645912207738d3323e3881759673fa688fb1cbce1fc5ecfa9c7ecf7eb1f1072db6fcbfcaa4bfd097054abcea18280290bd5478092171d3d17d1dd916b0a9613dd00a0022fcc77bcb0964450b3b4081f77d7c32f598ca588e7d2aee90597364f936745e25a1f566052e7f3915a92afb508b8e8569f4 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e MBAMInstallerService.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-22_fdb9eecfff6b1dd4a34bfbc4d5a22238_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe - Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MBAMService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MBAMService.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION MBAMInstallerService.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Malwarebytes.exe = "11000" MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION MBAMService.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\mbam.exe = "11000" MBAMService.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\mbamtray.exe = "11000" MBAMService.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d68b6f9ae7e9dc01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" SearchProtocolHost.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Malwarebytes MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft MBAMInstallerService.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000fc76a9ae7e9dc01 SearchProtocolHost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\Software MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\15.0\Common MBAMInstallerService.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:\ MBAMInstallerService.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template" SearchProtocolHost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\16.0\Common\Security MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:\ MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000001a1639ae7e9dc01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT MBAMInstallerService.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: MBAMInstallerService.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a05d039be7e9dc01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" SearchProtocolHost.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B32065E5-189E-4C5F-AA59-32A158BAF5B7}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CE7ABFE9-8F8F-4EDD-86BD-9209FD072126}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99E6F3FE-333C-462C-8C39-BC27DCA4A80E} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2F14F58B-B908-4644-830F-5ACF8542D27F}\TypeLib\ = "{74630AE8-C170-4A8F-A90A-F42D63EFE1E8}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6CE18DD5-2BD7-4844-B9AD-DF6A995750A1}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0E2822AB-0447-4F28-AF4C-FFDB1E8595AE} MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{172ABF99-1426-47CA-895B-092E23728E8A}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{00A73BC0-754E-44E1-B190-D59E187A5EA1} MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{67550381-6239-4A05-B207-5C9DEA9239F6}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{53AE1078-790B-405A-AD2E-A7DB93FFC016}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{638A43D2-5475-424B-87B8-042109D7768F} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{995A8F3B-6B5F-4773-898A-862D50142B4C}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E36A44EC-B16B-41DE-AD94-A59E117F67FF}\ = "IVPNBackendServiceProvider" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F36AD0D0-B5F0-4C69-AF08-603D177FEF0E}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E1AC7139-D1FF-4DE9-84A4-92E2B47F5D2A}\AppID = "{1F7896AD-8886-42CD-8ABD-7A1315A3A5F2}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{ED06E075-D1FD-4635-BA17-2F6D6BB0DFD6}\ProxyStubClsid32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EBA4A79D-9F4E-4E7A-AC00-49ECE23C20B6}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6ED2B0A1-984E-4A35-9B04-E0EBAFB2842A}\TypeLib\Version = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A0101B90-FD0B-40CF-90E4-33650F09A80F}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C2E404A3-4E3F-4094-AE06-5E38D39B79AE}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{309BE0D9-B4CA-4610-B250-26CC9CDE7186}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F81B1882-A388-42E5-9351-05C858E52DDC}\ = "IPoliciesControllerEventsV2" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B38EDC4F-A2CD-4F76-8607-F123FE4031D5}\TypeLib\Version = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{571FB9A8-E53B-4740-B125-082207566E5F}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5B9F1C8B-1E3B-4FBA-9C8A-7B0E6DCD9C9E}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6357A98F-CE03-4C67-9410-00907FB21BC7}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4412646D-16F5-4F3C-8348-0744CDEBCCBF}\ = "_ISPControllerEventsV3" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BF474111-9116-45C6-AF53-209E64F1BB53} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DBD14E9A-A1B3-4B5A-8A4A-0E4EB25FAA54}\ = "ICloudControllerV8" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4F3822FA-CCD5-4934-AB6D-3382B2F91DB9}\TypeLib\ = "{A82129F1-32E1-4D79-A39F-EBFEE53A70BF}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{23416CFE-018D-418E-8CE9-5729D070CCED} MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{96C7187E-6EC4-49BD-88C7-04A3A8A97CC5}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{19E8B60E-50A1-4E29-9138-A13421D2BF7D}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{995A8F3B-6B5F-4773-898A-862D50142B4C}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4412646D-16F5-4F3C-8348-0744CDEBCCBF} MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2A0F9375-1809-45ED-AFE0-92852B971139}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0C30B7D9-82A1-4068-8A5B-F4C7D5EF75A3}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C292FC1E-6930-404E-B7C6-2CBDA9CCF54B}\ = "IUpdateControllerV15" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FD6673C7-8E52-46EE-80B8-58F3FB6AA036}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{964AD404-A1EF-4EDA-B8FA-1D8003B29B10}\ = "IPoliciesControllerEventsV3" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{50538523-AA2F-40D3-9B58-DB51D5BD3D4A}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1861D707-8D71-497D-8145-62D5CBF4222F}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F128CCB-D86F-4998-803A-7CD58474FE2C}\ = "IScannerEvents" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F12E228B-821D-4093-B2E0-7F3E169A925A}\ProxyStubClsid32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3DCF0F42-EF8F-4450-BA68-42B61F594B2F}\ProxyStubClsid32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FB81F893-5D01-4DFD-98E1-3A6CB9C3E63E}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FB81F893-5D01-4DFD-98E1-3A6CB9C3E63E}\TypeLib\ = "{49F6AC60-2104-42C6-8F71-B3916D5AA732}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6B2CCE9B-6446-450F-9C9D-542CD9FA6677} MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MB.CloudController MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F77B440A-6CBC-4AFD-AA22-444552960E50}\ProxyStubClsid32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E298372C-5B10-42B4-B44C-7B85EA0722A3}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EC4BC952-9520-462B-BD5C-4E2C9200B3C9}\TypeLib\ = "{332AFEBA-9341-4CEC-8EA6-DB155A99DF63}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{636AD0C8-854C-46A5-8442-E5EE74723B3C}\TypeLib\Version = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2446F405-83F0-460F-B837-F04540BB330C}\1.0\FLAGS MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CCEFCD43-B934-4168-AE51-6FE07D3D0624}\TypeLib\Version = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A583D5DD-F005-4D17-B564-5B594BB58339}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D7E996E4-8D43-41A1-B9DF-633CE3AC3BDD}\ = "ICleanControllerV18" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2446F405-83F0-460F-B837-F04540BB330C}\1.0\0\win64 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57CE581A-0CB6-4266-9CA0-19364C90A0B3}\ = "MBAMShlExt Class" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C7BCC13C-47B9-4DC0-8FC6-B2A489EF60EF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2DEBAD4E-3BAF-44F0-9150-BCCCC3801CF9}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E90361FE-F6B5-43E8-99F7-1BD40500981F}\TypeLib\Version = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6C1047E9-9ADC-4F8A-8594-036375F53103}\ProxyStubClsid32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5250E5C8-A09C-4F87-A0DA-A46A62A0EACF} MBAMService.exe - Modifies system certificate store 2 TTPs 11 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8DA7F965EC5EFC37910F1C6E59FDC1CC6A6EDE16 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F6108407D6F8BB67980CC2E244C2EBAE1CEF63BE MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\1C58A3A8518E8759BF075B76B750D4F2DF264FCD MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\5A8CEF45D7A69859767A8C8B4496B578CF474B1A MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0D44DD8C3C8C1A1A58756481E90F2E2AFFB3D26E MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\2AD974A775F73CBDBBD8F5AC3A49255FA8FB1F8C MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2 MBAMInstallerService.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1752 2026-05-22_fdb9eecfff6b1dd4a34bfbc4d5a22238_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1752 2026-05-22_fdb9eecfff6b1dd4a34bfbc4d5a22238_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1752 2026-05-22_fdb9eecfff6b1dd4a34bfbc4d5a22238_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1752 2026-05-22_fdb9eecfff6b1dd4a34bfbc4d5a22238_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1752 2026-05-22_fdb9eecfff6b1dd4a34bfbc4d5a22238_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1752 2026-05-22_fdb9eecfff6b1dd4a34bfbc4d5a22238_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1752 2026-05-22_fdb9eecfff6b1dd4a34bfbc4d5a22238_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1752 2026-05-22_fdb9eecfff6b1dd4a34bfbc4d5a22238_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1752 2026-05-22_fdb9eecfff6b1dd4a34bfbc4d5a22238_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1752 2026-05-22_fdb9eecfff6b1dd4a34bfbc4d5a22238_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1752 2026-05-22_fdb9eecfff6b1dd4a34bfbc4d5a22238_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1752 2026-05-22_fdb9eecfff6b1dd4a34bfbc4d5a22238_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1752 2026-05-22_fdb9eecfff6b1dd4a34bfbc4d5a22238_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1752 2026-05-22_fdb9eecfff6b1dd4a34bfbc4d5a22238_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1752 2026-05-22_fdb9eecfff6b1dd4a34bfbc4d5a22238_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1752 2026-05-22_fdb9eecfff6b1dd4a34bfbc4d5a22238_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1752 2026-05-22_fdb9eecfff6b1dd4a34bfbc4d5a22238_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1752 2026-05-22_fdb9eecfff6b1dd4a34bfbc4d5a22238_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1752 2026-05-22_fdb9eecfff6b1dd4a34bfbc4d5a22238_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1752 2026-05-22_fdb9eecfff6b1dd4a34bfbc4d5a22238_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1752 2026-05-22_fdb9eecfff6b1dd4a34bfbc4d5a22238_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1752 2026-05-22_fdb9eecfff6b1dd4a34bfbc4d5a22238_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1752 2026-05-22_fdb9eecfff6b1dd4a34bfbc4d5a22238_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1752 2026-05-22_fdb9eecfff6b1dd4a34bfbc4d5a22238_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1752 2026-05-22_fdb9eecfff6b1dd4a34bfbc4d5a22238_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1752 2026-05-22_fdb9eecfff6b1dd4a34bfbc4d5a22238_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1752 2026-05-22_fdb9eecfff6b1dd4a34bfbc4d5a22238_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1752 2026-05-22_fdb9eecfff6b1dd4a34bfbc4d5a22238_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1752 2026-05-22_fdb9eecfff6b1dd4a34bfbc4d5a22238_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1752 2026-05-22_fdb9eecfff6b1dd4a34bfbc4d5a22238_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1752 2026-05-22_fdb9eecfff6b1dd4a34bfbc4d5a22238_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1752 2026-05-22_fdb9eecfff6b1dd4a34bfbc4d5a22238_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1752 2026-05-22_fdb9eecfff6b1dd4a34bfbc4d5a22238_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1752 2026-05-22_fdb9eecfff6b1dd4a34bfbc4d5a22238_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1752 2026-05-22_fdb9eecfff6b1dd4a34bfbc4d5a22238_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1752 2026-05-22_fdb9eecfff6b1dd4a34bfbc4d5a22238_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1752 2026-05-22_fdb9eecfff6b1dd4a34bfbc4d5a22238_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1036 MBAMInstallerService.exe 1036 MBAMInstallerService.exe 1036 MBAMInstallerService.exe 1036 MBAMInstallerService.exe 1036 MBAMInstallerService.exe 1036 MBAMInstallerService.exe 1036 MBAMInstallerService.exe 1036 MBAMInstallerService.exe 1036 MBAMInstallerService.exe 1036 MBAMInstallerService.exe 1036 MBAMInstallerService.exe 1036 MBAMInstallerService.exe 1036 MBAMInstallerService.exe 1036 MBAMInstallerService.exe 1036 MBAMInstallerService.exe 1036 MBAMInstallerService.exe 1036 MBAMInstallerService.exe 1036 MBAMInstallerService.exe 1036 MBAMInstallerService.exe 1036 MBAMInstallerService.exe 1036 MBAMInstallerService.exe 1036 MBAMInstallerService.exe 1036 MBAMInstallerService.exe 1036 MBAMInstallerService.exe 1036 MBAMInstallerService.exe 1036 MBAMInstallerService.exe 1036 MBAMInstallerService.exe - Suspicious behavior: LoadsDriver 15 IoCs
pid Process 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1752 2026-05-22_fdb9eecfff6b1dd4a34bfbc4d5a22238_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe Token: SeAuditPrivilege 2468 fxssvc.exe Token: SeRestorePrivilege 4436 TieringEngineService.exe Token: SeManageVolumePrivilege 4436 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 668 AgentService.exe Token: SeBackupPrivilege 2972 vssvc.exe Token: SeRestorePrivilege 2972 vssvc.exe Token: SeAuditPrivilege 2972 vssvc.exe Token: SeBackupPrivilege 536 wbengine.exe Token: SeRestorePrivilege 536 wbengine.exe Token: SeSecurityPrivilege 536 wbengine.exe Token: 33 4008 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 4008 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4008 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4008 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4008 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4008 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4008 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4008 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4008 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4008 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4008 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4008 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4008 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4008 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4008 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4008 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4008 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4008 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4008 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4008 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4008 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4008 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4008 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4008 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4008 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4008 SearchIndexer.exe Token: SeDebugPrivilege 1752 2026-05-22_fdb9eecfff6b1dd4a34bfbc4d5a22238_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe Token: SeDebugPrivilege 1752 2026-05-22_fdb9eecfff6b1dd4a34bfbc4d5a22238_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe Token: SeDebugPrivilege 1752 2026-05-22_fdb9eecfff6b1dd4a34bfbc4d5a22238_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe Token: SeDebugPrivilege 1752 2026-05-22_fdb9eecfff6b1dd4a34bfbc4d5a22238_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe Token: SeDebugPrivilege 1752 2026-05-22_fdb9eecfff6b1dd4a34bfbc4d5a22238_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe Token: SeDebugPrivilege 1036 MBAMInstallerService.exe Token: SeDebugPrivilege 1036 MBAMInstallerService.exe Token: SeDebugPrivilege 1036 MBAMInstallerService.exe Token: SeDebugPrivilege 1036 MBAMInstallerService.exe Token: SeDebugPrivilege 1036 MBAMInstallerService.exe Token: SeDebugPrivilege 1036 MBAMInstallerService.exe Token: SeDebugPrivilege 1036 MBAMInstallerService.exe Token: SeDebugPrivilege 1036 MBAMInstallerService.exe Token: SeDebugPrivilege 1036 MBAMInstallerService.exe Token: SeDebugPrivilege 1036 MBAMInstallerService.exe Token: SeDebugPrivilege 1036 MBAMInstallerService.exe Token: SeDebugPrivilege 1036 MBAMInstallerService.exe Token: SeDebugPrivilege 1036 MBAMInstallerService.exe Token: SeDebugPrivilege 1036 MBAMInstallerService.exe Token: SeDebugPrivilege 1036 MBAMInstallerService.exe Token: SeDebugPrivilege 1036 MBAMInstallerService.exe Token: SeDebugPrivilege 1036 MBAMInstallerService.exe Token: SeDebugPrivilege 1036 MBAMInstallerService.exe Token: SeDebugPrivilege 1036 MBAMInstallerService.exe Token: SeDebugPrivilege 1036 MBAMInstallerService.exe Token: SeDebugPrivilege 1036 MBAMInstallerService.exe Token: SeDebugPrivilege 1036 MBAMInstallerService.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1752 2026-05-22_fdb9eecfff6b1dd4a34bfbc4d5a22238_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4008 wrote to memory of 1920 4008 SearchIndexer.exe 116 PID 4008 wrote to memory of 2364 4008 SearchIndexer.exe 117 PID 1036 wrote to memory of 6204 1036 MBAMInstallerService.exe 132 PID 6728 wrote to memory of 6760 6728 svchost.exe 136 PID 1036 wrote to memory of 7060 1036 MBAMInstallerService.exe 137 PID 1220 wrote to memory of 5548 1220 MBAMService.exe 150 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-22_fdb9eecfff6b1dd4a34bfbc4d5a22238_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-22_fdb9eecfff6b1dd4a34bfbc4d5a22238_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe"1⤵
- Downloads MZ/PE file
- Drops file in Drivers directory
- Checks BIOS information in registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1752
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
PID:4200
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:5116
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:2956
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2468
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1084
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1460
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:4148
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3976
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:4372
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:4536
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3460
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:3836
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4940
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:3500
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2868
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:1648
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:4472
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4436
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:668
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:2700
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2972
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:536
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:4360
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4008 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:1920
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 7842⤵
- Modifies data under HKEY_USERS
PID:2364
-
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- Modifies trusted root certificate store through registry
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe" /installmbtun2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
PID:6204
-
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe" /Service /Protected2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:7060
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:6728 -
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "9" "C:\Program Files\Malwarebytes\Anti-Malware\mbtun\mbtun.inf" "9" "4ba9030c7" "0000000000000148" "Service-0x0-3e7$\Default" "0000000000000158" "208" "C:\Program Files\Malwarebytes\Anti-Malware\mbtun"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:6760
-
-
C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Event Triggered Execution: Netsh Helper DLL
PID:7092
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"1⤵
- Executes dropped EXE
PID:5920
-
C:\Windows\system32\DRIVERS\MbamElam.sysC:\Windows\system32\DRIVERS\MbamElam.sys1⤵
- Executes dropped EXE
PID:3640
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\ProgramData\Malwarebytes\MBAMService\rmode\mbrescue.exe"C:\ProgramData\Malwarebytes\MBAMService\rmode\mbrescue.exe" /rescuemode "C:\Program Files\Malwarebytes\Anti-Malware" "C:\ProgramData\Malwarebytes\MBAMService"2⤵
- Checks BIOS information in registry
- Executes dropped EXE
PID:5548
-
-
C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Event Triggered Execution: Netsh Helper DLL
PID:892
-
C:\Windows\system32\DRIVERS\mbamswissarmy.sysC:\Windows\system32\DRIVERS\mbamswissarmy.sys1⤵
- Executes dropped EXE
PID:6616
-
C:\Windows\system32\DRIVERS\MbamChameleon.sysC:\Windows\system32\DRIVERS\MbamChameleon.sys1⤵
- Executes dropped EXE
PID:2132
-
C:\Windows\system32\DRIVERS\farflt.sysC:\Windows\system32\DRIVERS\farflt.sys1⤵
- Executes dropped EXE
PID:6488
-
C:\Windows\system32\DRIVERS\mbam.sysC:\Windows\system32\DRIVERS\mbam.sys1⤵
- Executes dropped EXE
PID:6248
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
2Component Object Model Hijacking
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
2Component Object Model Hijacking
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
1Safe Mode Boot
1Modify Registry
3Subvert Trust Controls
2Install Root Certificate
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\PROGRA~1\MALWAR~1\ANTI-M~1\mbtun\mbtun.cat
- Size 10KB
- SHA256 9ceb410494b95397ec1f8fa505d071672bf61f81cc596b8eccd167a77893c658
- MD5 8abff1fbf08d70c1681a9b20384dbbf9
- SHA1 c9762e121e4f8a7ad931eee58ee60c8e9fc3ecb6
- SHA512 37998e0aee93ff47fe5b1636fce755966debe417a790e1aebd7674c86c1583feef04648a7bc79e4dedaabb731051f4f803932ac49ea0be05776c0f4d218b076f
- SSDEEP 192:gM6dynJCSEJOL7yKnUi8rFWQFIGjl8zjEswYt1FfRM/GX01k9z3AeOlFa:gqS4CFRWGjl8M8/fi/GR9z/OlFa
- TLSH T1B43208E1897D84C2ED87A87147E8E5977C3C1BCB2C5055A911ABF7600AA33C6E71853D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\PROGRA~1\MALWAR~1\ANTI-M~1\mbtun\mbtun.sys
- Size 107KB
- SHA256 6903e60784b9fa5d8b417f93f19665c59946a4de099bd1011ab36271b267261c
- MD5 83d4fba999eb8b34047c38fabef60243
- SHA1 25731b57e9968282610f337bc6d769aa26af4938
- SHA512 47faab5fff3e3e2d2aea0a425444aa2e215f1d5bf97edee2a3bb773468e1092919036bcd5002357594b62519bf3a8980749d8d0f6402de0e73c2125d26e78f1e
- SSDEEP 1536:k0h5S895dQOYJaryTmbMc6uqkZUcmSl47AjpdAyDCYJqUufIfmNn3VzwZ6Dh7Q9y:C895uOYJar1MLcmSlrSgC6Duls2t
- TLSH T174B36C9DA1783089DE42A6B482B98793EFB4357A2B1177BF01E1C1748F537C0DB29DA4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 b8b2d5bb02fc5daa92d5f55bf99249b0ab7ca89d6131546310d66e6fb38062fe
- MD5 212d044c8efe140dc305ab980a3fcb66
- SHA1 d3f857d90ee1cfd6ee9ba45ba27f35a47770bbde
- SHA512 7dbdc6e7b65b12bc90dd080875ba202050857aa40109b6929b917126dfccc760128e385300ee37c805e43f93a25f612ba0cfaa2d51d0984aa4971d2c1e187806
- SSDEEP 49152:Lb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnj0Z9iv71XyEBXOf:Z3q6HjB+0Z9A7c2Of
- TLSH T159D59D03F2D900E9E069D178D7469133EAA2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 826KB
- SHA256 f9749eed9dd0d2b355c8f66f28928b7124f869534498e0edac18d6c0a7e36639
- MD5 61257ba32fef46f1f5ab97d3558c2419
- SHA1 c2b453361b91262031ce495af418076d4e9b535b
- SHA512 6ce7aa65fb3119f085c315a3b2ae68e83b1f107e9eec6979bcc2c656ddef562e0e6a2f6a38826b7c16a75ad67bf59edacd269cc412806faa4aca0a6728a91f4d
- SSDEEP 24576:kXYfDtczAS0BTZ9iScVD++jJXyE3c4XsQS7f:Dtcd0Z9iv71XyEBXOf
- TLSH T12005F12967E409FAED67823CCCA28501E7337C918760E7DB03A499651F336D85E3EB91
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 805KB
- SHA256 05b541f25467da87d8a554426e1e7636c154e02b68f1a2a6bfce70e26ee2bec3
- MD5 e80a948201c88f0e368e1dc95923672a
- SHA1 40867b1a0aeb60f298972b8da30faa5248049814
- SHA512 90a59409040ea5af0862a0c5840a3fd4ba9a7ab1d3feac10f2753a347e79e3f34d0ce4241f544dfab568df049d160a841ab0c423a254a927ba41446fefd5d6b9
- SSDEEP 24576:rwuoOWs0BTZ9iScVD++jJXyE3c4XsQS7f:rwDO10Z9iv71XyEBXOf
- TLSH T1A205F14A26A81CFAE9A7823CC5979532F7F27C522921C71F0360C65B6F37361AD2D760
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 e048afffcd232f740c0d35062f72662592f2c5e4736ba4b5ec1cbeae15bd9a4f
- MD5 9324fa9a23c648e722b1ac0ce405bf1d
- SHA1 1883d826835c87b8ec6e5da9034b93a527ed9147
- SHA512 9ef86a82b35febe6d998d180f9d39fc6e496907b0a1ce326f9f0dd777665def8649e9ed0a4ed9bdc492de671a76fed0db0cfd24631eeae4abfe48c09be78bc00
- SSDEEP 49152:KB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gli0Z9iv71XyEBXOf:Yu6JmVxd2di0Z9A7c2Of
- TLSH T15DD59D13F1DA01E8D05ED178974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\MBAMCore.dll
- Size 8.6MB
- SHA256 4072fea1c8284e71f9a4123ec9bbde7dc35f1d1b2a1745f9f33c728bfa8856a7
- MD5 5720547f2827db508703e1c6f8e34a9f
- SHA1 a0bc8ad241ec2452b1c5296cf2160910a2cfd18d
- SHA512 2937e417834609e8bceff2bbef1d54ab72cd60da5a436ee97d197449660fc7f79b454078a50482beecfbc94ab8798b2f8d3d6451b23ca090109d10a718a8616a
- SSDEEP 98304:QLz04sS0y3MzAQetQQi560FPazhJQDQEr:QLw4KyEAQetQQi56UPIQDQEr
- TLSH T1F6967D2BA7A4009BD87AD37889EB4502F673B815537393CF1698A2361F677D09E3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
- Size 10.6MB
- SHA256 f1814ac13924bf83d863388f733b5b5c9c309563ad678c0acd16f9c5611a7e07
- MD5 cefdd1d9f043577f3659e3f177eb75ad
- SHA1 d0b1931943b5c01c3a4db0b27df78947a5aabb8a
- SHA512 afa729a4e7881ec5260c28ea5e9064932302a09cdfaf17ea8c7cac7f2592c785e0ca5876c6e6704cac1f674d56e950d6a4afdc01840436d9638f85340ae971ed
- SSDEEP 196608:NMiKK/ItFEmkkUH+XIqt+q3lVtvNpgV9076XZCN3R9SK:NMin/GFEjVeXIqt+q31Q2xSK
- TLSH T175B69E17A6A800ECD4F7D138CA569B03D7B2B80543B197DF0694967A1F63BE19E3EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\MBAMWsc.exe
- Size 4.2MB
- SHA256 7878a9b10903b8c0def49015deefd48a3ea0e46c0f5ac9ae755336994e020152
- MD5 acbb82943fe0d5f1c5df74b1a7dccd2f
- SHA1 c41e38f59eff5e40a6a47b14be44520dcd6d405a
- SHA512 7092748502f06bf05df19bd2d4d5857f161a35a9b2e3a72645eaacffacae7a8dad10ab41ad3b80d3a63ff0773b6c818edf3769ce6b1f61b01cc92edfb755dfc5
- SSDEEP 49152:dK5b4+V1qsR86LMFRbbX8DREqUaP7bBfnuF0JRlnPkokPmsBLdS4BPQRzU/81fge:i86kyaHF0JRlMhBpMyok3M
- TLSH T1C6166B06B6A540ECD866C239A47A8503E7F2B811273097CF066853761FF7AD21EBE7D4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.json
- Size 621B
- SHA256 6a22f9bdd22d6dc3bbd5a840726fea86bd2660deae5963ca005c5a85f761299a
- MD5 56a413d91c0b7fc2f83ed851657960c1
- SHA1 8769748d205365aaaeccb23377d2cf96b04a1006
- SHA512 32bef136793b7db55fb5604b28da9b9c9df3962112f648e8499850eb03563faecd068c705419f9936f10c4d3ddc0697f0508b26a3d1a722eadb2d5234e0c4711
- TLSH T1E1F0D822A92E42B78970078846A4108BF724838D1200990FB7F4FA84EEB393896C3C80
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.json
- Size 784B
- SHA256 589cf7f5f5c0066e8d0ac0c8737388c3e35a31d40ac94aa700bd66f2eff4c7fd
- MD5 2eddf4bf8ee513887a6a746247cba9e2
- SHA1 79d41cd66edb68b4f1779d6a08515744da0a36d3
- SHA512 f383d3457117c5d9a887c8073ea2e90e30bd756dcfce577fac35da441510c9e1cd0373cb8a5dab08a5a3a823e0e753b2b37fe6a243634c0df8c916393cc830f2
- TLSH T1E9011007952EC2BBA5B0034458640086FBB4E34E2208450F77F8EAC4CDF7C3563D2D84
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\malwarebytes_assistant.runtimeconfig.json
- Size 372B
- SHA256 1eca0f0c70070aa83bb609e4b749b26dcb4409784326032726394722224a098a
- MD5 d94cf983fba9ab1bb8a6cb3ad4a48f50
- SHA1 04855d8b7a76b7ec74633043ef9986d4500ca63c
- SHA512 09a9667d4f4622817116c8bc27d3d481d5d160380a2e19b8944bdd1271a83f718415ce5e6d66e82e36819e575ec1b55f19c45213e0013b877b8d61e6feb9d998
- TLSH T1CEE02C7BCA10ACB315F52BBAC02AC282FE20232B00004D2A35FC180C2F3AAB30012F49
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\mbtun\mbtun.inf
- Size 1KB
- SHA256 4a350fc20834a579c5a58352b7a3aa02a454abbbd9eecd3cd6d2a14864a49cd8
- MD5 5d1917024b228efbeab3c696e663873e
- SHA1 cec5e88c2481d323ec366c18024d61a117f01b21
- SHA512 14b345f03284b8c1d97219e3dd1a3910c1e453f93f51753f417e643f50922e55c0e23aab1d437300e6c196c7017d7b7538de4850df74b3599e90f3941b40ab4a
- TLSH T1CB4140BD48D20AB83C673356671B69C27BDC220145C920ADB2DE8606C88EDDCB905EB9
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.cat
- Size 11KB
- SHA256 a96e70795bb1f68016ae0b18d77f88aaf146d5f642974d26112bc89bcd496414
- MD5 391f464cdffbe67843ab70b5b2c49828
- SHA1 8ba6328dbe89ac0e29d81681952acbbbc09a25b1
- SHA512 358ac1dba4fe0d2dfd11f2178e10be19e085ddc78fbbb5323d98551176ed8cfc581f1512aec5b2dc2fca9324301024ecb02819bb3152788d1cbe7eaeaaa267d4
- SSDEEP 192:zK5I5WyaYcJCWE4ByKVb1FWQF8zKNbAw3WIX7X01k9z3AD5Mjjpw:5GLREopFRDOifX7R9zU5Mq
- TLSH T1353219E6952C60C2EDA36C6003D8E59B7C7D27CB5D40557A32EBF6680C623C9E73446E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.inf
- Size 2KB
- SHA256 ff93773f55bf4a6a0242adf82276a8c95c0b244b9bc05e515c4e810c81a960e8
- MD5 d87c2f68057611e687bdb8cc6ebea5b8
- SHA1 27b1311d3b199e4c22772fa1b7ea556805775d37
- SHA512 4aa65b8911d8a2a0f9ef0ee6e934b94db0a9ad4c2ec543b5edcf21486be43f6ab1fda6617ea2cbb85eff230628c9fa8e7649da915d6de695803b28e55bef5819
- TLSH T16541DED8A1D386BA6687B2D07E0741C3F6403A0049F7342872DE50D6C3E7A0F83B4BA9
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.sys
- Size 240KB
- SHA256 0cd62ce0cf56289cb0aa1e5330683704dc8e34c08a15407c9fdbc1948f5e12a3
- MD5 8817e3a16320ab5b04d7e05183bcbb6d
- SHA1 135288165990761d7c73ddff24758597722e9233
- SHA512 9e7fce8c85f7748b82dec4d3f3a967bceeb83f83dfdfc19e5824b5be96d7820da3b124b11ab72e224e9f188f9926aad9577e62a5e55e50d05bf5c3c2b1410c60
- SSDEEP 6144:Cnua/aI/vsqYHFtEPWv2S9NeJLBX0WOD7:CjSI3sqQqPuzehO
- TLSH T1CD346C46A3E43966F9B7C17D89A29002E772754A2B31CECF5370C42A2F5B7D0B93534A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\farflt.cat
- Size 11KB
- SHA256 e0fe577a1cae51a9b8c32f7930d36eb93f31a2ef6bb66fa9318deea00a49883a
- MD5 ee2bccab1023f3160e2e43be169dd404
- SHA1 abe0e470ffe3da47560456b9808c1b0051fb363c
- SHA512 7a2c0e8dd8d7a01457f762f8e6c09b11ffe0196cb6547cd910389ab3b33514030abf3b6d881bfe7428875548b632d7cb702f3b183489cde2d95b227ceae7e8bd
- SSDEEP 192:T57/y/gaxW7/lyKFFWQFA6QhUHWX01k9z3AeFFeUm:OiZFROthjR9zRFFeUm
- TLSH T19E3229E68A6C40C2EEE7AC6043ECE5977C3C67C71D1089795297E7840DA33C9E72856E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\farflt.inf
- Size 2KB
- SHA256 c031327df2e0222fb1820e38786e4826a7fa06ad72b4d2a0e35d6a94c20e9044
- MD5 8155859a66fabfd034cb1f635ee84654
- SHA1 b371b79bba7a9d34fd71227bbd4847d0a6939111
- SHA512 863c4d36e07a972732f8c85351ab15ec40d1d389cb5a846417d4061a3b85841f14584b014fb7239eee7a26de7246f297be21abbcd4d9b307d7ad30e5f8c9511d
- TLSH T1E951FE98A3978570AE8B31546F077807B6163440E1F5354832ED84D9D389B2E9BF8BBF
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\farflt.sys
- Size 210KB
- SHA256 f055218d96108b5b2ebc6fcbadfb84cb6d4ad6f869abfb7fed48824094161764
- MD5 e6efc90777008b861590faf006634878
- SHA1 b74c4abcafec53889389387824e65027dbd04201
- SHA512 e9200f006ee8605955944c394a276beef0d6a21a64bec3cf7bdd37df0bd835b083c07abf9ec69075202ea8893087de35d95f5d87282ceeb595c853047a3b2c3f
- SSDEEP 6144:gGE9N8rMKAYPvoa9k//8DvIDQtXdsBDvnsR7:bHMw3oa9k//8kDQtmfsp
- TLSH T187248D66B2E40DF4F867C6B9C562C143D7B2780A1721E6CF027086661F777E0BA3A319
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.cat
- Size 10KB
- SHA256 0f8be2806219f2bef067be7f6e110053f44df28916ddd54c5c0aa28bb8535682
- MD5 dd95b4cc9a4687be088a77b01a190760
- SHA1 b0b7eddb525c7c7c8075461c0885196e38ee2896
- SHA512 8127043c0813bef8f5b80725d7c2e327f44d9c433de8e075e4a7776acfe73a31340d3bf2d2b8b872a6751daa71a82a54a04157dbdd9c587cac5a8da1a48f3f36
- SSDEEP 192:Dgog8g1BgwWykJCRi+byKmFWQFdxwKCU9NBJYh5wE3X01k9z3ASWgaTSaeM:iFgs0FRvxrCU9xDE3R9zRWf0M
- TLSH T1C7320AE2456C51C6ECA7A9B043D8F9A73C7D6BCB0C4094A922BBF7A40D937C5EB1442D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.inf
- Size 3KB
- SHA256 47b7c516bb57c612de19f0ca865590af95b6e32bf873a0fef9e011b2c5b483d4
- MD5 5a9717e1385703e8f06b27aa10a69e87
- SHA1 84ee67a9167b5eb6560711b9871de98898ad07a5
- SHA512 dd3c7278c2c11ad15a55fae6d19b96dadd92f85b7f0c8ce934298258af00bb5c052a84a98499b8867b0f43704fb307c67d03692ca69dda4d814c6c17dd73df44
- TLSH T1B95121A4AB93C570A68BB5526F033403F11538A0E0E97554B2DD81D9D389A4E26B4BBA
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.sys
- Size 230KB
- SHA256 44aed351c604e5289e3e03849106480e7080354696f700403560d242319d3b3f
- MD5 6bf92367d2660511f2fc9fdc5e4fe9bc
- SHA1 1ede849f254f55108443346453f9c094f616b45f
- SHA512 65ae83deeff3c198a884d4afbc214aadebfe54c30b59b7e637a7073c3f46d87f393020346288cf507dc419c3206b58a7789deab22b787501220719fd44addae7
- SSDEEP 3072:dfO8aerwPPn94gV2JdkOqBWLKlXpFFCmJDueuw6lMnRDJKjfF2bk7SitZxQleZis:OpHKkOqBWGDDuNwznRDJSwbk7SiTgjfQ
- TLSH T149347D5AD2D41DAAF9B7C2BA8E969542E77334091B21DACF0370842A1F677F0F53530A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\srvversion.dat
- Size 9B
- SHA256 9fc2703e411bfd8338906e962293e9e4d4aa52ecd400dfbc00cb4fb7bb33ce32
- MD5 630b2fb590b0b8cd971c0e89709d1fac
- SHA1 208e149805e3d942c18ab527944ff288c39d2762
- SHA512 affbd05ea29e5919f205a51e5f4f41f714a608d4d2fe87a4a4538d4ac70df051380e11174685d2cdcbcfc9ea31365a5ea91737499fd85cf5c8f7773584df426e
- MD5 SHA1 SHA512
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.5MB
- SHA256 373215e8090268617d7d072b963a32d8571f302aa9b704a5b47f3c833267140f
- MD5 7084099bcd2b4a90f96194b511a10795
- SHA1 f2cb714d39aa867fe6069c344da83bebc7ed0cc5
- SHA512 2ec5e70e2cd1aa2992e1a4ed220bf7b35fff77287c90f83a192f4dc1663ae763e9002f0f69bab051250e1db3430b3c462a58f17fee248d3da1b0959e4dbf6374
- SSDEEP 24576:7cP4mcvIjkGOxhKP2l71nNKbrh/8KB70BTZ9iScVD++jJXyE3c4XsQS7f:wP4m4IpOO67W8K90Z9iv71XyEBXOf
- TLSH T15565BE2DABDC0096D0BA917885658A4AFAB1742A1F3286CF1160933C7F77EE54F35F12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\7z.dll
- Size 1.6MB
- SHA256 bb01c6fbb29590d6d144a9038c2a7736d6925a6dbd31889538af033e03e4f5fa
- MD5 3430e2544637cebf8ba1f509ed5a27b1
- SHA1 7e5bd7af223436081601413fb501b8bd20b67a1e
- SHA512 91c4eb3d341a8b30594ee4c08a638c3fb7f3a05248b459bcf07ca9f4c2a185959313a68741bdcec1d76014009875fa7cbfa47217fb45d57df3b9b1c580bc889d
- SSDEEP 24576:29raURTF/5pe2g5RpBDxSjv9IrqLwRpFEDbt7y0MVoAAlziG3B:29hP/5petvSjWZR8DxO0mo5MG3B
- TLSH T175756D5BF67400A4D5D6C034C5276B1BEAB1B88B8330A6EF12D15E6B6F13BF19979320
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\7z.dll
- Size 1.6MB
- SHA256 623e628393bc4b8131c1f4302b195429dfa67e890d3325ceaa56940660052b1b
- MD5 4da585f081e096a43a574f4f4167947e
- SHA1 38c81c6deae0e6d35c64c060b26271413a176a49
- SHA512 0fe168bf1661691dbaa103e478dd7e46b476db094bf1938bf1ad12ddb8a8f371bf611ff504d2eb3ac319862444cc64a27ebee8735aa3752aa32a399b09427243
- SSDEEP 24576:a9raURTF/5pe2g5RpBDxSjv9IrqLwRpFEDbt7y0MVoAAlzi8pY:a9hP/5petvSjWZR8DxO0mo5M8pY
- TLSH T16F756D5BF67400A4D5D6C034C5276B1BEAB1B88B8330A7EF12D15A6B6F13BF19979320
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\AEControllerImpl.dll
- Size 4.9MB
- SHA256 0f90b29d240f6d34b0df3d79b2f6629edee855cc5fec7701377e4543327633d2
- MD5 0b20be2cb023cd481bcc295f72af1a3e
- SHA1 81a2098353f2a23380a779843c0e3ac63d0ad418
- SHA512 ffc4f591427afa4f9a6537ddce9ebf54ddb1f997820fb63a4f86dd716366618b83760ed1a7879e75f86f97ca2fefa1db3477337bc519203bdf36acb12b147963
- SSDEEP 49152:ntQcNVHvFJa0GV9Tkq9HWsMyhXTnXRUHNNWjwJZ1yWBEsUXH7PWnE8q12VPvUbAW:l0XTnMmPsUXbPWNPvcYLYN
- TLSH T15D368D16A7F401A8C8B6C23CCA578503D7B2BC154730DBDF16A4966A1FB3BE1563EB24
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\ActionsShim.dll
- Size 3.7MB
- SHA256 6c5047cb77ea843e8386ba2b26a8458e6255e2ab94d493e914620623723c6b32
- MD5 33617cde11d2bfcef47faf0d5ce3cef9
- SHA1 2439b5f0622cd539b6f6f2f87d78edba466299ed
- SHA512 ef909e5e6a695a0f2ae95621cf87795705b3d267ea7d1c82634faeff3a4e3b111f5f809cd9e7dbb71d588d6106e0b54c138364f99ba41c7c5d47cde9af1b753e
- SSDEEP 49152:SH0QptrM88LLHy9nqSk5n9BT1vAPZmbLMo7JTfYkwZdPHFszUlE3JqCx9R345GEm:ktro8k3booBovlE3JqCx9R345GEzul
- TLSH T16E068B17EB9540A8CC6AD23C855B8607D7B2BC25237097CF17B462AA1FB3BE1523E714
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\ArwControllerImpl.dll
- Size 5.5MB
- SHA256 ca1f915b6ebf65a1fbaf7b8f917424d9436aec03826830d8ef7867e01d2e9e03
- MD5 7eef30500d42605cbb86900ec94f851d
- SHA1 7ce762e54e014f2467971369cbeb44a11a4b5e1c
- SHA512 406738b664629e9092e0827dd6094a83ee46f70f397795fa56d684b2d3759971c689d9710bdfb29d5c551c611f50566dd47c3a795fe21b4779e97cbd3e3e59a3
- SSDEEP 49152:HjXqdt61P6e9RZe/nZTqOLCIJAq/trSw7BaPR4M0zJP3HNrtlBJ/QBPDY8150GhY:HTqdmPycqMwV7HlcDV5j0Xn5f+KH
- TLSH T16E468E1AB6E500A8D8B6C23CCA678513E7B2BC154731DBDF16A462691F73BE0473EB14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\ArwLib.dll
- Size 7.2MB
- SHA256 9a607b1ac95b121d6b672099459b19e5016c2dd1e8a4a24071bf9464c567c657
- MD5 4350e37d3de314211bb48b478256e465
- SHA1 3113c19b5b6c6b2b1fc862d04de9fddb47e2f7fb
- SHA512 6864b536afe6723a1c1e2b73e01d2e1f8f3186b6c768448d5498bae8edac4077ea445d7c66fa85e3fd8e3a6ea2f6151d75e939caee2385037e364aaad09c4845
- SSDEEP 98304:3dnJpHOsS9AkcfcanXdGzzP1t88ZhE8r0/x/NPacDy:zxOsSK5fcAGzb1t88TEB/xh/Dy
- TLSH T160769E1AA2D401B9D8F6D238C9678513E7B2BC151332D7CF06A0966A1F73BE15B3E724
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\Assistant.deps.json
- Size 28KB
- SHA256 d4be9e364bad18eeb3bbc0845627345a38d7a96857a7f49ac07c5179fe970077
- MD5 113996cf0c379f05cfebcb2243190d19
- SHA1 56fa57f57392e85e92fd06b11d5499ac2ffd0af5
- SHA512 a53b17e0d7c320c9a0fe3f890157acc41ce497694a605006ba1d327a4d85682ed2c7161818aea185ec2b615df7edfd87e3c92c9ae34044381119a4e9a786d9c7
- SSDEEP 384:+qgEU19zfR16BFvOql1kkThjIvoUDqO4jYyWgM94q:+qgXp1OvOql04V9q
- TLSH T163D2CC25DA946EB70176AF9164398182F335533F5004698E78FC248DCF7BE8BA1A2F35
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\Assistant.dll
- Size 156KB
- SHA256 b639443f349dd110b2252b07f2fa8db5a6b5689f91bbe13a9db76ddb94ec708d
- MD5 a9112afed857edc1e36ae3055cd5a05e
- SHA1 b28546cbdf9bcf7aebb636d250ef52a5d9d8c010
- SHA512 80e77fe22b30d48e0ef8f67fcaf1bc2c737c2337e2be74f9ce02533ddebc5f4620d263371ef83fed4c27f8a664a6f86b673097d044d865a1a970cd065714e705
- SSDEEP 1536:jgYExJUaZol8fgnm7RizbTb2TbPa9EwfIbHQnn:jSzval8KmsPbSbnTS
- TLSH T1EEF37D879754C072DFDA5A386DE0CBDA7B346E861CD34A56B314B5FC2A72FD21B04222
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\Assistant.exe
- Size 288KB
- SHA256 aa399241663b0d9e6636d20f7ac52ab74932904dffc50ab625a0b6a73eae70c1
- MD5 37ed1b35d111d5aae831a2372623696f
- SHA1 1a9fb5c48a30b14817b4fdf716a8c8b0d066baae
- SHA512 df47aa3b20f4c26d5ca09a0855b676a0e7fcc521ef2923c6f2e26e18995aa50d06c33b43a8397b5d23cbba872532ed38b11c3e94ec04547753a0db1dcf584c5a
- SSDEEP 3072:Vczkitvo4BpYN/6mBPry8TXROLdW5m4mURh9OOGO0ktaPODIVbSbwTZ:VA4NCmBPry/N2VOOLeOEZ
- TLSH T118544A47A2A801B8DDEBA2384D928B46F776385647F346CF135052BA1F72FD0AE79311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\BrowserSDKDLLShim.dll
- Size 3.7MB
- SHA256 f6d24605eb688e039e4509d184d974bb14c4c38528edad129d0653eadfea80f9
- MD5 889529ee7dadd23f11ed5b3fdd1f5b79
- SHA1 3e8a1bee4d28102aeb4c6f2eb94946282ffa7e12
- SHA512 bcd57045d516232828003b2b970b457138cebafbfbf2bf762199c291228b2cd674d8084190fee22f0adf047e8f2ac20644712313cfb5f90289a83fd6698995ec
- SSDEEP 49152:aHENZh/xwXNNnfFEXqGW3nILlpqCBS6+38Q/h0oYEaF6r+jep6Plw3zUoC02n:TOX/xPb/aomGIoIn
- TLSH T1E2067B17EB9500A8CC6AD23C856B8607D7B2BC25677097CF1AB462791FB3BE1123E714
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\CleanControllerImpl.dll
- Size 8.7MB
- SHA256 66052dfedb06314a53d8623c028ccfc8a73246e93af71ff1c05e94390e2b9160
- MD5 89788c90fb782852cc7020d8525c9b71
- SHA1 45ad621b72710101b997cdb94b104a3557514fb3
- SHA512 e19eba971b26ea8334b41e635342717f1ffd0cc7957cc9759a67181008c7be21b24e7391ad81b9add49a6a4a695df3626c6b78c3fe73786c93a76de3e0c5aa66
- SSDEEP 98304:VUQs3ELAIrAjFSUaI2usCrxLR2rEpHeY8xStnTS5ecnWDl:2SPrA5vaI2SdLR2rEledxStTiI
- TLSH T17F968E1A76E400E8E4F6D278CE678503EBB2B8550731D7DF0690966A1F73BE09A3DB11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\CloudControllerImpl.dll
- Size 6.9MB
- SHA256 71b6312c8f6bd8e62c7f766ed56dea99f9daca0963039128ba11e4b6842b0922
- MD5 8a15daa8a9ea233265e4dbf5cf2cd9bf
- SHA1 08cd446e2148825fb3b6bce135758b264107284a
- SHA512 6741c89bfb611dc1790116c7ab6ddad5726c68aa22a53921281f0f8ceac6fe02b044b58992941cd3fe997f65880513b853303f70fb4c3496bc71b782ef54ab9b
- SSDEEP 98304:mMoK/6tfchVTu/EKdD3fcXJv9tzjfalW9h/PR:voK/6ZchVyEKdDPc5v9tag9/
- TLSH T160769E6BA6E400A8D8B7D13CCA578503DBB2B81553319BDF06A4967A1F73BE0573EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\DryIoc.dll
- Size 597KB
- SHA256 07f5c78ad2c3bdaf6860e49f8fa2ba62533df2656aa2879585458bb2d0857502
- MD5 41bf0b9e78dde011688178bc978ea3db
- SHA1 8a5346aa619f750bf00c35f697ae4df7133fa75a
- SHA512 d74058977f1fe21e9e76c3803d6ffa298badd00df4c49c51ecfae9e10b3d40ba4b7b30b85e27bb9e59a84dd2b7ec9598e1194916187ec0ce3c934006c875dd42
- SSDEEP 12288:70pb1rj47g2z4v3MObszwrO8Zak08Zfnr6s0DssPS4mr:7qZL2uccZsxS4mr
- TLSH T1AAD48D0533EC461AC6FFE673393529165AF5E423B8ABE78F158894F818A6B115E403F3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\IdentityModel.OidcClient.dll
- Size 191KB
- SHA256 84edd7b103e4f3da43e93afced2bdd4ccb6b65ef7ad1915b81b5eb6315537131
- MD5 abbaf189cff8727f76efa1de1d9402f6
- SHA1 8de7734a33fdedc50dbd09f74b6db56a1f2edddd
- SHA512 19ede4a7b15b3a0065893ef01ef61cf6dcdce36f601ef1e55135a290041a674467aa48b48163798f6982a45a0a91a6a3478e3f34a3fb454e124bfdf8308a3296
- SSDEEP 3072:HhC2gb3a95WWWZWWWWWWWWWWWWWWWWWWWWWWWWfWWWWWWWWWfWWWWWWWWWWWWWWb:rDb+V8RLTKqgcQj72I7e6u
- TLSH T127148D15237C8B02C6CF6B74E6E096126EF6AE53BB41FEDC6D0DA8E4092238171453A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\IdentityModel.dll
- Size 215KB
- SHA256 922c1745564bd47001df14373c836c60072615bdfbad59e0895e981e4542a78d
- MD5 e21398ea890ba04eda06b80b2a3e2749
- SHA1 133d75bd4d4fa67edf816b03b71be734a5fbbbae
- SHA512 75dc3cf19a10a5d614e97845faa21dea2666034616481f027c7c8463e698f3cf02a449cee8de75539e65b78da1a220e403c6495bdd1753bc3a24a6988602d812
- SSDEEP 3072:y+/zZQVCKripa5GCYEAdWqr4NP/AXu36Q4BppOHYDTIbMDhEU8s8kWRiREwhXsbX:hWTr+oYEAspegcpkHYXVDhP6iVS
- TLSH T1F7244C1273F48616F6AB1B35E4B09130D9B6AE86B900EF9F4F496CEC0532B80F255767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\LicenseControllerImpl.dll
- Size 7.1MB
- SHA256 9d50b1da54a81cfccf1947a3448e4520b8165d1f8bbb970afca2ad87078235bf
- MD5 48706dd68f37a68d58d6c39deb20c9d0
- SHA1 2d0c00c6a1481336b729c04fdbdd829b64230a67
- SHA512 d910adedadc94eafa8625462b98fc5997fc3409cbb42cb2d60b9fbfe5e87a598ad56683f13b9571c677c8068f5689e389b3b13561199667c13de1e66e63e4f49
- SSDEEP 98304:bW8eFh4UhR+p1xg1algKcy/juhaztW54xhuM13FqW:qDFhJhR+XxealgKc8jqaztw4UM13FN
- TLSH T18F769E5AA6E400A8D8B6D23CCA678513D7B2B8054771DBDF06A4967E1F73BE0473EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\MBAMCrashHandler.exe
- Size 890KB
- SHA256 164932ea0ead0fc1d660b075913244fe7ca7322c725cdb0903ae4cf217b19a64
- MD5 498178f914ec446f77c3c03637ef8889
- SHA1 e865fb47b565b146b05d1bbaa8d79b1e37f71e34
- SHA512 a93d02495be1f921f062fadcd65ac5ffb7ef2254707160f34832452ffc7c06a34784b7435afee645f253de6802a5a19d9c3cd38d3b9bdcb309e8c1a335b26cbc
- SSDEEP 24576:m+JgyhxA4n0eEmZ7HF6ULsOmSxNVl2uCdRP8a2hi6:msgyhx30b87F6ULsOmSxNVl2uCdR0a2f
- TLSH T140157C1A777C00F9D0B7D179CA46AA07E6B2740B03B05BDB13A147963F276D49E3AB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\MBAMService.exe
- Size 10.9MB
- SHA256 8615c75b2e4e48cd7e1c0a44267969d5d14a0af9b265f9dc0ffa6c8ab77da3e9
- MD5 e450e799096fbd71935059336535b837
- SHA1 bfe6e07a3268e68adc8ce13446f4c57d4c03b622
- SHA512 3d743f36a84eb24e459ec12f48ed0f1e5eb975333504f5952a22cff96a6c506344838b8befabff6d8999d358e5777edf1d87d1b5aa66edfd2c72c1b50fb79f5e
- SSDEEP 98304:SazWPq96A8C/Le5M/tZCA8bUg1VVihiPxoNaQ:Saiq9N/Le5M/tZ/8bUYVVHxoNaQ
- TLSH T1A9C6F606A7F951D8F5BBD674A977662AEE32BC618B3083CF1150560B0F32ED48E39721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\MBAMShim.dll
- Size 4.3MB
- SHA256 116a8d0f27c2dfbfcea03f29e63fd3b993f468593dd794e64bf58f4873d1cd17
- MD5 5609e89ea563a232623a3d28ea606aca
- SHA1 ba3de06deb10fdcfbd59c7895ae94831846a0e63
- SHA512 987b7bd9b6c48b3dab30229f82b52e737aac710f1e70d489e7a470971b958203e1690e27cc892b0e86721b337a0e0859d955ff1ee1cfa7625d500f041ebe4000
- SSDEEP 49152:eVq942z3sCYJ6Ew38z4lvXQuFFXButqfCbLqmsc/6ZLFYiG8HoJaimPsQzUOuVC+:Uq94QPYJcH2SCbvy28HSTFCZ2Jgar
- TLSH T17C267D17ABE801A8D87AC23885A78603E7B3BC16077097CF1A64557A1FB3BD15A3F714
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\MBVpnTunnelService.exe
- Size 2.7MB
- SHA256 05d4d87f43646f7ca2e50520d8850e8808748a508c2761838d5fb92d66d6ce35
- MD5 e04e61828c9fffcee59cd90ef155c90f
- SHA1 7a97b65f11d2b3f30d8e2dde4c44bdf16f3d3b24
- SHA512 04792b998628cde88bc2601534678e55b2d6fde290496e5af08a2955a992ca3bb767bd025dca4373abc55141de8d270f62f628e51c887de54035bbee10379ce9
- SSDEEP 49152:honErk5go+mXYlAfm9iNPg9yBb9m84QcVIrn4PdPWU+wgE:POpmIcs4PUU+c
- TLSH T1BFD59E03A2EA41F9DDB7C23C8962D503E7B2B8051370ABDF06A4D5651FA36E15E3E724
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\MBVpnTunnel_mbtun.dll
- Size 4.2MB
- SHA256 ed2a9ae7540aee752bc3e676bc01bbe1d87a857b8348ed114724956fc431908a
- MD5 a2b3f1d39c4ba202f0bd07aaaf07aecb
- SHA1 b65a67197982ba71b9c892090dcadf1fc3048f00
- SHA512 4098a58e17c620e6864fb1d64661de6690568ec80cb384c911540affc8ae2beb481215a8a470ad36b27ff311040a6a07c7c163b84c65d5c21500034f34aac347
- SSDEEP 49152:VBPD6Io8w4LcTwEDRzTJoeM9YSxjQ5g+o9h6iO0oFjn2Q1Z0NwEIxb:/DG8VQkgRzSeMfn+ofU1d
- TLSH T181164B02F8B205B9F2BEF131C9A963217A31746503327B871F9195692A66FE47E3D313
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\MBVpnTunnel_wireguard.dll
- Size 2.9MB
- SHA256 ec1a86d8aac7c43f95b33cc4e1b27d1590bd5cadb46438bbee03990c95da653d
- MD5 39200261e2f946bb25d9ab510d78a509
- SHA1 995992a10043bace9f097ac1d23be83d2ee7b1e7
- SHA512 eceae57fc498df1070c292c590900c8ea3fdfcd5c68409700e638fb747a81033205aa79ba166e0dd066f93269e0aa4540259d66e5221046cec117240976f515b
- SSDEEP 49152:viZVz3arb/TUvO90dL3BmAFd4A64nsfJNraOc3jxJpr7ZEN7DS25+NkzZGALgFtn:vK30c3jxrw5HZId7WW
- TLSH T12ED53903B89584B4C5AAD230896B92977B317C890B3163D73B50BBF92F72BD45E78364
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\MWACControllerImpl.dll
- Size 7.5MB
- SHA256 de2dae4a12a73667b42dc5eaeb3789e03481d8797c0257e32eb86ed5e83c5e3c
- MD5 3736bb99f7d117c33f60d37dc3f7c91b
- SHA1 f5a60bec3b93322f1c9f1877e1d46440574176fb
- SHA512 1e0297efc86f791d99b7ecb71afb58c7511a9439940d9c147c917cd059894635ba9ab8e299159078fd6aaec3826f146a9c0e29c06a1b4cdaed240a89f0872ccc
- SSDEEP 196608:oG+QckqcOt+Uc1eNa+ZmQ/Y3UftzVxmGOtvW:OQccm+UcANa+hY3wLmGOtvW
- TLSH T1A6866C1AE7B940E4D8B6C238D9636613FA727C298730A7DF0664575A0F73BE0963E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\Malwarebytes.Interop.Activation.dll
- Size 36KB
- SHA256 f5a9e3587fcf855046d8b08e86ed61105f2f330a1c9021461446c137ed3b9ac5
- MD5 2db24fdb7584378e27e5a023ce1c4221
- SHA1 f4c59cc128a4c79b1a6b450a81f5c2f9ed7e6b9a
- SHA512 0e1fcd125a839f5a85ecd96e432ece37a62a13af579153b375fd6ec57b605689bcbb46e7f3d0a93e0e1235ddedf4965b0d9b2f4826d7d7eaada79a15a4efe7b5
- SSDEEP 768:SI9HlxK1JN2bwUUcXk6xf1mlrjE7W3b/bF+Y7N2Ip4O6xf1mlrjE71:l9HlS2bwUBfIfmADh7Q9HfIfm1
- TLSH T1A5036DDA9A349003EF97AF7163E4DA83FD39A7C36845C56718AAD18408CB3C4E35626D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\Malwarebytes.Protection.Interop.dll
- Size 2.5MB
- SHA256 79dd4b1f0df86422b83a694994db2dace5c2b14a3e7f224a46196a4f1232e1b4
- MD5 9fb63706dcf90128c22f7897036ad312
- SHA1 0505cfc12a75fc20c49a156bace98d2e201a3bf0
- SHA512 05baaff2b7376846420e75f86349dcc4d2135b218126bff92c983e7627f6abf0d34ad85a01f2cb6fad00893b600a771f31157d90446035925b538653cab236ef
- SSDEEP 49152:4QHNDsWCHSDZqQgHJmCOxQhgB27W+AhD+bbzi+IJRr64oNpgp:4QHNDRCHSDZqQgHJmCOxQhgB27W+AhDL
- TLSH T1BFC5722679A49F2ADEF041BABE578F384721EBD07286DF13041C2A450FD11FA7C4B9A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\Malwarebytes.UI.Controls.dll
- Size 32KB
- SHA256 4c3d97304af4e091ee4ed390f2c75deb04de900ab404bc41e529a0c5bbbd04c9
- MD5 1cab5dc89a3c6e8aa69ee3a709e92f84
- SHA1 a8781531ac1700ee363f91995ca5269c3ef4846e
- SHA512 1b03c710f2d4bc754d74e09838c26444f244585b1dca8d84c76dd1ab0cff4f08aa368eb4595042ece1a71c339b44aaeaa2397aa85f8ffde507124d25704e3ddc
- SSDEEP 768:RQgoN5YiRifT5ALY6mM6m0fXT2Ip40GTxf1ml6Z+7EtNgU:RQrT7Ri16mM6m0va9vfIL+P
- TLSH T1EEE26CD78AB84403EE57DE31F1E8DA97BD38B7D36C91C1DA2069C1910B463C1A3A926C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\Malwarebytes.UI.Style.dll
- Size 108KB
- SHA256 ba1e626a9b6a3d7c967d00ae31b7a758edb0ac23d8332939f044710d8e6288a9
- MD5 a3478b0ba3b8948726bb37e82ee224de
- SHA1 122dad2b5a9b8e689f73405cc4cd8f420944134f
- SHA512 8a44270495ba7a2cf136cd618efb48b45d4fb60a85927eb4d9761ff8822ea852e9b1a1eafd77a6f0b4ec382330b835ab38872b4a09250d930f5e0f95c7ed32e8
- SSDEEP 1536:xVuxwXvVh3gIrjyhryRlMAMZHcEzpr7Ri86mM6m0va9ufIk02:xVuxwXvVh3gIrj/HHMHcEVrtoU
- TLSH T138B307546A550CB0EB134EB6ADDBCE0C3D3145AA00E1C86521DF8CDF6EC9B8186A977F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\Malwarebytes.UI.Theme.Dark.dll
- Size 55KB
- SHA256 e0b84c137d3cef1dd43fc3572d359373b1614ab8aa0f5091f58120bfd3fc1c53
- MD5 ba57abe6bc54c2a30a83372a1e5712fa
- SHA1 5dc310260a243e4ca26d25c09f152b22727a12c2
- SHA512 d940e2ccd2ef2d84b84be43765d88738136268892206a4f65182cce1c72fc4b15009ad11ab76b24bcd575cc6c1c06c5f3d7e82d9163f862e4a981082e081509c
- SSDEEP 768:wIZlzpsplPN8n7RF1f5YiRiY5ALIN6mM6m0fXT2Ip4pTxf1ml9dHejL:f/1R7RikN6mM6m0va9bfIbHev
- TLSH T1BD43C755E5894827EF675830BCFE74826F3511B49403BE4FABAF627006D034F1AEE626
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\Malwarebytes.UI.Theme.Light.dll
- Size 55KB
- SHA256 d2d177294181c0bc81baef93502e603eb1fdcff51b074a1f068c38003f1c0502
- MD5 231f26bf96e205bf339693ad3d30f0c5
- SHA1 24bf339765d5477e147e0e3320f1acc1e261689a
- SHA512 18b59759d24e579376fe2f067ff23688ae36363334191c0639a3d8bae071d7662738129490042c6164a7286fa800b0591e91ee7302f811f6f9ef369fc30be33a
- SSDEEP 768:nEfnxB+jbhXrzV+5YiRisGy5ALR6mM6m0fXT2Ip4PPTxf1ml9dHWjL:3XnV07Rij6mM6m0va9P1fIbHWv
- TLSH T10743B496E5894827EF235831BCF974827F3511A48403BE4FABAF6770069134F1AEE625
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\Malwarebytes.UI.Theme.Primitives.dll
- Size 2.1MB
- SHA256 7a543d38cb51c1fae0e41297c50247f7558aae0e879f7d6762b2349193ad992f
- MD5 2d99f557950980a71f4fd6c03b6c148a
- SHA1 bdafdcda30a295aa2fcee118212dadf6129b550c
- SHA512 39617ee745fb102e2131f6494f9eccf065ef576f64fca4bde72b9f57f5b4aa526d76efea1d838529d5438f6f2bd329f256e3309960c88601de2d6a6cb9108308
- SSDEEP 24576:4R7Lmv3ser0IruI+dktHly2fuBLwf+ogKTAWrrBcUg0A7PEjRr8Diyr:qc+4H42GBLwf+oFTAWrrBcUg0EEf0
- TLSH T1DEA58D02F302A719CD827E387D7DD3BD5B71F8197E1A961B74C5AF2488CA4809C59BAC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\Malwarebytes.UI.TrayNotification.dll
- Size 49KB
- SHA256 bbe5081e5e170dfd8827b2bf3e07babe1bcac633230062a2cf9288adc451fc7f
- MD5 45d0b682140c01e7b7d996bb1508d1dc
- SHA1 29762b71cf97d5be59db904cfc60f9a3651f87b7
- SHA512 acf638c08f147e6766c51dc572ab9c66f99103389213249845321c0de04bad8fa1cbea541009be3db73cf6632a1a13d568c00d82bb5a9829fdd6ab30e9d15d95
- SSDEEP 768:br/KeTw3PytMTLBuOQ2grRdBfLB5YiRi+2ElF7YpVOJh2Ip4xVTxf1mlWZG8vzoM:bz45I92GRDv7Ri+7apq89pfIW44zorQ
- TLSH T1FD338DD6576C4113EFAF8E75E0D1F542AB38A7AB1842E3C629D9E0D50E473C0A3191BB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\Malwarebytes.deps.json
- Size 51KB
- SHA256 1bbd3f0c4e83b6bc09a3d585b6c394a01cce4c1e9a7ef3cf47ef93ef86883203
- MD5 f1559622edaa65d4420dfa23f924d19e
- SHA1 3018e15165d07c422a967be98929a2de495a70bf
- SHA512 f176890c72f380ec1cb82e5b30835b21dee2119a6abc38731ef4659bc9c2b4e4363839d36caeafe4fee1ee8faa794a33760825598212ac30ecd971dce284ab3c
- SSDEEP 384:+RskofCTCpf1rHsPzfR16BDvO0l/kkUFVMKRAgW6T5pMR2+fqO4jYyw7IMN4c:+qkofCMHsp1gvO0l48Rx4V/c
- TLSH T19633FE25D9985EB70176ABD1A4394582F235533FA004698F78FC248CCF77E8BA192F35
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\Malwarebytes.dll
- Size 10.1MB
- SHA256 a939b4cc6c6fb20fbcbb92daa916382cc2a72dc81e19d4d0d5913fdd2540bfa9
- MD5 4e3fb70e57822d2537f3c56cfd0cb239
- SHA1 599aa95405574ec95d1ad9f0c9f47f4d0b95b9eb
- SHA512 5028b98e5dfeecca2f14b6a59f5c232cbbf4d961895204c433dfd603ab37829bbd41083758d8000b8ce2b75ffdde0b31a8f6affbfcae037aff773abdab3e2934
- SSDEEP 98304:6cKE8cO0nfScO3fofuZTy7ETUN8RAasPdo8qh9dykOf3QkpQuNNK71Yt5dsM1EvQ:6BPcO0nFKbZrHAPaXOf3fpbn+jNFo
- TLSH T1CBB6E01266FC4A38C9E70BB1543613185A75358223E2973D538E2C3DFC95F528E29BAF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\Malwarebytes.exe
- Size 291KB
- SHA256 a98e7e53ec0e545d52df593ccc44b726fc6f12247782c0b88e434012d106419d
- MD5 901ee4c3e8f9125d2f2108bb74321004
- SHA1 55206348edbb72c5d963e84af8f10f3ec655f5e8
- SHA512 222dbae7a61833885f53fa8c8fb28b232e6f0b59a8059b61231a712a9fb510be0557a1758df88b1807c749c364affc0e973e8219d9c570fe312bfbabd8e1f9cd
- SSDEEP 3072:wczkitvo4BpYN/6mBPry8TXROLdW5m4mURh9OOG40klaPOgfj5wO2bSbGTN:wA4NCmBPry/N2VOOV2OijUN
- TLSH T1AE544A47A2A800B8DDE7A2384D928B46F776385647F346CF235096BA1F72FD0AE75311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\Malwarebytes.runtimeconfig.json
- Size 489B
- SHA256 28d737bcc7e791e223784d6210a13cf1a46474a49c8bebcf60c89f991eca09f5
- MD5 37a7f9705b5c11682169378537ab4112
- SHA1 93170abdfea469b48f4be9182f9470c1778becf3
- SHA512 c30125a04d93dd9ed36495c52e161b527cd07093563625a7260364c24660c7f3c8947bd98d95f890b47e6aca7fd79b20a354cb05feaa46669c038b3afa0ebea5
- TLSH T1FEF0557AD910ACB315F926B6C126C082FA34132700008C2631FD050C2F7EAB61122F46
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\Malwarebytes_Assistant.deps.json
- Size 28KB
- SHA256 ea2f83bb7c48df846fd2c8d7a78ca277f9ecf1390b5b952bb35faa96da67c478
- MD5 e8d1bae5499cedc575caaa0c41973111
- SHA1 1bd8b95250d42960fbe39a42eab3cb6927e55444
- SHA512 61bf43a394e1eefd3018878dfb652b5a5c066b50d5569ecf530cc7189cfe11f4cfad507e31134c4413cdc0c09e9bd38b5ab1176ad5c7f8a91f7ad63c4c89559c
- SSDEEP 384:+qgEU19zfR16BFvOql1kkT4jIvoUDqO4jYyWgM94q:+qgXp1OvOql/4V9q
- TLSH T114D2BB25DA946EB70176AF9164398182F335533F5004698E78FC248DCF7BE8BA1A2F35
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\Malwarebytes_Assistant.dll
- Size 160KB
- SHA256 8e723ab7f2d70bc707b84c6cbf4019373e145388bc64ea1d31e72dd744422e64
- MD5 450a540185185fdc19c62c48961141dd
- SHA1 241eb5ad3f32d5e6744df96f4b9c2a21235906e0
- SHA512 6b4c45b8d8bf27a3233b2d7c885ae7b07b991650d75d4a887958dd31f855e5855a94a4440fdc28e97b58f6d9ca2035363971efa6f4d78e0539c08067aab86172
- SSDEEP 1536:0UfuWLObBxZolcQAXD7RitfTb2TbPa9PfIbHFnf:OWyb3alcjDg7bSbjTV
- TLSH T1DBF36C879754C071DFDA49386DE0CBDA3A346E861CD34A5AA344B6FD2AB3FD11B04322
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\Malwarebytes_Assistant.exe
- Size 288KB
- SHA256 a3fd92dd4b7edaed8137d731d2bdd35af1d4d3bfe440cfcbf31e0181c68a7e6a
- MD5 3e59c99fde7cca2e271190215a8aced3
- SHA1 97d4b489a0e997317be53f409df347054d33ba05
- SHA512 0df521d03654761c882d3ec63f4443841f9007ea172be98f6679d01290e32f8b48a088e454484ce31f4b0100324ff8e6d5c8ebbc94b266cd5bfdf6b93b21bc10
- SSDEEP 3072:Xczkitvo4BpYN/6mBPry8TXROLdW5m4mURh9OOGB0kIaPOvOeBbSbnT7:XA4NCmBPry/N2VOOENOtE7
- TLSH T10E544A47A2A800B8DDEBA2388D918B46F776385647F346CF135096BA1E73FD0AE75311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\MbamBgNativeMsg.exe
- Size 4.3MB
- SHA256 ea97af9bdc388c8b2f43b070b39ff3c30a32bac2b9a5143596a18038f5b027d9
- MD5 6ca8f5974de6d64a8e7dd3da3216a421
- SHA1 e9f4cf2b8f4cd2ab8924d045ec1a0dcaee6eba1a
- SHA512 09006d7a36e459ddce42c4511b7729f4b273b65fa589e11a60a59804bb7af7995103a2f5f35ca4748eb094ce1fd9f40826c7b5a53e119120f493ba752cce5e7d
- SSDEEP 49152:R+kHxfTc3EQkUzJNflIWBE0ABTvWYrBS3zPyAFsh9pDpMA7zx0nhCPf9+zUse9ch:1rZUzLy1+3zPpFyuSGuRPQX8BjY5z
- TLSH T10D268D17A7A401E8C876C238C55A8603E7B2BC1657709BCF16A4567A1FB3AE54F3FB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\MbamUI.Core.deps.json
- Size 12KB
- SHA256 0a6aa712caee3bd6ec47d861d101d864313fd5879cfcfcf1219c4f64b2742ddd
- MD5 75c33455adf4b7816507c51c43f2a3fc
- SHA1 3704739642c6447e455f2552af89750dee9030aa
- SHA512 bc73c92f89a67696e55035abea92115284cf6adcc28ef6f9773cf12478691094056d9a93ca9c443f5391d305b9bf5458bb6a4d8e3b21f207d6021faf3a4b5dab
- SSDEEP 96:+FPYmuVnRSTNMSoBSTV/naymRYVP4spE4160bdJdypp0ipltGhjsFmyWHGpk6kfB:+FXJHR16qMpSFxUC0J5qObEjYySAn
- TLSH T15B42EB26E9C46EB70076AB9598358102F735433B6008684E79FC245CDFB6F9B92E2F35
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\MbamUI.Core.dll
- Size 160KB
- SHA256 ab185b1b0e4e6bfb908fd0e2d14261e58856e3026ab78eba90c7bfd51c1c145b
- MD5 dd8e6dd32ad273d67f908003aa612a68
- SHA1 7a451f5d3f225066c7bae5bf7bab99f934557c43
- SHA512 c7621618c1ceb2318212b38694625c672912a71108214e92c096a4d4b17520103f14c77ae66a39d2c4444583a56d51d946d9ef00837af0ce9b0e74f307b6288e
- SSDEEP 3072:dV+51ShqlYYkPLw91szq5nb7FhBAMRtFihH+V9bSbQo:dk51S8l3M89Eq5nb7FhWM78hHn
- TLSH T154F3291267F80109FBFF0F39B8B6A2088D76BE566C21C6AF5551408E1972B81CE75B37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\MbamUI.Data.dll
- Size 1.5MB
- SHA256 173540983a9e00062514642b2568228647c407b54c5703bd116be8e6457cb8ff
- MD5 974f2234999988389306fdd1a0b6ca5a
- SHA1 cd93f4262e6584900db3b7685a743ecbe930d3e7
- SHA512 baa35874fc46b276150a586eb9be2f76e544b592e06f2591017e0d9829b4ece776fd6e82189db32788f9331b6a5258f8a969f979e46e2b96d76e4389cce89e7a
- SSDEEP 12288:/gJwaCO5jEyx5sIf2MoUF3pq1/il7hln0oNcuIcZesGrhiFc2w25FoEUfOfKumIE:oJtE5QWIfvHk
- TLSH T196752F7161081A27C4EACD7B60242D385835F707EDC2FB5E60137CF846B4779668BEAA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\MbamUI.Services.deps.json
- Size 27KB
- SHA256 44b9575dd55d28a1467f5a0c2ae3b5ed6ccff514c0a5dc27aeea04aee1e59b83
- MD5 3a772597609766ae7e68951ee4fb8b9a
- SHA1 cfde57b8fc81c005d92c6c15a0bef6572d72f9e8
- SHA512 81270ab05d2d708758394379856352f1ed7a8f62d5a09a4540986892833da0fef13a7a5430626bd58fa3f1f23271d0dd32c894834aefc4cad81865fc7e222cd3
- SSDEEP 384:+tGgEU19zfR16BFvOql1kkTjIvoUDqO4jYyWgM94G:+MgXp1OvOqlm4V9G
- TLSH T194D2BC25DA946EB70176AF9164358182F335533F5004698E78FC248DCF7BE8BA1A2F35
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\MbamUI.Services.dll
- Size 3.4MB
- SHA256 440ddf274aa475aee0b0794f2582aa0aaad1693957c07d27473687d8ad8c2d1a
- MD5 5591915b6baea3382c63e8cd4f4d6545
- SHA1 98a126d6ce00c5bb7e98e44b85707325d134f62f
- SHA512 4f008e55e1e87f87df00ee280f92237066b1096a575c23223dddcff546ae5491c6e69118dbabef058f2a86d7154cdf84bfd6eb773aae6914a3c2bbac3aa50be4
- SSDEEP 24576:CWE9dYfcWlv+dLl4TvlKu1zSxqMTY3PNd0deWIvjpeTgfih:s9SrjTvSxBOXVWIbwMfih
- TLSH T178F55C203BEC211AF1EB137BAD308545AA76B9ED2AB0C31C0A75456E28E5744DF67373
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\MbamUI.Tray.deps.json
- Size 29KB
- SHA256 256f61cdb2cc148458746a52a63de9c2a8e2efe7f3c3c2ca0e3e0d848c1c9d57
- MD5 d6ee742b9a29482e1c64da52cb880985
- SHA1 597dfc55217070a61743f4c9ae40a19c25342231
- SHA512 b707ec624e45c8df13330f1c52cff0f7847d3f1e36d584519710337c3eaa05c5f6383f9fbdee562d512f7b4b8a34cda56582bf0b993d73922e94de721c3b94b9
- SSDEEP 384:+egEU19zfR16BFvOql1kkTgQIvoUDqO4jYyWgM94q:+egXp1OvOql+4V9q
- TLSH T1AFD2CC25DA946EB70176AF9264394182F335533F5004698E78FC248DCF7BE8BA1A2F35
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\MbamUI.Tray.dll
- Size 178KB
- SHA256 cd00591fa67d0140c7cf031053a31764603e435e48134346ad9bb20bc3c791be
- MD5 9e64f2f344d3915b40b219f943059054
- SHA1 d7373c99198cabb5c12f7f7a225f2e9bc7be7066
- SHA512 826e3aaa3718cf96d61a41f2d77104ee701ba04eb062a32b76f4270e7dedf1d4750cea6f710e80a47157db732cccc9fa58f22aa21d65dff75175985c523be6b0
- SSDEEP 3072:dE8EIQJmoQDF1G3AWb4B0BNsqj5MRqXzbSbeu:O8EBJmoQDF1GwWu8NXjLXW
- TLSH T1C604F3839BD88966F59E793B685745AD8B26FA531B33D22E34C48C7C0977F880F52207
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\MdXaml.dll
- Size 183KB
- SHA256 2b3c517c7b40c80b5af6d37ab52ce768acb6654d2b444a926073f44e4637f51f
- MD5 ee15d908bcb76f9069b09d6af826e0d4
- SHA1 f318534273d8bbed74bc6381dcee65d06a27eb80
- SHA512 f349673a92a4af7970dbff8f6d3682ff9b53246d077cc536648a83d09d57361c007f1072d7177f85dfb9213ef8dfbf9af3ffe47abaaddd622f126f9d8bb330fe
- SSDEEP 3072:SD4USlTao5BOL4XGMkkcNnesLaOlTK5ZzA6bSb6x8:WaTao5IL4XGMkfVLjtKQz
- TLSH T150041A0243D88A21F6AE1938E420F8A1DF37436B1235C6457BDD69AF1F7B3A10567B63
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\Microsoft.Data.Sqlite.dll
- Size 166KB
- SHA256 f103967a60922cd73af5773568359024b72e5251a7efce80f92d07866b44cd5e
- MD5 4f43c73c43c338f17015bbe077715b26
- SHA1 f72cb1acd16655dc1a20c20b5da981e3db321fe1
- SHA512 abcf1fa325e22bdae7cf18f047865b5fc12d2c73889e719a14c7545d617d7b3ab518f09ee0b399b84f6c8ec02df1d6b3a1b6c633ad06b3a6af8891ee2437e07d
- SSDEEP 3072:/ncUUa2pdJawZJ491IZfJunvOtyD9TIlFFWbjvIS4dmspbZy7iqKyg7CgRV:T3wZJ4GnUZTIlFFWbjvIS4dmspbZy7Nn
- TLSH T13AF34A6D4A981113DEFEDE3564B46C8207389516DAE2E34BAC80E4BC3D233587F446AF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\Microsoft.EntityFrameworkCore.Abstractions.dll
- Size 33KB
- SHA256 a777e065bcd584c87ab03720a3632065f28d634a5faeae4a72e888843a98dda9
- MD5 2fe4ef84e5d0ed10435dfdd3d785e99c
- SHA1 82b7ef4c239dc3102195afd4b5a36ef6edde2feb
- SHA512 9179e2f07284d9826ee5eda58e6ff5680e24e876981b89e551130c57d81b116513f3ebf036ef5163f017a5f484a736b2c61692aa915023526b261feeadfa8713
- SSDEEP 768:FbOu2/CERb/ksbp5gtMLu9+HFbWKharGCxNaix9zMv:9OH/CId5WMQ+BWGMRjzY
- TLSH T1B9F25B92B3DC5323CEFF1B71A570E4422836F7CA7421CB6E4954A14A1C63B849A71B6B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\Microsoft.EntityFrameworkCore.Relational.dll
- Size 1.8MB
- SHA256 f84e9bb2a4e56e421c7e8ff872efd59e726310cbe62895f5d1bf55aaa597fced
- MD5 c5eb0cf9b942309060b1d0d0048bf0f5
- SHA1 f8cfee8d1e793a51664e857cc18b2e4782fd85b6
- SHA512 730f871fc3da7c94a82fb73dc306146d643d439413153353464afd44384ef14a8bc7bde64f50a9e6eba59582e9602b91c95e4410a1a1fa3e81c4e4abef921945
- SSDEEP 24576:lZApb4S9aL6hKgWndvtHbMMupTZ7Jbx8CoWcyQCzl+ASw1YLRNRgZ:lMaTRJp7g
- TLSH T1D8855DC5B3B86F21C59F033A6071841862F7DD1AA352F75B2509BEBA2C5B3460D4B39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\Microsoft.EntityFrameworkCore.Sqlite.dll
- Size 199KB
- SHA256 ae5b7c95ead6afec11d44b51ac9ea67d2616726d0dd5870b214c1e53ba96976c
- MD5 c888d4269539ecf2576c8cfa4e76b3bb
- SHA1 003610ec631c0d94cea0bbc668692bb3b3dac4cf
- SHA512 625e2cfe9b96501565eeb7534ab0651efcea54fe459fd869eca4ea7dbd9cc39bb7600596208f1e224659b9219bb4bf7665c027c25a77e74bf1a051194be34624
- SSDEEP 3072:XMxLsQupX72oMwMqzIFuj+47RGt+l+akHHMIqe:XMx9XgsF2EwWM
- TLSH T1BD146C5D23AC5326C6BF9735F0A864404735FA0BE5D6EB9D4C8C64ED2C62B817A083B7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\Microsoft.EntityFrameworkCore.dll
- Size 2.0MB
- SHA256 5f9599e42e226c8e48ea2c49322f02f9953314efa7c15467c6038312ab729609
- MD5 43b3404ed58839c0f19b37e8fef58785
- SHA1 36a3e112ada41f1a250d2e9dbcb123530f6454fe
- SHA512 a59cf3f31e162fc7cd74339165c3dd7c32e97dbaaf20f6da09bce00bdfa6f3e7ed8bd66cb69c7292c43428320ecf4409da2c5e27edb4f0a663fe7945459f42c2
- SSDEEP 24576:cvjpLewns1NE+XvjZXPsNHD39iUhz9pFIRH5qn8+JfBG771DyDsn:cvMqs1i+XaOiuV5O8+JfB1gn
- TLSH T1FFA56BC173DC4A67C0BF637AA834451473F6DD4A6332D7AA25259EBDACEB3801C81762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\Microsoft.Extensions.Caching.Abstractions.dll
- Size 31KB
- SHA256 c004f78d9f8378c5f79ac3a88e90625a117b9700a75f5f02266289dd4d28e451
- MD5 89f216cf8eacb39551ac5df4df726d7f
- SHA1 cbb5349b9ef110d51ab28cf6e9ea8acca6c16e2a
- SHA512 2b4517149995a75d188eb195f3c53331ce4119e6d516ed385fcfcc1e62676997c97ba66b13c3484f4bcab8509d566f17d3b58f5b146911644811a81c1ae36d17
- SSDEEP 768:X2z8YAqmMe33Qy6uOje1T45wKIG/N0Syo7ieSuo0lEQP9zMKY:X2z8YAhHNROjeMwK/N5T7iio0jzMn
- TLSH T114E26D514BB8435FCEBF2A75AAA5C1850D7ED3C93403E72B198DE18D1C8B388953273A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\Microsoft.Extensions.Caching.Memory.dll
- Size 42KB
- SHA256 9ef11f0b594d5be76341ca65a53bf3930aa807c312a278ae22043dcf4db9ce25
- MD5 f60f3d61ea68254b8a5ee1f50e95f56f
- SHA1 0cfa3f1be8f6b8f9a9439dcba0bbed12db4d58c0
- SHA512 d14792db1abb631c9f1532eb1575ce63786e888bdcc4625f38a4e841a9315e95659d4634dba592a37b4dd5441f1fe58f27df91a45a6fbaf7ee09db69ddad7429
- SSDEEP 768:M/Lun0cK7s4dFnRmoFSTzje6EEYcu2Epuo0NHkOQ69z7:M/L4bKs4dFnRHAjyERu2Do0Dz7
- TLSH T149134B00A77C4327DEFE1A7696D4F4011F7AA34BA511EB284D8DF0DA1D637C08A2663B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\Microsoft.Extensions.Configuration.Abstractions.dll
- Size 28KB
- SHA256 893f042b8bea61e3e56091ee6167af61bc38a39d35cb1d0f9b222aae4493146a
- MD5 5edcf3dccef856711d35e0afdbdf6d0c
- SHA1 fefe0a4870d36814a45f8e9c63530f1963cd6c0c
- SHA512 de9b23363d5fa78b45c96295713e392d24fa8b0d5a78cf6d2a2a8d04a071fed4f52f4b3559e36c829cdbfcb318c2a81b0df3cc3d46eea766c88afe5f16de5718
- SSDEEP 384:R+q+2Vv/+usFlLVyKo/9ETG/DwzzRjz69M1ZVMdWs6NWsY/WyRIHRN7eUBGQtR9h:R+EF/CvyKohrqnYuo0eUwQP9zV
- TLSH T114D24B9653EC4333CDEA0F71E5E5C8416E37D7993816DA1E688EB10919677C08B32B3A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\Microsoft.Extensions.DependencyInjection.Abstractions.dll
- Size 61KB
- SHA256 ac9cd953b7eeb03cf48e343c5ace6fc9b48ac968b68d1cb30ad1d6111178bf4d
- MD5 ac0b86ec11007640a167e400e26dcb0d
- SHA1 7246c0ce755c5e1bf393c47653014f2de38d6f2a
- SHA512 5b8e1e5e3b87289258e6edb61002946588aa30742dac8a9cf584929add2b92d5214cb03b0b3588c522669588341af825e21d63aaaad079654e955b9a9a5e5332
- SSDEEP 768:PJLDm/TQCX88WhVdUzS9erYaaRwoX0vGSS2QyF5W+TDuO9z2/:PJvD/8GizS9fwk0OSpQG5WWzo
- TLSH T1C4533A5037F84323C7EE5A70357790105F346B9B2602975B7B5AC0AD0E82BC69663FB6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\Microsoft.Extensions.DependencyInjection.dll
- Size 92KB
- SHA256 df0ae00b1599acae93d9f4df2bcc6d0ba109221ccc44d2d1486183f84a5fec78
- MD5 f20774246d4164768bcd577b09935fc4
- SHA1 c86f187eba3e45bf1d9c651bd96c09da8ff0bd82
- SHA512 65e330acf42057556c75e303e03b7840ba76112f98d5eaae752a51d2b80671f52a6ed8aed232a57a245f4aaa061b0a7aefd0833faf0a393a309740bd5a8751f9
- SSDEEP 1536:7+6ADQtk0uDceWOYLaAwe8hos5hI6eKdWZzE:7+ck0uJ5Awe8iKdqI
- TLSH T1D5938D7937FC8B33DAAF1A74A47581148FB9B54A3003D76D1EC8A0691A97FC407632B6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\Microsoft.Extensions.DependencyModel.dll
- Size 79KB
- SHA256 8913b56a0f6e209ebaadaba532865b1ea8d10d73fec86a1b8f93fe0ed8e0d2b8
- MD5 846a52de605558912993eda079b6a7d7
- SHA1 f5944f793eef7cda670f572f909b941259a6c56f
- SHA512 3096ed6a09acc77110ae290d9b92365a0b7c561a9c56fb1b3d6c092f3cb615a3efddf16fb6618ca64279631bb3c3347d230df08cd84a53dab1f659cd761ea649
- SSDEEP 1536:lJRwgfJbzkoKyMv95Wm5LMo7lRowMfYM9gcLzQtqfSnXzQD:lJn/BwlLtgwMfV9gOQt1XI
- TLSH T176836C1067EC9705C6FE1ABAB4B4A05907B7FB4AA023EF0DAD8E649D08537D04721B77
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\Microsoft.Extensions.Logging.Abstractions.dll
- Size 64KB
- SHA256 ab36e8201d41dd751cbb712704dbe8492bdd0ab1bff6fb35371cf59bcd982181
- MD5 40e5e8a38a71904dc4aca06a6a5acef8
- SHA1 14906117890baa2115fc0b88ceefd1afa30ba9a6
- SHA512 c12c6c047a2328fe0988914fb0567b83e24b495a6dc1c120f33109660688ed6308ca80b50dc2df2d56d2461da201bc931415dffae297c58ecdb5e9b764c250b1
- SSDEEP 768:9jcfWwJ81h+lacQ04G5TVNo09TZluLIWUyPCfgTTqRwMBYmWJbbWl29zL:sWeShXcQ04509TD0kfgVMBKJbbWlCzL
- TLSH T17F537C09A7E85333CBBE9D75F5A0D4031B3AC2326406E7572BDCE42C6A677C80A517B6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\Microsoft.Extensions.Logging.dll
- Size 51KB
- SHA256 37b87b16ac688d5619168554a22cca2677e1115f21c2d5ebe2f39c024fee2b7f
- MD5 ace199e2d716272f48c5aa22c8145dbd
- SHA1 6662aaa3a59e4063e041332e512ee2dcbdb63fdb
- SHA512 cb88bd6e127c0a5206329a578828836473faace6323d40fbc5ec3560849487fc901fefc5360ac2c5488f9bb97302355656b15f0004cc6af0eb64c202f6b29466
- SSDEEP 768:rNmM2XqAXJ8wkjEUpwh5kMTBOqxQ49A2qSmZ7vrG5w0zUc70FClYtio9zB:rNmMIlvUpA5x5wZm5wZc7AiYMgz
- TLSH T1DF336B1093AC0363FBAF0E75F4B4D5564F3DC7562022EB2A6ECCB056097378246627AB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\Microsoft.Extensions.Options.dll
- Size 64KB
- SHA256 fbb309a36bc91d90ec2984397bff4f75f35ac92909e0acd952c5264c5ac0a753
- MD5 e8a13a736c548bbaceb6e11349f26b46
- SHA1 4a38c8a0f51dd0fdffc5c21b159b39ac370d7b19
- SHA512 381e10f02436fda3ca67f8278b250d6a208d27abb45d077aa0b965bb519e0d3c02e62c8a097f2d79dba1ac9fdf117ad8cb5d53d3d3bfd1f878a46a58135f41da
- SSDEEP 1536:7t9ZUKZNOKGCmG/ddrkdGYflFE4CDsiqz9:/aKZNOKGChkdx8WJ
- TLSH T1DB535B56A3980723EAFF4975B868D0A60B34D3463D07FB2B56CCF1541C3B7858EA2639
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\Microsoft.Extensions.Primitives.dll
- Size 44KB
- SHA256 f9f47907a041067d9bc1b9a9f516009b6ca0a9c6325ce83527883cc0d053dfa5
- MD5 bb3af05bc071ceba027d1dc5fa255ec4
- SHA1 0a3d4c073d1e6fbe1b23f7e5ca7255ec311eca7b
- SHA512 4c0790d5891d9a200c4727b1dd6d2df21ea934bc7030edec71a2aaf9fd7390d4084ff2f7b02b17e252e90a3c1cc380db3da71d63f4b32b7c7fce70c041d4213f
- SSDEEP 768:MfyqqV7sGPyVh5Uh8849VHOP7JIPWKP3jvETuiBz+rpBhv9z1cD:cyV7R6VhCh886tOP7gR3jcTuiZ+Bh1zO
- TLSH T15E136B45B3AC0733CFEE0B70A8AAD5410A3DC3A57512EB6F4988E5642D533D58B713AB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\Microsoft.Xaml.Behaviors.dll
- Size 142KB
- SHA256 0493049febb4be74bdf669ad7fa754941c2754fe33421e230a8f14c8fd06c8c4
- MD5 a10c6f9556dfccca0db08b9ef2e86c4b
- SHA1 e34dedf472f32ac21306e5673d34dd2ec0deac15
- SHA512 8128bc268c5a62cec0eaf3bcb22b93e017f2a1d60808476a1c437ebdb6494ebfe898ac24dfbd620b525ed9b26bf81a8b7ebcfea26dabbeaf18fbf5538aa160e1
- SSDEEP 3072:+XQg6pDJRt4v4VMvlat1dLXTrGmAJ5ryjTT:YQD1JRtigRGG
- TLSH T198E34B6053FC8A5ED7FF1634E0B061158671EB9BB933DB0D5E84D2AE04A338266127B7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\MwacLib.dll
- Size 6.4MB
- SHA256 a61d5bc48277514b50c53b59d6b9fd759461be710a9d94a0bcbdd4c97f4dc376
- MD5 5d388ffcfb618962226028f5a03c3fc9
- SHA1 47d267cc940113412d6a04c5eb96c3518d0e7d13
- SHA512 d51b3dc151cd44e450ac24cb4ab2a193f3bae72ecc1b09cce49a109c10a38572f355b591c0a44cf3430cc2c6d0ec43ce3b8c3880e53722307ead89729556b33a
- SSDEEP 49152:gOTlN/ta8LjumXzlif3pviKBSVOSlBpQaFY9kqtu/JWH9vJFFocfcf7h62u1rgPb:ImXc1kykqzHDoKQ6jBqomdL
- TLSH T1B7669D16B6E500E9D8B6E238CA678213EBB2B855573197CF06B0573A1F73BE0563E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\PoliciesControllerImpl.dll
- Size 6.1MB
- SHA256 cd1e8f98551fb69d3d47837c09fea35be358dd7c27104afb7f1938a7fadbb2c5
- MD5 436a5828103f6874dda5ca0b32e8e8ec
- SHA1 7a5346221f40349881a65df91014114b1644c8f8
- SHA512 a4ce868855d83ad112b528a4969e5a5f79a115eb92f9e3ef1f05eb09f7f39c099abb162bbf2024b298af715560d81d9f08c2457109d7b2b33c04dff9789dbd05
- SSDEEP 98304:at69nEVAZKwY4Lka7NrGWeG0qwtEQ9VsAwbB:aAnEVmKv4Lka7NrGWJ0qwtP749
- TLSH T1C8569D1BA6E800A8D8B6D13CCA978513E7B2BC15177197CF06A4967A1F73BE05B3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\Prism.Container.Extensions.dll
- Size 20KB
- SHA256 85a55b97f20431fcf6d33634de6a86d7c6d441be413c728e19dda8b0aef72e92
- MD5 7c761ce50753f23707b12774d6191482
- SHA1 2a6367003777f077c2b0969e0454bc4de7b0757a
- SHA512 cc0dc04d17316a816553bac6092f124310c3fcb3c131ee9421bc6581710493233e7004d07bc097a9caa818d3b0c1320135d6562794d9520c207fbe6dd2f4f559
- SSDEEP 384:h8z2AKJxYjp8LXg0uHPF+jCZSZmZPSUPo2/VlhC9:h8z2AoYN3vF+jqSUPoAlhC9
- TLSH T1D5922B528BA44373EDBB8F35BDF592105A30FF41AC60CE6A069CD0C9CEE2B5445B463A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\Prism.DryIoc.Wpf.dll
- Size 26KB
- SHA256 ad1666c83f2554b09396386fcec856f9b3068b9bc2a29f13c08d3ce0c23d7d4f
- MD5 bd3f6009fc2b6a04bb3401c0158a2868
- SHA1 62aeb021c1fd18dd4bee4e3c6947571738582819
- SHA512 83e4ed6ff4351056c2003d776cb15916f280f1cd3aa4c6ae6e4cf982c0b69e21c1ad3c08d0ee4b3fbf7861f9b231f5ddb8735a037ee7beb76c1ac485fe49450d
- SSDEEP 384:j6Xd47wSthuCfI0xlid20I3W7xrgfScZSZmZPtU91C/SyIpMehV:8d4sAuCfDxd16ZQSYtG1npKehV
- TLSH T1D5C24B51CFE01536DEBB4F7E78F051015E70F746BC52C6AF819880A41EA3BA11A9077E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\Prism.Wpf.dll
- Size 132KB
- SHA256 c3b44b118486a5d74d696c14853e5306ec893dadd0be8ea6f404edae8c66f2d3
- MD5 7a103c5bde44976ad0627443af2e1a4b
- SHA1 55e4bb694cca644846bd4a39782d76d9b4996480
- SHA512 8ca0142f855f776cd610c5e9e6ed46bae8d980deff2a8916c8fb4356d516d1f0d9b8c0114f456740402f1de1ea55c5eb4f797bb04f00196c7a647fe212e50836
- SSDEEP 3072:ifxD31bs6W5SVEcJ8+s8ggRwfEQwwzOfzH3mgQ:ift31RVVRs8g5wwzOfz0
- TLSH T1CDD35B2923FC876BDBFF4A39F57440018FB2FE472062E75A5944E4AC285374196923BB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\Prism.dll
- Size 89KB
- SHA256 92090c9c3c5195149885be91aa469b85d2cba9a215cb3bfb65e93945f33d852b
- MD5 0877a419afc7306cfa2d301e314f0548
- SHA1 ba76afb78636546c5dd73162bba7a98ae3b34724
- SHA512 5e3ac30005f4fdee8f85d2a632415bef7a9722add4cfc59745da9a41e87cf79e5c62a0c2fb52b79381495be94f7b7d0ec3a455f0f112e7b0bdaf63d6b46c6bd1
- SSDEEP 1536:eH8fhOdBanbA/0soPhaECCcCxGVSCC+5rgnCnS+6j+DZORL0SSeVEEkqYyg1H:G8Z8MbwaCCcCxGVSCCFCnS+94LNSCYR
- TLSH T116935C1063EC4B23DAFF5F78B97410450BB6FA436522EB5E594CA1A80C63BD049A53FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\QRCoder.dll
- Size 169KB
- SHA256 4cca9817dc66b99653653f570a5d22e31fbd4b8d3f8c526c9e3b2594d9116620
- MD5 6b70d85bb131ff9fe2cf12fa6bdb185f
- SHA1 a7c529f65ba8b56e64c5d665962c3e7aec41d65e
- SHA512 37a825949d2c37234034109c0a0191133d324d495deef28357657a42da606a2f03e087cbeec472c2615cc0ca5958cf2054a25b90ab7e56f83f262f6308d933a9
- SSDEEP 3072:wxyL28tgLwBdPsbo7jG4T3YrA7hfjF0xQfOWIkHY+2ot5RbSbPmE:wutUEj+A7hbIkHR
- TLSH T160048C6567EC8A07E7BF3F30E8B040915B36B5577972DB5E0CCCA09D06A27C09A50BA7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\RTPControllerImpl.dll
- Size 6.4MB
- SHA256 129c0263a93d2faab793f0dd3cfe592ddd8c92b43ab29679f9bf6d07e6839a1f
- MD5 092d6d9c88cd777c11903b44e5773c1d
- SHA1 6748fb5a3a4f8a299b53a718dcd040a147ebe148
- SHA512 29a80d963a253d5e45dc98f813481354187032c229093a62295996aa31a7d567f3fe170a5f9ebb65b5e7fcaf295d1d69cb90f2e502a2a81a67171f6fd308bcec
- SSDEEP 49152:iVtVyp8mk6k4PtU4mSniwiqAevYVeMITie+ml8GVBq5qRvTTAZneBkPOUKNHPPtF:i0pFte+l8Tw2mjHHtrnGX/Vb841jsl
- TLSH T1B4668C1A76E400A8D4B6D2788A678513EBB3BC154731D7DF06A0966E1F73BE0973EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\SPControllerImpl.dll
- Size 4.5MB
- SHA256 fe1dc49340095d3b8c30a1be99d9c95f06565f456d90771942db725b7d078f2e
- MD5 81be99c6cb25e22c643048753acc2952
- SHA1 851d246115a9d5c52390be7233f9eb84576ce504
- SHA512 90ad208f9bc8d684ec0060338062a5e28ef20a6914837a73eff554754377fb9e3827a5981ccfc62aec35f15a87c1fbb8e863b4aefaad1471e441e0d25ff0d098
- SSDEEP 49152:L7cVpTaL2jUwJjkwHrXv5Ims7cOo9k5kh3ml4OaBC1u0d5J1Y3VpMXJzg6VqJTCv:wUwJjFy7cVnZ1m5E3f6VOmBYznA3
- TLSH T100268D17AAE801ACD876D23889AB8603D7B2BC510770DBCF0674567A1FB3BE1563E714
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\SQLitePCLRaw.batteries_v2.dll
- Size 32KB
- SHA256 ed1475cd55b4b28768efedffe41c84708f005dc3d15784504cf357d29bbe8981
- MD5 d99704296cbf72040924c8dafaf95fb6
- SHA1 210337784b79c47f4978cbb85930078a0ed219fb
- SHA512 46479362c5d776551398a62aa392f306187cf464ffaca8de7d6514a73ec425240ec0817432a7d2cdcd122147bec1babd5f6e5db5f4aaff42edb24624b86bea87
- SSDEEP 768:Vs5YiRiPu55ALqiT0Y2T0Y/XT2Ip4sTxf1ml6Z+7EHNg:VW7RimaTb2TbPa9AfIL4
- TLSH T188E26CD74A684407EE17DE71F5E4DAA3BD38A7D3AC80C197205AD2910B423C2A78E37D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\SQLitePCLRaw.core.dll
- Size 77KB
- SHA256 c84ea9a36dba4c8001adbcc7152526411a258c5b9436a116eef3701de7e140dd
- MD5 162f7184e7abfdae1df9594d987ab964
- SHA1 a7e8d80a3db0d216004d4f05a3c0dea218225ce0
- SHA512 d32dba15c4710e3048d677048916aee84216ec5c617d1527de2f87e96003fc124955dc4a2dc21f4b6dff7a11fa7babf487bf33771d33fe8b99dedc7de13e6486
- SSDEEP 1536:fLTtyXEQ3+bO6U+RlrPi1NLsFl7RiHTb2TbPa98fILVi:zRtHliMlWbSb64
- TLSH T1BC733AB64BA4891BEACF9134B03E4092BA74D256B767C713A584E0F05E733C747912BE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\SQLitePCLRaw.provider.e_sqlcipher.dll
- Size 63KB
- SHA256 3041e695aae69c5a8b4372c1e48719b29f235c0dc6dad0e9db78ed9ef631b4c1
- MD5 81720f2f07af7c792c9210b48ee6cc3c
- SHA1 31a312df616f9c42bd96bfcf103d6a5eb07eddc6
- SHA512 93367e49b68721e1e7103d47f129c719945d6b49c6627bacb4ec9f48c5cca67e5d2e000ee2e895a31541582ada5056746f83630c10347da9ad0f3a6b1cad8fe5
- SSDEEP 1536:ulg6P8yGn6Pe/x9JBZTZaw7RiRTb2TbPa9jfIbH2nj:ctG62dBaw+bSb3TO
- TLSH T17B534AE6834F0915F79D0A32B8B76E45D1B8E392FFB25353994BC3385DA33854A842B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\SQLitePCLRaw.provider.e_sqlite3.dll
- Size 62KB
- SHA256 f19a2bdc8b4a635fe1eafd92054468f8a7858969f164d114dcffb783dbe0d2e7
- MD5 88c62a60e85a162e456f3d94da783074
- SHA1 c44f7848877fa323174dd5949ed7a9eb077f2ee7
- SHA512 7e4716e8ebd77f22fa60c28fa83c9e9c26d3387e843ce00e5d0b932f133f672737e6e854ffe2b6d6bcbd835fc03bcf6a02a2ae3504fd6916ddd6357e01e1930c
- SSDEEP 1536:4+FQ3E9uoFc2npPI/3ehBJTZE87RijTb2TbPa9rrfILjq5:15pQkBzE8UbSbmsO
- TLSH T12C533AE6834F0515F69D0A32BC776E56D578F382FF724313A556C3389EA27824B842B8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\ScanControllerImpl.dll
- Size 6.9MB
- SHA256 f41c5a9754861fd06b05470a267fa9d6f801a0dce1834ad36aeec3212458841c
- MD5 b1c32661f9f9b9d5c5ff2af1a10cd5b1
- SHA1 ba17ac33a84aa99cd31c64c95d890d9d13a71571
- SHA512 d7d1f0fb8a73c66a8c0276ee4686082bb6bea58045119ea0df2abb0595b021c7621beabfaedad4b3a602b4db0ddfc73748e3208653f5fb2ccdbc5037e43caec2
- SSDEEP 98304:yO/wKetReiN+GTqOAbAgLq462dW5ljsN2OXRYwLiiE07pAQhh2HhFaxLzs:yO/wKeIXlLiiE07pAQP2Xaxs
- TLSH T10E767D1662E401A8D4B6D238CEA78513EB73BC554731D7DF0660966A1F73FE08A3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\SelfProtectionSdk.dll
- Size 4.6MB
- SHA256 0adb57549c241007b2b96194405d96de91b5f227d689823b8ca680b0a50ab1d8
- MD5 812709d97680e9705208e1376917347a
- SHA1 af18068ccaef61dca423343a3322c69f3eed7a6e
- SHA512 e2a5da61a570e705a7c50c8dc43e8a8a62ab07c3c608547b74d174b1d0bf3b4799d5d4da60b8cf85eb2ba142ff08f89b93334b621512c708b956c4a7845d2eff
- SSDEEP 49152:rqx6Rb6nfkyP5jecO5O7x800p5BV127gfs3XzNLiSH7IEjwIPs9zUzCnNlrsn9X:36kkp3nEfs31VH7PmuMoX
- TLSH T109268D17A6E501A9C876C23899B78603EBB2BC1117709BCF0A6496792FB3BD1573F704
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\SelfProtectionShim.dll
- Size 4.0MB
- SHA256 b87147bde9ab9fbebbcb5ff00986e0cfc76b3f66582ab67195f3ce5bff8106ba
- MD5 478fbcb25c37e0f1c4ada0fe02d35ff3
- SHA1 ad9cfbcae2d1e9bfd3d97cc3b4b1c84860bf3939
- SHA512 86d4dc0640c3974a2aa89a742d20d48789799cb000b92ddb8b805d83095d30afe5a45406b9b220f1da7d1a29eaa43673c453e77a2a0d7bee1d849722c723001f
- SSDEEP 49152:wuI5ZhsE7DWU0PIsOe2Yj2pBU5F4zLY1fqvtfIYKl4kKUSZPJ0pzUPn4AcJjrb:9+sEW0Q+Y1fN4TVlwAqf
- TLSH T15A168C17B7A940B8D866C23D85638603D7B2BC22077097CF16A466791FB3BE2573E718
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\Sentry.dll
- Size 754KB
- SHA256 8de41a631a741c44381ce8705c9093ef0e95f8b3bcba0988013ac7d9e9bc2315
- MD5 2fb96bf08029f920bbc02044e7e6be13
- SHA1 4cb2ff59e392ad38a3f6a8e0a3f77a2adedbded1
- SHA512 f8e4e1b46b5e12a73cb5da80ee9b851eac51c08b8ee9ae74d8fd67d080e13f9e46c04d2bc538d01772c38cca0c8226ffea4c398cc4f13f91db651d3bf16ae783
- SSDEEP 12288:4GatyZcGy82Yi/D/ESKCzfOp5+YTgekLt:4z6e80LcXCzO5+YOLt
- TLSH T18FF45CB363E89B2BD5AE2B30F43015094FB6E93DA4A6DFDF090CA49D1D423529D407B6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\Serilog.Extensions.Logging.dll
- Size 44KB
- SHA256 2b1fe300101924c8a64e34865215a7f94af49a900379a2eb10017bd186178421
- MD5 fb864d2f5b1939cb94357d97a55b650e
- SHA1 a2190e41697c311ee4f3cd8ca63bae71979f43d0
- SHA512 50e9920b9d8526d61f7a8e84bedc598a4ca44301241250c621f9f28eb4e310f9bc90c195e538c9b80ea6fb24671ec4c1e5e1691b06556f94fbd6392e1531097c
- SSDEEP 768:1SCZUl2O1zCnXyzD65YiRi/5ALkeT0Y2T0Y/XT2Ip4/Txf1ml6Z+7EeNgPZ:MCK9SyzDY7RieTb2TbPa9FfILF0Z
- TLSH T152137E8747BC8117EE5F9F30F4E0DA52BB38E7936850C692249DE2900E533C6579927E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\Serilog.Sinks.File.dll
- Size 57KB
- SHA256 26c3e4f919cd605846f3bc97f3af951faa3e5eee18c23e4620069be574e14cab
- MD5 c82a6c83bb5b511b73c28ca0a709266a
- SHA1 43056d7d851e8973d0add93ec19a210b1c8dc313
- SHA512 61a3d849a268fd9cfc67d4a7064e22ccb9e3cec28d9969066170919940a7cb557753100cf6cff16133e409439137675bbd7459dc1d7ddee80d107917fb54a8f8
- SSDEEP 1536:VLrgfPw3mXREaq7Rin4Tb2TbPa9vfILJ6:ZoPEaqcAbSb7w
- TLSH T1F9437C825BDC410BEA9F9F38F6F499522B35FBE3BC51CA4A009CC1A50D127856B4937B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\Serilog.dll
- Size 153KB
- SHA256 dcf73068f5fcf3e6d6770d18f8bdc80a260dbd7431f9eb32f1fd3d05692308f9
- MD5 b08d51ef3a2bbb3e154243dd4a448687
- SHA1 0d5491ec2586a8492b78ec9a03985e1371492545
- SHA512 0b147d63b25fe439d03499597ef8dbe31ff8f3ee67bae437b414266fb48c89d62a9bb95fc077af345baedf9a7b0a3d8d65f09b659db7630242cf67716fa89a27
- SSDEEP 3072:hobKO7RaoWuUeZk/f0Sh1HlWZm1ZZTdyGFkNUMT+P65jDtAgbSbMst:ObKKz1UeZk/Phv8lDuPaTu
- TLSH T11FE37C6953FC8EA1CBEE79B4A0F0C5810B74FD9B6072DB8E291C66F91D123054B50B6B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\Swissarmy.dll
- Size 3.7MB
- SHA256 d6b7da0f184b933f54dae4ec18df8cdcefe6b4b0850cbfea03c794c6a64a9de6
- MD5 8534491b85b0661b472342e565672261
- SHA1 b4b90df508d845a7eb0476612bed3e060621b642
- SHA512 da492a9ff7e95ba5fb9d4e6d9ee505bb036ddde361d666bd3fe38b1855724d9ca8da67417c2a1f93aff4312d4dff8049cbda47e2acc72900b8687e74469170fa
- SSDEEP 49152:/A+p/gJzSWZQGMfdOSpp+7LbfgMSaBaCpYXVOKRvPIWRdPDEzwzLu1N+IuqomIuH:/j1DwOOevPFREz4oF
- TLSH T12D069E1392D641BDEDB7C2788D57C503DBB2780903329BCF0A5096292FA3BE59A3E715
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\SwissarmyShim.dll
- Size 2.4MB
- SHA256 540f989efbf6f865b88cdce5277737a1947aaa006543bcd6b2a72440b85fb8dd
- MD5 2ac34694f42d73b8317eaae49972c0ba
- SHA1 08df62c5958ff62e664b0103352879dce1740128
- SHA512 3dead4a48dc84b6a3dea50d947cd78a61a6d872ec03af945309a54430f207cedece2f6d0423510024612352addcb2341bf5b22e7b045782e77f05d7f32574985
- SSDEEP 49152:lQmDoby8OpXiLI80nbqBc5SGpNBN+PmcY6SVI09dPHSEV66:buxmV6i/5SEN
- TLSH T1F9B59E07E3D641F9DDBAC2388963C51BD7B2B8191370ABDF06A092641FA37E1563D728
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\System.Diagnostics.DiagnosticSource.dll
- Size 160KB
- SHA256 d6935e993b69f8abd934f01b0d7dd8ca9616a7ea94c7af59ed07b2fd3cf93a97
- MD5 5a9c1832fee395c7dbeac9be739f8fb0
- SHA1 d3cb2771e9e6eb2784f402a490a57351ac02f236
- SHA512 c7187a32d6e6cfaf33992f3a68a0bf28e5dd4e1fd3e860adbe83c5c6810ca8afe12dd3f2551587acf857ad8349c7cc54323a9b95781e3e134c377900ecb326a4
- SSDEEP 3072:VpXcEKmyJfWx+TzaaYcSk7eZRAdm5qdTC:TXcmyhk+TlSI2AG
- TLSH T1A4F38D1873CD4A66CFEF2A39F0B4C48617B2D6567922EBDD798991EC1E137C0170226B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\System.Diagnostics.EventLog.Messages.dll
- Size 781KB
- SHA256 6444dfa03609248effd398e8562af484ad0163a6c47cee6d3a287ffdef809ad2
- MD5 6a205c78d14fa91efca3ae531d1ff7e8
- SHA1 9e26e81dfdba74ae261912993de875d13bb0891c
- SHA512 fd797f528519bd9b864394c2a45afa5c7f94f58d1f2b55e0017987fb521c9f7292dbe1366be778e60352fa8f9a08c10b7299aea39deeee3a164bb105857fe7ed
- SSDEEP 192:g/r3V645uWOL8/pCuPHnhWgN7acW5RjroUEKup3JdqnajvsKyhr:gx6Yi/uPHRN7y/oU7aJdlrsKK
- TLSH T19405D4928E388743CB5625B03E59F7F27B3983C72405516A05CAE6563C937F5AE212FC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\System.DirectoryServices.AccountManagement.dll
- Size 268KB
- SHA256 64e3c9c8474582853ba151287439a60c9dec916dcf3db096c4fe07a10d1eda3c
- MD5 ab6940648a9b3a98ae27d21fcfe19368
- SHA1 b305827c8bf8a227ce089a1e0044621e293ebc99
- SHA512 650c1e7641a4287cf3d8962025a36c89549e16456582e69ab8547855b7c0812890c01a720f90fc2491afd2180541d34795220c2586ba8d56c9c061db295961cd
- SSDEEP 6144:gw1bMhEqeJUiUd4dhHUgrUEtmKPrl7evN7mG/7C2dtl:gQ5qwuOHDogdjlev5bC8
- TLSH T189442B2433F80E09E2FF937DB57410598BF6F567629BDB2C186351AD0A63B41C621BA3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\System.DirectoryServices.Protocols.dll
- Size 136KB
- SHA256 7a4bc24de93fbb7ff0f3bd8f10a74e68ea345b29b5c370fa1e31d3b36b9eb187
- MD5 75ff319c6d198cad99be299e9625f3eb
- SHA1 b85d5489d512e5073cef81fd83b80a7a0a335f48
- SHA512 0b61333c12c52faa7ac7e6e4425e97aea80517976ceacf54e0b09ad82cfae2cbbd9e34e2012a67539bdc8dba2ed94bed3610843f05c262f19890ef84e78a4b12
- SSDEEP 3072:98PyVelkk/wYhsn7xMR0Zu1IW7nwDEIjcRPipiiId:ukkbU7xMRrIW7pI8z
- TLSH T1ECD36C14B7FC536FDB9F1578F26640244732F69A3A07D31E1A84A0EF1953B80A7329A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\System.ServiceProcess.ServiceController.dll
- Size 60KB
- SHA256 b5c339cc240e490a996ca5ee526e885aa6ef214614761de7b7704a4a0d9aaabb
- MD5 7f88677a39bb63c3a50d96f3aa1b0e20
- SHA1 53a006b7e31a95163497d3c6f599eba1070b2fd4
- SHA512 d81e56636f28dae8c0fc885f5d9d04a830ca1b385525b09179f654ccbcf2775d59645ad97969ef8b01a9f615061a48dcb3636ad1ce395ff775e46c8de4527724
- SSDEEP 768:r5tx7Q/QsFvqoEz2SviAC9Kd9OyPo+cbNxwx7uMSAXN92D1Nlt7fM8P:r5tx7gQ50ACapkNix7u6N0p7fMm
- TLSH T1DD536C0093FC4B7BDA9F4BB87CB290130A76B7862601F75E1AD8905A15E5FC886713B7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\System.Text.Encodings.Web.dll
- Size 69KB
- SHA256 d2af18fa9cec4f826b75649b1ad7fc88a07138adfdad986481f11db11817754e
- MD5 7dd9ae427be644501ed8dea4204ce45b
- SHA1 4c0874d5dcec93568957c5693a1afaf320d9cde4
- SHA512 fe6bd1439143190ce0e100fac26588434a14addd882760b148ab4f469db08a75f6e9264d92f63be1c86688a521a2e1c586fa1b0d7e966ff552934aeead263fc6
- SSDEEP 1536:uQuedlunqpC9yYxC9P7tt08eeykGlsESo3ro0Mf9XzFP:93KICHxC9ZJexRsG3rMf9XZ
- TLSH T1F1636C14E7C8C66FCA5E1E7234B1C071A7B0AF9B5166F68748A4384957B33CD260F1A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\System.Text.Json.dll
- Size 530KB
- SHA256 a6cb476d20369516d882fdd0f318a7fe9eb694c166dc9f2089e99b4c27f17ac7
- MD5 b7bcb19ea0110c433799412df9ab7c8a
- SHA1 0c39979d5a017e7c46169cc9fbfdda4448c33fb5
- SHA512 234522a56fc47894a8f63a467f7fb7c44285ea490296bfef893d1ae1533571f312a8bc5e9d586f19e5126c87f23e7bbc993dc04347f996f3a7fd0f19cdd874b3
- SSDEEP 6144:x6+HbUMHVgQO61+5ZpvsQ60OghEusa4UQgce0x7KjF76pkLzLFEnJEIfibgPKiUT:x6aRgsgfEU4UDcxkLzJEBsgPKiUYFHu
- TLSH T126C45BA273EC4A2BD9EF0775E03848199BBAE4677BA6D35F140474FA04837C08F456A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\TelemetryControllerImpl.dll
- Size 7.3MB
- SHA256 72a27362209a865cb90315f99c7f7bcc34cfdf39e48bd8d1dc4edb961edfb01e
- MD5 2065b2bb3bb83c314162ad49d320daa8
- SHA1 0f9e968fed20a5beb52eda51c52f1cfcde45cafe
- SHA512 e907e6ec4077d13d72e00a11c65155982fecff6753b6f69f17f5e94efa1d4fc1b9db96f13d1f8800bf769a06a84bca8fcec46037db8ee8d310ad5f1c9224d135
- SSDEEP 98304:g9J90MtrBKuNx0iLI1wP7TH7bxKB65tXUKhL3ZUTI1:gv9ntrcuNxzI1wP7THXx265tEKd3qs
- TLSH T13D76AF5AB6A400E8D4B6C23CCA578513D7B2B8255331DBDF06E4967A1F73BE09A3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\UpdateControllerImpl.dll
- Size 4.5MB
- SHA256 17d3d9cafc933fc96e1456491e6c589f00d02c0f901e20240ed8b81d74d2baf7
- MD5 9347983e1dbf7f65d12edb56771f105c
- SHA1 25eb0c6afcd9c932ae88dbfeba69a59f69f053a2
- SHA512 08279f021b4cb054d7ea9f78c07ca92195a8bea7297809535d9933a2861d761b18b6915fb4ee224d9666ed6f6c2d89f1b0a3b2e5f71e43e7091570a095b6f6cc
- SSDEEP 49152:BYQ4BHl6JGaUPn5abjPx2puWVL8LyAF8r5vjAu2ms43BnPvI0mJjFtBP5Z8lwyPD:lsIdWTPZmxFthlvA9Zh
- TLSH T1D026AE13A6E500F8D8B6D27CC9A78907D7B3B8150371DBCF16A4866A1F637E05A3B724
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\VPNControllerImpl.dll
- Size 3.5MB
- SHA256 0ab61876b204c8eb1abba90cdf7fda5f5278cf33f8adf9476de2008c4879c0c6
- MD5 2078fda6f4feab0b1ef1d64a6bcd6c03
- SHA1 a6f0685396e38ee8a2d7aa2055b27369343c7a9d
- SHA512 6fe7b662b0050e79d7685554b21d81fbc088cf04b82c82bcdc584df5da217bee668a6b0a18a81b1ab795b2ae664363a5d4502a155e8e74be89280a63f5ed1f2b
- SSDEEP 49152:UQ201Ox3P4aF8LLfgIxEe+2QSACfAZh5hniPu63u/WtBocgWh1vhWMGcdP6a45uj:+4EQ9f4cDvhIa4/OwoZb
- TLSH T19CF59D17A3E500F5D8B6C23889AB8517DBB3B8154371DBDF0AB182591F73BE0563AB24
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\ddshelper.bin
- Size 1KB
- SHA256 99198c557b03b24dbf40724c62c12c8c039447afedfd109e20061288963d9454
- MD5 bdf8a750ae5ff4858b88f1a0f729e4b1
- SHA1 f27c3c54473eb6787614a137af1f9a34e67d2816
- SHA512 187a178c872369032f2e4beefb9000cfa7ed97de184495ac06cefeaa4deb77d5ebac008685bced49203840bafed719a0097d3f32708989ca96acbab51812ce2d
- TLSH T106118C84C7A838424CE0AC06CBA0F42A0E45709717B65A4C96B6C669C1AD13C0CECFF9
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\ddshelper.exe
- Size 253KB
- SHA256 d2257e7643128166f46a88da45ab9c38b7c23d0d727551dbd9f780a43f4abd11
- MD5 10bc07abd8ebae1c977a9b2f32b8c788
- SHA1 55bbf844af546c27289cdb53fe9f05a31678d410
- SHA512 6ba48d29073b49cc0c3acb775dee91b8532fc75f0b41b8a84a40ceb8a4f84a8ea918beb3b9f27dfb368480c4893c749979e1721895d27bdfc6e686f16e8eec1d
- SSDEEP 6144:jC+kTECKVL+F97/2uXWbXCoReuENID4eH:j/kTIVL+L7+UYXlROIDD
- TLSH T1A0447C1473A108FAE967C631CD92CA13E27378514B34E99F436086729F37781AE3976E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\e_sqlcipher.dll
- Size 1.8MB
- SHA256 5151e6e3c9c715c5f5dbea8a2e463817798745756b51eb0fa22d161b754a5ca0
- MD5 c651b19e03524da8bfae78de9aec435f
- SHA1 92098a027cd958c06341f0136cd3e0c2864476c9
- SHA512 0709423b910097026a57bee7dd82508f3b063e4a1f8c61fd0e10fb190a5f7608b67204a4b87db76b0cd2bb471968bf6d1dcc9322e80487b07dccdead168f80e2
- SSDEEP 24576:2OAtE1Tfv9L8Y4D2OyiNilZmD0PgZCYyx6A8YuA7x/PME87BA2sufien:28tdy2OgmDGdxGYH7JVAn
- TLSH T1A1857D0BA2B900ACD8A7D278CA17970FDBF174151764ABDB159086952F23FF61E7A330
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\e_sqlite3.dll
- Size 1.6MB
- SHA256 8c98b2d4f8d8de9c796f97ad6fbfdee981446bf6bd59235d2875e03e62fe4646
- MD5 ccd5dd18e4a7208854791e6131637cee
- SHA1 d900328ad1703953602792026779a5ea8479a990
- SHA512 08f85828de79a198a637c13dea5b8f007b7b6bde25733ef0ccd1e0a0e21277c4c1b0c0cc52fa577f95627ef3a9a8afb9954f7ca87d9fff309fa944c8698909de
- SSDEEP 49152:aek0MS30xsjhNuIQEBlXrhMwI8nSQ7pz2R3:gOjhNu6XrhMwI8nS0z03
- TLSH T120757D47B3B900ACD467C2B88513571BD7F174052B64ABDB55A08AA92F23FF61E7A330
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\mb5uns.exe
- Size 2.2MB
- SHA256 2557968c8571a3e8147656ccc537866ec1644ec12ff4dd5d2aed0593c6000fba
- MD5 96891ea1a5d1a5cc24c58dfb8eea750a
- SHA1 af3f28d28320d0d781ec2f8cd3931e251091d939
- SHA512 890a245f71b661adf50dce95859f7dd799ab9850017bbb582073f2af1a5a2a2cf2842a9fb3e45bf73ef077c92ac5caebb85bf91787e52df81febd28f173bef41
- SSDEEP 24576:4EqVu0Si6HB/PJMpQizHvJE0h0lhSMXlUF+Tb6CO3yvoF6cL3XqU6syS2fe5Wa:BqB9G9PJMpQizHvJkkCzgZKUxT2gWa
- TLSH T152B5BF12E2818138C8E561302C7DD7BD2B79FC38AFA6559B73E4BB3509715C0AE35B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\mbae-api-na.dll
- Size 723KB
- SHA256 9da91636ba3d7792a2a5bc6d0824e9da21b1998bae8381c5bac3bfaf065a0398
- MD5 f28b508e5b653bb7cd71c0c3bbb025fa
- SHA1 6417487400375007fc7ded4304286019d2ccbe9e
- SHA512 8d877868138a1adf7300ec84fbdbaf42bb20fb120c992d34f1b9bad4a5e40522eb7ddc3632fe7a96ca3b9b3de42b545e69e89c32f56cca14b8d4e3efb0f17a56
- SSDEEP 12288:oBmhO7I2aYDXWwN4f4R1Nb+qlVLw8fIYbHny2U3vFn+hPrO6PnSP:oc+HDta4lb+qPcyqFP
- TLSH T153F40819A3AD02ACEA76C536B663A223FF7334541B70BE8B5E108E395F32760953C751
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\mbae.dll
- Size 1.4MB
- SHA256 c9abc12119ebf2eba9f723ae5e5d9d2bc763e49ff0c2100b672a25bd6bc39943
- MD5 12dece0fb669e53a056f0d58948e2eab
- SHA1 b609b957cbf1d21af0b6a547372d0787cc601f00
- SHA512 f28247d52e33b62b080e68bef7c2dadeeabd8768714d4641e2095f4cd7f4745a8bb277708c082ff25440cd5c50b96f027f210b94a99ec4b4fcdf9dc9b459ae6b
- SSDEEP 24576:vXforg3CNbssbhjwrPQ3k97VdzNe4TWtTtM3yRs4hqCw/MBi0O2nwuXLXNP:XoaqlwBPzNUYyRs11/Ai0LnwuXL9P
- TLSH T163657D20BAC1C175D4AE06B0A97CAB2F153E7B240B3494DBF2D85E9D6E345D36A31B13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\mbae.sys
- Size 156KB
- SHA256 713c4c1b31c414d227e47f842f17504af8cebf12f366d64272d9754ce2b7f291
- MD5 d125f96a3a5dbeccb0af00b75b268bdf
- SHA1 134ba5b0810441197c377c6344794a4481630f48
- SHA512 87fc46e4ffb2d66dafa2a431c3a1ca895fb48d7c35cdf4753948785612b153ef69a63f1b74dafa8704c8bdf5fec58aa1011fe147bf4dd2d431b8ca61597eeb0e
- SSDEEP 3072:EVj/Hk4po4h7crVPhwVXWTJyQbs6dWuKNScYgE+AVDGff1V:EV4+vhYrhJTJlbs6dWu4SaE+jXn
- TLSH T190F36C52E3A400F9D8A6CAB9CB669213E7B2780D2711E7CF076085351F573E4BB39366
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\mbae64.dll
- Size 1.7MB
- SHA256 1daa2d7e00dc951d48ba9335126a353c8a6bb6ec9114fb6022f9655327b9e0c4
- MD5 172d2cb6663fb50f99a71295b1567ae0
- SHA1 2124080fa630d9a39f3ebcbfdf25d7be47f97c18
- SHA512 90cfad254132c9ddf6baa96865c1d6e13892fb5cee33f0c804c9c3dd88a313496c826a14e29687aca8f3f633dd680deded9943d28d324d70204128896ce7f4c5
- SSDEEP 24576:KfXlyfvfWYZlN1QC0RMHft0NCA9BWHYOcpTnN5:KNynf3ZlnQRRMHS9sHTcpTT
- TLSH T1D8856C07B7B940A8D0B6C13889A7A71BE6B174550F30A7DF66908B5DEF23BE0493D361
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\mbamelam.cat
- Size 11KB
- SHA256 64416d564725416c6869ea951878a2734b1f6940b11f7961a897c45f0d8c6625
- MD5 bd4ceae54af081d6b1dd91ff584c5d61
- SHA1 5ade462d66e042da58bb1447d1b31f1aad901b68
- SHA512 37e7abd312f694ee2c8ea54ecf50ed12c16684f1007c61d9a6d1d01cba958be511c5e4e11cd7393a5cd57349fda1c552bebca42962137e0d11695c195761ebb0
- SSDEEP 192:oBxybp/yRpJCSEbhLxyKR/2FWQFdbiI/Ex6RMySX01k9z3AgEhrZg:oLp+eFRvmoMR9zJug
- TLSH T11A320AE58A6C5083DCA7AC6087E8E5D77C3D67C71D00987921DAFB5409933CAFB2816D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\mbamelam.inf
- Size 2KB
- SHA256 e26c2d3347e5f077da92713c9df3cd3eae438fb7e29810bd5c3afe567d2d3125
- MD5 5d8c05cc4f9b4304d57ea10b87f2dcf0
- SHA1 2cabe3d39aa5ec16c54c7818284a2ee235d2ddbd
- SHA512 55bff23fee9852f229246b71721b3659c916079787935d400a97641449dfda752fc8fbf36f9ea3dc4028f05daeb9006a99660284a61aa5d5a466af0ee966c738
- TLSH T164410454AA538BB8697B35B81E472883BF5412205076384032DEC8C99B6DF0C93757AB
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\mbamelam.sys
- Size 21KB
- SHA256 ded569e249e590314d095f740c6b8934a5a797e4f3edbe0f78eac9d333f12a2a
- MD5 8da81aa1f6b89ce1d2e216e3ea351c59
- SHA1 4baf79cbade9a5584630a540e6368d547579fb12
- SHA512 6d611bbd9d480ef2defd745fd06c4ab86e181267cf689d9d0e124edbaf22fd30fbe2310879cc7bb6dde5bae72c4feea1d329cdecfbf101d95634f85dd0769119
- SSDEEP 192:C7IlO/ZnEc+PbYv6/i0RtPH920QvVUKjnegqdsW++w/y1wVWQ4uW/+O68RwX01kd:wIlO/i8ChLIxUKjnev6+Twc69R9zING
- TLSH T108A23B6549780283F6BBC570C7E4C927BD38F39677408AEB0591E5681DA37C2AB3192D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\mbampt.exe
- Size 33KB
- SHA256 0eba9572e3667ca5043be61302f8fc89ff0eeec11f61a53b16f62d64efe83abe
- MD5 c847f34823755b89b0aaea18c350ab31
- SHA1 2448ccb1806ca53fa737a92537f121754baf1a89
- SHA512 7705831659ba5e3e4a94f519321ffb599d7ec9a4ee19fa6874ff49ace63fbb78d999187e2eaeb9182060797524494f368ec822a7a733835221aac3bca145618a
- SSDEEP 768:KH/F5YiRiu5ALAn3W2UW2qOJh2Ip40iTxf1ml6Z+7E3KNgos:IL7RiuvC58906fILGKC
- TLSH T14FF27BD68A680443FE07EE30B5E4DA67B938B7D32991C2D7206DD2810B563C1BB9D27D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\mbamsisdk.dll
- Size 12.7MB
- SHA256 0778cc030a9e8b7cd66950bf492554842ffb64d8e01b145c2dd9551c9239a78a
- MD5 10a694b956d9999531d9a21be1c4f2d8
- SHA1 3ac8fd5ae83ab8c42ac335a8d59ffb730628c11b
- SHA512 10b8f7c76d30e6dd83c360712eefb36d71b285a507944438d0b4d0645b01c74f2b12d8892a73ba5ee60b67081602a88b3ef1343d011a23fc958e7733c7a14c0a
- SSDEEP 196608:3LYxLLbdfBrYViPou2HocTCG/K5GLv7DuJHSWSbAZlyX2pD:38xLLbdfBrYVi96uG/raJHSWSbAZlyGh
- TLSH T17CD6AE17BBD540B9D8BAC23885A78627DBB2BC114730D7CF06A4566A1FB3BE0563E314
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\mbcut.dll
- Size 4.1MB
- SHA256 c7b5882996f126fe957bf12e32a6d3dafeb3677f1e88a972e600d03abcd36270
- MD5 6198a296e1a7e24feb10a30861cc8bd2
- SHA1 67563ceb7ef5d880899587cc621b82dce11b8aee
- SHA512 e6d05cf5e2b8ded7bd66987a503ae19970f27bb23fb1ec9a1ee6bcce1f646ac3ca510a150d1a5f5201a17af109eb9a198d3a16ed8efa7d5c87213405460884e8
- SSDEEP 49152:O8wF78cU+M+FMZ3Y6ys40LWvTFvjIfZvn2mPylZvyJjB4hezvo5fMbpWGs1fPm3/:al8UMv33ZLW5Mf0J5yvOfWI26FZkPN
- TLSH T1BD167C17ABA500A8D8BAC238896B8603D7B2FC15477097CF16A066791FB3BD2573F714
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\mbshlext.dll
- Size 3.1MB
- SHA256 8af36217efcc1b2a677accc77839ed3b67ddbfcabfa16caaa42c7e95796b940a
- MD5 d82467d25954c9fbaa91ca97e0de6834
- SHA1 d7da2b4f83acd0d2aaf55de2ae403fa6cc44bfc6
- SHA512 84a38b2d4a1b23439f4c6eca1fc148d618effd1444704f37e5812488877d15789b603944231281299ba332dbd0d3a0e51160c588c0adc1bf338675c62da45aa4
- SSDEEP 49152:zHsR0cmbmDszn14AcKLfC659mLVD+Bjmo+2g5rCdPWD8i51l3z:zHBpmj2Am0D8g3
- TLSH T169E54A227A9540ECF866A23864FB8502F6F27A05236097CB0558727D1EEB7F106BF7D4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\mbtun.dll
- Size 2.8MB
- SHA256 f21a980316bd4c57c70e00840ab76d9ad412092d7d2d6a2cff4f1311f7c05364
- MD5 2bbf63f1dab335f5caf431dbd4f38494
- SHA1 90f1d818ac8a4881bf770c1ff474f35cdaa4fcd0
- SHA512 ebb9834323329dc01ba2c87e5fad1083a4cb86f5ed761cb63299ac5336a9843a1aadd42fbed706797c2295117af1c00f96806422338352653c8e0255fecc2fd5
- SSDEEP 49152:xNrdEZjzdAj9fdc4fDrN1OxOh5PgqdnBq30yPFZP7KVxSL:bBzFRkshaZP2W
- TLSH T136D58C1AA7A800A8EEB6C27CC6578603D7F2B8151771ABDF02A456791F73BE1173E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\offreg.dll
- Size 140KB
- SHA256 8e6c155a97666c8e6a3f9ea95bfc6f6e4f87beac53dd72164aba3ef33ff88db1
- MD5 1659738d57a15a0983f0373b2faaef45
- SHA1 efd4cd05ff6bd787a2ceabfd11daba1c0e475855
- SHA512 4f62cfe0579e1aeeeb30edd5f42a2b1880446dd1075be051e2e0189da5071f9866e5425ff85547486fd7d952a28efa4e784db0cfdc1fcc428b34eaa89c6a7654
- SSDEEP 1536:kXNnhdTcQOCr7LClg5lSYOurIt/0q9mrf0Xp2N7RibuQusR9YfIZRoU:cnXTcQ57LClMlSYA0q9mrf0XoNHFQZ3
- TLSH T111E39D5A73B420A6E8678678C569875BE776B162232087DF12E5C6B80F037CA7F3C345
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\rtp.dll
- Size 4.5MB
- SHA256 0509d1438fe044da9d37a34710ddda2f8dfae5a3f240131968281b6bd16ee6e7
- MD5 efb31a400682e2e8dfa3789930bfc8db
- SHA1 6bae5c27b9a9cbd75eab588e4d208d703ab5b545
- SHA512 2b717d2c5ad690e33e26ed1dcd467a1ea21604a7a2a4b06944b59b4784a9778d5c7b725a68984aba486d0f7de1a77e01c9af570183fed831257ad4a72539dd4e
- SSDEEP 49152:AlsD4iHitygEQR6sn+MK/1mWB93Fq/p1/M9CYh8EXywoDdWJKPCWzU3h5d04UjVB:5HiDAFMpy9ByZE5QH
- TLSH T180268C17A6E900ACC876C23889779603E7B2BC1547709BCF066896691FB3BD24B3F715
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\sentrynativesdk.dll
- Size 596KB
- SHA256 6e6096dabfe6b34c3e6ccba49cef544b7be6158e34168f819f8cac1b3645d4d0
- MD5 efba4bdd511e95708c555984bd21c2bc
- SHA1 dbb823e9530ae40249db0bb8b85492ad1574e8b4
- SHA512 058110541c3cff39a0a3c136b6eaeb01896e04bf192d7138e0cd680203fd7b0d05b056d90fd0956ae537329de5c6ff1c666704c568b73554fbe4e56bbbcc8c8c
- SSDEEP 12288:m5Hiqt9csEXkXfE/gv9DL+2/xzEdqwuKyCCGBazBWXsCjTls:m5Cqth3fZL+oxzuqwBCWazBWcCjps
- TLSH T1D8D47C5A76A803B8E07BD238C9934907E6B2780607719BCF03A057A76F27BD55B3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\version.dat
- Size 10B
- SHA256 92108f60c42e942fbef31c35973fc0f340ae27b9fcdc0c30034260c5c8eaa055
- MD5 e799ebc8e1add8b0cd163211410b9d69
- SHA1 398683af0ef5e489e3351b44238809e278463f6c
- SHA512 9b2d76df3d700c297f1187c8efa8bfc65c653f5d08bc83fa28933371b03e49fa49cf3b5e1ee3c996756cb4d18277dc1b345472047c5394d65a32952c80cc4f08
- MD5 SHA1 SHA512
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\ctlrpkg\wireguard.dll
- Size 1.3MB
- SHA256 d2ad6ce25634776f5067fd9d5750a5e3d2add1adde98eb1f56a2df194d0e9cbb
- MD5 bafa63cbef47269e12392eb29ff87070
- SHA1 a5814b3548010dd3e3413835bdc0590f726346f6
- SHA512 95290f78b4bf8d98e64c4c5280ac334bdda56265fd88370d7ba2caec93c776a13c33105fbd1c9f9bb8189d769415b95ca5dfe74f7276065e619eecee5dc07e76
- SSDEEP 12288:DUenDNpq9bKeKqM7cyOcN7kWCEKI2ExcN7kWOpPD:9pqFKew1N7VCEvcN7VOlD
- TLSH T1C055AE41B2491B94D4A283FDC9E68175A67ABC145B20CAFF0034F2686F73FEE9476E11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\dbclspkg\ActionsV5.dll
- Size 6.1MB
- SHA256 d513f3a50ec070bbd74f78d27d79b6cb60aff48310283c74ebeb204aacf375a4
- MD5 923a9fe2404277f490bc959493f48e72
- SHA1 563c8dcc7adf7fcd2c706be7ac56ed79c52aacf9
- SHA512 5bdbe65ffd24380d423c3d2bef220e29c39622551edff942f643e79e50ea582439b9e7e91387ef020d44e2462721dda089a83566c76ba1287c2dd917e4fe4194
- SSDEEP 49152:v9x1737qVRJXwMb5WOXz2aXjAr0dcOyccpFZckK/xjDzBE+WjYFJWgP4FNJe5RRe:X97ELkwdchTNOAjYFsG4EGmzqZzhaa
- TLSH T196564B16A7E801A4E0B2C178EEF79103EAB27C255735CBDF0590525E0E73BE09A7BB15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\dbclspkg\BrowserSDKDLLV5.dll
- Size 7.0MB
- SHA256 c72e39709b26ac7577200a76515347ff11c0a9424cf61657762d657e7aecd974
- MD5 36b6cdd3677d6a079cd21768ffacbc7e
- SHA1 e525b6c778d7b59ef06300cc980f63bcf581a24a
- SHA512 e106563a21063eba244b536e67ececf2630415d5857af8aa67bedecabb39a87799324c3024bcf84487fbd9cfb76dc24b27ebb881734b4157a38b5c74d538ec3e
- SSDEEP 49152:8VF1SVg1db+wMSI0nW5xjpvypuDYpsD0VXZTWqls/e9uETWgjB+S/YfbWf2zv7je:s8TeZKT+X6S/Yf6fITlRChya9Fx
- TLSH T113768D17B6A400A9D8BBC17CCA578603EBB2BC06577097CF16A4966E1F73BE0563E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\dbclspkg\Global.nm
- Size 341KB
- SHA256 afb78bd0613f72aa10df54c1344972b551d40ba5d9827e0c8a1170fec77c2c22
- MD5 105cd8a9ef44352ea6a4b1bcf88e3f99
- SHA1 6e4b79d3938b043dc087d6f777d6af5e725c6c52
- SHA512 fd760e5134485f2f1d5300d68fdf318bc06f705b14716a0ea346acbdd9cce10bf85fd49879537486d920109fba130a22272fe6640ad0f043df88d0704d4202c1
- SSDEEP 6144:dhi/nRdxNOPYlnE6HmX5DBzecVStuPgHHJrgc7YCP0tUZgZoGwODCc2AeTtSiXbl:dhivRdxNOPYlnE6HmX5DBzecVStuPgHf
- TLSH T10F748AD167AE2354F5B2EFB41BA0DA25497A6CA6EF00DB99D302144B193DE50CB31F23
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\dbclspkg\Global.sr
- Size 24.0MB
- SHA256 64340346806ec59bd105b66d4273766642cc289580d0a69c54323a0d8c79bc7c
- MD5 ea71825174b2ca8e42b798167e655e60
- SHA1 479836c257d6b35a4ef7d4fa2f7605a26ff8dc45
- SHA512 3afa2ef346488917a44e50feb558681564afb0887a8ffac25d71d7a2383933a28f304af2389725b7fb80567f2c7387151e3e3911419cc0d0a3c16737ca6516cb
- SSDEEP 393216:ZgVi7abOOQxc1jd57rX7VM7mQyosiiVWEI39d5:ZgViGKBxCXSmQXok39d5
- TLSH T106470263B6DA3A9BF022E57B4345E6728193F9123A23C591FBD20B1FC41DC849F65B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\dbclspkg\cfg.bin
- Size 2KB
- SHA256 06cee2bf32530582fe8a7f84afd9be786f4986f3b35ad5c3989e61b7fab1e3f2
- MD5 7d6f402b86e291388f77a3afb313a7e0
- SHA1 5eb5bee3089194926abac8b2111db6018321e0fc
- SHA512 3e1e9fb48125d09f43fffdec679486e6585e865afc325e4a7cb97c4267b1d3daf8bc6fca63e272e9bac30fbcfcb13fb839b826a7063d5d7c3cba89df454c9d70
- TLSH T15751F8EC3F021B20C91BD8B2FB6E5B953204F2954A1D96525B4E80639ECA5C6B407F41
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\dbclspkg\clean.mbdb
- Size 25KB
- SHA256 c6ca1c2610dd39b16cbe9795ce1670b8776ac92f6650f5376b0183951fc2eaf5
- MD5 16183b24387d61370a45ff4ac1861d17
- SHA1 722830b7fecad1bdd39cf930e2aa4c5641682e46
- SHA512 8f854199564b3a320a58ec119dcc56fd9035e40410164a3bbd4f85ef6475388562ea24397ffc7d29741c9968dbc5e5d1e75e16735794f1a6207f741a3a59afb8
- SSDEEP 384:HSfVtf1xUsbefXXsCblQL3bN/uCG29s4G3hOEuYo5rD7eFpIGRPTmZR9RQcJ:yHTUpnHblcLG2ZG3hO4MrD0kRLQcJ
- TLSH T1A8C2E19B9476BE8FB271486233D601974C1B6F7F7167818538C62063822D6E6B24FBC6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\dbclspkg\dbmanifest2.dat
- Size 924B
- SHA256 95c4504ce1b6f65c600507c944b43018b042c3e42f09daa2fd42228ff4f0f1ca
- MD5 b73b3560e75e17b34b37d0cc1708044d
- SHA1 378089e602c69f31c994851ffb948bd82fa94dbb
- SHA512 c7b9750ebb72aeed0e2a77ba2c11789ee250b395c2740b741467c2e9b4daba07e353b973abe6a1f6383a30e09737cb8f6f5f41efea88a85bc44b4db1f4d8f127
- TLSH T1C31188D1E0E610DA201EBFC6C0921197EE77C1FF821D078DB53D9588560447C481043A
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\dbclspkg\dynconfig.dat
- Size 39KB
- SHA256 008254ca1f4d6415da89d01a4292911de6135b42833156720a841a22685765dc
- MD5 10f23e7c8c791b91c86cd966d67b7bc7
- SHA1 3f596093b2bc33f7a2554818f8e41adbbd101961
- SHA512 2d1b21371ada038323be412945994d030ee8a9007db072484724616c8597c6998a560bc28886ebf89e2c8919fb70d76c98338d88832351823027491c98d48118
- SSDEEP 384:jNOT68xDvtG9ObE7L8u8sXNVkIfvs4FRj:ay8u8KVkIXsWRj
- TLSH T15603A21266FA1001B1B36588AEF28570DB2B74D965399EBF00C5464A4BEEE40BC53FF7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\dbclspkg\exclusions.txt
- Size 23KB
- SHA256 9e87e4c9da3337c63b7f0e6ed0eb71696121c74e18a5da577215e18097715e2f
- MD5 aef4eca7ee01bb1a146751c4d0510d2d
- SHA1 5cf2273da41147126e5e1eabd3182f19304eea25
- SHA512 d31d21e37b0048050b19600f8904354cff3f3ec8291c5a7a54267e14af9fb88dfb6d11e74a037cc0369ade8a8fb9b753861f3b3fb2219563e8ec359f66c042db
- SSDEEP 384:OpHJUPIIawosLqVqmv4EHUtVbUQIKiKn6p+C+vNCMSP+TyHS7ivS/6:mYmsGfvSp/6pzgH4cyH9E6
- TLSH T1B5B2D73A1CBD123751B4C6AACFD58877F640E1A7316A183A64D7874987CBE4329C31BE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\dbclspkg\igV5.exe
- Size 1.8MB
- SHA256 18730539538c30c3c298ccd999220be0e9a91ed8666a8b1da2c6d136e6335855
- MD5 53269a1a73f14005cdcb6664d00268bf
- SHA1 8c2f359a29a8d4cdb5085655d4969f0a864f08d9
- SHA512 3e8bba9e7e66292777bf2069fc9e857049862adab7076e447be4cfa6a306b5b3a9d7aec6001cdb05e4505189c6b62257359bfe71de0e0fd3da3fc934aca332de
- SSDEEP 24576:2ppw8j0kcU71dHGvPKN8kP95bLS0pBm2L6y1szQGfthuTVHzw8mv/:250kcOnk88kPt7+zQFZw8mv/
- TLSH T1EA95D720BAB6414FDB9916B82EBCAF9D22AC69490B6059C3738C975D0CF11D344FB376
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\dbclspkg\mbdigsig2.dat
- Size 514B
- SHA256 a44059975b657ed87ddc7cefa2bd5bd8577e214b6e0d2f1c6f4678dfaf2238f3
- MD5 a5f36bcc00c07aaca262b8efa734362b
- SHA1 4e47c37d60f3b619e68e70bc9a4d4d6181774dea
- SHA512 1618d61fb27d598c61a54376655c0ade4e47a8de310e3d1a5023e1ee847e55d5f1652ec10461365398e202833f38f7fc7500e74c8244b7215e6c8b8f637094a4
- TLSH T179F0759D8B4CFBF3014CB1E704CC041913A723550DE9780B55332D721738818DC408CA
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\dbclspkg\prot.mbdb
- Size 24B
- SHA256 6089fbf0c0c1413f62e91dc9497bedc6d8a271e9dc761e20adc0dccf6f4a0c1f
- MD5 546d9e30eadad8b22f5b3ffa875144bf
- SHA1 3b323ffef009bfe0662c2bd30bb06af6dfc68e4d
- SHA512 3478f5dcf7af549dd6fe48ad714604200de84a90120b16a32233b6d44fa7240f5f4e5fe803f54b86bbdfd10fa1bfdd88fb85eb6a78e23e426933f98d0a2565ec
- MD5 SHA1 SHA512
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\dbclspkg\rdefs.mbdb
- Size 24B
- SHA256 850a4ea37a0fd6f68bf95422d502b2d1257264eb90cc38c0a3b1b95aa375be55
- MD5 2f7423ca7c6a0f1339980f3c8c7de9f8
- SHA1 102c77faa28885354cfe6725d987bc23bc7108ba
- SHA512 e922ac8a7a2cde6d387f8698207cf5efbd45b646986a090e3549d97a7d552dd74179bd7ac20b7d246ca49d340c4c168982c65b4749df760857810b2358e7eb69
- MD5 SHA1 SHA512
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\dbclspkg\rules.mbdb
- Size 14.5MB
- SHA256 74ff97a3fa1f5874c284a3e453133d7126846fed02d55366e36dd0f09508b6cc
- MD5 d8cf769a1b41a2dcc39fca96ecf9776e
- SHA1 835a4b9bc43108cd3882a36df94d7028a566a268
- SHA512 69d2d4532e4481abaf10eeac245d241084dd033e7023c7982ad54532c5e55dc0de7b97a12795d037e672d7c5a35ed899dbcd435c713696f9f9c3149eb52892b5
- SSDEEP 393216:sfR8krKYtAhkch+nr7WSK6qv7g42i+Y+0dVHkFfbMekuyjnsp:sruYt0kch++Xg4263kFfbjzyjsp
- TLSH T1B7E6335945854786D8A48F5A483EFEC628FB1F202BED5D83F06D00AFDF142631A6F4A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\dbclspkg\sampleV5.dll
- Size 524KB
- SHA256 06c1a019a4cdbc1d48327f33baa7cbdc95b71f6fd87245ea78610ecb20141dbb
- MD5 0139c8b8ab3ae1bfe4880121fd2f67f5
- SHA1 393385345b6c9cf371398de6af088a157a474c9d
- SHA512 6eb164cef469b7fdb4f5d3e86fbc13fae456ed07e2a814b6c03a564c2c45322f3d44fa0d34ea59cb54938779ace3b3a058c035d08d267f942e8dde4e3f017ecb
- SSDEEP 12288:jYIAmy9w5vPkTEetmCqryujcqhL0HU5WhjW5SOzZ:jY/VJrqhLcCZ
- TLSH T1A2B45C00A760C01CF4F701FA97BA969DA8387970777C94CB61E1E98A1A649E5FC37B13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\dbclspkg\scan.mbdb
- Size 419KB
- SHA256 4a044809695f16ad66fd00def8297cdc3a3fa3b9b5e0e2128a0c11700243c4ef
- MD5 2266d6426992e60dba85175d0da765b1
- SHA1 bd61070eb4ab1e76261195f2f147514d7dc09826
- SHA512 26ab9bbb573d04a233bb16e4bdba7286360a10eea52895fa1ff0448cd0dc2f1bed1b83061291b35ec7a41350bad4fc5d81f8bc49bce56302d5ff0b6c26aa7b29
- SSDEEP 12288:xVIdG5+VNvMAYabnZHJZzTr2p1Wzsk77Lx:x68+VmVabnZpRaDu7Lx
- TLSH T1139423139035BDDFC1F91398A45AECB3353DE3CA6A6F932E15ACA814DD4B0845B0DE44
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\dbclspkg\tids.mbdb
- Size 159KB
- SHA256 35e31534bda459f663fcd10575bdbc9b140310e74c9a7053da2c96ad2898c738
- MD5 82eb9ec269c385044ee0a5ae746d94e2
- SHA1 a35922e14cc76869c824450f6753793528bf52d1
- SHA512 94280ea3cedfaca6c833809dd2e65fd4799a4acd33470dab5113029a5cf50debfe5530d9184df82a3e7d16f42aaa1019da6726be7f2d68f229e6789106831f70
- SSDEEP 3072:rnJa90rfuyr7rEd6SmdWiQzLlkQatmv0IxsOdbsiQUh:rnRrxsdxm1QzLlkHgbsip
- TLSH T11AF31276D28EAF7C4322ECF5C3F7439768F12C04E02216B53892F91197998ED9A55C4A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\dbclspkg\version.dat
- Size 48B
- SHA256 2732bf6e994183e0c5087f86fe62c55c99dae6cf6f735afde4eba490a00804a1
- MD5 1e095e599d0f66052137e90bb4e8309b
- SHA1 2dac09a86dcb69a49506b08122895c53f7ad45c1
- SHA512 754101f43c5ff0a9ddafe97d8d1a69382a9808ccd099f899e59f3d111cfc7bbd6ee5d7adf6bfce2fb5556abd65c5d3cd4dd31ef9135c99dd8e176c75347ae19d
- MD5 SHA1 SHA512
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_dbc04f6f55da11f1934d7a3be15c66e4\dbclspkg\wprot2.mbdb
- Size 15.8MB
- SHA256 4a075dcc8691230d30966e5c6fdfa220c81603a9816bf5a98df145626cab5749
- MD5 f5958279f3baed5eb924de7f38c2e9bd
- SHA1 01aa5c0c789d36b32e8fdf6609e92d0f8488e91d
- SHA512 1cd2da1d52c43b796e4d5f55341e8d562d26e6884dcea4af75fbd30073d1ad77c1bb22a18c8d6831dac3d384a9d77349cc39a713a412bcc2f13d338f1a3c75c2
- SSDEEP 196608:9HghBnXICzmk68OvVKRX4C8TcxQDh3TWtZyOoAVK1FAcq/9oGS/zQ:peBxzmkGvVKCC8giWD3KneF74zQ
- TLSH T141F6222BF914E116CBB6503A5ECAD4D617723B8081628F55B2096B31FD3583D7B2B2BC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\LOGS\MBVpnTunnelService.log
- Size 3KB
- SHA256 625d5b71f8009cfc964ce6938b3752bbdb4048599c9cc4427a2b0793dc26795c
- MD5 f26a6732da7208d1ded7d8f263f93ee6
- SHA1 d6cfee92048a9a25decf184f22a6998050b2f5ac
- SHA512 ea76511ee1ecb175edda799ce55ee8ca5f40c56b678193818afdbdc0d9802314b1b9cabc67744e6791754c6d965b0af9da3c494c261ce814b47050d9bee52390
- TLSH T10681A01D67ED011A72B2DB08FDF614A25F273C5B6930AD1D01980A0D1677D46F8A2B3B
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\LOGS\mbae-default.log
- Size 1KB
- SHA256 a1dad19c9b5efd1ce59db594124bd2218d99b7ff3853f92615b53cee2770fdd9
- MD5 5c515c0c13a80fb6931ba6b3f02e27f2
- SHA1 dadde3e23349bb5276ab7d708717dfb5d129befc
- SHA512 8a7aa34ddfca5a214d03f0dfbb5e38a8b1c60cbb37b19271a4a97dd0e87a696677da8c7eaa883e8f0de57bbc09863b3e98bbe7a43aafae46b59e2cb783c2804d
- TLSH T17831CB16F16495E521DCC2646D133EA2C7D92935C8332248F5D11DE8DAC3718A6D2E16
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json
- Size 66KB
- SHA256 e4cb0fd236587990228f9e1c7a8c0c9ffb27cc7c90112defd1e68484a9690813
- MD5 a034b660cb60872f255f73569900e0dc
- SHA1 14b2ac003971c23793b59a87e10f8c284fec7b78
- SHA512 cdffbc5f20b28f0e676da812a3fa86e713c9a87e3997498c2e4ed16f13e362087dc6f8a494a09da1ee03ebed789007a157c53a5e998032158cb3783e2026ab80
- SSDEEP 384:sriPalGB5AWiWq2mhzJUVVqxKS3xV2CjNrBa7gHOykEajctcxPad:JUAHiWqn1UVVqx9U7gYEaIKod
- TLSH T17763FB76D8DC4D5B857123A4AAB94607FB50036F51880C07BEBDEA8CCFB781295C6F1A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json
- Size 66KB
- SHA256 c28104d2e226a534ce741b73f0ed2e13b8b4549881962d8ab489a75ad1c44d26
- MD5 1e9e7993be8b82a35598c8c5396ba953
- SHA1 29ccd4a128ee5548457c7c6bfdf91a99aaa65535
- SHA512 075afa79db9c3defb91bca6634e62da25b9b5f16a86542485080c437d9438f08f7ba191225564fd05cdb113df0056c5b06e99efc057847cd2929aa54d33bcf68
- SSDEEP 384:Cr1PalGB5AWiWq2mhzJUVVqxKS3xV2CjNrBa7gHOykEajctcxPad:IUAHiWqn1UVVqx9U7gYEaIKod
- TLSH T11A63FB76D8DC4D5B857123A4AAB94603FB50036F51880C07BEBDEA8CCFB781695C6F1A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json
- Size 90KB
- SHA256 246755e677472a330dcbb535d5154a74516a46a2678ac06e40d1d090d2284629
- MD5 e1cdc6ee9fd1ab3fa3ee157022c79cb4
- SHA1 51c6f0dda425bbc3ce583f58788924cde628b5f1
- SHA512 53b075fc377b28c3d1e222cccc37761a554c4d29fb9bf796d05d01e03edd22df0cc72e05bc9edf0c659e609ed912a6952eaca650df1767b5ac62074561581fb1
- SSDEEP 384:/r1PalGB5AWiWq2mhzJUVVqxKS3xV2CjNrBa7gHOykEajctcxPaFH9uYf4RfH:5UAHiWqn1UVVqx9U7gYEaIKo7tf4RfH
- TLSH T15093D837D8DC4D6B953223A4A9794203FA60436F11880C43BEBDED8CDF77912958AF5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json.bak
- Size 47KB
- SHA256 e8c6970bae2943108f4fdf3a84d888224aa93b378299d76085fa4d1224b380ae
- MD5 d746a9d5a40e12a0f5c1f92c19a0f64c
- SHA1 e5ee8a45adf804b4fcdce5bd90988cdb14761224
- SHA512 05ae53421539b36cabb53716b8ad560b030924f087731b962bbf7449400fdd28e403b0d0d48b15f48c1bede2d5013032aed38b2dbf159875c82efccabdfb31e2
- SSDEEP 384:FriPalGB5AWiWq2mhzJUVVqxKS3xV2CjNrBa7gHOykEaf:UUAHiWqn1UVVqx9U7gYEaf
- TLSH T1082382BBD9DC0D0B99712294A9B94607FB20036F10980C17BDBEA98DCFB755394C6F1A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\ArwControllerConfig.json
- Size 1KB
- SHA256 9b43d200f3bc7932dd174f62938d942d2e3634d9c331f201c68261ec06f95566
- MD5 cd89963c9efbee7285b3d26345d0eea3
- SHA1 6defaa2ee466f4f631d97ce42309594c4a617b8e
- SHA512 b6d99a05511de5d558f650818fb0101b30f64351b2ed8d626d7ce80ab692c40cb1f1cfa5726117f3df3331f787f0fe28eebd5291433d49c81289f0fe5c686be3
- TLSH T166112151962018FFA1BCA005E8949293CFA047A56408083BF2FCF688ED7A57363C2CD1
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\ArwControllerConfig.json
- Size 1KB
- SHA256 6ede46069429aa5f1bab8fa568e19ebd1586c8dd5c24034119c3bbd322e7e01e
- MD5 40770989550a5526d29337f59cb98102
- SHA1 171bfcdc2eac178e7bf1fd26d93dfdb05ef666d1
- SHA512 9da850c7b8dbaf1e52c09059be7381cf502b14fadcab30f3d70bbb66b40016794af71c7d4b179d07af934c92f01d28625fbfb342b9cd29f374c1ea8319c74ce8
- TLSH T10111E451962018FF95BDA406E9989153CFA047665414083BF2FDF784EC7A67267C2CE1
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\CleanControllerConfig.json
- Size 949B
- SHA256 4a25bb7a118c1971402e0f0d96e5f06dc14abb87be1d151b18420f3b1492ca2d
- MD5 93e45f8837d2f7db881cace95e578406
- SHA1 46faf7fff9c93aa49558c753a5d4a2205491be44
- SHA512 0fb8d20f60c98ec9a2440fbf712a92205ff523f49c4a7d6aeb8d8506333fc18a91cc3b3b54972afaaf4acd04e06efefc3f789b6f6c39cd3ea9427e7add76f17b
- TLSH T14C113674C40264BE54B9634E89F9E582D790530A28544C8BFEBCC99CEE73437B02BDDA
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\CloudConfig.json
- Size 1KB
- SHA256 f98a4c2fe9e897d460c3a68d34f9f217b56f4402a518e16cbb07554447c59616
- MD5 ae4d0abea594305a95a0b148b7734726
- SHA1 1a80b37516f386e66296943fa151d5a0cecb9769
- SHA512 2ea8bde0acd5f9a5a8fac3aa7d507c1250020a680638ea0166b19bcc2e98de14c51d09374509bb37e3f0c13506a8019623344c320a0d9abeca9a0c2c62f182f3
- TLSH T1001190179636ADFAA0BD261C5F6E9786C33897131885086B7270C9CCCF7AB169007A0F
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json
- Size 12KB
- SHA256 753430715ca52fb162b225b358027bea861f557b68d35d1d7d88fc210bab5b3b
- MD5 0f5ece8373b082890dcc5b7c023f869e
- SHA1 bd4ffc4f6d6b9782c515d0e35ef74f52a193ea29
- SHA512 d26a1513779a9b6146c8e1b20750e24d0c77dadac0a9e276720826249e37ac7d85d0d9b89d55d680270fffcd557065b6cb8bd95804b836e9dc7ab30e98000947
- SSDEEP 192:pcmf/FYgVMzhrgHTb0MAJUKfVgH8BZ8ZF1Px:KmlYgVMzhrgHTb0MAJUKfVgH8BZ8ZF15
- TLSH T150426426D1B5DEBB66FC617661B40782F364C76F08410C07797CC88C4F7BD2A62C2AA9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json
- Size 12KB
- SHA256 ec7b5e326bf5c36b6da9b0ba52f3557cfc60b168a8d4a929dd40700996fe9c9b
- MD5 881aba6292327ae870b8052f6ec0d90b
- SHA1 9a9a80e144c28c3c2cd7873d25ce28be91c82fcc
- SHA512 b9a5c0b9a731afa55b9d9006b389157b91e76834801b8772eb9c0da6f96a9a003c8f8a428d0509747f7869693957fae7fc4e0380bc40ce7124cc51a6ce140b40
- SSDEEP 384:LmlYgVMzhrgHTb0MAJUKfVgH8BZ8ZFx/5:LmlYgVMzhrgHTb0MAJUKfVgH8BZ8ZFxR
- TLSH T178426526D1B5DEBB66FD627661B40782F364C75F08410C07797CC88C4F7BD2A62C2AA9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json
- Size 12KB
- SHA256 520b46d738f7fe5e46048c507656db46c57ab52032153704a356fcc92e46c3f6
- MD5 e2ff5d560774b231e99a8a645906a7b1
- SHA1 cc80b0639d03e5ca9888c4dc83de48e0e7011a56
- SHA512 551a08e5a71bece6a69a5b620d7abd7f2823fffbf55de483c5c49474c2e8b70bf9f5fcea0f99986861bea3db9a18ca747d20b28353966e7bcb89995ea40131f0
- SSDEEP 384:AymlYgVMzhrgHTb0MAJUKfVgH8BZ8ZFta5:AymlYgVMzhrgHTb0MAJUKfVgH8BZ8ZFm
- TLSH T1A5427626D1B5DEBB66FD623661B40782F364C75F08410C17797CC88C4F7BD2A62C2AA9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json
- Size 12KB
- SHA256 2fe7ca9b558c547e048318c10e598743690723334827fabe67e19c868c7822ca
- MD5 d1681be23b0fce40fc6e844cafac8006
- SHA1 015dc1587848cec9e060a4ac072a047f2b974d57
- SHA512 c0bb54e9344ac16949ef50ced56f7eae698fc7818887fae8b64e3753ef94ef1e46b8900f4ade829c66cf81da70742a6fa693f3b922a02648e39d0b9dfb53fb35
- SSDEEP 384:PKmrYgVMzhrgHTb0MAJUKfVgH8BZ8ZFtal:PKmrYgVMzhrgHTb0MAJUKfVgH8BZ8ZF4
- TLSH T16A427626D5B5DEBB66FC627661B40782F364C76F08410C07797CC48C4F7BD2A62C2AA9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json
- Size 12KB
- SHA256 7a3aecc3869381890d1f947a2cd70646925bfceca3c3d85139c46781c35a429b
- MD5 6885878c025fb37861b12c32e7876bdd
- SHA1 53bf7697d03b251ed6d333d3a87970c6c29bf7e2
- SHA512 e29059d9a443f4ae11010a3d0770bd3d7f8a308e1f3609e3bb9e5b90687990a5ec1a64e631c0b66895104ba578df5b79ac95c4d2491c6a80efbf6bfc7876e7b5
- SSDEEP 384:PKmrYgVMzhrgHTb0MAJUKfVgH8BZ8ZFvLz:PKmrYgVMzhrgHTb0MAJUKfVgH8BZ8ZFP
- TLSH T19C426826D175EEBB66FC627662B40782F364C75F08410C17797CC48C4F7BD2A62C2AA9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json
- Size 12KB
- SHA256 2f57b71eab4bbb247419556ed9b9ddd08e66aa6e46bf0946f07ba68032375f5d
- MD5 dc919790c93f2ab7c916f185fe6feaef
- SHA1 c9d147555de7f31880be2a63718ab453bcb7f9b5
- SHA512 b34573c95175e04273719bf0c4b968a5dfabbaa40c1d49ff058955e0c33d97c75e5161348dddab7369b215b57174bbc42398a39b83ab4a2668fe940939c23d79
- SSDEEP 384:9KmpYgVMzhrgHTb0MAJUKfVgH8BZ8ZFhzV:9KmpYgVMzhrgHTb0MAJUKfVgH8BZ8ZFf
- TLSH T140426826D175EEBB66FC627662B40782F364C75F08410C17797CC48C4F7BD2A62C2AA9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\MwacControllerConfig.json
- Size 2KB
- SHA256 aed57db252c950c88fc526ce0f2a46da3ce90384a17dd5f8c23857eda5aa7558
- MD5 83868ee1d6d3ca3c41406381c8797028
- SHA1 2e9b3dadcbfd1be79916eb246e88bdc44c7b07bb
- SHA512 a5df4ac7729fd78e57d40cac59ba635434570f9e84ecb4e30f87def00f4da0943c3853b1c19484f5d01b4833b14b26932e939d05a6eb75e46bc5a814c07ce90b
- TLSH T19E41F532D5A8ADBF19F452667D994262F641935F416808A3FABCC97C4FF6C12200AF1F
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\MwacControllerConfig.json
- Size 2KB
- SHA256 77e05a1d8c03fa8b2b07c25f4505328185f100f34e174c7ef335f1c15ad8158a
- MD5 dc9105279a7ff6b4f21477a7f2afd681
- SHA1 dff9f1ae2633559f3d23279b2187244fb956b314
- SHA512 14c6a5ab3fe17bbad6cc1b7381acf565e41c4c547143073563559df64c513a7e35c6e7c76bcf5f7ed540e41cc8137b14835c1c74c608a137cf8c598bff28ef6c
- TLSH T1A1512732D5685CBF09F85266BCA84252F651871F51680CA3FABCC96C5FFAC12210AF5F
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\PoliciesConfig.json
- Size 814B
- SHA256 a2c890e3ae7387fcd578c0ecbb8543adf3d4c3bdc9a5cec0fba327541d9b2425
- MD5 98d61464bd24e69c22851405e9bbd188
- SHA1 2608b9af475640ba5362e129792f657ae75e7286
- SHA512 381db0384b8fdbbacb3286fe80dc88f86d3c3bf9267e6acc76f9a2d3512615e6ce3210d53761890db92ae2901e415579c89bce987f45689011aca16988f696d4
- TLSH T13D014726984084FD297C4168813BD4C1F351875A34190C2FB7FAEA0EEDB793B2185986
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\RtpConfig.json
- Size 2KB
- SHA256 c4e3e32094f17ea177448d904c752c0c0d166d3f0d6ffdc209cae64fc79159ca
- MD5 61c9e144e030f57ac6fed8d582b7fcca
- SHA1 4659b5f30c4e30d398a99db5fd6f257159db5cf1
- SHA512 9f7abbe72ccb924ed33be200ffee7807caff00cfb9f979e5d9857a5f1eed8d81b3984d7bb72f6480170a74d5bdadd710a01b2fdfcc5e00b35c7e8f5ef66ffe70
- TLSH T15A512521AE40A87D4C79C1199C7C518ADB245B60160A187B32FEC83DCDBBA727BC5CC2
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\RtpConfig.json
- Size 2KB
- SHA256 ad7eebc63c421956d1c61147ed26a84beeae6c6126ec07e50b5f29edac3f5c1f
- MD5 9f1d2fa1c9b0bf1af0496ec9f08405a3
- SHA1 a75738e2bb8940f55ba2eec462b7094b20ecb331
- SHA512 d64c6b7bae2e5001e3fda5b23c84833920f1439a382f6ce35ea2954a202b97642091ba1b97a5fe4744d354f17e7e12316078966b2785ce5479155f2be4637603
- TLSH T148510421AA40A87D4C79C1199C7C518ADB245B61160A18BB32FEC83DCDBBA737BC5CC6
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json
- Size 2KB
- SHA256 a81c570a6e3e4d374991ecdc3fc0fb7872ee0b45a65e558758067ef8de186e83
- MD5 e50ce559e3d5b9ae9a32a88922d11838
- SHA1 edfb181a14885b9c5ce93c1eef32d8285719f2fc
- SHA512 30df195a7763dfc12020eafd2267db07d64cf8baad8b7937eee5cc210929d103b658104803d41de3ea983e6e48436e053d15a1d2e447f5727807006cc20d0e55
- TLSH T1CF515B16D91058FE18B8E25EDC288086EB2083972506187F71FDC65C9FF76337686EE5
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json
- Size 5KB
- SHA256 7197a00cebce70edd5cc253e1f646f9a0f5b523b46f4e2ac558141f4934fdd0e
- MD5 9f192fcb5bdb73a19a0ac7084ad63615
- SHA1 8aa2462016be85f9f0f59916574bb91cac15e95c
- SHA512 c65c5504fef2a52aefbd5a15f138b5858ba7a0d10bf0ceabeebb62fe039181ea5623a5cacef41e79feead326039ec50c0705ca5a97159a57ab51b8d934db7e23
- SSDEEP 48:kIJCT5JtUmVSfKuGQf92Es1kV8Esmduwxu8qXKeWQX92MEnAf3wsaA:k+qZOfK5k9JykfsY3eXKBs9RsAf3wsaA
- TLSH T185C16C16D9105CFE18B8E25EDC288186E72083976202187FB5FD869C5FB76333686EE5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json
- Size 8KB
- SHA256 bbde68019873ef70c3f3fa403c1f997255eea28ca7e231996c4c98445bedc895
- MD5 61c3da7909b5993df32a54112b669202
- SHA1 ea349e84a79ab2671a0324ca150be319e2049fa1
- SHA512 986d8fc85ee8e7308b6abf8d42001540e85ef29f63b754e276cf730afba66fbbc4e66611531d8a72a5b1f52f83bbba82c6b90937f69cfc52c6c614927ae6df00
- SSDEEP 96:MZcQZOfK5k9JykfsY3eXKBs9Rsa6+YEZXKBs9RdAf3wsaA:KOi59ouaBUJZaB5gsR
- TLSH T131026D16D9105CFE18B8E25EDC28818AE730839762061C6FB5FD859C1FB76333686EE5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\SpConfigFile.json
- Size 11KB
- SHA256 1003909b770488eff8f9165f5946c5d48c2665f5609b899817f4d2f58871a1d7
- MD5 60041fcb88ef762fca6a6fa7f1cebd0f
- SHA1 a7a5316f67ab294f6ce05c192c141a2c67fa96c0
- SHA512 3f6936f2399058f6841ed62624cb06275c2e03f5cae3be083d46bdd662deb0e7122923c42a85b2d7c9663cc7861b00a5f66549c756fd6901ecea615295a30b9b
- SSDEEP 192:c8+xwb8fkY/sDpS8t7SSdUCExUYS9oFfJ7MLPi5LnDjufzqoA+8xRj81offZJZte:c8+xwb8fkY/sDY8t7SSdUCExUYS9oFfq
- TLSH T1BC42F61EE0A84867887626901F7A95A2E334526BC1435C6775FCF12CCFB6483C49AF9E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\SpConfigFile.json
- Size 11KB
- SHA256 da439a934647af4e5254331cd0834dfebbfee23af1544255092595c29b80c61a
- MD5 311aa80384cc361ee3aa403cc4b606e6
- SHA1 55687106bb3448c5d29bb9511f42c3a151d01b59
- SHA512 f0dc3f41d695ee1e1b837cc694fb30e3d7e9c3f8dbc7c898265492bf236e357f595567c9c490b3b9445d36055294744dd9ccb4a528fb47b2195f1833aca7c663
- SSDEEP 192:u8+xwb8fkY/sDpS8t7SSdUCExUYS9oFfJ7MLPi5LnDjufzqoA+8xRj81offZJZte:u8+xwb8fkY/sDY8t7SSdUCExUYS9oFfq
- TLSH T17642F71EE0984867887626901F7A95A2E338526BC1435C6775FCF12CCFB7483C49AF9E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json
- Size 1KB
- SHA256 2820b3e7b54b262fb2bfaf04549a4362ae0fbd5350abdf571cb4a9203c56bbd8
- MD5 43931008d5e4995486de44872903e16f
- SHA1 909452d1458efada092e3650d83aa315549d0254
- SHA512 4407f901ee5c639298138f67d99e61774e54348c6af8aa37164dc064b71bfd15d33e3cb6ff9103c255f946aea7ca4ca6d192cc75152b7390caaa31a05938c4b0
- TLSH T1B431E0128A2841FF28FDD148C9B88717E7A0531B21161C1FFAF8DA58DE7707237E1A98
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json
- Size 1KB
- SHA256 3ef878ea9f608abfb31ffb257a7fb992632855c2ba1969e8f5c6c298fae085b2
- MD5 d1d99c8d6d25c8c24c8a176b0e830198
- SHA1 c7b000c7a0f80a363724ea1fa907f63664b30e97
- SHA512 6eaecb25590a61ca3b83ef7efac51318b4ce50e60ce6fbf44a04141ab44a03aa10839e0c9ec570450a4bdbda3745e9cfdb976b3ab0b7add9b6a26102a9e8956c
- TLSH T1E43126128A2845FF28FCD144C9B88717E7A0431B21161C5FFAF8DA58DE3707237E2A88
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json
- Size 1KB
- SHA256 a2b810109ccb84e4ca29c1d9c588af24f39c97fe4c840d7812009811f640015e
- MD5 198e14cf0b264a8f642b195d6ba03606
- SHA1 f2f0488ea2bc73878ff4ccd12c9bd9b7e5e644b0
- SHA512 d611eee006a17c42bedde098b7e3451f682a89f0c0dfcda32be60fa5b7afe0cb7644d817cc6e984be059332dc999ef04dec5f170a0ebbada6e54aaf9516b68a8
- TLSH T1D33146128A2845FF28FCE148C9B88717E7A0531B61161C1FFAF8DA58DE3307237E1988
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json
- Size 1KB
- SHA256 3c1f474bac6b40ffadba64a053a7052e14a11a0245b8327e5f98aacbfdd46fd6
- MD5 1a3f11edd6ba84b2f503f15781d9571b
- SHA1 e18cf7a0f87147ec858a2d7aa40247183cab96a3
- SHA512 5f4e6fb727bef2cc664c44d1a6e1475f0a5017469022278f42164b3a07b27cce9a9f5af7b59d8841f4b9b735e9d0c096718b3c456ce549800bc51f7f6f058e98
- TLSH T1E63124128A2845FF28FCD154C9B84717E6A0531B11161C1FBAFCDA58CF7307227A2A99
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json
- Size 1KB
- SHA256 309516712d77421357c046537968f669d579735d0ee1d50e34eb20712741b589
- MD5 0265fbd5e77f635a7e262667897c6ca5
- SHA1 8c1b6c6d6b97238262146b960ef2bceb15e30129
- SHA512 ada7aa35694998cae6045ec019f9f5eeeb84ceb1684efcabfaded4e9bd7be2e97457a54e288cc4adc897c3875d72c25254992a5661325836526320e24827d5ca
- TLSH T1253134168A2845FF28FDE154C9B84717EAA0531B11161C2FB6FCDA58CF3303237E1A58
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json
- Size 1KB
- SHA256 2d7ef6052ccf6c6370f2af30cca35b56862cb952338ce2c8c05940bd8e8c69e0
- MD5 8fac6afe381bd57c90fc1ba2d6ee0855
- SHA1 8756c19cf90edb4ecb88e1ed485bc2a7101d0e9e
- SHA512 8d9915c6ee9d9e0094bd0cd22ca3e6eef66eba33936dc82351a6ee9616997b0cc631d86f7e945d27f4d2f8fc57910cf6ed9c2f22f2c2503befe3f2108c804b72
- TLSH T12A3136124A2845BF28FCD254C9B84717EAA0531B11061C2FBAFCDA58CF7707237E1948
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json
- Size 1KB
- SHA256 94bf88ac1ea14dc441766b3ff350c51cf8bbb004fa9b27b07d7615af58ee7311
- MD5 309b53327e52c6e64e05093ff36d6786
- SHA1 aee15302269d2b6b035cd2fd601204aa78944144
- SHA512 2a6106f490a6ec58f87d2918a4c9ccc2b5cfa3ad109d7468552f5be46dd860d28dea4dce466f98d4182e174c9222f9e544b0fcca9557412b43bbd81fd41d5fb4
- TLSH T1033124128A2845FF2CFCE154D9B84717EAA0631B11161C2FB6FCDA58CF7707236A2A58
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json
- Size 1KB
- SHA256 2b3a8d8daad32affb180d690849cf38dae254398d7482d2c26e2050cb507b9d6
- MD5 786f0d3052057a3772dc80911c148846
- SHA1 34650da44eb338b7f81e161cee4f0468135176b6
- SHA512 172f75cc1b10f84ef48c1ec3f7b03650cec40f0f86f8f7f820c2f6ced7ecbc8281081fb406d984a207080901883e192c059c372dac1037b0d1a3fe581265e539
- TLSH T15C3127124A2845BF28FCD154C9B85B17E6A0531B11161C2FBAFCDA58CF7703237E2A59
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json
- Size 1KB
- SHA256 1cd909b34c82c3e62aa356deb8f48a7ad5b84c373068582906fe18155597a505
- MD5 385aef9a1ae1717210067dfe4ff9828b
- SHA1 d676994056f75b04fa709f3ea8133d997ac6c413
- SHA512 17c4383e0474ad7ed489050933f90a8b43244cc5d31e6b6d02baa177155c089e6edd61ced23ae40304c48af8ec0efea6a57b88213958193d238b4d12b1173f0a
- TLSH T1953104128A2845FF29FDD254C9B84717EAA0531B11161C2FBAFCDA58CF3707237A2A59
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json
- Size 1KB
- SHA256 92be039dd5d4d34a592a64492201eef8932072a78155cb584641dc04d32a4c32
- MD5 6677a16b2466e3021e8556941270ce91
- SHA1 3d715b6f1a1887f39745f8a745a6d956df1f36c4
- SHA512 b27ac40a23803808405393b4e1a9950c4555ceec2ea3b8ae2f3ea46104e9a333f688d0e3f58e544a7e8be223e6471bab46034ea444022c66ad90b8e2f3791089
- TLSH T1573156228938CCBF1279974DC9B88001E760838F66B0892BB3FDD848DD73D34648BA4D
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json
- Size 1KB
- SHA256 6f0d160292bd5ecd41d3a42769ac5d1ffe2368ff2a06539c7fd00244d2caa54a
- MD5 f52ab925f57720db2482f0e440178c40
- SHA1 fb559b5a34c96eb96761fb7337aaa50c4e1b2593
- SHA512 a99408746bffaf31ba9b5d023a6bcc0581915dba6f01c8f4d09de2dadf73d744bab813227b8d3a9a71d48c065cd1e3c69563db39c9c756b04665eb03da604ad9
- TLSH T1D53189238938C8BF1279964DC9B88101E750538F26B08D2FB3FCD848DD73938648BA4D
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\VPNControllerConfig.json
- Size 1KB
- SHA256 b13b5f67991205d1e48d16c875a0bb8016e54d714c3e1b5a9d0748ff6b77e774
- MD5 8bdcb04fe9974832a55a0468415582c3
- SHA1 d0036f4510e6862167ef32ec350c624bb7da045f
- SHA512 6af9cef45d21d6728dc22c477b3c0358b22252d4696eb091681cb6849bff3418d6226c07e25f46b94d19a7ee7f29f6cf1e30bbee94bd4fe5fa58958a1458910f
- TLSH T147216836B0A010F96A7D9A9B6C7C8240F370530F11DA8F42BFBCE014CEB3594A164F9A
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\VPNControllerConfig.json
- Size 1KB
- SHA256 ff0429665c12de87c22923003f28d28384584f556b785459808e4d17250abac7
- MD5 c72660cabc8dd6a9ada21481c5003b74
- SHA1 9720fb7e7ee6f87603dfc80a2d198a156f57ddb2
- SHA512 19f4ecd716c290d0d37df8bcee050ab688ddb8a4962e44d9001e55a27caacba7ba8fd3a7e16393bb1652ca36f82045957f7e10fbe98c8b3d7a9534a735faa9ef
- TLSH T1B5219A32B09011F56A7D9A9B6C7C4200F370530F12D98B82FBBCE010CEB25A4A160F8A
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\VPNServerListConfig.json
- Size 125B
- SHA256 6e1795c39c8a248bdb15a810613038d8f595d98c63781f1da484663961e28d3a
- MD5 11624665a1b469d023e96dbe7674c71b
- SHA1 32a20abe92a41829f619bfa0f935dae938bdccde
- SHA512 15ea1d9c7440604486fc725120801972f3cbe66c564f6e8931bb16e70ffb3a6e1f72fa40971ed8f5b0728fef9c451eaa61431c30a425f6730189013ec75b40b3
- TLSH T118B092A820656A76A3F7974A4D854141D7A0B296A088840DB62C82EAEA70AA24156F7A
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\lkg_db\ig.exe
- Size 2.3MB
- SHA256 1e295c81dceca2266a52f7f8fd237c82a2511682a770dbe891c4fd2a73e1ef7e
- MD5 b4c59ab0083c4fc867136558953d9e15
- SHA1 39af2111877a57995633d86cac912ca7754833dd
- SHA512 bd7171c57d8d7840370ac394e0eacc38a0cd2f65a5ab7284ab7dcb45520254e3c7f2ee8595e513ebc045edaa7d348e4cb6783113c07dc7c80ce689ed1085d245
- SSDEEP 49152:2D0kcOnkB8kPt7+zQFZw8mvC0Z9iv71XyEBXOf:2Qkx88kPUEw870Z9A7c2Of
- TLSH T18EB52A20BAB6414FDB9916B82EBCAF9D22AC69490B6059C3738C975D0CF11D344FB376
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\pkgvers.dat
- Size 78B
- SHA256 6a02747fafab442c1a95f45965e1e3ec02f48a366472ddc3ce6b3cbe03fde589
- MD5 2b8caaec167bc171502ef80e1df18fbb
- SHA1 ab05017eb80c2c3c293feca906811cdaa02c5acd
- SHA512 ebf302a0eda057817b0dd8a6d39828fd9b308986ec2a860109a6d141a46ebee845473dd953d9a0c67eac4c486ddb58a6470214695657365ae38210b266a645ef
- TLSH T1AFA02411000D4700D117F1F151F411DC3103DC141D501F0000D343F11337070050C4F3
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\rmode\MBSetup.exe
- Size 2.7MB
- SHA256 0b9465643cd2609856e7ebdebc34296670a2b388c2bcf6e5ee0b59430c97bf41
- MD5 c12892ce63fe1ece5eb0b551019f0b9a
- SHA1 1c8e0ef2c2af8a6cc7763e87a3db307cf231df6d
- SHA512 d9a09154eb67f64190eef474bf70430591e3248bae751529cd37d41acc5bf15f4f6ad3be3e52ea887eba6d30380d272b9b9d7ea899af1056c941b3de7e0ce855
- SSDEEP 49152:bUgNqjSWr+s3E5C4tAwAeyfvE0Z3R0Tnxn1o2d581Kj:b/6SWr+s3yC4AeKtwnW2Ei
- TLSH T1F2D58E31B2918120E5F39370297EB7EA5B75BC256F76408F32D8B6390B725C09D35B26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\rmode\mbrescue.exe
- Size 7.7MB
- SHA256 477919ecb586d6ef4a06793417c2ae3126c51a51cf9445d901e90e3627e7143b
- MD5 ce8ca947e3162da157d1878d4cfec382
- SHA1 6f574aa206ba5e9d7469450780c4238cdd5112e8
- SHA512 4233bbde636d039ea3295e3b2066f56ea5a23e0431a5e675c967c60bbfa4f518f01eb90ac271da56a192671b925b3e14d3a25f1da4a8412983b4973565dff299
- SSDEEP 98304:akpowZa6gr/YzKrEAi9bESWCt+z3zweCeT007kxK:aFwZa62YW4AQbLWCtej1C9076K
- TLSH T1D586AE57A3E800E8D8B6D13CCA978503EBB2B85147719BDF06A4566A1F73AE05F3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 588KB
- SHA256 23a0c55ee03ad93eb1958f2bcdcf86c0f2858efaccc96bf6f4a68887bf875a3c
- MD5 517055823060755660ed192242a5ffd0
- SHA1 e2ffc2c8399cf0dd31cdf33f4ab7df96e83dd02c
- SHA512 229415c932d0e4dc8b5cab87fee521fc61a85080639e5f6a15a048cd86453de05dc80a685dd218eaf3bb3932fe26d7b552e8f8e8480b76526bd8e6295793b8b7
- SSDEEP 12288:VzhAlBciqqZeuiXC61iVNcDvG+XzzNQnGyEZ9c46usQS7f:Vz0BTZ9iScVD++jJXyE3c4XsQS7f
- TLSH T17AD4234B859C6E8BFE98837CB85A2511133E2EF2CC55C4D7A41CB2097D74DBADD28386
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.7MB
- SHA256 cdceaa05d5d4f987afd3be9cb43474c99b0d6f7e55664c495caf5dfa68b9c52b
- MD5 6b75958e6072affde9c2b6d692e352b6
- SHA1 6b8796ff3d0b0249c9e322e5b51d6252ab032cb2
- SHA512 acf0b9887365af5315f805f745b7cf8fe7ccb1b84549207dfaf8f70839ecb9658bc19fadfe9b2879a6af74a3dea3682dd7020e95d9bb5c14ff32c34a0afde98b
- SSDEEP 49152:ca0h2GEkuAe73q3pp46zwwQJ0Z9iv71XyEBXOf:ca0hNYG4Jwg0Z9A7c2Of
- TLSH T10F85AE1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE84E3DB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\CatRoot2\dberr.txt
- Size 37KB
- SHA256 eed1baae354ffb9cb02e95005eece47146166ba92796c6f27182ca8fa665bd2c
- MD5 b4919bf343eaa656e9714f16db563501
- SHA1 0a892f15396f57361938c9150c5bf903999f3460
- SHA512 b5526220982be32928ea5f958549d9bc6d10b87ee0c2494237c431e233ac2ad8c5b01f4f839fb10345a9bef44887447b1f67b490e835b74fdeeebc05e57b8084
- SSDEEP 768:hdovkB5Zw6aPIIGt2c4eptJCuPIFY50/0hY/kS:hdovqZw6aPIIGt2c3VCuPIFY50/0hYf
- TLSH T13B036F0952D88818C9F50D623A7BDE72C57BD5C6B70B1EE970ACA314D9C2B042FBA45F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 659KB
- SHA256 18e727efe931fafbc45515221bab6aa458af8d332a1d074c11a489179b9c2077
- MD5 2335242d4ff486abfa59b7c5154ac3c3
- SHA1 6ee6a4f5b77d9fac1834e7566b0cea40cf43ce50
- SHA512 1008e38dc3f61e355f3bbca3d96b5875070d7a2cf753f532c06edb8fede48e611377bc8f5eafb711d57a932c94902acb04a9d6770bbd39c8934bbeae69339e8e
- SSDEEP 12288:HhbHjfXUhAlBciqqZeuiXC61iVNcDvG+XzzNQnGyEZ9c46usQS7f:HhbHjPU0BTZ9iScVD++jJXyE3c4XsQSD
- TLSH T1D6E4026F06AC25CAFA71D27C98965606C3317C76072193EF1295827D5F3BEE94C38B82
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.2MB
- SHA256 80014fd0be194eae2b856879f914b6405687979410b774654fec4f8667e3c7f4
- MD5 9c741e38e8f5557763775dce53da4223
- SHA1 f2e1f3b7364241e7aa33f14339221be436673fee
- SHA512 99902a7744d4ed0d6d4d679113c5677a6019a04977b7ae67d967eccc4b37b6fe3646095850e6c2549fffb379a228cdafe59f719fc2bed23c297189e3aa7b83ec
- SSDEEP 24576:U3YgnJcRTk4yti+R5dBR/s0BTZ9iScVD++jJXyE3c4XsQS7f:UIgnaTk46pBR/s0Z9iv71XyEBXOf
- TLSH T17745BF2EF2B910B9D8A6D236450147B5FB71782D1F209ACB0170C538AF1AEE85F39F59
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 578KB
- SHA256 569afe0cda7e1ad79b6ed1f093a31b2088d93b887049f8ee1fb4544da8e354e9
- MD5 085a78a18bbe96417d4381e24ebd310a
- SHA1 ee976027922c29e932be92b8e3a1156cbc02d3df
- SHA512 394ca7c46ba4e5a69b6e55af56f824ccc5a17953f67e4f156860073b232b2afda03446da6725482e75f37ab3b7cab0d69b476b8e613cb4e6ded4abfc12b8377e
- SSDEEP 12288:bnhAlBciqqZeuiXC61iVNcDvG+XzzNQnGyEZ9c46usQS7f:bn0BTZ9iScVD++jJXyE3c4XsQS7f
- TLSH T105C4238F445C6ECBEE44827DA8862A0513381EF2C966C5E7542DF5097E78DFB99383C2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 940KB
- SHA256 9f057af3d83e143a85dda7b38074c018396c116b0a7a146c9fe2fc06d985e821
- MD5 d8a08c4a10dbf251e5dc6432d326ab4f
- SHA1 eecfec93f6d09e89b6266f6110b40d07eeda016d
- SHA512 43f2c1409f6204bfa0d7b580a1be2895a6a5e365ea3a0c0ccee3ea409377c8c7008410b19a3788f37c7b465b703051e5b691e32d08175f920d86f41a872ac4e0
- SSDEEP 24576:NpL3UTS0BTZ9iScVD++jJXyE3c4XsQS7f:NpL3U20Z9iv71XyEBXOf
- TLSH T12A250145E79804F9ED6BC13CC8A29A12D27278AD0764E7DF03A88A551F237F64E3E750
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 671KB
- SHA256 372c53e49f3aa1f5731cceec96bd2ddd1c745ca2681093301afb66e1328932cb
- MD5 07783045ed771960d9931cd2057489d5
- SHA1 eaf36ebf4858651b501bcc81d008b127e6cad99d
- SHA512 9e0d7b6f393118f34d6e199772c1ed205fdf98720f8a4ae9e030e3442bde44c3ed526df4b06640862f0a9e1068b783de42a4bb9bde931ddef0e1f799194721fa
- SSDEEP 12288:PpFtpOWhAlBciqqZeuiXC61iVNcDvG+XzzNQnGyEZ9c46usQS7f:jOW0BTZ9iScVD++jJXyE3c4XsQS7f
- TLSH T108E4021E26EC10EAE965923C99825309D3717CB2472297EF0290817E5F77FF89C39B91
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 ac943e9dc0f4e3c42e8205cd30d56ff1f1de3bc1b73ac04d659b28373edfa88f
- MD5 a4c7fcd3538b21187ca88b590e73e60f
- SHA1 4e58ce75cee64b9f39d80fd1ff9c951d2d3ac346
- SHA512 5c2085b04a4aae5cddff072d22b25a10c7dc67f2576369b718358c2d27ec19b517a28048b292daa34c2cbef68538ba336806142d48d3faca28b1da13730cf540
- SSDEEP 24576:V7NM9YqZqmWMUkPjZM48Mv6bEhsD0BTZ9iScVD++jJXyE3c4XsQS7f:V7cBWMpPjN8DbEh00Z9iv71XyEBXOf
- TLSH T153659E2E6BEC81D5D576D13DC9A28606F2B2B4611B318ACB1162833E7F37AF44E35721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.8MB
- SHA256 adb2cada63167fe4ae7a225a022b9661b6b8f5698f33b04cdb363a6cdca665f9
- MD5 69b85c2e32e7d70f443a4b514c3e4cca
- SHA1 aab8fbcbfe4974c8da262ddbb00091b2a4e46234
- SHA512 bf61a725240522ad55842626c484b970297cb452d3c3df4b0ac5154f568f3e14e8b782be4cbea6654bf8ec527c1157a8cb5feb4c5bd819d84850b96ff82bbe3a
- SSDEEP 49152:YF2YuHNETovAvNYf8kmj0Z9iv71XyEBXOf:d6BCf8kW0Z9A7c2Of
- TLSH T1B5858E6A27ED80A4E0BBD27D45B7D246FAB2B8511B3055CF0255862E1F33AF44D3DB22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Spectrum.exe
- Size 1.4MB
- SHA256 07a5404f776430115a85be103311346e3f089fc46d44f2ce8234c5416bd42958
- MD5 6aab8022cdacb48087a44706ce57e03c
- SHA1 9d6c21bfcde8e8606a7b7096148d714bcc3838b8
- SHA512 963c5f0f4c2f1d8b303ea54434958687a54e8e55abb7a1ccc69f19beaa1f12535468b8af7a10b5bc1541e6845ff506aae1dada19587fcef09b175f6b89b8ee23
- SSDEEP 24576:7AFs06+Omlf3NXEbToa0BTZ9iScVD++jJXyE3c4XsQS7f:0Fs060lVXup0Z9iv71XyEBXOf
- TLSH T10F65AE2F62AC00D5D47ED17E8997C91AF2B1786307255ACB0160C63E7F6BEE85E39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 885KB
- SHA256 ed2501e0f3be671a6f856d78d52e54f692730971caf79fae7d9d316c06459689
- MD5 6861212764e8107f161123896c0949ab
- SHA1 4e708db76c56fab6dec2bbf2db31a32e8dd8f270
- SHA512 b7bbbee7f2f43f393627ab37ec47e056a0a3fe4bb7f3c8cfe5a79fdc4a9f06f4071fecc0ebe6168b859736f27a02ccade703da2933d188a4ba79a510b70ce3d1
- SSDEEP 24576:LJnJ5D3WXp0BTZ9iScVD++jJXyE3c4XsQS7f:LJnJ5DGXp0Z9iv71XyEBXOf
- TLSH T19F15D02DD2A810E9D4B7C278815A2B46FF72387D2F22A9C72874D5353F12EE09979F44
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 0638b90604bb13d97df2b867c07a8ec290ccacb80a4d10a6d99e97204cac8b28
- MD5 416611ee36571c0176fee1c0a7a6a49f
- SHA1 1441e1ec70bd4c780197c3fa59e330bb460382c8
- SHA512 8ec32c1fcd9a8adf014b817837a8b993a3263a70f2ccdda2d65db756821dd70eda25cf0d88d9b5ec79179b2f01f4b2e5c7f8afdee6f16c256ea61f193d0334e7
- SSDEEP 49152:Fg06DIKdwc+eQnSt65aVv0Z9iv71XyEBXOf:eF0Z9A7c2Of
- TLSH T10D956C16B7EA5294E8B3CAB1C962A5169B327C509B34F7DF0AC0C92E1D33BD1D934B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 661KB
- SHA256 34c35c5c8406949f2764dad93904b7f005b533b70919eaeac274e879a5415b8b
- MD5 4d0aa130ca0a1eb4b14d1b207647b016
- SHA1 3f7d289a54979d71b1716db6bd87506b87cdcd03
- SHA512 e18b643433ddd7ebfc07ba4ad27dd6ceade308b92f23084c1010a4d40829e971cffd3a7acc601078f44536a928656d01d0ec1ce17e5c458838991423a895450f
- SSDEEP 12288:TEP3RnthAlBciqqZeuiXC61iVNcDvG+XzzNQnGyEZ9c46usQS7f:Ynt0BTZ9iScVD++jJXyE3c4XsQS7f
- TLSH T170E4129F169C70DAEA29913C98914605D372B8B14B5267EF01A4C23E4F37EFA5D3CB80
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\catroot2\dberr.txt
- Size 37KB
- SHA256 3188e307096b209bd7db2940e515adc3e244ad49eaa6a5f7b9f3979c7cf72907
- MD5 0cb12136e6554954bf334f092934183f
- SHA1 fb249fbb9a10cf8ebc73947de9c0392f102232f2
- SHA512 885332232bc29ff50167783fa1ce3e3e188c53b2ba90873b2e0208b570283c4a37981563340ca344dc28d22687132ad2324a5a6ed51f2501a6551761b20f906f
- SSDEEP 768:hdovkB5Zw6aPIIGt2c4eptJCuPIFY50/0hY/kk:hdovqZw6aPIIGt2c3VCuPIFY50/0hY3
- TLSH T1CB036E0952D88818C9F50D623A7BDE72C57BD5C6B70B1EE970ACA314D9C2B042FBA45F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 712KB
- SHA256 6eedbe75f8bca92440b4986316e5d19be323f6daae37a0fd93eb072b1efde355
- MD5 246213cbd655dda70d00683046649164
- SHA1 32660d40a7059d9c28a77bf34c3129257569182a
- SHA512 5ed00ccd2c512c8a0dd957b52381d9f3453da3bf73e6f5f82bfcad21cc48264fadab58e7b7357981e93187fe6ab32919ddf7d1fbe699f30f76aca3364911efae
- SSDEEP 12288:tjkyEhAlBciqqZeuiXC61iVNcDvG+XzzNQnGyEZ9c46usQS7f:tIyE0BTZ9iScVD++jJXyE3c4XsQS7f
- TLSH T1EFF4120A539C65CAEEA5423CE863125187397C718F21D2DF5090F63E6F36BE59C34B92
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 584KB
- SHA256 7a2e7d434fa3f86650736523b62c8018039810a1c3f0b0030468751ae39dfdb4
- MD5 25796eb1a2943b907d5a5edb9ec9b5d5
- SHA1 3b080cc8e778985d08778b75c0b3fb6799cf10f5
- SHA512 7bbf5a0768d6f5bd8820e1e7afb21a37a59cb8243f120d54f01477323925abaa0dc58f9a596be8acd62c30341ef35ea11c74391f608ce7a02bdc1379d804f287
- SSDEEP 12288:WyGhAlBciqqZeuiXC61iVNcDvG+XzzNQnGyEZ9c46usQS7f:/G0BTZ9iScVD++jJXyE3c4XsQS7f
- TLSH T11CD4234F055C7ACBEF44427CA8562A0143383DF28A16D4FB54ACF139AE759FA9938BC1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.3MB
- SHA256 7eb7f5334f22b1b6104eb221b19c2f0abf535b83d7948e991d4a4f89fea521fb
- MD5 e0d1496f489f4b62dcf9a8c7326a82f3
- SHA1 45abb2b4e973bd0139d27975394cb27819beecf6
- SHA512 b3c066640391a0231a8d7579cd6bc5a3e28dd3d5e9204bd8141c9e21bf1c6905e8afd7a4f0b82236e7ad625e7dad38fe0855f14f6ab35c3c974f8224a33a46e5
- SSDEEP 24576:gQ9MxZKdcz9dw3L0BTZ9iScVD++jJXyE3c4XsQS7f:gVKZL0Z9iv71XyEBXOf
- TLSH T13C558D2DABE9058AE177D279D4A250C3A633B4311B35D6CF2448D03D4D7AEE8AE74F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 772KB
- SHA256 4f4134e3cea7ae9e5761bc4ab70c3271c34f75e13c2c29451eeaab10906761ef
- MD5 758a038e5095f43f49917d0b59abc554
- SHA1 04cb45716ca7844cfee50ee228854243e8587a72
- SHA512 caf060af38bdf8da6b5658e48ee1a67629880e27d032899c98a8b90923dfa02f248613ec385970ca33ef76b62bffc6ed1796f391f151bb59fcad743e337e8834
- SSDEEP 24576:JyocDApI0BTZ9iScVD++jJXyE3c4XsQS7f:kocDApI0Z9iv71XyEBXOf
- TLSH T11DF4E01FBB6D40E2E166823C88858745E37374705B6293DB6591C33D8F27AE9BD38B42
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 c58cb2669080f1c34e4fb8004beb275e926f7687bf0e8f27dfbc9c497147bd08
- MD5 f86fc3a1f4b02783647a9bc3716770e6
- SHA1 9dcf2cb9287cdf842bfebb52e572b9fb0b5f6c63
- SHA512 b403275bea77b5c9ec7891bb508a5161027ea17ffd0361e109c2a353110524b52d00bfea0ea1d95daa3a5badde60e6d8113656dbbe924c5a1e6a20ce32ca10e2
- SSDEEP 49152:PWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKI0Z9iv71XyEBXOf:30zuNIS0Z9A7c2Of
- TLSH T18EA57B3DA2BC00A9D8AAC379C5451366EA71742E3F2055DB01B0C57CBF2AEF19A38F55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 104db8aa2a57cbe99a3df6c9177a5a997653173dfbb6f4e5c6f3a94a40e21ff5
- MD5 952f4b1485c9c6a2700a002d8470a656
- SHA1 78e8d09a852ffee3c6168408449056027b377880
- SHA512 cd3d4cef2c5b447b398c65be0bcbaeef38314be283873cc016f862ec8a10992a5b06c4a4351cb2c70e1b598116ea5d4c22fe2c78265ba54b281f3e63d377aea3
- SSDEEP 24576:K1QT7EcpfxR+N5AWAz3ooiYtjMqbt0BTZ9iScVD++jJXyE3c4XsQS7f:3TDxR+N5YzTfjM20Z9iv71XyEBXOf
- TLSH T11455B02EA7F815E9D17EC5799A238502FB727861033193CB42A0C17E1E7B9D85E7AF10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\SgrmBroker.exe
- Size 877KB
- SHA256 ece70285395a534d72e41e0f55270ac30891e63696f7b6fc74988fd693f23833
- MD5 69e8edd9c6a94254ec48ae2ac1c9d68e
- SHA1 39a314b57eba22092e853299c186034c3f0c9983
- SHA512 c1a27d578dd8fe9863672b8eab575469f55037c1e5e17abddd5d126318980cade9be97d7dc106e906b67c0df7c9ebdb6e2bfcbbed7695ef47f5c1c4440b9253f
- SSDEEP 24576:qTMdOz0FFS+imSLx0BTZ9iScVD++jJXyE3c4XsQS7f:m0K+imSLx0Z9iv71XyEBXOf
- TLSH T15A15F17EA36D14E5E57AC27CDA438906E67238720322A6DB0690C1793F5BFE4793DB40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\msiexec.exe
- Size 635KB
- SHA256 026c8e475c7bc6414b7281a4743800e07bd98ce1080a0a720db0c33718e47ae0
- MD5 c1036176376b270e3787ff182067e6a9
- SHA1 0dfe4a89d9ab70de23676e4218a9556859943381
- SHA512 3c24d296b7fb2b2bb7834871387f4a82784d3045bc4401713a6fad58658f8f0be5457737b12c2b1c5f9eb086b31688db0cabb06d03eef9cdeefa906abad268ff
- SSDEEP 12288:A4KShAlBciqqZeuiXC61iVNcDvG+XzzNQnGyEZ9c46usQS7f:WS0BTZ9iScVD++jJXyE3c4XsQS7f
- TLSH T150D4124E03EC34CAF961923CE966120583307CB2472596FF24E4D57E5F36AE9D938B82
- MD5 SHA1 SHA512 SSDEEP TLSH