Analysis
- max time kernel
149s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/07/2026, 05:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-09_239fa561ac8e1a047bd19b43f3554eb1_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-09_239fa561ac8e1a047bd19b43f3554eb1_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
39 signatures
150 seconds
General
- Target 2026-07-09_239fa561ac8e1a047bd19b43f3554eb1_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
- Size 3.2MB
- Sample260709-fxm3jsdx6t
- SHA256 0aae87262fb6881c8e868372232c322b987cc58e2ef04c4501f8531ce507bf1b
- MD5 239fa561ac8e1a047bd19b43f3554eb1
- SHA1 abe2a613595aa09b8617204e5970f790333c8a09
- SHA512 867b1730861cdd34bab5752c71b1a239828f536866c663d06b60c1ced1c3cc15d5ba2c8b4e5a2653150e4db1356fb7ebf7804ca4d5eb5dca2ab63cbe407667fc
- SSDEEP 49152:ag9zAAgHY7oomwAeyfvE0Z3R0Tnxn1o2d5Hptj4Lxln1i99ZG5v4:JdAAgHY1AeKtwnW28EHGt4
- TLSH T19DF5BF31B2D18120D5B39370297EA7EA4B79BC256F7640CF32D8B6390B725C0AD75B26
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 4732 created 3492 4732 2026-07-09_239fa561ac8e1a047bd19b43f3554eb1_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 51 - Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs
resource yara_rule behavioral2/files/0x000800000001cab4-2310.dat INDICATOR_SUSPICIOUS_Binary_References_Browsers - Detects executables built or packed with MPress PE compressor 1 IoCs
resource yara_rule behavioral2/files/0x000c00000001c6a1-1732.dat INDICATOR_EXE_Packed_MPress - Detects executables packed with ConfuserEx Mod 1 IoCs
resource yara_rule behavioral2/files/0x000c00000001c6a1-1732.dat INDICATOR_EXE_Packed_ConfuserEx - Detects executables packed with Goliath 1 IoCs
resource yara_rule behavioral2/files/0x000c00000001c6a1-1732.dat INDICATOR_EXE_Packed_Goliath - Detects executables packed with Themida 1 IoCs
resource yara_rule behavioral2/files/0x000c00000001c6a1-1732.dat INDICATOR_EXE_Packed_Themida - Drops file in Drivers directory 6 IoCs
description ioc Process File created C:\Windows\system32\DRIVERS\MbamChameleon.sys MBAMService.exe File opened for modification C:\Windows\SysWOW64\drivers\mbamtestfile.dat 2026-07-09_239fa561ac8e1a047bd19b43f3554eb1_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File created C:\Windows\SysWOW64\drivers\mbamtestfile.dat 2026-07-09_239fa561ac8e1a047bd19b43f3554eb1_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File created C:\Windows\system32\drivers\mbae.sys MBAMInstallerService.exe File created C:\Windows\system32\DRIVERS\MbamElam.sys MBAMService.exe File created C:\Windows\system32\DRIVERS\mbamswissarmy.sys MBAMService.exe - Modifies RDP port number used by Windows 1 TTPs
- Patched UPX-packed file 1 IoCs
Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
resource yara_rule behavioral2/files/0x000c00000001c6a1-1732.dat patched_upx - Sets service image path in registry 3 TTPs 2 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MBAMSwissArmy\ImagePath = "\\SystemRoot\\System32\\Drivers\\mbamswissarmy.sys" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mbamchameleon\ImagePath = "\\SystemRoot\\System32\\Drivers\\MbamChameleon.sys" MBAMService.exe - Checks BIOS information in registry 2 TTPs 6 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion MBAMService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate MBAMService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion mbrescue.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate mbrescue.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 2026-07-09_239fa561ac8e1a047bd19b43f3554eb1_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 2026-07-09_239fa561ac8e1a047bd19b43f3554eb1_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 11 IoCs
pid Process 1064 MBAMInstallerService.exe 1112 MBVpnTunnelService.exe 5972 MBVpnTunnelService.exe 4412 MBAMService.exe 1464 MBAMService.exe 3276 MbamElam.sys 2464 mbamswissarmy.sys 1124 MbamChameleon.sys 4804 Malwarebytes.exe 5932 mbrescue.exe 1452 Malwarebytes.exe - Impair Defenses: Safe Mode Boot 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\MBAMService MBAMInstallerService.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\MBAMService\ = "Service" MBAMInstallerService.exe - Loads dropped DLL 64 IoCs
pid Process 1064 MBAMInstallerService.exe 1064 MBAMInstallerService.exe 1112 MBVpnTunnelService.exe 5972 MBVpnTunnelService.exe 5972 MBVpnTunnelService.exe 1464 MBAMService.exe 1464 MBAMService.exe 1464 MBAMService.exe 1464 MBAMService.exe 1464 MBAMService.exe 1464 MBAMService.exe 1464 MBAMService.exe 1464 MBAMService.exe 1464 MBAMService.exe 1464 MBAMService.exe 1464 MBAMService.exe 1464 MBAMService.exe 1464 MBAMService.exe 1464 MBAMService.exe 1464 MBAMService.exe 1464 MBAMService.exe 1464 MBAMService.exe 1464 MBAMService.exe 1464 MBAMService.exe 1464 MBAMService.exe 1464 MBAMService.exe 1464 MBAMService.exe 1464 MBAMService.exe 1464 MBAMService.exe 1464 MBAMService.exe 1464 MBAMService.exe 1464 MBAMService.exe 1064 MBAMInstallerService.exe 1064 MBAMInstallerService.exe 4804 Malwarebytes.exe 4804 Malwarebytes.exe 4804 Malwarebytes.exe 4804 Malwarebytes.exe 4804 Malwarebytes.exe 4804 Malwarebytes.exe 4804 Malwarebytes.exe 4804 Malwarebytes.exe 4804 Malwarebytes.exe 4804 Malwarebytes.exe 4804 Malwarebytes.exe 4804 Malwarebytes.exe 4804 Malwarebytes.exe 4804 Malwarebytes.exe 4804 Malwarebytes.exe 4804 Malwarebytes.exe 4804 Malwarebytes.exe 4804 Malwarebytes.exe 4804 Malwarebytes.exe 4804 Malwarebytes.exe 4804 Malwarebytes.exe 4804 Malwarebytes.exe 4804 Malwarebytes.exe 4804 Malwarebytes.exe 4804 Malwarebytes.exe 4804 Malwarebytes.exe 4804 Malwarebytes.exe 4804 Malwarebytes.exe 4804 Malwarebytes.exe 4804 Malwarebytes.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Malwarebytes.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\V: MBAMInstallerService.exe File opened (read-only) \??\I: MBAMService.exe File opened (read-only) \??\K: MBAMService.exe File opened (read-only) \??\S: MBAMService.exe File opened (read-only) \??\D: MBAMInstallerService.exe File opened (read-only) \??\I: MBAMInstallerService.exe File opened (read-only) \??\S: MBAMInstallerService.exe File opened (read-only) \??\Z: MBAMInstallerService.exe File opened (read-only) \??\G: MBAMService.exe File opened (read-only) \??\J: MBAMService.exe File opened (read-only) \??\L: MBAMService.exe File opened (read-only) \??\T: MBAMService.exe File opened (read-only) \??\T: MBAMInstallerService.exe File opened (read-only) \??\U: MBAMInstallerService.exe File opened (read-only) \??\P: MBAMService.exe File opened (read-only) \??\R: MBAMService.exe File opened (read-only) \??\U: MBAMService.exe File opened (read-only) \??\V: MBAMService.exe File opened (read-only) \??\B: MBAMInstallerService.exe File opened (read-only) \??\G: MBAMInstallerService.exe File opened (read-only) \??\O: MBAMInstallerService.exe File opened (read-only) \??\X: MBAMInstallerService.exe File opened (read-only) \??\Y: MBAMInstallerService.exe File opened (read-only) \??\A: MBAMService.exe File opened (read-only) \??\M: MBAMService.exe File opened (read-only) \??\Q: MBAMService.exe File opened (read-only) \??\X: MBAMService.exe File opened (read-only) \??\J: MBAMInstallerService.exe File opened (read-only) \??\M: MBAMInstallerService.exe File opened (read-only) \??\W: MBAMInstallerService.exe File opened (read-only) \??\D: MBAMService.exe File opened (read-only) \??\N: MBAMService.exe File opened (read-only) \??\A: MBAMInstallerService.exe File opened (read-only) \??\L: MBAMInstallerService.exe File opened (read-only) \??\B: MBAMService.exe File opened (read-only) \??\H: MBAMService.exe File opened (read-only) \??\O: MBAMService.exe File opened (read-only) \??\Z: MBAMService.exe File opened (read-only) \??\P: MBAMInstallerService.exe File opened (read-only) \??\W: MBAMService.exe File opened (read-only) \??\Y: MBAMService.exe File opened (read-only) \??\H: MBAMInstallerService.exe File opened (read-only) \??\K: MBAMInstallerService.exe File opened (read-only) \??\N: MBAMInstallerService.exe File opened (read-only) \??\Q: MBAMInstallerService.exe File opened (read-only) \??\R: MBAMInstallerService.exe - ConfuserEx .NET packer 1 IoCs
Detects ConfuserEx .NET packer.
resource yara_rule behavioral2/files/0x000c00000001c6a1-1732.dat ConfuserEx - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\86844F70250DD8EF225D6B4178798C21_44AD5D0C299F1D4EE038B125B5E5863A MBAMService.exe File created C:\Windows\System32\DriverStore\FileRepository\netefe3e.inf_amd64_c4fbd94d20e3c73c\netefe3e.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netbc63a.inf_amd64_adc1c27c4a8b0d4f\netbc63a.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\rtux64w10.inf_amd64_382d70e2c349183c\rtux64w10.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\usbncm.inf_amd64_b48ccf297d0cca81\usbncm.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netax88179_178a.inf_amd64_be76888d30e8464a\netax88179_178a.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\net2ic68.inf_amd64_7af2e2aa52ab9b71\net2ic68.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netvf63a.inf_amd64_6d0895d8fed6bb96\netvf63a.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netwtw02.inf_amd64_669639d5a41714fa\netwtw02.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netg664.inf_amd64_f4299f18c1844724\netg664.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netxex64.inf_amd64_01587744078125a1\netxex64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netwtw06.inf_amd64_c5f16d20642e3070\netwtw06.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netathr10x.inf_amd64_e4b0b7be4ba10fc1\netathr10x.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt MBAMService.exe File created C:\Windows\System32\DriverStore\FileRepository\netbxnda.inf_amd64_5cfb6a07d9d75a4a\netbxnda.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netavpna.inf_amd64_27530893ea84631e\netavpna.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netvchannel.inf_amd64_4282c59d3148caa2\netvchannel.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netwtw04.inf_amd64_28271e5be9a9f6f4\netwtw04.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{295822d0-226f-bc47-9352-dadd9f4d5826}\SET10BC.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\86844F70250DD8EF225D6B4178798C21_44AD5D0C299F1D4EE038B125B5E5863A MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94D97B1EC1F43DD6ED4FE7AB95E144BC_38A1221025A0DFB52F454FF8C79E14CC MBAMService.exe File created C:\Windows\System32\DriverStore\FileRepository\netl1c63x64.inf_amd64_20b3691d6e7445a9\netl1c63x64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\wceisvista.inf_amd64_b98fec2fcf3c69e9\wceisvista.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\b57nd60a.inf_amd64_86493878b5fef607\b57nd60a.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\mbtun.inf_amd64_add82795013a7c3b\mbtun.inf DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\e2xw10x64.inf_amd64_b78633a7607613a0\e2xw10x64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\kdnic.inf_amd64_a9d04a55194853d2\kdnic.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{295822d0-226f-bc47-9352-dadd9f4d5826}\mbtun.sys DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\netl160a.inf_amd64_24496b197c188680\netl160a.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netmlx5.inf_amd64_daa0dfc87505ee8d\netmlx5.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netloop.inf_amd64_768107cfce81988e\netloop.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netax88772.inf_amd64_8cf5f634aa308898\netax88772.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\rndiscmp.inf_amd64_e3cf74e485b2778b\rndiscmp.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\c_net.inf_amd64_64490bb3b4dcbb9a\c_net.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netrtwlans.inf_amd64_e0770fc2820687e2\netrtwlans.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07A7CCFBD28A674D95D3BF853C9007C6 MBAMService.exe File created C:\Windows\System32\DriverStore\FileRepository\netvg63a.inf_amd64_dd38edc9e96390ae\netvg63a.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netnvma.inf_amd64_f3a84765144777ee\netnvma.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netwtw08.inf_amd64_448906930b28afd9\netwtw08.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netrndis.inf_amd64_7559d510c51e5594\netrndis.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netjme.inf_amd64_7d2f6f04d092b277\netjme.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\ipoib6x.inf_amd64_c009b0cd3e63f884\ipoib6x.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netnvm64.inf_amd64_3dc2e896fdc07ff7\netnvm64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netrtwlane_13.inf_amd64_34c21e0a7f9c97b4\netrtwlane_13.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netbc64.inf_amd64_4c416384b17ee84f\netbc64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netmlx4eth63.inf_amd64_59e293fc00a669f4\netmlx4eth63.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\mbtun.inf_amd64_add82795013a7c3b.ini DrvInst.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50 MBAMService.exe File created C:\Windows\System32\DriverStore\FileRepository\netr28x.inf_amd64_bd4998128e365665\netr28x.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\ndisimplatformmp.inf_amd64_8f9eb8ff490e6c70\ndisimplatformmp.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\nete1e3e.inf_amd64_71ee3a27d9580084\nete1e3e.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\nete1g3e.inf_amd64_1bcc7029f170b19a\nete1g3e.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\rtwlanu_oldic.inf_amd64_de1bf895eba0afa5\rtwlanu_oldic.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netrtwlanu.inf_amd64_2814b0012fc3a833\netrtwlanu.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\bthpan.inf_amd64_c908ea6dab3e932a\bthpan.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netrtwlane01.inf_amd64_e88ba65a7546f702\netrtwlane01.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\usb4p2pnetadapter.inf_amd64_cc88f42fbf400320\usb4p2pnetadapter.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netwlv64.inf_amd64_786cb697586229e5\netwlv64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\net8187bv64.inf_amd64_4295cf068229eafc\net8187bv64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netsstpa.inf_amd64_a982732ea027811e\netsstpa.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\net7400-x64-n650.inf_amd64_213b9c153c9b4d01\net7400-x64-n650.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{295822d0-226f-bc47-9352-dadd9f4d5826}\SET10AC.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\netathrx.inf_amd64_ba496c81c003f721\netathrx.PNF MBVpnTunnelService.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\PresentationFramework.Classic.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\Microsoft.Xaml.Behaviors.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\ja\System.Windows.Forms.Design.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\System.Windows.Primitives.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\Serilog.Extensions.Logging.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\63873df7-67ad-42ee-9e6c-7b2bbc122c48 2026-07-09_239fa561ac8e1a047bd19b43f3554eb1_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.Security.Cryptography.X509Certificates.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\de\PresentationUI.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\de\UIAutomationClientSideProviders.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\CloudControllerImpl.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\SecurityProductInformation.ini MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\UIAutomationProvider.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\netstandard.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.ComponentModel.Annotations.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\es\Microsoft.VisualBasic.Forms.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\ru\System.Windows.Controls.Ribbon.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.Runtime.Handles.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\PresentationFramework.AeroLite.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\System.Windows.Extensions.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\MBAMCrashHandler.exe MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\es\System.Windows.Forms.Design.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\ko\UIAutomationProvider.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\pl\System.Xaml.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\System.Diagnostics.EventLog.Messages.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\System.Drawing.Common.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\System.Windows.Forms.Design.Editors.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.Net.NetworkInformation.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.Xml.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\de\System.Windows.Input.Manipulations.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\es\UIAutomationProvider.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\pl\System.Windows.Controls.Ribbon.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.Diagnostics.TextWriterTraceListener.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\fr\System.Xaml.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\SQLitePCLRaw.core.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.Collections.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\UIAutomationTypes.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\zh-Hant\PresentationUI.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.IO.Compression.FileSystem.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.Transactions.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\de\UIAutomationProvider.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\System.Security.Cryptography.ProtectedData.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\UIAutomationClientSideProviders.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.Globalization.Extensions.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\pl\UIAutomationClient.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\PresentationFramework-SystemCore.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\pt-BR\System.Windows.Input.Manipulations.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\ru\UIAutomationTypes.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\mb5uns.runtimeconfig.json MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\tr\UIAutomationProvider.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\msquic.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.Collections.Immutable.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.Console.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.Linq.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.Reflection.Metadata.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.Reflection.TypeExtensions.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.Security.Cryptography.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.Linq.Parallel.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.Xml.Linq.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\pt-BR\PresentationUI.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\pt-BR\System.Windows.Forms.Primitives.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\pt-BR\System.Windows.Forms.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\ru\System.Windows.Forms.Design.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\zh-Hans\System.Xaml.resources.dll MBAMInstallerService.exe - Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification C:\Windows\inf\oem1.inf DrvInst.exe File created C:\Windows\inf\oem1.inf DrvInst.exe File created C:\Windows\ELAMBKUP\MbamElam.sys MBAMService.exe File opened for modification C:\Windows\INF\setupapi.dev.log MBVpnTunnelService.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 1 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh MBVpnTunnelService.exe - Modifies trusted root certificate store through registry 1 TTPs 13 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\5A8CEF45D7A69859767A8C8B4496B578CF474B1A\Blob = 0300000001000000140000005a8cef45d7a69859767a8c8b4496b578cf474b1a2000000001000000450500003082054130820329a0030201020213066c9fd29635869f0a0fe58678f85b26bb8a37300d06092a864886f70d01010c05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412032301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f74204341203230820222300d06092a864886f70d01010105000382020f003082020a0282020100ad969f2d9c4a4c4a81795199ec8acb6b605113bc4d6d06fcb0088ddd19106ac7260c35d8c06f2084e994b19b8503c35bdb4ae8c8f89076d95b4fe34ce806364dcc9aac3d0c902b92d4061960ac374479858182ad5a37e00dcc9da64c5276ea439db704d150f655e0d5d2a64985e937e9ca7eae5c954d489a3fae205a6d8895d934b8521a4390b0bf6c05b9b678b7ead0e43a3c125362ff4af27bbe3505a91234e3f36474622c3d00495a28fe3244bb87dd652702713bda4af71fdacdf72155904f0fecae82e19f6bd945d3bbf05f87ed3c2c3986da3fdeec7255eb79a3addbdd7cb0ba1ccefcde4f3576cf0ff8781f6a36514627615be99ecff0a2557d7c258a6f2fb4c5cf842e2bfd0d51106cfb5f1bbc1b7ec5ae3b98013192ff0b57f49ab2b957e9abef0d76d1f0eef4ce86a7e06ee9b469a1df69f633c6692e97139ea587b057108137c953b3bb7ff692d19cd018f4926eda834fa663994ca5fb5eef21647a205f6c648515cb37e9620c0b2a16dc012e32da3e4bf59e3af6174094ef9e910886fabe63a85a33eccb744395f96c695236c7296ffc55035c1ffb9fbd47ebe74947950b4e89220949e0f5611ef1bf2e8a726e8059ff573af97532a34e5feced2862d94d73f2cc811760edcdebdcdba7cac57e02bdf2540854fdb42d092c17544a98d154e1516708d2ed6e7e6f3fd22d81592966cb903995111e7427feddebaf0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414b00cf04c30f405580248fd33e552af4b84e36652300d06092a864886f70d01010c05000382020100aaa8808f0e78a3e0a2d4cde6f5987a3bea0003b0970e93bc5aa8f62c8c7287a9b1fc7f73fd637178a58759cf30e10d10b2135a6d82f56ae6809fa0050b68e4476bc76adfb6fd773272e518fa09f4a0932c5dd28c75857665900c0379b7312363ad788309866884cafff9cf269a9279e7cd4bc5e761a717cbf3a91293936ba7e82f5392c46058b0cc0251185b858d625963b6adb4de9afb26f70027c05d55377499c9507fe3592e44e32c25eeec4c3277b49f1ae94b5d20c5dafd1c8716c643e8d4bb269a45705ea90b3753e2467b27fde046f289b7cc42b6cb28266ed9a5c93ac8411360f7508c15aeb26d1a151a5778e6922ad96590823f6c02afae123a27963604d71da28063a99bf1e5bab47c14b04ec9b11f745f38f651ea9bfa2ca211d4a92d271a45b1afb24e710dc05846d66906cb53cbb3fe6b41cd417e7d4c0f7c72797a59cd5e4a0eac9ba99873797cb4f4ccb9b8070cb2745cb8c76f88a190a7f4aaf9bf673af41a15621eb79fbe3db129af67a112f25810195303301bb81a89f69cbd97038ea309f31d8b21f1b4dfe41cd19f650206ea5cd613b384efa2a55c8c7729a768c06bae40d2a8b4eacdf08d4b389c199a1b2854b88990efca75813e1ef26424c718af4eff479e07f63565a4d30a56fff517646cefa822254993b6df0017da587e5deec51bb0d1d15f2110c7f9f3ba020a2707c5f1d6c7d3e0fb09606c MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\1C58A3A8518E8759BF075B76B750D4F2DF264FCD\Blob = 0300000001000000140000001c58a3a8518e8759bf075b76b750d4f2df264fcd2000000001000000c2040000308204be308203a6a003020102021006d8d904d5584346f68a2fa754227ec4300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3231303431343030303030305a170d3331303431333233353935395a304f310b300906035504061302555331153013060355040a130c446967694365727420496e633129302706035504031320446967694365727420544c53205253412053484132353620323032302043413130820122300d06092a864886f70d01010105000382010f003082010a0282010100c14bb3654770bcdd4f58dbec9cedc366e51f311354ad4a66461f2c0aec6407e52edcdcb90a20eddfe3c4d09e9aa97a1d8288e51156db1e9f58c251e72c340d2ed292e156cbf1795fb3bb87ca25037b9a52416610604f571349f0e8376783dfe7d34b674c2251a6df0e9910ed57517426e27dc7ca622e131b7f238825536fc13458008b84fff8bea75849227b96ada2889b15bca07cdfe951a8d5b0ed37e236b4824b62b5499aecc767d6e33ef5e3d6125e44f1bf71427d58840380b18101faf9ca32bbb48e278727c52b74d4a8d697dec364f9cace53a256bc78178e490329aefb494fa415b9cef25c19576d6b79a72ba2272013b5d03d40d321300793ea99f50203010001a38201823082017e30120603551d130101ff040830060101ff020100301d0603551d0e04160414b76ba2eaa8aa848c79eab4da0f98b2c59576b9f4301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030106082b06010505070302307606082b06010505070101046a3068302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304006082b060105050730028634687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274476c6f62616c526f6f7443412e63727430420603551d1f043b30393037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274476c6f62616c526f6f7443412e63726c303d0603551d2004363034300b06096086480186fd6c02013007060567810c01013008060667810c0102013008060667810c0102023008060667810c010203300d06092a864886f70d01010b050003820101008032ce5e0bdd6e5a0d0aafe1d684cbc08efa8570edda5db30cf72b7540fe850afaf33178b7704b1a8958ba80bdf36b1de97ecf0bba589c59d490d3fd6cfdd0986db771825bcf6d0b5a09d07bdec443d82aa4de9e41265fbb8f99cbddaee1a86f9f87fe74b71f1b20abb14fc6f5675d5d9b3ce9ff69f7616cd6d9f3fd36c6ab038876d24b2e7586e3fcd8557d26c21177df3e02b67cf3ab7b7a86366fb8f7d89371cf86df7330fa7babed2a59c842843b11171a52f3c90e147da25b7267ba71ed574766c5b8024a65345e8bd02a3c209c51994ce7529ef76b112b0d927e1de88aeb36164387ea2a63bf753febdec403bb0a3cf730efebaf4cfc8b3610733ef3a4 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 6b00000001000000200000005367f20c7ade0e2bca790915056d086b720c33c1fa2a2661acf787e3292e1270140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a2030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa20f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e1900000001000000100000009f687581f7ef744ecfc12b9cee6238f12000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 MBAMService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 5c0000000100000004000000001000001900000001000000100000009f687581f7ef744ecfc12b9cee6238f10f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa2140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a26b00000001000000200000005367f20c7ade0e2bca790915056d086b720c33c1fa2a2661acf787e3292e12702000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 MBAMService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54362000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E\Blob = 030000000100000014000000b51c067cee2b0c3df855ab2d92f4fe39d4e70f0e2000000001000000e1030000308203dd308202c5a003020102020100300d06092a864886f70d01010b050030818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a30818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bdedc103fcf68ffc02b16f5b9f48d99d79e2a2b703615618c347b6d7ca3d352e8943f7a1699bde8a1afd13209cb44977322956fdb9ec8cdd22fa72dc276197eef65a84ec6e19b9892cdc845bd574fb6b5fc589a51052894655f4b8751ce67fe454ae4bf85572570219f8177159eb1e280774c59d48be6cb4f4a4b0f364377992c0ec465e7fe16d534c62afcd1f0b63bb3a9dfbfc7900986174cf26824063f3b2726a190d99cad40e75cc37fb8b89c159f1627f5fb35f6530f8a7b74d765a1e765e34c0e89656998ab3f07fa4cdbddc32317c91cfe05f11f86baa495cd19994d1a2e3635b0976b55662e14b741d96d426d4080459d0980e0ee6defcc3ec1f90f10203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147c0c321fa7d9307fc47d68a362a8a1ceab075b27300d06092a864886f70d01010b050003820101001159fa254f036f94993b9a1f828539d47605945ee128936d625d09c2a0a8d4b07538f1346a9de49f8a862651e62cd1c62d6e95204a9201ecb88a677b31e2672e8c9503262e439d4a31f60eb50cbbb7e2377f22ba00a30e7b52fb6bbb3bc4d379514ecd90f4670719c83c467a0d017dc558e76de68530179a24c410e004f7e0f27fd4aa0aff421d37ed94e5645912207738d3323e3881759673fa688fb1cbce1fc5ecfa9c7ecf7eb1f1072db6fcbfcaa4bfd097054abcea18280290bd5478092171d3d17d1dd916b0a9613dd00a0022fcc77bcb0964450b3b4081f77d7c32f598ca588e7d2aee90597364f936745e25a1f566052e7f3915a92afb508b8e8569f4 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa22000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8DA7F965EC5EFC37910F1C6E59FDC1CC6A6EDE16\Blob = 0300000001000000140000008da7f965ec5efc37910f1c6e59fdc1cc6a6ede162000000001000000450300003082034130820229a0030201020213066c9fcf99bf8c0a39e2f0788a43e696365bca300d06092a864886f70d01010b05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412031301e170d3135303532363030303030305a170d3338303131373030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f74204341203130820122300d06092a864886f70d01010105000382010f003082010a0282010100b2788071ca78d5e371af478050747d6ed8d78876f49968f7582160f97484012fac022d86d3a0437a4eb2a4d036ba01be8ddb48c80717364cf4ee8823c73eeb37f5b519f84968b0ded7b976381d619ea4fe8236a5e54a56e445e1f9fdb416fa74da9c9b35392ffab02050066c7ad080b2a6f9afec47198f503807dca2873958f8bad5a9f948673096ee94785e6f89a351c0308666a14566ba54eba3c391f948dcffd1e8302d7d2d747035d78824f79ec4596ebb738717f2324628b843fab71daacab4f29f240e2d4bf7715c5e69ffea9502cb388aae50386fdbfb2d621bc5c71e54e177e067c80f9c8723d63f40207f2080c4804c3e3b24268e04ae6c9ac8aa0d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604148418cc8534ecbc0c94942e08599cc7b2104e0a08300d06092a864886f70d01010b0500038201010098f2375a4190a11ac57651282036230eaee628bbaaf894ae48a4307f1bfc248d4bb4c8a197f6b6f17a70c85393cc0828e39825cf23a4f9de21d37c8509ad4e9a753ac20b6a897876444718656c8d418e3b7f9acbf4b5a750d7052c37e8034bade961a0026ef5f2f0c5b2ed5bb7dcfa945c779e13a57f52ad95f2f8933bde8b5c5bca5a525b60af14f74befa3fb9f40956d3154fc42d3c7461f23add90f48709ad9757871d1724334756e5759c2025c266029cf2319168e8843a5d4e4cb08fb231143e843297262a1a95d5e08d490aeb8d8ce14c2d055f286f6c49343776661c0b9e841d7977860036e4a72aea5d17dba109e866c1b8ab95933f8ebc490bef1b9 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0D44DD8C3C8C1A1A58756481E90F2E2AFFB3D26E\Blob = 0300000001000000140000000d44dd8c3c8c1a1a58756481e90f2e2affb3d26e2000000001000000ba010000308201b63082015ba0030201020213066c9fd5749736663f3b0b9ad9e89e7603f24a300a06082a8648ce3d0403023039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412033301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f7420434120333059301306072a8648ce3d020106082a8648ce3d030107034200042997a7c6417fc00d9be8011b56c6f252a5ba2db212e8d22ed7fac9c5d8aa6d1f73813b3b986b397c33a5c54e868e8017686245577d44581db337e56708eb66dea3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414abb6dbd7069e37ac3086079170c79cc419b178c0300a06082a8648ce3d0403020349003046022100e08592a317b78df92b06a593ac1a98686172fae1a1d0fb1c7860a64399c5b8c40221009c02eff1949cb396f9ebc62af8b62cfe3a901416d78c6324481cdf307dd5683b MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F6108407D6F8BB67980CC2E244C2EBAE1CEF63BE\Blob = 030000000100000014000000f6108407d6f8bb67980cc2e244c2ebae1cef63be2000000001000000f6010000308201f230820178a0030201020213066c9fd7c1bb104c2943e5717b7b2cc81ac10e300a06082a8648ce3d0403033039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412034301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f7420434120343076301006072a8648ce3d020106052b8104002203620004d2ab8a374fa3530dfec18a7b4ba87b464b63b062f62d1bdb087121d200e863bd9a27fbf0396e5dea3da5c981aaa35b2098455d16dbfde8106de39ce0e3bd5f8462f3706433a0cb242f70ba88a12aa075f881ae6206c481db396e29b01efa2e5ca3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414d3ecc73a656ecce1da769a56fb9cf3866d57e581300a06082a8648ce3d040303036800306502303a8b21f1bd7e11add0ef58962fd6eb9d7e908d2bcf6655c32ce328a9700a470ef0375912ff2d9994284e2a4f354d335a023100ea75004e3bc43a941291c958469d211372a7889c8ae44c4adb96d4ac8b6b6b49125333add7e4be24fcb50a76d4a5bc10 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\2AD974A775F73CBDBBD8F5AC3A49255FA8FB1F8C\Blob = 0300000001000000140000002ad974a775f73cbdbbd8f5ac3a49255fa8fb1f8c2000000001000000620400003082045e30820346a0030201020213077312380b9d6688a33b1ed9bf9ccda68e0e0f300d06092a864886f70d01010b05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412031301e170d3232303832333232323132385a170d3330303832333232323132385a303c310b3009060355040613025553310f300d060355040a1306416d617a6f6e311c301a06035504031313416d617a6f6e205253412032303438204d303130820122300d06092a864886f70d01010105000382010f003082010a0282010100eb712ca9cb1f8828923230af8a570f78b73725955587ac675c97d322c8daa214676b7cf067dae2032ab356125dc6b547f96708a7937a9592180fb4f9f910369a7f2f80b64fba134ec75d531ee0dd96330720d396bc12e4745042a1051373b54f9b4424fe2d7fedbc2285ec362133977506ce271882dce3d9c582078d5e26012626671fd93f13cf32ba6bad7864fcaaff0e023c07df9c0578728cfdea75b7032884dae86e078cd05085ef8154b2716eec6d62ef8f94c35ee9c4a4d091c02e249198caeeba258ed4f671b6fb5b6b38064837478d86dcf2ea06fb76377d9eff424e4d588293cfe271c278b17aab4b5b94378881e4d9af24aef872c565fb4bb451e70203010001a382015a3082015630120603551d130101ff040830060101ff020100300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030106082b06010505070302301d0603551d0e0416041481b80e638a891218e5fa3b3b50959fe6e5901385301f0603551d230418301680148418cc8534ecbc0c94942e08599cc7b2104e0a08307b06082b06010505070101046f306d302f06082b060105050730018623687474703a2f2f6f6373702e726f6f746361312e616d617a6f6e74727573742e636f6d303a06082b06010505073002862e687474703a2f2f6372742e726f6f746361312e616d617a6f6e74727573742e636f6d2f726f6f746361312e636572303f0603551d1f043830363034a032a030862e687474703a2f2f63726c2e726f6f746361312e616d617a6f6e74727573742e636f6d2f726f6f746361312e63726c30130603551d20040c300a3008060667810c010201300d06092a864886f70d01010b05000382010100ad00de0205232e063262b46bb19416e41140de2bfa59c135efe0aa8f2b41b9d1f38739001df23db5a7470c0606c691f3075702d4edbd17c1909abf4875a2074f30dd4a6a42b50d3d15c00ffe845bc63c99cc5752b1d86e12d59692934b94e507e88982086a7a34d49e64e13d876a92909a63a14bf88fb6ea34d305be20c2de06e28c9f738b9f4d3985cace19369d85c99ec9f8503fb67e88a1efca84068b50b40a5ca61c44f1fdc8614060f26125aa07f4c7c27375e40c0b428d04e55f4448995b7b898196a7889d4b0d62e804c4d7feb4e8b26dcaecc01cbc385b1ddf85ce5b7ae3494b6cb9a7ddf405b249ade1c5146bc2ccebcd7fd65869bac3207e7fb0b8 MBAMInstallerService.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-09_239fa561ac8e1a047bd19b43f3554eb1_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe - Checks SCSI registry key(s) 3 TTPs 16 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs DrvInst.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MBAMService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MBAMService.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION MBAMInstallerService.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Malwarebytes.exe = "11000" MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION MBAMService.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\mbam.exe = "11000" MBAMService.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\mbamtray.exe = "11000" MBAMService.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\16.0\Common\Security MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\16.0\Common\Security MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\15.0\Common MBAMInstallerService.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Malwarebytes\FirstRun = "false" MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Malwarebytes MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Malwarebytes MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: MBAMInstallerService.exe Set value (str) \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:\ MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MBAMService.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\16.0\Common MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates MBAMInstallerService.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:\ MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\15.0\Common MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:\ MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Malwarebytes MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0 MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\15.0\Common\Security MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\16.0\Common MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0\Common\Security MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\16.0\Common\Security MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:\ MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2058A31F-5F59-4452-9204-03F588252FFC}\TypeLib\Version = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B38EDC4F-A2CD-4F76-8607-F123FE4031D5} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3B42C782-9650-4EFF-9618-91118DF96061}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B44D50B8-E459-4078-9249-3763459B2676}\TypeLib\Version = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C4C41809-DC9B-4791-8F18-3F04C847E62F} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EC676D1E-2E9E-4876-834C-7AF2BCA2E885}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{03141A2A-5C3A-458E-ABEC-0812AD7FF497}\Version\ = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BFC6C7E6-8475-4F9B-AC56-AD22BECF91C4}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B3B24818-1CC9-4825-96A9-1DB596E079C8}\ = "_ILogControllerEvents" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E46A48DF-07CC-4C7F-89BB-145CF0DFC60A}\TypeLib\Version = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{09F245DA-55E7-451E-BDF3-4EE44637DFF1}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{636AD0C8-854C-46A5-8442-E5EE74723B3C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{46AEAC9A-C091-4B63-926C-37CFBD9D244F}\TypeLib\ = "{FFB94DF8-FC15-411C-B443-E937085E2AC1}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{638A43D2-5475-424B-87B8-042109D7768F}\ProxyStubClsid32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{78E69E6F-EC12-4B84-8431-1D68572C7A61}\ProxyStubClsid32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C0CEAFA7-4F65-418C-8A61-92B2048115EE}\ProxyStubClsid32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0E4540C9-F666-4664-851E-128A06EF5F03} MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CFFF19F6-ECFE-446D-ACAD-8DC525DA2563} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2DFD7E94-47E6-483A-B4FD-DC586A52CE5D}\ = "_ILicenseControllerEventsV2" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6EC225D5-FD37-4F9B-B80F-09FAE36103AE} MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2E423AF9-25D2-451E-8D81-08D44F63D83F}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{77EC89F7-64B9-4192-930B-B7B0A3976BBC}\ = "ISPControllerV7" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8C842243-BDAD-4A93-B282-93E3FCBC1CA4} MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{61964EBA-D9C0-4834-B01C-A6133F432BB1} MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AC5390D0-3831-4D42-BD1D-8151A5A1742C}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BE6DEC4E-1BDE-49DA-AFDD-D979539A9A0D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{09F245DA-55E7-451E-BDF3-4EE44637DFF1} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{83D0C30B-ECF4-40C5-80EC-21BB47F898A9}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FFBD938D-3ABA-4895-97EF-5A0BDF7AC07D}\ = "_IPoliciesControllerEventsV2" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0070F531-5D6B-4302-ACA0-6920E95D9A31}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{748A86D4-7EDF-41EF-A1EF-9582643B1C9F}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9CFA1689-38D3-4AE9-B1E8-B039EB7AD988}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{985DFDFE-853A-48AE-93C1-E533391817D6}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8DF5CCD7-6442-495E-9016-B4AF5B9110A6}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1A173904-D20F-4872-93D5-CBC1336AE0D6} MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1A173904-D20F-4872-93D5-CBC1336AE0D6}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{05510285-C4B6-4AFD-971B-EBE3139F45A3} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{44864E51-B63C-49C2-89CF-CA8F5F15564D}\TypeLib\Version = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{66328184-6592-46BE-B950-4FDA4417DF2E}\ProxyStubClsid32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4F9DF82A-36EA-4E90-BF20-CCBB6B66117F}\ProxyStubClsid32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F275D775-3A22-4C5A-B9AD-6FE8008304D0}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3C871BA6-4662-4E17-ABF4-3B2276FC0FF4}\TypeLib\Version = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57CE581A-0CB6-4266-9CA0-19364C90A0B3}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{97DA9E74-558F-4085-AE41-6A82ED12D02C} MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{81541635-736E-4460-81AA-86118F313CD5}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{44AC1571-055F-4CC8-B7D8-EA022C4CC112}\TypeLib\Version = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{49F6AC60-2104-42C6-8F71-B3916D5AA732}\1.0\FLAGS MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9F798C4B-4059-46F9-A0FE-F6B1664ADE96}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{59DBD1B8-A7BD-4322-998F-41B0D2516FA0}\1.0\0\win64 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0B14402F-4F35-443E-A34E-0F511098C644}\TypeLib\ = "{A82129F1-32E1-4D79-A39F-EBFEE53A70BF}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E32ABD9A-1CBD-44A5-8A62-55D347D3C4F0}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{24F9231B-265E-4C66-B10B-D438EF1EB510}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C8952062-7422-4BAD-8A60-94E21F5CFE7C}\ = "IRTPControllerV22" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{ADA09B8D-A536-4429-8331-49808442D24B}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6B3DFEA6-6514-42CF-A091-C4DFFD9C2158}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B44D50B8-E459-4078-9249-3763459B2676}\ = "ILicenseControllerV6" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E32ABD9A-1CBD-44A5-8A62-55D347D3C4F0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F275D775-3A22-4C5A-B9AD-6FE8008304D0}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B59F38D8-23CF-4D7F-BAE8-939738B3001B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{63A6AB57-4679-4529-B78D-143547B22799}\TypeLib\ = "{A82129F1-32E1-4D79-A39F-EBFEE53A70BF}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BD9CB7A5-5C46-4799-A3A4-20FB128E58F1}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{18C5830A-FF78-4172-9DFB-E4016D1C1F31}\TypeLib\ = "{FFB94DF8-FC15-411C-B443-E937085E2AC1}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A0B9A582-5C93-41EF-A196-75B1DE8D4A8A}\ProxyStubClsid32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9BFD0661-4D6A-4607-8450-2EF79859A415}\TypeLib MBAMService.exe - Modifies system certificate store 2 TTPs 12 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0D44DD8C3C8C1A1A58756481E90F2E2AFFB3D26E MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\1C58A3A8518E8759BF075B76B750D4F2DF264FCD MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8DA7F965EC5EFC37910F1C6E59FDC1CC6A6EDE16 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\5A8CEF45D7A69859767A8C8B4496B578CF474B1A MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F6108407D6F8BB67980CC2E244C2EBAE1CEF63BE MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\2AD974A775F73CBDBBD8F5AC3A49255FA8FB1F8C MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2 MBAMService.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4732 2026-07-09_239fa561ac8e1a047bd19b43f3554eb1_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 4732 2026-07-09_239fa561ac8e1a047bd19b43f3554eb1_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1064 MBAMInstallerService.exe 1064 MBAMInstallerService.exe 1064 MBAMInstallerService.exe 1064 MBAMInstallerService.exe 1064 MBAMInstallerService.exe 1064 MBAMInstallerService.exe 1064 MBAMInstallerService.exe 1064 MBAMInstallerService.exe 1064 MBAMInstallerService.exe 1064 MBAMInstallerService.exe 1064 MBAMInstallerService.exe 1064 MBAMInstallerService.exe 1064 MBAMInstallerService.exe 1064 MBAMInstallerService.exe 1064 MBAMInstallerService.exe 1064 MBAMInstallerService.exe 1064 MBAMInstallerService.exe 1064 MBAMInstallerService.exe 1064 MBAMInstallerService.exe 1064 MBAMInstallerService.exe 1064 MBAMInstallerService.exe 1064 MBAMInstallerService.exe 1064 MBAMInstallerService.exe 1064 MBAMInstallerService.exe 1064 MBAMInstallerService.exe 1064 MBAMInstallerService.exe 1064 MBAMInstallerService.exe 1064 MBAMInstallerService.exe 1064 MBAMInstallerService.exe 1064 MBAMInstallerService.exe 1464 MBAMService.exe 1464 MBAMService.exe 1452 Malwarebytes.exe 1452 Malwarebytes.exe 1452 Malwarebytes.exe 1452 Malwarebytes.exe 1452 Malwarebytes.exe 1452 Malwarebytes.exe 1452 Malwarebytes.exe 1452 Malwarebytes.exe 1452 Malwarebytes.exe 1452 Malwarebytes.exe 1452 Malwarebytes.exe 1452 Malwarebytes.exe 1452 Malwarebytes.exe 1452 Malwarebytes.exe 1452 Malwarebytes.exe 1452 Malwarebytes.exe 1452 Malwarebytes.exe 1452 Malwarebytes.exe 1452 Malwarebytes.exe 1452 Malwarebytes.exe 1452 Malwarebytes.exe 1452 Malwarebytes.exe 1452 Malwarebytes.exe 1452 Malwarebytes.exe 1452 Malwarebytes.exe 1452 Malwarebytes.exe 1452 Malwarebytes.exe 1452 Malwarebytes.exe 1452 Malwarebytes.exe 1452 Malwarebytes.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 820 Process not Found 820 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1064 MBAMInstallerService.exe Token: SeDebugPrivilege 1064 MBAMInstallerService.exe Token: SeDebugPrivilege 1064 MBAMInstallerService.exe Token: SeDebugPrivilege 1064 MBAMInstallerService.exe Token: SeDebugPrivilege 1064 MBAMInstallerService.exe Token: SeDebugPrivilege 1064 MBAMInstallerService.exe Token: SeDebugPrivilege 1064 MBAMInstallerService.exe Token: SeDebugPrivilege 1064 MBAMInstallerService.exe Token: SeDebugPrivilege 1064 MBAMInstallerService.exe Token: SeDebugPrivilege 1064 MBAMInstallerService.exe Token: SeDebugPrivilege 1064 MBAMInstallerService.exe Token: SeDebugPrivilege 1064 MBAMInstallerService.exe Token: SeDebugPrivilege 1064 MBAMInstallerService.exe Token: SeDebugPrivilege 1064 MBAMInstallerService.exe Token: SeDebugPrivilege 1064 MBAMInstallerService.exe Token: SeDebugPrivilege 1064 MBAMInstallerService.exe Token: SeDebugPrivilege 1064 MBAMInstallerService.exe Token: SeDebugPrivilege 1064 MBAMInstallerService.exe Token: SeDebugPrivilege 1064 MBAMInstallerService.exe Token: SeDebugPrivilege 1064 MBAMInstallerService.exe Token: SeDebugPrivilege 1064 MBAMInstallerService.exe Token: SeDebugPrivilege 1064 MBAMInstallerService.exe Token: SeDebugPrivilege 1064 MBAMInstallerService.exe Token: SeDebugPrivilege 1064 MBAMInstallerService.exe Token: SeDebugPrivilege 1064 MBAMInstallerService.exe Token: SeDebugPrivilege 1064 MBAMInstallerService.exe Token: SeDebugPrivilege 1064 MBAMInstallerService.exe Token: SeDebugPrivilege 1064 MBAMInstallerService.exe Token: SeDebugPrivilege 1064 MBAMInstallerService.exe Token: SeDebugPrivilege 1064 MBAMInstallerService.exe Token: SeDebugPrivilege 1064 MBAMInstallerService.exe Token: SeDebugPrivilege 1064 MBAMInstallerService.exe Token: SeDebugPrivilege 1064 MBAMInstallerService.exe Token: SeDebugPrivilege 1064 MBAMInstallerService.exe Token: SeDebugPrivilege 1064 MBAMInstallerService.exe Token: SeDebugPrivilege 1064 MBAMInstallerService.exe Token: SeDebugPrivilege 1064 MBAMInstallerService.exe Token: SeDebugPrivilege 1064 MBAMInstallerService.exe Token: SeDebugPrivilege 1064 MBAMInstallerService.exe Token: SeDebugPrivilege 1064 MBAMInstallerService.exe Token: SeDebugPrivilege 1064 MBAMInstallerService.exe Token: SeDebugPrivilege 1064 MBAMInstallerService.exe Token: SeDebugPrivilege 1064 MBAMInstallerService.exe Token: SeDebugPrivilege 1064 MBAMInstallerService.exe Token: SeDebugPrivilege 1064 MBAMInstallerService.exe Token: SeDebugPrivilege 1064 MBAMInstallerService.exe Token: SeDebugPrivilege 1064 MBAMInstallerService.exe Token: SeDebugPrivilege 1064 MBAMInstallerService.exe Token: SeDebugPrivilege 1064 MBAMInstallerService.exe Token: SeDebugPrivilege 1064 MBAMInstallerService.exe Token: SeDebugPrivilege 1064 MBAMInstallerService.exe Token: SeDebugPrivilege 1064 MBAMInstallerService.exe Token: SeDebugPrivilege 1064 MBAMInstallerService.exe Token: SeDebugPrivilege 1064 MBAMInstallerService.exe Token: SeDebugPrivilege 1064 MBAMInstallerService.exe Token: SeDebugPrivilege 1064 MBAMInstallerService.exe Token: SeDebugPrivilege 1064 MBAMInstallerService.exe Token: SeDebugPrivilege 1064 MBAMInstallerService.exe Token: SeDebugPrivilege 1064 MBAMInstallerService.exe Token: SeDebugPrivilege 1064 MBAMInstallerService.exe Token: SeDebugPrivilege 1064 MBAMInstallerService.exe Token: SeDebugPrivilege 1064 MBAMInstallerService.exe Token: SeDebugPrivilege 1064 MBAMInstallerService.exe Token: SeDebugPrivilege 1064 MBAMInstallerService.exe - Suspicious use of FindShellTrayWindow 9 IoCs
pid Process 4732 2026-07-09_239fa561ac8e1a047bd19b43f3554eb1_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1452 Malwarebytes.exe 1452 Malwarebytes.exe 1452 Malwarebytes.exe 1452 Malwarebytes.exe 1452 Malwarebytes.exe 1452 Malwarebytes.exe 1452 Malwarebytes.exe 1452 Malwarebytes.exe - Suspicious use of SendNotifyMessage 6 IoCs
pid Process 1452 Malwarebytes.exe 1452 Malwarebytes.exe 1452 Malwarebytes.exe 1452 Malwarebytes.exe 1452 Malwarebytes.exe 1452 Malwarebytes.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 1064 wrote to memory of 1112 1064 MBAMInstallerService.exe 91 PID 1064 wrote to memory of 4412 1064 MBAMInstallerService.exe 96 PID 4732 wrote to memory of 4804 4732 2026-07-09_239fa561ac8e1a047bd19b43f3554eb1_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 106 PID 1464 wrote to memory of 5932 1464 MBAMService.exe 108 PID 4804 wrote to memory of 1452 4804 Malwarebytes.exe 110
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\2026-07-09_239fa561ac8e1a047bd19b43f3554eb1_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-09_239fa561ac8e1a047bd19b43f3554eb1_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Checks BIOS information in registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4732
-
-
C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe"C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe"C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe"3⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1452
-
-
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- Modifies trusted root certificate store through registry
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe" /installmbtun2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
PID:1112
-
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe" /Service /Protected2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
PID:4412
-
-
C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Event Triggered Execution: Netsh Helper DLL
PID:5972
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "9" "C:\Program Files\Malwarebytes\Anti-Malware\mbtun\mbtun.inf" "9" "4ba9030c7" "0000000000000184" "Service-0x0-3e7$\Default" "000000000000016C" "208" "C:\Program Files\Malwarebytes\Anti-Malware\mbtun"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:4760
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Modifies trusted root certificate store through registry
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\ProgramData\Malwarebytes\MBAMService\rmode\mbrescue.exe"C:\ProgramData\Malwarebytes\MBAMService\rmode\mbrescue.exe" /rescuemode "C:\Program Files\Malwarebytes\Anti-Malware" "C:\ProgramData\Malwarebytes\MBAMService"2⤵
- Checks BIOS information in registry
- Executes dropped EXE
PID:5932
-
-
C:\Windows\system32\DRIVERS\MbamElam.sysC:\Windows\system32\DRIVERS\MbamElam.sys1⤵
- Executes dropped EXE
PID:3276
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k AppReadiness -p -s AppReadiness1⤵PID:1340
-
C:\Windows\system32\DRIVERS\mbamswissarmy.sysC:\Windows\system32\DRIVERS\mbamswissarmy.sys1⤵
- Executes dropped EXE
PID:2464
-
C:\Windows\system32\DRIVERS\MbamChameleon.sysC:\Windows\system32\DRIVERS\MbamChameleon.sys1⤵
- Executes dropped EXE
PID:1124
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
2Component Object Model Hijacking
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
2Component Object Model Hijacking
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
1Safe Mode Boot
1Modify Registry
3Subvert Trust Controls
2Install Root Certificate
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\PROGRA~1\MALWAR~1\ANTI-M~1\mbtun\mbtun.cat
- Size 10KB
- SHA256 9ceb410494b95397ec1f8fa505d071672bf61f81cc596b8eccd167a77893c658
- MD5 8abff1fbf08d70c1681a9b20384dbbf9
- SHA1 c9762e121e4f8a7ad931eee58ee60c8e9fc3ecb6
- SHA512 37998e0aee93ff47fe5b1636fce755966debe417a790e1aebd7674c86c1583feef04648a7bc79e4dedaabb731051f4f803932ac49ea0be05776c0f4d218b076f
- SSDEEP 192:gM6dynJCSEJOL7yKnUi8rFWQFIGjl8zjEswYt1FfRM/GX01k9z3AeOlFa:gqS4CFRWGjl8M8/fi/GR9z/OlFa
- TLSH T1B43208E1897D84C2ED87A87147E8E5977C3C1BCB2C5055A911ABF7600AA33C6E71853D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\PROGRA~1\MALWAR~1\ANTI-M~1\mbtun\mbtun.sys
- Size 107KB
- SHA256 6903e60784b9fa5d8b417f93f19665c59946a4de099bd1011ab36271b267261c
- MD5 83d4fba999eb8b34047c38fabef60243
- SHA1 25731b57e9968282610f337bc6d769aa26af4938
- SHA512 47faab5fff3e3e2d2aea0a425444aa2e215f1d5bf97edee2a3bb773468e1092919036bcd5002357594b62519bf3a8980749d8d0f6402de0e73c2125d26e78f1e
- SSDEEP 1536:k0h5S895dQOYJaryTmbMc6uqkZUcmSl47AjpdAyDCYJqUufIfmNn3VzwZ6Dh7Q9y:C895uOYJar1MLcmSlrSgC6Duls2t
- TLSH T174B36C9DA1783089DE42A6B482B98793EFB4357A2B1177BF01E1C1748F537C0DB29DA4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\7z.dll
- Size 1.6MB
- SHA256 623e628393bc4b8131c1f4302b195429dfa67e890d3325ceaa56940660052b1b
- MD5 4da585f081e096a43a574f4f4167947e
- SHA1 38c81c6deae0e6d35c64c060b26271413a176a49
- SHA512 0fe168bf1661691dbaa103e478dd7e46b476db094bf1938bf1ad12ddb8a8f371bf611ff504d2eb3ac319862444cc64a27ebee8735aa3752aa32a399b09427243
- SSDEEP 24576:a9raURTF/5pe2g5RpBDxSjv9IrqLwRpFEDbt7y0MVoAAlzi8pY:a9hP/5petvSjWZR8DxO0mo5M8pY
- TLSH T16F756D5BF67400A4D5D6C034C5276B1BEAB1B88B8330A7EF12D15A6B6F13BF19979320
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\AEControllerImpl.dll
- Size 4.9MB
- SHA256 f15b0afd904825c8e653fb305bf5248571566a9d59aac9d3202aad549d746e1a
- MD5 2821718912293886e9b97f75497b91a1
- SHA1 00db15cfc8b947e43ffa9116abfd5552bcac8d69
- SHA512 f3fe52dae9adccedc989734ec834d84cb22154751cbe0d7d8f9f51b00fcab920b8030743b1f81b1b9655b956b1532a69a62272d3b33da7b9a1abe598fb2f9784
- SSDEEP 49152:89QcNVHvFJa0GV9Tkq9HWsMyhXTnXRUHNNWjwJZ1yWBEsUXH7PWnE8q12VPvUbAL:y0XTnMmPsUXbPWNPvcYLUw
- TLSH T1E8368D16A7F401A8C8B6C23CCA578503D7B2BC154730DBDF16A4966A1FB3BE1563EB24
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\Actions.dll
- Size 6.1MB
- SHA256 d513f3a50ec070bbd74f78d27d79b6cb60aff48310283c74ebeb204aacf375a4
- MD5 923a9fe2404277f490bc959493f48e72
- SHA1 563c8dcc7adf7fcd2c706be7ac56ed79c52aacf9
- SHA512 5bdbe65ffd24380d423c3d2bef220e29c39622551edff942f643e79e50ea582439b9e7e91387ef020d44e2462721dda089a83566c76ba1287c2dd917e4fe4194
- SSDEEP 49152:v9x1737qVRJXwMb5WOXz2aXjAr0dcOyccpFZckK/xjDzBE+WjYFJWgP4FNJe5RRe:X97ELkwdchTNOAjYFsG4EGmzqZzhaa
- TLSH T196564B16A7E801A4E0B2C178EEF79103EAB27C255735CBDF0590525E0E73BE09A7BB15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\ActionsShim.dll
- Size 3.7MB
- SHA256 6c5047cb77ea843e8386ba2b26a8458e6255e2ab94d493e914620623723c6b32
- MD5 33617cde11d2bfcef47faf0d5ce3cef9
- SHA1 2439b5f0622cd539b6f6f2f87d78edba466299ed
- SHA512 ef909e5e6a695a0f2ae95621cf87795705b3d267ea7d1c82634faeff3a4e3b111f5f809cd9e7dbb71d588d6106e0b54c138364f99ba41c7c5d47cde9af1b753e
- SSDEEP 49152:SH0QptrM88LLHy9nqSk5n9BT1vAPZmbLMo7JTfYkwZdPHFszUlE3JqCx9R345GEm:ktro8k3booBovlE3JqCx9R345GEzul
- TLSH T16E068B17EB9540A8CC6AD23C855B8607D7B2BC25237097CF17B462AA1FB3BE1523E714
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\ArwControllerImpl.dll
- Size 5.5MB
- SHA256 4c0ed13fa8a08e2d8f7673ddf1efbf47721559de4b47d38de3346802a1272032
- MD5 1b552d86386f4e4036b401010c90eb70
- SHA1 7c8720046f527689f3145cf1db77d6ad00c49e1c
- SHA512 f0413f26feefe4b4b632e6b1f5f7b04a2f362ffe4b07784c6925c8795c16f5d2a20f354ff065ee5225140e4478acaa1bdeb121931548a0394fefaaad5a54b0de
- SSDEEP 49152:cymAlMSQPVZ2Uhn7QhtOFByC5fcRChNvvTsDYMTSltO36boBTzvEfOaXErkdlwDc:c3AljgV/htzJusfQkdnTYYYz1XPU
- TLSH T1C0468E1AB6E500A8D8B6C23CCA578513D7B2BC154731DBDF06A466AA1F73BE0473EB14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\BrowserSDKDLL.dll
- Size 7.0MB
- SHA256 c72e39709b26ac7577200a76515347ff11c0a9424cf61657762d657e7aecd974
- MD5 36b6cdd3677d6a079cd21768ffacbc7e
- SHA1 e525b6c778d7b59ef06300cc980f63bcf581a24a
- SHA512 e106563a21063eba244b536e67ececf2630415d5857af8aa67bedecabb39a87799324c3024bcf84487fbd9cfb76dc24b27ebb881734b4157a38b5c74d538ec3e
- SSDEEP 49152:8VF1SVg1db+wMSI0nW5xjpvypuDYpsD0VXZTWqls/e9uETWgjB+S/YfbWf2zv7je:s8TeZKT+X6S/Yf6fITlRChya9Fx
- TLSH T113768D17B6A400A9D8BBC17CCA578603EBB2BC06577097CF16A4966E1F73BE0563E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\BrowserSDKDLLShim.dll
- Size 3.7MB
- SHA256 f6d24605eb688e039e4509d184d974bb14c4c38528edad129d0653eadfea80f9
- MD5 889529ee7dadd23f11ed5b3fdd1f5b79
- SHA1 3e8a1bee4d28102aeb4c6f2eb94946282ffa7e12
- SHA512 bcd57045d516232828003b2b970b457138cebafbfbf2bf762199c291228b2cd674d8084190fee22f0adf047e8f2ac20644712313cfb5f90289a83fd6698995ec
- SSDEEP 49152:aHENZh/xwXNNnfFEXqGW3nILlpqCBS6+38Q/h0oYEaF6r+jep6Plw3zUoC02n:TOX/xPb/aomGIoIn
- TLSH T1E2067B17EB9500A8CC6AD23C856B8607D7B2BC25677097CF1AB462791FB3BE1123E714
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\CleanControllerImpl.dll
- Size 8.7MB
- SHA256 d85916bd0b4ef3f1aa9abf108d0f6a9541b0ff690fe71af8fb90dd4139f411a0
- MD5 8a8f67c8ba548aa10ea7487df93927aa
- SHA1 6d8655192e857c5f0ca42ba41dd35a866d793c60
- SHA512 ecd6ee84c2f0f14fee86c1ef285608b09374203b72279b4812618860d29525818ff89d36ca0e66937318ead393bf619c7a4c8d49ae6d91653845837018a5b55e
- SSDEEP 98304:yzyEQ2D+Lbhak7wUBLCGJeUDutjCa7TtryqnYW0mhDMpw:r2D+ok7wUUzUDutjp7TtryqYbCD9
- TLSH T130968E5A66E400E8E4F6D178CE678503DBB2BC551731D7DF0690966A1F73BE08A3EB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\CloudControllerImpl.dll
- Size 6.9MB
- SHA256 71b6312c8f6bd8e62c7f766ed56dea99f9daca0963039128ba11e4b6842b0922
- MD5 8a15daa8a9ea233265e4dbf5cf2cd9bf
- SHA1 08cd446e2148825fb3b6bce135758b264107284a
- SHA512 6741c89bfb611dc1790116c7ab6ddad5726c68aa22a53921281f0f8ceac6fe02b044b58992941cd3fe997f65880513b853303f70fb4c3496bc71b782ef54ab9b
- SSDEEP 98304:mMoK/6tfchVTu/EKdD3fcXJv9tzjfalW9h/PR:voK/6ZchVyEKdDPc5v9tag9/
- TLSH T160769E6BA6E400A8D8B7D13CCA578503DBB2B81553319BDF06A4967A1F73BE0573EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\LicenseControllerImpl.dll
- Size 7.1MB
- SHA256 14d0f6b8a3c404e7773458b731edcde63a94f3f09adf2489ff837e0e3b9f7098
- MD5 fced76fd9efcc97dbfe06c4071ed475a
- SHA1 adbfd23a4fb7848d9684eb66af5d907cfa090643
- SHA512 ed4bbdbfd89b90ac2ec21ba202774e2837079aef9cb93e0e0a19196e3c38163f355ab37390507859fc084ea26c64ca4d6977374f93abcbb3d0d4e7af7f8255ba
- SSDEEP 98304:geZ10ipuowSwUdI/xFf6ehXvat5LKnCJ5lM96R:/j02uowTqI/xFf6SXSt5xd/R
- TLSH T13C769E6AA7E400ACD4B6C27CCA678503D7B2B8154371D7DF06A4966E1F73BE0963EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
- Size 10.6MB
- SHA256 d10e04217f81b44667c6237971f1f2843d132220c8712e8a855436e9f1f73baa
- MD5 cdd8c06c1f88f57727813906e3a58fb5
- SHA1 4ba873161c0ab0f489bb0c82a267aac8b0cb91dc
- SHA512 40fb64f723481e9b8e24d88edff74dbb85b2e63790595c067b01cc5986ac3a0fdeef0d8083e4c86c0e2681837cb53eb98e7bda2bcb22eb77d1b8330e2d72ef73
- SSDEEP 196608:PRO3j3Ld/5Mo9/vEvt2teG35tTdnXo9076gZCN3R9i:PROT7d/6o9XEvt2teG3p42Yi
- TLSH T10DB69E17A6B400E8D4F7D238CA579A03D7B2B81643B197CF0690567A1F63BE19E3EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\MBAMShim.dll
- Size 4.3MB
- SHA256 dcc714dd199d9768faa0ca212e63efe63caa8aeb4cb11487fa389ff59f6cf98d
- MD5 5be75744f4065e88aeda92344b999ada
- SHA1 48347bd7c99adf4e1c8407c0f56b2017ef8e5525
- SHA512 53cba40ed9450dc83c8fc6e522b567884c1a7b858f708930f164fb5eaafb4d6972625eeb35b7d5d01d754f7c7af7727ecf08efb37de6541ec637021fa06c6613
- SSDEEP 49152:+6s9rQzE4CYJQEw34L4lvXYsFFXBulqfCbLqmsc/6ZeFYpA8aIJammPsQzUOu+/x:rs9rVzYJGrsSCbvyg8aeTO/Z2JgH3
- TLSH T138267D17ABE801A8D87AC23885A78603E7B3BC16077097CF1A64557A1FB3BD15A3F714
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
- Size 4.1MB
- SHA256 a67f94a3014d93b9b91f0c8427c81cc18cb13239a114d91c51f993702e60a580
- MD5 88138b3ddd9b2800ea155743aa26fe87
- SHA1 0b45bd01e388bf4821a3caa09e78033588f66667
- SHA512 4f2f2f04c1b3c1d55731d7dc55fa3ee09385b8f77084e79ebde5252242008eb3362beb9b50b3ea8934acc471dcef67763f20d5268f6cb18bfb98926e4189c3b3
- SSDEEP 49152:0JxO5tmuSoHE4RtMMoLPqf/nkMq1BmwlxMOqSv6bi36i6X43jtPQ6zU+5pAqIPIS:8Y5tY4RMk6lxMObN6/tbH
- TLSH T188168D57A7A901E8D8A6C23CC4678603E7B2BC151770A7CF0664627A1FB3AD25F3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnel_mbtun.dll
- Size 4.2MB
- SHA256 0b764892f7f32d385684411e647f69f428067180aa28315d71668d3ab25b335e
- MD5 ca4f7f1ffd364bdb46dbbb8bd1319125
- SHA1 a2d8a1a3401a93da3303376e37e6ae36e08c693d
- SHA512 522a23be06d466db16e9abe89897e8562ef1fab483285c37c5ff43468e084a91ea78892ea9225c2da589e440e84034d23b0236af99182ed6d1eb118b4e0dc273
- SSDEEP 49152:lBPD6Io8w4LcTwEDRzTJoeM9YSxjQ5g+o9h6iO0oFjn2Q1Z0NwEIx6:PDG8VQkgRzSeMfn+ofU1M
- TLSH T1C8164B02F8B205B9F2BEF131C9A963217A31749503327B871F9195692A66FE47E3D313
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\MWACControllerImpl.dll
- Size 7.5MB
- SHA256 de2dae4a12a73667b42dc5eaeb3789e03481d8797c0257e32eb86ed5e83c5e3c
- MD5 3736bb99f7d117c33f60d37dc3f7c91b
- SHA1 f5a60bec3b93322f1c9f1877e1d46440574176fb
- SHA512 1e0297efc86f791d99b7ecb71afb58c7511a9439940d9c147c917cd059894635ba9ab8e299159078fd6aaec3826f146a9c0e29c06a1b4cdaed240a89f0872ccc
- SSDEEP 196608:oG+QckqcOt+Uc1eNa+ZmQ/Y3UftzVxmGOtvW:OQccm+UcANa+hY3wLmGOtvW
- TLSH T1A6866C1AE7B940E4D8B6C238D9636613FA727C298730A7DF0664575A0F73BE0963E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.dll
- Size 10.8MB
- SHA256 7614667bd520d84f6f448e9e63d43e692705180391734f51d77222313d2e96f2
- MD5 cbb2570609ce05ac2385e59ca42d6b9f
- SHA1 fa192a9f903341bd1b9f92697c148a36feabddbf
- SHA512 5b7b0fde52a262696762bf604bf8fd1e1930f02ad10ed15a8011985a05816b3f51cf72c0ada00a4da269feabcc1b00b0854f707e2185534b0b0850b3bdfcc8bf
- SSDEEP 98304:pl+KcO0nfScO36njmZGva7Uq2UaULsPdo8qh9dykOf3QkpQuNNbzRc2kotVmCPb+:pQKcO0nFKNZCfUYaXOf3fp8Lmwso
- TLSH T155B6E10567BC4E38CED70BF1582203189975B58222E2873D93CE5C3EBC95F558E19AAF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe
- Size 304KB
- SHA256 6ee6ed189cb0fecfc628c6e74bce9b019d33b947d9c1e4d98a7f3cc58a933b30
- MD5 10ff1005d06d1d7630f5a57be5541642
- SHA1 92e39ff3b5cb5c73ffd07bd87cac1e940dbecaae
- SHA512 7547952023238c8c37c1257d069a817f8af0c8d4c7e84dc58e06e34dcaab6d1c14665305d8eef217d179ce26c05616b6e64c0474a0cbccb8f1fdd745901a7cfd
- SSDEEP 3072:AXwANETcQt1Onb5RHrfqDQXFn4dPPYseJwmZf2jT67b2aPO7vj5W8fNCQ:ulxnlRLfyQXN42D0GtObjP0Q
- TLSH T1F6644B03969850BAEDE6D638CD918B41F732785A4BF366CB13505ABA1F72FD05E39302
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\PoliciesControllerImpl.dll
- Size 6.1MB
- SHA256 cd1e8f98551fb69d3d47837c09fea35be358dd7c27104afb7f1938a7fadbb2c5
- MD5 436a5828103f6874dda5ca0b32e8e8ec
- SHA1 7a5346221f40349881a65df91014114b1644c8f8
- SHA512 a4ce868855d83ad112b528a4969e5a5f79a115eb92f9e3ef1f05eb09f7f39c099abb162bbf2024b298af715560d81d9f08c2457109d7b2b33c04dff9789dbd05
- SSDEEP 98304:at69nEVAZKwY4Lka7NrGWeG0qwtEQ9VsAwbB:aAnEVmKv4Lka7NrGWJ0qwtP749
- TLSH T1C8569D1BA6E800A8D8B6D13CCA978513E7B2BC15177197CF06A4967A1F73BE05B3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\RTPControllerImpl.dll
- Size 6.4MB
- SHA256 ca857f122db3d8d65e81969cefc3e9d42243e85f72a0567a369236b82ca0ee34
- MD5 3655926d24f1c520b1608bf65c81c8f1
- SHA1 6002cf0fe55bb5af8a95478b5770a0122c3dbcf9
- SHA512 c7c7cd8a54a7e36041ecc70f66d6ecff1b180ce803ed8fce58316783a25827a63c096bfc4ec9e10840b2f6201b2fb0cd127943b9e6e61ac16ac8e4fd491859a8
- SSDEEP 49152:rhtSXXcKHwcgDwLRm3dDwgv6lQfMDylO/phDShUThdOJrUDz6wPP9ulBCdQ5g1Xw:ttwzJuKhdOsTnO+1hXRIvFpL274uk
- TLSH T19F667C1AB6E400A8D4B6D238CA678513DBB2BC554731D7DF06A0966E1F73BE0973EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\SPControllerImpl.dll
- Size 4.5MB
- SHA256 6563c8273b0285bb2db5df55c8a707b76ed9215739b78ea4e2f954ee1025ef12
- MD5 efaf9a951675b1d23cf37e6f0cb9a02b
- SHA1 ec1edd6046df2d78f26a708db865c16065bc5021
- SHA512 9a43c424313d610c9bc133bb35d7ed3b7bf424c66b8820483a103aa41d3628fb609c26d5ab1399f7b6bb43ae962b03307cc32fb5a5a4d434934b5be0bf98c793
- SSDEEP 49152:JRNwUFTWIls1ThDYENU+QTRzmKVuPSfgSdBF5Mufa3j9LIJv24rBPZROnwPi5zUR:XlQBFQT8v6GufOJVuBPzyKR
- TLSH T1B1268D17AAE801ACD876D23C89AB8603D7B2BC61437097CF0674567A1FB3BE1563E714
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\ScanControllerImpl.dll
- Size 6.9MB
- SHA256 f41c5a9754861fd06b05470a267fa9d6f801a0dce1834ad36aeec3212458841c
- MD5 b1c32661f9f9b9d5c5ff2af1a10cd5b1
- SHA1 ba17ac33a84aa99cd31c64c95d890d9d13a71571
- SHA512 d7d1f0fb8a73c66a8c0276ee4686082bb6bea58045119ea0df2abb0595b021c7621beabfaedad4b3a602b4db0ddfc73748e3208653f5fb2ccdbc5037e43caec2
- SSDEEP 98304:yO/wKetReiN+GTqOAbAgLq462dW5ljsN2OXRYwLiiE07pAQhh2HhFaxLzs:yO/wKeIXlLiiE07pAQP2Xaxs
- TLSH T10E767D1662E401A8D4B6D238CEA78513EB73BC554731D7DF0660966A1F73FE08A3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\SelfProtectionSdk.dll
- Size 4.6MB
- SHA256 fc37ffdcd7d89b95c6848677973c8dff654e4a65f3d067961144c92b6f71150e
- MD5 5bf6e919af4f8ae3481eb93f25258f43
- SHA1 c5aa5609a5ee3aaba528b45b9c6409c71a74fcf7
- SHA512 80e8d599950cc828210d9043d34c46280272ebb518cf5e0da54649967c0c4a3f2e8a87a2c2bf3e4f8c4315f1ba3281bd54516504b26bf9265f64dc59465646a3
- SSDEEP 49152:HvVNraNCw9Vjvu1DPcFFiIju4Bn241fvX9MDwKDKGMsWOVRtPGWzU032cZdCZ3oY:3w9UqIivGDcsWoO56ZdC5j
- TLSH T1CF268D17A6E601A8D876C23889B78603E7B2BC1147709BCF0A6496792FB3BD1573F714
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\SelfProtectionShim.dll
- Size 4.0MB
- SHA256 49b3feefcda8c839dfd591a04ed73d7321db278f061d5d4735f1ff520bb78288
- MD5 650e99a764433c6c735a8c993f522d4f
- SHA1 90454d2c36112d7f72c16409c6c88cbe23102f14
- SHA512 55662290d37a1cad37036f4c5879ec9fe3456967a9ea06d447bfad53a24358b44328e5c595da7436910062ce027a17ed03dfa20edec56bccb7d5c37441a7b707
- SSDEEP 49152:3EWWy/r6DbXWDWVZ76nXsLLeLWRBKI8GUfdgTyQWVp1CLrNSJPCqwzUyLFW:0fXWsDY3dgTWC3dSKW
- TLSH T150168D17B7E841B8D866C239C5638603E7B2BC2107709BCF16A466791FB3BE2563E714
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.json
- Size 621B
- SHA256 891cc9b649f1b8b57ecc523901982b51835a2ebed9bc12650faf6b1a2ce54d39
- MD5 af65a1067695e43f5fc64fc0c13565af
- SHA1 70043f33f1264e1a10cd00784db31504342e6510
- SHA512 32dce3475d0ad1396ff16b2b338e6027045375d46d7d9988873706bc334ffcf7a55f5400163a1477d514949172a07afda301adba94d1ebe33cabd7297ed3c308
- TLSH T10FF00203A95F82F78170078982900087F630935D1215190FB7F4EA81DEF2C388BD2CC5
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\Swissarmy.dll
- Size 5.3MB
- SHA256 9ad52208d95d536dd1dd77c9bd118c7ab0fffc795a4f0875fa608544d30bb931
- MD5 60d217257971f73714b8c5e398d461dc
- SHA1 9906053f88d7a409e8ba874aa9f66e5ead73c961
- SHA512 8eb3304e904af5847c6b2cab99d1d3690b5b239fbe85467d164ed29a714f029ec163f467a7bebcc80e156e0d291436306145a2ae68766613f5a6b30f316b0250
- SSDEEP 49152:5LG8qKNFeojCOg33h8pRdPSDIGRmqiZBmdWZyKYbHkEAoXvEPj8QF9yllBpP9aze:Zfex8pCIQbWZ0kd8xTdNhIcPz
- TLSH T1E3469D17A6D500ADD8B7C278C99B8603D7B3B81553319BCF1A64522A2FB3BE2573E701
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\SwissarmyShim.dll
- Size 3.8MB
- SHA256 7b7bef24ae682aed60edf136ef817d60b7b1a02e3ad3f86c7b820cc502e4edce
- MD5 07a16e004bdc32df788c0f7144526105
- SHA1 de6cb075bc813f25aea014eba71b1127299da2e5
- SHA512 c0f2db7f9dc6b7e5575f4a7b5b5d60aa032777e3a9994b534651317326e4ae6721527422d9001fac8cf4280fc7876dd8e1f321a7ee65e3394417982b0373687f
- SSDEEP 49152:s5AWJyZyVe6ZGVE96H+KLNjU1BWIaDLwOx/AJJKFS7JkC3zly0IPLRzUgT9dmR:bUemgTTwOCJJRDqyg3
- TLSH T100067B17E79940A8CCAAC23C85978607D7B2BC127770A7CF16B466691FB3BE1123E714
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\TelemetryControllerImpl.dll
- Size 7.3MB
- SHA256 d783c0ae649b6d267c330c3c9d613d4c5ab09bf1f594598484da1760f0b16e4b
- MD5 7a1b3a54f39392375078dac7b2822ad1
- SHA1 7008531c23e7f266e9a94b20bf98f8038aca5562
- SHA512 518aa3b5060ee69f6d46cdc0ff5142109a1129b7b3481243a2291114ac436b2235d0bd6498a527a25686cf6901bfc3cdd2f5caa7d319e794eb587fa03b55d759
- SSDEEP 98304:MJrBHlha0hhvIzoMzMk/Tm78Wi6bPtBrtkXb4:MJNDa0hhvtMzMk/TmQW5bPtB5Wb4
- TLSH T147769E5AB6A400E8D4B6D23CDA578513D7B3B8254331D7EF06A096791F73BE09A3EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\UpdateControllerImpl.dll
- Size 4.5MB
- SHA256 058befee7a55f5d8510de91f4746053fd49393f2f1843c4f090c3dae60d7d540
- MD5 150ce3c5de43955af87ef53f51c1c866
- SHA1 43cbf73c227e208bd2f601c91a27d58962f08e51
- SHA512 20855a4289f8985ffa840d00819efeb2d2f076fff7507f695cf1a3f6927a7b48cd85285e62ca8d25cd4d2593b00b6614c5bc88677cfb8b933f8138b09a9b48ee
- SSDEEP 49152:lzY8o3OtUDkkGEVl0QFxd/X6LCzqlXB9eC24aeZSRBFZ24uFpei6tyP/ZNZoyP++:2en6yQIV2ZOFoxtFlwGYT
- TLSH T19C269E17AAE900F8D8B6D27CC9A78917D7B3B8150371DBCF169082691F637E05A3B724
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\VPNControllerImpl.dll
- Size 3.5MB
- SHA256 9b2b33a5c58a3e95423f5f3cf4d0c53b27ae4a399c72de90aaebb6b6e000b17a
- MD5 93bc933c0188b182424b8ab87fc7e635
- SHA1 783d97877ad1344a49e4c61f7c65f2c9ee2be63a
- SHA512 3fabebe19ba4d28ef2eda395c2c8c0f256a89959d215529b7226162a940d3ae75edea78083f1f614205da5915d3bdb5c8bcbdea80479180e9a9ab81916bd8215
- SSDEEP 49152:lUh1BFqcsDLEh7i2Tlu1fVPicc27eYv3OhJBwzn5QOZFFRPtdPSnZnZwCAMxM:YvKRziO5nwnZGCAMxM
- TLSH T1C5F59D1763E600F5D8B6C23889AB8517DBB3B8150371DBDF0AB096691F737E0563AB24
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\hostfxr.dll
- Size 391KB
- SHA256 40ea98fad0d3455cb2842689c4ac97582f0de5fac00d09b26f526854c0910c89
- MD5 60409cf32e47259088b414aec2eacf23
- SHA1 2868556cad6051e44438915e8c657cc04ff2698c
- SHA512 f0121504498930ba883683b41bee172a89278692fa4f42fd4433f79f7f58f0d773ef36099652774c8a42338068f8240dd7a3e0365ee0a3eedf1b0ed94b7bed1f
- SSDEEP 6144:RalRvjNggqbRqhaUzIS64W+zz3Z0UCVvfpJEl0FsGxilKmkVAwBA8/UMs2CUHFhn:R5q0iOnpq2TDdl9Bq
- TLSH T129841916D3E8057CF0B7D679DAB29942EB727C494BB0E5DF139088650E73BD09A39322
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll
- Size 3.1MB
- SHA256 8af36217efcc1b2a677accc77839ed3b67ddbfcabfa16caaa42c7e95796b940a
- MD5 d82467d25954c9fbaa91ca97e0de6834
- SHA1 d7da2b4f83acd0d2aaf55de2ae403fa6cc44bfc6
- SHA512 84a38b2d4a1b23439f4c6eca1fc148d618effd1444704f37e5812488877d15789b603944231281299ba332dbd0d3a0e51160c588c0adc1bf338675c62da45aa4
- SSDEEP 49152:zHsR0cmbmDszn14AcKLfC659mLVD+Bjmo+2g5rCdPWD8i51l3z:zHBpmj2Am0D8g3
- TLSH T169E54A227A9540ECF866A23864FB8502F6F27A05236097CB0558727D1EEB7F106BF7D4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\mbtun.dll
- Size 2.8MB
- SHA256 f21a980316bd4c57c70e00840ab76d9ad412092d7d2d6a2cff4f1311f7c05364
- MD5 2bbf63f1dab335f5caf431dbd4f38494
- SHA1 90f1d818ac8a4881bf770c1ff474f35cdaa4fcd0
- SHA512 ebb9834323329dc01ba2c87e5fad1083a4cb86f5ed761cb63299ac5336a9843a1aadd42fbed706797c2295117af1c00f96806422338352653c8e0255fecc2fd5
- SSDEEP 49152:xNrdEZjzdAj9fdc4fDrN1OxOh5PgqdnBq30yPFZP7KVxSL:bBzFRkshaZP2W
- TLSH T136D58C1AA7A800A8EEB6C27CC6578603D7F2B8151771ABDF02A456791F73BE1173E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\mbtun\mbtun.inf
- Size 1KB
- SHA256 4a350fc20834a579c5a58352b7a3aa02a454abbbd9eecd3cd6d2a14864a49cd8
- MD5 5d1917024b228efbeab3c696e663873e
- SHA1 cec5e88c2481d323ec366c18024d61a117f01b21
- SHA512 14b345f03284b8c1d97219e3dd1a3910c1e453f93f51753f417e643f50922e55c0e23aab1d437300e6c196c7017d7b7538de4850df74b3599e90f3941b40ab4a
- TLSH T1CB4140BD48D20AB83C673356671B69C27BDC220145C920ADB2DE8606C88EDDCB905EB9
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\offreg.dll
- Size 140KB
- SHA256 8e6c155a97666c8e6a3f9ea95bfc6f6e4f87beac53dd72164aba3ef33ff88db1
- MD5 1659738d57a15a0983f0373b2faaef45
- SHA1 efd4cd05ff6bd787a2ceabfd11daba1c0e475855
- SHA512 4f62cfe0579e1aeeeb30edd5f42a2b1880446dd1075be051e2e0189da5071f9866e5425ff85547486fd7d952a28efa4e784db0cfdc1fcc428b34eaa89c6a7654
- SSDEEP 1536:kXNnhdTcQOCr7LClg5lSYOurIt/0q9mrf0Xp2N7RibuQusR9YfIZRoU:cnXTcQ57LClMlSYA0q9mrf0XoNHFQZ3
- TLSH T111E39D5A73B420A6E8678678C569875BE776B162232087DF12E5C6B80F037CA7F3C345
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\pkgvers.dat
- Size 78B
- SHA256 1a79d77b1af3bbab8abc066247fc55efcc7f5992a50b53f7a2767370421a2c41
- MD5 7bfa7cb9c2f4f6edbd6c5e50b4590993
- SHA1 8030abc85d7b6b8343ceaa90c224c0c6d27934b9
- SHA512 d88d49beb09a08e273f53b8683bd424a3c1df29fa514a3f873127b7792d2a5ba6444fdcf9cf8534e408f9e2d4c954a0e8f911ff894cfd8a712c6bd32f2ebeba6
- TLSH T1D8A0122040081B00096666F0A071E81831079C1425800B0490B601B1050102011040DB
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.Collections.dll
- Size 309KB
- SHA256 3a810053e803aeb1fe59838d6b138587918d8be5ce02c590f220bc51a8aeb57e
- MD5 32a7b1d6b0f6a8bf8a468b7e4ecfaf7c
- SHA1 ced1e64a69787aeaa73bddae2a6f6eaea78689b9
- SHA512 568fd87a5e25c49313e43156a8110e6089dadefe97a63d759dc03a1bb1858444e23e839977b96ae36241d9d5ab3743e01b4cac2f9e0a70ff8f1825f2983eddf9
- SSDEEP 6144:ldtH4FsjvCSCDLEFCL8ph2wqXh0PsHkbtXmj:POUvCS8qCL9wqx/HkbtO
- TLSH T15864392873CC2711FD7E42BAE693C042E3799152475082EB42BDF6519F9BFC16ABB025
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.Private.CoreLib.dll
- Size 15.4MB
- SHA256 7aa6e90e2dce12c08ab8ccbab63d67c16cb68addf6b4a9d3d191753788f636cc
- MD5 b4f639d7200ad1fbc93659a7b2793b60
- SHA1 d84b79a5be5fbb3a983a52ffb8c01ed5464d5e61
- SHA512 e29da3e7dfee85bce935239b5c3c49a4955266b8f0978f73334ec45123d3af9c5bb2839fddc7e83189e86a18828c0baf16be9cbe56f5a6a0f171f76a4d8c1994
- SSDEEP 196608:0zw2LnkvY9BnpsZdI9fkuOH0Ar+6x5LKd6kIn+9ZNIbe0nZr:6w2LnkvY9BnAdI9dOH0Ar+6vKd6k527
- TLSH T1B9F6AE10E3D89F4AE53EC2788057C616DA70F882532B86CB0195EA493F73BD5673B762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\clrjit.dll
- Size 2.0MB
- SHA256 66bfbb198673c22247b78c7df4aa7f96b6909631cf5989cbfb2c6d7ed68fc1eb
- MD5 de4343ebecec5fed2ad9078d01c7e204
- SHA1 24e487af26aa0bca966c32df31e756d6b2f4887a
- SHA512 7df5dc2a51e1e4ee1c399089157fc0fcd5ce31d986f0593ca83cb7fc44fd1183368894cc3268a751e82d83d90d81a94ea553b855be8e3c248c38c3def988c69a
- SSDEEP 49152:a1NyfVyKIaKUnctJfilvld1oZgpdZTctkQLFbD/Mq+Nyupy1wmp/Ky7f5hwb:ax2nctJfGvld1oZGdZQtkQLdD0q9upyH
- TLSH T1E5A5AF47A2B900FCD46F9274C6274A07EBB2B80517719FDF03F04A556F23BA2296E725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\coreclr.dll
- Size 4.5MB
- SHA256 599d0c0ca4739fb965c44b51a466ace34d5dfbb53b255ae9c5bca49713cdc8f4
- MD5 bf6674ba17f62cd1850b0989b1267f58
- SHA1 2f573be0c8caa8a2969bb6d454b385a6b782a320
- SHA512 53c9f3ffc63dfebfea7bdb4bc0623ef0f814ab8d66bd53f543f1ca7e3b409b44d7e33dc49e15f29f26e8badeb8a1f4d1195a44d98faca671863cdb87fbd1a40b
- SSDEEP 49152:BOyyR7TkLEH6ut8PjdCRxKe2b7b7b7b7br7b7b7b7b7/IqnAXYIxmRL3zeE24QIf:MyyJRvcO0qQzX0T1U9
- TLSH T174268E25F6AD00DCC4BAD179C6E74A1BFBB238591338DBEB026146651F237E16A3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\hostpolicy.dll
- Size 390KB
- SHA256 a1a4111aecfa597cfeae28e304e1faab5b74226ce4a25ee696345c2cdabd2a8c
- MD5 05972504c38caa20d497d35e662c8dcd
- SHA1 f17ece9535a67c99e6bd2c16ae299158b093caf7
- SHA512 a0877c664bf12f2a5d568227116b5bf12f92170ab103be2df56fe7394b89875fd5046de89548a9e8e2b3197b7ca2ab1c8a71c7ae946ed1d54ab8955a0532a6c5
- SSDEEP 6144:SsQpbUUvKO93ss3JDpMBqyiNlCCxO7ptsuBNV3h3BjcZjKr9HLhLuxJb/JDtkwKm:SHFvK+H5Kcyi8JHpa2wKdMFwE
- TLSH T128844A16D6E8047DF0B7D679CAB28902EB727C4A47B095DF139089A61F73BD09E39312
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\PresentationFramework.dll
- Size 15.2MB
- SHA256 4715cc17a523aa28f47e7ac5ecc1093d6d229a8d6e22e8e667e1604782e605e4
- MD5 e76c192462b3da96ea0ffc3785d1d92d
- SHA1 4624b81832b16530e80effa374aa91dcd6e9be56
- SHA512 8fbe5c184240436f29dcebb2f67da741cb8a42417d33e404ab3b98dfb7407d7141622313b8e63af971ceb57acc20e48a857c755cd80ee69b5db372f587df2a7b
- SSDEEP 196608:g6k3buHljBxsAJted72Zlzcgb/erKHvAtkcfgMbgDML:iEljBxsSed72ZZHPAtkg
- TLSH T163F67D19E3D84A05D37EC1BF82632102E5F5F8B6937285DF0527DA492F83FC1A676262
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\System.Xaml.dll
- Size 1.4MB
- SHA256 b56a2e8dcc642fae180e35cf61efd08889b77261eec4353a77b4a90e79d6c226
- MD5 07b73e9dbbb6f89aec7c582ab4f2e461
- SHA1 405cdca92e8851091408437e6adf3fd0ea7a97eb
- SHA512 442c1891cee24b8cdfc9e5adf750e69355f1a70eb264d8e185abe38cfa26f1bf9b30cb6f1c88aad27ae2d84fcecd8fd8bcf91de2088cf7f22af051e3185a7269
- SSDEEP 24576:H/kc7vpWcVYFzBzhJsHf0xOL0nsfr1ALiDvQrTcvjS+HaftB:f7CFzBzhJsGsfrhvQrTc1w
- TLSH T13A656B2463E88615D7BB82BFD1938122D6F590531362C6CF8405EE6D2FD77C3AB72262
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\WindowsBase.dll
- Size 2.1MB
- SHA256 7b8a63b512cec9ae7562eb93f8fef39c122123b1ba5c6bc21ea410c3b2dca453
- MD5 75f639819eeb0492ae40af92e58e8e91
- SHA1 63643d1b38fce6d9350b60f75cd47ef989bdfda2
- SHA512 e9cf58b72d75a56302eb0002c3706ce052bd8c96b5c35c7b66835e0fb8ccdc6d3e34b934a50379caf3441acd3d207a255239c67fe6961c016ccbc0d4bea93377
- SSDEEP 24576:oSfXf1vpCb8ZvoX9OPIA9wxc/rYd1/Yph4R+uyhapRSvMP:o8fvCAeOPIowxMWmh1uyAcc
- TLSH T1CDA56A2473D84726CE7A82B9A6739112E677F4570316CBCF1809C62D2F97BC087762B6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_3bd508027b5511f1a89edad55ddebf35\7z.dll
- Size 1.6MB
- SHA256 bb01c6fbb29590d6d144a9038c2a7736d6925a6dbd31889538af033e03e4f5fa
- MD5 3430e2544637cebf8ba1f509ed5a27b1
- SHA1 7e5bd7af223436081601413fb501b8bd20b67a1e
- SHA512 91c4eb3d341a8b30594ee4c08a638c3fb7f3a05248b459bcf07ca9f4c2a185959313a68741bdcec1d76014009875fa7cbfa47217fb45d57df3b9b1c580bc889d
- SSDEEP 24576:29raURTF/5pe2g5RpBDxSjv9IrqLwRpFEDbt7y0MVoAAlziG3B:29hP/5petvSjWZR8DxO0mo5MG3B
- TLSH T175756D5BF67400A4D5D6C034C5276B1BEAB1B88B8330A6EF12D15E6B6F13BF19979320
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_3bd508027b5511f1a89edad55ddebf35\ctlrpkg\MBAMService.exe
- Size 11.0MB
- SHA256 10715f7321fcf50ee7a7cbdeb46035634c3aa4bf314cfd02a0aa1c16d34b0669
- MD5 9bc69b5b9a0e208b10c827d293d082cf
- SHA1 ab4c6057954ab6fc9876bfecab7b4c984b5767d6
- SHA512 624f7ca43962e8d480aa3f538ff91dd6c777399cb77c4b2624effb8ade932eab4d7c672a6cd4ce5bc90e6af8da0d59b22d16bd54b23af5bc22b0d1fdda4c9b75
- SSDEEP 49152:tg9H/qoiwmX7ldbnb8hYI2PFgevvF+20DlSFBqgAK/wj5BykfcTpniZTHebm4Cy3:sHUD52ykKnZViQ43TLh6400HzPFC/a4
- TLSH T101C6F606B7F951D8F5BAD674A97B652AEE32BC618B3083CF1150560B0F32ED48E39721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_3bd508027b5511f1a89edad55ddebf35\ctlrpkg\MBAMWsc.exe
- Size 4.2MB
- SHA256 7878a9b10903b8c0def49015deefd48a3ea0e46c0f5ac9ae755336994e020152
- MD5 acbb82943fe0d5f1c5df74b1a7dccd2f
- SHA1 c41e38f59eff5e40a6a47b14be44520dcd6d405a
- SHA512 7092748502f06bf05df19bd2d4d5857f161a35a9b2e3a72645eaacffacae7a8dad10ab41ad3b80d3a63ff0773b6c818edf3769ce6b1f61b01cc92edfb755dfc5
- SSDEEP 49152:dK5b4+V1qsR86LMFRbbX8DREqUaP7bBfnuF0JRlnPkokPmsBLdS4BPQRzU/81fge:i86kyaHF0JRlMhBpMyok3M
- TLSH T1C6166B06B6A540ECD866C239A47A8503E7F2B811273097CF066853761FF7AD21EBE7D4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_3bd508027b5511f1a89edad55ddebf35\ctlrpkg\Malwarebytes_Assistant.runtimeconfig.json
- Size 559B
- SHA256 ff0c15737963951550db7cc1bb116e49cb15c61bd93c61ac1861bd8e12efb61a
- MD5 e9420939afed10ab831746dc22ef813a
- SHA1 773f27f2a98cb5db97d26e65b992a653c2a07ae0
- SHA512 a3285d5db3631bc6a3438b03412f1f8aff03102a3e3e35736df207af066e936fdd2c84d85d360fa7cff33ffb786d84220b47888a5c0288c88e203f243e7cac5b
- TLSH T11FF05969CA106DB708F9737AD12AC083EA30572B10002C56B4FC080C2F776B62121F95
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_3bd508027b5511f1a89edad55ddebf35\ctlrpkg\mbae.sys
- Size 155KB
- SHA256 c990dd89b65d35d6c9b34e21c78d96e206ec3bcdd934716ee61ff79da0fa5251
- MD5 fc98ddab2223dc73b950622801b31554
- SHA1 997faaec1dfd18b9dd31e1c216440a28bc4cd612
- SHA512 da08860f8c3d8a9204d1480f33d21f2ab922db5cbbf7734527ed05477c2d9c184deaedb63196876c989c9ff6c1b45b5792661f5bce92212992a7cdb664a793e3
- SSDEEP 3072:hcj/Hk4/53QBvOP8JsUrLx1o6GwzfwKYdkXEnU/H0KBJT2:hc4wNQBvOEJvx1o6GwzfwZqEU/33C
- TLSH T1D3F36C52F3B400F5D8A6C679DB669213E6B2780D2721E7CF076085252F673E4BB39326
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_3bd508027b5511f1a89edad55ddebf35\ctlrpkg\mbamelam.cat
- Size 11KB
- SHA256 64416d564725416c6869ea951878a2734b1f6940b11f7961a897c45f0d8c6625
- MD5 bd4ceae54af081d6b1dd91ff584c5d61
- SHA1 5ade462d66e042da58bb1447d1b31f1aad901b68
- SHA512 37e7abd312f694ee2c8ea54ecf50ed12c16684f1007c61d9a6d1d01cba958be511c5e4e11cd7393a5cd57349fda1c552bebca42962137e0d11695c195761ebb0
- SSDEEP 192:oBxybp/yRpJCSEbhLxyKR/2FWQFdbiI/Ex6RMySX01k9z3AgEhrZg:oLp+eFRvmoMR9zJug
- TLSH T11A320AE58A6C5083DCA7AC6087E8E5D77C3D67C71D00987921DAFB5409933CAFB2816D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_3bd508027b5511f1a89edad55ddebf35\ctlrpkg\mbamelam.inf
- Size 2KB
- SHA256 e26c2d3347e5f077da92713c9df3cd3eae438fb7e29810bd5c3afe567d2d3125
- MD5 5d8c05cc4f9b4304d57ea10b87f2dcf0
- SHA1 2cabe3d39aa5ec16c54c7818284a2ee235d2ddbd
- SHA512 55bff23fee9852f229246b71721b3659c916079787935d400a97641449dfda752fc8fbf36f9ea3dc4028f05daeb9006a99660284a61aa5d5a466af0ee966c738
- TLSH T164410454AA538BB8697B35B81E472883BF5412205076384032DEC8C99B6DF0C93757AB
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_3bd508027b5511f1a89edad55ddebf35\ctlrpkg\mbamelam.sys
- Size 21KB
- SHA256 ded569e249e590314d095f740c6b8934a5a797e4f3edbe0f78eac9d333f12a2a
- MD5 8da81aa1f6b89ce1d2e216e3ea351c59
- SHA1 4baf79cbade9a5584630a540e6368d547579fb12
- SHA512 6d611bbd9d480ef2defd745fd06c4ab86e181267cf689d9d0e124edbaf22fd30fbe2310879cc7bb6dde5bae72c4feea1d329cdecfbf101d95634f85dd0769119
- SSDEEP 192:C7IlO/ZnEc+PbYv6/i0RtPH920QvVUKjnegqdsW++w/y1wVWQ4uW/+O68RwX01kd:wIlO/i8ChLIxUKjnev6+Twc69R9zING
- TLSH T108A23B6549780283F6BBC570C7E4C927BD38F39677408AEB0591E5681DA37C2AB3192D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_3bd508027b5511f1a89edad55ddebf35\ctlrpkg\srvversion.dat
- Size 9B
- SHA256 b3e9c3ae109bbe9c08500dc2caeee7ecb59dc2f0737baba2133306ecfa3e7fd3
- MD5 6d78731a933c88778ea4891954ba8aab
- SHA1 2aceac7331a21c1929a5fc2c66fd4a9cbfbf3889
- SHA512 6b039f66cbf5c7a82e6e68f791e56dffc429e8df6ac465055185dd6c3b683892ca3442f47778324d771e3f29b0d712b0a4ec08115feb1ef191316a13b7e82440
- MD5 SHA1 SHA512
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_3bd508027b5511f1a89edad55ddebf35\dbclspkg\MBAMCoreV5.dll
- Size 8.7MB
- SHA256 15ea0e58a63840c705681cd9bdd4024d347816f99e5bcce7194b475e27f040b0
- MD5 ab40a369f9e8bcb02ff6b9bc50eef776
- SHA1 e9948cca99f31f3c4570d90159d998e4b9e229a7
- SHA512 b75fccd077533d5eb5ecf14c911978d844d637f5ad0eb9f25dccd39543ffbaa10590091dd67113bfe60fe22d280e9d3a1ffd648c45fc6a769e5d6748ddd43a49
- SSDEEP 98304:pl8GfUDU2vmrPfU7fWGl1oPvBtFuIiaW5iuewLPQzL:pJfUQ2vmLUuGl1oPv7FziquewLPQ3
- TLSH T186967B2BA7A400AFD87AD37889EB4502F672B811537397CF16A8A1761F637D09E3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_3bd508027b5511f1a89edad55ddebf35\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\10.0.8\.version
- Size 50B
- SHA256 42559a4970a981aa61f3ed59ad44d05214fcc5eb97c35d06a88102a0b747a45f
- MD5 9072ad106b74f3900d25ae80843c8a24
- SHA1 b664a23dea5a5591c21fe0f4a9b5f344079d94d1
- SHA512 ea866258bbcccc0951f95367f3309db65d437ad27eb6fcbdfe12e08b9f76265050d6216091b89f0dc92db66b24f8238c8d6cc98ce49e6c3bb6b051ee037e56a2
- TLSH T1309004444445D47315D3313453015154F00C5D3C5D34CC11D05F707CC4D705CC55C301
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json
- Size 47KB
- SHA256 a19eb9936713bf0cc54aae893ffdbbd00b0605cea204b21988fc843928cf64bc
- MD5 9b3f19ffb3ab29665bc9ddc870a393d2
- SHA1 5e5cb1c01ce2eac686671502b242aa696cc8d4f4
- SHA512 d3dd5f37476d473be5db2e86fd5773396534d98169774cee3268c2cf05ca39b182f799f4372ffa77ba0d325d85d02112e4ed8d461b150a8223605bdecf657b15
- SSDEEP 384:0riPalGB5AWiWq2mhzJUVVqxKS3xV2CjNrBa7gHOykEaf:hUAHiWqn1UVVqx9U7gYEaf
- TLSH T13D2382BBD9DC0D0B99712294A9B94607FB20036F10980C17BDBEA98DCFB751394C6F1A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json
- Size 12KB
- SHA256 95004958b8a13c89f271ac7cd6713782434adafda77c031185c2db1f47233131
- MD5 416ccb4f5426f7fe35d3f7dc4bed92d1
- SHA1 cfba4a2185c8cd777c7f33eaef2f9aed51aa9c08
- SHA512 c706a3670e0ee6f033b831dd2068eff47a64c17582c24b91c9b9ca4dcc90304aaa7cc0ae1a28d20d2fc2c96ed4260cde07dca9e487e6b5c352d79d4fd76ef84b
- SSDEEP 192:ZqDmf/FYgVMzhrgHTb0MAJUKfVgH8BZ8ZFnPx:mmlYgVMzhrgHTb0MAJUKfVgH8BZ8ZFn5
- TLSH T1E7425422D1B5AEBB66FD613661B40782F364C75F08414C07797CC88C4F7BD2A62C2AA9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json
- Size 12KB
- SHA256 e960cb0a189fbf63971e1ee42654e80e97783f97425b8e581947a0f3017bd95f
- MD5 03d3a0f5fa081a93d8523c7ec15868f5
- SHA1 d683336cf1e94b401f7f5303baba8b8ae5d3b586
- SHA512 8582fc17c44713f5065b5ab968b5c03cdb80c5ea3d291741214fbe550bf370823f8ff4751bf73bd2a9454842a913d59382f484a211e5d3fdcd79c1c89da2b77c
- SSDEEP 384:2mlYgVMzhrgHTb0MAJUKfVgH8BZ8ZF+5f:2mlYgVMzhrgHTb0MAJUKfVgH8BZ8ZF+d
- TLSH T16C425426D1759EBB66FC627661B40782F364C75F08414C07797CC88C4F7BD2A62C2AA9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\MwacControllerConfig.json
- Size 2KB
- SHA256 8e2e36ef2564030967cb5628d3ab8f54f01533e6a2ce42a9c9134f89803ba84b
- MD5 07e5289834efacc49804eb8adff1ce16
- SHA1 820fb6edcb708e83953b440ff6a957ca674f26a1
- SHA512 5b33cb79ede563a1ca7aba3e97cef9184eb99d19e0bc18064e3d8581a30516f0d7bd6ca58dc389e77d7beb82929c7e9c275f44d1e246fc4af9ed086fcde4b38f
- TLSH T1A2411732D9686DBF19F412A77C994252F641971F415808A3BABCC97C5FF6C12200AF1F
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\PoliciesConfig.json
- Size 814B
- SHA256 f2e0d07f26e1646b9014f1ff203b4f931c2c0f38abccbf47a76fbea4a7fcd1eb
- MD5 f7cf30fefb91ef1b1eec6b53c5d24337
- SHA1 b8aaf77df6f327b29fc43127e3f69c137d4cb3cb
- SHA512 fc08d776fdb316893424e6960cff33be65bb80568b469ae829e88ed0afcc17c25ec93c5cbea4c036f02b3645a3d94e27bc969b617f5d616df1916529e449f274
- TLSH T1DF014C66984480FD247C41688137D4C1F351871634190C2FF7FAEE0DEDB393B2185D85
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json
- Size 5KB
- SHA256 98d7748bb007c6f6c14612b32d15f2520ba537edc2e69daefcd36ad5ef814c92
- MD5 778654218928c5d7bfe6256ff3d5d46f
- SHA1 a42a7af688cc16347cf36e3d1f0b2ad5248772e4
- SHA512 4de45229b7892cbba1ead8856ee7da5782e9f16629fdce7f446e535d9979017ef554357971ba077132d41e7dd89d52aa621e984957185992f055f3b96a46111a
- SSDEEP 48:juT5JtUmVSfKuGQf92Es1kV8ERr7mduwmMd8qXKeWQX92MEnAf3wsaA:juZOfK5k9JykfhYwMHXKBs9RsAf3wsaA
- TLSH T109C18D16D9105CFE18B8E25EDC288186EB3083972202187FB5FD859C5FB76337686EE5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\SpConfigFile.json
- Size 12KB
- SHA256 1fc35d40e2f471970b00775226e847f927f704be4e0c75ada381d32a01e464c3
- MD5 1b45abbfe856b9ab1589bef25ff67488
- SHA1 4d9d29305aa5127004cda11a4f72e4c0b143e855
- SHA512 fd1800ea9e8c12028674caf58795bee601508d5e3b981f505d0a1819febfcf6e3711ecea6fe50659d17fcc318803b85b95878f360b2691469ac2e967466a9b7c
- SSDEEP 384:G8+xwb8fkY/sDY8t7SSdUCExUYS9oFfJ7MLPi5LnDjufzqoA+8xRj81offZJZtXJ:LXDK
- TLSH T1B652161EE0A84867887726901F7A95A2E334526BC1435C6775FCB12CCFBB483C496F9E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json
- Size 1KB
- SHA256 f2d6f8f6b2c66d1f8c1645af56c0e429c6282797e594d54d7832a4ce53d01650
- MD5 2aae42187f1dacdc90aeab841d3a8521
- SHA1 d0c639656fa7b0f1084c2ade613676c3bd91d059
- SHA512 b0ea1d2513168c0393668c2da4aa0cd2c1ddedae9de9d4414288c8490f42aac07f5d61ded3b6e575d805a54cbd82a1c20fa2408891bf8c80cc7457b7fbe04a1a
- TLSH T17E31E4128A2845FF28FDD288C9B8471BE7A0531B61161C1FF6F8DA5CDD7703267E1998
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json
- Size 1KB
- SHA256 95717dc7260edd071aafe83b7a5b2fa3b738d3a7077b8c70d52022be088920b5
- MD5 ffd786c5fb80867e59aa3751eec4ca39
- SHA1 a522d5066df798ac15848fc5258aa655e412fef9
- SHA512 ab54f93a19e627efaf22259e5e06822828f6c98a48f407c87e5e7af7315320c8ed81d2c5d144735c6927ba5f3bb60fdbe0790d18465147a0c193f8f8f795c2cd
- TLSH T16831F4128A2845FF28FDD254D9B84717E7A0531B61161C1FFAFCDA5CDF7303226A1A89
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json
- Size 1KB
- SHA256 a87c50037e491f94a6e7e2a8ed96ddb154e7edbe876bc4b8f8d49b9790be51c9
- MD5 c9e2aed5335a7d08040a3dd70768a3ed
- SHA1 eadc3f152634b82750cfb78ca3c225201cae8261
- SHA512 fee6b596f133c5a65af57f171d1d73f67d822e33a6239a2b8eb467027b889cfd213570451f09a262ee0d2e6497a0604a79ee35edbb608564788a58990fa6d277
- TLSH T1E3315B2385288CBF1275965DD9B48002D750538F66705C2FB3FCDC48DE739342587A8D
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\rmode\mbrescue.exe
- Size 7.7MB
- SHA256 477919ecb586d6ef4a06793417c2ae3126c51a51cf9445d901e90e3627e7143b
- MD5 ce8ca947e3162da157d1878d4cfec382
- SHA1 6f574aa206ba5e9d7469450780c4238cdd5112e8
- SHA512 4233bbde636d039ea3295e3b2066f56ea5a23e0431a5e675c967c60bbfa4f518f01eb90ac271da56a192671b925b3e14d3a25f1da4a8412983b4973565dff299
- SSDEEP 98304:akpowZa6gr/YzKrEAi9bESWCt+z3zweCeT007kxK:aFwZa62YW4AQbLWCtej1C9076K
- TLSH T1D586AE57A3E800E8D8B6D13CCA978503EBB2B85147719BDF06A4566A1F73AE05F3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\CatRoot2\dberr.txt
- Size 63KB
- SHA256 8f51aa11a18a6c8ac9eae202d179ff6e28729050780910f905fa30d6aadefddd
- MD5 4e0d8369816baa6e3b0abb9ebacd2436
- SHA1 94aba728f936ae6096643eb238e26dea434862ab
- SHA512 986e68b30be5e2e07a26cf4e86eca09f5e7ddbfca676055e1a6e6e7fd5046a40d9dd655cec834d8dc66fd9c223c5640b102473db437a0796504bc2068603f8a9
- SSDEEP 1536:YC7/VngDmt9fS+r1moyeuftI8GtqWxsKo06x+x4IP/VTwmSBR9KS8NyFCCA6WGcI:cu+
- TLSH T193533D45A4EC9608C5B70FA67257FD72C92E559BB70B0DE930ED6204D8C3B442FBA06E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\CatRoot2\dberr.txt
- Size 64KB
- SHA256 50f88ed6d73c004106bde4fba512a462a45afb4b9fdb3c6672deba4e9eafa1fe
- MD5 8f5cb0c81536b658b71e3e5975ed946c
- SHA1 c03564812f70a02cb1594df2e3c069898054db23
- SHA512 00fb250de21a5337b8d3cb3442033ef30389df44bb6b6df50a61651fc1558c7b9afce74cee45bbfd189d0e921c9a0da978cc6cdb9fa940d617771dd8361f2e88
- SSDEEP 1536:YC7/VngDmt9fS+r1moyeuftI8GtqWxsKo06x+x4IP/VTwmSBR9KS8NyFCCA6WGcT:cu5
- TLSH T1D5533D45A4FC9608C5B70FA67257FE72C92E559B770B0DE930ED6204D8C3A442FBA06E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DriverStore\FileRepository\mbtun.inf_amd64_add82795013a7c3b.ini
- Size 409B
- SHA256 a25f5b5c15b265a5da287c219638aa5acb82bcb6c860db85db7a92013f59bdd0
- MD5 317c1da5543a4ed3367ad44f662ebe8c
- SHA1 6104c2c7a3e7473ffa3b5ae3f4f7e279427a9504
- SHA512 7700e7392760c45a6595aba45a5f1e2550c19a84c02e945a0b54789aed55ebcc6c1a37e7a8d2b3cb273ec3642b733c9b63a45ebdef51a959569f9dfe1cee06e7
- TLSH T1C7E02B81182615DEA082C3DFD22C7CAEC354F44C0831204AB3C0414D9F22DDBAFC8F9A
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\drivers\MbamChameleon.sys
- Size 230KB
- SHA256 1d0c63d9d7328822fcbb5e06770270bc28aad0debc6e3bf77a89a8ce2d9b4bfa
- MD5 477e2ed9dbb9301697acca38b8330543
- SHA1 b64bbc071a8fb77313839ea3ee045821e3a326eb
- SHA512 1929662184c192763345e2ff9c079c4552e1e07b837686b4cfde2512961be207a2d40a605f66089c58a84beaa106e14d7bc9f876b73109c45f5ae34c222d6606
- SSDEEP 3072:g/OxDVrLPJZW1sldvO7T509rYfD6lrbOtZB28zYdvWFWaUfKGLeFFciO43gY4ZwV:RLvO7T5YutZBvEAFWaUf3LeIiO4Hc4jJ
- TLSH T1B6347E5AD2D41DA6F9B6C2BA8ED69542E77334091B21DACF0370842A1F67BB0F53530A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\drivers\mbamswissarmy.sys
- Size 240KB
- SHA256 6d2c9a01f953d206abbbd8c2ba5a00b78ad8f6bcddba6db810f2d6f562ddbd8a
- MD5 953f871a91ac057d2d748646065fc2dd
- SHA1 ef6eb7900e194555bc9dc4b4eca377f5aee9f7e2
- SHA512 dc4caf64effe29e719d85823ac9ded93bd723ccefa4662420303c700968db608c9c0cdb4412373ffba49c9672359f4594dab50863cc6c10e8bb4d3b5fd00573c
- SSDEEP 3072:rM98OZY4B+FY1GeX7dxNRV634KOMuFZWaOJRN4KoXkM0dsFTgUzFkzSzpJW4d1sa:rkLelYsCdbRDF7WaeRN4dT0U6r4dxt
- TLSH T1FB346D06E2E47A66F9B7827D89A69102E77271452B31CECF5370C1292F1B7E0F93534A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\TEMP\mb_errors999.log
- Size 429B
- SHA256 1798bf03306bfcb625bcb099b4d736b1a0595a116a8738d1fee1206ac009be5b
- MD5 843e7016f878ab6f4163052cad0d9016
- SHA1 7e608636c657a3d68739160689aef5f7cc16790d
- SHA512 c5197821926e4e1fe935e72d8e6f9132e49a4ce3e9f9be35952dbbd0fe1cc1f9a2228a2a3d5e6dc7184ad1a5fdcc5a7342b182e4b14ac6720347663bdd53e8da
- TLSH T13FE027D026E305B1741A0C93846A2EDCFA9AFCA0622E30F87FD539A043C440BCF1A387
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\mb_1F9F.tmp
- Size 107KB
- SHA256 ad820dd54edb13e255d34eafacd71f278d6514e2f7e4c2970401f922a774ceb0
- MD5 2df8ff40bec48460845f851a54b76fe8
- SHA1 8e19f3d76c87d590cf1af839ddbe98af381d44e7
- SHA512 2177f5dfd6901f09ae2b8a0d6bea7b5fac3d00a721aa297ca6c35666cf2549d6c8d8655063a332224ccc8e0f00bdc84334636e9f1527862c850cc4ceb96d7d61
- SSDEEP 3072:dAZdoamZdgBjLpSXussssvYssssnC1c9RvZfy74hfp:dW542pSessssgssss7Nea
- TLSH T1B6B3F1F78379B8D9C513DA3B93874B110B28426B2C8A7E45A84DDB158D7E66181C3F8F
- MD5 SHA1 SHA512 SSDEEP TLSH