Analysis
- max time kernel
142s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/07/2026, 22:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-16_dcf2e29ddbae67afec5e123dc8302998_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
36 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-16_dcf2e29ddbae67afec5e123dc8302998_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
36 signatures
150 seconds
General
- Target 2026-07-16_dcf2e29ddbae67afec5e123dc8302998_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
- Size 3.2MB
- Sample260716-19nvtsaw21
- SHA256 9edead8b165096560066183d2e1c9363be44f9db385a8a1b99133e3bac03a487
- MD5 dcf2e29ddbae67afec5e123dc8302998
- SHA1 5585fad3e7ca3ec0d90a22ecbdb8c44ab3be9aab
- SHA512 7af8a4f3677db85498913f481d7b6f602162d505d18086a7cf170ea3448d22a0e6122435539af026cf238151d3000f7229d4032f0d35e96c791ee98de586f778
- SSDEEP 49152:Pg9zAAXHY7oomwAeyfvE0Z3R0Tnxn1o2d5Hptj4LWg+ctK1tqDjFJsUP:odAAXHY1AeKtwnW2ZWatqDjFJX
- TLSH T176F5AE31B2D18120D5B39370297EA7EA4B79BC256F7640CF32D8B6390B725C0AD75B26
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs
resource yara_rule behavioral2/files/0x000900000001c965-2644.dat INDICATOR_SUSPICIOUS_Binary_References_Browsers - Detects executables built or packed with MPress PE compressor 1 IoCs
resource yara_rule behavioral2/files/0x000c00000001c545-2057.dat INDICATOR_EXE_Packed_MPress - Detects executables packed with ConfuserEx Mod 1 IoCs
resource yara_rule behavioral2/files/0x000c00000001c545-2057.dat INDICATOR_EXE_Packed_ConfuserEx - Detects executables packed with Goliath 1 IoCs
resource yara_rule behavioral2/files/0x000c00000001c545-2057.dat INDICATOR_EXE_Packed_Goliath - Detects executables packed with Themida 1 IoCs
resource yara_rule behavioral2/files/0x000c00000001c545-2057.dat INDICATOR_EXE_Packed_Themida - Drops file in Drivers directory 9 IoCs
description ioc Process File created C:\Windows\system32\DRIVERS\MbamElam.sys MBAMService.exe File created C:\Windows\system32\DRIVERS\farflt11.sys MBAMService.exe File created C:\Windows\system32\DRIVERS\mwac.sys MBAMService.exe File created C:\Windows\SysWOW64\drivers\mbamtestfile.dat 2026-07-16_dcf2e29ddbae67afec5e123dc8302998_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File created C:\Windows\system32\DRIVERS\mbamswissarmy.sys MBAMService.exe File created C:\Windows\system32\DRIVERS\MbamChameleon.sys MBAMService.exe File created C:\Windows\system32\DRIVERS\mbam.sys MBAMService.exe File opened for modification C:\Windows\SysWOW64\drivers\mbamtestfile.dat 2026-07-16_dcf2e29ddbae67afec5e123dc8302998_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File created C:\Windows\system32\drivers\mbae.sys MBAMInstallerService.exe - Modifies RDP port number used by Windows 1 TTPs
- Patched UPX-packed file 1 IoCs
Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
resource yara_rule behavioral2/files/0x000c00000001c545-2057.dat patched_upx - Sets service image path in registry 3 TTPs 4 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MBAMProtection\ImagePath = "\\SystemRoot\\System32\\Drivers\\mbam.sys" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MBAMSwissArmy\ImagePath = "\\SystemRoot\\System32\\Drivers\\mbamswissarmy.sys" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mbamchameleon\ImagePath = "\\SystemRoot\\System32\\Drivers\\MbamChameleon.sys" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MBAMFarflt\ImagePath = "\\SystemRoot\\System32\\Drivers\\farflt11.sys" MBAMService.exe - Checks BIOS information in registry 2 TTPs 6 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 2026-07-16_dcf2e29ddbae67afec5e123dc8302998_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 2026-07-16_dcf2e29ddbae67afec5e123dc8302998_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion MBAMService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate MBAMService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion mbrescue.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate mbrescue.exe - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 43 IoCs
pid Process 5236 elevation_service.exe 4760 elevation_service.exe 3272 maintenanceservice.exe 4592 OSE.EXE 5804 PerceptionSimulationService.exe 600 perfhost.exe 4104 ReFsDedupSvc.exe 5860 SensorDataService.exe 2824 ssh-agent.exe 2692 AgentService.exe 5080 SearchIndexer.exe 2736 MBAMInstallerService.exe 2368 MBVpnTunnelService.exe 264 MBVpnTunnelService.exe 4484 MBAMService.exe 2492 MBAMService.exe 5152 MbamElam.sys 2388 MBAMService.exe 5540 mbamswissarmy.sys 824 MbamChameleon.sys 1020 ig.exe 2748 ig.exe 5408 ig.exe 5956 ig.exe 3364 ig.exe 4460 ig.exe 5008 ig.exe 356 ig.exe 3948 ig.exe 5644 ig.exe 1304 ig.exe 5328 ig.exe 6020 ig.exe 1940 ig.exe 4724 ig.exe 4348 ig.exe 4768 ig.exe 1140 ig.exe 3152 ig.exe 2492 ig.exe 5736 mbam.sys 5976 MBVpnTunnelService.exe 4628 mbrescue.exe - Impair Defenses: Safe Mode Boot 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\MBAMService MBAMInstallerService.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\MBAMService\ = "Service" MBAMInstallerService.exe - Loads dropped DLL 41 IoCs
pid Process 2736 MBAMInstallerService.exe 2736 MBAMInstallerService.exe 2368 MBVpnTunnelService.exe 264 MBVpnTunnelService.exe 264 MBVpnTunnelService.exe 2388 MBAMService.exe 2388 MBAMService.exe 2388 MBAMService.exe 2388 MBAMService.exe 2388 MBAMService.exe 2388 MBAMService.exe 2388 MBAMService.exe 2388 MBAMService.exe 2388 MBAMService.exe 2388 MBAMService.exe 2388 MBAMService.exe 2388 MBAMService.exe 2388 MBAMService.exe 2388 MBAMService.exe 2388 MBAMService.exe 2388 MBAMService.exe 2388 MBAMService.exe 2388 MBAMService.exe 2388 MBAMService.exe 2388 MBAMService.exe 2388 MBAMService.exe 2388 MBAMService.exe 2388 MBAMService.exe 2388 MBAMService.exe 2388 MBAMService.exe 2388 MBAMService.exe 2388 MBAMService.exe 2388 MBAMService.exe 2388 MBAMService.exe 2736 MBAMInstallerService.exe 2388 MBAMService.exe 2388 MBAMService.exe 2736 MBAMInstallerService.exe 2388 MBAMService.exe 5976 MBVpnTunnelService.exe 5976 MBVpnTunnelService.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\G: MBAMService.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\B: MBAMInstallerService.exe File opened (read-only) \??\Q: MBAMInstallerService.exe File opened (read-only) \??\I: MBAMService.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\P: MBAMService.exe File opened (read-only) \??\A: MBAMInstallerService.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\W: MBAMService.exe File opened (read-only) \??\Y: MBAMService.exe File opened (read-only) \??\D: MBAMInstallerService.exe File opened (read-only) \??\I: MBAMInstallerService.exe File opened (read-only) \??\O: MBAMInstallerService.exe File opened (read-only) \??\R: MBAMInstallerService.exe File opened (read-only) \??\V: MBAMService.exe File opened (read-only) \??\S: MBAMInstallerService.exe File opened (read-only) \??\Y: MBAMInstallerService.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\J: MBAMService.exe File opened (read-only) \??\X: MBAMInstallerService.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\M: MBAMService.exe File opened (read-only) \??\U: MBAMService.exe File opened (read-only) \??\G: MBAMInstallerService.exe File opened (read-only) \??\K: MBAMInstallerService.exe File opened (read-only) \??\V: MBAMInstallerService.exe File opened (read-only) \??\K: MBAMService.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\A: MBAMService.exe File opened (read-only) \??\L: MBAMService.exe File opened (read-only) \??\O: MBAMService.exe File opened (read-only) \??\S: MBAMService.exe File opened (read-only) \??\X: MBAMService.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\Q: MBAMService.exe File opened (read-only) \??\J: MBAMInstallerService.exe File opened (read-only) \??\T: MBAMInstallerService.exe File opened (read-only) \??\U: MBAMInstallerService.exe File opened (read-only) \??\W: MBAMInstallerService.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\N: MBAMInstallerService.exe File opened (read-only) \??\L: SearchIndexer.exe - ConfuserEx .NET packer 1 IoCs
Detects ConfuserEx .NET packer.
resource yara_rule behavioral2/files/0x000c00000001c545-2057.dat ConfuserEx - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\system32\AppVClient.exe 2026-07-16_dcf2e29ddbae67afec5e123dc8302998_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C56C4404C4DEF0DC88E5FCD9F09CB2F1 MBAMService.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe 2026-07-16_dcf2e29ddbae67afec5e123dc8302998_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File created C:\Windows\System32\DriverStore\FileRepository\netax88179_178a.inf_amd64_be76888d30e8464a\netax88179_178a.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\net7800-x64-n650f.inf_amd64_bfc44179ca196669\net7800-x64-n650f.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netmyk64.inf_amd64_2f029cbaae1f9a8c\netmyk64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\rtcx21x64.inf_amd64_feec7a9662e785f0\rtcx21x64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netathrx.inf_amd64_ba496c81c003f721\netathrx.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{88958964-1b80-6945-9c61-67d41c5d805b}\SETF766.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{88958964-1b80-6945-9c61-67d41c5d805b} DrvInst.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe 2026-07-16_dcf2e29ddbae67afec5e123dc8302998_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File created C:\Windows\System32\DriverStore\FileRepository\usb4p2pnetadapter.inf_amd64_cc88f42fbf400320\usb4p2pnetadapter.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\bcmdhd64.inf_amd64_0c3c6ca9708e5a9a\bcmdhd64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\nett4x64.inf_amd64_345dd70a1546350e\nett4x64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netloop.inf_amd64_768107cfce81988e\netloop.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netvwifimp.inf_amd64_16c785b9ba77e7b0\netvwifimp.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\Temp\{88958964-1b80-6945-9c61-67d41c5d805b}\SETF766.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{88958964-1b80-6945-9c61-67d41c5d805b}\mbtun.inf DrvInst.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File created C:\Windows\System32\DriverStore\FileRepository\netbxnda.inf_amd64_5cfb6a07d9d75a4a\netbxnda.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\net8192se64.inf_amd64_3d81196084e3f594\net8192se64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\Temp\{88958964-1b80-6945-9c61-67d41c5d805b}\SETF767.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\mbtun.inf_amd64_add82795013a7c3b\mbtun.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\mbtun.inf_amd64_add82795013a7c3b\mbtun.inf DrvInst.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94D97B1EC1F43DD6ED4FE7AB95E144BC_38A1221025A0DFB52F454FF8C79E14CC MBAMService.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File created C:\Windows\System32\DriverStore\FileRepository\netrtwlane01.inf_amd64_e88ba65a7546f702\netrtwlane01.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netbc64.inf_amd64_4c416384b17ee84f\netbc64.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{88958964-1b80-6945-9c61-67d41c5d805b}\mbtun.sys DrvInst.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File created C:\Windows\System32\DriverStore\FileRepository\kdnic_legacy.inf_amd64_052adde7f2101c60\kdnic_legacy.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netbxnd0a.inf_amd64_9744de6fd6c11c4f\netbxnd0a.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\wceisvista.inf_amd64_b98fec2fcf3c69e9\wceisvista.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netjme.inf_amd64_7d2f6f04d092b277\netjme.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{88958964-1b80-6945-9c61-67d41c5d805b}\mbtun.cat DrvInst.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_CF33567922C393BFB92DE8105C392BE5 MBAMService.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-07-16_dcf2e29ddbae67afec5e123dc8302998_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File created C:\Windows\System32\DriverStore\FileRepository\netl1e64.inf_amd64_616d8a2e59fc462f\netl1e64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\net9500-x64-n650f.inf_amd64_566fa98f770451d2\net9500-x64-n650f.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netavpna.inf_amd64_27530893ea84631e\netavpna.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-07-16_dcf2e29ddbae67afec5e123dc8302998_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File created C:\Windows\System32\DriverStore\FileRepository\netelx.inf_amd64_b821dc8c43094e14\netelx.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netvchannel.inf_amd64_4282c59d3148caa2\netvchannel.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\ndisimplatformmp.inf_amd64_8f9eb8ff490e6c70\ndisimplatformmp.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netwbw02.inf_amd64_d0afc216e2ec6863\netwbw02.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\rndiscmp.inf_amd64_e3cf74e485b2778b\rndiscmp.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\bthpan.inf_amd64_c908ea6dab3e932a\bthpan.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\86844F70250DD8EF225D6B4178798C21_44AD5D0C299F1D4EE038B125B5E5863A MBAMService.exe File created C:\Windows\System32\DriverStore\FileRepository\e2xw10x64.inf_amd64_b78633a7607613a0\e2xw10x64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\bcmwdidhdpcie.inf_amd64_b244d6a9a7f90517\bcmwdidhdpcie.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt MBAMService.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File created C:\Windows\System32\DriverStore\FileRepository\netr28ux.inf_amd64_2613a90929adebda\netr28ux.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-07-16_dcf2e29ddbae67afec5e123dc8302998_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File created C:\Windows\System32\DriverStore\FileRepository\net2ic68.inf_amd64_7af2e2aa52ab9b71\net2ic68.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\net44amd.inf_amd64_6af2734d06d3e49f\net44amd.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netxex64.inf_amd64_01587744078125a1\netxex64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netwtw04.inf_amd64_28271e5be9a9f6f4\netwtw04.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\mbtun.inf_amd64_add82795013a7c3b.ini DrvInst.exe File opened for modification C:\Windows\System32\vds.exe 2026-07-16_dcf2e29ddbae67afec5e123dc8302998_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File created C:\Windows\System32\DriverStore\FileRepository\nete1e3e.inf_amd64_71ee3a27d9580084\nete1e3e.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\rt640x64.inf_amd64_cbf4e23981c3c8a3\rt640x64.PNF MBVpnTunnelService.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-07-16_dcf2e29ddbae67afec5e123dc8302998_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\cs\UIAutomationTypes.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\es\System.Windows.Forms.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\ru\UIAutomationProvider.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.UI.Theme.Dark.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.Private.Uri.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\es\System.Windows.Forms.Design.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\PresentationFramework.Luna.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\System.Windows.Forms.Design.Editors.dll MBAMInstallerService.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe elevation_service.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.Formats.Tar.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\de\UIAutomationClientSideProviders.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\zh-Hans\WindowsFormsIntegration.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\Prism.Wpf.dll MBAMInstallerService.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe elevation_service.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.Diagnostics.Tools.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.Runtime.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\Accessibility.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.Diagnostics.FileVersionInfo.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.Net.Http.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.Resources.Reader.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\MbamUI.Data.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\6800e790-1844-481c-a89d-2b10fe8c1f19 2026-07-16_dcf2e29ddbae67afec5e123dc8302998_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2026-07-16_dcf2e29ddbae67afec5e123dc8302998_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\ko\UIAutomationTypes.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\ru\Microsoft.VisualBasic.Forms.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\sdk\farflt11.sys MBAMService.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-07-16_dcf2e29ddbae67afec5e123dc8302998_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\System.Windows.Forms.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.Web.HttpUtility.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\fr\WindowsBase.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\PresentationFramework.Fluent.dll MBAMInstallerService.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-07-16_dcf2e29ddbae67afec5e123dc8302998_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-07-16_dcf2e29ddbae67afec5e123dc8302998_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.ServiceModel.Web.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\ko\PresentationCore.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\tr\System.Xaml.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\zh-Hans\PresentationUI.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\MbamUI.Tray.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.ComponentModel.EventBasedAsync.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.Diagnostics.Contracts.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.Security.Claims.dll MBAMInstallerService.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe elevation_service.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\cs\UIAutomationProvider.resources.dll MBAMInstallerService.exe File opened for modification C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\30f94975-afbe-4a3b-9cc7-e42d28b6c9fc 2026-07-16_dcf2e29ddbae67afec5e123dc8302998_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.Linq.Queryable.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.Net.Http.Json.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\fr\System.Xaml.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\System.Configuration.ConfigurationManager.dll MBAMInstallerService.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-07-16_dcf2e29ddbae67afec5e123dc8302998_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-07-16_dcf2e29ddbae67afec5e123dc8302998_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.Numerics.Vectors.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\malwarebytes_assistant.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\offreg.dll MBAMInstallerService.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-07-16_dcf2e29ddbae67afec5e123dc8302998_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\ru\UIAutomationTypes.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\System.Design.dll MBAMInstallerService.exe - Drops file in Windows directory 7 IoCs
description ioc Process File opened for modification C:\Windows\inf\oem1.inf DrvInst.exe File created C:\Windows\inf\oem1.inf DrvInst.exe File created C:\Windows\ELAMBKUP\MbamElam.sys MBAMService.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-07-16_dcf2e29ddbae67afec5e123dc8302998_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\INF\setupapi.dev.log MBVpnTunnelService.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 2 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh MBVpnTunnelService.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh MBVpnTunnelService.exe - Modifies trusted root certificate store through registry 1 TTPs 13 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54362000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa22000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\5A8CEF45D7A69859767A8C8B4496B578CF474B1A\Blob = 0300000001000000140000005a8cef45d7a69859767a8c8b4496b578cf474b1a2000000001000000450500003082054130820329a0030201020213066c9fd29635869f0a0fe58678f85b26bb8a37300d06092a864886f70d01010c05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412032301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f74204341203230820222300d06092a864886f70d01010105000382020f003082020a0282020100ad969f2d9c4a4c4a81795199ec8acb6b605113bc4d6d06fcb0088ddd19106ac7260c35d8c06f2084e994b19b8503c35bdb4ae8c8f89076d95b4fe34ce806364dcc9aac3d0c902b92d4061960ac374479858182ad5a37e00dcc9da64c5276ea439db704d150f655e0d5d2a64985e937e9ca7eae5c954d489a3fae205a6d8895d934b8521a4390b0bf6c05b9b678b7ead0e43a3c125362ff4af27bbe3505a91234e3f36474622c3d00495a28fe3244bb87dd652702713bda4af71fdacdf72155904f0fecae82e19f6bd945d3bbf05f87ed3c2c3986da3fdeec7255eb79a3addbdd7cb0ba1ccefcde4f3576cf0ff8781f6a36514627615be99ecff0a2557d7c258a6f2fb4c5cf842e2bfd0d51106cfb5f1bbc1b7ec5ae3b98013192ff0b57f49ab2b957e9abef0d76d1f0eef4ce86a7e06ee9b469a1df69f633c6692e97139ea587b057108137c953b3bb7ff692d19cd018f4926eda834fa663994ca5fb5eef21647a205f6c648515cb37e9620c0b2a16dc012e32da3e4bf59e3af6174094ef9e910886fabe63a85a33eccb744395f96c695236c7296ffc55035c1ffb9fbd47ebe74947950b4e89220949e0f5611ef1bf2e8a726e8059ff573af97532a34e5feced2862d94d73f2cc811760edcdebdcdba7cac57e02bdf2540854fdb42d092c17544a98d154e1516708d2ed6e7e6f3fd22d81592966cb903995111e7427feddebaf0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414b00cf04c30f405580248fd33e552af4b84e36652300d06092a864886f70d01010c05000382020100aaa8808f0e78a3e0a2d4cde6f5987a3bea0003b0970e93bc5aa8f62c8c7287a9b1fc7f73fd637178a58759cf30e10d10b2135a6d82f56ae6809fa0050b68e4476bc76adfb6fd773272e518fa09f4a0932c5dd28c75857665900c0379b7312363ad788309866884cafff9cf269a9279e7cd4bc5e761a717cbf3a91293936ba7e82f5392c46058b0cc0251185b858d625963b6adb4de9afb26f70027c05d55377499c9507fe3592e44e32c25eeec4c3277b49f1ae94b5d20c5dafd1c8716c643e8d4bb269a45705ea90b3753e2467b27fde046f289b7cc42b6cb28266ed9a5c93ac8411360f7508c15aeb26d1a151a5778e6922ad96590823f6c02afae123a27963604d71da28063a99bf1e5bab47c14b04ec9b11f745f38f651ea9bfa2ca211d4a92d271a45b1afb24e710dc05846d66906cb53cbb3fe6b41cd417e7d4c0f7c72797a59cd5e4a0eac9ba99873797cb4f4ccb9b8070cb2745cb8c76f88a190a7f4aaf9bf673af41a15621eb79fbe3db129af67a112f25810195303301bb81a89f69cbd97038ea309f31d8b21f1b4dfe41cd19f650206ea5cd613b384efa2a55c8c7729a768c06bae40d2a8b4eacdf08d4b389c199a1b2854b88990efca75813e1ef26424c718af4eff479e07f63565a4d30a56fff517646cefa822254993b6df0017da587e5deec51bb0d1d15f2110c7f9f3ba020a2707c5f1d6c7d3e0fb09606c MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0D44DD8C3C8C1A1A58756481E90F2E2AFFB3D26E\Blob = 0300000001000000140000000d44dd8c3c8c1a1a58756481e90f2e2affb3d26e2000000001000000ba010000308201b63082015ba0030201020213066c9fd5749736663f3b0b9ad9e89e7603f24a300a06082a8648ce3d0403023039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412033301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f7420434120333059301306072a8648ce3d020106082a8648ce3d030107034200042997a7c6417fc00d9be8011b56c6f252a5ba2db212e8d22ed7fac9c5d8aa6d1f73813b3b986b397c33a5c54e868e8017686245577d44581db337e56708eb66dea3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414abb6dbd7069e37ac3086079170c79cc419b178c0300a06082a8648ce3d0403020349003046022100e08592a317b78df92b06a593ac1a98686172fae1a1d0fb1c7860a64399c5b8c40221009c02eff1949cb396f9ebc62af8b62cfe3a901416d78c6324481cdf307dd5683b MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F6108407D6F8BB67980CC2E244C2EBAE1CEF63BE\Blob = 030000000100000014000000f6108407d6f8bb67980cc2e244c2ebae1cef63be2000000001000000f6010000308201f230820178a0030201020213066c9fd7c1bb104c2943e5717b7b2cc81ac10e300a06082a8648ce3d0403033039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412034301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f7420434120343076301006072a8648ce3d020106052b8104002203620004d2ab8a374fa3530dfec18a7b4ba87b464b63b062f62d1bdb087121d200e863bd9a27fbf0396e5dea3da5c981aaa35b2098455d16dbfde8106de39ce0e3bd5f8462f3706433a0cb242f70ba88a12aa075f881ae6206c481db396e29b01efa2e5ca3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414d3ecc73a656ecce1da769a56fb9cf3866d57e581300a06082a8648ce3d040303036800306502303a8b21f1bd7e11add0ef58962fd6eb9d7e908d2bcf6655c32ce328a9700a470ef0375912ff2d9994284e2a4f354d335a023100ea75004e3bc43a941291c958469d211372a7889c8ae44c4adb96d4ac8b6b6b49125333add7e4be24fcb50a76d4a5bc10 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\1C58A3A8518E8759BF075B76B750D4F2DF264FCD\Blob = 0300000001000000140000001c58a3a8518e8759bf075b76b750d4f2df264fcd2000000001000000c2040000308204be308203a6a003020102021006d8d904d5584346f68a2fa754227ec4300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3231303431343030303030305a170d3331303431333233353935395a304f310b300906035504061302555331153013060355040a130c446967694365727420496e633129302706035504031320446967694365727420544c53205253412053484132353620323032302043413130820122300d06092a864886f70d01010105000382010f003082010a0282010100c14bb3654770bcdd4f58dbec9cedc366e51f311354ad4a66461f2c0aec6407e52edcdcb90a20eddfe3c4d09e9aa97a1d8288e51156db1e9f58c251e72c340d2ed292e156cbf1795fb3bb87ca25037b9a52416610604f571349f0e8376783dfe7d34b674c2251a6df0e9910ed57517426e27dc7ca622e131b7f238825536fc13458008b84fff8bea75849227b96ada2889b15bca07cdfe951a8d5b0ed37e236b4824b62b5499aecc767d6e33ef5e3d6125e44f1bf71427d58840380b18101faf9ca32bbb48e278727c52b74d4a8d697dec364f9cace53a256bc78178e490329aefb494fa415b9cef25c19576d6b79a72ba2272013b5d03d40d321300793ea99f50203010001a38201823082017e30120603551d130101ff040830060101ff020100301d0603551d0e04160414b76ba2eaa8aa848c79eab4da0f98b2c59576b9f4301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030106082b06010505070302307606082b06010505070101046a3068302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304006082b060105050730028634687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274476c6f62616c526f6f7443412e63727430420603551d1f043b30393037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274476c6f62616c526f6f7443412e63726c303d0603551d2004363034300b06096086480186fd6c02013007060567810c01013008060667810c0102013008060667810c0102023008060667810c010203300d06092a864886f70d01010b050003820101008032ce5e0bdd6e5a0d0aafe1d684cbc08efa8570edda5db30cf72b7540fe850afaf33178b7704b1a8958ba80bdf36b1de97ecf0bba589c59d490d3fd6cfdd0986db771825bcf6d0b5a09d07bdec443d82aa4de9e41265fbb8f99cbddaee1a86f9f87fe74b71f1b20abb14fc6f5675d5d9b3ce9ff69f7616cd6d9f3fd36c6ab038876d24b2e7586e3fcd8557d26c21177df3e02b67cf3ab7b7a86366fb8f7d89371cf86df7330fa7babed2a59c842843b11171a52f3c90e147da25b7267ba71ed574766c5b8024a65345e8bd02a3c209c51994ce7529ef76b112b0d927e1de88aeb36164387ea2a63bf753febdec403bb0a3cf730efebaf4cfc8b3610733ef3a4 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E\Blob = 030000000100000014000000b51c067cee2b0c3df855ab2d92f4fe39d4e70f0e2000000001000000e1030000308203dd308202c5a003020102020100300d06092a864886f70d01010b050030818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a30818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bdedc103fcf68ffc02b16f5b9f48d99d79e2a2b703615618c347b6d7ca3d352e8943f7a1699bde8a1afd13209cb44977322956fdb9ec8cdd22fa72dc276197eef65a84ec6e19b9892cdc845bd574fb6b5fc589a51052894655f4b8751ce67fe454ae4bf85572570219f8177159eb1e280774c59d48be6cb4f4a4b0f364377992c0ec465e7fe16d534c62afcd1f0b63bb3a9dfbfc7900986174cf26824063f3b2726a190d99cad40e75cc37fb8b89c159f1627f5fb35f6530f8a7b74d765a1e765e34c0e89656998ab3f07fa4cdbddc32317c91cfe05f11f86baa495cd19994d1a2e3635b0976b55662e14b741d96d426d4080459d0980e0ee6defcc3ec1f90f10203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147c0c321fa7d9307fc47d68a362a8a1ceab075b27300d06092a864886f70d01010b050003820101001159fa254f036f94993b9a1f828539d47605945ee128936d625d09c2a0a8d4b07538f1346a9de49f8a862651e62cd1c62d6e95204a9201ecb88a677b31e2672e8c9503262e439d4a31f60eb50cbbb7e2377f22ba00a30e7b52fb6bbb3bc4d379514ecd90f4670719c83c467a0d017dc558e76de68530179a24c410e004f7e0f27fd4aa0aff421d37ed94e5645912207738d3323e3881759673fa688fb1cbce1fc5ecfa9c7ecf7eb1f1072db6fcbfcaa4bfd097054abcea18280290bd5478092171d3d17d1dd916b0a9613dd00a0022fcc77bcb0964450b3b4081f77d7c32f598ca588e7d2aee90597364f936745e25a1f566052e7f3915a92afb508b8e8569f4 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8DA7F965EC5EFC37910F1C6E59FDC1CC6A6EDE16\Blob = 0300000001000000140000008da7f965ec5efc37910f1c6e59fdc1cc6a6ede162000000001000000450300003082034130820229a0030201020213066c9fcf99bf8c0a39e2f0788a43e696365bca300d06092a864886f70d01010b05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412031301e170d3135303532363030303030305a170d3338303131373030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f74204341203130820122300d06092a864886f70d01010105000382010f003082010a0282010100b2788071ca78d5e371af478050747d6ed8d78876f49968f7582160f97484012fac022d86d3a0437a4eb2a4d036ba01be8ddb48c80717364cf4ee8823c73eeb37f5b519f84968b0ded7b976381d619ea4fe8236a5e54a56e445e1f9fdb416fa74da9c9b35392ffab02050066c7ad080b2a6f9afec47198f503807dca2873958f8bad5a9f948673096ee94785e6f89a351c0308666a14566ba54eba3c391f948dcffd1e8302d7d2d747035d78824f79ec4596ebb738717f2324628b843fab71daacab4f29f240e2d4bf7715c5e69ffea9502cb388aae50386fdbfb2d621bc5c71e54e177e067c80f9c8723d63f40207f2080c4804c3e3b24268e04ae6c9ac8aa0d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604148418cc8534ecbc0c94942e08599cc7b2104e0a08300d06092a864886f70d01010b0500038201010098f2375a4190a11ac57651282036230eaee628bbaaf894ae48a4307f1bfc248d4bb4c8a197f6b6f17a70c85393cc0828e39825cf23a4f9de21d37c8509ad4e9a753ac20b6a897876444718656c8d418e3b7f9acbf4b5a750d7052c37e8034bade961a0026ef5f2f0c5b2ed5bb7dcfa945c779e13a57f52ad95f2f8933bde8b5c5bca5a525b60af14f74befa3fb9f40956d3154fc42d3c7461f23add90f48709ad9757871d1724334756e5759c2025c266029cf2319168e8843a5d4e4cb08fb231143e843297262a1a95d5e08d490aeb8d8ce14c2d055f286f6c49343776661c0b9e841d7977860036e4a72aea5d17dba109e866c1b8ab95933f8ebc490bef1b9 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\2AD974A775F73CBDBBD8F5AC3A49255FA8FB1F8C\Blob = 0300000001000000140000002ad974a775f73cbdbbd8f5ac3a49255fa8fb1f8c2000000001000000620400003082045e30820346a0030201020213077312380b9d6688a33b1ed9bf9ccda68e0e0f300d06092a864886f70d01010b05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412031301e170d3232303832333232323132385a170d3330303832333232323132385a303c310b3009060355040613025553310f300d060355040a1306416d617a6f6e311c301a06035504031313416d617a6f6e205253412032303438204d303130820122300d06092a864886f70d01010105000382010f003082010a0282010100eb712ca9cb1f8828923230af8a570f78b73725955587ac675c97d322c8daa214676b7cf067dae2032ab356125dc6b547f96708a7937a9592180fb4f9f910369a7f2f80b64fba134ec75d531ee0dd96330720d396bc12e4745042a1051373b54f9b4424fe2d7fedbc2285ec362133977506ce271882dce3d9c582078d5e26012626671fd93f13cf32ba6bad7864fcaaff0e023c07df9c0578728cfdea75b7032884dae86e078cd05085ef8154b2716eec6d62ef8f94c35ee9c4a4d091c02e249198caeeba258ed4f671b6fb5b6b38064837478d86dcf2ea06fb76377d9eff424e4d588293cfe271c278b17aab4b5b94378881e4d9af24aef872c565fb4bb451e70203010001a382015a3082015630120603551d130101ff040830060101ff020100300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030106082b06010505070302301d0603551d0e0416041481b80e638a891218e5fa3b3b50959fe6e5901385301f0603551d230418301680148418cc8534ecbc0c94942e08599cc7b2104e0a08307b06082b06010505070101046f306d302f06082b060105050730018623687474703a2f2f6f6373702e726f6f746361312e616d617a6f6e74727573742e636f6d303a06082b06010505073002862e687474703a2f2f6372742e726f6f746361312e616d617a6f6e74727573742e636f6d2f726f6f746361312e636572303f0603551d1f043830363034a032a030862e687474703a2f2f63726c2e726f6f746361312e616d617a6f6e74727573742e636f6d2f726f6f746361312e63726c30130603551d20040c300a3008060667810c010201300d06092a864886f70d01010b05000382010100ad00de0205232e063262b46bb19416e41140de2bfa59c135efe0aa8f2b41b9d1f38739001df23db5a7470c0606c691f3075702d4edbd17c1909abf4875a2074f30dd4a6a42b50d3d15c00ffe845bc63c99cc5752b1d86e12d59692934b94e507e88982086a7a34d49e64e13d876a92909a63a14bf88fb6ea34d305be20c2de06e28c9f738b9f4d3985cace19369d85c99ec9f8503fb67e88a1efca84068b50b40a5ca61c44f1fdc8614060f26125aa07f4c7c27375e40c0b428d04e55f4448995b7b898196a7889d4b0d62e804c4d7feb4e8b26dcaecc01cbc385b1ddf85ce5b7ae3494b6cb9a7ddf405b249ade1c5146bc2ccebcd7fd65869bac3207e7fb0b8 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 6b00000001000000200000005367f20c7ade0e2bca790915056d086b720c33c1fa2a2661acf787e3292e1270140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a2030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa20f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e1900000001000000100000009f687581f7ef744ecfc12b9cee6238f12000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 MBAMService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 5c0000000100000004000000001000001900000001000000100000009f687581f7ef744ecfc12b9cee6238f10f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa2140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a26b00000001000000200000005367f20c7ade0e2bca790915056d086b720c33c1fa2a2661acf787e3292e12702000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 MBAMService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 MBAMInstallerService.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-16_dcf2e29ddbae67afec5e123dc8302998_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe - Checks SCSI registry key(s) 3 TTPs 52 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe - Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MBAMService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MBAMService.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION MBAMInstallerService.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Malwarebytes.exe = "11000" MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION MBAMService.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\mbam.exe = "11000" MBAMService.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\mbamtray.exe = "11000" MBAMService.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000915c02727115dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:\ MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs MBAMService.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs MBAMService.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office MBAMInstallerService.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:\ MBAMInstallerService.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C MBAMService.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006cf57a717115dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0\Common MBAMInstallerService.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000e892fb37115dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template" SearchProtocolHost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\16.0\Common\Security MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MBAMService.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: MBAMInstallerService.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies MBAMInstallerService.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList SearchProtocolHost.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A583D5DD-F005-4D17-B564-5B594BB58339}\ProxyStubClsid32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{108E7F3D-FB06-4024-94FB-3B8E687587E4}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8ED8EAAB-1FA5-48D4-ACD4-32645776BA28}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{19E8B60E-50A1-4E29-9138-A13421D2BF7D}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BF153224-DA64-41F1-AA87-321B345870FA}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4F9DF82A-36EA-4E90-BF20-CCBB6B66117F}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5DA5CFCA-E804-4A2F-8B93-F5431D233D54}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8A574BA8-3535-41F9-AB73-FA93F8A7DC3B}\ProxyStubClsid32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{76AD4430-9C5C-4FC2-A15F-4E16ACD735AC} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{46AEAC9A-C091-4B63-926C-37CFBD9D244F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F81B1882-A388-42E5-9351-05C858E52DDC} MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDCB7916-7DE8-44C8-BAF6-F1BBB3268456}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\malwarebytes\shell\open\command MBAMInstallerService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MB.CleanController\ = "CleanController Class" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{50538523-AA2F-40D3-9B58-DB51D5BD3D4A}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4D6484EE-AA00-472F-A4F0-18D905C71EA3}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{735BE2C0-5A9B-457A-A0A9-4B27FCED2817}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5D448EF3-7261-4C0C-909C-6D56043C259D}\TypeLib\ = "{5709DEEB-F05E-4D5C-8DC4-3B0D924EE08F}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3C0ECFDC-317D-406B-ADF5-C0E8217E244F} MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C4C41809-DC9B-4791-8F18-3F04C847E62F}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6655E528-3168-47A4-BF82-A71E9E6AB5F7}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{553B1C62-BE94-4CE0-8041-EB3BC1329D20}\TypeLib\Version = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F641DDA1-271F-47C7-90C2-4327665959DF}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{571FB9A8-E53B-4740-B125-082207566E5F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{55D0C28B-2BF3-4230-B48D-DB2C2D7BF6F8}\ProxyStubClsid32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B5186B66-AE3D-4EC4-B9F5-67EC478625BE}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{20BFD5CC-DF6F-474B-B0D1-901514C35612}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1917B432-C1CE-4A96-A08E-A270E00E5B23}\TypeLib\ = "{2446F405-83F0-460F-B837-F04540BB330C}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9DAB0CA5-AE19-41AE-955C-41DD44C52697}\VersionIndependentProgID MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AD174136-2177-4A57-88AA-F336662EE04A} MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{94E6A9DF-4AAB-48E7-8A94-65CA2481D1F6}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{36BABBB6-6184-44EC-8109-76CBF522C9EF}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FFB9BE53-8FE4-4B61-9C25-18E5B4B202E8}\TypeLib\ = "{332AFEBA-9341-4CEC-8EA6-DB155A99DF63}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{090D2E82-C71B-414E-AF6A-6681A92FF2B3}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BBE61C7C-6D07-4067-B177-0C88A58FA92D}\ = "_IRTPControllerEventsV9" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{616E9BE3-358B-4C06-8AAB-0ACF8D089931} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DE35F2CA-6335-49BA-8E86-F6E246CFCEA6}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C7BCC13C-47B9-4DC0-8FC6-B2A489EF60EF}\ = "IScanControllerV4" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B471ACFB-E67A-4BE9-A328-F6A906DDDEAA}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EE77988C-B530-4686-8294-F7AB429DFD0C}\TypeLib\Version = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EABA01A8-8468-430A-9D6E-4C9F1CE22C88}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{72F290D5-789C-4D8A-9EBE-63ECEA150373}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8ED8EAAB-1FA5-48D4-ACD4-32645776BA28} MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{929A5C6C-42D7-4248-9533-03C32165691F}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{53260A87-5F77-4449-95F1-77A210A2A6D8}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7968A0D1-5C9E-4F28-8C2F-E215BC7DF146}\TypeLib\ = "{6C5B978B-68C9-45C7-9D6E-0BA57A3C7EB2}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6D344266-10BB-4FFF-BC15-1BC6A3F50E54} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6D344266-10BB-4FFF-BC15-1BC6A3F50E54}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AC765BED-7B43-4A78-9958-11E3612E4B2F}\ = "_IVPNControllerEventsV2" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{704E9E72-AF0A-4883-B0FF-01D08E47AD2F}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{716C74C4-80C9-4CEB-A5E6-9E3F5F209D9B}\ = "IScanControllerV24" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CE7ABFE9-8F8F-4EDD-86BD-9209FD072126}\TypeLib\Version = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD67766C-A28D-44F3-A5D0-962965510B2D}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FB81F893-5D01-4DFD-98E1-3A6CB9C3E63E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4412646D-16F5-4F3C-8348-0744CDEBCCBF}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{05510285-C4B6-4AFD-971B-EBE3139F45A3}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{44864E51-B63C-49C2-89CF-CA8F5F15564D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0C4652FC-FA35-4394-A133-F68409776465}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C731375E-3199-4C88-8326-9F81D3224DAD}\1.0\HELPDIR\ = "C:\\Program Files\\Malwarebytes\\Anti-Malware" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5B9F1C8B-1E3B-4FBA-9C8A-7B0E6DCD9C9E}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D0C724C7-E25C-4505-A300-4677A3DCA32D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B1790AB-65B0-4F50-812F-7CC86FA94AF7}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{638A43D2-5475-424B-87B8-042109D7768F}\TypeLib\Version = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{07B91244-8A85-4196-8904-7681CD9C42A6}\ProxyStubClsid32 MBAMService.exe - Modifies system certificate store 2 TTPs 12 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F6108407D6F8BB67980CC2E244C2EBAE1CEF63BE MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\1C58A3A8518E8759BF075B76B750D4F2DF264FCD MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\2AD974A775F73CBDBBD8F5AC3A49255FA8FB1F8C MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8DA7F965EC5EFC37910F1C6E59FDC1CC6A6EDE16 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\5A8CEF45D7A69859767A8C8B4496B578CF474B1A MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0D44DD8C3C8C1A1A58756481E90F2E2AFFB3D26E MBAMInstallerService.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1452 2026-07-16_dcf2e29ddbae67afec5e123dc8302998_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1452 2026-07-16_dcf2e29ddbae67afec5e123dc8302998_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1452 2026-07-16_dcf2e29ddbae67afec5e123dc8302998_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1452 2026-07-16_dcf2e29ddbae67afec5e123dc8302998_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1452 2026-07-16_dcf2e29ddbae67afec5e123dc8302998_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1452 2026-07-16_dcf2e29ddbae67afec5e123dc8302998_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1452 2026-07-16_dcf2e29ddbae67afec5e123dc8302998_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1452 2026-07-16_dcf2e29ddbae67afec5e123dc8302998_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1452 2026-07-16_dcf2e29ddbae67afec5e123dc8302998_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1452 2026-07-16_dcf2e29ddbae67afec5e123dc8302998_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1452 2026-07-16_dcf2e29ddbae67afec5e123dc8302998_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1452 2026-07-16_dcf2e29ddbae67afec5e123dc8302998_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1452 2026-07-16_dcf2e29ddbae67afec5e123dc8302998_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1452 2026-07-16_dcf2e29ddbae67afec5e123dc8302998_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1452 2026-07-16_dcf2e29ddbae67afec5e123dc8302998_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1452 2026-07-16_dcf2e29ddbae67afec5e123dc8302998_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1452 2026-07-16_dcf2e29ddbae67afec5e123dc8302998_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1452 2026-07-16_dcf2e29ddbae67afec5e123dc8302998_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1452 2026-07-16_dcf2e29ddbae67afec5e123dc8302998_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1452 2026-07-16_dcf2e29ddbae67afec5e123dc8302998_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1452 2026-07-16_dcf2e29ddbae67afec5e123dc8302998_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1452 2026-07-16_dcf2e29ddbae67afec5e123dc8302998_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1452 2026-07-16_dcf2e29ddbae67afec5e123dc8302998_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1452 2026-07-16_dcf2e29ddbae67afec5e123dc8302998_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1452 2026-07-16_dcf2e29ddbae67afec5e123dc8302998_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1452 2026-07-16_dcf2e29ddbae67afec5e123dc8302998_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1452 2026-07-16_dcf2e29ddbae67afec5e123dc8302998_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1452 2026-07-16_dcf2e29ddbae67afec5e123dc8302998_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1452 2026-07-16_dcf2e29ddbae67afec5e123dc8302998_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1452 2026-07-16_dcf2e29ddbae67afec5e123dc8302998_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 2736 MBAMInstallerService.exe 2736 MBAMInstallerService.exe 2736 MBAMInstallerService.exe 2736 MBAMInstallerService.exe 2736 MBAMInstallerService.exe 2736 MBAMInstallerService.exe 2736 MBAMInstallerService.exe 2736 MBAMInstallerService.exe 2736 MBAMInstallerService.exe 2736 MBAMInstallerService.exe 2736 MBAMInstallerService.exe 2736 MBAMInstallerService.exe 2736 MBAMInstallerService.exe 2736 MBAMInstallerService.exe 2736 MBAMInstallerService.exe 2736 MBAMInstallerService.exe 2736 MBAMInstallerService.exe 2736 MBAMInstallerService.exe 2736 MBAMInstallerService.exe 2736 MBAMInstallerService.exe 2736 MBAMInstallerService.exe 2736 MBAMInstallerService.exe 2736 MBAMInstallerService.exe 2736 MBAMInstallerService.exe 2736 MBAMInstallerService.exe 2736 MBAMInstallerService.exe 2736 MBAMInstallerService.exe 2736 MBAMInstallerService.exe 2736 MBAMInstallerService.exe 2736 MBAMInstallerService.exe 2388 MBAMService.exe 2388 MBAMService.exe 2388 MBAMService.exe 2388 MBAMService.exe - Suspicious behavior: LoadsDriver 16 IoCs
pid Process 828 Process not Found 828 Process not Found 828 Process not Found 828 Process not Found 828 Process not Found 828 Process not Found 828 Process not Found 828 Process not Found 828 Process not Found 828 Process not Found 828 Process not Found 828 Process not Found 828 Process not Found 828 Process not Found 828 Process not Found 828 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1452 2026-07-16_dcf2e29ddbae67afec5e123dc8302998_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe Token: SeBackupPrivilege 4104 ReFsDedupSvc.exe Token: SeRestorePrivilege 4104 ReFsDedupSvc.exe Token: SeBackupPrivilege 4104 ReFsDedupSvc.exe Token: SeRestorePrivilege 4104 ReFsDedupSvc.exe Token: SeBackupPrivilege 4104 ReFsDedupSvc.exe Token: SeRestorePrivilege 4104 ReFsDedupSvc.exe Token: SeBackupPrivilege 4104 ReFsDedupSvc.exe Token: SeRestorePrivilege 4104 ReFsDedupSvc.exe Token: SeBackupPrivilege 4104 ReFsDedupSvc.exe Token: SeRestorePrivilege 4104 ReFsDedupSvc.exe Token: SeAssignPrimaryTokenPrivilege 2692 AgentService.exe Token: 33 5080 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 5080 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5080 SearchIndexer.exe Token: SeDebugPrivilege 1452 2026-07-16_dcf2e29ddbae67afec5e123dc8302998_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe Token: SeDebugPrivilege 1452 2026-07-16_dcf2e29ddbae67afec5e123dc8302998_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe Token: SeDebugPrivilege 1452 2026-07-16_dcf2e29ddbae67afec5e123dc8302998_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe Token: SeDebugPrivilege 1452 2026-07-16_dcf2e29ddbae67afec5e123dc8302998_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe Token: SeDebugPrivilege 2736 MBAMInstallerService.exe Token: SeDebugPrivilege 2736 MBAMInstallerService.exe Token: SeDebugPrivilege 2736 MBAMInstallerService.exe Token: SeDebugPrivilege 2736 MBAMInstallerService.exe Token: SeDebugPrivilege 2736 MBAMInstallerService.exe Token: SeDebugPrivilege 2736 MBAMInstallerService.exe Token: SeDebugPrivilege 2736 MBAMInstallerService.exe Token: SeDebugPrivilege 2736 MBAMInstallerService.exe Token: SeDebugPrivilege 2736 MBAMInstallerService.exe Token: SeDebugPrivilege 2736 MBAMInstallerService.exe Token: SeDebugPrivilege 2736 MBAMInstallerService.exe Token: SeDebugPrivilege 2736 MBAMInstallerService.exe Token: SeDebugPrivilege 2736 MBAMInstallerService.exe Token: SeDebugPrivilege 2736 MBAMInstallerService.exe Token: SeDebugPrivilege 2736 MBAMInstallerService.exe Token: SeDebugPrivilege 2736 MBAMInstallerService.exe Token: SeDebugPrivilege 2736 MBAMInstallerService.exe Token: SeDebugPrivilege 2736 MBAMInstallerService.exe Token: SeDebugPrivilege 2736 MBAMInstallerService.exe Token: SeDebugPrivilege 2736 MBAMInstallerService.exe Token: SeDebugPrivilege 2736 MBAMInstallerService.exe Token: SeDebugPrivilege 2736 MBAMInstallerService.exe Token: SeDebugPrivilege 2736 MBAMInstallerService.exe Token: SeDebugPrivilege 2736 MBAMInstallerService.exe Token: SeDebugPrivilege 2736 MBAMInstallerService.exe Token: SeDebugPrivilege 2736 MBAMInstallerService.exe Token: SeDebugPrivilege 2736 MBAMInstallerService.exe Token: SeDebugPrivilege 2736 MBAMInstallerService.exe Token: SeDebugPrivilege 2736 MBAMInstallerService.exe Token: SeDebugPrivilege 2736 MBAMInstallerService.exe Token: SeDebugPrivilege 2736 MBAMInstallerService.exe Token: SeDebugPrivilege 2736 MBAMInstallerService.exe Token: SeDebugPrivilege 2736 MBAMInstallerService.exe Token: SeDebugPrivilege 2736 MBAMInstallerService.exe Token: SeDebugPrivilege 2736 MBAMInstallerService.exe Token: SeDebugPrivilege 2736 MBAMInstallerService.exe Token: SeDebugPrivilege 2736 MBAMInstallerService.exe Token: SeDebugPrivilege 2736 MBAMInstallerService.exe Token: SeDebugPrivilege 2736 MBAMInstallerService.exe Token: SeDebugPrivilege 2736 MBAMInstallerService.exe Token: SeDebugPrivilege 2736 MBAMInstallerService.exe Token: SeDebugPrivilege 2736 MBAMInstallerService.exe Token: SeDebugPrivilege 2736 MBAMInstallerService.exe Token: SeDebugPrivilege 2736 MBAMInstallerService.exe Token: SeDebugPrivilege 2736 MBAMInstallerService.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1452 2026-07-16_dcf2e29ddbae67afec5e123dc8302998_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe - Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 5080 wrote to memory of 3808 5080 SearchIndexer.exe 101 PID 5080 wrote to memory of 2556 5080 SearchIndexer.exe 102 PID 5080 wrote to memory of 6036 5080 SearchIndexer.exe 103 PID 5080 wrote to memory of 3336 5080 SearchIndexer.exe 104 PID 2736 wrote to memory of 2368 2736 MBAMInstallerService.exe 110 PID 2736 wrote to memory of 4484 2736 MBAMInstallerService.exe 115 PID 2388 wrote to memory of 1020 2388 MBAMService.exe 131 PID 2388 wrote to memory of 2748 2388 MBAMService.exe 132 PID 2388 wrote to memory of 5408 2388 MBAMService.exe 133 PID 2388 wrote to memory of 5956 2388 MBAMService.exe 134 PID 2388 wrote to memory of 3364 2388 MBAMService.exe 135 PID 2388 wrote to memory of 4460 2388 MBAMService.exe 136 PID 2388 wrote to memory of 5008 2388 MBAMService.exe 137 PID 2388 wrote to memory of 356 2388 MBAMService.exe 138 PID 2388 wrote to memory of 3948 2388 MBAMService.exe 139 PID 2388 wrote to memory of 5644 2388 MBAMService.exe 140 PID 2388 wrote to memory of 1304 2388 MBAMService.exe 141 PID 2388 wrote to memory of 5328 2388 MBAMService.exe 142 PID 2388 wrote to memory of 6020 2388 MBAMService.exe 143 PID 2388 wrote to memory of 1940 2388 MBAMService.exe 144 PID 2388 wrote to memory of 4724 2388 MBAMService.exe 145 PID 2388 wrote to memory of 4348 2388 MBAMService.exe 146 PID 2388 wrote to memory of 4768 2388 MBAMService.exe 147 PID 2388 wrote to memory of 1140 2388 MBAMService.exe 148 PID 2388 wrote to memory of 3152 2388 MBAMService.exe 149 PID 2388 wrote to memory of 2492 2388 MBAMService.exe 150 PID 2388 wrote to memory of 4628 2388 MBAMService.exe 154
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-16_dcf2e29ddbae67afec5e123dc8302998_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-16_dcf2e29ddbae67afec5e123dc8302998_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe"1⤵
- Drops file in Drivers directory
- Checks BIOS information in registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1452
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:5236
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4760
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:3272
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:4592
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:5804
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
PID:600
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4104
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5860
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:2824
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2692
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:3808
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:2556
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 952 2848 2840 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:6036
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 952 2884 2844 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵
- Modifies data under HKEY_USERS
PID:3336
-
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- Modifies trusted root certificate store through registry
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe" /installmbtun2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
PID:2368
-
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe" /Service /Protected2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
PID:4484
-
-
C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Event Triggered Execution: Netsh Helper DLL
PID:264
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "9" "C:\Program Files\Malwarebytes\Anti-Malware\mbtun\mbtun.inf" "9" "4ba9030c7" "0000000000000184" "Service-0x0-3e7$\Default" "0000000000000114" "208" "C:\Program Files\Malwarebytes\Anti-Malware\mbtun"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:2996
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"1⤵
- Executes dropped EXE
PID:2492
-
C:\Windows\system32\DRIVERS\MbamElam.sysC:\Windows\system32\DRIVERS\MbamElam.sys1⤵
- Executes dropped EXE
PID:5152
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies trusted root certificate store through registry
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Program Files\Malwarebytes\Anti-Malware\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:1020
-
-
C:\Program Files\Malwarebytes\Anti-Malware\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:2748
-
-
C:\Program Files\Malwarebytes\Anti-Malware\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:5408
-
-
C:\Program Files\Malwarebytes\Anti-Malware\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:5956
-
-
C:\Program Files\Malwarebytes\Anti-Malware\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:3364
-
-
C:\Program Files\Malwarebytes\Anti-Malware\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:4460
-
-
C:\Program Files\Malwarebytes\Anti-Malware\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:5008
-
-
C:\Program Files\Malwarebytes\Anti-Malware\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:356
-
-
C:\Program Files\Malwarebytes\Anti-Malware\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:3948
-
-
C:\Program Files\Malwarebytes\Anti-Malware\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:5644
-
-
C:\Program Files\Malwarebytes\Anti-Malware\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:1304
-
-
C:\Program Files\Malwarebytes\Anti-Malware\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:5328
-
-
C:\Program Files\Malwarebytes\Anti-Malware\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:6020
-
-
C:\Program Files\Malwarebytes\Anti-Malware\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:1940
-
-
C:\Program Files\Malwarebytes\Anti-Malware\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:4724
-
-
C:\Program Files\Malwarebytes\Anti-Malware\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:4348
-
-
C:\Program Files\Malwarebytes\Anti-Malware\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:4768
-
-
C:\Program Files\Malwarebytes\Anti-Malware\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:1140
-
-
C:\Program Files\Malwarebytes\Anti-Malware\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:3152
-
-
C:\Program Files\Malwarebytes\Anti-Malware\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:2492
-
-
C:\ProgramData\Malwarebytes\MBAMService\rmode\mbrescue.exe"C:\ProgramData\Malwarebytes\MBAMService\rmode\mbrescue.exe" /rescuemode "C:\Program Files\Malwarebytes\Anti-Malware" "C:\ProgramData\Malwarebytes\MBAMService"2⤵
- Checks BIOS information in registry
- Executes dropped EXE
PID:4628
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k AppReadiness -p -s AppReadiness1⤵PID:3688
-
C:\Windows\system32\DRIVERS\mbamswissarmy.sysC:\Windows\system32\DRIVERS\mbamswissarmy.sys1⤵
- Executes dropped EXE
PID:5540
-
C:\Windows\system32\DRIVERS\MbamChameleon.sysC:\Windows\system32\DRIVERS\MbamChameleon.sys1⤵
- Executes dropped EXE
PID:824
-
C:\Windows\system32\DRIVERS\mbam.sysC:\Windows\system32\DRIVERS\mbam.sys1⤵
- Executes dropped EXE
PID:5736
-
C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Event Triggered Execution: Netsh Helper DLL
PID:5976
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
2Component Object Model Hijacking
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
2Component Object Model Hijacking
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
1Safe Mode Boot
1Modify Registry
3Subvert Trust Controls
2Install Root Certificate
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\PROGRA~1\MALWAR~1\ANTI-M~1\mbtun\mbtun.cat
- Size 10KB
- SHA256 9ceb410494b95397ec1f8fa505d071672bf61f81cc596b8eccd167a77893c658
- MD5 8abff1fbf08d70c1681a9b20384dbbf9
- SHA1 c9762e121e4f8a7ad931eee58ee60c8e9fc3ecb6
- SHA512 37998e0aee93ff47fe5b1636fce755966debe417a790e1aebd7674c86c1583feef04648a7bc79e4dedaabb731051f4f803932ac49ea0be05776c0f4d218b076f
- SSDEEP 192:gM6dynJCSEJOL7yKnUi8rFWQFIGjl8zjEswYt1FfRM/GX01k9z3AeOlFa:gqS4CFRWGjl8M8/fi/GR9z/OlFa
- TLSH T1B43208E1897D84C2ED87A87147E8E5977C3C1BCB2C5055A911ABF7600AA33C6E71853D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\PROGRA~1\MALWAR~1\ANTI-M~1\mbtun\mbtun.sys
- Size 107KB
- SHA256 6903e60784b9fa5d8b417f93f19665c59946a4de099bd1011ab36271b267261c
- MD5 83d4fba999eb8b34047c38fabef60243
- SHA1 25731b57e9968282610f337bc6d769aa26af4938
- SHA512 47faab5fff3e3e2d2aea0a425444aa2e215f1d5bf97edee2a3bb773468e1092919036bcd5002357594b62519bf3a8980749d8d0f6402de0e73c2125d26e78f1e
- SSDEEP 1536:k0h5S895dQOYJaryTmbMc6uqkZUcmSl47AjpdAyDCYJqUufIfmNn3VzwZ6Dh7Q9y:C895uOYJar1MLcmSlrSgC6Duls2t
- TLSH T174B36C9DA1783089DE42A6B482B98793EFB4357A2B1177BF01E1C1748F537C0DB29DA4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 6881a948278d0ebb59690b2e4b9b820b11efb1c49c47524256ea392073b992e6
- MD5 fe0c661290aa49d93075de781d95fe50
- SHA1 84934477f5c1b5edaa0d71b88f9fc8dd4bd78fed
- SHA512 7ea83cefd4d92b6cbe966123427491596bcf2250c03b5d83e207eebc3dc62b0d1d8a86942166b0d787feb000b3d6db6d7e649c2a9e6bce8d66cbe875a5f2501b
- SSDEEP 49152:Bb+632BuPkFKRrdE6ohQstBhuXjfS4LWxnHg+ctK1tqDjFJsUP:H3q6tjBkWatqDjFJX
- TLSH T158D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.4MB
- SHA256 99bea59db1e2fb0a6eee87f957c49d066b9f28dca14f42879b6b1409667acc72
- MD5 8a04448b01aa86fdfe20eed9c16d0707
- SHA1 3f7a7a837228cedfd406e3068650e5e891f3bfd4
- SHA512 cf8e823ff316cd82ea77409eed508a07159aa1d328755c0956a1818d0460adae68b6709369119df0404d788d43e5a235877e578cdfc4bd84c27aa496d845c577
- SSDEEP 24576:6XYfDtczAyC/+c9/Jdy1ttzQDjFiEX8UjLCo:htcVg+ctK1tqDjFJsUP
- TLSH T10365012473D409F9ED678279C9A2C511EA73784143A0EBDB03E8967A1F332D85E3EB51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.4MB
- SHA256 28523d83196a51aa2f8a8b7ec7f919873ee3ddb7a4be86cd22cdc17b64889c85
- MD5 a0967d8336550886ebd067fa37e574c3
- SHA1 82c7605d3220b33d17513484342bc9696a378ee2
- SHA512 fdd81ee909b02d64c49665724ae012120278dec2ddafb99c3a14b3e9b3c78cdaa42c6e118a8e2fa2c3c011d7ef5ec113f14e958f6a0f66c5508429cf0ab618e9
- SSDEEP 24576:7wuJOW4C/+c9/Jdy1ttzQDjFiEX8UjLCo:7wOONg+ctK1tqDjFJsUP
- TLSH T1AF65F14572A40CF9E96792398683D136F7F2BC012A61DB1F0764C75B6F37261AD2EB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 07e54bf402942145dca67eefcfe92a51c9ef7451ee1796df5de05d58aa1acc91
- MD5 3351ebb19f3aa44cb51d6d231eea5351
- SHA1 3d7c690385eb8e8bba03bb969bff86cfc0e1c72d
- SHA512 e953d7c8fa5db6fa110d226c062d9f1446f5de57d940f627794a2a1c1c2144eadac50ba1e8826eb69cf75bd7e4596d4cc67da781874f910dca79f8712c9acaa0
- SSDEEP 49152:GB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glCg+ctK1tqDjFJsUP:0u6JmQxd2dQWatqDjFJX
- TLSH T1F2D59D13F1D901E8D06ED178974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\7z.dll
- Size 1.6MB
- SHA256 623e628393bc4b8131c1f4302b195429dfa67e890d3325ceaa56940660052b1b
- MD5 4da585f081e096a43a574f4f4167947e
- SHA1 38c81c6deae0e6d35c64c060b26271413a176a49
- SHA512 0fe168bf1661691dbaa103e478dd7e46b476db094bf1938bf1ad12ddb8a8f371bf611ff504d2eb3ac319862444cc64a27ebee8735aa3752aa32a399b09427243
- SSDEEP 24576:a9raURTF/5pe2g5RpBDxSjv9IrqLwRpFEDbt7y0MVoAAlzi8pY:a9hP/5petvSjWZR8DxO0mo5M8pY
- TLSH T16F756D5BF67400A4D5D6C034C5276B1BEAB1B88B8330A7EF12D15A6B6F13BF19979320
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\AEControllerImpl.dll
- Size 4.9MB
- SHA256 878239e138180492b8e703203db1eeda5da1a88b7897c16e7323bb506ef28dfe
- MD5 e4f9ffbfd7c3c8b641ebbbdcfe6399e8
- SHA1 8ee46b184bb37a8f24001eebe120796fa46935f2
- SHA512 8f68576a20a8a3b6e7125733862583bcb4fe137392392acb4e3b826450cb4b656815a3be7b44174bd3fef3a0f4722079eded587d8c0f2ac3680d67384cdbb317
- SSDEEP 49152:y3QcNVHvFJa0GV9Tkq9HWsMyhXTnXRUHNNWjwJZ1yWBEsUXH7PWnE8q12VPvUbA:q0XTnMmPsUXbPWNPvcYLX
- TLSH T152368D16A7F401A8C8B6C23CCA578503D7B2BC154730DBDF16A4966A1FB3BE1563EB24
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\Actions.dll
- Size 6.1MB
- SHA256 d513f3a50ec070bbd74f78d27d79b6cb60aff48310283c74ebeb204aacf375a4
- MD5 923a9fe2404277f490bc959493f48e72
- SHA1 563c8dcc7adf7fcd2c706be7ac56ed79c52aacf9
- SHA512 5bdbe65ffd24380d423c3d2bef220e29c39622551edff942f643e79e50ea582439b9e7e91387ef020d44e2462721dda089a83566c76ba1287c2dd917e4fe4194
- SSDEEP 49152:v9x1737qVRJXwMb5WOXz2aXjAr0dcOyccpFZckK/xjDzBE+WjYFJWgP4FNJe5RRe:X97ELkwdchTNOAjYFsG4EGmzqZzhaa
- TLSH T196564B16A7E801A4E0B2C178EEF79103EAB27C255735CBDF0590525E0E73BE09A7BB15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\ActionsShim.dll
- Size 3.7MB
- SHA256 6c5047cb77ea843e8386ba2b26a8458e6255e2ab94d493e914620623723c6b32
- MD5 33617cde11d2bfcef47faf0d5ce3cef9
- SHA1 2439b5f0622cd539b6f6f2f87d78edba466299ed
- SHA512 ef909e5e6a695a0f2ae95621cf87795705b3d267ea7d1c82634faeff3a4e3b111f5f809cd9e7dbb71d588d6106e0b54c138364f99ba41c7c5d47cde9af1b753e
- SSDEEP 49152:SH0QptrM88LLHy9nqSk5n9BT1vAPZmbLMo7JTfYkwZdPHFszUlE3JqCx9R345GEm:ktro8k3booBovlE3JqCx9R345GEzul
- TLSH T16E068B17EB9540A8CC6AD23C855B8607D7B2BC25237097CF17B462AA1FB3BE1523E714
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\ArwControllerImpl.dll
- Size 5.6MB
- SHA256 a1904889632fce5fece6dbecda5e237423d571652350f24c8724bdeb3a30228a
- MD5 40f500da8c204e5e9a89fdd8dfae4ff6
- SHA1 3a407e01769f582116a34c3b874dd5b534734072
- SHA512 5a1888e523b39f1590c05236f502c2f5c0ab4a9384737294fdfa0c8b0870d851e2cb927b71112a8828c67c9017209e8b4fa66fca262d5f8d9a11ec481c946d46
- SSDEEP 49152:rjEQxZvdSVum8H2EMBNi3IcKpFd5wKqW1c7h/med5BNhlA+KjTscJ0Kzp+i7JtmC:rYQxjspzwJxE+6Tv+iVg64Iky
- TLSH T160468E1AB7D500A8D4B6C238CA578513E7B2BC554331DBDF06A4A6AA1F73BE0473EB14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\BrowserSDKDLL.dll
- Size 7.0MB
- SHA256 c72e39709b26ac7577200a76515347ff11c0a9424cf61657762d657e7aecd974
- MD5 36b6cdd3677d6a079cd21768ffacbc7e
- SHA1 e525b6c778d7b59ef06300cc980f63bcf581a24a
- SHA512 e106563a21063eba244b536e67ececf2630415d5857af8aa67bedecabb39a87799324c3024bcf84487fbd9cfb76dc24b27ebb881734b4157a38b5c74d538ec3e
- SSDEEP 49152:8VF1SVg1db+wMSI0nW5xjpvypuDYpsD0VXZTWqls/e9uETWgjB+S/YfbWf2zv7je:s8TeZKT+X6S/Yf6fITlRChya9Fx
- TLSH T113768D17B6A400A9D8BBC17CCA578603EBB2BC06577097CF16A4966E1F73BE0563E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\BrowserSDKDLLShim.dll
- Size 3.7MB
- SHA256 f6d24605eb688e039e4509d184d974bb14c4c38528edad129d0653eadfea80f9
- MD5 889529ee7dadd23f11ed5b3fdd1f5b79
- SHA1 3e8a1bee4d28102aeb4c6f2eb94946282ffa7e12
- SHA512 bcd57045d516232828003b2b970b457138cebafbfbf2bf762199c291228b2cd674d8084190fee22f0adf047e8f2ac20644712313cfb5f90289a83fd6698995ec
- SSDEEP 49152:aHENZh/xwXNNnfFEXqGW3nILlpqCBS6+38Q/h0oYEaF6r+jep6Plw3zUoC02n:TOX/xPb/aomGIoIn
- TLSH T1E2067B17EB9500A8CC6AD23C856B8607D7B2BC25677097CF1AB462791FB3BE1123E714
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\CleanControllerImpl.dll
- Size 8.7MB
- SHA256 8404395da4f44f39236e8265593f52dcbbdcb7e37e129498d4c18b56dee6902e
- MD5 b7930dfd9175b4c2d9abde99076bce4e
- SHA1 7219ee742a50fca1c9be0f68652704386f837797
- SHA512 b3afcdfc3c538ebbc9ed373f1c440592ed45adf274e8e0b4210b1b394605af23f999c2fe7c3742f6c8962578b6982d71f98a7c1be1c4a8f7d663e7240b7a4102
- SSDEEP 98304:pBDjgBUbuC7uYUxcbfssqiamfbt5rOTwLCeLZT:UBUiC7ufWfssqilfbtlkwd
- TLSH T1F9968E56B6E400A4E4F6D178CE678503DBB2BC551731DBDF0690966A1F73BE08A3EB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\CloudControllerImpl.dll
- Size 6.9MB
- SHA256 c1af072bd24fe47e5f2cd71faa900c7a1dd16520d3735f9cc8df40d671b5e9b7
- MD5 43cb480992b8419e0e2938e8897590f8
- SHA1 e8c69764ce3d6627956bc88b598b99b0143dbd87
- SHA512 f6d974086da91d5da49015ef82e4d0494c3bef77829fa4c7438fdf8e0fa06520f682609dfa42a0dd06fded7ae113543a9284467514486f2b514e2d6e94f0d231
- SSDEEP 98304:lTUvUuVCKfYls1zPJ2KxJRttlMA+4sS3GK:evUGCKfn1zPJ2KnRttOTm3GK
- TLSH T163769E5BA6E400A8D8B7C17CCE578503EBB2B81543719BDF06A4967A1F73BE0563EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\LicenseControllerImpl.dll
- Size 7.1MB
- SHA256 223dd68b4fc42d3451d7631a56bf261517e400da2b9536969b7eda80b28a0e93
- MD5 d91ed54c2e16f0c2d883dbcdd0b3c513
- SHA1 e5116a0fd899ccefc5e7375100b6fee90107c293
- SHA512 44b036566fde88317ccb90a3173464c96c547b61da73e1e65cfdbbd2bbe8df96d7425088cb7322c8c1e5cc6abdcc47ab76e41834f8e5cfa0ae07fadde35c5c5c
- SSDEEP 98304:qWth0pN471WY8eAolIft4ooTU5tgrJDFfv/8k:qU034715FAolIV76U5twtFfv/b
- TLSH T137769F6AA7E400ACD4B6D27CCA578503D7B2B8054371DBDF06A4967A1F73BE0963EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
- Size 10.6MB
- SHA256 d10e04217f81b44667c6237971f1f2843d132220c8712e8a855436e9f1f73baa
- MD5 cdd8c06c1f88f57727813906e3a58fb5
- SHA1 4ba873161c0ab0f489bb0c82a267aac8b0cb91dc
- SHA512 40fb64f723481e9b8e24d88edff74dbb85b2e63790595c067b01cc5986ac3a0fdeef0d8083e4c86c0e2681837cb53eb98e7bda2bcb22eb77d1b8330e2d72ef73
- SSDEEP 196608:PRO3j3Ld/5Mo9/vEvt2teG35tTdnXo9076gZCN3R9i:PROT7d/6o9XEvt2teG3p42Yi
- TLSH T10DB69E17A6B400E8D4F7D238CA579A03D7B2B81643B197CF0690567A1F63BE19E3EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\MBAMShim.dll
- Size 4.3MB
- SHA256 dcc714dd199d9768faa0ca212e63efe63caa8aeb4cb11487fa389ff59f6cf98d
- MD5 5be75744f4065e88aeda92344b999ada
- SHA1 48347bd7c99adf4e1c8407c0f56b2017ef8e5525
- SHA512 53cba40ed9450dc83c8fc6e522b567884c1a7b858f708930f164fb5eaafb4d6972625eeb35b7d5d01d754f7c7af7727ecf08efb37de6541ec637021fa06c6613
- SSDEEP 49152:+6s9rQzE4CYJQEw34L4lvXYsFFXBulqfCbLqmsc/6ZeFYpA8aIJammPsQzUOu+/x:rs9rVzYJGrsSCbvyg8aeTO/Z2JgH3
- TLSH T138267D17ABE801A8D87AC23885A78603E7B3BC16077097CF1A64557A1FB3BD15A3F714
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
- Size 4.1MB
- SHA256 a67f94a3014d93b9b91f0c8427c81cc18cb13239a114d91c51f993702e60a580
- MD5 88138b3ddd9b2800ea155743aa26fe87
- SHA1 0b45bd01e388bf4821a3caa09e78033588f66667
- SHA512 4f2f2f04c1b3c1d55731d7dc55fa3ee09385b8f77084e79ebde5252242008eb3362beb9b50b3ea8934acc471dcef67763f20d5268f6cb18bfb98926e4189c3b3
- SSDEEP 49152:0JxO5tmuSoHE4RtMMoLPqf/nkMq1BmwlxMOqSv6bi36i6X43jtPQ6zU+5pAqIPIS:8Y5tY4RMk6lxMObN6/tbH
- TLSH T188168D57A7A901E8D8A6C23CC4678603E7B2BC151770A7CF0664627A1FB3AD25F3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnel_mbtun.dll
- Size 4.2MB
- SHA256 0b764892f7f32d385684411e647f69f428067180aa28315d71668d3ab25b335e
- MD5 ca4f7f1ffd364bdb46dbbb8bd1319125
- SHA1 a2d8a1a3401a93da3303376e37e6ae36e08c693d
- SHA512 522a23be06d466db16e9abe89897e8562ef1fab483285c37c5ff43468e084a91ea78892ea9225c2da589e440e84034d23b0236af99182ed6d1eb118b4e0dc273
- SSDEEP 49152:lBPD6Io8w4LcTwEDRzTJoeM9YSxjQ5g+o9h6iO0oFjn2Q1Z0NwEIx6:PDG8VQkgRzSeMfn+ofU1M
- TLSH T1C8164B02F8B205B9F2BEF131C9A963217A31749503327B871F9195692A66FE47E3D313
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\MWACControllerImpl.dll
- Size 7.6MB
- SHA256 de1f0248c81a86c1498ec703d90c2b7edb7d863b39380ff21c1f19d3edbe7075
- MD5 1b3efbe4501e3fb33790e3594db8928e
- SHA1 70dbb4c7902a4686c77e3bc13d17f237e4eed953
- SHA512 902edcc5f6e8b60cc7d3f0c7a3c209aeac8c167d34c681e1b37e0859fb261d5a8c3e4ffb2d41549a0a6f1b6df6a157b1e78830a1f758497f654688aa1911e84c
- SSDEEP 98304:nNE9vvaDfzdXtRIteX3Dai+NtqcMQL6hO8lwwrx:nexCDfzPRIteX3D1+Ntqc5x8lzN
- TLSH T1E0866B1AE7B940E4D8B6C23C9967A617FA72BC19833067CF0654975A0F73BE0963E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\MwacLib.dll
- Size 6.4MB
- SHA256 b7bd08efeb605825a6fbddfb86f467017d015c39b498b1abadce3a1c2b9aec77
- MD5 d8edbe0741a24661d2f6725d2f327ec5
- SHA1 7b567a8dde4a5f04c51b9765a17a42fd84876a8a
- SHA512 e8afa10b5834b52e0e1c38dcf82aa5c0bea2738dbf01d7ee0c2d1630490f297d5133fab9f22bb1ad662af5128ff8b342d266be3689d59d8c4aca62b9443ac92f
- SSDEEP 98304:NpB7Kgxzgp+hagqZ9JhJ4uvIONMdCWVp+w/:FKgxzgp+QgIJhGuvIO+dCU
- TLSH T11C668C1AB6E400A9C8B6E238CA678213EBF2F855173197CF0664967E1F73BD0563E744
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\PoliciesControllerImpl.dll
- Size 6.1MB
- SHA256 cd1e8f98551fb69d3d47837c09fea35be358dd7c27104afb7f1938a7fadbb2c5
- MD5 436a5828103f6874dda5ca0b32e8e8ec
- SHA1 7a5346221f40349881a65df91014114b1644c8f8
- SHA512 a4ce868855d83ad112b528a4969e5a5f79a115eb92f9e3ef1f05eb09f7f39c099abb162bbf2024b298af715560d81d9f08c2457109d7b2b33c04dff9789dbd05
- SSDEEP 98304:at69nEVAZKwY4Lka7NrGWeG0qwtEQ9VsAwbB:aAnEVmKv4Lka7NrGWJ0qwtP749
- TLSH T1C8569D1BA6E800A8D8B6D13CCA978513E7B2BC15177197CF06A4967A1F73BE05B3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\RTPControllerImpl.dll
- Size 6.4MB
- SHA256 905e6da13fed3e931eb9180aa50b6f2058da73ec7e8c9735a6e03730de3f317c
- MD5 2abbbd7e5d16e3c4f8f28ebee148baf7
- SHA1 b414cc1f22b4dcfe70a0057cc6dfdf04ca587f7c
- SHA512 2ba3e909ca19272114821c891b2a9fae3ae6ce29138e8daac7c319532a5a8878a5f810560f469eb613ca119ba3bd0bf8e5cc75afa3e11477f17664e4a7714866
- SSDEEP 49152:itLx7V0PZw2Pdap9fNt4htJsg+6Q8OmITjRCqVZ5PIE5FGAhZ2NPh+xOtW3BbNba:soycr0bf5FGsEYFNbMGsdBiiI4rM8j
- TLSH T137669D16B7E400A8D4B6D238CA678513DBB2BC554731DBDF06A0966E1F73BE0963EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\SPControllerImpl.dll
- Size 4.5MB
- SHA256 6563c8273b0285bb2db5df55c8a707b76ed9215739b78ea4e2f954ee1025ef12
- MD5 efaf9a951675b1d23cf37e6f0cb9a02b
- SHA1 ec1edd6046df2d78f26a708db865c16065bc5021
- SHA512 9a43c424313d610c9bc133bb35d7ed3b7bf424c66b8820483a103aa41d3628fb609c26d5ab1399f7b6bb43ae962b03307cc32fb5a5a4d434934b5be0bf98c793
- SSDEEP 49152:JRNwUFTWIls1ThDYENU+QTRzmKVuPSfgSdBF5Mufa3j9LIJv24rBPZROnwPi5zUR:XlQBFQT8v6GufOJVuBPzyKR
- TLSH T1B1268D17AAE801ACD876D23C89AB8603D7B2BC61437097CF0674567A1FB3BE1563E714
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\ScanControllerImpl.dll
- Size 6.9MB
- SHA256 c247fc5913cdd73b37f6619b5e2019831635cac2786997e6e98965690b87d076
- MD5 831f51a590742a2bbe1e55ae7fa9e760
- SHA1 a2b2dd8bb930d9f0a975be3fa57cfd0cc4b1c067
- SHA512 0c56f1630e7a806f6a1383536f11b1496f23901b3eb2d96a63fe5cd3fae1d5c0de3ccaf637ad99074611e115d0911059fc0b5428e687a4f252766772d17b9d41
- SSDEEP 98304:+dhoYDGql6cTC+8ngEZsxKGNSRLzoxXlS4qbVO3yuxtq18DSyWgavm+6:+dhoYDU7VOiuxtq18DJWNm+6
- TLSH T1EF768E1662E401A8D4B7D238CAA78113DB73BC554731D7DF06A0966E1F73BE09A3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\SelfProtectionSdk.dll
- Size 4.6MB
- SHA256 09b8ea52a6950390fa1f96720f0c7b4c527631b24d27466e5f9e5952701dbc0b
- MD5 9466bdc77270fafe1849911257d1b2f9
- SHA1 4b6f98d87da1b31cb788f202617f567e200473cb
- SHA512 de9d02a89e20fde5777bc591c647871689cd9f0ed07d5aa3b483accac897eeef536ebc56d732349c0ce6eea233e117fbcf131e83877d66281424772aa8b4a7cc
- SSDEEP 49152:VvVNraNCw9Vjvu1DPcFFiIju4Bn241fvX9MDwKDKGMsWOVRtPGWzU03LcZdkZH4e:Bw9UqIivGDcsWoO5xZdkU+3
- TLSH T1AD268D17A6E601A8D876C23889B78603E7B2BC1147709BCF0A6496792FB3BD1573F714
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\SelfProtectionShim.dll
- Size 4.0MB
- SHA256 ccb4ce36aa0887ed1017abd15b1019f31a8fe2c1afc55a6a063d94142d7483c2
- MD5 d1d035f3ad7cc27a29e0e80186571c4b
- SHA1 37a42f712a8e847f8d575613b47962c0f3c28f3a
- SHA512 f37523a83d0a41ef128b8d731599e26be3dfdb868c6e0f9068e5318f038cd59d72700beab772814d4d2ebc69657d3173bd3c596461473a25cfe9b10306733e82
- SSDEEP 49152:8EWWy/r6DbXWDWVZ76nXsLLeLWRBKI8GUfdgTyQWVp1CLrNSJPCqwzUyLWm:3fXWsDY3dgTWC3dSNm
- TLSH T17F168D17B7E841B8D866C23D85638603E7B2BC2107709BCF16A466791FB3BE2563E714
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.json
- Size 621B
- SHA256 7a7df91b431e888498f206b5a8cfaaa4659e885c0c97e1bedae3a0ba182994e9
- MD5 4e3591b732d73550bdf89ed8ecab07b3
- SHA1 be47e1253b2774ad278dbb1ee3952f1c9231e3fa
- SHA512 72a5eb5771607fbf8ee3675badebe5cefa45595415ea07ace0f05d7ccd7f458378141c7c68423d743782f1db0ce6cad1e1725627be65644a11c0fa4d27aba4fe
- TLSH T135F0A262995F41F745744B8885650487F624939E02155A0FBBF4F6C0DEB2C298AD2C85
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\Swissarmy.dll
- Size 5.3MB
- SHA256 9ad52208d95d536dd1dd77c9bd118c7ab0fffc795a4f0875fa608544d30bb931
- MD5 60d217257971f73714b8c5e398d461dc
- SHA1 9906053f88d7a409e8ba874aa9f66e5ead73c961
- SHA512 8eb3304e904af5847c6b2cab99d1d3690b5b239fbe85467d164ed29a714f029ec163f467a7bebcc80e156e0d291436306145a2ae68766613f5a6b30f316b0250
- SSDEEP 49152:5LG8qKNFeojCOg33h8pRdPSDIGRmqiZBmdWZyKYbHkEAoXvEPj8QF9yllBpP9aze:Zfex8pCIQbWZ0kd8xTdNhIcPz
- TLSH T1E3469D17A6D500ADD8B7C278C99B8603D7B3B81553319BCF1A64522A2FB3BE2573E701
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\SwissarmyShim.dll
- Size 3.8MB
- SHA256 7b7bef24ae682aed60edf136ef817d60b7b1a02e3ad3f86c7b820cc502e4edce
- MD5 07a16e004bdc32df788c0f7144526105
- SHA1 de6cb075bc813f25aea014eba71b1127299da2e5
- SHA512 c0f2db7f9dc6b7e5575f4a7b5b5d60aa032777e3a9994b534651317326e4ae6721527422d9001fac8cf4280fc7876dd8e1f321a7ee65e3394417982b0373687f
- SSDEEP 49152:s5AWJyZyVe6ZGVE96H+KLNjU1BWIaDLwOx/AJJKFS7JkC3zly0IPLRzUgT9dmR:bUemgTTwOCJJRDqyg3
- TLSH T100067B17E79940A8CCAAC23C85978607D7B2BC127770A7CF16B466691FB3BE1123E714
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\TelemetryControllerImpl.dll
- Size 7.3MB
- SHA256 d783c0ae649b6d267c330c3c9d613d4c5ab09bf1f594598484da1760f0b16e4b
- MD5 7a1b3a54f39392375078dac7b2822ad1
- SHA1 7008531c23e7f266e9a94b20bf98f8038aca5562
- SHA512 518aa3b5060ee69f6d46cdc0ff5142109a1129b7b3481243a2291114ac436b2235d0bd6498a527a25686cf6901bfc3cdd2f5caa7d319e794eb587fa03b55d759
- SSDEEP 98304:MJrBHlha0hhvIzoMzMk/Tm78Wi6bPtBrtkXb4:MJNDa0hhvtMzMk/TmQW5bPtB5Wb4
- TLSH T147769E5AB6A400E8D4B6D23CDA578513D7B3B8254331D7EF06A096791F73BE09A3EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\UpdateControllerImpl.dll
- Size 4.5MB
- SHA256 058befee7a55f5d8510de91f4746053fd49393f2f1843c4f090c3dae60d7d540
- MD5 150ce3c5de43955af87ef53f51c1c866
- SHA1 43cbf73c227e208bd2f601c91a27d58962f08e51
- SHA512 20855a4289f8985ffa840d00819efeb2d2f076fff7507f695cf1a3f6927a7b48cd85285e62ca8d25cd4d2593b00b6614c5bc88677cfb8b933f8138b09a9b48ee
- SSDEEP 49152:lzY8o3OtUDkkGEVl0QFxd/X6LCzqlXB9eC24aeZSRBFZ24uFpei6tyP/ZNZoyP++:2en6yQIV2ZOFoxtFlwGYT
- TLSH T19C269E17AAE900F8D8B6D27CC9A78917D7B3B8150371DBCF169082691F637E05A3B724
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\VPNControllerImpl.dll
- Size 3.5MB
- SHA256 9b2b33a5c58a3e95423f5f3cf4d0c53b27ae4a399c72de90aaebb6b6e000b17a
- MD5 93bc933c0188b182424b8ab87fc7e635
- SHA1 783d97877ad1344a49e4c61f7c65f2c9ee2be63a
- SHA512 3fabebe19ba4d28ef2eda395c2c8c0f256a89959d215529b7226162a940d3ae75edea78083f1f614205da5915d3bdb5c8bcbdea80479180e9a9ab81916bd8215
- SSDEEP 49152:lUh1BFqcsDLEh7i2Tlu1fVPicc27eYv3OhJBwzn5QOZFFRPtdPSnZnZwCAMxM:YvKRziO5nwnZGCAMxM
- TLSH T1C5F59D1763E600F5D8B6C23889AB8517DBB3B8150371DBDF0AB096691F737E0563AB24
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\arwlib.dll
- Size 7.2MB
- SHA256 acc5508787ed40d3fd48c9428d3cbdb23ef9540ba4e9bcafc1e3c25e30fef526
- MD5 683b857fdf1cf176997065b2e6178347
- SHA1 827f731e94314636a4809280bffbf9f380a8c669
- SHA512 15e0a79690a7c100c6f582742756b85ca3e2ce1e8101b7867a06bd3c5064aa77a5ce8b8d1ba70ef47ea1f70b754c933f513690d4c874f191c25fbdd7ddbe643a
- SSDEEP 98304:Qp5FvnA5WTmewOgWWNtkSVdQhm4mT7gHjBsCBZyVNPaX7:mvA5HfObgkSVd0m4mTE1BZWy7
- TLSH T167769E16A2E800B9D8B6D238C9678513E7B3BC561331D7CF06A0966A1F73BE1573E724
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\mbae-api-na.dll
- Size 723KB
- SHA256 6aee09c65a2f22658a8a74459df2b9df5c81c5ec7d853e496794ef6f52ed8924
- MD5 53d9f6d408d43a8b9f080b87ac0df146
- SHA1 1e6c7befb2c68efc87508c705cf72427cdf45370
- SHA512 b4db12bf61ddcf16ff14ea245865b2aa0d71efba17fcfd36d64d47707f6f497170f19235dc8bf69e3961d8072743f27cdc343f228f331d6f27c41ea07be11b7d
- SSDEEP 12288:LFvU1Pr3pBWtftHAmoLdkm9c5Wn2VqK/Zny2E3vFn+hPraFnPFN:ZvUtKtJAmsdjc50iHoZ7
- TLSH T14BF40819A3AD02A8EA77C536B663A223FF7334541B70BE8B5E108E395F31760963C751
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll
- Size 3.1MB
- SHA256 8af36217efcc1b2a677accc77839ed3b67ddbfcabfa16caaa42c7e95796b940a
- MD5 d82467d25954c9fbaa91ca97e0de6834
- SHA1 d7da2b4f83acd0d2aaf55de2ae403fa6cc44bfc6
- SHA512 84a38b2d4a1b23439f4c6eca1fc148d618effd1444704f37e5812488877d15789b603944231281299ba332dbd0d3a0e51160c588c0adc1bf338675c62da45aa4
- SSDEEP 49152:zHsR0cmbmDszn14AcKLfC659mLVD+Bjmo+2g5rCdPWD8i51l3z:zHBpmj2Am0D8g3
- TLSH T169E54A227A9540ECF866A23864FB8502F6F27A05236097CB0558727D1EEB7F106BF7D4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\mbtun.dll
- Size 2.8MB
- SHA256 f21a980316bd4c57c70e00840ab76d9ad412092d7d2d6a2cff4f1311f7c05364
- MD5 2bbf63f1dab335f5caf431dbd4f38494
- SHA1 90f1d818ac8a4881bf770c1ff474f35cdaa4fcd0
- SHA512 ebb9834323329dc01ba2c87e5fad1083a4cb86f5ed761cb63299ac5336a9843a1aadd42fbed706797c2295117af1c00f96806422338352653c8e0255fecc2fd5
- SSDEEP 49152:xNrdEZjzdAj9fdc4fDrN1OxOh5PgqdnBq30yPFZP7KVxSL:bBzFRkshaZP2W
- TLSH T136D58C1AA7A800A8EEB6C27CC6578603D7F2B8151771ABDF02A456791F73BE1173E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\mbtun\mbtun.inf
- Size 1KB
- SHA256 4a350fc20834a579c5a58352b7a3aa02a454abbbd9eecd3cd6d2a14864a49cd8
- MD5 5d1917024b228efbeab3c696e663873e
- SHA1 cec5e88c2481d323ec366c18024d61a117f01b21
- SHA512 14b345f03284b8c1d97219e3dd1a3910c1e453f93f51753f417e643f50922e55c0e23aab1d437300e6c196c7017d7b7538de4850df74b3599e90f3941b40ab4a
- TLSH T1CB4140BD48D20AB83C673356671B69C27BDC220145C920ADB2DE8606C88EDDCB905EB9
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\offreg.dll
- Size 140KB
- SHA256 8e6c155a97666c8e6a3f9ea95bfc6f6e4f87beac53dd72164aba3ef33ff88db1
- MD5 1659738d57a15a0983f0373b2faaef45
- SHA1 efd4cd05ff6bd787a2ceabfd11daba1c0e475855
- SHA512 4f62cfe0579e1aeeeb30edd5f42a2b1880446dd1075be051e2e0189da5071f9866e5425ff85547486fd7d952a28efa4e784db0cfdc1fcc428b34eaa89c6a7654
- SSDEEP 1536:kXNnhdTcQOCr7LClg5lSYOurIt/0q9mrf0Xp2N7RibuQusR9YfIZRoU:cnXTcQ57LClMlSYA0q9mrf0XoNHFQZ3
- TLSH T111E39D5A73B420A6E8678678C569875BE776B162232087DF12E5C6B80F037CA7F3C345
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\pkgvers.dat
- Size 78B
- SHA256 121cfe9bcf3991ed7ba0b138d5b4e21eddb6ede3efb7b616a656ce50d18a18d7
- MD5 57ceb7c8f371cd2288932b753802d981
- SHA1 cf0000453a82e7b1a7a5b7fe49361428c1d110ad
- SHA512 f14328c022e8659da516ee4233946c17d6a1c5625a709c483c61d319f69ecebded205439b713ddd3a4715f1a893e9fd58647878bb19eda5bc13d873530b7c833
- TLSH T185A02434400D13003C15F1F07C714473F01FDC105D111F0010C053310711010133C177
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.cat
- Size 11KB
- SHA256 33dbca74f9364b66974d987b20505fd9298707f42fa8d2f636d8362e470b410e
- MD5 92ece2e13283144da6dd4e0a1b6ab04a
- SHA1 cd0acbb0fee1fa9f41b82b7dacd6405e07beadf5
- SHA512 0f1e79c6be4d29566f5e8263fe78c61e3ee1b04b16bcc1c0aa165b715c08b91ba7a82690d8c92fafa6a9cb4918e27ec459630480c2a00fcedd72f4b5ccf32076
- SSDEEP 192:UsCI5WyAJCWW7/lyKFFWQFRZUHWX01k9z3AV0bk:L0RiZFRjZjR9zOj
- TLSH T14A3229E2852C55C1EDA3ACA043A8E5573C3D27CB1D1048B962DBF7680DA33C9E73856E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.inf
- Size 2KB
- SHA256 ff93773f55bf4a6a0242adf82276a8c95c0b244b9bc05e515c4e810c81a960e8
- MD5 d87c2f68057611e687bdb8cc6ebea5b8
- SHA1 27b1311d3b199e4c22772fa1b7ea556805775d37
- SHA512 4aa65b8911d8a2a0f9ef0ee6e934b94db0a9ad4c2ec543b5edcf21486be43f6ab1fda6617ea2cbb85eff230628c9fa8e7649da915d6de695803b28e55bef5819
- TLSH T16541DED8A1D386BA6687B2D07E0741C3F6403A0049F7342872DE50D6C3E7A0F83B4BA9
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.sys
- Size 240KB
- SHA256 6d2c9a01f953d206abbbd8c2ba5a00b78ad8f6bcddba6db810f2d6f562ddbd8a
- MD5 953f871a91ac057d2d748646065fc2dd
- SHA1 ef6eb7900e194555bc9dc4b4eca377f5aee9f7e2
- SHA512 dc4caf64effe29e719d85823ac9ded93bd723ccefa4662420303c700968db608c9c0cdb4412373ffba49c9672359f4594dab50863cc6c10e8bb4d3b5fd00573c
- SSDEEP 3072:rM98OZY4B+FY1GeX7dxNRV634KOMuFZWaOJRN4KoXkM0dsFTgUzFkzSzpJW4d1sa:rkLelYsCdbRDF7WaeRN4dT0U6r4dxt
- TLSH T1FB346D06E2E47A66F9B7827D89A69102E77271452B31CECF5370C1292F1B7E0F93534A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\farflt11.cat
- Size 10KB
- SHA256 8b19e3ad46d594e099eded7fdb784c48a98d620675982204bc7250c471f1719f
- MD5 6b69e2855dcad56e24e9aa9034f53ced
- SHA1 10406666207ff26b36556a730b6fdcfbfac9c433
- SHA512 b862faaa395eb0c22960d6a760c40b52ca973c5268247b53faf5d47bb14591bb098de3a42570dd211996ebc096963de2b516be36d47710bacd2cb8121cb4e956
- SSDEEP 192:VAd3dxdJdfWyh4JCWW7/lyKFFWQFml2MAAUYX01k9z3AIyhZ1jrAhCUCk:VAN7jf2RiZFR9MgYR9zH8Kck
- TLSH T1983229F6866C81C2EDA76CB007A8E4472C3D2BC71D50846961DBF6A80D937C5F71806F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\farflt11.inf
- Size 3KB
- SHA256 142f7bef5d7c91cc29537e423e4c10fc409b085adc66b75552252bb5c7b38697
- MD5 9924a26e2fb32c82e9683a01d65d4a78
- SHA1 f707880f584131c0f69fdbf1dda753c88cb75125
- SHA512 600665fcc54d8b76f2e9b059bfe7e4f7f1c3b4e2e635c8f97eee4a34b478485312998e42db4dadfb221eaba817082283b7b7be5938557fe24339302177e353bc
- TLSH T17951019463978574AECB31A45F077807B6253480A1F5395832DD84D8C389A2E5AF87BF
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\farflt11.sys
- Size 211KB
- SHA256 deab1165f6147404947248c5a7ad0a6be37a8b7dea3d764ce7c79ab871f9d940
- MD5 9be4d4d729f0cea7bee139aef06c71a9
- SHA1 921b6a7d0f0915124cc3f02567a9bb6d590cd992
- SHA512 06f2568bdc848286135cde4da3992fe14176acd6c0a2d7f3745442e7be53c82831dd4cea4533340a476b5e35d8077848d6c31dae18fc1b0cecfa0a9f65bea532
- SSDEEP 6144:P89UhuhYRI62VGdXyzLOUL2bFY8UKi5aJ:UOTI62VGdizLOULr5s
- TLSH T146248D5662E41CF5F877C6B5C662C103D7B3784A1721EACF027086661F6B7E0BA39319
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.cat
- Size 11KB
- SHA256 45bfd887f1969f364ecca95f32a46354bb463864a697d631a14082eb213aa04a
- MD5 c553d878f2fe661a2408224c80178b7e
- SHA1 3c2f6515b04ee0af02b43920827d9830cf94b558
- SHA512 8a8cc31eede18ea4e169420a5c4e86388155a6f3e8000b981f9ff14c56cf6ea43ff0ad6a20d960a692dc70de6ee683541be8129fea326481384c17376bf04b3c
- SSDEEP 192:IgFgUgr1gZQWy+JCWW7/lyKFFWQFsW3pA1wki+X01k9z3APhAdE:meQqRiZFRDki+R9zGhA+
- TLSH T16D3229E5862C96C2E9A7ACB043E4F5673C3D67CB4C4084A922E7F7640D937CAE71406E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.inf
- Size 3KB
- SHA256 47b7c516bb57c612de19f0ca865590af95b6e32bf873a0fef9e011b2c5b483d4
- MD5 5a9717e1385703e8f06b27aa10a69e87
- SHA1 84ee67a9167b5eb6560711b9871de98898ad07a5
- SHA512 dd3c7278c2c11ad15a55fae6d19b96dadd92f85b7f0c8ce934298258af00bb5c052a84a98499b8867b0f43704fb307c67d03692ca69dda4d814c6c17dd73df44
- TLSH T1B95121A4AB93C570A68BB5526F033403F11538A0E0E97554B2DD81D9D389A4E26B4BBA
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_b6ce0c1a816411f1874c5ec22d2638fe\7z.dll
- Size 1.6MB
- SHA256 bb01c6fbb29590d6d144a9038c2a7736d6925a6dbd31889538af033e03e4f5fa
- MD5 3430e2544637cebf8ba1f509ed5a27b1
- SHA1 7e5bd7af223436081601413fb501b8bd20b67a1e
- SHA512 91c4eb3d341a8b30594ee4c08a638c3fb7f3a05248b459bcf07ca9f4c2a185959313a68741bdcec1d76014009875fa7cbfa47217fb45d57df3b9b1c580bc889d
- SSDEEP 24576:29raURTF/5pe2g5RpBDxSjv9IrqLwRpFEDbt7y0MVoAAlziG3B:29hP/5petvSjWZR8DxO0mo5MG3B
- TLSH T175756D5BF67400A4D5D6C034C5276B1BEAB1B88B8330A6EF12D15E6B6F13BF19979320
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_b6ce0c1a816411f1874c5ec22d2638fe\ctlrpkg\MBAMService.exe
- Size 11.0MB
- SHA256 fd7a1428221fe7de747930cb3d9f2991610e2b1d809a0abc1f26590db5f5986c
- MD5 bb079cbeb5948a894358ac3c5586d990
- SHA1 777c05ca055c938d3352e758d835d33896807a23
- SHA512 692ac8284d78c69b06dfdd7e4b6ecd0380e7198d587c48655d4d2204957e7968209e5aba6fd06ab150823998bdb74446a7f168fb9240f2f1aba0f5a38c39abcd
- SSDEEP 98304:RA64Z/iUYtDJODZi1EZnnsc8tUFswknM94BJ:C64dSJODZi1EZnsc82FZyM94BJ
- TLSH T126C6E606A7F951D8F5BAD674AD7B652AEE32BC618B3093CF1150560B0F32ED48E38721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_b6ce0c1a816411f1874c5ec22d2638fe\ctlrpkg\MBAMWsc.exe
- Size 4.2MB
- SHA256 7878a9b10903b8c0def49015deefd48a3ea0e46c0f5ac9ae755336994e020152
- MD5 acbb82943fe0d5f1c5df74b1a7dccd2f
- SHA1 c41e38f59eff5e40a6a47b14be44520dcd6d405a
- SHA512 7092748502f06bf05df19bd2d4d5857f161a35a9b2e3a72645eaacffacae7a8dad10ab41ad3b80d3a63ff0773b6c818edf3769ce6b1f61b01cc92edfb755dfc5
- SSDEEP 49152:dK5b4+V1qsR86LMFRbbX8DREqUaP7bBfnuF0JRlnPkokPmsBLdS4BPQRzU/81fge:i86kyaHF0JRlMhBpMyok3M
- TLSH T1C6166B06B6A540ECD866C239A47A8503E7F2B811273097CF066853761FF7AD21EBE7D4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_b6ce0c1a816411f1874c5ec22d2638fe\ctlrpkg\Malwarebytes_Assistant.runtimeconfig.json
- Size 559B
- SHA256 ff0c15737963951550db7cc1bb116e49cb15c61bd93c61ac1861bd8e12efb61a
- MD5 e9420939afed10ab831746dc22ef813a
- SHA1 773f27f2a98cb5db97d26e65b992a653c2a07ae0
- SHA512 a3285d5db3631bc6a3438b03412f1f8aff03102a3e3e35736df207af066e936fdd2c84d85d360fa7cff33ffb786d84220b47888a5c0288c88e203f243e7cac5b
- TLSH T11FF05969CA106DB708F9737AD12AC083EA30572B10002C56B4FC080C2F776B62121F95
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_b6ce0c1a816411f1874c5ec22d2638fe\ctlrpkg\mbae.sys
- Size 155KB
- SHA256 c990dd89b65d35d6c9b34e21c78d96e206ec3bcdd934716ee61ff79da0fa5251
- MD5 fc98ddab2223dc73b950622801b31554
- SHA1 997faaec1dfd18b9dd31e1c216440a28bc4cd612
- SHA512 da08860f8c3d8a9204d1480f33d21f2ab922db5cbbf7734527ed05477c2d9c184deaedb63196876c989c9ff6c1b45b5792661f5bce92212992a7cdb664a793e3
- SSDEEP 3072:hcj/Hk4/53QBvOP8JsUrLx1o6GwzfwKYdkXEnU/H0KBJT2:hc4wNQBvOEJvx1o6GwzfwZqEU/33C
- TLSH T1D3F36C52F3B400F5D8A6C679DB669213E6B2780D2721E7CF076085252F673E4BB39326
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_b6ce0c1a816411f1874c5ec22d2638fe\ctlrpkg\mbamelam.cat
- Size 11KB
- SHA256 64416d564725416c6869ea951878a2734b1f6940b11f7961a897c45f0d8c6625
- MD5 bd4ceae54af081d6b1dd91ff584c5d61
- SHA1 5ade462d66e042da58bb1447d1b31f1aad901b68
- SHA512 37e7abd312f694ee2c8ea54ecf50ed12c16684f1007c61d9a6d1d01cba958be511c5e4e11cd7393a5cd57349fda1c552bebca42962137e0d11695c195761ebb0
- SSDEEP 192:oBxybp/yRpJCSEbhLxyKR/2FWQFdbiI/Ex6RMySX01k9z3AgEhrZg:oLp+eFRvmoMR9zJug
- TLSH T11A320AE58A6C5083DCA7AC6087E8E5D77C3D67C71D00987921DAFB5409933CAFB2816D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_b6ce0c1a816411f1874c5ec22d2638fe\ctlrpkg\mbamelam.inf
- Size 2KB
- SHA256 e26c2d3347e5f077da92713c9df3cd3eae438fb7e29810bd5c3afe567d2d3125
- MD5 5d8c05cc4f9b4304d57ea10b87f2dcf0
- SHA1 2cabe3d39aa5ec16c54c7818284a2ee235d2ddbd
- SHA512 55bff23fee9852f229246b71721b3659c916079787935d400a97641449dfda752fc8fbf36f9ea3dc4028f05daeb9006a99660284a61aa5d5a466af0ee966c738
- TLSH T164410454AA538BB8697B35B81E472883BF5412205076384032DEC8C99B6DF0C93757AB
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_b6ce0c1a816411f1874c5ec22d2638fe\ctlrpkg\mbamelam.sys
- Size 21KB
- SHA256 ded569e249e590314d095f740c6b8934a5a797e4f3edbe0f78eac9d333f12a2a
- MD5 8da81aa1f6b89ce1d2e216e3ea351c59
- SHA1 4baf79cbade9a5584630a540e6368d547579fb12
- SHA512 6d611bbd9d480ef2defd745fd06c4ab86e181267cf689d9d0e124edbaf22fd30fbe2310879cc7bb6dde5bae72c4feea1d329cdecfbf101d95634f85dd0769119
- SSDEEP 192:C7IlO/ZnEc+PbYv6/i0RtPH920QvVUKjnegqdsW++w/y1wVWQ4uW/+O68RwX01kd:wIlO/i8ChLIxUKjnev6+Twc69R9zING
- TLSH T108A23B6549780283F6BBC570C7E4C927BD38F39677408AEB0591E5681DA37C2AB3192D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_b6ce0c1a816411f1874c5ec22d2638fe\ctlrpkg\srvversion.dat
- Size 9B
- SHA256 68dd8af1181189786acc04862ebf835611e90ec74ff672fe75d2197ede49e9da
- MD5 79025fa617f131c92f2a812e18a86dcd
- SHA1 1f6bcbd4b98b5b84deb602686599f41e5f47ea02
- SHA512 85307648d3621c0271edaba947600a4ab8329e98ee068a6d381a0ef77c70ce42fcbae4fd53ff783c81be259142ba8c267268b89e843439ec3bca90b33fab682e
- MD5 SHA1 SHA512
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_b6ce0c1a816411f1874c5ec22d2638fe\dbclspkg\MBAMCoreV5.dll
- Size 8.7MB
- SHA256 b226e4e93acba45a3e6c0ee06d6fa1c62fac91ae37c86595ab395088ab9edbc4
- MD5 1ab568867f09d24d997c993e185c4f08
- SHA1 bd97a322c4736f420c54c7ecec02e8bb1d764fa2
- SHA512 1c4d688a1897019428c8c7fa2dfc3368f6f7e3e1cfa55c915562a0630e70d5ad9ea2b36a4483f1b94118db32e5da85722a1524d52a5aa781933d583678e4f448
- SSDEEP 98304:9lZ2y5IWilAVOyU7mhNl/DP3RtFJe92YiGNwmdQk:9iy55ilAEj8Nl/DP3rFk9iGNwmdQk
- TLSH T192967B2BA7A400AFD87AD37889EB4502F672B811537397CF16A8A1761F637D09E3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_b6ce0c1a816411f1874c5ec22d2638fe\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\10.0.8\.version
- Size 50B
- SHA256 42559a4970a981aa61f3ed59ad44d05214fcc5eb97c35d06a88102a0b747a45f
- MD5 9072ad106b74f3900d25ae80843c8a24
- SHA1 b664a23dea5a5591c21fe0f4a9b5f344079d94d1
- SHA512 ea866258bbcccc0951f95367f3309db65d437ad27eb6fcbdfe12e08b9f76265050d6216091b89f0dc92db66b24f8238c8d6cc98ce49e6c3bb6b051ee037e56a2
- TLSH T1309004444445D47315D3313453015154F00C5D3C5D34CC11D05F707CC4D705CC55C301
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json
- Size 47KB
- SHA256 17dd55147abd332a15a21d1aba1e4b5e0b4ae25ed731ba156ced6fea918b7c0f
- MD5 73812f6b3daacbe681f343dfd51dc948
- SHA1 1b624d39e605e70f07411df6ad5ce07eec5dddde
- SHA512 595e67392e9832f1c9f5fd19e543cc1e4d2b5b48cbb0bfa59ac967642d356ecb12f28434391229e850b40778b6f5957877be6b88e218161d566269d5efe58248
- SSDEEP 384:nriPalGB5AWiWq2mhzJUVVqxKS3xV2CjNrBa7gHOykEaf:OUAHiWqn1UVVqx9U7gYEaf
- TLSH T13A2382BBD9DC0D0B99312294A9B94607FB20036F10980C17BDBEA98CCFB751394C6F1A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json
- Size 66KB
- SHA256 ba6e3a42b59edf91b456d91bf3debd01078723ad7884f4c9e18ba805629c2ce1
- MD5 3054886e2264ec1bac3aaca163d80e88
- SHA1 c6b45024dbf6e46aef73fb32407bdd6c8a0ddf91
- SHA512 f4c96cc49a2f9bca9632ec70c379581744a4d82515a361cfc0cbc8c8ea67a92bd5a9338621f2cac8ea686a18672668d1ef07af1b3444861334607b6abe8a7998
- SSDEEP 384:Pir1PalGB5AWiWq2mhzJUVVqxKS3xV2CjNrBa7gHOykEajctcxPad:PoUAHiWqn1UVVqx9U7gYEaIKod
- TLSH T17563FB76D8DC4D5B857123A4AAB94607FB50036F51880C07BEBDEA8CCFB781295C6F1A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\ArwControllerConfig.json
- Size 1KB
- SHA256 dc01e4bb5aee00dfea42dae02bdb80a34a50946412b170e5de2ad249efdfad00
- MD5 742a6f6e804bb0f68949a03c8db475ad
- SHA1 4d99fbaec4c2e9e515984657fadcb55fd9d5733f
- SHA512 c84e5123de3d37bd6bbbc6c2a766d0422b1eab8c4c45aa2d9433c542ef2bb4883bea20b30ac8a2f2c94a560abb7d0c6b625d2ab74a7dda10a2a89d45ddfef7ae
- TLSH T137213852862419FFA1FCA005E8949193CFB057A52408083BF2FCF788ED3A67263C6CD2
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json
- Size 12KB
- SHA256 ad2cea2fca658f982ae0c70f92152aaaae2650b4ff5b8806bc4bd9fac8272436
- MD5 3b3203868c84f8cdff2896e0a8fa2bfa
- SHA1 b6f34db6f98a8cd76fcaa2da726cf880da6dd3ca
- SHA512 84495ac476c80af8134af74341baf22d76f9b7b007abb09b3fa0bc2fe033daf3a09ab644cf65ce033588bfecf957077b53c65f8701d3b53cc439eb231e8dd6b4
- SSDEEP 384:HOmlYgVMzhrgHTb0MAJUKfVgH8BZ8ZABE:HOmlYgVMzhrgHTb0MAJUKfVgH8BZ8ZAO
- TLSH T11A425526D1B5DEBB66FC613661B40B82F364C75F08410C07797CC88C4F7BD2A62C2AA9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json
- Size 12KB
- SHA256 8f96d6c4020002f9b517eaa9f4d514ebfcb627abcfb3712c97ad7454dc97a16b
- MD5 ea69a4cbc528aa1d41873f0b64a607fd
- SHA1 e26fc6f9f6a133ceee6eadcdd8396a0a9274bafb
- SHA512 3c779dab35983a8ccb57478cd482293cbdc8b469b70414f378d25d170a19e3550ddd6bd276f8d729f9360338a93e7682abb3ff12a944a2bb02877d85415ca3b1
- SSDEEP 192:fLEml/FYgVMzhrgHTb0MAJUKfVgH8BZ8ZF3PC:ImXYgVMzhrgHTb0MAJUKfVgH8BZ8ZF3a
- TLSH T113427726D175DEBB66FD623662B40B82F364C75F08414C07797CC48C4F7BD2A62C2AA9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\MwacControllerConfig.json
- Size 2KB
- SHA256 32535636e2ccf2ae834230fe575e1df0025ba9cc15ac0c2fb9c222932cb767b3
- MD5 612275365dc4b5fe546ded7e35010156
- SHA1 d40bc355e02064905c815fca85b5956404cf4302
- SHA512 67a292fd07cd30ced61b734c1a56ee71a32500c76e5055f9c6de410b8b3f44cce535b4d246f3c159b4f416372f9ea1d4e26e885a1c004895f2691426caf0e77f
- TLSH T1DA513A32D9686CBF09F85266ACA84252F651871F41580CA3FABCC57C5FB6C12210AF5F
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\PoliciesConfig.json
- Size 814B
- SHA256 41e6aba630335637651678c1772ec11c44f0d04d21e8a1c457e15e66b8361618
- MD5 d83c462faadfae1a0a3e4c905afefdf7
- SHA1 929f35eb849edcdfefb29534cf09f7dd44edf3f0
- SHA512 db201dd08964b1d3d01206209397ce8c642d230e10194d9fdbe5a14a543215506c96abd524311cc19c12898ca8b95b6c9340f0239941e0be69b986a26b3bfa22
- TLSH T18F012826984084FE293C416C4537D881F751871A34191C2FB7F9EA0DED73A3A2185D86
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\RtpConfig.json
- Size 2KB
- SHA256 6dd4250d43001539dad5d0b57b9b6d7b8946be6be0f5de92cef8cf0d6acb6cf6
- MD5 8ecf22b36a7ecff7642b95b8aa4a204d
- SHA1 4039f07e90ba04384180f0775d701f40ff964538
- SHA512 9cef4e9ba67a343e384109f2a4516cb69631ca1a0266d2b2fffd6dcbd90d1aa279e7e3a3bacd6d08c749e2a89ed9d6f220923d81ea6a810052b0eb46460fa044
- TLSH T1AC512621AE40A87D4C79C1199C7C518ADB245B61160A187B72FEC83DCDBBA737BC5CC2
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json
- Size 5KB
- SHA256 87a951886f634d910700e03dfff76530071b85c71e690b31e5e98800ed91bfa7
- MD5 e286bd3ca9afcff0166ee994af495ebc
- SHA1 f6f0bdf7547f948ddf118a07e1a4a65f4b282a69
- SHA512 69b6dc25393f3b571915886ef49f349f610263ec71837fd4b987363bb3ba2dc863bfc2228678379fb3bfeb15b990687c77c1a6f9c11c5c646984be23384bfc79
- SSDEEP 48:8T5JtUmVSfKuGQf92Es1kV8EBPmduw68qXKeWQX92MEnAf3wsaA:gZOfK5k9JykfBPYAXKBs9RsAf3wsaA
- TLSH T172C17C16D9105CFE18B8E25EDC288186EB2083972202186FB5FD859C5FF76337686EE5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json
- Size 8KB
- SHA256 57f0f0e8e9c10ae1b990bada853862d8835ccdcdb4dfd201d55dea3412808064
- MD5 e018412886a63b3d71f0d1e198528497
- SHA1 9d1b2289e3d97ec89954d7fbc6f3fba995f29862
- SHA512 c53ef1ad5bf6fd12b447afaf1f4bd64599ce3c832b04b7086df6d543cac137586c405d4cb94b882d8154cf9b65112707dd12d3758d011ca816378d3d17e2d66e
- SSDEEP 96:bbZOfK5k9JykfBPYAXKBs9RsaaA+fDEZXKBs9RdAf3wsaA:pOi59eAAaBRtfwZaB5gsR
- TLSH T129027D16D9105CFE18B8E25EDC288186EB20839722061C2FB5FD859C1FB76333686EE5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\SpConfigFile.json
- Size 12KB
- SHA256 bacd02fedb2af4029a42b9994547cb1a80ae1dfc95f280417fc6944d596af6bc
- MD5 43af47ee182b12ac0dfba49a033087a9
- SHA1 84ed1e7413daa46474e1d21a92840062ab4cb64d
- SHA512 826aeb708aea009bfe08f9aca06e2187221a712a3091f1d0d1a29e8b35331c1e686dfc301722009b339b0c55ecdeac9c253cc0395bbab30303e765a4fc334520
- SSDEEP 384:V8+xwb8fkY/sDY8t7SSdUCExUYS9oFfJ7MLPi5LnDjufzqoA+8xRj81offZJZtXJ:IXDK
- TLSH T10352161EE0A84867887726901F7A95A2E334526BC1435C6775FCB12CCFBB483C496F9E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json
- Size 1KB
- SHA256 f60a14bcc7dea0274c12f1b2708acde869ecf4d53c3e4a679f4ab6c64e1e4f36
- MD5 9d9fe53d2dfda9570a4b7039f6887281
- SHA1 7f5290711ee319ceb0332703de35bf54157c1156
- SHA512 81252c17a2d64275bd8a728417d8444e5318f129a38671184ae9157a2d84864fa9e46d527f1df49bb3160b8e989febbfc65e4a9a019361404052d400abedcebe
- TLSH T1CF3126128A2845FF28FCD148C9B88717E7A0531B61161C1FF6F8DA58DE7703237E1989
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json
- Size 1KB
- SHA256 c881038c6afa95be493625a72907eb91011bc0f155a7921663d9a197566d8291
- MD5 e0d0381f6229bf0d08d36b79cb754b92
- SHA1 78a02abc0c8186688472d296183ead1688a36458
- SHA512 cf831b3c5767300c1a2db6019c37d58f31e2d2a1053f2155e65c8a0c2e284a59d3c0306f8424ce560fee0ca0406980e6d11d403f08302c496cda25e305243ae6
- TLSH T1AA3138524A2845BF28FDD144C9B84B17FAA0531B61161C2FBAF8DE5CCD7707237E1988
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json
- Size 1KB
- SHA256 67f4e8bb38ad7df6efc1030385de5ef26907b41e691b3764d86fd34f63c3d39c
- MD5 2655324d53bd012ba6b754b2b87a5cbc
- SHA1 d22cfa120c0007734bc717cdd73fd2ed68a405f8
- SHA512 e1151cf39611ac25e62cdf238b1554d58f519d4e123fa77b886efdccda588e3364f55f8ebb6dc3ff1a2b38b858f8760ff12e7bb3aa8dcf3598511c274a2e83a1
- TLSH T18F3104138A2845BF28FDD254C9B84707EAA0531B51161C2FBAFCDA58CF7743226E1A49
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json
- Size 1KB
- SHA256 c8140be46cf063cd47bfe8123142205a39981c52a43dea4b270721bd96e611d3
- MD5 15ca8ec4fa390c71d7a0d610d8b3f586
- SHA1 cc973f17f8c85ada96b81f9f13f0fa806adf535a
- SHA512 8b968f4183bfcb4c0f85b06a63f8ec35027b68fc40c1f2f53874d522ef6be689fca35f995debe8ab6cebe2ed110813b27feb441448070d1c5d1625d612f4b854
- TLSH T1DE3106138A2845BF28FCD294D9B84717EAA0531B51161C2FB6FCDA58CF3703226E1A49
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json
- Size 1KB
- SHA256 b47568802c9bef3871b68083a9813bc62e1304f0f83f5b73aeb03fe18184408c
- MD5 e8adf81e0b32d4cdc903a7e810020cb5
- SHA1 02ae20ed56c26362ed31ade104331b825becff2d
- SHA512 28265de1f8d16882bf174d8037c0dab1f9fd6898daa63d5bbb7d63f9a95ee573528fbf7ef5474ec6f5270e8ff307bd45434c17653cd1f0422056f7b616847c47
- TLSH T1343156228939C8BF2279978DD9B48102E760438F26708D2FB3FCD848DE739342487A4D
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json
- Size 1KB
- SHA256 fc12046381166b72306bbbdf22046cfeb007fc79997bbe665443486096913daa
- MD5 9553c4925f5673f668051db0a86ed30b
- SHA1 d5eac9e7da3dedad430fb24c163d347237755521
- SHA512 31839d18e87114f8e4b20285fcfedfc7405a7a4ddd8f56403aa458bb0a377f7cddbb26270e6204b793325bfde69028c48d535b67cf80ece1c7c29faf5e8a9e5d
- TLSH T1EB315922893988BF2279975DD9B48102E760938F26705D2FB3FCDC48DD73974248BA4E
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\rmode\mbrescue.exe
- Size 7.7MB
- SHA256 477919ecb586d6ef4a06793417c2ae3126c51a51cf9445d901e90e3627e7143b
- MD5 ce8ca947e3162da157d1878d4cfec382
- SHA1 6f574aa206ba5e9d7469450780c4238cdd5112e8
- SHA512 4233bbde636d039ea3295e3b2066f56ea5a23e0431a5e675c967c60bbfa4f518f01eb90ac271da56a192671b925b3e14d3a25f1da4a8412983b4973565dff299
- SSDEEP 98304:akpowZa6gr/YzKrEAi9bESWCt+z3zweCeT007kxK:aFwZa62YW4AQbLWCtej1C9076K
- TLSH T1D586AE57A3E800E8D8B6D13CCA978503EBB2B85147719BDF06A4566A1F73AE05F3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
- Size 1.1MB
- SHA256 411e0bd440febc700e47e46214938dc86617c11cc75b9436a11148fcb0cbef4d
- MD5 59be690417d96f11e623f0ad21e1e501
- SHA1 f35e55291b5a85b3a0178dab2decb830ed8a7ada
- SHA512 4da75c5965a0f3a53cc9b917c2925add3ef95779ed67df73e936f3e9ee4b1a3a74c3676001917d0073ad8d1e1767812d075e7b651a569697c4ac5bc8fd1652a0
- SSDEEP 12288:jEj8y1zy5RK6oEQ64D8QY0tsiurqvjm6W:wRzyH/4D8/0tsTr+a
- TLSH T18A452851B62BC75FC6A940326E36D1CCAB707D05EE056B0372C8973FC576668BAF2281
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
- Size 426KB
- SHA256 d5da6bf554ebda810198ba59bb29ad582c8fb82c37094d3fb59223e3718d6493
- MD5 65891f7a2b6703bc308a87013168bd87
- SHA1 392275d7fdaced36d5087a7fe49389bece1c9805
- SHA512 1a87f9db01748ba7626bad996a51409cc14b8a7794048b65c1b49c4f15b595fff867540838b696fe122edd5d3bf18c1360a16c1e1681762111b2e7577830408c
- SSDEEP 1536:xLigtUTO9GtQsgAdLwxFWH789IJg2y0/RGKj2LW30hx2C/znW:JmOk5gAax0bOEByqPRvgjW
- TLSH T17594B6007771E35FCBB6C0BB5471A29EE73975129F026F052B884CB4D4B216AA6F6B84
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.2MB
- SHA256 4fb430f28996cb9ebddc90a1bbb30e3142a175b02dd22b9afaa42c0cf6aa40c8
- MD5 c9eba8425341b2f95aa24f40dbf6d62d
- SHA1 0a7fecdf60b1b36556c2e1a8638e46d2fbe8203c
- SHA512 4513d4ed01ed7e9769e29abb76bfc20e188292ce85367772f5baff8d6a51d07ec01e2cf08b2dfe39c086a2c7785d0231a790fccfb89a6476fba236e54b129996
- SSDEEP 12288:Fy7PCgSXl+j4HNJRjUm/Rdy11JXVtzQDjIQibwjDteUEsLCHET:cPC/+c9/Jdy1ttzQDjFiEX8UjLCo
- TLSH T128452310A2980EC6F539B3F215C2E13565527C846B81C9D7684E33EE78B89E4DEF6B07
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 d5f16fcb73e88900e6497b9a79b78655f767a91abbc6c03d750ed0e69b377f7c
- MD5 230dc6839409d586569d578ace37ad73
- SHA1 a065473668aa3fbdd8cd050c7dddb62f367d39cd
- SHA512 156bda88e7a8d1d4af8f98329ddf97c9bf257dbf2caab329967395f35640891524e8e116af921f088f03573bb34a07729bb2511948ba872d5f7dafc8e61b882a
- SSDEEP 24576:jgb6bmBIi49WNNFpg1rSvFv7bYFC/+c9/Jdy1ttzQDjFiEX8UjLCo:jgb4mBIBhGFgg+ctK1tqDjFJsUP
- TLSH T13265AE1E22EC02F5E0F9E2B89DA64417D6B278160732D2DF1151427D2F3BEE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\CatRoot2\dberr.txt
- Size 64KB
- SHA256 30b6e2b6334ae6b36bd1c6c661eddaa151847545d2c6e97a3008200930ca49eb
- MD5 f766c5657de7a18206329d434cd83fbe
- SHA1 fe8a5e61c27352cc5a5e37fb96f9603e09bf42c9
- SHA512 eb4b254d7a562d6f6fe8b2c40e6adc8e7053675a96de0a42e399a2b05eb79b1f842ddb1c2223c441a18e72823bdc561cc70599c7d2f1d9425b91ad9881092f22
- SSDEEP 1536:Nu7Et/xoToXuvBKoZaL6TNX9FgwcwHC8SCs8o8WcMv1K0Rw7gN4Tkl1bvzwLM65n:L1LE
- TLSH T15B534D0580DC8519C5B60BA272A7EE72C92E69CA770F1DE931ED730198C2B552F7A07F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\CatRoot2\dberr.txt
- Size 65KB
- SHA256 b56ee7be8dacea9fa20dc46826fa6c8624d2563916f2a54c5ed489f035361d56
- MD5 80367ee78925f866c8701c841795a530
- SHA1 162aa9e9e3ff9f3fc605201ce03370010386edc9
- SHA512 d7fe6cceb2da19048ecfd3653e8f5b94f8b0fdca884f2cb8a4f900163c26eedbf395f55feb334192d25f90bae1ee0d54a0a760bc27fde6a1d172bcf4f9845085
- SSDEEP 1536:Nu7Et/xoToXuvBKoZaL6TNX9FgwcwHC8SCs8o8WcMv1K0Rw7gN4Tkl1bvzwLM65F:L1LO
- TLSH T1D6534D0580DC8519C5B60BA272A7EE72C92E69CA770F1DE931ED730198C2B552F7A07F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DriverStore\FileRepository\mbtun.inf_amd64_add82795013a7c3b.ini
- Size 409B
- SHA256 710ceb1da55a56b04527e4405255a04879575046d8689c68c63d4af947713541
- MD5 923583c624f727b1abb12142b9afad72
- SHA1 4d22e723c1128f3f5750996122767818f2e4d802
- SHA512 82531f2066be647f817d139a47b1b51ee5a59243661b4b258cdb39e9c61ff5b792b5c6acc737b33072a677bccce521f2a67f83d5f25c9a20615d587fc8e3bfc0
- TLSH T1F7E09B91D43D719E421A865DE71C2DA6CD58F01B086324F9FB8044D49B7AD896E48D73
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.7MB
- SHA256 5740efdd302009c7a32ddb7d07df43cec0a40b7ea9209a55cea72d712cfa2f22
- MD5 e53a19d54dd4f62825983aca5f9c2bb6
- SHA1 78df032d8c65c334740a097d9c1cb8dbc1088753
- SHA512 a17a89178a092085a6de04eb2b977cae3b9a20aae5605a268adde22fa04dbe2598e1e2316e84508c5220743f228742f0b534e317d778011c0f7cbada676b40b8
- SSDEEP 24576:EG88u8FpJqH1dzria7/mwC/+c9/Jdy1ttzQDjFiEX8UjLCo:37ZFPqVEa7/9g+ctK1tqDjFJsUP
- TLSH T1C685F16572E001F1D47BE1388A824663F6B2B8151364EFDF06AC8B551F23AE54B7FB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.6MB
- SHA256 5ee6d5b51197d8f7ad3c98c55c59c3cd0f7bfe3a2834f054d6626410fb95558d
- MD5 dacf11248c6f3306fe3c3bd7f5260424
- SHA1 c5a0c5d7991784dcf46076bdc6a9c00881546fa1
- SHA512 9140ba835c186ffb06d1c356c0df28236db5845f9fca3c7707e255486fcbfae55a25baaf897d9836b00bd80080ce22a40b5b5d7e5e83dfadf4dacf2916545fd2
- SSDEEP 49152:oBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjsg+ctK1tqDjFJsUP:DG05lO43bPWatqDjFJX
- TLSH T18ED5C06A62EC01F9D1BBD17CDAC6860BEBB23815033556CF02A486A91F27FF4957E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 1c97d1a835e59b9a91e71298d7b8833ddc30c2567c2a5f2033cd3944635a032e
- MD5 3bbddd758716136c4a7632d71fba38cb
- SHA1 64cda3586c4d8714544d126fcd30dbf600a99d61
- SHA512 02f29fffe89a08b8c4e2c0d9ff5ab82244b3ac2c2577f482d3d4d4b485363b3bf124aa83b8ccd879718a51a08c93090ac3ca57dcd5f2d9d66303a9d7555baef3
- SSDEEP 24576:Bfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnSC/+c9/Jdy1ttzQDjFiEX8UjLCo:Ba5POZ3hJt2pasx2+mUg+ctK1tqDjFJX
- TLSH T13A65AF5EA6FC01D5E579D17DC583861AF5B1342153329BCB022182BE3F27EE89E39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 6e6486ec88f2e8bbd3caa367d678f9a7c3dddbc4ccc9897fc5d1fe998956d6fa
- MD5 d755b5522644f76e6486ae1aada259af
- SHA1 a790696465126567a6bb46cb14a1e693a64fee5c
- SHA512 52cb0115a73fbb7a4719fd166a0695aa62b16a67bea9633fbb73ab00713e7dbf506f59c2194fe1abcb7ff7b925a696c2656312d25c24afdfa8ae19380772a0ac
- SSDEEP 24576:gNcwHdjbyQ4nLC18lb/EOjowL7FkYC/+c9/Jdy1ttzQDjFiEX8UjLCo:gNc/zEOVHFdg+ctK1tqDjFJsUP
- TLSH T142857B1623E901E4F5BBE1BE89679546FAB1786513308ACF0291851F1E73BF45C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\catroot2\dberr.txt
- Size 65KB
- SHA256 a1137b90ff487efed9e5f0067d599bdea14c2031bb0f1bef2c0a2726c7963d0a
- MD5 867c8d27f91a7582ba1fb28b01dd3828
- SHA1 9523674bb56ea79a0e40c2f60b29393557f21573
- SHA512 fe3d911d7fc8e17a330141e5d74117f21aa67a1027679b0abdb2f5c56935f0e290e6b5f633ae644c9ca893ac0824f28b80e3c489073d0ac03fb74872e9741ca9
- SSDEEP 1536:Nu7Et/xoToXuvBKoZaL6TNX9FgwcwHC8SCs8o8WcMv1K0Rw7gN4Tkl1bvzwLM65Q:L1Lp
- TLSH T11A634D0580DC8519C5B60BA272A7EE72C92E69CA770F1DE931ED730198C2B552F7A07F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\drivers\MbamChameleon.sys
- Size 230KB
- SHA256 a2f19edac47313a8d282ec88ff6da531d49ada37829328278be4b8d395819f0f
- MD5 7e71850b3c629e6753c1ae3c44353d01
- SHA1 43ebff27352b1e2aba7a892cae8cb3e9d60242af
- SHA512 a5de9eac12d2ea3af7936ecdf268b7786dd467cd62050a341afea67c30343dfef05c5eba9325dc5803f61ac0ec3f95ce029bf1c0298fb78a70f173ffa502597f
- SSDEEP 3072:f/Oxj1rrPoZW1sldvOyp509rYfDPmLbZSZhW8PY9PRVNSXwKX9WVUgl00ZoYAYey:W6vOyp5uZSZhPAvVIXwm9W166oIqIj9
- TLSH T1BD347E5AD2D41DA6F9B6C2BA8ED69542E77334091B21DACF0370842A1F67BB0F53530A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\mb_9B6.tmp
- Size 107KB
- SHA256 ad820dd54edb13e255d34eafacd71f278d6514e2f7e4c2970401f922a774ceb0
- MD5 2df8ff40bec48460845f851a54b76fe8
- SHA1 8e19f3d76c87d590cf1af839ddbe98af381d44e7
- SHA512 2177f5dfd6901f09ae2b8a0d6bea7b5fac3d00a721aa297ca6c35666cf2549d6c8d8655063a332224ccc8e0f00bdc84334636e9f1527862c850cc4ceb96d7d61
- SSDEEP 3072:dAZdoamZdgBjLpSXussssvYssssnC1c9RvZfy74hfp:dW542pSessssgssss7Nea
- TLSH T1B6B3F1F78379B8D9C513DA3B93874B110B28426B2C8A7E45A84DDB158D7E66181C3F8F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.4MB
- SHA256 1f2c3f0b0edcad322579026772b802e6c0270dcfeb2ae78de72b677112712660
- MD5 76234df6f0e039a28c00f50222103b5e
- SHA1 f2992a4f50b50141c73ed82d3b542767d38ce11f
- SHA512 6deb07136c98be6c462e709a0f5314ce4f19af11f064d96b2c33088731790a310a74633716c854534ac34d303b8900ccb763f7fa39f505605236a323a4f43705
- SSDEEP 24576:YPUr+NQcC/+c9/Jdy1ttzQDjFiEX8UjLCo:YJQcg+ctK1tqDjFJsUP
- TLSH T12B65E11E22EC1CE5F67AE27D85828219E77278521312D6CF02D1817E5E67DE8BD3EB10
- MD5 SHA1 SHA512 SSDEEP TLSH