Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/07/2026, 19:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-23_6819d4a1e5ddc327534a5a95e3d1decb_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
38 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-23_6819d4a1e5ddc327534a5a95e3d1decb_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
37 signatures
150 seconds
General
- Target 2026-07-23_6819d4a1e5ddc327534a5a95e3d1decb_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
- Size 3.2MB
- Sample260723-ykrt3stzht
- SHA256 d9acde9dcb11e5f1c7cd10bea9ad464d5827b11dd6416b76502755d819b73f8a
- MD5 6819d4a1e5ddc327534a5a95e3d1decb
- SHA1 76af230aafd8a6335bab2b69a9d98443280cb820
- SHA512 02b821e184e0bf150db226f6da16e5f2f38717a0d93d5132a3781225fb296cf0859d42444da46d3fe63603960fa764d8e01c0f9da5e36cfe9ab3013df85e8481
- SSDEEP 49152:Tg9zAAgHY7oomwAeyfvE0Z3R0Tnxn1o2d5Hptj4LdB+kn3Hnx:8dAAgHY1AeKtwnW2i+k
- TLSH T143F5AF31B2D18120E5B39370297EA7EA4B79BC256F7640CF32D8B6390B725C09D75B26
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs
resource yara_rule behavioral2/files/0x000900000001c9b3-2312.dat INDICATOR_SUSPICIOUS_Binary_References_Browsers - Detects executables built or packed with MPress PE compressor 2 IoCs
resource yara_rule behavioral2/files/0x000c00000001c59e-1734.dat INDICATOR_EXE_Packed_MPress behavioral2/files/0x000900000001c9b5-2660.dat INDICATOR_EXE_Packed_MPress - Detects executables packed with ConfuserEx Mod 1 IoCs
resource yara_rule behavioral2/files/0x000c00000001c59e-1734.dat INDICATOR_EXE_Packed_ConfuserEx - Detects executables packed with Goliath 1 IoCs
resource yara_rule behavioral2/files/0x000c00000001c59e-1734.dat INDICATOR_EXE_Packed_Goliath - Detects executables packed with Themida 1 IoCs
resource yara_rule behavioral2/files/0x000c00000001c59e-1734.dat INDICATOR_EXE_Packed_Themida - Downloads MZ/PE file 1 IoCs
flow pid Process 3 2028 2026-07-23_6819d4a1e5ddc327534a5a95e3d1decb_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe - Drops file in Drivers directory 9 IoCs
description ioc Process File created C:\Windows\system32\DRIVERS\mbamswissarmy.sys MBAMService.exe File created C:\Windows\system32\DRIVERS\farflt11.sys MBAMService.exe File created C:\Windows\system32\DRIVERS\mbam.sys MBAMService.exe File opened for modification C:\Windows\SysWOW64\drivers\mbamtestfile.dat 2026-07-23_6819d4a1e5ddc327534a5a95e3d1decb_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File created C:\Windows\SysWOW64\drivers\mbamtestfile.dat 2026-07-23_6819d4a1e5ddc327534a5a95e3d1decb_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File created C:\Windows\system32\drivers\mbae.sys MBAMInstallerService.exe File created C:\Windows\system32\DRIVERS\MbamElam.sys MBAMService.exe File created C:\Windows\system32\DRIVERS\MbamChameleon.sys MBAMService.exe File created C:\Windows\system32\DRIVERS\mwac.sys MBAMService.exe - Modifies RDP port number used by Windows 1 TTPs
- Patched UPX-packed file 1 IoCs
Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
resource yara_rule behavioral2/files/0x000c00000001c59e-1734.dat patched_upx - Sets service image path in registry 3 TTPs 4 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MBAMSwissArmy\ImagePath = "\\SystemRoot\\System32\\Drivers\\mbamswissarmy.sys" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mbamchameleon\ImagePath = "\\SystemRoot\\System32\\Drivers\\MbamChameleon.sys" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MBAMFarflt\ImagePath = "\\SystemRoot\\System32\\Drivers\\farflt11.sys" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MBAMProtection\ImagePath = "\\SystemRoot\\System32\\Drivers\\mbam.sys" MBAMService.exe - Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion MBAMService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate MBAMService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion mbrescue.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate mbrescue.exe - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 21 IoCs
pid Process 4988 MBAMInstallerService.exe 2760 MBAMInstallerService.exe 4704 MBVpnTunnelService.exe 5748 MBVpnTunnelService.exe 2044 MBAMService.exe 3376 MbamElam.sys 1704 MBAMService.exe 712 MBAMService.exe 5372 mbamswissarmy.sys 4832 MbamChameleon.sys 5636 ig.exe 1268 ig.exe 2396 ig.exe 2496 ig.exe 5744 ig.exe 2592 ig.exe 4744 ig.exe 4916 ig.exe 4588 ig.exe 5136 mbam.sys 5364 mbrescue.exe - Impair Defenses: Safe Mode Boot 1 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\MBAMService\ = "Service" MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\MBAMService MBAMInstallerService.exe - Loads dropped DLL 39 IoCs
pid Process 4988 MBAMInstallerService.exe 4988 MBAMInstallerService.exe 4704 MBVpnTunnelService.exe 5748 MBVpnTunnelService.exe 5748 MBVpnTunnelService.exe 712 MBAMService.exe 712 MBAMService.exe 712 MBAMService.exe 712 MBAMService.exe 712 MBAMService.exe 712 MBAMService.exe 712 MBAMService.exe 712 MBAMService.exe 712 MBAMService.exe 712 MBAMService.exe 712 MBAMService.exe 712 MBAMService.exe 712 MBAMService.exe 712 MBAMService.exe 712 MBAMService.exe 712 MBAMService.exe 712 MBAMService.exe 712 MBAMService.exe 712 MBAMService.exe 712 MBAMService.exe 712 MBAMService.exe 712 MBAMService.exe 712 MBAMService.exe 712 MBAMService.exe 712 MBAMService.exe 712 MBAMService.exe 4988 MBAMInstallerService.exe 712 MBAMService.exe 712 MBAMService.exe 712 MBAMService.exe 712 MBAMService.exe 712 MBAMService.exe 4988 MBAMInstallerService.exe 712 MBAMService.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: MBAMService.exe File opened (read-only) \??\S: MBAMService.exe File opened (read-only) \??\L: MBAMInstallerService.exe File opened (read-only) \??\P: MBAMInstallerService.exe File opened (read-only) \??\W: MBAMInstallerService.exe File opened (read-only) \??\Y: MBAMInstallerService.exe File opened (read-only) \??\D: MBAMService.exe File opened (read-only) \??\X: MBAMService.exe File opened (read-only) \??\H: MBAMInstallerService.exe File opened (read-only) \??\O: MBAMInstallerService.exe File opened (read-only) \??\J: MBAMService.exe File opened (read-only) \??\O: MBAMService.exe File opened (read-only) \??\Z: MBAMService.exe File opened (read-only) \??\K: MBAMInstallerService.exe File opened (read-only) \??\N: MBAMInstallerService.exe File opened (read-only) \??\R: MBAMInstallerService.exe File opened (read-only) \??\S: MBAMInstallerService.exe File opened (read-only) \??\T: MBAMInstallerService.exe File opened (read-only) \??\G: MBAMService.exe File opened (read-only) \??\K: MBAMService.exe File opened (read-only) \??\P: MBAMService.exe File opened (read-only) \??\V: MBAMService.exe File opened (read-only) \??\M: MBAMInstallerService.exe File opened (read-only) \??\V: MBAMInstallerService.exe File opened (read-only) \??\B: MBAMInstallerService.exe File opened (read-only) \??\B: MBAMService.exe File opened (read-only) \??\H: MBAMService.exe File opened (read-only) \??\Q: MBAMInstallerService.exe File opened (read-only) \??\Z: MBAMInstallerService.exe File opened (read-only) \??\T: MBAMService.exe File opened (read-only) \??\D: MBAMInstallerService.exe File opened (read-only) \??\J: MBAMInstallerService.exe File opened (read-only) \??\M: MBAMService.exe File opened (read-only) \??\U: MBAMService.exe File opened (read-only) \??\U: MBAMInstallerService.exe File opened (read-only) \??\X: MBAMInstallerService.exe File opened (read-only) \??\G: MBAMInstallerService.exe File opened (read-only) \??\A: MBAMService.exe File opened (read-only) \??\L: MBAMService.exe File opened (read-only) \??\Q: MBAMService.exe File opened (read-only) \??\W: MBAMService.exe File opened (read-only) \??\Y: MBAMService.exe File opened (read-only) \??\A: MBAMInstallerService.exe File opened (read-only) \??\I: MBAMInstallerService.exe File opened (read-only) \??\I: MBAMService.exe File opened (read-only) \??\N: MBAMService.exe - ConfuserEx .NET packer 1 IoCs
Detects ConfuserEx .NET packer.
resource yara_rule behavioral2/files/0x000c00000001c59e-1734.dat ConfuserEx - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\System32\DriverStore\Temp\{47f36001-ee18-6c47-b472-91c2ea43e618}\SET132D.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\dc21x4vm.inf_amd64_9512f2b97d63f7fa\dc21x4vm.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netwtw10.inf_amd64_400af1170541b7b0\netwtw10.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netvwifimp.inf_amd64_16c785b9ba77e7b0\netvwifimp.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\athw8x.inf_amd64_600627b27b9c7b10\athw8x.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netelx.inf_amd64_b821dc8c43094e14\netelx.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\net7800-x64-n650f.inf_amd64_bfc44179ca196669\net7800-x64-n650f.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\net44amd.inf_amd64_6af2734d06d3e49f\net44amd.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netwmbclass.inf_amd64_0958b27686099e9c\netwmbclass.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netvg63a.inf_amd64_dd38edc9e96390ae\netvg63a.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netwew01.inf_amd64_a78e41f934de228a\netwew01.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\bthpan.inf_amd64_c908ea6dab3e932a\bthpan.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\mbtun.inf_amd64_add82795013a7c3b\mbtun.cat DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\netvchannel.inf_amd64_4282c59d3148caa2\netvchannel.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netnvm64.inf_amd64_3dc2e896fdc07ff7\netnvm64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netwlv64.inf_amd64_786cb697586229e5\netwlv64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\usbncm.inf_amd64_b48ccf297d0cca81\usbncm.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\86844F70250DD8EF225D6B4178798C21_44AD5D0C299F1D4EE038B125B5E5863A MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07A7CCFBD28A674D95D3BF853C9007C6 MBAMService.exe File created C:\Windows\System32\DriverStore\FileRepository\net8192se64.inf_amd64_3d81196084e3f594\net8192se64.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\mbtun.inf_amd64_add82795013a7c3b.ini DrvInst.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50 MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141 MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_CF33567922C393BFB92DE8105C392BE5 MBAMService.exe File created C:\Windows\System32\DriverStore\FileRepository\netl260a.inf_amd64_39ee03ea6ee818e4\netl260a.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\usb4p2pnetadapter.inf_amd64_cc88f42fbf400320\usb4p2pnetadapter.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\kdnic_legacy.inf_amd64_052adde7f2101c60\kdnic_legacy.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netavpna.inf_amd64_27530893ea84631e\netavpna.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\Temp\{47f36001-ee18-6c47-b472-91c2ea43e618}\SET132C.tmp DrvInst.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141 MBAMService.exe File created C:\Windows\System32\DriverStore\FileRepository\rtux64w10.inf_amd64_382d70e2c349183c\rtux64w10.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netathrx.inf_amd64_ba496c81c003f721\netathrx.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\net9500-x64-n650f.inf_amd64_566fa98f770451d2\net9500-x64-n650f.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\ndisimplatformmp.inf_amd64_8f9eb8ff490e6c70\ndisimplatformmp.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\qcwlan64.inf_amd64_71c84e1405061462\qcwlan64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\rndiscmp.inf_amd64_e3cf74e485b2778b\rndiscmp.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netsstpa.inf_amd64_a982732ea027811e\netsstpa.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_CF33567922C393BFB92DE8105C392BE5 MBAMService.exe File created C:\Windows\System32\DriverStore\FileRepository\vmxnet3.inf_amd64_de19380e1b34c369\vmxnet3.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netrtl64.inf_amd64_e646b306d9138846\netrtl64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\wnetvsc.inf_amd64_3ea8686d80de3706\wnetvsc.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\net8187bv64.inf_amd64_4295cf068229eafc\net8187bv64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netvwwanmp.inf_amd64_21a7e1c8368216a0\netvwwanmp.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C56C4404C4DEF0DC88E5FCD9F09CB2F1 MBAMService.exe File created C:\Windows\System32\DriverStore\FileRepository\netbc63a.inf_amd64_adc1c27c4a8b0d4f\netbc63a.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\bcmdhd64.inf_amd64_0c3c6ca9708e5a9a\bcmdhd64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netbxnd0a.inf_amd64_9744de6fd6c11c4f\netbxnd0a.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\mrvlpcie8897.inf_amd64_668551398886eaf3\mrvlpcie8897.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{47f36001-ee18-6c47-b472-91c2ea43e618}\SET132D.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\netwtw08.inf_amd64_448906930b28afd9\netwtw08.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\wceisvista.inf_amd64_b98fec2fcf3c69e9\wceisvista.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94D97B1EC1F43DD6ED4FE7AB95E144BC_38A1221025A0DFB52F454FF8C79E14CC MBAMService.exe File created C:\Windows\System32\DriverStore\FileRepository\rtucx21x64.inf_amd64_286645bc82b2f9fb\rtucx21x64.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{47f36001-ee18-6c47-b472-91c2ea43e618}\mbtun.sys DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\netwtw06.inf_amd64_c5f16d20642e3070\netwtw06.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07A7CCFBD28A674D95D3BF853C9007C6 MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_64A201640BD8E31E72E33FB1EBF9962D MBAMService.exe File created C:\Windows\System32\DriverStore\FileRepository\net1ic64.inf_amd64_93678a2d694d4579\net1ic64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netxex64.inf_amd64_01587744078125a1\netxex64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netwns64.inf_amd64_d630255fa92e6727\netwns64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netrndis.inf_amd64_7559d510c51e5594\netrndis.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netrtwlans.inf_amd64_e0770fc2820687e2\netrtwlans.PNF MBVpnTunnelService.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\PresentationFramework-SystemXml.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\Microsoft.Extensions.Options.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\daeebdfd-2c2b-4f97-a0af-87392f9eb5a3 2026-07-23_6819d4a1e5ddc327534a5a95e3d1decb_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\it\System.Windows.Controls.Ribbon.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\ja\System.Xaml.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\tr\ReachFramework.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\PoliciesControllerImpl.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\MwacLib.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\Microsoft.CSharp.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\tr\System.Windows.Input.Manipulations.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\zh-Hant\WindowsFormsIntegration.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\sample.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\SQLitePCLRaw.provider.e_sqlite3.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\mscordbi.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.Reflection.Emit.Lightweight.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\ru\System.Windows.Controls.Ribbon.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\tr\PresentationUI.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\UIAutomationTypes.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbam.inf MBAMService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.Windows.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\es\WindowsBase.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\zh-Hant\PresentationCore.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\zh-Hant\System.Windows.Forms.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\VPNControllerImpl.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\MBAMShim.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\MbamBgNativeMsg.exe MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\mbam.manifest.json MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\mscordaccore_amd64_amd64_10.0.826.23019.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.IO.Compression.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\es\WindowsFormsIntegration.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\pl\PresentationCore.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\PresentationFramework.Fluent.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.IO.FileSystem.AccessControl.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\it\WindowsBase.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.Data.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\es\System.Windows.Forms.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\fr\UIAutomationClient.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\ja\Microsoft.VisualBasic.Forms.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\ko\PresentationUI.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\tr\System.Windows.Forms.Primitives.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnel_wireguard.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\MbamUI.Services.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.Net.WebProxy.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.Text.RegularExpressions.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\pt-BR\PresentationCore.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.runtimeconfig.json MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.Collections.Concurrent.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.Security.Cryptography.Cng.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\cs\System.Windows.Controls.Ribbon.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\cs\UIAutomationClient.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\it\WindowsFormsIntegration.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\SelfProtectionSdk.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.Protection.Interop.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\hostfxr.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\System.DirectoryServices.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\zh-Hans\Microsoft.VisualBasic.Forms.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\zh-Hant\WindowsBase.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\AEControllerImpl.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\MbamUI.Data.dll MBAMInstallerService.exe File opened for modification C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.json.bak MBAMService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\cs\ReachFramework.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\es\UIAutomationClient.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\PresentationFramework-SystemCore.dll MBAMInstallerService.exe - Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.dev.log MBVpnTunnelService.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\inf\oem1.inf DrvInst.exe File created C:\Windows\inf\oem1.inf DrvInst.exe File created C:\Windows\ELAMBKUP\MbamElam.sys MBAMService.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 1 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh MBVpnTunnelService.exe - Modifies trusted root certificate store through registry 1 TTPs 13 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa22000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8DA7F965EC5EFC37910F1C6E59FDC1CC6A6EDE16\Blob = 0300000001000000140000008da7f965ec5efc37910f1c6e59fdc1cc6a6ede162000000001000000450300003082034130820229a0030201020213066c9fcf99bf8c0a39e2f0788a43e696365bca300d06092a864886f70d01010b05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412031301e170d3135303532363030303030305a170d3338303131373030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f74204341203130820122300d06092a864886f70d01010105000382010f003082010a0282010100b2788071ca78d5e371af478050747d6ed8d78876f49968f7582160f97484012fac022d86d3a0437a4eb2a4d036ba01be8ddb48c80717364cf4ee8823c73eeb37f5b519f84968b0ded7b976381d619ea4fe8236a5e54a56e445e1f9fdb416fa74da9c9b35392ffab02050066c7ad080b2a6f9afec47198f503807dca2873958f8bad5a9f948673096ee94785e6f89a351c0308666a14566ba54eba3c391f948dcffd1e8302d7d2d747035d78824f79ec4596ebb738717f2324628b843fab71daacab4f29f240e2d4bf7715c5e69ffea9502cb388aae50386fdbfb2d621bc5c71e54e177e067c80f9c8723d63f40207f2080c4804c3e3b24268e04ae6c9ac8aa0d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604148418cc8534ecbc0c94942e08599cc7b2104e0a08300d06092a864886f70d01010b0500038201010098f2375a4190a11ac57651282036230eaee628bbaaf894ae48a4307f1bfc248d4bb4c8a197f6b6f17a70c85393cc0828e39825cf23a4f9de21d37c8509ad4e9a753ac20b6a897876444718656c8d418e3b7f9acbf4b5a750d7052c37e8034bade961a0026ef5f2f0c5b2ed5bb7dcfa945c779e13a57f52ad95f2f8933bde8b5c5bca5a525b60af14f74befa3fb9f40956d3154fc42d3c7461f23add90f48709ad9757871d1724334756e5759c2025c266029cf2319168e8843a5d4e4cb08fb231143e843297262a1a95d5e08d490aeb8d8ce14c2d055f286f6c49343776661c0b9e841d7977860036e4a72aea5d17dba109e866c1b8ab95933f8ebc490bef1b9 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F6108407D6F8BB67980CC2E244C2EBAE1CEF63BE\Blob = 030000000100000014000000f6108407d6f8bb67980cc2e244c2ebae1cef63be2000000001000000f6010000308201f230820178a0030201020213066c9fd7c1bb104c2943e5717b7b2cc81ac10e300a06082a8648ce3d0403033039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412034301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f7420434120343076301006072a8648ce3d020106052b8104002203620004d2ab8a374fa3530dfec18a7b4ba87b464b63b062f62d1bdb087121d200e863bd9a27fbf0396e5dea3da5c981aaa35b2098455d16dbfde8106de39ce0e3bd5f8462f3706433a0cb242f70ba88a12aa075f881ae6206c481db396e29b01efa2e5ca3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414d3ecc73a656ecce1da769a56fb9cf3866d57e581300a06082a8648ce3d040303036800306502303a8b21f1bd7e11add0ef58962fd6eb9d7e908d2bcf6655c32ce328a9700a470ef0375912ff2d9994284e2a4f354d335a023100ea75004e3bc43a941291c958469d211372a7889c8ae44c4adb96d4ac8b6b6b49125333add7e4be24fcb50a76d4a5bc10 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\1C58A3A8518E8759BF075B76B750D4F2DF264FCD\Blob = 0300000001000000140000001c58a3a8518e8759bf075b76b750d4f2df264fcd2000000001000000c2040000308204be308203a6a003020102021006d8d904d5584346f68a2fa754227ec4300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3231303431343030303030305a170d3331303431333233353935395a304f310b300906035504061302555331153013060355040a130c446967694365727420496e633129302706035504031320446967694365727420544c53205253412053484132353620323032302043413130820122300d06092a864886f70d01010105000382010f003082010a0282010100c14bb3654770bcdd4f58dbec9cedc366e51f311354ad4a66461f2c0aec6407e52edcdcb90a20eddfe3c4d09e9aa97a1d8288e51156db1e9f58c251e72c340d2ed292e156cbf1795fb3bb87ca25037b9a52416610604f571349f0e8376783dfe7d34b674c2251a6df0e9910ed57517426e27dc7ca622e131b7f238825536fc13458008b84fff8bea75849227b96ada2889b15bca07cdfe951a8d5b0ed37e236b4824b62b5499aecc767d6e33ef5e3d6125e44f1bf71427d58840380b18101faf9ca32bbb48e278727c52b74d4a8d697dec364f9cace53a256bc78178e490329aefb494fa415b9cef25c19576d6b79a72ba2272013b5d03d40d321300793ea99f50203010001a38201823082017e30120603551d130101ff040830060101ff020100301d0603551d0e04160414b76ba2eaa8aa848c79eab4da0f98b2c59576b9f4301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030106082b06010505070302307606082b06010505070101046a3068302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304006082b060105050730028634687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274476c6f62616c526f6f7443412e63727430420603551d1f043b30393037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274476c6f62616c526f6f7443412e63726c303d0603551d2004363034300b06096086480186fd6c02013007060567810c01013008060667810c0102013008060667810c0102023008060667810c010203300d06092a864886f70d01010b050003820101008032ce5e0bdd6e5a0d0aafe1d684cbc08efa8570edda5db30cf72b7540fe850afaf33178b7704b1a8958ba80bdf36b1de97ecf0bba589c59d490d3fd6cfdd0986db771825bcf6d0b5a09d07bdec443d82aa4de9e41265fbb8f99cbddaee1a86f9f87fe74b71f1b20abb14fc6f5675d5d9b3ce9ff69f7616cd6d9f3fd36c6ab038876d24b2e7586e3fcd8557d26c21177df3e02b67cf3ab7b7a86366fb8f7d89371cf86df7330fa7babed2a59c842843b11171a52f3c90e147da25b7267ba71ed574766c5b8024a65345e8bd02a3c209c51994ce7529ef76b112b0d927e1de88aeb36164387ea2a63bf753febdec403bb0a3cf730efebaf4cfc8b3610733ef3a4 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\2AD974A775F73CBDBBD8F5AC3A49255FA8FB1F8C\Blob = 0300000001000000140000002ad974a775f73cbdbbd8f5ac3a49255fa8fb1f8c2000000001000000620400003082045e30820346a0030201020213077312380b9d6688a33b1ed9bf9ccda68e0e0f300d06092a864886f70d01010b05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412031301e170d3232303832333232323132385a170d3330303832333232323132385a303c310b3009060355040613025553310f300d060355040a1306416d617a6f6e311c301a06035504031313416d617a6f6e205253412032303438204d303130820122300d06092a864886f70d01010105000382010f003082010a0282010100eb712ca9cb1f8828923230af8a570f78b73725955587ac675c97d322c8daa214676b7cf067dae2032ab356125dc6b547f96708a7937a9592180fb4f9f910369a7f2f80b64fba134ec75d531ee0dd96330720d396bc12e4745042a1051373b54f9b4424fe2d7fedbc2285ec362133977506ce271882dce3d9c582078d5e26012626671fd93f13cf32ba6bad7864fcaaff0e023c07df9c0578728cfdea75b7032884dae86e078cd05085ef8154b2716eec6d62ef8f94c35ee9c4a4d091c02e249198caeeba258ed4f671b6fb5b6b38064837478d86dcf2ea06fb76377d9eff424e4d588293cfe271c278b17aab4b5b94378881e4d9af24aef872c565fb4bb451e70203010001a382015a3082015630120603551d130101ff040830060101ff020100300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030106082b06010505070302301d0603551d0e0416041481b80e638a891218e5fa3b3b50959fe6e5901385301f0603551d230418301680148418cc8534ecbc0c94942e08599cc7b2104e0a08307b06082b06010505070101046f306d302f06082b060105050730018623687474703a2f2f6f6373702e726f6f746361312e616d617a6f6e74727573742e636f6d303a06082b06010505073002862e687474703a2f2f6372742e726f6f746361312e616d617a6f6e74727573742e636f6d2f726f6f746361312e636572303f0603551d1f043830363034a032a030862e687474703a2f2f63726c2e726f6f746361312e616d617a6f6e74727573742e636f6d2f726f6f746361312e63726c30130603551d20040c300a3008060667810c010201300d06092a864886f70d01010b05000382010100ad00de0205232e063262b46bb19416e41140de2bfa59c135efe0aa8f2b41b9d1f38739001df23db5a7470c0606c691f3075702d4edbd17c1909abf4875a2074f30dd4a6a42b50d3d15c00ffe845bc63c99cc5752b1d86e12d59692934b94e507e88982086a7a34d49e64e13d876a92909a63a14bf88fb6ea34d305be20c2de06e28c9f738b9f4d3985cace19369d85c99ec9f8503fb67e88a1efca84068b50b40a5ca61c44f1fdc8614060f26125aa07f4c7c27375e40c0b428d04e55f4448995b7b898196a7889d4b0d62e804c4d7feb4e8b26dcaecc01cbc385b1ddf85ce5b7ae3494b6cb9a7ddf405b249ade1c5146bc2ccebcd7fd65869bac3207e7fb0b8 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54362000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\5A8CEF45D7A69859767A8C8B4496B578CF474B1A\Blob = 0300000001000000140000005a8cef45d7a69859767a8c8b4496b578cf474b1a2000000001000000450500003082054130820329a0030201020213066c9fd29635869f0a0fe58678f85b26bb8a37300d06092a864886f70d01010c05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412032301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f74204341203230820222300d06092a864886f70d01010105000382020f003082020a0282020100ad969f2d9c4a4c4a81795199ec8acb6b605113bc4d6d06fcb0088ddd19106ac7260c35d8c06f2084e994b19b8503c35bdb4ae8c8f89076d95b4fe34ce806364dcc9aac3d0c902b92d4061960ac374479858182ad5a37e00dcc9da64c5276ea439db704d150f655e0d5d2a64985e937e9ca7eae5c954d489a3fae205a6d8895d934b8521a4390b0bf6c05b9b678b7ead0e43a3c125362ff4af27bbe3505a91234e3f36474622c3d00495a28fe3244bb87dd652702713bda4af71fdacdf72155904f0fecae82e19f6bd945d3bbf05f87ed3c2c3986da3fdeec7255eb79a3addbdd7cb0ba1ccefcde4f3576cf0ff8781f6a36514627615be99ecff0a2557d7c258a6f2fb4c5cf842e2bfd0d51106cfb5f1bbc1b7ec5ae3b98013192ff0b57f49ab2b957e9abef0d76d1f0eef4ce86a7e06ee9b469a1df69f633c6692e97139ea587b057108137c953b3bb7ff692d19cd018f4926eda834fa663994ca5fb5eef21647a205f6c648515cb37e9620c0b2a16dc012e32da3e4bf59e3af6174094ef9e910886fabe63a85a33eccb744395f96c695236c7296ffc55035c1ffb9fbd47ebe74947950b4e89220949e0f5611ef1bf2e8a726e8059ff573af97532a34e5feced2862d94d73f2cc811760edcdebdcdba7cac57e02bdf2540854fdb42d092c17544a98d154e1516708d2ed6e7e6f3fd22d81592966cb903995111e7427feddebaf0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414b00cf04c30f405580248fd33e552af4b84e36652300d06092a864886f70d01010c05000382020100aaa8808f0e78a3e0a2d4cde6f5987a3bea0003b0970e93bc5aa8f62c8c7287a9b1fc7f73fd637178a58759cf30e10d10b2135a6d82f56ae6809fa0050b68e4476bc76adfb6fd773272e518fa09f4a0932c5dd28c75857665900c0379b7312363ad788309866884cafff9cf269a9279e7cd4bc5e761a717cbf3a91293936ba7e82f5392c46058b0cc0251185b858d625963b6adb4de9afb26f70027c05d55377499c9507fe3592e44e32c25eeec4c3277b49f1ae94b5d20c5dafd1c8716c643e8d4bb269a45705ea90b3753e2467b27fde046f289b7cc42b6cb28266ed9a5c93ac8411360f7508c15aeb26d1a151a5778e6922ad96590823f6c02afae123a27963604d71da28063a99bf1e5bab47c14b04ec9b11f745f38f651ea9bfa2ca211d4a92d271a45b1afb24e710dc05846d66906cb53cbb3fe6b41cd417e7d4c0f7c72797a59cd5e4a0eac9ba99873797cb4f4ccb9b8070cb2745cb8c76f88a190a7f4aaf9bf673af41a15621eb79fbe3db129af67a112f25810195303301bb81a89f69cbd97038ea309f31d8b21f1b4dfe41cd19f650206ea5cd613b384efa2a55c8c7729a768c06bae40d2a8b4eacdf08d4b389c199a1b2854b88990efca75813e1ef26424c718af4eff479e07f63565a4d30a56fff517646cefa822254993b6df0017da587e5deec51bb0d1d15f2110c7f9f3ba020a2707c5f1d6c7d3e0fb09606c MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0D44DD8C3C8C1A1A58756481E90F2E2AFFB3D26E\Blob = 0300000001000000140000000d44dd8c3c8c1a1a58756481e90f2e2affb3d26e2000000001000000ba010000308201b63082015ba0030201020213066c9fd5749736663f3b0b9ad9e89e7603f24a300a06082a8648ce3d0403023039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412033301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f7420434120333059301306072a8648ce3d020106082a8648ce3d030107034200042997a7c6417fc00d9be8011b56c6f252a5ba2db212e8d22ed7fac9c5d8aa6d1f73813b3b986b397c33a5c54e868e8017686245577d44581db337e56708eb66dea3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414abb6dbd7069e37ac3086079170c79cc419b178c0300a06082a8648ce3d0403020349003046022100e08592a317b78df92b06a593ac1a98686172fae1a1d0fb1c7860a64399c5b8c40221009c02eff1949cb396f9ebc62af8b62cfe3a901416d78c6324481cdf307dd5683b MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 6b00000001000000200000005367f20c7ade0e2bca790915056d086b720c33c1fa2a2661acf787e3292e1270140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a2030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa20f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e1900000001000000100000009f687581f7ef744ecfc12b9cee6238f12000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 MBAMService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 5c0000000100000004000000001000001900000001000000100000009f687581f7ef744ecfc12b9cee6238f10f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa2140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a26b00000001000000200000005367f20c7ade0e2bca790915056d086b720c33c1fa2a2661acf787e3292e12702000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 MBAMService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E\Blob = 030000000100000014000000b51c067cee2b0c3df855ab2d92f4fe39d4e70f0e2000000001000000e1030000308203dd308202c5a003020102020100300d06092a864886f70d01010b050030818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a30818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bdedc103fcf68ffc02b16f5b9f48d99d79e2a2b703615618c347b6d7ca3d352e8943f7a1699bde8a1afd13209cb44977322956fdb9ec8cdd22fa72dc276197eef65a84ec6e19b9892cdc845bd574fb6b5fc589a51052894655f4b8751ce67fe454ae4bf85572570219f8177159eb1e280774c59d48be6cb4f4a4b0f364377992c0ec465e7fe16d534c62afcd1f0b63bb3a9dfbfc7900986174cf26824063f3b2726a190d99cad40e75cc37fb8b89c159f1627f5fb35f6530f8a7b74d765a1e765e34c0e89656998ab3f07fa4cdbddc32317c91cfe05f11f86baa495cd19994d1a2e3635b0976b55662e14b741d96d426d4080459d0980e0ee6defcc3ec1f90f10203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147c0c321fa7d9307fc47d68a362a8a1ceab075b27300d06092a864886f70d01010b050003820101001159fa254f036f94993b9a1f828539d47605945ee128936d625d09c2a0a8d4b07538f1346a9de49f8a862651e62cd1c62d6e95204a9201ecb88a677b31e2672e8c9503262e439d4a31f60eb50cbbb7e2377f22ba00a30e7b52fb6bbb3bc4d379514ecd90f4670719c83c467a0d017dc558e76de68530179a24c410e004f7e0f27fd4aa0aff421d37ed94e5645912207738d3323e3881759673fa688fb1cbce1fc5ecfa9c7ecf7eb1f1072db6fcbfcaa4bfd097054abcea18280290bd5478092171d3d17d1dd916b0a9613dd00a0022fcc77bcb0964450b3b4081f77d7c32f598ca588e7d2aee90597364f936745e25a1f566052e7f3915a92afb508b8e8569f4 MBAMInstallerService.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-23_6819d4a1e5ddc327534a5a95e3d1decb_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe - Checks SCSI registry key(s) 3 TTPs 16 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 DrvInst.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MBAMService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MBAMService.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Malwarebytes.exe = "11000" MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION MBAMService.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\mbam.exe = "11000" MBAMService.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\mbamtray.exe = "11000" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION MBAMInstallerService.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates MBAMService.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\16.0\Common\Security MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates MBAMService.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Malwarebytes MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:\ MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\Software MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs MBAMService.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\16.0 MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0 MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\15.0\Common MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust MBAMService.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\16.0\Common MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office MBAMInstallerService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates MBAMService.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:\ MBAMInstallerService.exe Set value (str) \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:\ MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Malwarebytes MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\16.0\Common MBAMInstallerService.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6C5B978B-68C9-45C7-9D6E-0BA57A3C7EB2}\1.0\FLAGS\ = "0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{346CF9BC-3AD5-43BA-B348-EFB88F75360F}\ = "IVPNControllerV2" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{960F2BB5-E954-45C5-97DF-A770D9D8C24B}\TypeLib\ = "{5709DEEB-F05E-4D5C-8DC4-3B0D924EE08F}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{44AC1571-055F-4CC8-B7D8-EA022C4CC112}\TypeLib\ = "{A82129F1-32E1-4D79-A39F-EBFEE53A70BF}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{014D0CF7-ACC9-4004-B999-7BDBAAD274B7}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D8258E71-3A7A-4D9D-85BB-C7999F95B7E4}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DB82CDC6-F12A-4156-8DBF-EC7465B9C0B9}\ = "ISPController" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EAD7766B-F8F3-4944-AFE6-5D667E535709}\TypeLib\ = "{783B187E-360F-419C-B6DA-592892764A01}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8307A4A5-A025-438B-B23B-8EE38A453D54}\TypeLib\ = "{332AFEBA-9341-4CEC-8EA6-DB155A99DF63}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8FF168C7-A609-4237-A076-E461334BF4EA}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7C710FA9-862A-40CF-9F54-063EF8FC8438}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7C710FA9-862A-40CF-9F54-063EF8FC8438}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C0D8223D-D594-4147-BAD8-1E2B54ED1990}\TypeLib\Version = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{08057A16-2479-49CE-BA58-1EA1FF95D95D} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BADF77CD-ECCE-4B36-88FF-6A2804FFE307}\ = "_IScanControllerEventsV11" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DBD14E9A-A1B3-4B5A-8A4A-0E4EB25FAA54}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{44AC1571-055F-4CC8-B7D8-EA022C4CC112}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EC4BC952-9520-462B-BD5C-4E2C9200B3C9}\TypeLib\ = "{332AFEBA-9341-4CEC-8EA6-DB155A99DF63}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6724C143-DE69-4A93-80ED-19B75DD2AA99}\ = "IMWACControllerEventsV9" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AC765BED-7B43-4A78-9958-11E3612E4B2F} MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57CE581A-0CB6-4266-9CA0-19364C90A0B3}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FA1D4FDD-C9C8-4575-A2A1-4179C3A3473D} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C7BCC13C-47B9-4DC0-8FC6-B2A489EF60EF}\ = "IScanControllerV4" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CE7ABFE9-8F8F-4EDD-86BD-9209FD072126}\TypeLib\ = "{5709DEEB-F05E-4D5C-8DC4-3B0D924EE08F}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DBD14E9A-A1B3-4B5A-8A4A-0E4EB25FAA54}\ = "ICloudControllerV8" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EABA01A8-8468-430A-9D6E-4C9F1CE22C88}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2DFD7E94-47E6-483A-B4FD-DC586A52CE5D}\ = "_ILicenseControllerEventsV2" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DD3CFEBD-3B8E-4651-BB7C-537D1F03E59C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{53260A87-5F77-4449-95F1-77A210A2A6D8}\ = "IMWACControllerEventsV2" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F128CCB-D86F-4998-803A-7CD58474FE2C}\ProxyStubClsid32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B44D50B8-E459-4078-9249-3763459B2676}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6A3E14F0-01F5-492E-AA97-3D880941D814}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{19E8B60E-50A1-4E29-9138-A13421D2BF7D} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C4C41809-DC9B-4791-8F18-3F04C847E62F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{46AEAC9A-C091-4B63-926C-37CFBD9D244F}\ = "IRTPControllerEventsV5" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7196E77C-8EA5-4824-92C9-BAE8671149FA} MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CCEFCD43-B934-4168-AE51-6FE07D3D0624}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{71B13605-3569-4F4A-B971-08FF179A3A60}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BE6DEC4E-1BDE-49DA-AFDD-D979539A9A0D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{08927360-710B-483B-BEEC-17E51FF84AF9}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{08927360-710B-483B-BEEC-17E51FF84AF9}\TypeLib\Version = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EC676D1E-2E9E-4876-834C-7AF2BCA2E885} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{376BE474-56D4-4177-BB4E-5610156F36C8}\Version\ = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B3B24818-1CC9-4825-96A9-1DB596E079C8}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B32065E5-189E-4C5F-AA59-32A158BAF5B7}\ = "_IScanControllerEventsV10" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6B3DFEA6-6514-42CF-A091-C4DFFD9C2158}\TypeLib\ = "{5709DEEB-F05E-4D5C-8DC4-3B0D924EE08F}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9185897A-76F4-4083-A02C-5FFC2A51F6D4}\ = "ICleanControllerV10" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9704115C-F54E-4D64-8554-0CAF8BF33B1B} MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9F798C4B-4059-46F9-A0FE-F6B1664ADE96}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4475F1FD-791E-4CEB-B70D-C1167C56CBE1}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MB.MBAMServiceController.1\CLSID MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB54E87D-D7DB-400E-AFF1-0182D7378E0F}\ = "ICleanControllerV17" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A10434E2-CAA7-48C4-9770-E9F215C51ECC}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DC2F8F62-D471-4AD5-B346-9F214FE941A7}\TypeLib\Version = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57CE581A-0CB6-4266-9CA0-19364C90A0B3}\VersionIndependentProgID MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AD174136-2177-4A57-88AA-F336662EE04A}\TypeLib\ = "{783B187E-360F-419C-B6DA-592892764A01}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CE7ABFE9-8F8F-4EDD-86BD-9209FD072126} MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CFFF19F6-ECFE-446D-ACAD-8DC525DA2563} MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{956AEAEB-8EA2-4BE1-AAD0-3BE4C986A1CC}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E149FEF9-F1DC-4894-8A8E-AA53F6807EFD}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C2E404A3-4E3F-4094-AE06-5E38D39B79AE}\ = "ILicenseControllerV3" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C8952062-7422-4BAD-8A60-94E21F5CFE7C}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A2C9E279-3E50-44F0-8C3B-606A303BA1D1}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{17BE78EE-B40A-4B9E-835F-38EC62F9D479}\Version\ = "1.0" MBAMService.exe - Modifies system certificate store 2 TTPs 12 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F6108407D6F8BB67980CC2E244C2EBAE1CEF63BE MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\2AD974A775F73CBDBBD8F5AC3A49255FA8FB1F8C MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0D44DD8C3C8C1A1A58756481E90F2E2AFFB3D26E MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\1C58A3A8518E8759BF075B76B750D4F2DF264FCD MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8DA7F965EC5EFC37910F1C6E59FDC1CC6A6EDE16 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\5A8CEF45D7A69859767A8C8B4496B578CF474B1A MBAMInstallerService.exe - Suspicious behavior: EnumeratesProcesses 36 IoCs
pid Process 2028 2026-07-23_6819d4a1e5ddc327534a5a95e3d1decb_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 2028 2026-07-23_6819d4a1e5ddc327534a5a95e3d1decb_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 4988 MBAMInstallerService.exe 4988 MBAMInstallerService.exe 4988 MBAMInstallerService.exe 4988 MBAMInstallerService.exe 4988 MBAMInstallerService.exe 4988 MBAMInstallerService.exe 4988 MBAMInstallerService.exe 4988 MBAMInstallerService.exe 4988 MBAMInstallerService.exe 4988 MBAMInstallerService.exe 4988 MBAMInstallerService.exe 4988 MBAMInstallerService.exe 4988 MBAMInstallerService.exe 4988 MBAMInstallerService.exe 4988 MBAMInstallerService.exe 4988 MBAMInstallerService.exe 4988 MBAMInstallerService.exe 4988 MBAMInstallerService.exe 4988 MBAMInstallerService.exe 4988 MBAMInstallerService.exe 4988 MBAMInstallerService.exe 4988 MBAMInstallerService.exe 4988 MBAMInstallerService.exe 4988 MBAMInstallerService.exe 4988 MBAMInstallerService.exe 4988 MBAMInstallerService.exe 4988 MBAMInstallerService.exe 4988 MBAMInstallerService.exe 4988 MBAMInstallerService.exe 4988 MBAMInstallerService.exe 712 MBAMService.exe 712 MBAMService.exe 712 MBAMService.exe 712 MBAMService.exe - Suspicious behavior: LoadsDriver 12 IoCs
pid Process 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4988 MBAMInstallerService.exe Token: SeDebugPrivilege 4988 MBAMInstallerService.exe Token: SeDebugPrivilege 4988 MBAMInstallerService.exe Token: SeDebugPrivilege 4988 MBAMInstallerService.exe Token: SeDebugPrivilege 4988 MBAMInstallerService.exe Token: SeDebugPrivilege 4988 MBAMInstallerService.exe Token: SeDebugPrivilege 4988 MBAMInstallerService.exe Token: SeDebugPrivilege 4988 MBAMInstallerService.exe Token: SeDebugPrivilege 4988 MBAMInstallerService.exe Token: SeDebugPrivilege 4988 MBAMInstallerService.exe Token: SeDebugPrivilege 4988 MBAMInstallerService.exe Token: SeDebugPrivilege 4988 MBAMInstallerService.exe Token: SeDebugPrivilege 4988 MBAMInstallerService.exe Token: SeDebugPrivilege 4988 MBAMInstallerService.exe Token: SeDebugPrivilege 4988 MBAMInstallerService.exe Token: SeDebugPrivilege 4988 MBAMInstallerService.exe Token: SeDebugPrivilege 4988 MBAMInstallerService.exe Token: SeDebugPrivilege 4988 MBAMInstallerService.exe Token: SeDebugPrivilege 4988 MBAMInstallerService.exe Token: SeDebugPrivilege 4988 MBAMInstallerService.exe Token: SeDebugPrivilege 4988 MBAMInstallerService.exe Token: SeDebugPrivilege 4988 MBAMInstallerService.exe Token: SeDebugPrivilege 4988 MBAMInstallerService.exe Token: SeDebugPrivilege 4988 MBAMInstallerService.exe Token: SeDebugPrivilege 4988 MBAMInstallerService.exe Token: SeDebugPrivilege 4988 MBAMInstallerService.exe Token: SeDebugPrivilege 4988 MBAMInstallerService.exe Token: SeDebugPrivilege 4988 MBAMInstallerService.exe Token: SeDebugPrivilege 4988 MBAMInstallerService.exe Token: SeDebugPrivilege 4988 MBAMInstallerService.exe Token: SeDebugPrivilege 4988 MBAMInstallerService.exe Token: SeDebugPrivilege 4988 MBAMInstallerService.exe Token: SeDebugPrivilege 4988 MBAMInstallerService.exe Token: SeDebugPrivilege 4988 MBAMInstallerService.exe Token: SeDebugPrivilege 4988 MBAMInstallerService.exe Token: SeDebugPrivilege 4988 MBAMInstallerService.exe Token: SeDebugPrivilege 4988 MBAMInstallerService.exe Token: SeDebugPrivilege 4988 MBAMInstallerService.exe Token: SeDebugPrivilege 4988 MBAMInstallerService.exe Token: SeDebugPrivilege 4988 MBAMInstallerService.exe Token: SeDebugPrivilege 4988 MBAMInstallerService.exe Token: SeDebugPrivilege 4988 MBAMInstallerService.exe Token: SeDebugPrivilege 4988 MBAMInstallerService.exe Token: SeDebugPrivilege 4988 MBAMInstallerService.exe Token: SeDebugPrivilege 4988 MBAMInstallerService.exe Token: SeDebugPrivilege 4988 MBAMInstallerService.exe Token: SeDebugPrivilege 4988 MBAMInstallerService.exe Token: SeDebugPrivilege 4988 MBAMInstallerService.exe Token: SeDebugPrivilege 4988 MBAMInstallerService.exe Token: SeDebugPrivilege 4988 MBAMInstallerService.exe Token: SeDebugPrivilege 4988 MBAMInstallerService.exe Token: SeDebugPrivilege 4988 MBAMInstallerService.exe Token: SeDebugPrivilege 4988 MBAMInstallerService.exe Token: SeDebugPrivilege 4988 MBAMInstallerService.exe Token: SeDebugPrivilege 4988 MBAMInstallerService.exe Token: SeDebugPrivilege 4988 MBAMInstallerService.exe Token: SeDebugPrivilege 4988 MBAMInstallerService.exe Token: SeDebugPrivilege 4988 MBAMInstallerService.exe Token: SeDebugPrivilege 4988 MBAMInstallerService.exe Token: SeDebugPrivilege 4988 MBAMInstallerService.exe Token: SeDebugPrivilege 4988 MBAMInstallerService.exe Token: SeDebugPrivilege 4988 MBAMInstallerService.exe Token: SeDebugPrivilege 4988 MBAMInstallerService.exe Token: SeDebugPrivilege 4988 MBAMInstallerService.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2028 2026-07-23_6819d4a1e5ddc327534a5a95e3d1decb_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4988 wrote to memory of 4704 4988 MBAMInstallerService.exe 93 PID 4988 wrote to memory of 2044 4988 MBAMInstallerService.exe 98 PID 712 wrote to memory of 5636 712 MBAMService.exe 115 PID 712 wrote to memory of 1268 712 MBAMService.exe 116 PID 712 wrote to memory of 2396 712 MBAMService.exe 117 PID 712 wrote to memory of 2496 712 MBAMService.exe 118 PID 712 wrote to memory of 5744 712 MBAMService.exe 119 PID 712 wrote to memory of 2592 712 MBAMService.exe 120 PID 712 wrote to memory of 4744 712 MBAMService.exe 121 PID 712 wrote to memory of 4916 712 MBAMService.exe 122 PID 712 wrote to memory of 4588 712 MBAMService.exe 123 PID 712 wrote to memory of 5364 712 MBAMService.exe 127
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-23_6819d4a1e5ddc327534a5a95e3d1decb_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-23_6819d4a1e5ddc327534a5a95e3d1decb_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe"1⤵
- Downloads MZ/PE file
- Drops file in Drivers directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:2028
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- Modifies trusted root certificate store through registry
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe" /installmbtun2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
PID:4704
-
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe" /Service /Protected2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
PID:2044
-
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"1⤵
- Executes dropped EXE
PID:2760
-
C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Event Triggered Execution: Netsh Helper DLL
PID:5748
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "9" "C:\Program Files\Malwarebytes\Anti-Malware\mbtun\mbtun.inf" "9" "4ba9030c7" "0000000000000190" "Service-0x0-3e7$\Default" "0000000000000164" "208" "C:\Program Files\Malwarebytes\Anti-Malware\mbtun"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:4136
-
C:\Windows\system32\DRIVERS\MbamElam.sysC:\Windows\system32\DRIVERS\MbamElam.sys1⤵
- Executes dropped EXE
PID:3376
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"1⤵
- Executes dropped EXE
PID:1704
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies trusted root certificate store through registry
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:712 -
C:\Program Files\Malwarebytes\Anti-Malware\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:5636
-
-
C:\Program Files\Malwarebytes\Anti-Malware\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:1268
-
-
C:\Program Files\Malwarebytes\Anti-Malware\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:2396
-
-
C:\Program Files\Malwarebytes\Anti-Malware\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:2496
-
-
C:\Program Files\Malwarebytes\Anti-Malware\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:5744
-
-
C:\Program Files\Malwarebytes\Anti-Malware\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:2592
-
-
C:\Program Files\Malwarebytes\Anti-Malware\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:4744
-
-
C:\Program Files\Malwarebytes\Anti-Malware\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:4916
-
-
C:\Program Files\Malwarebytes\Anti-Malware\ig.exeig.exe reseed2⤵
- Executes dropped EXE
PID:4588
-
-
C:\ProgramData\Malwarebytes\MBAMService\rmode\mbrescue.exe"C:\ProgramData\Malwarebytes\MBAMService\rmode\mbrescue.exe" /rescuemode "C:\Program Files\Malwarebytes\Anti-Malware" "C:\ProgramData\Malwarebytes\MBAMService"2⤵
- Checks BIOS information in registry
- Executes dropped EXE
PID:5364
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k AppReadiness -p -s AppReadiness1⤵PID:4292
-
C:\Windows\system32\DRIVERS\mbamswissarmy.sysC:\Windows\system32\DRIVERS\mbamswissarmy.sys1⤵
- Executes dropped EXE
PID:5372
-
C:\Windows\system32\DRIVERS\MbamChameleon.sysC:\Windows\system32\DRIVERS\MbamChameleon.sys1⤵
- Executes dropped EXE
PID:4832
-
C:\Windows\system32\DRIVERS\mbam.sysC:\Windows\system32\DRIVERS\mbam.sys1⤵
- Executes dropped EXE
PID:5136
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
2Component Object Model Hijacking
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
2Component Object Model Hijacking
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
1Safe Mode Boot
1Modify Registry
3Subvert Trust Controls
2Install Root Certificate
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\PROGRA~1\MALWAR~1\ANTI-M~1\mbtun\mbtun.cat
- Size 10KB
- SHA256 9ceb410494b95397ec1f8fa505d071672bf61f81cc596b8eccd167a77893c658
- MD5 8abff1fbf08d70c1681a9b20384dbbf9
- SHA1 c9762e121e4f8a7ad931eee58ee60c8e9fc3ecb6
- SHA512 37998e0aee93ff47fe5b1636fce755966debe417a790e1aebd7674c86c1583feef04648a7bc79e4dedaabb731051f4f803932ac49ea0be05776c0f4d218b076f
- SSDEEP 192:gM6dynJCSEJOL7yKnUi8rFWQFIGjl8zjEswYt1FfRM/GX01k9z3AeOlFa:gqS4CFRWGjl8M8/fi/GR9z/OlFa
- TLSH T1B43208E1897D84C2ED87A87147E8E5977C3C1BCB2C5055A911ABF7600AA33C6E71853D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\PROGRA~1\MALWAR~1\ANTI-M~1\mbtun\mbtun.sys
- Size 107KB
- SHA256 6903e60784b9fa5d8b417f93f19665c59946a4de099bd1011ab36271b267261c
- MD5 83d4fba999eb8b34047c38fabef60243
- SHA1 25731b57e9968282610f337bc6d769aa26af4938
- SHA512 47faab5fff3e3e2d2aea0a425444aa2e215f1d5bf97edee2a3bb773468e1092919036bcd5002357594b62519bf3a8980749d8d0f6402de0e73c2125d26e78f1e
- SSDEEP 1536:k0h5S895dQOYJaryTmbMc6uqkZUcmSl47AjpdAyDCYJqUufIfmNn3VzwZ6Dh7Q9y:C895uOYJar1MLcmSlrSgC6Duls2t
- TLSH T174B36C9DA1783089DE42A6B482B98793EFB4357A2B1177BF01E1C1748F537C0DB29DA4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\7z.dll
- Size 1.6MB
- SHA256 623e628393bc4b8131c1f4302b195429dfa67e890d3325ceaa56940660052b1b
- MD5 4da585f081e096a43a574f4f4167947e
- SHA1 38c81c6deae0e6d35c64c060b26271413a176a49
- SHA512 0fe168bf1661691dbaa103e478dd7e46b476db094bf1938bf1ad12ddb8a8f371bf611ff504d2eb3ac319862444cc64a27ebee8735aa3752aa32a399b09427243
- SSDEEP 24576:a9raURTF/5pe2g5RpBDxSjv9IrqLwRpFEDbt7y0MVoAAlzi8pY:a9hP/5petvSjWZR8DxO0mo5M8pY
- TLSH T16F756D5BF67400A4D5D6C034C5276B1BEAB1B88B8330A7EF12D15A6B6F13BF19979320
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\AEControllerImpl.dll
- Size 4.9MB
- SHA256 878239e138180492b8e703203db1eeda5da1a88b7897c16e7323bb506ef28dfe
- MD5 e4f9ffbfd7c3c8b641ebbbdcfe6399e8
- SHA1 8ee46b184bb37a8f24001eebe120796fa46935f2
- SHA512 8f68576a20a8a3b6e7125733862583bcb4fe137392392acb4e3b826450cb4b656815a3be7b44174bd3fef3a0f4722079eded587d8c0f2ac3680d67384cdbb317
- SSDEEP 49152:y3QcNVHvFJa0GV9Tkq9HWsMyhXTnXRUHNNWjwJZ1yWBEsUXH7PWnE8q12VPvUbA:q0XTnMmPsUXbPWNPvcYLX
- TLSH T152368D16A7F401A8C8B6C23CCA578503D7B2BC154730DBDF16A4966A1FB3BE1563EB24
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\Actions.dll
- Size 6.1MB
- SHA256 f2dc3b02c39cc92b945ebffc0be675251e93de87158eaf47bfeb5c3231488173
- MD5 d2ddd6f0a411ecd5023812336c7c386f
- SHA1 7eac246c6bb316814439d9e124d8371f27bb647a
- SHA512 6c2b3b4f4802670a1e461c6035a9ea32eafd653e7d5c9352b92fb0e27e3e1f5de178f02fa6875ea75d247f1545065e35f8f1d27105912ba7c19dafb24b535602
- SSDEEP 49152:7msy+BT0cuT6iMx6RqDX1aldmjrHPykS7WbQMB4wpZ4fKBj+Ae+Ysyg1cqW1wyT5:trTQNPYrHqe3le+jyTwyvbKIf/j
- TLSH T15C564B16A7E802A4E0B2C178EEF79103DBB27C255735CBDF0190525E0E73BE19A7AB15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\ActionsShim.dll
- Size 3.7MB
- SHA256 6c5047cb77ea843e8386ba2b26a8458e6255e2ab94d493e914620623723c6b32
- MD5 33617cde11d2bfcef47faf0d5ce3cef9
- SHA1 2439b5f0622cd539b6f6f2f87d78edba466299ed
- SHA512 ef909e5e6a695a0f2ae95621cf87795705b3d267ea7d1c82634faeff3a4e3b111f5f809cd9e7dbb71d588d6106e0b54c138364f99ba41c7c5d47cde9af1b753e
- SSDEEP 49152:SH0QptrM88LLHy9nqSk5n9BT1vAPZmbLMo7JTfYkwZdPHFszUlE3JqCx9R345GEm:ktro8k3booBovlE3JqCx9R345GEzul
- TLSH T16E068B17EB9540A8CC6AD23C855B8607D7B2BC25237097CF17B462AA1FB3BE1523E714
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\ArwControllerImpl.dll
- Size 5.6MB
- SHA256 a1904889632fce5fece6dbecda5e237423d571652350f24c8724bdeb3a30228a
- MD5 40f500da8c204e5e9a89fdd8dfae4ff6
- SHA1 3a407e01769f582116a34c3b874dd5b534734072
- SHA512 5a1888e523b39f1590c05236f502c2f5c0ab4a9384737294fdfa0c8b0870d851e2cb927b71112a8828c67c9017209e8b4fa66fca262d5f8d9a11ec481c946d46
- SSDEEP 49152:rjEQxZvdSVum8H2EMBNi3IcKpFd5wKqW1c7h/med5BNhlA+KjTscJ0Kzp+i7JtmC:rYQxjspzwJxE+6Tv+iVg64Iky
- TLSH T160468E1AB7D500A8D4B6C238CA578513E7B2BC554331DBDF06A4A6AA1F73BE0473EB14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\BrowserSDKDLL.dll
- Size 7.0MB
- SHA256 c72e39709b26ac7577200a76515347ff11c0a9424cf61657762d657e7aecd974
- MD5 36b6cdd3677d6a079cd21768ffacbc7e
- SHA1 e525b6c778d7b59ef06300cc980f63bcf581a24a
- SHA512 e106563a21063eba244b536e67ececf2630415d5857af8aa67bedecabb39a87799324c3024bcf84487fbd9cfb76dc24b27ebb881734b4157a38b5c74d538ec3e
- SSDEEP 49152:8VF1SVg1db+wMSI0nW5xjpvypuDYpsD0VXZTWqls/e9uETWgjB+S/YfbWf2zv7je:s8TeZKT+X6S/Yf6fITlRChya9Fx
- TLSH T113768D17B6A400A9D8BBC17CCA578603EBB2BC06577097CF16A4966E1F73BE0563E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\BrowserSDKDLLShim.dll
- Size 3.7MB
- SHA256 f6d24605eb688e039e4509d184d974bb14c4c38528edad129d0653eadfea80f9
- MD5 889529ee7dadd23f11ed5b3fdd1f5b79
- SHA1 3e8a1bee4d28102aeb4c6f2eb94946282ffa7e12
- SHA512 bcd57045d516232828003b2b970b457138cebafbfbf2bf762199c291228b2cd674d8084190fee22f0adf047e8f2ac20644712313cfb5f90289a83fd6698995ec
- SSDEEP 49152:aHENZh/xwXNNnfFEXqGW3nILlpqCBS6+38Q/h0oYEaF6r+jep6Plw3zUoC02n:TOX/xPb/aomGIoIn
- TLSH T1E2067B17EB9500A8CC6AD23C856B8607D7B2BC25677097CF1AB462791FB3BE1123E714
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\CleanControllerImpl.dll
- Size 8.7MB
- SHA256 8404395da4f44f39236e8265593f52dcbbdcb7e37e129498d4c18b56dee6902e
- MD5 b7930dfd9175b4c2d9abde99076bce4e
- SHA1 7219ee742a50fca1c9be0f68652704386f837797
- SHA512 b3afcdfc3c538ebbc9ed373f1c440592ed45adf274e8e0b4210b1b394605af23f999c2fe7c3742f6c8962578b6982d71f98a7c1be1c4a8f7d663e7240b7a4102
- SSDEEP 98304:pBDjgBUbuC7uYUxcbfssqiamfbt5rOTwLCeLZT:UBUiC7ufWfssqilfbtlkwd
- TLSH T1F9968E56B6E400A4E4F6D178CE678503DBB2BC551731DBDF0690966A1F73BE08A3EB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\CloudControllerImpl.dll
- Size 6.9MB
- SHA256 c1af072bd24fe47e5f2cd71faa900c7a1dd16520d3735f9cc8df40d671b5e9b7
- MD5 43cb480992b8419e0e2938e8897590f8
- SHA1 e8c69764ce3d6627956bc88b598b99b0143dbd87
- SHA512 f6d974086da91d5da49015ef82e4d0494c3bef77829fa4c7438fdf8e0fa06520f682609dfa42a0dd06fded7ae113543a9284467514486f2b514e2d6e94f0d231
- SSDEEP 98304:lTUvUuVCKfYls1zPJ2KxJRttlMA+4sS3GK:evUGCKfn1zPJ2KnRttOTm3GK
- TLSH T163769E5BA6E400A8D8B7C17CCE578503EBB2B81543719BDF06A4967A1F73BE0563EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\LicenseControllerImpl.dll
- Size 7.1MB
- SHA256 223dd68b4fc42d3451d7631a56bf261517e400da2b9536969b7eda80b28a0e93
- MD5 d91ed54c2e16f0c2d883dbcdd0b3c513
- SHA1 e5116a0fd899ccefc5e7375100b6fee90107c293
- SHA512 44b036566fde88317ccb90a3173464c96c547b61da73e1e65cfdbbd2bbe8df96d7425088cb7322c8c1e5cc6abdcc47ab76e41834f8e5cfa0ae07fadde35c5c5c
- SSDEEP 98304:qWth0pN471WY8eAolIft4ooTU5tgrJDFfv/8k:qU034715FAolIV76U5twtFfv/b
- TLSH T137769F6AA7E400ACD4B6D27CCA578503D7B2B8054371DBDF06A4967A1F73BE0963EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
- Size 10.6MB
- SHA256 d10e04217f81b44667c6237971f1f2843d132220c8712e8a855436e9f1f73baa
- MD5 cdd8c06c1f88f57727813906e3a58fb5
- SHA1 4ba873161c0ab0f489bb0c82a267aac8b0cb91dc
- SHA512 40fb64f723481e9b8e24d88edff74dbb85b2e63790595c067b01cc5986ac3a0fdeef0d8083e4c86c0e2681837cb53eb98e7bda2bcb22eb77d1b8330e2d72ef73
- SSDEEP 196608:PRO3j3Ld/5Mo9/vEvt2teG35tTdnXo9076gZCN3R9i:PROT7d/6o9XEvt2teG3p42Yi
- TLSH T10DB69E17A6B400E8D4F7D238CA579A03D7B2B81643B197CF0690567A1F63BE19E3EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\MBAMShim.dll
- Size 4.3MB
- SHA256 dcc714dd199d9768faa0ca212e63efe63caa8aeb4cb11487fa389ff59f6cf98d
- MD5 5be75744f4065e88aeda92344b999ada
- SHA1 48347bd7c99adf4e1c8407c0f56b2017ef8e5525
- SHA512 53cba40ed9450dc83c8fc6e522b567884c1a7b858f708930f164fb5eaafb4d6972625eeb35b7d5d01d754f7c7af7727ecf08efb37de6541ec637021fa06c6613
- SSDEEP 49152:+6s9rQzE4CYJQEw34L4lvXYsFFXBulqfCbLqmsc/6ZeFYpA8aIJammPsQzUOu+/x:rs9rVzYJGrsSCbvyg8aeTO/Z2JgH3
- TLSH T138267D17ABE801A8D87AC23885A78603E7B3BC16077097CF1A64557A1FB3BD15A3F714
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
- Size 4.1MB
- SHA256 a67f94a3014d93b9b91f0c8427c81cc18cb13239a114d91c51f993702e60a580
- MD5 88138b3ddd9b2800ea155743aa26fe87
- SHA1 0b45bd01e388bf4821a3caa09e78033588f66667
- SHA512 4f2f2f04c1b3c1d55731d7dc55fa3ee09385b8f77084e79ebde5252242008eb3362beb9b50b3ea8934acc471dcef67763f20d5268f6cb18bfb98926e4189c3b3
- SSDEEP 49152:0JxO5tmuSoHE4RtMMoLPqf/nkMq1BmwlxMOqSv6bi36i6X43jtPQ6zU+5pAqIPIS:8Y5tY4RMk6lxMObN6/tbH
- TLSH T188168D57A7A901E8D8A6C23CC4678603E7B2BC151770A7CF0664627A1FB3AD25F3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnel_mbtun.dll
- Size 4.2MB
- SHA256 0b764892f7f32d385684411e647f69f428067180aa28315d71668d3ab25b335e
- MD5 ca4f7f1ffd364bdb46dbbb8bd1319125
- SHA1 a2d8a1a3401a93da3303376e37e6ae36e08c693d
- SHA512 522a23be06d466db16e9abe89897e8562ef1fab483285c37c5ff43468e084a91ea78892ea9225c2da589e440e84034d23b0236af99182ed6d1eb118b4e0dc273
- SSDEEP 49152:lBPD6Io8w4LcTwEDRzTJoeM9YSxjQ5g+o9h6iO0oFjn2Q1Z0NwEIx6:PDG8VQkgRzSeMfn+ofU1M
- TLSH T1C8164B02F8B205B9F2BEF131C9A963217A31749503327B871F9195692A66FE47E3D313
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\MWACControllerImpl.dll
- Size 7.6MB
- SHA256 de1f0248c81a86c1498ec703d90c2b7edb7d863b39380ff21c1f19d3edbe7075
- MD5 1b3efbe4501e3fb33790e3594db8928e
- SHA1 70dbb4c7902a4686c77e3bc13d17f237e4eed953
- SHA512 902edcc5f6e8b60cc7d3f0c7a3c209aeac8c167d34c681e1b37e0859fb261d5a8c3e4ffb2d41549a0a6f1b6df6a157b1e78830a1f758497f654688aa1911e84c
- SSDEEP 98304:nNE9vvaDfzdXtRIteX3Dai+NtqcMQL6hO8lwwrx:nexCDfzPRIteX3D1+Ntqc5x8lzN
- TLSH T1E0866B1AE7B940E4D8B6C23C9967A617FA72BC19833067CF0654975A0F73BE0963E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\MwacLib.dll
- Size 6.4MB
- SHA256 b7bd08efeb605825a6fbddfb86f467017d015c39b498b1abadce3a1c2b9aec77
- MD5 d8edbe0741a24661d2f6725d2f327ec5
- SHA1 7b567a8dde4a5f04c51b9765a17a42fd84876a8a
- SHA512 e8afa10b5834b52e0e1c38dcf82aa5c0bea2738dbf01d7ee0c2d1630490f297d5133fab9f22bb1ad662af5128ff8b342d266be3689d59d8c4aca62b9443ac92f
- SSDEEP 98304:NpB7Kgxzgp+hagqZ9JhJ4uvIONMdCWVp+w/:FKgxzgp+QgIJhGuvIO+dCU
- TLSH T11C668C1AB6E400A9C8B6E238CA678213EBF2F855173197CF0664967E1F73BD0563E744
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\PoliciesControllerImpl.dll
- Size 6.1MB
- SHA256 cd1e8f98551fb69d3d47837c09fea35be358dd7c27104afb7f1938a7fadbb2c5
- MD5 436a5828103f6874dda5ca0b32e8e8ec
- SHA1 7a5346221f40349881a65df91014114b1644c8f8
- SHA512 a4ce868855d83ad112b528a4969e5a5f79a115eb92f9e3ef1f05eb09f7f39c099abb162bbf2024b298af715560d81d9f08c2457109d7b2b33c04dff9789dbd05
- SSDEEP 98304:at69nEVAZKwY4Lka7NrGWeG0qwtEQ9VsAwbB:aAnEVmKv4Lka7NrGWJ0qwtP749
- TLSH T1C8569D1BA6E800A8D8B6D13CCA978513E7B2BC15177197CF06A4967A1F73BE05B3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\RTPControllerImpl.dll
- Size 6.4MB
- SHA256 905e6da13fed3e931eb9180aa50b6f2058da73ec7e8c9735a6e03730de3f317c
- MD5 2abbbd7e5d16e3c4f8f28ebee148baf7
- SHA1 b414cc1f22b4dcfe70a0057cc6dfdf04ca587f7c
- SHA512 2ba3e909ca19272114821c891b2a9fae3ae6ce29138e8daac7c319532a5a8878a5f810560f469eb613ca119ba3bd0bf8e5cc75afa3e11477f17664e4a7714866
- SSDEEP 49152:itLx7V0PZw2Pdap9fNt4htJsg+6Q8OmITjRCqVZ5PIE5FGAhZ2NPh+xOtW3BbNba:soycr0bf5FGsEYFNbMGsdBiiI4rM8j
- TLSH T137669D16B7E400A8D4B6D238CA678513DBB2BC554731DBDF06A0966E1F73BE0963EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\SPControllerImpl.dll
- Size 4.5MB
- SHA256 6563c8273b0285bb2db5df55c8a707b76ed9215739b78ea4e2f954ee1025ef12
- MD5 efaf9a951675b1d23cf37e6f0cb9a02b
- SHA1 ec1edd6046df2d78f26a708db865c16065bc5021
- SHA512 9a43c424313d610c9bc133bb35d7ed3b7bf424c66b8820483a103aa41d3628fb609c26d5ab1399f7b6bb43ae962b03307cc32fb5a5a4d434934b5be0bf98c793
- SSDEEP 49152:JRNwUFTWIls1ThDYENU+QTRzmKVuPSfgSdBF5Mufa3j9LIJv24rBPZROnwPi5zUR:XlQBFQT8v6GufOJVuBPzyKR
- TLSH T1B1268D17AAE801ACD876D23C89AB8603D7B2BC61437097CF0674567A1FB3BE1563E714
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\ScanControllerImpl.dll
- Size 6.9MB
- SHA256 c247fc5913cdd73b37f6619b5e2019831635cac2786997e6e98965690b87d076
- MD5 831f51a590742a2bbe1e55ae7fa9e760
- SHA1 a2b2dd8bb930d9f0a975be3fa57cfd0cc4b1c067
- SHA512 0c56f1630e7a806f6a1383536f11b1496f23901b3eb2d96a63fe5cd3fae1d5c0de3ccaf637ad99074611e115d0911059fc0b5428e687a4f252766772d17b9d41
- SSDEEP 98304:+dhoYDGql6cTC+8ngEZsxKGNSRLzoxXlS4qbVO3yuxtq18DSyWgavm+6:+dhoYDU7VOiuxtq18DJWNm+6
- TLSH T1EF768E1662E401A8D4B7D238CAA78113DB73BC554731D7DF06A0966E1F73BE09A3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\SelfProtectionSdk.dll
- Size 4.6MB
- SHA256 09b8ea52a6950390fa1f96720f0c7b4c527631b24d27466e5f9e5952701dbc0b
- MD5 9466bdc77270fafe1849911257d1b2f9
- SHA1 4b6f98d87da1b31cb788f202617f567e200473cb
- SHA512 de9d02a89e20fde5777bc591c647871689cd9f0ed07d5aa3b483accac897eeef536ebc56d732349c0ce6eea233e117fbcf131e83877d66281424772aa8b4a7cc
- SSDEEP 49152:VvVNraNCw9Vjvu1DPcFFiIju4Bn241fvX9MDwKDKGMsWOVRtPGWzU03LcZdkZH4e:Bw9UqIivGDcsWoO5xZdkU+3
- TLSH T1AD268D17A6E601A8D876C23889B78603E7B2BC1147709BCF0A6496792FB3BD1573F714
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\SelfProtectionShim.dll
- Size 4.0MB
- SHA256 ccb4ce36aa0887ed1017abd15b1019f31a8fe2c1afc55a6a063d94142d7483c2
- MD5 d1d035f3ad7cc27a29e0e80186571c4b
- SHA1 37a42f712a8e847f8d575613b47962c0f3c28f3a
- SHA512 f37523a83d0a41ef128b8d731599e26be3dfdb868c6e0f9068e5318f038cd59d72700beab772814d4d2ebc69657d3173bd3c596461473a25cfe9b10306733e82
- SSDEEP 49152:8EWWy/r6DbXWDWVZ76nXsLLeLWRBKI8GUfdgTyQWVp1CLrNSJPCqwzUyLWm:3fXWsDY3dgTWC3dSNm
- TLSH T17F168D17B7E841B8D866C23D85638603E7B2BC2107709BCF16A466791FB3BE2563E714
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.json
- Size 621B
- SHA256 4d70440d7da4d5ffe55ac802cc593e602771707aea3859c12cd93feb9df813a1
- MD5 c9aa9835054051ccf9bf3b2b15fead9e
- SHA1 e21075ea1e03e5d587eb49ec61344bae50aefce4
- SHA512 77613ffc6f4a86916c8d59c39772e4da0ece97bf8c35891bf21c3ae8ef75daa45f3a9b0d11499b8903823913e8938b60433142aaae84e2ed78e9ef2c3ab6dc4b
- TLSH T10EF0AC12A95F41FB15B40AC896A40983FB34838E02045E0FBBF4F5A4DEF6C2896D3C85
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\Swissarmy.dll
- Size 5.3MB
- SHA256 9ad52208d95d536dd1dd77c9bd118c7ab0fffc795a4f0875fa608544d30bb931
- MD5 60d217257971f73714b8c5e398d461dc
- SHA1 9906053f88d7a409e8ba874aa9f66e5ead73c961
- SHA512 8eb3304e904af5847c6b2cab99d1d3690b5b239fbe85467d164ed29a714f029ec163f467a7bebcc80e156e0d291436306145a2ae68766613f5a6b30f316b0250
- SSDEEP 49152:5LG8qKNFeojCOg33h8pRdPSDIGRmqiZBmdWZyKYbHkEAoXvEPj8QF9yllBpP9aze:Zfex8pCIQbWZ0kd8xTdNhIcPz
- TLSH T1E3469D17A6D500ADD8B7C278C99B8603D7B3B81553319BCF1A64522A2FB3BE2573E701
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\SwissarmyShim.dll
- Size 3.8MB
- SHA256 7b7bef24ae682aed60edf136ef817d60b7b1a02e3ad3f86c7b820cc502e4edce
- MD5 07a16e004bdc32df788c0f7144526105
- SHA1 de6cb075bc813f25aea014eba71b1127299da2e5
- SHA512 c0f2db7f9dc6b7e5575f4a7b5b5d60aa032777e3a9994b534651317326e4ae6721527422d9001fac8cf4280fc7876dd8e1f321a7ee65e3394417982b0373687f
- SSDEEP 49152:s5AWJyZyVe6ZGVE96H+KLNjU1BWIaDLwOx/AJJKFS7JkC3zly0IPLRzUgT9dmR:bUemgTTwOCJJRDqyg3
- TLSH T100067B17E79940A8CCAAC23C85978607D7B2BC127770A7CF16B466691FB3BE1123E714
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\TelemetryControllerImpl.dll
- Size 7.3MB
- SHA256 d783c0ae649b6d267c330c3c9d613d4c5ab09bf1f594598484da1760f0b16e4b
- MD5 7a1b3a54f39392375078dac7b2822ad1
- SHA1 7008531c23e7f266e9a94b20bf98f8038aca5562
- SHA512 518aa3b5060ee69f6d46cdc0ff5142109a1129b7b3481243a2291114ac436b2235d0bd6498a527a25686cf6901bfc3cdd2f5caa7d319e794eb587fa03b55d759
- SSDEEP 98304:MJrBHlha0hhvIzoMzMk/Tm78Wi6bPtBrtkXb4:MJNDa0hhvtMzMk/TmQW5bPtB5Wb4
- TLSH T147769E5AB6A400E8D4B6D23CDA578513D7B3B8254331D7EF06A096791F73BE09A3EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\UpdateControllerImpl.dll
- Size 4.5MB
- SHA256 058befee7a55f5d8510de91f4746053fd49393f2f1843c4f090c3dae60d7d540
- MD5 150ce3c5de43955af87ef53f51c1c866
- SHA1 43cbf73c227e208bd2f601c91a27d58962f08e51
- SHA512 20855a4289f8985ffa840d00819efeb2d2f076fff7507f695cf1a3f6927a7b48cd85285e62ca8d25cd4d2593b00b6614c5bc88677cfb8b933f8138b09a9b48ee
- SSDEEP 49152:lzY8o3OtUDkkGEVl0QFxd/X6LCzqlXB9eC24aeZSRBFZ24uFpei6tyP/ZNZoyP++:2en6yQIV2ZOFoxtFlwGYT
- TLSH T19C269E17AAE900F8D8B6D27CC9A78917D7B3B8150371DBCF169082691F637E05A3B724
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\VPNControllerImpl.dll
- Size 3.5MB
- SHA256 9b2b33a5c58a3e95423f5f3cf4d0c53b27ae4a399c72de90aaebb6b6e000b17a
- MD5 93bc933c0188b182424b8ab87fc7e635
- SHA1 783d97877ad1344a49e4c61f7c65f2c9ee2be63a
- SHA512 3fabebe19ba4d28ef2eda395c2c8c0f256a89959d215529b7226162a940d3ae75edea78083f1f614205da5915d3bdb5c8bcbdea80479180e9a9ab81916bd8215
- SSDEEP 49152:lUh1BFqcsDLEh7i2Tlu1fVPicc27eYv3OhJBwzn5QOZFFRPtdPSnZnZwCAMxM:YvKRziO5nwnZGCAMxM
- TLSH T1C5F59D1763E600F5D8B6C23889AB8517DBB3B8150371DBDF0AB096691F737E0563AB24
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\arwlib.dll
- Size 7.2MB
- SHA256 acc5508787ed40d3fd48c9428d3cbdb23ef9540ba4e9bcafc1e3c25e30fef526
- MD5 683b857fdf1cf176997065b2e6178347
- SHA1 827f731e94314636a4809280bffbf9f380a8c669
- SHA512 15e0a79690a7c100c6f582742756b85ca3e2ce1e8101b7867a06bd3c5064aa77a5ce8b8d1ba70ef47ea1f70b754c933f513690d4c874f191c25fbdd7ddbe643a
- SSDEEP 98304:Qp5FvnA5WTmewOgWWNtkSVdQhm4mT7gHjBsCBZyVNPaX7:mvA5HfObgkSVd0m4mTE1BZWy7
- TLSH T167769E16A2E800B9D8B6D238C9678513E7B3BC561331D7CF06A0966A1F73BE1573E724
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\ig.exe
- Size 1.8MB
- SHA256 f0a1eb806f31c9aaacb91b61816ebbd5e13d93e5653b1bfe2dff71159582bb30
- MD5 4ddf3a45147ba6ba9b0a1de6af00153d
- SHA1 9f26cf5b581adb01648dafc49eef4bfc06d4cba8
- SHA512 ea3bf7e8c5d4fd4f02a3a187b6f0890d5ec4aea3d90c40b12f0624516f25525c12db32db4406919fbfc42ca21e1737be19bdfa792becb9c8d5067f943dd3c9fc
- SSDEEP 24576:2upw8j0kcU71dHGvPKN8kP95bLS0pBm2L6y1szQGfthuTVHzw8mvk1u:2Q0kcOnk88kPt7+zQFZw8mvk1u
- TLSH T17C95D820BAB6414FDB9916B82EBCAF9D22AC69490B6059C3738C975D0CF11D344FB376
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\mbae-api-na.dll
- Size 723KB
- SHA256 6aee09c65a2f22658a8a74459df2b9df5c81c5ec7d853e496794ef6f52ed8924
- MD5 53d9f6d408d43a8b9f080b87ac0df146
- SHA1 1e6c7befb2c68efc87508c705cf72427cdf45370
- SHA512 b4db12bf61ddcf16ff14ea245865b2aa0d71efba17fcfd36d64d47707f6f497170f19235dc8bf69e3961d8072743f27cdc343f228f331d6f27c41ea07be11b7d
- SSDEEP 12288:LFvU1Pr3pBWtftHAmoLdkm9c5Wn2VqK/Zny2E3vFn+hPraFnPFN:ZvUtKtJAmsdjc50iHoZ7
- TLSH T14BF40819A3AD02A8EA77C536B663A223FF7334541B70BE8B5E108E395F31760963C751
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\mbcut.dll
- Size 4.2MB
- SHA256 cc9b2f7379351f5cb246fcab1823962716c3b90dce252292f3c7fabf718a0c23
- MD5 e10fde737021eab76462e4f0fcd6548d
- SHA1 e24fad860352bedd64aabced856404ab09ca94ab
- SHA512 333ae97d9238d925e6fc3dd254d93f3a90dcd7a694e3a8487b20d257e9371070641d576970a17a27dab4f97780039f1867d90dc80365318a7ccb1fe0b196edc9
- SSDEEP 49152:LsIdWtjIxvFfomKYsEwpmUeT0MSD1TX8jmxB5sVvXsuY2AYuSHyp4DZePe1zU/6n:LsWGqfrKYepmnIvqvXTAKWydzkT0d
- TLSH T153167C17ABA501A8D8BAC23885778603D7B2BC1147709BCF16A0667A1FB3BE1573F714
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll
- Size 3.1MB
- SHA256 8af36217efcc1b2a677accc77839ed3b67ddbfcabfa16caaa42c7e95796b940a
- MD5 d82467d25954c9fbaa91ca97e0de6834
- SHA1 d7da2b4f83acd0d2aaf55de2ae403fa6cc44bfc6
- SHA512 84a38b2d4a1b23439f4c6eca1fc148d618effd1444704f37e5812488877d15789b603944231281299ba332dbd0d3a0e51160c588c0adc1bf338675c62da45aa4
- SSDEEP 49152:zHsR0cmbmDszn14AcKLfC659mLVD+Bjmo+2g5rCdPWD8i51l3z:zHBpmj2Am0D8g3
- TLSH T169E54A227A9540ECF866A23864FB8502F6F27A05236097CB0558727D1EEB7F106BF7D4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\mbtun.dll
- Size 2.8MB
- SHA256 f21a980316bd4c57c70e00840ab76d9ad412092d7d2d6a2cff4f1311f7c05364
- MD5 2bbf63f1dab335f5caf431dbd4f38494
- SHA1 90f1d818ac8a4881bf770c1ff474f35cdaa4fcd0
- SHA512 ebb9834323329dc01ba2c87e5fad1083a4cb86f5ed761cb63299ac5336a9843a1aadd42fbed706797c2295117af1c00f96806422338352653c8e0255fecc2fd5
- SSDEEP 49152:xNrdEZjzdAj9fdc4fDrN1OxOh5PgqdnBq30yPFZP7KVxSL:bBzFRkshaZP2W
- TLSH T136D58C1AA7A800A8EEB6C27CC6578603D7F2B8151771ABDF02A456791F73BE1173E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\mbtun\mbtun.inf
- Size 1KB
- SHA256 4a350fc20834a579c5a58352b7a3aa02a454abbbd9eecd3cd6d2a14864a49cd8
- MD5 5d1917024b228efbeab3c696e663873e
- SHA1 cec5e88c2481d323ec366c18024d61a117f01b21
- SHA512 14b345f03284b8c1d97219e3dd1a3910c1e453f93f51753f417e643f50922e55c0e23aab1d437300e6c196c7017d7b7538de4850df74b3599e90f3941b40ab4a
- TLSH T1CB4140BD48D20AB83C673356671B69C27BDC220145C920ADB2DE8606C88EDDCB905EB9
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\offreg.dll
- Size 140KB
- SHA256 8e6c155a97666c8e6a3f9ea95bfc6f6e4f87beac53dd72164aba3ef33ff88db1
- MD5 1659738d57a15a0983f0373b2faaef45
- SHA1 efd4cd05ff6bd787a2ceabfd11daba1c0e475855
- SHA512 4f62cfe0579e1aeeeb30edd5f42a2b1880446dd1075be051e2e0189da5071f9866e5425ff85547486fd7d952a28efa4e784db0cfdc1fcc428b34eaa89c6a7654
- SSDEEP 1536:kXNnhdTcQOCr7LClg5lSYOurIt/0q9mrf0Xp2N7RibuQusR9YfIZRoU:cnXTcQ57LClMlSYA0q9mrf0XoNHFQZ3
- TLSH T111E39D5A73B420A6E8678678C569875BE776B162232087DF12E5C6B80F037CA7F3C345
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\pkgvers.dat
- Size 78B
- SHA256 c64b4d7f64fe42d50d5eafc496f95daa86408c74b7aefad4674cb9d9692c8b2f
- MD5 063c144f883ca2984292b4cd947dde8e
- SHA1 940b914d6ea449eb4bf22277784fa436e8a0218c
- SHA512 197e04eafede07a774e2269e6a717291653a5dc212302a8de9957daed8554b3d3d44c25100a2723c1ae7471448a3a56c387c28b5cd46d6897a274b716b1bbc4c
- TLSH T13CA02230800C03C00F3EFAF2A2F2CA20B00BFC282B002F0822C00232030B030238C2AB
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\farflt11.cat
- Size 10KB
- SHA256 8b19e3ad46d594e099eded7fdb784c48a98d620675982204bc7250c471f1719f
- MD5 6b69e2855dcad56e24e9aa9034f53ced
- SHA1 10406666207ff26b36556a730b6fdcfbfac9c433
- SHA512 b862faaa395eb0c22960d6a760c40b52ca973c5268247b53faf5d47bb14591bb098de3a42570dd211996ebc096963de2b516be36d47710bacd2cb8121cb4e956
- SSDEEP 192:VAd3dxdJdfWyh4JCWW7/lyKFFWQFml2MAAUYX01k9z3AIyhZ1jrAhCUCk:VAN7jf2RiZFR9MgYR9zH8Kck
- TLSH T1983229F6866C81C2EDA76CB007A8E4472C3D2BC71D50846961DBF6A80D937C5F71806F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\farflt11.inf
- Size 3KB
- SHA256 142f7bef5d7c91cc29537e423e4c10fc409b085adc66b75552252bb5c7b38697
- MD5 9924a26e2fb32c82e9683a01d65d4a78
- SHA1 f707880f584131c0f69fdbf1dda753c88cb75125
- SHA512 600665fcc54d8b76f2e9b059bfe7e4f7f1c3b4e2e635c8f97eee4a34b478485312998e42db4dadfb221eaba817082283b7b7be5938557fe24339302177e353bc
- TLSH T17951019463978574AECB31A45F077807B6253480A1F5395832DD84D8C389A2E5AF87BF
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\farflt11.sys
- Size 211KB
- SHA256 deab1165f6147404947248c5a7ad0a6be37a8b7dea3d764ce7c79ab871f9d940
- MD5 9be4d4d729f0cea7bee139aef06c71a9
- SHA1 921b6a7d0f0915124cc3f02567a9bb6d590cd992
- SHA512 06f2568bdc848286135cde4da3992fe14176acd6c0a2d7f3745442e7be53c82831dd4cea4533340a476b5e35d8077848d6c31dae18fc1b0cecfa0a9f65bea532
- SSDEEP 6144:P89UhuhYRI62VGdXyzLOUL2bFY8UKi5aJ:UOTI62VGdizLOULr5s
- TLSH T146248D5662E41CF5F877C6B5C662C103D7B3784A1721EACF027086661F6B7E0BA39319
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.cat
- Size 11KB
- SHA256 45bfd887f1969f364ecca95f32a46354bb463864a697d631a14082eb213aa04a
- MD5 c553d878f2fe661a2408224c80178b7e
- SHA1 3c2f6515b04ee0af02b43920827d9830cf94b558
- SHA512 8a8cc31eede18ea4e169420a5c4e86388155a6f3e8000b981f9ff14c56cf6ea43ff0ad6a20d960a692dc70de6ee683541be8129fea326481384c17376bf04b3c
- SSDEEP 192:IgFgUgr1gZQWy+JCWW7/lyKFFWQFsW3pA1wki+X01k9z3APhAdE:meQqRiZFRDki+R9zGhA+
- TLSH T16D3229E5862C96C2E9A7ACB043E4F5673C3D67CB4C4084A922E7F7640D937CAE71406E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.inf
- Size 3KB
- SHA256 47b7c516bb57c612de19f0ca865590af95b6e32bf873a0fef9e011b2c5b483d4
- MD5 5a9717e1385703e8f06b27aa10a69e87
- SHA1 84ee67a9167b5eb6560711b9871de98898ad07a5
- SHA512 dd3c7278c2c11ad15a55fae6d19b96dadd92f85b7f0c8ce934298258af00bb5c052a84a98499b8867b0f43704fb307c67d03692ca69dda4d814c6c17dd73df44
- TLSH T1B95121A4AB93C570A68BB5526F033403F11538A0E0E97554B2DD81D9D389A4E26B4BBA
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_e5d2ba9086cf11f1b8ee5a8b93556056\7z.dll
- Size 1.6MB
- SHA256 bb01c6fbb29590d6d144a9038c2a7736d6925a6dbd31889538af033e03e4f5fa
- MD5 3430e2544637cebf8ba1f509ed5a27b1
- SHA1 7e5bd7af223436081601413fb501b8bd20b67a1e
- SHA512 91c4eb3d341a8b30594ee4c08a638c3fb7f3a05248b459bcf07ca9f4c2a185959313a68741bdcec1d76014009875fa7cbfa47217fb45d57df3b9b1c580bc889d
- SSDEEP 24576:29raURTF/5pe2g5RpBDxSjv9IrqLwRpFEDbt7y0MVoAAlziG3B:29hP/5petvSjWZR8DxO0mo5MG3B
- TLSH T175756D5BF67400A4D5D6C034C5276B1BEAB1B88B8330A6EF12D15E6B6F13BF19979320
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_e5d2ba9086cf11f1b8ee5a8b93556056\ctlrpkg\MBAMService.exe
- Size 11.0MB
- SHA256 fd7a1428221fe7de747930cb3d9f2991610e2b1d809a0abc1f26590db5f5986c
- MD5 bb079cbeb5948a894358ac3c5586d990
- SHA1 777c05ca055c938d3352e758d835d33896807a23
- SHA512 692ac8284d78c69b06dfdd7e4b6ecd0380e7198d587c48655d4d2204957e7968209e5aba6fd06ab150823998bdb74446a7f168fb9240f2f1aba0f5a38c39abcd
- SSDEEP 98304:RA64Z/iUYtDJODZi1EZnnsc8tUFswknM94BJ:C64dSJODZi1EZnsc82FZyM94BJ
- TLSH T126C6E606A7F951D8F5BAD674AD7B652AEE32BC618B3093CF1150560B0F32ED48E38721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_e5d2ba9086cf11f1b8ee5a8b93556056\ctlrpkg\MBAMWsc.exe
- Size 4.2MB
- SHA256 7878a9b10903b8c0def49015deefd48a3ea0e46c0f5ac9ae755336994e020152
- MD5 acbb82943fe0d5f1c5df74b1a7dccd2f
- SHA1 c41e38f59eff5e40a6a47b14be44520dcd6d405a
- SHA512 7092748502f06bf05df19bd2d4d5857f161a35a9b2e3a72645eaacffacae7a8dad10ab41ad3b80d3a63ff0773b6c818edf3769ce6b1f61b01cc92edfb755dfc5
- SSDEEP 49152:dK5b4+V1qsR86LMFRbbX8DREqUaP7bBfnuF0JRlnPkokPmsBLdS4BPQRzU/81fge:i86kyaHF0JRlMhBpMyok3M
- TLSH T1C6166B06B6A540ECD866C239A47A8503E7F2B811273097CF066853761FF7AD21EBE7D4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_e5d2ba9086cf11f1b8ee5a8b93556056\ctlrpkg\Malwarebytes_Assistant.runtimeconfig.json
- Size 615B
- SHA256 61fca252e8e336706f4c153c16100b7b621f9092ed09bb6959e406ab5bb21e85
- MD5 389f208d959c5ff4ee9c0e4dbbc31ecc
- SHA1 32243920d3687a1b8af307a3ae140103ec08f222
- SHA512 86dce7141f4fe9fd938f8b5be78d9e9d9885365d7ea7d4d3cb0674ea63a9201f4f0e02ceef47819b9d596a2e397fa68c78e9dfd15acf804ff93fca0f55b1997b
- TLSH T1C5F08B29CA106CB718B8337ED125C083EA30133B10002C56B4FC080C7F775B62221F96
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_e5d2ba9086cf11f1b8ee5a8b93556056\ctlrpkg\mbae.sys
- Size 155KB
- SHA256 c990dd89b65d35d6c9b34e21c78d96e206ec3bcdd934716ee61ff79da0fa5251
- MD5 fc98ddab2223dc73b950622801b31554
- SHA1 997faaec1dfd18b9dd31e1c216440a28bc4cd612
- SHA512 da08860f8c3d8a9204d1480f33d21f2ab922db5cbbf7734527ed05477c2d9c184deaedb63196876c989c9ff6c1b45b5792661f5bce92212992a7cdb664a793e3
- SSDEEP 3072:hcj/Hk4/53QBvOP8JsUrLx1o6GwzfwKYdkXEnU/H0KBJT2:hc4wNQBvOEJvx1o6GwzfwZqEU/33C
- TLSH T1D3F36C52F3B400F5D8A6C679DB669213E6B2780D2721E7CF076085252F673E4BB39326
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_e5d2ba9086cf11f1b8ee5a8b93556056\ctlrpkg\mbamelam.cat
- Size 11KB
- SHA256 64416d564725416c6869ea951878a2734b1f6940b11f7961a897c45f0d8c6625
- MD5 bd4ceae54af081d6b1dd91ff584c5d61
- SHA1 5ade462d66e042da58bb1447d1b31f1aad901b68
- SHA512 37e7abd312f694ee2c8ea54ecf50ed12c16684f1007c61d9a6d1d01cba958be511c5e4e11cd7393a5cd57349fda1c552bebca42962137e0d11695c195761ebb0
- SSDEEP 192:oBxybp/yRpJCSEbhLxyKR/2FWQFdbiI/Ex6RMySX01k9z3AgEhrZg:oLp+eFRvmoMR9zJug
- TLSH T11A320AE58A6C5083DCA7AC6087E8E5D77C3D67C71D00987921DAFB5409933CAFB2816D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_e5d2ba9086cf11f1b8ee5a8b93556056\ctlrpkg\mbamelam.inf
- Size 2KB
- SHA256 e26c2d3347e5f077da92713c9df3cd3eae438fb7e29810bd5c3afe567d2d3125
- MD5 5d8c05cc4f9b4304d57ea10b87f2dcf0
- SHA1 2cabe3d39aa5ec16c54c7818284a2ee235d2ddbd
- SHA512 55bff23fee9852f229246b71721b3659c916079787935d400a97641449dfda752fc8fbf36f9ea3dc4028f05daeb9006a99660284a61aa5d5a466af0ee966c738
- TLSH T164410454AA538BB8697B35B81E472883BF5412205076384032DEC8C99B6DF0C93757AB
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_e5d2ba9086cf11f1b8ee5a8b93556056\ctlrpkg\mbamelam.sys
- Size 21KB
- SHA256 ded569e249e590314d095f740c6b8934a5a797e4f3edbe0f78eac9d333f12a2a
- MD5 8da81aa1f6b89ce1d2e216e3ea351c59
- SHA1 4baf79cbade9a5584630a540e6368d547579fb12
- SHA512 6d611bbd9d480ef2defd745fd06c4ab86e181267cf689d9d0e124edbaf22fd30fbe2310879cc7bb6dde5bae72c4feea1d329cdecfbf101d95634f85dd0769119
- SSDEEP 192:C7IlO/ZnEc+PbYv6/i0RtPH920QvVUKjnegqdsW++w/y1wVWQ4uW/+O68RwX01kd:wIlO/i8ChLIxUKjnev6+Twc69R9zING
- TLSH T108A23B6549780283F6BBC570C7E4C927BD38F39677408AEB0591E5681DA37C2AB3192D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_e5d2ba9086cf11f1b8ee5a8b93556056\ctlrpkg\srvversion.dat
- Size 9B
- SHA256 4f219d88cedb3ca1815ffcbe61703548e5e4b7dc2732ded5a3836dad942e2e7a
- MD5 9c97986ae0ad5a6a7fa161b4fb594fa0
- SHA1 d98b622b45fd8de7d86791d9c53de9c459715dd7
- SHA512 62b3275de8bcefa81248dda5065ce278f848c79212dc6b4a7feaa680772da3876f3525a4016aca2fbb6b39363dcd8e056444e552c2613457e06875b741e92cd5
- MD5 SHA1 SHA512
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_e5d2ba9086cf11f1b8ee5a8b93556056\dbclspkg\MBAMCoreV5.dll
- Size 8.7MB
- SHA256 b226e4e93acba45a3e6c0ee06d6fa1c62fac91ae37c86595ab395088ab9edbc4
- MD5 1ab568867f09d24d997c993e185c4f08
- SHA1 bd97a322c4736f420c54c7ecec02e8bb1d764fa2
- SHA512 1c4d688a1897019428c8c7fa2dfc3368f6f7e3e1cfa55c915562a0630e70d5ad9ea2b36a4483f1b94118db32e5da85722a1524d52a5aa781933d583678e4f448
- SSDEEP 98304:9lZ2y5IWilAVOyU7mhNl/DP3RtFJe92YiGNwmdQk:9iy55ilAEj8Nl/DP3rFk9iGNwmdQk
- TLSH T192967B2BA7A400AFD87AD37889EB4502F672B811537397CF16A8A1761F637D09E3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_e5d2ba9086cf11f1b8ee5a8b93556056\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\10.0.8\.version
- Size 50B
- SHA256 42559a4970a981aa61f3ed59ad44d05214fcc5eb97c35d06a88102a0b747a45f
- MD5 9072ad106b74f3900d25ae80843c8a24
- SHA1 b664a23dea5a5591c21fe0f4a9b5f344079d94d1
- SHA512 ea866258bbcccc0951f95367f3309db65d437ad27eb6fcbdfe12e08b9f76265050d6216091b89f0dc92db66b24f8238c8d6cc98ce49e6c3bb6b051ee037e56a2
- TLSH T1309004444445D47315D3313453015154F00C5D3C5D34CC11D05F707CC4D705CC55C301
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json
- Size 47KB
- SHA256 53fdf28fbf12e6730976c0d9088a54da2340a142123d0f7c11567580d0db9565
- MD5 754367c68d3e145bff4c37cd6da967f2
- SHA1 493b023984b0aa03b444f0daede9c4ce7e816128
- SHA512 d9b81a8fdcb2734bb5c6c679e9d6af3bc88e00960c23710b8ae68a7b19794043558360d9d1aadf4aa9443c650e5ac121aacb905a05a94bbbb5141db3702822a0
- SSDEEP 384:CTriPalGB5AWiWq2mhzJUVVqxKS3xV2CjNrBa7gHOykEaf:CqUAHiWqn1UVVqx9U7gYEaf
- TLSH T13A2382BBD9DC0D1B99712294A9B94607FB20036F10980C17BDBEA98DCFB751394C6F1A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json
- Size 66KB
- SHA256 02c1700e51352f02fa0c207890c818cf3e7d7da68d4853c0595a8c2222bdbd52
- MD5 c9f0ab23a0ff325a55e34914454efec4
- SHA1 b4bdfc9a4644659fc6c1803c31c6ed5909c89bd9
- SHA512 a3e9ac9abc9eb8ec1e9e7b906e7fe2614ec9db805019d47fcc2a94abb9297ffe5fd70d30bfbdede7fa97e0cb2600f0a2864e99be5deb062e7bbf5ec06050639c
- SSDEEP 384:9r1PalGB5AWiWq2mhzJUVVqxKS3xV2CjNrBa7gHOykEajctcxPad:PUAHiWqn1UVVqx9U7gYEaIKod
- TLSH T19163FB76D8DC4D5B857123A4AAB94603FB50036F51880C07BEBDEA8CCFB781295C6F1A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\ArwControllerConfig.json
- Size 1KB
- SHA256 3cc8d7609a3e62aa6925b103485c0294960ae5278a6313abbb2d63aaf0c33c07
- MD5 16e44721260829a20246f2b4a80733f0
- SHA1 4fe0cff3022840ff8ed614b37727b8fbd7471a34
- SHA512 63d6ee8afd74fd626ed17aff745ec7fda6f23fa1b43e013fdfdc2ba563909ae2e05e0b39d7949eab1d7c1155bf7c65b486553d488cd073e2258901348754ee3b
- TLSH T1F7212652862419FFA1FCA009E8949253CBA057652508083BF2FCF788ED3967267C6CD1
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json
- Size 12KB
- SHA256 652a79dee7e90cc4cca009ffc13a5c6c54fedb2f65349653ec30b0fc8fe1b8ed
- MD5 b9a6d128153d3de5758a2b8acb83223c
- SHA1 b068e5aeb4cd37fb150ae342a6955b6eb2d886e9
- SHA512 9f33820d8f259c60bc0d4d086402038df93c15eee1937985277ab285428279e3669ca61518982fbfaa179f106d28d46aaa2fe0ee2eb76495dc0e677ce552c451
- SSDEEP 192:+vmf/FYgVMzhrgHTb0MAJUKfVgH8BZ8ZUBPs:MmlYgVMzhrgHTb0MAJUKfVgH8BZ8ZUBE
- TLSH T13E425523D1759EBB66FD617661B40B82F364C75F08410C17797CC88C4F7BD2A62C2AA9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json
- Size 12KB
- SHA256 8c959c672b0ae5c60ba51f5a11f534a1211a2d84613bce5e063ed7b8ddc35637
- MD5 24c0dbb08f3cd3e16d611be61cfc3deb
- SHA1 8a7ee1e9e610fe92b14500c5e9c189d440e92a8d
- SHA512 e0e145ad0351d25dd76f55975308c3ef484dd0ff2d92044698be1fcd73707cd4b895e6436cc34245b9d59bc20e9c7f1ca64ffc0e0a8222b62a8a1ed787ff754f
- SSDEEP 192:a1mN/FYgVMzhrgHTb0MAJUKfVgH8BZ8ZUIPL:gmvYgVMzhrgHTb0MAJUKfVgH8BZ8ZUIz
- TLSH T114427626D175DEBB66FC613661B40B82F360C76F08410C07797CC88C4F7BD2A62C2AA9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json
- Size 12KB
- SHA256 bdafc03c201dbc16cc4231b25a1931b14fda156512f40037fc7157c5b151d3dd
- MD5 7283c6cc479b28b0e7d53bf65c65bf21
- SHA1 2fcee681dedf1e9d175e329be69034e1114f498b
- SHA512 f36341dfba37c94429290a3e0b9dc86c2871331fd71c10400628d18c872e26001dd68bfd7b35b64f674a70a9250c349db7873eba96728cc518b4562d9758f2f1
- SSDEEP 384:PCmvYgVMzhrgHTb0MAJUKfVgH8BZ8ZFez:KmvYgVMzhrgHTb0MAJUKfVgH8BZ8ZFez
- TLSH T1F1426626D175EEBB66FC623661B40B82F364C76F08405C07797CC48C4F7BD2A62C26A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\MwacControllerConfig.json
- Size 2KB
- SHA256 392912a07c864695a33ddf57cd2a967aa4249db6e4b3d9eaa739503183deb774
- MD5 9d1171c9bbf3c6c62938e153422bf90f
- SHA1 483fd9b87be0809ffcd83d7bf87d5b9842c19bb9
- SHA512 2781c47b5436f19e0351910461d24944d2b29b7fd47002e5026ba4426e7845f3ffed881d56e7cbd95f0c5821e7cb48adeb5f06a7082bf999242271ee63a5a949
- TLSH T1C5515A32D5A86CFF09F85266AC684252F650835F41580CA3BABCC57C4FB6C12210AF5F
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\PoliciesConfig.json
- Size 814B
- SHA256 0a6937230abf1bb306551af20c0f1bf005b0384c2d6025134c8c1e62d334e673
- MD5 2b567278137fc004374ae6357274cc7c
- SHA1 8852e1079bf65bb7b10a020045940d0b67c2694a
- SHA512 cb87503ec110c944ae6d27fc84d4285877964acaca019cb5fe10b806e8f8f862d5a1ca1f8895962e14308974032c6e7d10b51e074a2d44a1c1fc06a75e6cbeb3
- TLSH T1BA014766984084FE393C51688537D8C2F3A1871634191C2FF7F9EA0DEDB793B3082985
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\RtpConfig.json
- Size 2KB
- SHA256 940ac4c04c195c2f6463eca6e66a0e3035247264cd919e73a09152abb5880ace
- MD5 beb5e926b4eb84c47d40f6e9665a40b9
- SHA1 ebe9094c5b846b0a89321b87ba2e0d1f5afe3f3e
- SHA512 16f4ec0d95a93f9c815b2727a6325b0fbf39fd5a58fe6621ff0ce489089f608062c3e48c47575caa1c71037da447ded4a95ee1b003b4c461886ebe684e305341
- TLSH T166513521AF40A87D4C79C1199C7C518ADB245B61160A08BB32FEC83DCDBBA727BC1CC2
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json
- Size 5KB
- SHA256 dd5ff98551b431935a5760efd41d64a617995ff144a556ec3f895038cfe10a4f
- MD5 557a98e4de33fef14bc4eb3dbe2beb23
- SHA1 c7edaf36cfe5b6120bcf50e693c9d6dac2a378dd
- SHA512 16b74921c99c8d6dbfbf9aa59f3179acf586c2203515d5592fb2332145f5a870fb7a095fba04ed7e0295084f254b7c619b6cebde6547f9a5bbbad53faa9cf4bb
- SSDEEP 48:iQuT5JtUmVSfKuGQf92Es1kV8EHmduwbk8qXKeWQX92MEnAf3wsaA:iRZOfK5k9JykfHYNsXKBs9RsAf3wsaA
- TLSH T156C18C12D9105CFE18B8E25EDC288186EB2083972206186FB1FD865C5FB763336C6EE5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json
- Size 8KB
- SHA256 889facdfef059ee7139ff807a41eafac2a6b32679901b76f4209046b713268b5
- MD5 122749b33bc750c91212a078f9a6eea2
- SHA1 5fc27e468566e81653c449e95b2f14f1dd7bffd0
- SHA512 8d31f49d489587279749e11d306383f45fd3812b7ef92d9d0dba5d1bfb3581628d08108281c3e8f763d871a9d508605aa876685390ee0b8dd94caf904982fdb1
- SSDEEP 96:/NZOfK5k9JykfHYNsXKBs9RsaI+yEZXKBs9RdAf3wsaA:XOi59rNsaB2bZaB5gsR
- TLSH T110027D16D9105CFE18F8E25EDC288186EB20839762061C6FB5FD859C1FB76333686EE5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\SpConfigFile.json
- Size 12KB
- SHA256 32138da12051398a4b2ba83ba10f54463476742578a06cf9a4d98b53e6349022
- MD5 6d5756b2f0fa80a5460da476b832f9ae
- SHA1 47ef4854b13284a014cdf844ce3562c1bf299300
- SHA512 bb0a5b28d40204b55a189d405ae46b3925ccfeaa2699324f6e7ad432013d92cece7b91a8a5c0174a9077786a6e938616edd976ed4d45e8c62a7a155000e2bf33
- SSDEEP 384:258+xwb8fkY/sDY8t7SSdUCExUYS9oFfJ7MLPi5LnDjufzqoA+8xRj81offZJZtZ:2UXDK
- TLSH T17252161EE0A84867887726901F7A95A2E334526BC1435C6775FCB12CCFBB483C496F9E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json
- Size 1KB
- SHA256 587918745908752417e0cbac7c207c4ae7502d57c09210984ae9ecd38730c96c
- MD5 411d07886cd387be6e05de70eaa61502
- SHA1 837843f7e54f724c6d125bf693c6eb3fd0c70f46
- SHA512 f9d96d484406f91595b921842d9cb40ef3fc7ef57efdbc397e53880910ea2bd19f6782f65b8813552c5475d26070c95d93d6db8cd4815a2481310e1c9f10d7df
- TLSH T1A33126128A2845FF28FCD284C9B84717E7A0531B21161C1FFAF8DA58DD3707237E1A99
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json
- Size 1KB
- SHA256 9f59e79a7c33985429f817106104537aa185d7764583862ee8ed846806aa58e6
- MD5 976e2b03d1688680f8de4b7d9eab14a3
- SHA1 19d91eb9ce32ec4985aba6c096365ee4390dcacb
- SHA512 8a7af4aa6446dd4da9010bb0cb03cf8c312ac00a497225c981d477eae1998fa2416ce1d86f8b8a5f4a107c3dae1ad12c681d842e8981c18837e0138e056db544
- TLSH T1623125124A2845BF28FCD294D9B84707EAA0531B111A1C2FBAFCDE58CF7707237E1A49
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json
- Size 1KB
- SHA256 199ceebe13f24d772095adc958c867a67c03ae35f32897d2458c506fad37286c
- MD5 a439c25a31f3f81fd7e2a208ea33b7ae
- SHA1 4ce482956fc85ddf302e147d13b1df8f5c3608fc
- SHA512 7efb483923fb80d9322e61f9f612e2e30ef7341230c22eff949ef9f59438a76d9ac9af69321183454c2e21b91e9f74d6a008f5b6e0a3e3417ddac0c437869473
- TLSH T14131F2124A2845BF28FCD254D9B84707E7A0531B111A1C2FBAFCDA58CF7707236E1A89
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json
- Size 1KB
- SHA256 3fdd258d93e01874fb19eccebff7e1482d219237631401528bd383e067a442dc
- MD5 c9cad0e5fb4f07a9a1e76fe3d57d6740
- SHA1 0def9f3120beda4e7ce53f9ed564b16e9088ab87
- SHA512 566b3dc04017ec89453aac839cb2d2dcb38803fd6d6a186cdbee3d67726a8fcad6c1a05b9ef6e5aa1cb5ec0a459f8d03e994080503f337a578e351982d24c90d
- TLSH T1EB31F2124A2845FF28FDD294D9B84716EAA0531B51161C1FBAFCDA58CF3707226A1A89
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json
- Size 1KB
- SHA256 4a31f0df1c5f62607e0c787697a215490e7a6de84867b40806a2c57b6c73cb8d
- MD5 e66eaaf855035ea6387bf6f71202471d
- SHA1 455bdd45dd05371ddb6a3595324c76ac84e211b2
- SHA512 905cd2c259be8211c3709e18b1129c4cb7d08440aec8d275e817984cea7da6a0324183ad73c0aa13214fb6fb1b5605605be23c05c4b46992723ea9ff1107c3d5
- TLSH T15A3159228938D8BF1279965DD9B48102E350938F22B08C2FB3FCD848DD73974148BA4D
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\rmode\mbrescue.exe
- Size 7.7MB
- SHA256 477919ecb586d6ef4a06793417c2ae3126c51a51cf9445d901e90e3627e7143b
- MD5 ce8ca947e3162da157d1878d4cfec382
- SHA1 6f574aa206ba5e9d7469450780c4238cdd5112e8
- SHA512 4233bbde636d039ea3295e3b2066f56ea5a23e0431a5e675c967c60bbfa4f518f01eb90ac271da56a192671b925b3e14d3a25f1da4a8412983b4973565dff299
- SSDEEP 98304:akpowZa6gr/YzKrEAi9bESWCt+z3zweCeT007kxK:aFwZa62YW4AQbLWCtej1C9076K
- TLSH T1D586AE57A3E800E8D8B6D13CCA978503EBB2B85147719BDF06A4566A1F73AE05F3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\CatRoot2\dberr.txt
- Size 63KB
- SHA256 10affd7e47c15f71535cca7f176db47af595d6eed7a585cd2c7db32a90aeed8d
- MD5 ab08cbcdaa3c3fd31cf30491d6a83c65
- SHA1 88f1226a1ecbcad3b4e3f922ffbbffba9d8fe2dd
- SHA512 0381d1dde49d0be113324e002cc615d1ce903b72a3a8fec7d2dd3aa5fef8df89416eb4d07a0ca3af3b921a884e4266db1001db4a8b00410dbb7a2ae743b265b9
- SSDEEP 1536:Zq6gfLjhqzuRskDV7u2a9ZhD1lmD5Dv1PPJ/C7PMV57bUzqShFPXCF3traGFQm7p:ioqH
- TLSH T1AF531F0580D8C619C5B60BA273ABEE72D92E65C6770B0DE531AD7301D8C2B552F7A0BF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\CatRoot2\dberr.txt
- Size 64KB
- SHA256 eda5d84135ffd9b44dd13fc1ee962a322ee51bf8c5b81b8bc893825279c5dc56
- MD5 36e843db0f54474e79fafeccd36fda2a
- SHA1 59a2bfcfecb6604490eecb17fc9c71e44d380955
- SHA512 61eaa312652caf8ef324fea9a1dbc143dc6972d65d0c0d2dcc7cbbff1849f9ade56d0560ccefc2cf6558667f846e88f782f9b9205e6f06ea55eb918b8fae3e93
- SSDEEP 1536:Zq6gfLjhqzuRskDV7u2a9ZhD1lmD5Dv1PPJ/C7PMV57bUzqShFPXCF3traGFQm7m:ioqE
- TLSH T1CC531F0580D8C619C5B60BA273ABEE72D92E65C6770B0DE531AD7301D8C2B552F7A0BF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DriverStore\FileRepository\mbtun.inf_amd64_add82795013a7c3b.ini
- Size 409B
- SHA256 d1cd0033b6c0f5a3c290bf8a73ff67e2552701787e3bc58305f896f75425218f
- MD5 f7c1ce9ca13fb4b7cafae7bab264ebbe
- SHA1 5922f98dec640dd9a188f4cf87fe5e79e81c62f0
- SHA512 c4fc355194de3cb5a286781d73b9fc67136d021af29ec4fc0860bee2644d288bdd1bc4ad7a4488455d0f7bd13c0071c24f5373b06620649bd7471df72b893a8c
- TLSH T103E023E150B411DEA001835FF3163996CB59F01E04D5724DBF0458CC5B53DC71EE8791
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\catroot2\dberr.txt
- Size 64KB
- SHA256 153d6f1227ff7af24558d95e424676b9e2ad9774ef16e172d3d8b9b626709ff5
- MD5 f0c3ed3a8ab00e86b78acc7b8ab50050
- SHA1 71a99256f05073000d46fc1addb548442bfdc8cb
- SHA512 58f111778580fb1012cdff6f38a4120a3f56e707158917f4051c9c885454fcdaf582af9f3d55b1714bf5c96c5d94ec0e41028a805151843452cc07161df8ffa3
- SSDEEP 1536:Zq6gfLjhqzuRskDV7u2a9ZhD1lmD5Dv1PPJ/C7PMV57bUzqShFPXCF3traGFQm7g:ioqi
- TLSH T155531F0580D8C619C5B60BA273ABEE72D92E65C6770B0DE531AD7301D8C2B552F7A0BF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\drivers\MbamChameleon.sys
- Size 230KB
- SHA256 a2f19edac47313a8d282ec88ff6da531d49ada37829328278be4b8d395819f0f
- MD5 7e71850b3c629e6753c1ae3c44353d01
- SHA1 43ebff27352b1e2aba7a892cae8cb3e9d60242af
- SHA512 a5de9eac12d2ea3af7936ecdf268b7786dd467cd62050a341afea67c30343dfef05c5eba9325dc5803f61ac0ec3f95ce029bf1c0298fb78a70f173ffa502597f
- SSDEEP 3072:f/Oxj1rrPoZW1sldvOyp509rYfDPmLbZSZhW8PY9PRVNSXwKX9WVUgl00ZoYAYey:W6vOyp5uZSZhPAvVIXwm9W166oIqIj9
- TLSH T1BD347E5AD2D41DA6F9B6C2BA8ED69542E77334091B21DACF0370842A1F67BB0F53530A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\drivers\mbamswissarmy.sys
- Size 240KB
- SHA256 6d2c9a01f953d206abbbd8c2ba5a00b78ad8f6bcddba6db810f2d6f562ddbd8a
- MD5 953f871a91ac057d2d748646065fc2dd
- SHA1 ef6eb7900e194555bc9dc4b4eca377f5aee9f7e2
- SHA512 dc4caf64effe29e719d85823ac9ded93bd723ccefa4662420303c700968db608c9c0cdb4412373ffba49c9672359f4594dab50863cc6c10e8bb4d3b5fd00573c
- SSDEEP 3072:rM98OZY4B+FY1GeX7dxNRV634KOMuFZWaOJRN4KoXkM0dsFTgUzFkzSzpJW4d1sa:rkLelYsCdbRDF7WaeRN4dT0U6r4dxt
- TLSH T1FB346D06E2E47A66F9B7827D89A69102E77271452B31CECF5370C1292F1B7E0F93534A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\TEMP\mb_errors999.log
- Size 429B
- SHA256 4085b7baaeb99e5db500e148f8ee1836b7efb7c773e39bcc256ebbed7906c9da
- MD5 cdf6a693b17f165749b6989b50d59b69
- SHA1 4794fe45d1aa1e09e78398d3d5c127a45a38e0dc
- SHA512 1f7e4a726e97ab4b565f09992c4bfa8a2e56f446fe1f60b90afdc6f10c264ea9028fe464221818e581a45a52dcbd30f0ae85c6704e09ec8e4836a5b4a7166a91
- TLSH T13BE0A08149F214B438424862E9423A4DF7ABFCD8663D34B87FD538989A8148ECD7222B
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\mb_26C3.tmp
- Size 107KB
- SHA256 ad820dd54edb13e255d34eafacd71f278d6514e2f7e4c2970401f922a774ceb0
- MD5 2df8ff40bec48460845f851a54b76fe8
- SHA1 8e19f3d76c87d590cf1af839ddbe98af381d44e7
- SHA512 2177f5dfd6901f09ae2b8a0d6bea7b5fac3d00a721aa297ca6c35666cf2549d6c8d8655063a332224ccc8e0f00bdc84334636e9f1527862c850cc4ceb96d7d61
- SSDEEP 3072:dAZdoamZdgBjLpSXussssvYssssnC1c9RvZfy74hfp:dW542pSessssgssss7Nea
- TLSH T1B6B3F1F78379B8D9C513DA3B93874B110B28426B2C8A7E45A84DDB158D7E66181C3F8F
- MD5 SHA1 SHA512 SSDEEP TLSH