Analysis
- max time kernel
136s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/07/2026, 17:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-30_8ff932ae4fa2327d55d5e34a10bf9d83_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
37 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-30_8ff932ae4fa2327d55d5e34a10bf9d83_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
33 signatures
150 seconds
General
- Target 2026-07-30_8ff932ae4fa2327d55d5e34a10bf9d83_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
- Size 3.2MB
- Sample260730-vwpbjsch46
- SHA256 4644f30e839e9afb0a960ab4a3988e29a8831f98bb21c0cbcb8942544079772e
- MD5 8ff932ae4fa2327d55d5e34a10bf9d83
- SHA1 6b706a95a52a226068ffed023102af66d40d0975
- SHA512 7ff745f937e976a8af5ed06e55618aa44c77977c35df02f2427df34a2123eb3b6969de68d99bab62206be961c3e10d0c83a6d8ad29d42755e199ba0d6fb64b34
- SSDEEP 49152:zg9zAAAHY7oomwAeyfvE0Z3R0Tnxn1o2d5Hptj4LD6mGvKVO+n1:cdAAAHY1AeKtwnW2yXeN+1
- TLSH T1FBF5BE31B2918120D5B39270297EB7EB4B79BC256F7640CF32D8B6390B725C0AD75B26
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs
resource yara_rule behavioral1/files/0x0007000000024516-2816.dat INDICATOR_SUSPICIOUS_Binary_References_Browsers - Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 2 IoCs
resource yara_rule behavioral1/files/0x000200000001e75a-2788.dat INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL behavioral1/files/0x000200000001e758-2784.dat INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL - Detects executables built or packed with MPress PE compressor 3 IoCs
resource yara_rule behavioral1/files/0x0007000000024519-2804.dat INDICATOR_EXE_Packed_MPress behavioral1/files/0x000700000002451a-2812.dat INDICATOR_EXE_Packed_MPress behavioral1/files/0x0007000000024518-2824.dat INDICATOR_EXE_Packed_MPress - Detects executables packed with ConfuserEx Mod 2 IoCs
resource yara_rule behavioral1/files/0x0007000000024519-2804.dat INDICATOR_EXE_Packed_ConfuserEx behavioral1/files/0x000700000002451a-2812.dat INDICATOR_EXE_Packed_ConfuserEx - Detects executables packed with Goliath 2 IoCs
resource yara_rule behavioral1/files/0x0007000000024519-2804.dat INDICATOR_EXE_Packed_Goliath behavioral1/files/0x000700000002451a-2812.dat INDICATOR_EXE_Packed_Goliath - Detects executables packed with Themida 2 IoCs
resource yara_rule behavioral1/files/0x0007000000024519-2804.dat INDICATOR_EXE_Packed_Themida behavioral1/files/0x000700000002451a-2812.dat INDICATOR_EXE_Packed_Themida - Downloads MZ/PE file 1 IoCs
flow pid Process 138 1404 2026-07-30_8ff932ae4fa2327d55d5e34a10bf9d83_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe - Drops file in Drivers directory 5 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\drivers\mbamtestfile.dat 2026-07-30_8ff932ae4fa2327d55d5e34a10bf9d83_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File created C:\Windows\SysWOW64\drivers\mbamtestfile.dat 2026-07-30_8ff932ae4fa2327d55d5e34a10bf9d83_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File created C:\Windows\system32\drivers\mbae.sys MBAMInstallerService.exe File created C:\Windows\system32\DRIVERS\MbamElam.sys MBAMService.exe File opened for modification C:\Windows\system32\DRIVERS\MbamElam.sys MBAMService.exe - Patched UPX-packed file 2 IoCs
Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
resource yara_rule behavioral1/files/0x0007000000024519-2804.dat patched_upx behavioral1/files/0x000700000002451a-2812.dat patched_upx - Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion MBAMService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate MBAMService.exe - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 28 IoCs
pid Process 5004 alg.exe 4788 DiagnosticsHub.StandardCollector.Service.exe 4708 fxssvc.exe 3760 elevation_service.exe 2648 elevation_service.exe 3384 maintenanceservice.exe 416 msdtc.exe 3436 OSE.EXE 1872 PerceptionSimulationService.exe 116 perfhost.exe 3040 locator.exe 8 SensorDataService.exe 1196 snmptrap.exe 2948 spectrum.exe 1464 ssh-agent.exe 3224 TieringEngineService.exe 3036 AgentService.exe 3236 vds.exe 1448 vssvc.exe 3884 wbengine.exe 2780 WmiApSrv.exe 4064 SearchIndexer.exe 4444 MBAMInstallerService.exe 5172 MBVpnTunnelService.exe 5476 MBVpnTunnelService.exe 5992 MBAMService.exe 6092 MBAMService.exe 776 MbamElam.sys - Impair Defenses: Safe Mode Boot 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\MBAMService MBAMInstallerService.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\MBAMService\ = "Service" MBAMInstallerService.exe - Loads dropped DLL 14 IoCs
pid Process 4444 MBAMInstallerService.exe 4444 MBAMInstallerService.exe 5172 MBVpnTunnelService.exe 5476 MBVpnTunnelService.exe 5476 MBVpnTunnelService.exe 6092 MBAMService.exe 6092 MBAMService.exe 6092 MBAMService.exe 6092 MBAMService.exe 6092 MBAMService.exe 6092 MBAMService.exe 6092 MBAMService.exe 6092 MBAMService.exe 6092 MBAMService.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: MBAMService.exe File opened (read-only) \??\B: MBAMService.exe File opened (read-only) \??\J: MBAMService.exe File opened (read-only) \??\K: MBAMService.exe File opened (read-only) \??\L: MBAMService.exe File opened (read-only) \??\R: MBAMService.exe File opened (read-only) \??\S: MBAMService.exe File opened (read-only) \??\T: MBAMService.exe File opened (read-only) \??\H: MBAMService.exe File opened (read-only) \??\N: MBAMService.exe File opened (read-only) \??\U: MBAMService.exe File opened (read-only) \??\V: MBAMService.exe File opened (read-only) \??\W: MBAMService.exe File opened (read-only) \??\Z: MBAMService.exe File opened (read-only) \??\O: MBAMService.exe File opened (read-only) \??\A: MBAMService.exe File opened (read-only) \??\E: MBAMService.exe File opened (read-only) \??\G: MBAMService.exe File opened (read-only) \??\M: MBAMService.exe File opened (read-only) \??\X: MBAMService.exe File opened (read-only) \??\I: MBAMService.exe File opened (read-only) \??\P: MBAMService.exe File opened (read-only) \??\Y: MBAMService.exe - ConfuserEx .NET packer 2 IoCs
Detects ConfuserEx .NET packer.
resource yara_rule behavioral1/files/0x0007000000024519-2804.dat ConfuserEx behavioral1/files/0x000700000002451a-2812.dat ConfuserEx - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\System32\DriverStore\FileRepository\net1ic64.inf_amd64_5f033e913d34d111\net1ic64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\dc21x4vm.inf_amd64_3294fc34256dbb0e\dc21x4vm.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netbc63a.inf_amd64_7ba6c9cea77dd549\netbc63a.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netmyk64.inf_amd64_1f949c30555f4111\netmyk64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netwtw04.inf_amd64_c8f5ae6576289a2d\netwtw04.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netwtw08.inf_amd64_7c0c516fb22456cd\netwtw08.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netvwwanmp.inf_amd64_f9e30429669d7fff\netvwwanmp.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netax88179_178a.inf_amd64_b6748bc8bb8ccf4d\netax88179_178a.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netwmbclass.inf_amd64_dba6eeaf0544a4e0\netwmbclass.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\nete1g3e.inf_amd64_af58b4e19562a3f9\nete1g3e.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netvf63a.inf_amd64_a090e6cfaf18cb5c\netvf63a.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\mwlu97w8x64.inf_amd64_23bc3dc6d91eebdc\mwlu97w8x64.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{fbb75e12-bf75-1a4b-a689-64b0aefce948}\mbtun.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\mbtun.inf_amd64_add82795013a7c3b\mbtun.cat DrvInst.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-07-30_8ff932ae4fa2327d55d5e34a10bf9d83_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File created C:\Windows\System32\DriverStore\FileRepository\netsstpa.inf_amd64_e76c5387d67e3fd6\netsstpa.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netl1c63x64.inf_amd64_4d6630ce07a4fb42\netl1c63x64.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-07-30_8ff932ae4fa2327d55d5e34a10bf9d83_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Windows\System32\DriverStore\FileRepository\ndisimplatformmp.inf_amd64_8de1181bfd1f1628\ndisimplatformmp.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netwbw02.inf_amd64_1c4077fa004e73b4\netwbw02.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\msux64w10.inf_amd64_5aa81644af5957b3\msux64w10.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\net8192se64.inf_amd64_167684f9283b4eca\net8192se64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\rndiscmp.inf_amd64_81bff1eb756435c6\rndiscmp.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\Temp\{fbb75e12-bf75-1a4b-a689-64b0aefce948}\SET2329.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\net9500-x64-n650f.inf_amd64_e92c5a65e41993f9\net9500-x64-n650f.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\e2xw10x64.inf_amd64_04c2ae40613a06ff\e2xw10x64.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 2026-07-30_8ff932ae4fa2327d55d5e34a10bf9d83_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File created C:\Windows\System32\DriverStore\FileRepository\netr28ux.inf_amd64_d5996f2a9d9aa9e3\netr28ux.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\rtux64w10.inf_amd64_d6132e4c7fe2fac6\rtux64w10.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{fbb75e12-bf75-1a4b-a689-64b0aefce948}\SET232A.tmp DrvInst.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-07-30_8ff932ae4fa2327d55d5e34a10bf9d83_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File created C:\Windows\System32\DriverStore\FileRepository\netrndis.inf_amd64_be4ba6237d385e2e\netrndis.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netrtwlans.inf_amd64_97cd1a72c2a7829c\netrtwlans.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\bthpan.inf_amd64_b06c3bc32f7db374\bthpan.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\ykinx64.inf_amd64_0bbd8466b526ef26\ykinx64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\net44amd.inf_amd64_450d4b1e35cc8e0d\net44amd.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netwew00.inf_amd64_325c0bd6349ed81c\netwew00.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netv1x64.inf_amd64_30040c3eb9d7ade4\netv1x64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netvg63a.inf_amd64_9f5493180b1252cf\netvg63a.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\net8192su64.inf_amd64_66c8bfc7a4b1feed\net8192su64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\msdri.inf_amd64_97bef65a8432edd4\msdri.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\wceisvista.inf_amd64_07ad61d07466a58a\wceisvista.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\mbtun.inf_amd64_add82795013a7c3b\mbtun.sys DrvInst.exe File opened for modification C:\Windows\system32\msiexec.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Windows\System32\DriverStore\FileRepository\usbncm.inf_amd64_9957a38c3d2283ed\usbncm.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\net8185.inf_amd64_7a30f5a9441cd55b\net8185.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-07-30_8ff932ae4fa2327d55d5e34a10bf9d83_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File created C:\Windows\System32\DriverStore\FileRepository\net1yx64.inf_amd64_8604d8a50804b9c1\net1yx64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\net8187bv64.inf_amd64_bc859d32f3e2f0d5\net8187bv64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\Temp\{fbb75e12-bf75-1a4b-a689-64b0aefce948}\SET232A.tmp DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\netwsw00.inf_amd64_24d55504ae3587aa\netwsw00.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netefe3e.inf_amd64_7830581a689ef40d\netefe3e.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netl160a.inf_amd64_e4cbe375963a69e9\netl160a.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netathr10x.inf_amd64_2691c4f95b80eb3b\netathr10x.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\System32\vds.exe 2026-07-30_8ff932ae4fa2327d55d5e34a10bf9d83_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File created C:\Windows\System32\DriverStore\FileRepository\net7800-x64-n650f.inf_amd64_178f1bdb49a6e2fd\net7800-x64-n650f.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netrasa.inf_amd64_1bdf7a435cb3580d\netrasa.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netloop.inf_amd64_762588e32974f9e8\netloop.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-07-30_8ff932ae4fa2327d55d5e34a10bf9d83_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-07-30_8ff932ae4fa2327d55d5e34a10bf9d83_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-07-30_8ff932ae4fa2327d55d5e34a10bf9d83_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 2026-07-30_8ff932ae4fa2327d55d5e34a10bf9d83_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.Security.Cryptography.Primitives.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\it\UIAutomationClientSideProviders.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\pl\System.Windows.Forms.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\ru\ReachFramework.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.json MBAMInstallerService.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-07-30_8ff932ae4fa2327d55d5e34a10bf9d83_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\clrjit.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\sentrynativesdk.dll MBAMInstallerService.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-07-30_8ff932ae4fa2327d55d5e34a10bf9d83_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_85093\java.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\Microsoft.Win32.Registry.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.Xml.XmlDocument.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\es\System.Windows.Controls.Ribbon.resources.dll MBAMInstallerService.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-07-30_8ff932ae4fa2327d55d5e34a10bf9d83_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\ko\UIAutomationClientSideProviders.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\System.Diagnostics.EventLog.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\System.Security.Cryptography.Xml.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\MBAMShim.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\Prism.Container.Extensions.dll MBAMInstallerService.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\Microsoft.NETCore.App.runtimeconfig.json MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\pt-BR\Microsoft.VisualBasic.Forms.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\offreg.dll MBAMInstallerService.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-07-30_8ff932ae4fa2327d55d5e34a10bf9d83_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-07-30_8ff932ae4fa2327d55d5e34a10bf9d83_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.Diagnostics.Contracts.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\Serilog.Extensions.Logging.dll MBAMInstallerService.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-07-30_8ff932ae4fa2327d55d5e34a10bf9d83_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\System.Resources.Extensions.dll MBAMInstallerService.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-07-30_8ff932ae4fa2327d55d5e34a10bf9d83_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-07-30_8ff932ae4fa2327d55d5e34a10bf9d83_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-07-30_8ff932ae4fa2327d55d5e34a10bf9d83_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.Diagnostics.StackTrace.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\PenImc_cor3.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\UIAutomationProvider.dll MBAMInstallerService.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-07-30_8ff932ae4fa2327d55d5e34a10bf9d83_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.Data.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\es\UIAutomationTypes.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\pl\System.Xaml.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\System.Drawing.Common.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\SQLitePCLRaw.core.dll MBAMInstallerService.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe 2026-07-30_8ff932ae4fa2327d55d5e34a10bf9d83_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.Interop.Activation.dll MBAMInstallerService.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_85093\javaws.exe 2026-07-30_8ff932ae4fa2327d55d5e34a10bf9d83_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\ko\System.Xaml.resources.dll MBAMInstallerService.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.Reflection.Emit.Lightweight.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\ko\System.Windows.Forms.Primitives.resources.dll MBAMInstallerService.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.Buffers.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.Private.DataContractSerialization.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.Runtime.CompilerServices.Unsafe.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\de\UIAutomationClient.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\AEControllerImpl.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\ig.exe MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.UI.Controls.dll MBAMInstallerService.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 2026-07-30_8ff932ae4fa2327d55d5e34a10bf9d83_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-07-30_8ff932ae4fa2327d55d5e34a10bf9d83_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe - Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-07-30_8ff932ae4fa2327d55d5e34a10bf9d83_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\inf\oem3.inf DrvInst.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\INF\setupapi.dev.log MBVpnTunnelService.exe File opened for modification C:\Windows\INF\setupapi.dev.log svchost.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\inf\oem3.inf DrvInst.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 1 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh MBVpnTunnelService.exe - Modifies trusted root certificate store through registry 1 TTPs 11 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa22000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8DA7F965EC5EFC37910F1C6E59FDC1CC6A6EDE16\Blob = 0300000001000000140000008da7f965ec5efc37910f1c6e59fdc1cc6a6ede162000000001000000450300003082034130820229a0030201020213066c9fcf99bf8c0a39e2f0788a43e696365bca300d06092a864886f70d01010b05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412031301e170d3135303532363030303030305a170d3338303131373030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f74204341203130820122300d06092a864886f70d01010105000382010f003082010a0282010100b2788071ca78d5e371af478050747d6ed8d78876f49968f7582160f97484012fac022d86d3a0437a4eb2a4d036ba01be8ddb48c80717364cf4ee8823c73eeb37f5b519f84968b0ded7b976381d619ea4fe8236a5e54a56e445e1f9fdb416fa74da9c9b35392ffab02050066c7ad080b2a6f9afec47198f503807dca2873958f8bad5a9f948673096ee94785e6f89a351c0308666a14566ba54eba3c391f948dcffd1e8302d7d2d747035d78824f79ec4596ebb738717f2324628b843fab71daacab4f29f240e2d4bf7715c5e69ffea9502cb388aae50386fdbfb2d621bc5c71e54e177e067c80f9c8723d63f40207f2080c4804c3e3b24268e04ae6c9ac8aa0d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604148418cc8534ecbc0c94942e08599cc7b2104e0a08300d06092a864886f70d01010b0500038201010098f2375a4190a11ac57651282036230eaee628bbaaf894ae48a4307f1bfc248d4bb4c8a197f6b6f17a70c85393cc0828e39825cf23a4f9de21d37c8509ad4e9a753ac20b6a897876444718656c8d418e3b7f9acbf4b5a750d7052c37e8034bade961a0026ef5f2f0c5b2ed5bb7dcfa945c779e13a57f52ad95f2f8933bde8b5c5bca5a525b60af14f74befa3fb9f40956d3154fc42d3c7461f23add90f48709ad9757871d1724334756e5759c2025c266029cf2319168e8843a5d4e4cb08fb231143e843297262a1a95d5e08d490aeb8d8ce14c2d055f286f6c49343776661c0b9e841d7977860036e4a72aea5d17dba109e866c1b8ab95933f8ebc490bef1b9 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\5A8CEF45D7A69859767A8C8B4496B578CF474B1A\Blob = 0300000001000000140000005a8cef45d7a69859767a8c8b4496b578cf474b1a2000000001000000450500003082054130820329a0030201020213066c9fd29635869f0a0fe58678f85b26bb8a37300d06092a864886f70d01010c05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412032301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f74204341203230820222300d06092a864886f70d01010105000382020f003082020a0282020100ad969f2d9c4a4c4a81795199ec8acb6b605113bc4d6d06fcb0088ddd19106ac7260c35d8c06f2084e994b19b8503c35bdb4ae8c8f89076d95b4fe34ce806364dcc9aac3d0c902b92d4061960ac374479858182ad5a37e00dcc9da64c5276ea439db704d150f655e0d5d2a64985e937e9ca7eae5c954d489a3fae205a6d8895d934b8521a4390b0bf6c05b9b678b7ead0e43a3c125362ff4af27bbe3505a91234e3f36474622c3d00495a28fe3244bb87dd652702713bda4af71fdacdf72155904f0fecae82e19f6bd945d3bbf05f87ed3c2c3986da3fdeec7255eb79a3addbdd7cb0ba1ccefcde4f3576cf0ff8781f6a36514627615be99ecff0a2557d7c258a6f2fb4c5cf842e2bfd0d51106cfb5f1bbc1b7ec5ae3b98013192ff0b57f49ab2b957e9abef0d76d1f0eef4ce86a7e06ee9b469a1df69f633c6692e97139ea587b057108137c953b3bb7ff692d19cd018f4926eda834fa663994ca5fb5eef21647a205f6c648515cb37e9620c0b2a16dc012e32da3e4bf59e3af6174094ef9e910886fabe63a85a33eccb744395f96c695236c7296ffc55035c1ffb9fbd47ebe74947950b4e89220949e0f5611ef1bf2e8a726e8059ff573af97532a34e5feced2862d94d73f2cc811760edcdebdcdba7cac57e02bdf2540854fdb42d092c17544a98d154e1516708d2ed6e7e6f3fd22d81592966cb903995111e7427feddebaf0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414b00cf04c30f405580248fd33e552af4b84e36652300d06092a864886f70d01010c05000382020100aaa8808f0e78a3e0a2d4cde6f5987a3bea0003b0970e93bc5aa8f62c8c7287a9b1fc7f73fd637178a58759cf30e10d10b2135a6d82f56ae6809fa0050b68e4476bc76adfb6fd773272e518fa09f4a0932c5dd28c75857665900c0379b7312363ad788309866884cafff9cf269a9279e7cd4bc5e761a717cbf3a91293936ba7e82f5392c46058b0cc0251185b858d625963b6adb4de9afb26f70027c05d55377499c9507fe3592e44e32c25eeec4c3277b49f1ae94b5d20c5dafd1c8716c643e8d4bb269a45705ea90b3753e2467b27fde046f289b7cc42b6cb28266ed9a5c93ac8411360f7508c15aeb26d1a151a5778e6922ad96590823f6c02afae123a27963604d71da28063a99bf1e5bab47c14b04ec9b11f745f38f651ea9bfa2ca211d4a92d271a45b1afb24e710dc05846d66906cb53cbb3fe6b41cd417e7d4c0f7c72797a59cd5e4a0eac9ba99873797cb4f4ccb9b8070cb2745cb8c76f88a190a7f4aaf9bf673af41a15621eb79fbe3db129af67a112f25810195303301bb81a89f69cbd97038ea309f31d8b21f1b4dfe41cd19f650206ea5cd613b384efa2a55c8c7729a768c06bae40d2a8b4eacdf08d4b389c199a1b2854b88990efca75813e1ef26424c718af4eff479e07f63565a4d30a56fff517646cefa822254993b6df0017da587e5deec51bb0d1d15f2110c7f9f3ba020a2707c5f1d6c7d3e0fb09606c MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0D44DD8C3C8C1A1A58756481E90F2E2AFFB3D26E\Blob = 0300000001000000140000000d44dd8c3c8c1a1a58756481e90f2e2affb3d26e2000000001000000ba010000308201b63082015ba0030201020213066c9fd5749736663f3b0b9ad9e89e7603f24a300a06082a8648ce3d0403023039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412033301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f7420434120333059301306072a8648ce3d020106082a8648ce3d030107034200042997a7c6417fc00d9be8011b56c6f252a5ba2db212e8d22ed7fac9c5d8aa6d1f73813b3b986b397c33a5c54e868e8017686245577d44581db337e56708eb66dea3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414abb6dbd7069e37ac3086079170c79cc419b178c0300a06082a8648ce3d0403020349003046022100e08592a317b78df92b06a593ac1a98686172fae1a1d0fb1c7860a64399c5b8c40221009c02eff1949cb396f9ebc62af8b62cfe3a901416d78c6324481cdf307dd5683b MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F6108407D6F8BB67980CC2E244C2EBAE1CEF63BE\Blob = 030000000100000014000000f6108407d6f8bb67980cc2e244c2ebae1cef63be2000000001000000f6010000308201f230820178a0030201020213066c9fd7c1bb104c2943e5717b7b2cc81ac10e300a06082a8648ce3d0403033039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412034301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f7420434120343076301006072a8648ce3d020106052b8104002203620004d2ab8a374fa3530dfec18a7b4ba87b464b63b062f62d1bdb087121d200e863bd9a27fbf0396e5dea3da5c981aaa35b2098455d16dbfde8106de39ce0e3bd5f8462f3706433a0cb242f70ba88a12aa075f881ae6206c481db396e29b01efa2e5ca3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414d3ecc73a656ecce1da769a56fb9cf3866d57e581300a06082a8648ce3d040303036800306502303a8b21f1bd7e11add0ef58962fd6eb9d7e908d2bcf6655c32ce328a9700a470ef0375912ff2d9994284e2a4f354d335a023100ea75004e3bc43a941291c958469d211372a7889c8ae44c4adb96d4ac8b6b6b49125333add7e4be24fcb50a76d4a5bc10 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\2AD974A775F73CBDBBD8F5AC3A49255FA8FB1F8C\Blob = 0300000001000000140000002ad974a775f73cbdbbd8f5ac3a49255fa8fb1f8c2000000001000000620400003082045e30820346a0030201020213077312380b9d6688a33b1ed9bf9ccda68e0e0f300d06092a864886f70d01010b05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412031301e170d3232303832333232323132385a170d3330303832333232323132385a303c310b3009060355040613025553310f300d060355040a1306416d617a6f6e311c301a06035504031313416d617a6f6e205253412032303438204d303130820122300d06092a864886f70d01010105000382010f003082010a0282010100eb712ca9cb1f8828923230af8a570f78b73725955587ac675c97d322c8daa214676b7cf067dae2032ab356125dc6b547f96708a7937a9592180fb4f9f910369a7f2f80b64fba134ec75d531ee0dd96330720d396bc12e4745042a1051373b54f9b4424fe2d7fedbc2285ec362133977506ce271882dce3d9c582078d5e26012626671fd93f13cf32ba6bad7864fcaaff0e023c07df9c0578728cfdea75b7032884dae86e078cd05085ef8154b2716eec6d62ef8f94c35ee9c4a4d091c02e249198caeeba258ed4f671b6fb5b6b38064837478d86dcf2ea06fb76377d9eff424e4d588293cfe271c278b17aab4b5b94378881e4d9af24aef872c565fb4bb451e70203010001a382015a3082015630120603551d130101ff040830060101ff020100300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030106082b06010505070302301d0603551d0e0416041481b80e638a891218e5fa3b3b50959fe6e5901385301f0603551d230418301680148418cc8534ecbc0c94942e08599cc7b2104e0a08307b06082b06010505070101046f306d302f06082b060105050730018623687474703a2f2f6f6373702e726f6f746361312e616d617a6f6e74727573742e636f6d303a06082b06010505073002862e687474703a2f2f6372742e726f6f746361312e616d617a6f6e74727573742e636f6d2f726f6f746361312e636572303f0603551d1f043830363034a032a030862e687474703a2f2f63726c2e726f6f746361312e616d617a6f6e74727573742e636f6d2f726f6f746361312e63726c30130603551d20040c300a3008060667810c010201300d06092a864886f70d01010b05000382010100ad00de0205232e063262b46bb19416e41140de2bfa59c135efe0aa8f2b41b9d1f38739001df23db5a7470c0606c691f3075702d4edbd17c1909abf4875a2074f30dd4a6a42b50d3d15c00ffe845bc63c99cc5752b1d86e12d59692934b94e507e88982086a7a34d49e64e13d876a92909a63a14bf88fb6ea34d305be20c2de06e28c9f738b9f4d3985cace19369d85c99ec9f8503fb67e88a1efca84068b50b40a5ca61c44f1fdc8614060f26125aa07f4c7c27375e40c0b428d04e55f4448995b7b898196a7889d4b0d62e804c4d7feb4e8b26dcaecc01cbc385b1ddf85ce5b7ae3494b6cb9a7ddf405b249ade1c5146bc2ccebcd7fd65869bac3207e7fb0b8 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E\Blob = 030000000100000014000000b51c067cee2b0c3df855ab2d92f4fe39d4e70f0e2000000001000000e1030000308203dd308202c5a003020102020100300d06092a864886f70d01010b050030818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a30818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bdedc103fcf68ffc02b16f5b9f48d99d79e2a2b703615618c347b6d7ca3d352e8943f7a1699bde8a1afd13209cb44977322956fdb9ec8cdd22fa72dc276197eef65a84ec6e19b9892cdc845bd574fb6b5fc589a51052894655f4b8751ce67fe454ae4bf85572570219f8177159eb1e280774c59d48be6cb4f4a4b0f364377992c0ec465e7fe16d534c62afcd1f0b63bb3a9dfbfc7900986174cf26824063f3b2726a190d99cad40e75cc37fb8b89c159f1627f5fb35f6530f8a7b74d765a1e765e34c0e89656998ab3f07fa4cdbddc32317c91cfe05f11f86baa495cd19994d1a2e3635b0976b55662e14b741d96d426d4080459d0980e0ee6defcc3ec1f90f10203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147c0c321fa7d9307fc47d68a362a8a1ceab075b27300d06092a864886f70d01010b050003820101001159fa254f036f94993b9a1f828539d47605945ee128936d625d09c2a0a8d4b07538f1346a9de49f8a862651e62cd1c62d6e95204a9201ecb88a677b31e2672e8c9503262e439d4a31f60eb50cbbb7e2377f22ba00a30e7b52fb6bbb3bc4d379514ecd90f4670719c83c467a0d017dc558e76de68530179a24c410e004f7e0f27fd4aa0aff421d37ed94e5645912207738d3323e3881759673fa688fb1cbce1fc5ecfa9c7ecf7eb1f1072db6fcbfcaa4bfd097054abcea18280290bd5478092171d3d17d1dd916b0a9613dd00a0022fcc77bcb0964450b3b4081f77d7c32f598ca588e7d2aee90597364f936745e25a1f566052e7f3915a92afb508b8e8569f4 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\1C58A3A8518E8759BF075B76B750D4F2DF264FCD\Blob = 0300000001000000140000001c58a3a8518e8759bf075b76b750d4f2df264fcd2000000001000000c2040000308204be308203a6a003020102021006d8d904d5584346f68a2fa754227ec4300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3231303431343030303030305a170d3331303431333233353935395a304f310b300906035504061302555331153013060355040a130c446967694365727420496e633129302706035504031320446967694365727420544c53205253412053484132353620323032302043413130820122300d06092a864886f70d01010105000382010f003082010a0282010100c14bb3654770bcdd4f58dbec9cedc366e51f311354ad4a66461f2c0aec6407e52edcdcb90a20eddfe3c4d09e9aa97a1d8288e51156db1e9f58c251e72c340d2ed292e156cbf1795fb3bb87ca25037b9a52416610604f571349f0e8376783dfe7d34b674c2251a6df0e9910ed57517426e27dc7ca622e131b7f238825536fc13458008b84fff8bea75849227b96ada2889b15bca07cdfe951a8d5b0ed37e236b4824b62b5499aecc767d6e33ef5e3d6125e44f1bf71427d58840380b18101faf9ca32bbb48e278727c52b74d4a8d697dec364f9cace53a256bc78178e490329aefb494fa415b9cef25c19576d6b79a72ba2272013b5d03d40d321300793ea99f50203010001a38201823082017e30120603551d130101ff040830060101ff020100301d0603551d0e04160414b76ba2eaa8aa848c79eab4da0f98b2c59576b9f4301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030106082b06010505070302307606082b06010505070101046a3068302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304006082b060105050730028634687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274476c6f62616c526f6f7443412e63727430420603551d1f043b30393037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274476c6f62616c526f6f7443412e63726c303d0603551d2004363034300b06096086480186fd6c02013007060567810c01013008060667810c0102013008060667810c0102023008060667810c010203300d06092a864886f70d01010b050003820101008032ce5e0bdd6e5a0d0aafe1d684cbc08efa8570edda5db30cf72b7540fe850afaf33178b7704b1a8958ba80bdf36b1de97ecf0bba589c59d490d3fd6cfdd0986db771825bcf6d0b5a09d07bdec443d82aa4de9e41265fbb8f99cbddaee1a86f9f87fe74b71f1b20abb14fc6f5675d5d9b3ce9ff69f7616cd6d9f3fd36c6ab038876d24b2e7586e3fcd8557d26c21177df3e02b67cf3ab7b7a86366fb8f7d89371cf86df7330fa7babed2a59c842843b11171a52f3c90e147da25b7267ba71ed574766c5b8024a65345e8bd02a3c209c51994ce7529ef76b112b0d927e1de88aeb36164387ea2a63bf753febdec403bb0a3cf730efebaf4cfc8b3610733ef3a4 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 MBAMInstallerService.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_8ff932ae4fa2327d55d5e34a10bf9d83_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 svchost.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION MBAMInstallerService.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Malwarebytes.exe = "11000" MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION MBAMService.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\mbam.exe = "11000" MBAMService.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\mbamtray.exe = "11000" MBAMService.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\16.0\Common MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001d8c10cf4720dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0 MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\15.0 MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000207f46d04720dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\15.0 MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\16.0\Common\Security MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio" SearchProtocolHost.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications MBAMInstallerService.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:\ MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" fxssvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0\Common\Security MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005b1d25d04720dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Malwarebytes MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MBAMService.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bc7479cf4720dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Malwarebytes MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0\Common MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Policies MBAMInstallerService.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{94E6A9DF-4AAB-48E7-8A94-65CA2481D1F6}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3641B831-731C-4963-B50B-D84902285C26}\ProxyStubClsid32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{983849D5-BFE9-43E9-A9A0-CBAFBC917F39}\ProxyStubClsid32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2650A9C4-A53C-4BEF-B766-7405B4D5562B} MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FA484BC6-E101-4A87-AAF3-B468B3F2C6BB} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BB344FF5-ACAE-4B90-AD24-DEFD41159C56}\ = "IVPNControllerV4" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F6D29500-933C-447C-9D88-9D814AF73808}\LocalServer32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{106E3995-72F9-458A-A317-9AFF9E45A1F0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FC60FEE4-E373-4962-B548-BA2E06119D54} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BF153224-DA64-41F1-AA87-321B345870FA}\ = "ICleanControllerEventsV8" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DAD5232C-6E05-4458-9709-0B4DCB22EA09}\ = "ITelemetryControllerV2" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{53260A87-5F77-4449-95F1-77A210A2A6D8}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{19184D37-6938-4F54-BAFD-3240F0FA75E6}\TypeLib\ = "{49F6AC60-2104-42C6-8F71-B3916D5AA732}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E2D56B7B-4B87-45A1-A6D3-5C77035141A6}\ProxyStubClsid32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MB.LogController.1 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{106E3995-72F9-458A-A317-9AFF9E45A1F0}\TypeLib\Version = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6EBDF088-E9E1-42A9-A5C2-99242C338948}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{563D4D90-1666-4949-AC2E-E39DB953DF70}\ = "IScanControllerV27" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B32065E5-189E-4C5F-AA59-32A158BAF5B7}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4163399F-AB08-4E5E-BE28-6B9440393AD3}\ = "IMWACControllerV13" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{767D2042-D2F6-4BAA-B30E-00E0CD4015BD}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A0EB1521-C843-47D5-88D2-5449A2F5F40B}\ProxyStubClsid32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A0101B90-FD0B-40CF-90E4-33650F09A80F}\ProxyStubClsid32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7CE6B1E9-C583-4F97-991C-A2DA0089A924} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5ABC7CB0-FA59-4326-A92E-BD47C0BD9B42}\ = "_IArwControllerEventsV6" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{10024D75-0830-473C-8C23-0649487FCCF1}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{32DF4C97-FE35-41AA-B18F-583AA53723A3}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CCEFCD43-B934-4168-AE51-6FE07D3D0624}\TypeLib\Version = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F6A99D88-2CA0-4781-86B9-2014CDC372E8} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3498D9E4-6476-4AC0-B53A-75BC9955EF37}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0DB6AD16-564C-451A-A173-0F31A62B7A4D} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB54E87D-D7DB-400E-AFF1-0182D7378E0F}\TypeLib\ = "{A82129F1-32E1-4D79-A39F-EBFEE53A70BF}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{23416CFE-018D-418E-8CE9-5729D070CCED}\TypeLib\Version = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{67550381-6239-4A05-B207-5C9DEA9239F6}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E2D56B7B-4B87-45A1-A6D3-5C77035141A6}\TypeLib\Version = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2E423AF9-25D2-451E-8D81-08D44F63D83F} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{44864E51-B63C-49C2-89CF-CA8F5F15564D}\TypeLib\Version = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7995CBA9-83E0-4F28-A50B-DFDE85EBCCD1}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4163399F-AB08-4E5E-BE28-6B9440393AD3}\TypeLib\ = "{49F6AC60-2104-42C6-8F71-B3916D5AA732}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A993F934-6341-4D52-AB17-F93184A624E4}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{81541635-736E-4460-81AA-86118F313CD5}\TypeLib\Version = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{96C7187E-6EC4-49BD-88C7-04A3A8A97CC5} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{18C5830A-FF78-4172-9DFB-E4016D1C1F31}\ = "IRTPController" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{32DF4C97-FE35-41AA-B18F-583AA53723A3}\ = "_IRTPControllerEventsV5" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{995A8F3B-6B5F-4773-898A-862D50142B4C}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BFC6C7E6-8475-4F9B-AC56-AD22BECF91C4}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{59E42E77-5F19-4602-A559-3FFA9EE51202}\ = "ILinkerEventHandler" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B1BDE8B0-F598-4334-9991-ECC7442EEAA6}\ = "ILicenseControllerV9" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CDA4F172-98EF-4DF6-89AB-852D1B0EC2D4}\TypeLib\ = "{332AFEBA-9341-4CEC-8EA6-DB155A99DF63}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79D77750-02E0-4451-A7BB-524ACD93DD93}\TypeLib\Version = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{995A8F3B-6B5F-4773-898A-862D50142B4C}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{07B91244-8A85-4196-8904-7681CD9C42A6}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EEC295FA-EC51-4055-BC47-022FC0FC122F}\1.0\HELPDIR\ = "C:\\Program Files\\Malwarebytes\\Anti-Malware" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{40D6E119-3897-41B3-AC5D-5FE6F088C97B}\TypeLib\Version = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5709DEEB-F05E-4D5C-8DC4-3B0D924EE08F}\1.0\HELPDIR MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7EF16D72-5906-4045-86BC-16826F6212FE}\ = "IScanParametersV3" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3DCF0F42-EF8F-4450-BA68-42B61F594B2F}\TypeLib\ = "{226C1698-A075-4315-BB5D-9C164A96ACE7}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B860FC17-5606-4F3A-8AE5-E1C139D8BDE3}\ = "IArwControllerEventsV3" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E8D2DC04-56F2-4F6F-8E11-8CB2BB337FCA} MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{46AEAC9A-C091-4B63-926C-37CFBD9D244F} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FCB473CB-B8B5-44A7-A3E0-D83AF05350DF}\TypeLib\ = "{74630AE8-C170-4A8F-A90A-F42D63EFE1E8}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D372F21-E6DA-4B82-881A-79F6CA6B6AE1}\ProgID\ = "MB.PoliciesController.1" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FFBD938D-3ABA-4895-97EF-5A0BDF7AC07D}\ = "_IPoliciesControllerEventsV2" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7968A0D1-5C9E-4F28-8C2F-E215BC7DF146}\TypeLib\Version = "1.0" MBAMService.exe - Modifies system certificate store 2 TTPs 11 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8DA7F965EC5EFC37910F1C6E59FDC1CC6A6EDE16 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0D44DD8C3C8C1A1A58756481E90F2E2AFFB3D26E MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\2AD974A775F73CBDBBD8F5AC3A49255FA8FB1F8C MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\5A8CEF45D7A69859767A8C8B4496B578CF474B1A MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F6108407D6F8BB67980CC2E244C2EBAE1CEF63BE MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\1C58A3A8518E8759BF075B76B750D4F2DF264FCD MBAMInstallerService.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1404 2026-07-30_8ff932ae4fa2327d55d5e34a10bf9d83_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1404 2026-07-30_8ff932ae4fa2327d55d5e34a10bf9d83_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1404 2026-07-30_8ff932ae4fa2327d55d5e34a10bf9d83_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1404 2026-07-30_8ff932ae4fa2327d55d5e34a10bf9d83_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1404 2026-07-30_8ff932ae4fa2327d55d5e34a10bf9d83_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1404 2026-07-30_8ff932ae4fa2327d55d5e34a10bf9d83_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1404 2026-07-30_8ff932ae4fa2327d55d5e34a10bf9d83_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1404 2026-07-30_8ff932ae4fa2327d55d5e34a10bf9d83_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1404 2026-07-30_8ff932ae4fa2327d55d5e34a10bf9d83_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1404 2026-07-30_8ff932ae4fa2327d55d5e34a10bf9d83_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1404 2026-07-30_8ff932ae4fa2327d55d5e34a10bf9d83_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1404 2026-07-30_8ff932ae4fa2327d55d5e34a10bf9d83_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1404 2026-07-30_8ff932ae4fa2327d55d5e34a10bf9d83_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1404 2026-07-30_8ff932ae4fa2327d55d5e34a10bf9d83_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1404 2026-07-30_8ff932ae4fa2327d55d5e34a10bf9d83_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1404 2026-07-30_8ff932ae4fa2327d55d5e34a10bf9d83_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1404 2026-07-30_8ff932ae4fa2327d55d5e34a10bf9d83_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1404 2026-07-30_8ff932ae4fa2327d55d5e34a10bf9d83_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1404 2026-07-30_8ff932ae4fa2327d55d5e34a10bf9d83_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1404 2026-07-30_8ff932ae4fa2327d55d5e34a10bf9d83_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1404 2026-07-30_8ff932ae4fa2327d55d5e34a10bf9d83_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1404 2026-07-30_8ff932ae4fa2327d55d5e34a10bf9d83_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1404 2026-07-30_8ff932ae4fa2327d55d5e34a10bf9d83_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1404 2026-07-30_8ff932ae4fa2327d55d5e34a10bf9d83_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1404 2026-07-30_8ff932ae4fa2327d55d5e34a10bf9d83_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1404 2026-07-30_8ff932ae4fa2327d55d5e34a10bf9d83_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1404 2026-07-30_8ff932ae4fa2327d55d5e34a10bf9d83_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1404 2026-07-30_8ff932ae4fa2327d55d5e34a10bf9d83_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1404 2026-07-30_8ff932ae4fa2327d55d5e34a10bf9d83_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1404 2026-07-30_8ff932ae4fa2327d55d5e34a10bf9d83_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1404 2026-07-30_8ff932ae4fa2327d55d5e34a10bf9d83_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1404 2026-07-30_8ff932ae4fa2327d55d5e34a10bf9d83_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1404 2026-07-30_8ff932ae4fa2327d55d5e34a10bf9d83_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1404 2026-07-30_8ff932ae4fa2327d55d5e34a10bf9d83_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1404 2026-07-30_8ff932ae4fa2327d55d5e34a10bf9d83_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1404 2026-07-30_8ff932ae4fa2327d55d5e34a10bf9d83_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 1404 2026-07-30_8ff932ae4fa2327d55d5e34a10bf9d83_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 4444 MBAMInstallerService.exe 4444 MBAMInstallerService.exe 4444 MBAMInstallerService.exe 4444 MBAMInstallerService.exe 4444 MBAMInstallerService.exe 4444 MBAMInstallerService.exe 4444 MBAMInstallerService.exe 4444 MBAMInstallerService.exe 4444 MBAMInstallerService.exe 4444 MBAMInstallerService.exe 4444 MBAMInstallerService.exe 4444 MBAMInstallerService.exe 4444 MBAMInstallerService.exe 4444 MBAMInstallerService.exe 4444 MBAMInstallerService.exe 4444 MBAMInstallerService.exe 4444 MBAMInstallerService.exe 4444 MBAMInstallerService.exe 4444 MBAMInstallerService.exe 4444 MBAMInstallerService.exe 4444 MBAMInstallerService.exe 4444 MBAMInstallerService.exe 4444 MBAMInstallerService.exe 4444 MBAMInstallerService.exe 4444 MBAMInstallerService.exe 4444 MBAMInstallerService.exe 4444 MBAMInstallerService.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 664 Process not Found 664 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1404 2026-07-30_8ff932ae4fa2327d55d5e34a10bf9d83_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe Token: SeAuditPrivilege 4708 fxssvc.exe Token: SeRestorePrivilege 3224 TieringEngineService.exe Token: SeManageVolumePrivilege 3224 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 3036 AgentService.exe Token: SeBackupPrivilege 1448 vssvc.exe Token: SeRestorePrivilege 1448 vssvc.exe Token: SeAuditPrivilege 1448 vssvc.exe Token: SeBackupPrivilege 3884 wbengine.exe Token: SeRestorePrivilege 3884 wbengine.exe Token: SeSecurityPrivilege 3884 wbengine.exe Token: 33 4064 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 4064 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4064 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4064 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4064 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4064 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4064 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4064 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4064 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4064 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4064 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4064 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4064 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4064 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4064 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4064 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4064 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4064 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4064 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4064 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4064 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4064 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4064 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4064 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4064 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4064 SearchIndexer.exe Token: SeDebugPrivilege 1404 2026-07-30_8ff932ae4fa2327d55d5e34a10bf9d83_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe Token: SeDebugPrivilege 1404 2026-07-30_8ff932ae4fa2327d55d5e34a10bf9d83_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe Token: SeDebugPrivilege 1404 2026-07-30_8ff932ae4fa2327d55d5e34a10bf9d83_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe Token: SeDebugPrivilege 1404 2026-07-30_8ff932ae4fa2327d55d5e34a10bf9d83_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe Token: SeDebugPrivilege 1404 2026-07-30_8ff932ae4fa2327d55d5e34a10bf9d83_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe Token: SeDebugPrivilege 4444 MBAMInstallerService.exe Token: SeDebugPrivilege 4444 MBAMInstallerService.exe Token: SeDebugPrivilege 4444 MBAMInstallerService.exe Token: SeDebugPrivilege 4444 MBAMInstallerService.exe Token: SeDebugPrivilege 4444 MBAMInstallerService.exe Token: SeDebugPrivilege 4444 MBAMInstallerService.exe Token: SeDebugPrivilege 4444 MBAMInstallerService.exe Token: SeDebugPrivilege 4444 MBAMInstallerService.exe Token: SeDebugPrivilege 4444 MBAMInstallerService.exe Token: SeDebugPrivilege 4444 MBAMInstallerService.exe Token: SeDebugPrivilege 4444 MBAMInstallerService.exe Token: SeDebugPrivilege 4444 MBAMInstallerService.exe Token: SeDebugPrivilege 4444 MBAMInstallerService.exe Token: SeDebugPrivilege 4444 MBAMInstallerService.exe Token: SeDebugPrivilege 4444 MBAMInstallerService.exe Token: SeDebugPrivilege 4444 MBAMInstallerService.exe Token: SeDebugPrivilege 4444 MBAMInstallerService.exe Token: SeDebugPrivilege 4444 MBAMInstallerService.exe Token: SeDebugPrivilege 4444 MBAMInstallerService.exe Token: SeDebugPrivilege 4444 MBAMInstallerService.exe Token: SeDebugPrivilege 4444 MBAMInstallerService.exe Token: SeDebugPrivilege 4444 MBAMInstallerService.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1404 2026-07-30_8ff932ae4fa2327d55d5e34a10bf9d83_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 4064 wrote to memory of 2808 4064 SearchIndexer.exe 110 PID 4064 wrote to memory of 3276 4064 SearchIndexer.exe 111 PID 4444 wrote to memory of 5172 4444 MBAMInstallerService.exe 124 PID 5736 wrote to memory of 5768 5736 svchost.exe 129 PID 4444 wrote to memory of 5992 4444 MBAMInstallerService.exe 130 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_8ff932ae4fa2327d55d5e34a10bf9d83_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-30_8ff932ae4fa2327d55d5e34a10bf9d83_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe"1⤵
- Downloads MZ/PE file
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1404
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
PID:5004
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:4788
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:4496
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4708
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3760
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2648
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:3384
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:416
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:3436
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:1872
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:116
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:3040
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:8
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:1196
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2948
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:1464
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3224
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:2520
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3036
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:3236
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1448
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3884
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:2780
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:2808
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 7842⤵
- Modifies data under HKEY_USERS
PID:3276
-
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵PID:5348
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 7842⤵PID:1832
-
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies trusted root certificate store through registry
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe" /installmbtun2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
PID:5172
-
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe" /Service /Protected2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Modifies registry class
PID:5992
-
-
C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Event Triggered Execution: Netsh Helper DLL
PID:5476
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:5736 -
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "9" "C:\Program Files\Malwarebytes\Anti-Malware\mbtun\mbtun.inf" "9" "4ba9030c7" "0000000000000148" "Service-0x0-3e7$\Default" "0000000000000158" "208" "C:\Program Files\Malwarebytes\Anti-Malware\mbtun"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:5768
-
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"1⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
PID:6092 -
C:\ProgramData\Malwarebytes\MBAMService\rmode\mbrescue.exe"C:\ProgramData\Malwarebytes\MBAMService\rmode\mbrescue.exe" /rescuemode "C:\Program Files\Malwarebytes\Anti-Malware" "C:\ProgramData\Malwarebytes\MBAMService"2⤵PID:4816
-
-
C:\Windows\system32\DRIVERS\MbamElam.sysC:\Windows\system32\DRIVERS\MbamElam.sys1⤵
- Executes dropped EXE
PID:776
-
C:\Windows\system32\DRIVERS\mbamswissarmy.sysC:\Windows\system32\DRIVERS\mbamswissarmy.sys1⤵PID:4232
-
C:\Windows\system32\DRIVERS\MbamChameleon.sysC:\Windows\system32\DRIVERS\MbamChameleon.sys1⤵PID:5748
Network
MITRE ATT&CK Enterprise v16
Persistence
Event Triggered Execution
2Component Object Model Hijacking
1Netsh Helper DLL
1Privilege Escalation
Event Triggered Execution
2Component Object Model Hijacking
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
1Safe Mode Boot
1Modify Registry
2Subvert Trust Controls
2Install Root Certificate
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 52b8d6555da109b59c7ac039710c0aab904d0dd68ef1eebbe8bea6af893388eb
- MD5 f5a6f0242dd83028feb857abfe578d16
- SHA1 454978197d4d5871ffd35277ee2c5a36c949af5f
- SHA512 ecfebd7aa0bcd2b5665887223d67da0c3663dc25586cc575606d490855360f69d8b331ab8ce57cc037e4ef4e5704fada89dbc4a2ac1b5a6f6574e09c6cd52333
- SSDEEP 49152:ob+632BuPkFKRrdE6ohrstBhuXjfS4LWxnE6mGvKVO+n1:C3q60jBbXeN+1
- TLSH T1B2D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.6MB
- SHA256 4e5ca6bd4105e705755912c0dee416925f08b5362bf842047671400591a59bd0
- MD5 cb39898f62f28b52a29a129bbcba035b
- SHA1 e79899495a9201940f3ac2aeea3d189ee8b52e30
- SHA512 db017b5ae8b3a3ba812f51a20a8bc39cbf545e1593111a0a6882aa8772d23815e5a179ca1e2a9ccaae6effbf6b5ee869cdd0b564a8f99a64412d7dfb54c19820
- SSDEEP 12288:S1XLsswWkxy2lRq2czAXtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:4XYfDtczAX6mctvE/BT76+1NCE
- TLSH T1CF850224779504F9ED6B4278C9A2C112EA737C9547A4E7CB03E4892A1F333D85E3EB52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.9MB
- SHA256 bdd36f368054640da405d95b695a8df8c70e959b2a889b03d5f275f4ee6afa25
- MD5 357aeeae55727302d51d9ba2257b80a1
- SHA1 11b5339c3da7dce45837ca37983aa6b64e9aaf5a
- SHA512 0d21947d613f7efbce7e8e2a110fb6d8558956e56975a8b8dc053db4c447ef8910ea1710d98aeed1a8f17c4c6e176587ddbb26f5fa6d198e33b9f5b433ec8127
- SSDEEP 12288:1XZNYVLeyUji0h90ZD0wxpGZIVutrHsstM6hct28uP18WR/FW2Gb8JTCMMK7LIFq:b0Le5ji0hmxqrMs6mctvE/BT76+1NCE
- TLSH T128959E16F6748331D073C0B9C5D2A69EED7130865B308ACB4286D77C7E67AE6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 940760d0e51851651608876e01a632d2dc8855c2e47c57ff2fe69e687294518d
- MD5 c9d35cecbb314a2c8492676a3e1d8ff3
- SHA1 0858caf1bf9d763e2dfe25d07d1918ea29739bcd
- SHA512 8cd344559b85d69387e2c8c6e88315ff98d0053a6814c8d649350de98004b0faca1bb4fc8f66e153a1c582e5936c1167290caf4fc8caf7a64af24e9002a236f9
- SSDEEP 24576:Za7/ezSC6vUyD/aqgrvWr6q8wyuG6mctvE/BT76+1NCE:I/ezSC6vUzPviHjyh6mGvKVO+n1
- TLSH T1E0755D15F5788323D0B2D0BAC5D6BA99FE7230865B3089CB0246D76C3E277E68536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 705b9d3972aefbfa5b41f851b13780f22332e129bfcd29801a5f4bc40d0f3bd0
- MD5 de98d7b66dee9d84737b3b4a2bd9e37e
- SHA1 31a437c9cfffc3d364b1c1e0e9ffcd4bfd1ec74c
- SHA512 b21617a939f9fa8f0bbfc84a7a129c96c045dcdd5a98c2a4b73fe4dac753cdfc77a4cb038b607d61934e82436fee9114abb13c49f767abb550c8d7c5d0352346
- SSDEEP 12288:aVJjBq33vb5O8M+l1D0hwsEBoW/lx45f0Im98LtM6hct28uP18WR/FW2Gb8JTCMx:aVbqPb88hv/l+bL6mctvE/BT76+1NCE
- TLSH T1B155AE66F5748331D073C0BAC5D2A69AEE3234425B318ACB1246D72C3E677E6D63A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.4MB
- SHA256 326fa6690d52f8368dabd4802acc847293442b8e11096d9de66ea96a06ea70fd
- MD5 33d67f85ac7400bbae3e8e65293c360f
- SHA1 730fc676ec99b71ca4d0f81b9cea25a97d4a0328
- SHA512 d98c420816cb626e587d90366b5aa717a2795e3990570af36c20b7d15843c2647e25814fb992a1b9162b00f47a9860d4dfd5a267994690d427801c7098ec809c
- SSDEEP 12288:tMAtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:tMA6mctvE/BT76+1NCE
- TLSH T1AA652382881B11D0EFFF07F06395E296E8516EF978DA1C81D322991F9D30162FD0B9A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.6MB
- SHA256 51e52c5fd19b2569ee65918c1f4206f6bab440db7c27498d61b50128fb512c85
- MD5 e0948c315a80631c2ac99a1ccae9512d
- SHA1 20837b32bd047d08413c1957da2b7055133dc150
- SHA512 58960af19ea0b259b670f5f821b1ca61e9f701d6c545b21457c2152f14e2a303d98158846f0e26b11fd86a5e78319158060febfb9d648f9bd06ce3a64580c837
- SSDEEP 12288:ueBNUbTVO86UTtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:uJIUT6mctvE/BT76+1NCE
- TLSH T1A885CF7BEE28FCD2C27E4DB85691C240E77278704B52A3CBD165820EDE235E15E7AC25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 383b3cf31bb02d87bd874a00f0fbef9cf8c63adab4cc6ae4ecf08ddc61dbef4e
- MD5 de3197f3bdc42d273ad2efa43193dfba
- SHA1 09f3493155149be1d2d5162da4164c8037655cb9
- SHA512 c3c037a68348fcaaf832201c17b190573ae6e2a7fad038bacf0b6c321f237d2c1375aac91487ee3386d3dd6ac31b7e15ffeae0dde31ab9cd3ee17a9aedba6a10
- SSDEEP 49152:RQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THt:RQvGAdlCEL8c/RRNw5C2XeN+1
- TLSH T119267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.7MB
- SHA256 ef64cc5a10c6f7d37925a0e6905f0e29b9001f088506b550acdb95ba5f9769f4
- MD5 7a4657e6bb8c60282c222ea772d7e80d
- SHA1 4cb5f8ba0215d9c6f70f2e007764728f92387f3c
- SHA512 788f018475e56393940c58ad0c42f2d80f3f30717a403d8fe6ce64f0d611791607ba72e6ebe6d0922538b51e81a7042411f6649091878c822adf6d9ab6dee8aa
- SSDEEP 12288:NAwSfxL/2Dc3+DLLmt0LDQewsAjVtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WG:+rewsAjV6mctvE/BT76+1NCE
- TLSH T1EE85E031FE75E036C7BF0DB21B26D316546C7A604B9219C3E3A88E9E59302D22776E17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 3de0ccff70a7c5834ae018498e803ec8cc35819af76ba574c2bc26062b82dd68
- MD5 8cd95a35eed40146d49a33aa16434f88
- SHA1 6022c89319d87c3c8d4b6937af8deef1e67d6daf
- SHA512 ff34b6d92d31ef50d5613f997a84d45efb727e58660245655e436be7fd61483acca6b1c289a0dde26440edc203931b1e51369a84439bb6281e992217e1e12d6e
- SSDEEP 196608:sUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHNXeN:sUEtQevvqc2W1cpV2RI32Ne
- TLSH T121474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 959731cc4a69482ec146b12afb27b3b6ea2926b73d6c7e8fb473dc4248df7ac2
- MD5 bd1cd89beb8f6ed86f4269da695f71c7
- SHA1 8cba69b473400b1536c69b54c57ee1acf8b7dfca
- SHA512 9d38d5b4b5930cf4eada2ea3a47da28f714fa11f0667c9c29f36a81d5e38e47bbe910ab251c82206d794808db76ac39a94baf094396062cbfb020a9b58319e4a
- SSDEEP 49152:UCbRquA/m2yL5zQfFiV+XenmE3/z16mGvKVO+n1:9oqtVjnmyXeN+1
- TLSH T199D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 536c49fa6ab9e77f354f13aac8b13fb3c40a0f26a13fa8af7b8a9e1dc27ae5e3
- MD5 0643b9e43dac50032cb43300d289db1d
- SHA1 5710c34c72cef536c52f7a0b0a131359bcd4245d
- SHA512 43ddad1ea4e17ee21c060da4d0f8a53091e3f2d950a5798e4da3ebf29b33c7fa8d46ca605901ae751774da068dfb8f5b1140e56083a492469186c08e0b4d622d
- SSDEEP 24576:xAhGL2IFoiwtA5l7S53S6mctvE/BT76+1NCE:xAM1Foiq5i6mGvKVO+n1
- TLSH T1A6359E81E7F951D4F5F3AAB899B69171EA76BCAA5E31C20F2150C11F0E33A509D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.6MB
- SHA256 676ff14cf69f34b8d115664f7d05ef440aee9d47a3bb39b8d9890dd4b1b57fcb
- MD5 93d0860899f654fccb530cd296314253
- SHA1 4fa995df1dc4105b2e4bd49376e77ea55f6165be
- SHA512 88581fedbce06f5487a5f6ea866b8f26c3b6871730a69eefb858e18f0b0d5cdbb4b9479333388bc41c4c95634bc050c18ecd629c888c36da5d87e2845e309967
- SSDEEP 12288:kmw5HEjsChNDBFgl0WDm+CmtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwL:Bwu2OWB6mctvE/BT76+1NCE
- TLSH T1C075F14676A508F8E9A742388657C136F7F2BC513A25DB1F1360C61B6F33261BD2EB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.5MB
- SHA256 bf5cabba22495f09e42c5aaed79ea835ea4cfd55f48d83c30fbbb16956342ffa
- MD5 d7a360e77fd0319d1b3d751e27236cf4
- SHA1 9df09ff025af9624185d8ac49ab664fbf2103592
- SHA512 caebcd7fa0e901ba434e12a94df792a3009132f5e094db8a0f34efc692d413e322b94606d323a972898b0f8af6b23d24248c09d1d9f21168a7ac967b082e41ce
- SSDEEP 12288:EMZ1IyFtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:zZu06mctvE/BT76+1NCE
- TLSH T1DB651286226520F4E5E702B8C9E19245E77178E6377603CF5221466F6F33AD26D3AB33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 240446661e85a40d3eb737bd3c5f0a9552dc6f3d0d855d75dd1f6ff6d09a5928
- MD5 60fa25bcc83cb7ee49bbc5b4af5cb514
- SHA1 aea3f57c6909c60359c3dc0b2191e2fe470d1c39
- SHA512 2f932fb9c288ab362fa0dc2f0cca46b4f695c671fa98802b69de58b40fc1627ab2fdb8c7d7c39a31b5639b2a46af725230ebdf188703a81478cd3c10c4601a7b
- SSDEEP 49152:Zj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23Uh:gQRQyi36YOcPhLvw2gAf+PN3fXeN+1
- TLSH T154667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 705ca9ed2011137b93006729ee667368c7604af2bb0e6154bf2f0ae1d05b3a71
- MD5 b14e6fa32d0c079168c118712d4f7e16
- SHA1 141a36cac19b950d4f7faddeab1d95c1aab69091
- SHA512 0545b284563d6eba5b68530feaa626ede74f3a228d24da38084ca2dfb91d4df592a0a0df1ece92df81ea93d03fc0b1634e522c01e02f541873c8e724eb66e23f
- SSDEEP 49152:Hj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23Uh:2QRQyi36YOcPhLvw2gAf+PN3fXeN+1
- TLSH T183667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 7c3ac1c8e133d78ea1af377e4b1fb825eda80c1499464e76f53aafb4318315cf
- MD5 7fc2c7dd7d5f58c92e46836aab33ddcb
- SHA1 2a19a331ddad97febe684bfe43aea89605016adc
- SHA512 4852737758b896e1464d7a813b667cdef8f958630620b5bb80cd6d5023d914d52a70543fec4ffc337ca7b3ca7aaf40c1a51b3bb0bb882f65b72b97e635e2d4cd
- SSDEEP 24576:lwvLof6SRQ+rn/fDboqxN1nnh6D7DaHGTNHu7PNU3/5W/ohL0E6mctvE/BT76+13:B68Qg55nhceWu7PNU3/l6mGvKVO+n1
- TLSH T170B54933B2F600A9C44DE1769F4A872196D17C758FE1E3DB8511720A1BB2AD07B3A71B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 2a8f952293776e552b978d54bafbada18dd5becd93126482a2fe4ac7212955ff
- MD5 2a6326d930ed9fb5d1fb12261fa6a51c
- SHA1 cb80b2668e21ac691ae77ae150edac21fb55abfc
- SHA512 ffa475953e8b9bc775930e37720671f29e0b75e2e4b365d1636fe69eaacaa511d8fe86e16014d5a8c4c74ff6aabb01c1c1b933e096c95db10181824845e9207e
- SSDEEP 49152:n3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpN3Oh6tznm2FQ/nho2qkrk99v:Ky5112gYy5azzVva69nLKnhZAXeN+1
- TLSH T111167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 e015e0303332aed2400f8326f7e51bac16eed130a7d135fa8741b54f886c0468
- MD5 70ebd63717bc5d9841b4f8c563deae83
- SHA1 baa9f916ba511e75941866677e18465c64908c0f
- SHA512 6d135c22cde99b7c64af3e85f741cd2b90c93d3b02336eb9f8ee0f4a69519ac3eb2bf3dd0bd054cd1b099b77b9a2a50ea5a03de4a0c3f96e1c93780c094cad57
- SSDEEP 49152:9B+taZ3usBWOBr4tEG20bqx0z+n217aau1gln6mGvKVO+n1:ju6JmUxd2dnXeN+1
- TLSH T136D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 5021f0cc4640f3a6793fd736cb7e11461912e7eea7482d6f9c05acf0b0825b0a
- MD5 bd430bb40c754005d5be5afc4901a7b0
- SHA1 4259afeeb63109227525356d1017d38c6dde22fe
- SHA512 95ce0c711388e71d5635b4651d86b80b20ca5bf6f9913064d643f19c266d1c03c21bde73e110d70a5b717d2e5b3a379a4ff918e4469dde49e8c6ec7b4180624e
- SSDEEP 49152:A1hpsNoJpF1A6BU44CwH7R4xz6mGvKVO+n1:AmifPkRyXeN+1
- TLSH T18CB5BE13F29900E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BBE46F3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 1839a84be2659c03c4c4775f238e68d9a16cf17f0e2b85aca6f2a816b789a159
- MD5 b1b77c6601dccd8f440dffb9debfc149
- SHA1 36b1cac48350e4597940689152f6d446f0fba34c
- SHA512 a7b3aa98d5a5421402467059d44f5584cf02ae5ce194a50a41815707bd35c562072e55187d383036bd838dd798e80c08d4e4bd01513a04cbea210899ade980aa
- SSDEEP 49152:+SuZQIY0Be2KNRVtOnks6NMHq06mGvKVO+n1:Q5dKvi610XeN+1
- TLSH T136C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 44f08ec5d64bbff8efbd2b068c3989ed515d165a40883f12dffcf53ed226fd55
- MD5 55845e6d17f955bac0e0d9e6195f0172
- SHA1 d4cd71d823fad72018a34c4963794a9f76a5b6b9
- SHA512 32edf6edc1a5526c6b5add5c8bcba258072549c6bef222dcc822433daff6d004a84a86eed653a9c0f4091d30a530549b9d3c5042c87ebc558cafdd6fee8d9aea
- SSDEEP 49152:YhtSn8EApI0figXgiDn0AP5wX6mGvKVO+n1:JX2iyphOXeN+1
- TLSH T1BA95BE13F2D900E8D05ED174C7468632E962BC160B39AAEF0A90B7561F7BBE45B3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.4MB
- SHA256 1401aae31fd7d859e6812efb0fb43d8d0a454d0483f1aa8389fce01be59f8e12
- MD5 1f483dd181a1dec6892f5cd81e39c86a
- SHA1 fb7fa4528a2fca6d82b520d00184858000649800
- SHA512 294d5c717406c174f4940dcb180ca51a20f272b991f1ded0b85bfb91a2404f82cc6b007fb4e28de7e81d0e7da97f0ec7fe83857a8cfbb6f9b4fd52c40e8704e3
- SSDEEP 12288:cItM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:cI6mctvE/BT76+1NCE
- TLSH T1D1652381981B01D4E9DF07F19395E29AE8502EFE74DB1481F326851FAE305A27D0FDAB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.4MB
- SHA256 5c040b829ff760553455783cfcae1cbaf056061ee39d33b7fc4fc31f0d240029
- MD5 32f31e2debde50f36d8215094965743e
- SHA1 e8b0d09c7ae64af7f5139349d3441e0d5c4db812
- SHA512 7b0e4b3544704623b27054dc7f912fe223b96c0f45fff007ba855e5b36a00f627bd43dc62045c2b8fbe75305fbeee8d67943f65d1d583f6b5fff3198aa01abdd
- SSDEEP 12288:PZtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:PZ6mctvE/BT76+1NCE
- TLSH T1A6652382981B01D5D9DF07F15395E29AE8502EFE74DB1881F326841FAE305A27D0FDAB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.4MB
- SHA256 d7394c1990f46a9dd9989ca7d293d7c8c230b2e7d54b095b1d4248234f2be025
- MD5 7bec9e44a6005b60b9997571afdfab9f
- SHA1 70ea8b6601c2bd47df40cf9a0db35e83c3cda582
- SHA512 00294415bec352a16bcd77b3655c6cc6e13f397dc3b4b4cdf40ada95e0a488e8779e4a0bc5aabecad360c8d3879f5be2ecd5928afb542b8e3b8b7ecdb85dcf5b
- SSDEEP 12288:EbtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:Eb6mctvE/BT76+1NCE
- TLSH T154652381981B01D5E9DF07F15395E29AE8502EFE74DB1881F326841FAE305A27D0BDEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.4MB
- SHA256 7fd2ed13654346e680091f63a7a3a49aee9276ba15d8dfac6c1a4482ab3deaa5
- MD5 33ec78b801a1b344b2c23de0b109b32c
- SHA1 7ec92c9200b318f6665bfc1f78b00e47faa2b914
- SHA512 5262fddc020cdb675c271b03f2b7fdf7f48219d88d3c650c0f8f96d6ef509c7659c6c9d3cb0621078ad7b8541442a6d1f468494ac30c38f79b4ab4e04481c07d
- SSDEEP 12288:wVytM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:T6mctvE/BT76+1NCE
- TLSH T1A5652382692B01C0DCEB43F0C6A2D296E5B07DE975A719CBE311491F5E303917D2AFA7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.4MB
- SHA256 aa2304bb13b9dadb987b933774370aeca9296590bde9d18767719a092a6f96a7
- MD5 6bfa71dfa5dd43be247cebd034fa82a6
- SHA1 251feab31b162115ceb0293dd5a7701899b0d6df
- SHA512 f96d0e5d06154df6fbaf34671d6069b0e4bc5c535374c2d408d48cdfec65f6fc60bcb689016748eec254aab10b01fc14c914e39f170e0d99ec34932fbe725040
- SSDEEP 12288:HKtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:HK6mctvE/BT76+1NCE
- TLSH T18A652381981B01D5E9DF06F19355E2DAE8502EEE74DB1881F326841FAE305A27D0BDEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.4MB
- SHA256 4e8db2efe5a29252312bc96dbd3fd2410fea4f24b99eeacc6ef19860dcf63454
- MD5 dbe84bb9d63cf548046e709218691ba5
- SHA1 d9f705bbc7e0cc7c74c39286077e438f68a6c115
- SHA512 3924c8fdbf0f533ac287ea9239e72c44d1a0294147dd7f5b0e08abbcaa20edf7b026e257b5090ba479637779deeeebbc43bb9b2ae6367d649240f2407bfeb678
- SSDEEP 12288:A9tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:A96mctvE/BT76+1NCE
- TLSH T1E8652381981B01D5D9EF07F15395E29AE8502EFE74DB1881F326841FAE305A27D0FDAB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.4MB
- SHA256 0edff76fb18f805aedb756e87bbede75814ca27bb89e304705525fc698b3eb21
- MD5 958325ef0b26af3303b883f49257a3a3
- SHA1 53292d6da78490f881124a7b784de197bf7ab67c
- SHA512 115567b2f69b37dd7991cb727aa86e430d1cd964fc53e1bbb03a8e283ece860ae954d6b776d935a37cbd0293d0b71d6795170f36f1612dac96a22f328d4c5cc2
- SSDEEP 12288:ORtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:OR6mctvE/BT76+1NCE
- TLSH T1BE652381981B01D5E9EF07F05355E29AE8502EFE78DB1881F326841FAE701627D0BDEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 1.6MB
- SHA256 b8157b598e2b08c5812aab02785ffeb16260d919cf41f57840121c241d3e7fcc
- MD5 4cd8df791353f893bff49cdff6ba7c29
- SHA1 b6b040e5909882ca193ceb5cd833c8572a4986d5
- SHA512 2e1b91e0eb1bc0811d5a4e790b107dce90614cf25f327dd0420cf221d6f44341dbb073f138bdd482a43450d5144d8dbd1451392571357222e2f8ab7607730359
- SSDEEP 12288:DiZwbrzzFEoS2cPvy5tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:uZM/zFVSO56mctvE/BT76+1NCE
- TLSH T1DA850295B35118F4ECA7427EC9558506D6B27CAA1AB0C60F13B4362B5F333A11C3EFA6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 1.4MB
- SHA256 96d49c8861d2d2606cb481ba59bc6056bfc038d6acaad3adf8232dbe5a5c4e39
- MD5 5296fc275cf8d5fc664e5b7bd5743298
- SHA1 99080cff411fa2f68e167ee95dbe848d0da8dc8a
- SHA512 b86cbf65aaa8ed9a0b507ff461bacdc8176af897c1da286279a9406410465001a025ff246737d28dc591c7696da7d80bce720eb449ceb002025c0848ab472167
- SSDEEP 12288:FktM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:Fk6mctvE/BT76+1NCE
- TLSH T13B652382981B01D4E9DF07F15395E29AE8502EFE74DB1881F326851FAE305627D0FDAB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 1.4MB
- SHA256 2a49b551017c27504b65773af63981911f2084b1beb9a9e46e59eb251dd2b4d0
- MD5 c38f0888180f5fdfffee649fb5293772
- SHA1 6ba6b1065e1e49355ebe30b09a07fac8f6385dc9
- SHA512 28e192358c1b6ffe2d4231e3e8f9cb559c8a59ea2725e2435b9d2abccda8759bee825e52a83c89106ba9f1b56fb4fc9a93d9406208ea1ee3d9288986f01af8a8
- SSDEEP 12288:OwtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:Ow6mctvE/BT76+1NCE
- TLSH T12A652382981B01D4E9AF07F15395E29AE8502FFE74DB1481F326851FAE305627D0FDAB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 1.5MB
- SHA256 9549b0acdf8121ec82cb191b78fc48242be9f733562c537913ff83bfd6905181
- MD5 23bfea5c313ad3e53764d34553fc2509
- SHA1 20ce0d1814387c570d24a9cbc4045da8734a56e3
- SHA512 985cfbe4ace2a588f97bbf7c4f849f6bc156c45d753a73b386c04d9697cafb7d77f9eb88fe4d180dcf37a0be80b7d45faabce4ae9e0fa2768f2a43b04c7ff2c2
- SSDEEP 12288:gyPz5L8FtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:RzyF6mctvE/BT76+1NCE
- TLSH T11A750143726630F8D57B4274C9A25202F77178B62B654A9F5360463B2F332A1AE3FB71
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 1.4MB
- SHA256 15d35293b6ea37ff239c0dca9e531ea7090ac0163221ad2bfe3cba3a37200ac0
- MD5 71c9be2db0af58bd58f8cd2c795724b1
- SHA1 003cf60d5266d7a3295300f1e43366f01a7032d3
- SHA512 53844fb8e964e08ea04cac4b6faf4a98cb647b05155f2750183bdd67db6e3abdbc4977d9469c5d08e438ade2664062fb49c9990ff1e3f60fadd742d7a2d26efa
- SSDEEP 12288:rktM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:rk6mctvE/BT76+1NCE
- TLSH T18A652382981B01D4E9EF07F15355E29AE8502EEE74DB1881F326851FAE305627D0FDAB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 1.4MB
- SHA256 988ff2e003ed7e2df52094479271473221881a3c03c1b0d0efe3c2e63a361b1a
- MD5 50302e206d8f182a7935235aa5bfeb18
- SHA1 3e95ca5054c4a4df9bdb75b7c2c867bc5de0c852
- SHA512 73504c3b0905fd62085c7a6dbd7bfa055eeea3da393d1cae155c3988ee15ee2c49da967ab4c7feea1afd88e2e4852f3f653ee71807ec6d7f9edf99bcfa58d64f
- SSDEEP 12288:NktM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:Nk6mctvE/BT76+1NCE
- TLSH T187652382981B01D4E9EF07F15355E29AE8502EFE74DB1881F326851FAE305627D0FDAB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
- Size 10.6MB
- SHA256 d10e04217f81b44667c6237971f1f2843d132220c8712e8a855436e9f1f73baa
- MD5 cdd8c06c1f88f57727813906e3a58fb5
- SHA1 4ba873161c0ab0f489bb0c82a267aac8b0cb91dc
- SHA512 40fb64f723481e9b8e24d88edff74dbb85b2e63790595c067b01cc5986ac3a0fdeef0d8083e4c86c0e2681837cb53eb98e7bda2bcb22eb77d1b8330e2d72ef73
- SSDEEP 196608:PRO3j3Ld/5Mo9/vEvt2teG35tTdnXo9076gZCN3R9i:PROT7d/6o9XEvt2teG3p42Yi
- TLSH T10DB69E17A6B400E8D4F7D238CA579A03D7B2B81643B197CF0690567A1F63BE19E3EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\MBAMWsc.exe
- Size 4.2MB
- SHA256 7878a9b10903b8c0def49015deefd48a3ea0e46c0f5ac9ae755336994e020152
- MD5 acbb82943fe0d5f1c5df74b1a7dccd2f
- SHA1 c41e38f59eff5e40a6a47b14be44520dcd6d405a
- SHA512 7092748502f06bf05df19bd2d4d5857f161a35a9b2e3a72645eaacffacae7a8dad10ab41ad3b80d3a63ff0773b6c818edf3769ce6b1f61b01cc92edfb755dfc5
- SSDEEP 49152:dK5b4+V1qsR86LMFRbbX8DREqUaP7bBfnuF0JRlnPkokPmsBLdS4BPQRzU/81fge:i86kyaHF0JRlMhBpMyok3M
- TLSH T1C6166B06B6A540ECD866C239A47A8503E7F2B811273097CF066853761FF7AD21EBE7D4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.json
- Size 621B
- SHA256 a80015a6eec91c975ae3677751e55e411ccfa294e4b29e22329510ddd46f416e
- MD5 574fda985e84f5b3946c0e68867a8617
- SHA1 7671de064bf81bac540cb27b27b6a1b1cd2d8422
- SHA512 d0624bb036d6f3b90c0c942f74cac12a2705290b78595e28a6b83d60bb52fbf3fe95d004dd55d54e6d01916ca85f5fddd55fea03bec768e527c5914392f21ef9
- TLSH T19FF07813A66F82FB15709A9846650087FA24839D1214590FB7F4EA94CEB6C2986C2C84
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.json
- Size 784B
- SHA256 8615d27fc9298e0444406990796ea9dc2655d71e4bf711086982a3bc597587f9
- MD5 350fa05cde9535b0fae5d02416278213
- SHA1 e0d796bd2056c57962030682d92a9f2fa749ef49
- SHA512 8ec7dc5b21704daada1e3c5e1a9a19d444a62a4ee2a34d49202d2264dc072b495853680d46a27f7d33712bcbc69299cbf9992d017d624fa62993736303a870fb
- TLSH T1C901DC13A52A86BB59B4179854A808C6F774D34E1210190FB7F8EA85CEF78266BC2D40
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\malwarebytes_assistant.runtimeconfig.json
- Size 615B
- SHA256 61fca252e8e336706f4c153c16100b7b621f9092ed09bb6959e406ab5bb21e85
- MD5 389f208d959c5ff4ee9c0e4dbbc31ecc
- SHA1 32243920d3687a1b8af307a3ae140103ec08f222
- SHA512 86dce7141f4fe9fd938f8b5be78d9e9d9885365d7ea7d4d3cb0674ea63a9201f4f0e02ceef47819b9d596a2e397fa68c78e9dfd15acf804ff93fca0f55b1997b
- TLSH T1C5F08B29CA106CB718B8337ED125C083EA30133B10002C56B4FC080C7F775B62221F96
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\mbtun\mbtun.inf
- Size 1KB
- SHA256 4a350fc20834a579c5a58352b7a3aa02a454abbbd9eecd3cd6d2a14864a49cd8
- MD5 5d1917024b228efbeab3c696e663873e
- SHA1 cec5e88c2481d323ec366c18024d61a117f01b21
- SHA512 14b345f03284b8c1d97219e3dd1a3910c1e453f93f51753f417e643f50922e55c0e23aab1d437300e6c196c7017d7b7538de4850df74b3599e90f3941b40ab4a
- TLSH T1CB4140BD48D20AB83C673356671B69C27BDC220145C920ADB2DE8606C88EDDCB905EB9
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.cat
- Size 11KB
- SHA256 33dbca74f9364b66974d987b20505fd9298707f42fa8d2f636d8362e470b410e
- MD5 92ece2e13283144da6dd4e0a1b6ab04a
- SHA1 cd0acbb0fee1fa9f41b82b7dacd6405e07beadf5
- SHA512 0f1e79c6be4d29566f5e8263fe78c61e3ee1b04b16bcc1c0aa165b715c08b91ba7a82690d8c92fafa6a9cb4918e27ec459630480c2a00fcedd72f4b5ccf32076
- SSDEEP 192:UsCI5WyAJCWW7/lyKFFWQFRZUHWX01k9z3AV0bk:L0RiZFRjZjR9zOj
- TLSH T14A3229E2852C55C1EDA3ACA043A8E5573C3D27CB1D1048B962DBF7680DA33C9E73856E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.inf
- Size 2KB
- SHA256 ff93773f55bf4a6a0242adf82276a8c95c0b244b9bc05e515c4e810c81a960e8
- MD5 d87c2f68057611e687bdb8cc6ebea5b8
- SHA1 27b1311d3b199e4c22772fa1b7ea556805775d37
- SHA512 4aa65b8911d8a2a0f9ef0ee6e934b94db0a9ad4c2ec543b5edcf21486be43f6ab1fda6617ea2cbb85eff230628c9fa8e7649da915d6de695803b28e55bef5819
- TLSH T16541DED8A1D386BA6687B2D07E0741C3F6403A0049F7342872DE50D6C3E7A0F83B4BA9
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\MBAMSwissArmy.sys
- Size 240KB
- SHA256 6d2c9a01f953d206abbbd8c2ba5a00b78ad8f6bcddba6db810f2d6f562ddbd8a
- MD5 953f871a91ac057d2d748646065fc2dd
- SHA1 ef6eb7900e194555bc9dc4b4eca377f5aee9f7e2
- SHA512 dc4caf64effe29e719d85823ac9ded93bd723ccefa4662420303c700968db608c9c0cdb4412373ffba49c9672359f4594dab50863cc6c10e8bb4d3b5fd00573c
- SSDEEP 3072:rM98OZY4B+FY1GeX7dxNRV634KOMuFZWaOJRN4KoXkM0dsFTgUzFkzSzpJW4d1sa:rkLelYsCdbRDF7WaeRN4dT0U6r4dxt
- TLSH T1FB346D06E2E47A66F9B7827D89A69102E77271452B31CECF5370C1292F1B7E0F93534A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\srvversion.dat
- Size 9B
- SHA256 af0cac103fb816b5059d8775d63406a2f410a8ed70826978cddc6d88d8ddc668
- MD5 bcec912691aaf576c95bfe0265863b6c
- SHA1 1c9b9a02b6f3845a292b49332056df7e2ca2d539
- SHA512 d0556b3e89b42e12e26104ca3f1889714bee2a45fe74ebd8af7720398bd3a32d072f5ae91bfdf33406ff0027188705780c769350c4cda5176b15b3541d4fe412
- MD5 SHA1 SHA512
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.5MB
- SHA256 d6ccdd7cfed3532f458fe4f9d7d9193c31e01ed34b772fa6dcbb919f38396742
- MD5 6c44292e00856a545d83807a13484457
- SHA1 d0cee3f6d9340babcebac0738a4e04ca68270924
- SHA512 e2f93211045c6434ea60a18b44dea63c4ac05f7b31423cf3b33bf54d61103c82f8b458aaf3c2c9e15fb599ba070da9bb1c23527cd797fcb8b03316507c56c2fe
- SSDEEP 24576:xcP4mcvIjkGOxhKP2l71nNKbrh/8KB86mctvE/BT76+1NCE:mP4m4IpOO67W8K26mGvKVO+n1
- TLSH T1B665AE2DABDC0096D0BB917485658A4AFAB1742A2F3286CB1160933D3F77EE54F35F12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.5MB
- SHA256 9b70059be16da9940a77105cfc14dbed0a9fa36a0499dd505b42e26bc468dfb0
- MD5 65bf4a66b7137e7537efbfd033f9cace
- SHA1 4941e5b4263684ba8031b7d7ff83ce675d98cb50
- SHA512 dda4266efbe7e3e8014c78507cbe94f15ce04b0c1bc22605e8a4b35c19a85a741f7e1d8ae114ab62f36bce41d08346caf9fcafe1b2cb8b8a0da166a73f3cfea3
- SSDEEP 12288:v1sf0tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:006mctvE/BT76+1NCE
- TLSH T1FC75F14AD25902D8C0AE12B5C7569241F7333CA5A7E293CB63D0F53E1F31690ADEAB53
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\7z.dll
- Size 1.6MB
- SHA256 bb01c6fbb29590d6d144a9038c2a7736d6925a6dbd31889538af033e03e4f5fa
- MD5 3430e2544637cebf8ba1f509ed5a27b1
- SHA1 7e5bd7af223436081601413fb501b8bd20b67a1e
- SHA512 91c4eb3d341a8b30594ee4c08a638c3fb7f3a05248b459bcf07ca9f4c2a185959313a68741bdcec1d76014009875fa7cbfa47217fb45d57df3b9b1c580bc889d
- SSDEEP 24576:29raURTF/5pe2g5RpBDxSjv9IrqLwRpFEDbt7y0MVoAAlziG3B:29hP/5petvSjWZR8DxO0mo5MG3B
- TLSH T175756D5BF67400A4D5D6C034C5276B1BEAB1B88B8330A6EF12D15E6B6F13BF19979320
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\7z.dll
- Size 1.6MB
- SHA256 623e628393bc4b8131c1f4302b195429dfa67e890d3325ceaa56940660052b1b
- MD5 4da585f081e096a43a574f4f4167947e
- SHA1 38c81c6deae0e6d35c64c060b26271413a176a49
- SHA512 0fe168bf1661691dbaa103e478dd7e46b476db094bf1938bf1ad12ddb8a8f371bf611ff504d2eb3ac319862444cc64a27ebee8735aa3752aa32a399b09427243
- SSDEEP 24576:a9raURTF/5pe2g5RpBDxSjv9IrqLwRpFEDbt7y0MVoAAlzi8pY:a9hP/5petvSjWZR8DxO0mo5M8pY
- TLSH T16F756D5BF67400A4D5D6C034C5276B1BEAB1B88B8330A7EF12D15A6B6F13BF19979320
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\AEControllerImpl.dll
- Size 4.9MB
- SHA256 878239e138180492b8e703203db1eeda5da1a88b7897c16e7323bb506ef28dfe
- MD5 e4f9ffbfd7c3c8b641ebbbdcfe6399e8
- SHA1 8ee46b184bb37a8f24001eebe120796fa46935f2
- SHA512 8f68576a20a8a3b6e7125733862583bcb4fe137392392acb4e3b826450cb4b656815a3be7b44174bd3fef3a0f4722079eded587d8c0f2ac3680d67384cdbb317
- SSDEEP 49152:y3QcNVHvFJa0GV9Tkq9HWsMyhXTnXRUHNNWjwJZ1yWBEsUXH7PWnE8q12VPvUbA:q0XTnMmPsUXbPWNPvcYLX
- TLSH T152368D16A7F401A8C8B6C23CCA578503D7B2BC154730DBDF16A4966A1FB3BE1563EB24
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\ActionsShim.dll
- Size 3.7MB
- SHA256 6c5047cb77ea843e8386ba2b26a8458e6255e2ab94d493e914620623723c6b32
- MD5 33617cde11d2bfcef47faf0d5ce3cef9
- SHA1 2439b5f0622cd539b6f6f2f87d78edba466299ed
- SHA512 ef909e5e6a695a0f2ae95621cf87795705b3d267ea7d1c82634faeff3a4e3b111f5f809cd9e7dbb71d588d6106e0b54c138364f99ba41c7c5d47cde9af1b753e
- SSDEEP 49152:SH0QptrM88LLHy9nqSk5n9BT1vAPZmbLMo7JTfYkwZdPHFszUlE3JqCx9R345GEm:ktro8k3booBovlE3JqCx9R345GEzul
- TLSH T16E068B17EB9540A8CC6AD23C855B8607D7B2BC25237097CF17B462AA1FB3BE1523E714
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\ArwControllerImpl.dll
- Size 5.6MB
- SHA256 a1904889632fce5fece6dbecda5e237423d571652350f24c8724bdeb3a30228a
- MD5 40f500da8c204e5e9a89fdd8dfae4ff6
- SHA1 3a407e01769f582116a34c3b874dd5b534734072
- SHA512 5a1888e523b39f1590c05236f502c2f5c0ab4a9384737294fdfa0c8b0870d851e2cb927b71112a8828c67c9017209e8b4fa66fca262d5f8d9a11ec481c946d46
- SSDEEP 49152:rjEQxZvdSVum8H2EMBNi3IcKpFd5wKqW1c7h/med5BNhlA+KjTscJ0Kzp+i7JtmC:rYQxjspzwJxE+6Tv+iVg64Iky
- TLSH T160468E1AB7D500A8D4B6C238CA578513E7B2BC554331DBDF06A4A6AA1F73BE0473EB14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\ArwLib.dll
- Size 7.2MB
- SHA256 acc5508787ed40d3fd48c9428d3cbdb23ef9540ba4e9bcafc1e3c25e30fef526
- MD5 683b857fdf1cf176997065b2e6178347
- SHA1 827f731e94314636a4809280bffbf9f380a8c669
- SHA512 15e0a79690a7c100c6f582742756b85ca3e2ce1e8101b7867a06bd3c5064aa77a5ce8b8d1ba70ef47ea1f70b754c933f513690d4c874f191c25fbdd7ddbe643a
- SSDEEP 98304:Qp5FvnA5WTmewOgWWNtkSVdQhm4mT7gHjBsCBZyVNPaX7:mvA5HfObgkSVd0m4mTE1BZWy7
- TLSH T167769E16A2E800B9D8B6D238C9678513E7B3BC561331D7CF06A0966A1F73BE1573E724
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\Assistant.deps.json
- Size 15KB
- SHA256 6832f2ca93598e09ea6476cfc780c4b8deae9c0c9e540d5f5b252a45fdac0458
- MD5 eb59f133da7a9246eae609e7c985fc4c
- SHA1 b8a557f5d248ee9c98ad5b296358d02aa99988a3
- SHA512 f31e8229073a683f5fb776d54092a9ae084deec781ee1b2ef8a45e354afaded661742de1ad44a13964c11109656cb4d1f1de242bcf0fa0bfb7225c12c333ba7a
- SSDEEP 96:X4Ky03qXNHxVwTA3G8EnqimkKqTxecaFh4QUP2syK6TFBcSVy9/O1ap75LGQ9gp6:XBxGcaFKQUPXyN/WChCYdA81Ej
- TLSH T16562B925E8946E770972BBB1B8354141F629132F7004284E79FC285DCFB7F5AA096F35
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\Assistant.dll
- Size 158KB
- SHA256 10ab319330bb858dc26fb8286a9b58656171561f01937f4f51b631a195c6efeb
- MD5 c3d207ccc5c0f32e18792603ccf820c7
- SHA1 993a896d60e45a79cd0137e527a862fbfdc21747
- SHA512 846e0a8e6a7eb8e624f969a66d129c6c6353bbed44a47491ffcb88cc3942bf0cf0928be3b3ae5340f77bb3d7b2fc37d1ec74231e51aabdd599061bc50dce39e6
- SSDEEP 1536:SvJYElo8Zol8fgGE7RinElGDlGDba9NdfIY9F:SvJPal8rE+Cq
- TLSH T1E5F36C8797948072EFDA4A386DF0D7DA3B346E461CD34956B354B1FD2AB2FC21E04226
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\Assistant.exe
- Size 301KB
- SHA256 f29f68a50d89b9cf5590fe19de68065f5da28adaf7a7d1ee377aa42b8f586b47
- MD5 0c6bcb548503fee5a7670687b1e6a353
- SHA1 516ea05fb76eb02a9b7e3fc2c7287d0e003388cb
- SHA512 e53cb5571b94a1ecf100e28df3f8d1a041be265a8d25cce4ca2e1998bdef41f325c23a40b127a7a6fe80cb4b822ed7bd9883697555e54c3f31d1207fc7a71a53
- SSDEEP 3072:LXwANETcQt1Onb5RHrfqDQXFn4dPPYseJwmZf2jT6lb+aPOaWlKM:rlxnlRLfyQXN42D0IlO/n
- TLSH T177644B03969850BAEDE6D638CD918B41FB7238594BF366CB13505ABA1F76FD05E38302
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\BrowserSDKDLLShim.dll
- Size 3.7MB
- SHA256 f6d24605eb688e039e4509d184d974bb14c4c38528edad129d0653eadfea80f9
- MD5 889529ee7dadd23f11ed5b3fdd1f5b79
- SHA1 3e8a1bee4d28102aeb4c6f2eb94946282ffa7e12
- SHA512 bcd57045d516232828003b2b970b457138cebafbfbf2bf762199c291228b2cd674d8084190fee22f0adf047e8f2ac20644712313cfb5f90289a83fd6698995ec
- SSDEEP 49152:aHENZh/xwXNNnfFEXqGW3nILlpqCBS6+38Q/h0oYEaF6r+jep6Plw3zUoC02n:TOX/xPb/aomGIoIn
- TLSH T1E2067B17EB9500A8CC6AD23C856B8607D7B2BC25677097CF1AB462791FB3BE1123E714
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\CleanControllerImpl.dll
- Size 8.7MB
- SHA256 8404395da4f44f39236e8265593f52dcbbdcb7e37e129498d4c18b56dee6902e
- MD5 b7930dfd9175b4c2d9abde99076bce4e
- SHA1 7219ee742a50fca1c9be0f68652704386f837797
- SHA512 b3afcdfc3c538ebbc9ed373f1c440592ed45adf274e8e0b4210b1b394605af23f999c2fe7c3742f6c8962578b6982d71f98a7c1be1c4a8f7d663e7240b7a4102
- SSDEEP 98304:pBDjgBUbuC7uYUxcbfssqiamfbt5rOTwLCeLZT:UBUiC7ufWfssqilfbtlkwd
- TLSH T1F9968E56B6E400A4E4F6D178CE678503DBB2BC551731DBDF0690966A1F73BE08A3EB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\CloudControllerImpl.dll
- Size 6.9MB
- SHA256 c1af072bd24fe47e5f2cd71faa900c7a1dd16520d3735f9cc8df40d671b5e9b7
- MD5 43cb480992b8419e0e2938e8897590f8
- SHA1 e8c69764ce3d6627956bc88b598b99b0143dbd87
- SHA512 f6d974086da91d5da49015ef82e4d0494c3bef77829fa4c7438fdf8e0fa06520f682609dfa42a0dd06fded7ae113543a9284467514486f2b514e2d6e94f0d231
- SSDEEP 98304:lTUvUuVCKfYls1zPJ2KxJRttlMA+4sS3GK:evUGCKfn1zPJ2KnRttOTm3GK
- TLSH T163769E5BA6E400A8D8B7C17CCE578503EBB2B81543719BDF06A4967A1F73BE0563EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\DryIoc.dll
- Size 597KB
- SHA256 bea5ba96d0043de5b52d5ce12bb9444d79c85c4b5160ebe19dee405c01aebc0e
- MD5 ee6afdb461a7bcb8906db48f9b47bf2b
- SHA1 92bc3f4ec5979cc71d9accdc5001d5aa56a53d61
- SHA512 e7bd06abe330e4d6afaa88ba48317ec5dec754a7fa958dfd92ac527be3d326108a19a82528c568e8c74282bfee3fa2025cc0076aa5f37064f6a1509914d8fd36
- SSDEEP 12288:70pb1qj47g2Gzp3+bszwrO8Zakh8Zfnr600DssPUbUhDPzi:7qEL2SJMZbxHhLzi
- TLSH T137D48D0533EC461AC6FFE673793925165BF5E413A8ABE78F158884F818EAB115E403B3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\Duende.IdentityModel.OidcClient.dll
- Size 165KB
- SHA256 db2d3a529c5486ba69d385bedd6e1e5cbea351a4b8213ab83c952092b17cc17c
- MD5 067ff8a1bbde4956637e359c1b2ae17c
- SHA1 0110a19390a9fe1fc5e28e966424e2552a3b18df
- SHA512 61b106bbabade649219499bc78b1fd835de2d78cda14758db69a99891dca58e13e1195425c5526ab3e57c03b8f44b8bf6989f588da2b4cd7856e554b83bec45e
- SSDEEP 3072:WR8wizSvYrIgF6ApyaljQi4xBzZGhbMyB9EVeUc:Wo+vYLDoxVZGLHSc
- TLSH T15EF33D6577EC8312CA9F7F78F950A52565B59E03BE81EEC80E487CFE05263C2390971A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\Duende.IdentityModel.dll
- Size 250KB
- SHA256 5a32a96fffa06776adbfa8432105e06aa7cf795ba8647690b9ca272fe07892a3
- MD5 d6fc1f290e3ebc744e270f8b9b9abeaf
- SHA1 643be493d386eb61014fc468119713360d5c1c30
- SHA512 fc317e68c70cac518a82b8820f3e5bcc28661ae21ecfc2aa593ac500d5032f96114598f29e4b9342d24845ade0325d4295d769662b91caae49101b9544663bf2
- SSDEEP 6144:TBCOgXPwr6V8Hhm2ZTKR9bzIdbN2mCFMhqPDhadWX:VCOgXPwr6V8Hhm2ZO3b5Dhad
- TLSH T13B445C0263F48617F3EF6F3AF574A5218577BD467A00EA8E4D487DEC1522B80BB15B22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\LicenseControllerImpl.dll
- Size 7.1MB
- SHA256 223dd68b4fc42d3451d7631a56bf261517e400da2b9536969b7eda80b28a0e93
- MD5 d91ed54c2e16f0c2d883dbcdd0b3c513
- SHA1 e5116a0fd899ccefc5e7375100b6fee90107c293
- SHA512 44b036566fde88317ccb90a3173464c96c547b61da73e1e65cfdbbd2bbe8df96d7425088cb7322c8c1e5cc6abdcc47ab76e41834f8e5cfa0ae07fadde35c5c5c
- SSDEEP 98304:qWth0pN471WY8eAolIft4ooTU5tgrJDFfv/8k:qU034715FAolIV76U5twtFfv/b
- TLSH T137769F6AA7E400ACD4B6D27CCA578503D7B2B8054371DBDF06A4967A1F73BE0963EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\MBAMCrashHandler.exe
- Size 890KB
- SHA256 164932ea0ead0fc1d660b075913244fe7ca7322c725cdb0903ae4cf217b19a64
- MD5 498178f914ec446f77c3c03637ef8889
- SHA1 e865fb47b565b146b05d1bbaa8d79b1e37f71e34
- SHA512 a93d02495be1f921f062fadcd65ac5ffb7ef2254707160f34832452ffc7c06a34784b7435afee645f253de6802a5a19d9c3cd38d3b9bdcb309e8c1a335b26cbc
- SSDEEP 24576:m+JgyhxA4n0eEmZ7HF6ULsOmSxNVl2uCdRP8a2hi6:msgyhx30b87F6ULsOmSxNVl2uCdR0a2f
- TLSH T140157C1A777C00F9D0B7D179CA46AA07E6B2740B03B05BDB13A147963F276D49E3AB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\MBAMService.exe
- Size 11.0MB
- SHA256 fd7a1428221fe7de747930cb3d9f2991610e2b1d809a0abc1f26590db5f5986c
- MD5 bb079cbeb5948a894358ac3c5586d990
- SHA1 777c05ca055c938d3352e758d835d33896807a23
- SHA512 692ac8284d78c69b06dfdd7e4b6ecd0380e7198d587c48655d4d2204957e7968209e5aba6fd06ab150823998bdb74446a7f168fb9240f2f1aba0f5a38c39abcd
- SSDEEP 98304:RA64Z/iUYtDJODZi1EZnnsc8tUFswknM94BJ:C64dSJODZi1EZnsc82FZyM94BJ
- TLSH T126C6E606A7F951D8F5BAD674AD7B652AEE32BC618B3093CF1150560B0F32ED48E38721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\MBAMShim.dll
- Size 4.3MB
- SHA256 dcc714dd199d9768faa0ca212e63efe63caa8aeb4cb11487fa389ff59f6cf98d
- MD5 5be75744f4065e88aeda92344b999ada
- SHA1 48347bd7c99adf4e1c8407c0f56b2017ef8e5525
- SHA512 53cba40ed9450dc83c8fc6e522b567884c1a7b858f708930f164fb5eaafb4d6972625eeb35b7d5d01d754f7c7af7727ecf08efb37de6541ec637021fa06c6613
- SSDEEP 49152:+6s9rQzE4CYJQEw34L4lvXYsFFXBulqfCbLqmsc/6ZeFYpA8aIJammPsQzUOu+/x:rs9rVzYJGrsSCbvyg8aeTO/Z2JgH3
- TLSH T138267D17ABE801A8D87AC23885A78603E7B3BC16077097CF1A64557A1FB3BD15A3F714
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\MBVpnTunnelService.exe
- Size 4.1MB
- SHA256 a67f94a3014d93b9b91f0c8427c81cc18cb13239a114d91c51f993702e60a580
- MD5 88138b3ddd9b2800ea155743aa26fe87
- SHA1 0b45bd01e388bf4821a3caa09e78033588f66667
- SHA512 4f2f2f04c1b3c1d55731d7dc55fa3ee09385b8f77084e79ebde5252242008eb3362beb9b50b3ea8934acc471dcef67763f20d5268f6cb18bfb98926e4189c3b3
- SSDEEP 49152:0JxO5tmuSoHE4RtMMoLPqf/nkMq1BmwlxMOqSv6bi36i6X43jtPQ6zU+5pAqIPIS:8Y5tY4RMk6lxMObN6/tbH
- TLSH T188168D57A7A901E8D8A6C23CC4678603E7B2BC151770A7CF0664627A1FB3AD25F3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\MBVpnTunnel_mbtun.dll
- Size 4.2MB
- SHA256 0b764892f7f32d385684411e647f69f428067180aa28315d71668d3ab25b335e
- MD5 ca4f7f1ffd364bdb46dbbb8bd1319125
- SHA1 a2d8a1a3401a93da3303376e37e6ae36e08c693d
- SHA512 522a23be06d466db16e9abe89897e8562ef1fab483285c37c5ff43468e084a91ea78892ea9225c2da589e440e84034d23b0236af99182ed6d1eb118b4e0dc273
- SSDEEP 49152:lBPD6Io8w4LcTwEDRzTJoeM9YSxjQ5g+o9h6iO0oFjn2Q1Z0NwEIx6:PDG8VQkgRzSeMfn+ofU1M
- TLSH T1C8164B02F8B205B9F2BEF131C9A963217A31749503327B871F9195692A66FE47E3D313
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\MBVpnTunnel_wireguard.dll
- Size 2.9MB
- SHA256 998086c9be8d1e7bb8ec63e907c834dd315849cb78de4da8cdb5702e03eb79ad
- MD5 2b25add11147543409d55d85d1662e06
- SHA1 37ced9f532ef0bb743305d4b58095d49ae8e382b
- SHA512 4bf32d77cb9617ddaf835cc7fed41f590e343a7c567474353e75ae80c5820efa6a5b443143b6fbecfd8cd9df77ba4356c19cf65d47d73c408091ec4041ea30a7
- SSDEEP 49152:OiZVz3arb/TUvO90dL3BmAFd4A64nsfJNraOc3jxJpr7ZEN7DS25+NkzZGALgFtt:OK30c3jxrw5HZId7W
- TLSH T199D53903B89584B4C5AAD230896B92977B317C890B3163D73B50BBF92F72BD45E78364
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\MWACControllerImpl.dll
- Size 7.6MB
- SHA256 de1f0248c81a86c1498ec703d90c2b7edb7d863b39380ff21c1f19d3edbe7075
- MD5 1b3efbe4501e3fb33790e3594db8928e
- SHA1 70dbb4c7902a4686c77e3bc13d17f237e4eed953
- SHA512 902edcc5f6e8b60cc7d3f0c7a3c209aeac8c167d34c681e1b37e0859fb261d5a8c3e4ffb2d41549a0a6f1b6df6a157b1e78830a1f758497f654688aa1911e84c
- SSDEEP 98304:nNE9vvaDfzdXtRIteX3Dai+NtqcMQL6hO8lwwrx:nexCDfzPRIteX3D1+Ntqc5x8lzN
- TLSH T1E0866B1AE7B940E4D8B6C23C9967A617FA72BC19833067CF0654975A0F73BE0963E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\Malwarebytes.Interop.Activation.dll
- Size 36KB
- SHA256 f5a9e3587fcf855046d8b08e86ed61105f2f330a1c9021461446c137ed3b9ac5
- MD5 2db24fdb7584378e27e5a023ce1c4221
- SHA1 f4c59cc128a4c79b1a6b450a81f5c2f9ed7e6b9a
- SHA512 0e1fcd125a839f5a85ecd96e432ece37a62a13af579153b375fd6ec57b605689bcbb46e7f3d0a93e0e1235ddedf4965b0d9b2f4826d7d7eaada79a15a4efe7b5
- SSDEEP 768:SI9HlxK1JN2bwUUcXk6xf1mlrjE7W3b/bF+Y7N2Ip4O6xf1mlrjE71:l9HlS2bwUBfIfmADh7Q9HfIfm1
- TLSH T1A5036DDA9A349003EF97AF7163E4DA83FD39A7C36845C56718AAD18408CB3C4E35626D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\Malwarebytes.Protection.Interop.dll
- Size 2.5MB
- SHA256 1c598177dffdc0588968bcc909642b42607c33f3c0058f9ae2a6f91a996eb111
- MD5 79507948df53d09d503664b250d320a0
- SHA1 a2bad1306041cb895ec021d783f2244ee5763662
- SHA512 2ef3542213e779fc5461ff8090b1534352bcaeb2ba33e26f7ee22adf91d02131dcfbc523213df7b449793235e8f44e6bc3f1e6b9aa38e7d6ebe435c6849f273d
- SSDEEP 49152:tIJHNNsKCHSDZqQgHJmCOxQhAB27W+AhD+bbzWCCi8MI1v:CJHNNDCHSDZqQgHJmCOxQhAB27W+AhDh
- TLSH T106C53E2671B4AF3EDAFD01BEA5678F380761EBC07206EF17554C29480FD1ADA3D4A921
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\Malwarebytes.UI.Controls.dll
- Size 32KB
- SHA256 4c3d97304af4e091ee4ed390f2c75deb04de900ab404bc41e529a0c5bbbd04c9
- MD5 1cab5dc89a3c6e8aa69ee3a709e92f84
- SHA1 a8781531ac1700ee363f91995ca5269c3ef4846e
- SHA512 1b03c710f2d4bc754d74e09838c26444f244585b1dca8d84c76dd1ab0cff4f08aa368eb4595042ece1a71c339b44aaeaa2397aa85f8ffde507124d25704e3ddc
- SSDEEP 768:RQgoN5YiRifT5ALY6mM6m0fXT2Ip40GTxf1ml6Z+7EtNgU:RQrT7Ri16mM6m0va9vfIL+P
- TLSH T1EEE26CD78AB84403EE57DE31F1E8DA97BD38B7D36C91C1DA2069C1910B463C1A3A926C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\Malwarebytes.UI.Style.dll
- Size 108KB
- SHA256 ba1e626a9b6a3d7c967d00ae31b7a758edb0ac23d8332939f044710d8e6288a9
- MD5 a3478b0ba3b8948726bb37e82ee224de
- SHA1 122dad2b5a9b8e689f73405cc4cd8f420944134f
- SHA512 8a44270495ba7a2cf136cd618efb48b45d4fb60a85927eb4d9761ff8822ea852e9b1a1eafd77a6f0b4ec382330b835ab38872b4a09250d930f5e0f95c7ed32e8
- SSDEEP 1536:xVuxwXvVh3gIrjyhryRlMAMZHcEzpr7Ri86mM6m0va9ufIk02:xVuxwXvVh3gIrj/HHMHcEVrtoU
- TLSH T138B307546A550CB0EB134EB6ADDBCE0C3D3145AA00E1C86521DF8CDF6EC9B8186A977F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\Malwarebytes.UI.Theme.Dark.dll
- Size 55KB
- SHA256 e0b84c137d3cef1dd43fc3572d359373b1614ab8aa0f5091f58120bfd3fc1c53
- MD5 ba57abe6bc54c2a30a83372a1e5712fa
- SHA1 5dc310260a243e4ca26d25c09f152b22727a12c2
- SHA512 d940e2ccd2ef2d84b84be43765d88738136268892206a4f65182cce1c72fc4b15009ad11ab76b24bcd575cc6c1c06c5f3d7e82d9163f862e4a981082e081509c
- SSDEEP 768:wIZlzpsplPN8n7RF1f5YiRiY5ALIN6mM6m0fXT2Ip4pTxf1ml9dHejL:f/1R7RikN6mM6m0va9bfIbHev
- TLSH T1BD43C755E5894827EF675830BCFE74826F3511B49403BE4FABAF627006D034F1AEE626
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\Malwarebytes.UI.Theme.Light.dll
- Size 55KB
- SHA256 d2d177294181c0bc81baef93502e603eb1fdcff51b074a1f068c38003f1c0502
- MD5 231f26bf96e205bf339693ad3d30f0c5
- SHA1 24bf339765d5477e147e0e3320f1acc1e261689a
- SHA512 18b59759d24e579376fe2f067ff23688ae36363334191c0639a3d8bae071d7662738129490042c6164a7286fa800b0591e91ee7302f811f6f9ef369fc30be33a
- SSDEEP 768:nEfnxB+jbhXrzV+5YiRisGy5ALR6mM6m0fXT2Ip4PPTxf1ml9dHWjL:3XnV07Rij6mM6m0va9P1fIbHWv
- TLSH T10743B496E5894827EF235831BCF974827F3511A48403BE4FABAF6770069134F1AEE625
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\Malwarebytes.UI.Theme.Primitives.dll
- Size 2.1MB
- SHA256 7a543d38cb51c1fae0e41297c50247f7558aae0e879f7d6762b2349193ad992f
- MD5 2d99f557950980a71f4fd6c03b6c148a
- SHA1 bdafdcda30a295aa2fcee118212dadf6129b550c
- SHA512 39617ee745fb102e2131f6494f9eccf065ef576f64fca4bde72b9f57f5b4aa526d76efea1d838529d5438f6f2bd329f256e3309960c88601de2d6a6cb9108308
- SSDEEP 24576:4R7Lmv3ser0IruI+dktHly2fuBLwf+ogKTAWrrBcUg0A7PEjRr8Diyr:qc+4H42GBLwf+oFTAWrrBcUg0EEf0
- TLSH T1DEA58D02F302A719CD827E387D7DD3BD5B71F8197E1A961B74C5AF2488CA4809C59BAC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\Malwarebytes.deps.json
- Size 53KB
- SHA256 ec9c8488469f49892da2dd31adf8f6e871d2c6a7a3e734392aec875087af5979
- MD5 fcea2a36471ff6a20aae281f660095f5
- SHA1 f8a6d6cc88ac4fbd9d1a62c282a98040eea60629
- SHA512 af2f71c78f15a713a578fb3c3bc3eddf906cac1abbbc23dd6d8ed5456cbf53d13907255894dc78a0736e231225c27022a0d051056f818782b02ced93a6d89995
- SSDEEP 384:XRWGyitlXt1XBcbuQT4J7VjFneQmiVmAH1nmhwtjenRQhdHbb+CKxoiYoI3c4sOn:X84/Xt1XcuQT4JYQhIx9pH9U
- TLSH T191339B25D4545E7B4572F7B1A9790581F62A132FA0046C8E78FC285CCFB3F9A509AF38
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\Malwarebytes.dll
- Size 10.8MB
- SHA256 a9eb2c88a612aaeff17fac7a6358095648430b797b532d91119cff1505eedb5b
- MD5 cccd34bf3f1b34ee67c8b33917a12607
- SHA1 5c7ce83b9027bdbc9c9df4c01fe856ddfc8d3b09
- SHA512 5385a2cd3965148552df476598fb723bf16f049ba8798456fd04552d01423d019fca02a3fef6dee932c6f491f24bcea1d81a90a3dd8eb4fcb400a74cf8cb7e69
- SSDEEP 98304:H/iyuazcO0nfScO3injmZGva7Uq2UausPdo8qh9dykOf3QkpQuNNZzRc2kotVmCo:H/iyuucO0nFK1ZCfbaXOf3fp6LmwjEa
- TLSH T106B6E01627BC4E38C9D70BB198220314D975768622E2873D93CE1C3EBCD5F558E19AAF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\Malwarebytes.exe
- Size 304KB
- SHA256 0671ca7932916aba879752e6b59ed5d87538c57236a64c73eb5ff36deaef03b2
- MD5 18ecf82a2db00ea793417be6939dcbb3
- SHA1 3e9207bfd6d762a1b41b5f95b88c1e7df3e347bd
- SHA512 c9676cfd80a04b6ea340a16a49bfd27ff808c9775b21ddf69573180c493c7dbe561cfdd5091cb3a17ba3c20792046f568ae1f2b979d695187a39a6b56b4fe8a5
- SSDEEP 3072:xXwANETcQt1Onb5RHrfqDQXFn4dPPYseJwmZf2jT67b2aPONPj5Uz2En:plxnlRLfyQXN42D0GtOBjA3
- TLSH T17F645B03969850BAEDE6D638CD918B41FB32385A4BF356CB13505ABA1F76FD05E39302
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\Malwarebytes.runtimeconfig.json
- Size 732B
- SHA256 3f60cdd7ad6efb453058c7d80dcad1ef76bf5db28fd548fb6f9714b409e4a181
- MD5 5bfe910e05d660bafacad9e7769c940b
- SHA1 fffa577eed91f3e25b5c1a1824a4dc758628845c
- SHA512 7d47cbe8d7799213636773b36cb6ca8efa22d8f1fa1b125355e7804b022280572a7b647608f39e71ecbc480e244e2bcaa59f27d9c16a3751953629fbd15ca7e0
- TLSH T115014979CA106CB718B9327BD525D483EA34133B10046C56B5FD090C7F7B6BA2232F96
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\Malwarebytes_Assistant.deps.json
- Size 15KB
- SHA256 a7b61740f03ff13d048988b468b9eae31c051b1ee38dfa4dbd4f9b64fc91735c
- MD5 4adc7ee922f3d13a5d0b10a9034a37bf
- SHA1 641b2484e23c4e46ccfc1c563cfbe59878880ed3
- SHA512 4e568521c070f05a5d5a271d892e153371c9fd0178129756a2ed4e831e220f6e6f55880aa3ab81e054013065a788aa10ca3c66edf12fcd3c93ed707ea01715ac
- SSDEEP 96:XSKy03qXNHxVwTA3G8EnqimkKqTxecaFh4QUP2syK6TaBcSVy9/O1ap75LGQ9gp6:XLxGcaFKQUPXyNMWChCYdA81Ej
- TLSH T13362C925E8946E770A72BBB1B8354141F629132F7004284E79FC285DCFB7F5AA086F35
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\Malwarebytes_Assistant.dll
- Size 162KB
- SHA256 7f49055ad3feee2968e609388c493c7288c3825ce506dcd0c8937b163c99ca11
- MD5 cc33005b24743dd09be1395c0666eb2c
- SHA1 d7f61ba79085faa9e243fa3214eaa7fa104906f9
- SHA512 cdc91b580f8528c6caaf5fc8c826554f0dc4a86c7c8b67c390e963ee17c2f4c9affd4bdbacf37ce5bea989b93b4c7096ebf6a4da89bf23f4367498959ead9b3c
- SSDEEP 1536:D3TXPfL5jObR9ZolcQAme7Rie/wD+bGDlGDba9RkfILZz:DjPfL8bHalcqem+kV
- TLSH T199F35D8797948072EFDA89346DF0C79A7B357D461CE38A5A634472FD2AB2FD11B04322
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\Malwarebytes_Assistant.exe
- Size 301KB
- SHA256 401db49dee2f6cd6d7568b4c2fe3aa387d5a4fd500bd8d607dea3dafb481a43b
- MD5 ec7a783ad8200e74b8fdee83d78ee89a
- SHA1 0e3e0b1a9c02c97e3db8e7274010d334c41cff46
- SHA512 8e48a21f7001faaef17f0221036d6061d28106d5bfbf7d61de56fa729a0524f66917484db61bc9f57d2523a79f07c504c63b0be17f513e26a42faab68608e16e
- SSDEEP 3072:TXwANETcQt1Onb5RHrfqDQXFn4dPPYseJwmZf2jT6ebzaPO+XqU3:jlxnlRLfyQXN42D0rWOnA
- TLSH T1E8644B03A69850BAEDE6D638CD918B41FB3278554BF366CB13505ABA1F76FD05E38302
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\MbamBgNativeMsg.exe
- Size 4.3MB
- SHA256 ea97af9bdc388c8b2f43b070b39ff3c30a32bac2b9a5143596a18038f5b027d9
- MD5 6ca8f5974de6d64a8e7dd3da3216a421
- SHA1 e9f4cf2b8f4cd2ab8924d045ec1a0dcaee6eba1a
- SHA512 09006d7a36e459ddce42c4511b7729f4b273b65fa589e11a60a59804bb7af7995103a2f5f35ca4748eb094ce1fd9f40826c7b5a53e119120f493ba752cce5e7d
- SSDEEP 49152:R+kHxfTc3EQkUzJNflIWBE0ABTvWYrBS3zPyAFsh9pDpMA7zx0nhCPf9+zUse9ch:1rZUzLy1+3zPpFyuSGuRPQX8BjY5z
- TLSH T10D268D17A7A401E8C876C238C55A8603E7B2BC1657709BCF16A4567A1FB3AE54F3FB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\MbamUI.Core.deps.json
- Size 7KB
- SHA256 097af37567e76677bcc9b90d5864db84103a5145131c16bb94aed3e083e91c8b
- MD5 9fc3310a0db1ec9c6c496af0f14d1eee
- SHA1 3b167e8a37f617348ac2a9df3be97165cd6d5f16
- SHA512 a9c557e090b40d878a8888efb0362758f114a2c461dce9f5334ebf65475de06ccc686d6e47268d377eaeb9d3f7fc91ec61fdf904bd49bc788ca98d44b0ec708d
- SSDEEP 96:Xb2e03qXNHxVwTA3G8EnqimC4QhSH75LGQ9gpGc6bXpzXaTgNj+FPhCYwpUVCk86:XbIqQhSshCYhV
- TLSH T16EF1CA21E8986F370976B7B1B87A4151FA39132B70042C4E79FC280C8FB6F9A5096F35
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\MbamUI.Core.dll
- Size 178KB
- SHA256 94e33dfa4430472f21dacd7ae46bd49d90a2f7300f5a76f411f599763ab1cd0b
- MD5 a944e72aff20cdbad26700247dd186cb
- SHA1 d61b77d2a2f1ddce6c21f7c3e71e7a2f8916f8f8
- SHA512 c5cf68263f3d315824d3cde19ffdf23fef5ab8dd8c5274fa4efc6a92412b494947938d0819fe495c49cde096682761e405d061add5bc24b2c7af5b16d49a7422
- SSDEEP 3072:e3uZmuGLjeDPbob79GlvOzYz2GUGQZHOFLs+qM:BMeDPMb79G5OUZsZHMT
- TLSH T12A044A4177F84649FAFB0F3AB8B6664C8E76FE466C21D66E1491404D0873B80EE61B37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\MbamUI.Data.dll
- Size 1.6MB
- SHA256 53f6bf1b4a9026b541253bb00972734f3a966e539a9aa4c39be8098b7fae420a
- MD5 7bdc9ffc12f688f1053ccd3fbe08a059
- SHA1 6bd743177f791cde152e37b2e8ed50e23035f9c3
- SHA512 a4ea1a82aad7a68d9d0c56f847ec1f012993c8a9d83a86fb9baf6164e8a997ea7be2112ed30a655f5cdcc3bb16b9746e93a83ef4505ac565a9b89901335d9ba4
- SSDEEP 6144:Fz5X+vpPHsEtOVByDqRnm6kSkQdimFbzHMmLeFsXOII0YNWZfu/fi6Z:FEpPHsaOGDqhk63stB33qfWN
- TLSH T1D885B17077886632C4D4DC6B0E4559B8CA31EF93EDCCBA8DA017B0F92274A56D46BED0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\MbamUI.Services.deps.json
- Size 14KB
- SHA256 cdd3624951f7a32c5d211afb9e9800a6f5ffb60d1d4d71272e168649c29c4f29
- MD5 a41110c32c0dd5e305a894f68cb6f1c1
- SHA1 0a4326fafab02e23eeafbed1bd38bc2178ddb890
- SHA512 cc8c95c1983447f35272113dcfc2ae61cd2a6cee07d9dd5b65af9a4ff42ece686b46be00bc9a274e8f29ea9a9314514a3ee7d345415fa6880d8737a58e5f5a4e
- SSDEEP 96:XCyK6TuKy03qXNHxVwTA3G8EnqimkKqTxecN4QhP2QBcSVy9/O1ap75LGQ9gpGcq:XCyNvxGceQhP3WChCYdA8IEW
- TLSH T15E62A925E8946E770972BBB1A8394141F639132F6004284E79FC284DCFB7F5AA096F35
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\MbamUI.Services.dll
- Size 3.5MB
- SHA256 664bd764f02edc1660516792588ffa7a0ab3fdc36220a2646e3b3c02889869ff
- MD5 53dad5d36f6833b54626c82fed3c0244
- SHA1 d0bb0eee6c52bb5b90f063c5f7f7477c4185f158
- SHA512 ad56cfa603c7a3c383d5058323c3bdac2dcb4ac6c8e68270cfd117ad2741248925f3a666b3030b062814d05ed3fff6b7c74555e1eb7415f661baee2202a8ad0d
- SSDEEP 24576:Ph42IZ+U8iBgqqT/AJVV5XB2Qqegg4a50DuCL9NnhiEVf:PyGmqT/AJ5Bn/CZ9EEVf
- TLSH T148F56C20B7E92169E0F75377AE3185056A76FADDBA31C20C09A8442F24F6748CF76763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\MbamUI.Tray.deps.json
- Size 14KB
- SHA256 04838342f08dbec004170b4902da3e4726354b4a04e155c6b914b54c55580acf
- MD5 1a4dccd5bbd773e2eb26e9ebb7a61702
- SHA1 382a49c04eacf9406014e5c54e36ae8526ea50bc
- SHA512 0223efd9e085185bac3584b775efe9ce59429a2590aafbe6b3bdc226f0716096ae3c13f44a2324f9a754cac75377cfb93c59e38275765824fec1b74c552b0d72
- SSDEEP 96:XWKy03qXNHxVwTA3G8EnqimkKqTxecN4QhP2syK6T4BcSVy9/O1ap75LGQ9gpGc3:XnxGceQhPXyNaWChCYdA8IEj
- TLSH T1F062A925E8946E770972BBF1A8354141F639532F6004284E79FC284DCFB7F5AA096F35
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\MbamUI.Tray.dll
- Size 192KB
- SHA256 f3f10f62a4166b17d7c01274a5f0df5fec7013dae682df6d3a54f03aa144c5a7
- MD5 f8609a52ca3bc308d856a28d9b7fad4c
- SHA1 3a05ed48ef361057a52b6252feb51cb3bacb4835
- SHA512 407b09714716f367f9b7bdd031954c51c40807c95cb23e36fd2cc430839e233c76f8f09e6bf159845399594c2f1d358330235f552af812c1dc2d1b7994f62a80
- SSDEEP 3072:WRjgWGGxp5HdCVrtSGIQJmoQDF1G3AWb4B0BNDX6j5rDrd:M9D/CVIGBJmoQDF1GwWu8N2j7
- TLSH T15A1415839BD88962FA9E797B285751AD9B36EA531B33D26D34C45C7C0977F880F02107
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\MdXaml.dll
- Size 183KB
- SHA256 0f701984b8efd7bcb9da4a13aeffd698b9a2c3f248e3cc460c4c6ac4b9cfe150
- MD5 4bc3431f8d844d5fbbba47ffe7533f0c
- SHA1 6aa89cf7830ebd5fab1806cd3a00699d103d674f
- SHA512 1316f7f531ca099b48c7984e56de8eea9397d7712bd36561b90a928d03f38b33b3b096f9d5b4fd4bf259f3d165389f3fde4f6e95708cbaa89e3995df419c5210
- SSDEEP 3072:6LmHpg9WcYmiWbkt+akcNfU0L/maeTK5lWw6wqv:1WfIZt3HLL+a+KP+
- TLSH T16C041A0253D88A21E6BF0938D520E8A5DF3343AB1235CA457ADD75AF1B7B3910277B63
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\Microsoft.Data.Sqlite.dll
- Size 173KB
- SHA256 4ffa9156ebb9332bc53196cde2e62997447ad046629216be555e07d5d65f6c19
- MD5 803fb44bcf3e488c9fbaac4933d729bb
- SHA1 2f9d613cc53944e912ede7a1214d87554e30394f
- SHA512 569041a3b05cf1bd548ff2c767a48d4c30c9be9a3e11c4407714d1ae1928f817d1a15cdc08fed40c0fbbda78ee3ac4f9ad443be43744647507bc7f6caefb8afd
- SSDEEP 3072:5Po1U7KHI/FRmHsGP8vrzqWLvVtly65GBSilr7DSILSAQSIgdG8CmST:9omLmHsGPKGWhrZ543Iv8Ch
- TLSH T16B0449B4135C6543C7FFCE32B0B96C820734AA4BD5D2D74BAE40E5B93923745AE8129E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\Microsoft.EntityFrameworkCore.Abstractions.dll
- Size 33KB
- SHA256 c29df8f2db22e129bb6929130d98aa612b570a5ebab9842a11e809796cf03448
- MD5 5e000060b3a6a847d27f892b4f0f9c12
- SHA1 ef4f660221e458f6ae38127769f66f924581b3a3
- SHA512 28337074f48d61d9c11c4dd30eebacff52b0bbe5470aef7a0a07b2c336adf0ede76c7aa5742c457a6f8459528b8b5140775f7d6d6eb6e282942ceb30ac2b1f73
- SSDEEP 768:/eLi5XHQQd3Sksb55OkbzouC+MV2bQEF/9zR:WMXdtw5BbzS+U28EDzR
- TLSH T1DFF25C52639C9333DAFF1A76F570A5812836F7863811DA7A4A44F08D18637C0AA70B77
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\Microsoft.EntityFrameworkCore.Relational.dll
- Size 2.1MB
- SHA256 687f84616b0a58de7ba0c20d14b4fe38871d79161f2de5bb3f48d171c292a0db
- MD5 6d842b431b91328b5c703ec7e721c3f4
- SHA1 1a5617d2e2c79fa20b43aa7eaf3d0aacf5ddb6ed
- SHA512 04cb1f53504f1fa4860b5bc984ebf7054e8ee99c1512efca461c01c74f63e493d81ff7a5ffe56c98a09a27a6f3c8d170fc194e7fcc4c88f7f6c5c1acd689f5d1
- SSDEEP 24576:yfWlkbXVTUH5pnb05u3bLbeIdvDLbncb9WOEJ89F7T+IyTS6oNzvP/vTXqXFti7F:ypEJ89F7TgS6oZkSNPeFC/U6
- TLSH T1C0A55B45B3B8BE62E1BF5336E025844473F6E846A352EB5A240CBAFE2C537411D41B7B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\Microsoft.EntityFrameworkCore.Sqlite.dll
- Size 304KB
- SHA256 623bc03297fcefc658a9e251d1e75c12d7365b80a3ebcfecd3e31d5a6e7feead
- MD5 3ded14093905c1f26692be0c0ec2305d
- SHA1 aa249a469baecbff645d9cb6c6b7577ac30c2f6f
- SHA512 68eb5848dee8ce008e90d317611fda792f2b10e4e19c03f0e5453f214e501cb2bf1f81755a29ad7a185ac4cd5cbc0c3af78c554425fcd5183d7b8bfd8f60c423
- SSDEEP 3072:y614aDpdB36A912H5mQtTLvf8u4tcLR8BlNt+kNpQo2NxGG6tHmXiVstgbx3h+0q:yg4aFjPf26o81tzpv2GGdyBCjKcwJnQ
- TLSH T1C5646B4133FC9326D5FF8736B074C14883FCE9178499DB4E2C94A5EB2EE23415A29A67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\Microsoft.EntityFrameworkCore.dll
- Size 2.7MB
- SHA256 6750a0c56a1d557d7590728d4d7378f6e1ec65cb96e59489023cdc9fd139f6ca
- MD5 4522635c0a768a1968fc0c606384aec4
- SHA1 b1a5d4ec3016894c5c73ca1ca80304dab0144634
- SHA512 6362209e1e9f8f1eda70b01609ce617987d10a422730bb5f3559a2ac4d2c970e4bba6d4c03406f52e50262b8f0627f6df2bcd4408a0a496be69392994ec2e388
- SSDEEP 24576:cH7ch/JrNY4K49OX6HDkMqdGO+nDGBHUefp2c1boCLFtrNBIdu633Do9R/42iQ9Q:qcqRYkMqdGO+lWm2/NW+hmqulzEY
- TLSH T192D55B55F3EC5F26C4BFC736B078054093FFE8941372DB075084AABA39A37524AC96A6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\Microsoft.Extensions.Caching.Abstractions.dll
- Size 36KB
- SHA256 46697030a421c60e4a1eecb295fe14513a562bb2e5d7e0ac878f4934e56bb50b
- MD5 ccc8814b69e63f0c87dac4da0d9dd1bb
- SHA1 1a2f71bf9b77e83084fad125161735148703fa2b
- SHA512 e7413110fb79901fad3c4cecd2701f760f7962ee52c00e566a965babf1d0a805827efe499ea8d2eb455f12ea6bf3cd1cfe988d5fb53d70d77004bba3dfccedb0
- SSDEEP 768:/BPRm3g7qLxnMLsLNRP0iNeAr+KIeOt83ZW26/9ze:5PkxMoLAiNeAr+Kst83ZW2Eze
- TLSH T12F035B048764C363DDFE2BBABDE581C60A36E64A6412E71A5C8CF4DD0D03788DBB1766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\Microsoft.Extensions.Caching.Memory.dll
- Size 46KB
- SHA256 f108fc79cd1b69eb4d0f8a45d198c5fb99ace430dbec65380854a559a248d6a9
- MD5 6346b4d17d67e59c82aa743b572ba255
- SHA1 0e6ccc1c528501562cd17d878525de1be6e69fcc
- SHA512 4620967e627981f0c758e6fae1ec10a3564ff6612b538d21be6167fbb4c1545d7ed65abf392086b41f02cc62260d190ff6c21ac59f78e9549c601f70527bcddc
- SSDEEP 768:LZWKkP6xlhFOQjkEL3ZAcueHPsXeHrjZ9zf62K:9lanm3OTwsXebzfW
- TLSH T1FB234A00576C4327DFFE1BB8EAB0A5511B7A87977811FB691CCEB1995CA37C0861223B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\Microsoft.Extensions.Configuration.Abstractions.dll
- Size 27KB
- SHA256 c295e6c3384ed61e4fea0fc43479aadedf81a60c9c97d3dbdb9247f562e0846f
- MD5 59a088e0efed74aedb4d38b18cb81dca
- SHA1 80c85b3e2654e9a98ae49ceb0c074d9b43352b02
- SHA512 e869a3512828477ee8a5fb163d008e50cd516cbd121bbb5873a4434a9200612470edcd7204749dc13cfb7e9e0d3ee9ab323e7b4a3194e3d5b7d17a7a447750ea
- SSDEEP 384:TJ5rtAUhkfuUIh0cUarO9vaTG/dwSzRjz67MFTFUjTWsjSNWRlNaADSki+R9zGDp:15KUhFFh0cU6Qp6cO9zkR
- TLSH T10DD24B1683AC9323CCBB2E75E9A1C4562E35D397A801EE5A64DDF0094DA37C45722B3E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\Microsoft.Extensions.DependencyInjection.Abstractions.dll
- Size 64KB
- SHA256 ca708422782fb25819941a16a057ea96d6d18b037e7e5cbfdf340b7a04362b57
- MD5 ae5e45ed689ecd9ca584e517dec04437
- SHA1 a03538d460b2cd255477500b364d9e463afe05c2
- SHA512 0ec0ddb7f15cda3e02039de26d1730d6ac4383a384ad56fda8398ec6cf33d9489add536e78e76f6a6f33590895f9da60e2d6b98aa437607c6533e9b80d26152c
- SSDEEP 1536:PFuu+NbA5+iU5t53Ueb4I+MkT/sEyWzekwmgzT:Ph4ttkDsb6omg3
- TLSH T10C532B6837F9E613DBBE4A3137E642C1AB78AF036001F70F254A92F50597BC949909B7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\Microsoft.Extensions.DependencyInjection.dll
- Size 93KB
- SHA256 47f8175d34e9087d3858644803c558cb9cf52b29bffda796f65c1c527d1b6a22
- MD5 691d122172e70a956be0ed59b935a8a9
- SHA1 13db5e854cfe3805bb518b501c438ea394b5683b
- SHA512 995afb87da135e03386bd5d0072bc93a8c99372ec963a566d304161ba9521a4735d88e9048e5b9bd07a25da410c54a1165e0392aceb292410be6c8f5c48308f0
- SSDEEP 1536:txemzdEwSsliCvUFoN93dJrutpF5nRN46zIQ:txqsl2FoNBrutdj46/
- TLSH T1F2935C7513FC9B26E9DF0A74A87542404B79FA9A3402E35D0EC4E06D1EA3FC54B6226B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\Microsoft.Extensions.DependencyModel.dll
- Size 82KB
- SHA256 8dadc004effa669d9caf231019413e469d58632eadb9dacf56aad07d8bac82a3
- MD5 52ec978e8277e966277939d57630fd6d
- SHA1 547f659d6e20d7f13120fb52413a2db7fecd428e
- SHA512 43fffe70d25e79c45a5cb018e03565718aeaf910231c270cd87bb9806ba410c7afee2bc54911b80553ed7898e6a61e46636ced974139e2aba5158d24d951d3a0
- SSDEEP 1536:iuCEshm8cqNUMP/9T3vM8Gkvv0P2OK4bYMgzU:L5lbOj/9TfL7vCfsMgI
- TLSH T15C836C01A7EC9713EAEF1BB578B5A05907B2F65B6013FB5C6D4D609A0907BC04720AF7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\Microsoft.Extensions.Logging.Abstractions.dll
- Size 65KB
- SHA256 ec244a2db19dffe90cd299fa4b0691456ced342a078b4a93cf3726a9b431e9ac
- MD5 ce9485a33686f5b71a44b578c1f62a83
- SHA1 08c936106235dc9a3c30f817896f947354460b4c
- SHA512 fbd2b2bb5b83a280fe16e51d48dab44f9708ba224ae854e8510790cf0eebbfb23056009d8d5347f05c04fb4e2d16ee110f497ad7f243646e6ad78927fcc6b1e1
- SSDEEP 1536:jc7Vs2LEzbPQV1b66atnqmY8bf24LNU/XhQ6zIhQ:j2PBV1b/OqRY0q6t
- TLSH T1AC636C1197DC4733CB7F4EB6E82196524B35C5473103E7676CCCE1697827BD8AA202BA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\Microsoft.Extensions.Logging.dll
- Size 50KB
- SHA256 74d8fd2d7997fc638474e2bd79916458a30481e6a6925b50e7e96b4b852031c3
- MD5 8ab959f2310c6f8a3ecf2de3cecb978c
- SHA1 f989f82c587621c85856ba0266759e6a848f4e98
- SHA512 aef718d5e732e7c9a6dc98e54e03d7cc91f72b5fbe738bc9d1d1a8001fc1fdc9e7247fada6be660b58f4532f172855e3108110b91d3ead49aad03266a6eddd87
- SSDEEP 768:OVY+gXlZrIb5IilZcLfQQ1rERWp8gFT7Gf0lJa2s9zwH:OVY+yf25IiDcTZ1rEgz60lJDkzwH
- TLSH T1D0334A5183EC9366E5EE5E38F9E0D8555B3AD74B6002EB865ECCF0B428B37D0462067B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\Microsoft.Extensions.Options.dll
- Size 63KB
- SHA256 644350f8c2404d4479b97a250edb29585e5fafec1b6ce8486ae600c5015fd7fb
- MD5 cd3547864f8b6753525e759948a8901e
- SHA1 121a0634920dd0edab6403f9aedd675bb77ab74f
- SHA512 55128005f5d095b0f977f0a1f8814cb1f7dbcbde8b14f791f392387f605e7bc0e20ce96de65ee6f7c23c6c6930f2df6390f3ebacab81af9ba76059a4e5d869e9
- SSDEEP 768:JxLQqsUmClAD59d05JD/GQtbOZZn6SqaDiNax4PTcFBLCx5NLdW7NDpfbrr9zP70:TLExCmD7dvQtgZtqTyekE5mB9fXBzA
- TLSH T13A536D014B5C9762CEEF4A71F458C1F11A36C36BB54BB32A96CCE2A81DE73909FA1531
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\Microsoft.Extensions.Primitives.dll
- Size 43KB
- SHA256 a0794c3bab2d7e0c848f0dffb3b9aa4b43ce07dc0abd122ebb7bf6dc79452ec4
- MD5 0665c2fcf8856e8790488ad7caa2c00f
- SHA1 5e7f4cc30b5a252cfdc016eadf69d3b181013d36
- SHA512 3d3f4595d5ea34e2b691b05fd540b8c92bb84b1d30706a10e375166cc3fe70228f7f68425e4dd9d814fa0669ed10ec61fe30c0cd43c705054f3a20da20cdc260
- SSDEEP 768:EipZy7/jRFQLfvJ4dBayaIb/Olz1OkytW58cZM7uisK1KPp2Kfr//9zT8B:nMjjcLfnjimp1OkytVc67uisK162eNzG
- TLSH T113135C41A3AC8333CEFE5E32B4E4D155063897AA7552FB5B96C8E0A45D633C05B3263B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\Microsoft.Xaml.Behaviors.dll
- Size 142KB
- SHA256 0493049febb4be74bdf669ad7fa754941c2754fe33421e230a8f14c8fd06c8c4
- MD5 a10c6f9556dfccca0db08b9ef2e86c4b
- SHA1 e34dedf472f32ac21306e5673d34dd2ec0deac15
- SHA512 8128bc268c5a62cec0eaf3bcb22b93e017f2a1d60808476a1c437ebdb6494ebfe898ac24dfbd620b525ed9b26bf81a8b7ebcfea26dabbeaf18fbf5538aa160e1
- SSDEEP 3072:+XQg6pDJRt4v4VMvlat1dLXTrGmAJ5ryjTT:YQD1JRtigRGG
- TLSH T198E34B6053FC8A5ED7FF1634E0B061158671EB9BB933DB0D5E84D2AE04A338266127B7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\MwacLib.dll
- Size 6.4MB
- SHA256 b7bd08efeb605825a6fbddfb86f467017d015c39b498b1abadce3a1c2b9aec77
- MD5 d8edbe0741a24661d2f6725d2f327ec5
- SHA1 7b567a8dde4a5f04c51b9765a17a42fd84876a8a
- SHA512 e8afa10b5834b52e0e1c38dcf82aa5c0bea2738dbf01d7ee0c2d1630490f297d5133fab9f22bb1ad662af5128ff8b342d266be3689d59d8c4aca62b9443ac92f
- SSDEEP 98304:NpB7Kgxzgp+hagqZ9JhJ4uvIONMdCWVp+w/:FKgxzgp+QgIJhGuvIO+dCU
- TLSH T11C668C1AB6E400A9C8B6E238CA678213EBF2F855173197CF0664967E1F73BD0563E744
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\PoliciesControllerImpl.dll
- Size 6.1MB
- SHA256 cd1e8f98551fb69d3d47837c09fea35be358dd7c27104afb7f1938a7fadbb2c5
- MD5 436a5828103f6874dda5ca0b32e8e8ec
- SHA1 7a5346221f40349881a65df91014114b1644c8f8
- SHA512 a4ce868855d83ad112b528a4969e5a5f79a115eb92f9e3ef1f05eb09f7f39c099abb162bbf2024b298af715560d81d9f08c2457109d7b2b33c04dff9789dbd05
- SSDEEP 98304:at69nEVAZKwY4Lka7NrGWeG0qwtEQ9VsAwbB:aAnEVmKv4Lka7NrGWJ0qwtP749
- TLSH T1C8569D1BA6E800A8D8B6D13CCA978513E7B2BC15177197CF06A4967A1F73BE05B3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\Prism.Container.Extensions.dll
- Size 20KB
- SHA256 85a55b97f20431fcf6d33634de6a86d7c6d441be413c728e19dda8b0aef72e92
- MD5 7c761ce50753f23707b12774d6191482
- SHA1 2a6367003777f077c2b0969e0454bc4de7b0757a
- SHA512 cc0dc04d17316a816553bac6092f124310c3fcb3c131ee9421bc6581710493233e7004d07bc097a9caa818d3b0c1320135d6562794d9520c207fbe6dd2f4f559
- SSDEEP 384:h8z2AKJxYjp8LXg0uHPF+jCZSZmZPSUPo2/VlhC9:h8z2AoYN3vF+jqSUPoAlhC9
- TLSH T1D5922B528BA44373EDBB8F35BDF592105A30FF41AC60CE6A069CD0C9CEE2B5445B463A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\Prism.DryIoc.Wpf.dll
- Size 26KB
- SHA256 ad1666c83f2554b09396386fcec856f9b3068b9bc2a29f13c08d3ce0c23d7d4f
- MD5 bd3f6009fc2b6a04bb3401c0158a2868
- SHA1 62aeb021c1fd18dd4bee4e3c6947571738582819
- SHA512 83e4ed6ff4351056c2003d776cb15916f280f1cd3aa4c6ae6e4cf982c0b69e21c1ad3c08d0ee4b3fbf7861f9b231f5ddb8735a037ee7beb76c1ac485fe49450d
- SSDEEP 384:j6Xd47wSthuCfI0xlid20I3W7xrgfScZSZmZPtU91C/SyIpMehV:8d4sAuCfDxd16ZQSYtG1npKehV
- TLSH T1D5C24B51CFE01536DEBB4F7E78F051015E70F746BC52C6AF819880A41EA3BA11A9077E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\Prism.Wpf.dll
- Size 132KB
- SHA256 c3b44b118486a5d74d696c14853e5306ec893dadd0be8ea6f404edae8c66f2d3
- MD5 7a103c5bde44976ad0627443af2e1a4b
- SHA1 55e4bb694cca644846bd4a39782d76d9b4996480
- SHA512 8ca0142f855f776cd610c5e9e6ed46bae8d980deff2a8916c8fb4356d516d1f0d9b8c0114f456740402f1de1ea55c5eb4f797bb04f00196c7a647fe212e50836
- SSDEEP 3072:ifxD31bs6W5SVEcJ8+s8ggRwfEQwwzOfzH3mgQ:ift31RVVRs8g5wwzOfz0
- TLSH T1CDD35B2923FC876BDBFF4A39F57440018FB2FE472062E75A5944E4AC285374196923BB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\Prism.dll
- Size 89KB
- SHA256 92090c9c3c5195149885be91aa469b85d2cba9a215cb3bfb65e93945f33d852b
- MD5 0877a419afc7306cfa2d301e314f0548
- SHA1 ba76afb78636546c5dd73162bba7a98ae3b34724
- SHA512 5e3ac30005f4fdee8f85d2a632415bef7a9722add4cfc59745da9a41e87cf79e5c62a0c2fb52b79381495be94f7b7d0ec3a455f0f112e7b0bdaf63d6b46c6bd1
- SSDEEP 1536:eH8fhOdBanbA/0soPhaECCcCxGVSCC+5rgnCnS+6j+DZORL0SSeVEEkqYyg1H:G8Z8MbwaCCcCxGVSCCFCnS+94LNSCYR
- TLSH T116935C1063EC4B23DAFF5F78B97410450BB6FA436522EB5E594CA1A80C63BD049A53FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\QRCoder.dll
- Size 228KB
- SHA256 71eabcb0819c02d8f62db7dc8c3b6af2a75e5d37ea65cbcdb2cf37f0f664c847
- MD5 901df4ba69ff8c2e566232f856c84cc4
- SHA1 ca80174b7702093d1c3609b60418f6b9fdf87c3d
- SHA512 7589647234dc6f70383742264931ba2f5b096dae208424649728b5da1b86f284e334106ab75a925c25b74995f516a712b3ad8b9c4fbb749b8b775a6b43664071
- SSDEEP 3072:WbtYdT8Wa/cOnjtzdG0PRUQYw8n+6nMovphLwQfldIkP5NxBVWrDAoBgDvsJotdx:WbC8WqTbK5ntLPIk1nWrDAagYU
- TLSH T1D2349D2967FCDA02E6BF6F35E8B050118772BAA22D36D74F198CD4AD15A3BC049407B7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\RTPControllerImpl.dll
- Size 6.4MB
- SHA256 905e6da13fed3e931eb9180aa50b6f2058da73ec7e8c9735a6e03730de3f317c
- MD5 2abbbd7e5d16e3c4f8f28ebee148baf7
- SHA1 b414cc1f22b4dcfe70a0057cc6dfdf04ca587f7c
- SHA512 2ba3e909ca19272114821c891b2a9fae3ae6ce29138e8daac7c319532a5a8878a5f810560f469eb613ca119ba3bd0bf8e5cc75afa3e11477f17664e4a7714866
- SSDEEP 49152:itLx7V0PZw2Pdap9fNt4htJsg+6Q8OmITjRCqVZ5PIE5FGAhZ2NPh+xOtW3BbNba:soycr0bf5FGsEYFNbMGsdBiiI4rM8j
- TLSH T137669D16B7E400A8D4B6D238CA678513DBB2BC554731DBDF06A0966E1F73BE0963EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\SPControllerImpl.dll
- Size 4.5MB
- SHA256 6563c8273b0285bb2db5df55c8a707b76ed9215739b78ea4e2f954ee1025ef12
- MD5 efaf9a951675b1d23cf37e6f0cb9a02b
- SHA1 ec1edd6046df2d78f26a708db865c16065bc5021
- SHA512 9a43c424313d610c9bc133bb35d7ed3b7bf424c66b8820483a103aa41d3628fb609c26d5ab1399f7b6bb43ae962b03307cc32fb5a5a4d434934b5be0bf98c793
- SSDEEP 49152:JRNwUFTWIls1ThDYENU+QTRzmKVuPSfgSdBF5Mufa3j9LIJv24rBPZROnwPi5zUR:XlQBFQT8v6GufOJVuBPzyKR
- TLSH T1B1268D17AAE801ACD876D23C89AB8603D7B2BC61437097CF0674567A1FB3BE1563E714
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\SQLitePCLRaw.batteries_v2.dll
- Size 32KB
- SHA256 7c10d7bd83a3a3451072d1a80b26a9f55d7eea11097a3c4d9de6daa3d562d50b
- MD5 0eef5b2fc40fc83886802a4f6b864512
- SHA1 5d53f89f2f1176583a839e92a8956b34d5b7536f
- SHA512 b7751c84c2350c36f12a655825230b9436d17c5028c4ecda64dbc24dccf545efce55639c5903be57f66a971ea432fb31806c494d093c5e18707b16a93ca82255
- SSDEEP 768:BA5YiRicD5ALhlGDlGDLXT2Ip4R5Txf1ml6Z+7UhFg9Fd:BS7RicClGDlGDba9RLfILKyr
- TLSH T124E26BD74AA44803EF579E70B1F4DA53FE38A7C3A890C5D76099D2510B863C2A79D27C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\SQLitePCLRaw.core.dll
- Size 77KB
- SHA256 2e55d659a5693afdf4c6a5b4b0214f6224b7f0ba094ddc1db0871834c66935e7
- MD5 d4f9d5ece79b8827fe7f0706ef96916f
- SHA1 03c45c74f4638ea11881058095b5330e787eed96
- SHA512 42bbd4da7e953c1ddacbdf0587ac2c4791f7fc6e66327693d61f45322b12a8fbdd94b876222f10a325f7513b4795be09ce428b57950e3fb00d70de42c11dd7ac
- SSDEEP 1536:EAFy5WiUx1PaDJqq4qLN1JirPi1HLsKr7RiCGDlGDba9RYfILtSs:E/pji2PrYd
- TLSH T193736A7587948D1AE9CE9030B0BB40D6BA70D219A7F7CB63B590D0B019723CB57B61BE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\SQLitePCLRaw.provider.e_sqlcipher.dll
- Size 63KB
- SHA256 7ca281df0718d1d00cb83fc7412b88ad3a10120dfc0dae8fe4efc1a6c478d226
- MD5 9e5eea0a8ec5de9dbfe5a937ba25c43e
- SHA1 dd19c849d23bdd7b8a0fa7815da47cae7d2dab3e
- SHA512 2f3367a9db19897e6b59b40de4d96b840b80fdd5f43dd8a0a5a718ddfca427b4a014b6b2c971da9d96d5b3b46806fbbf1ea199788da4a991aa9a680b4c5ad48d
- SSDEEP 1536:LD35VJMRjNUQ2QuX2YTn7Pe/x9hE431TyN7RimqaGDlGDba91ofILbeH:LNajoR72lBYNeGH
- TLSH T182533AD6874E0A22F69D0A3278775E4AA178E3C2FF725353A553C3385D633C58B982B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\SQLitePCLRaw.provider.e_sqlite3.dll
- Size 63KB
- SHA256 5064528668f29aba1752bbd38669428c0a20bf68d5ce8a64d8f6dccaaefc1834
- MD5 8317555a965d9c0620786634596baca9
- SHA1 370293127ca75faff9f9868b0f3c31e1812a1436
- SHA512 ee8df6dce47872e9c939fadc2cdb862fdda3ecaf4c0008cd0dad70edaf26b5c2acd6ed615ed5e1c089abed62761da35b9977172f18927b5f0d5ad7bfab5699b9
- SSDEEP 1536:2LOVCntPI/3ebE43FTth7RiAesGDlGDba9N+fIYY0:23tQeBHhce
- TLSH T19F534BD6874F2925F69D0B32B8B35E869678E392FB321753A553C335DD623804F842B8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\ScanControllerImpl.dll
- Size 6.9MB
- SHA256 c247fc5913cdd73b37f6619b5e2019831635cac2786997e6e98965690b87d076
- MD5 831f51a590742a2bbe1e55ae7fa9e760
- SHA1 a2b2dd8bb930d9f0a975be3fa57cfd0cc4b1c067
- SHA512 0c56f1630e7a806f6a1383536f11b1496f23901b3eb2d96a63fe5cd3fae1d5c0de3ccaf637ad99074611e115d0911059fc0b5428e687a4f252766772d17b9d41
- SSDEEP 98304:+dhoYDGql6cTC+8ngEZsxKGNSRLzoxXlS4qbVO3yuxtq18DSyWgavm+6:+dhoYDU7VOiuxtq18DJWNm+6
- TLSH T1EF768E1662E401A8D4B7D238CAA78113DB73BC554731D7DF06A0966E1F73BE09A3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\SelfProtectionSdk.dll
- Size 4.6MB
- SHA256 09b8ea52a6950390fa1f96720f0c7b4c527631b24d27466e5f9e5952701dbc0b
- MD5 9466bdc77270fafe1849911257d1b2f9
- SHA1 4b6f98d87da1b31cb788f202617f567e200473cb
- SHA512 de9d02a89e20fde5777bc591c647871689cd9f0ed07d5aa3b483accac897eeef536ebc56d732349c0ce6eea233e117fbcf131e83877d66281424772aa8b4a7cc
- SSDEEP 49152:VvVNraNCw9Vjvu1DPcFFiIju4Bn241fvX9MDwKDKGMsWOVRtPGWzU03LcZdkZH4e:Bw9UqIivGDcsWoO5xZdkU+3
- TLSH T1AD268D17A6E601A8D876C23889B78603E7B2BC1147709BCF0A6496792FB3BD1573F714
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\SelfProtectionShim.dll
- Size 4.0MB
- SHA256 ccb4ce36aa0887ed1017abd15b1019f31a8fe2c1afc55a6a063d94142d7483c2
- MD5 d1d035f3ad7cc27a29e0e80186571c4b
- SHA1 37a42f712a8e847f8d575613b47962c0f3c28f3a
- SHA512 f37523a83d0a41ef128b8d731599e26be3dfdb868c6e0f9068e5318f038cd59d72700beab772814d4d2ebc69657d3173bd3c596461473a25cfe9b10306733e82
- SSDEEP 49152:8EWWy/r6DbXWDWVZ76nXsLLeLWRBKI8GUfdgTyQWVp1CLrNSJPCqwzUyLWm:3fXWsDY3dgTWC3dSNm
- TLSH T17F168D17B7E841B8D866C23D85638603E7B2BC2107709BCF16A466791FB3BE2563E714
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\Sentry.dll
- Size 835KB
- SHA256 a826dd6e254ca80c35769bf2a540260203349d38f645aa34072709285ca30804
- MD5 a34afeca5f136b3975db929e44a6095f
- SHA1 16ff077e5015e239cc597dad3bf6f8bbcf1c9f43
- SHA512 24366b1b396acf5f4c93118c3ad79693878b09fc4f8b91091d386e48068c0dce3a8936df7f46fd9727d37bb7aeff868258273c4a60c7ac54b610acbfb3a339c8
- SSDEEP 12288:gviEDdBXBL8cTitI9PrTiU5OrTYT0ffg+ZO2g1i:gK8HTH62OoQo+ZO2gY
- TLSH T14E055A4127F8D73AD4AFAB30E87851580FF6EB1AA576E74F0608A1AD3D973418E40763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\Serilog.Extensions.Logging.dll
- Size 55KB
- SHA256 5ae5f9e0308e7043e81d4fd1121057d01449f7022c7a4e5d47f2101e82584594
- MD5 bd330564ee9358aadb175bf5e783558d
- SHA1 9725998c598a669de1aef332a1653e06902743f1
- SHA512 26fec834facb99e49690ba5d893a5afa2fa2e4446996a2dc64be2d118d2d267668939a47f7fa683661801c7cc81df0bf68bbb193adc77575a9aafa98e3bba08a
- SSDEEP 1536:33dvmGCZDFPTwYe7Ri+6oGDlGDba9NyfIkQx:3nkDFPTHeZ6lD
- TLSH T136438C4297BC5722DECF5F31B0E4CA91BB35D7A36820D6853899E2904D6338227B517F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\Serilog.Sinks.File.dll
- Size 63KB
- SHA256 b4397c50906493343a91ed95505c2091f86cd2a7a8523c139decf6ead7381e14
- MD5 8924f4230d557b10d2009ab9b889e505
- SHA1 181667bcbf5447d6b6d310d5356fc7675f6a8770
- SHA512 e4c56d30cf48ba0d1c1d5aa267a746ea109312b41a6b3270758b980a658214abae140a931302f6789a75a108af2fedfd8d0530b4ea5c9ebd89e4b5a67291b5ac
- SSDEEP 1536:r0Dt41dC7cRbVBh7RipGDlGDba9RJfIL7pgE:r0p9yvhABgE
- TLSH T1F7538E82A7EC0317EEDF5F74B4F4D9532B35F7E3A821D68E209482950C62B81176536B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\Serilog.dll
- Size 186KB
- SHA256 f1de8852c92655aeefeb52904daa4e9ccf0abf2e64f44583bfe27088d9aaf050
- MD5 cbb92fd07ddd9caa59f751b5ea78c17d
- SHA1 e1e8fec8db36969c63cc49b185ca3f425679b5f0
- SHA512 ee21aa893efaadc987e054008a31ae3493154eb57d345603793d6fd9d7e3556e4a370d8d997fa7a39027f05fbd0b4a05bee4e4af10abbe7a76bb2933a39b656c
- SSDEEP 3072:EojNje2ueNclPk+lbsdAz/SnSpnf6G9Hk3xvVbXyMc6f9MXU4JVMwFRB:Eohje2ueNclPJlbsAzSixHW1Ti7tB
- TLSH T123147D2A73EC4A76DBDE5B7CB0B091442B31FA5B9027E7CE681C65E80A17F855B40327
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\Swissarmy.dll
- Size 5.3MB
- SHA256 9ad52208d95d536dd1dd77c9bd118c7ab0fffc795a4f0875fa608544d30bb931
- MD5 60d217257971f73714b8c5e398d461dc
- SHA1 9906053f88d7a409e8ba874aa9f66e5ead73c961
- SHA512 8eb3304e904af5847c6b2cab99d1d3690b5b239fbe85467d164ed29a714f029ec163f467a7bebcc80e156e0d291436306145a2ae68766613f5a6b30f316b0250
- SSDEEP 49152:5LG8qKNFeojCOg33h8pRdPSDIGRmqiZBmdWZyKYbHkEAoXvEPj8QF9yllBpP9aze:Zfex8pCIQbWZ0kd8xTdNhIcPz
- TLSH T1E3469D17A6D500ADD8B7C278C99B8603D7B3B81553319BCF1A64522A2FB3BE2573E701
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\SwissarmyShim.dll
- Size 3.8MB
- SHA256 7b7bef24ae682aed60edf136ef817d60b7b1a02e3ad3f86c7b820cc502e4edce
- MD5 07a16e004bdc32df788c0f7144526105
- SHA1 de6cb075bc813f25aea014eba71b1127299da2e5
- SHA512 c0f2db7f9dc6b7e5575f4a7b5b5d60aa032777e3a9994b534651317326e4ae6721527422d9001fac8cf4280fc7876dd8e1f321a7ee65e3394417982b0373687f
- SSDEEP 49152:s5AWJyZyVe6ZGVE96H+KLNjU1BWIaDLwOx/AJJKFS7JkC3zly0IPLRzUgT9dmR:bUemgTTwOCJJRDqyg3
- TLSH T100067B17E79940A8CCAAC23C85978607D7B2BC127770A7CF16B466691FB3BE1123E714
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\System.Diagnostics.EventLog.dll
- Size 172KB
- SHA256 9177c5434d2872741cf7a80e000c52166fed8930d07ab154c6a4d476d01a9aaa
- MD5 74de4396506a13ba8bcbbe9d445e53ee
- SHA1 0fef9f1f91de802006f20c019c9d1a2899df0843
- SHA512 42a00206c4f43ac589aaec7d06045959cf47fd58caef55d91801e88010c454fccf6451a525a8a80f7ee4eaa1813cd7b832f975f494f11802c7622bb4ba552adc
- SSDEEP 3072:XhV2mZAS5h+Jp6l6XPSlzOR5KkORMuPYHgDCaTd7brDHbh7oN+r65k1+EK8IFxQX:XGa2tPgDCaTd7bvl7o+25k1udSOk
- TLSH T151045B3873E84B0EE7FE1F38F4B160194736B5A6693BE36D458498ED0563BC09A20767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\System.DirectoryServices.AccountManagement.dll
- Size 297KB
- SHA256 721a82b65516782f57f7fbf4c9940c016f8c1a209d5fed553b5044c45485b8fd
- MD5 1f873950cc7f0b618f60b2480af0cb2b
- SHA1 f19815525e195507a3b0ac715f8436e0ef77f4ef
- SHA512 9941dac5b23bf3370743086ce0f30ae0ddd7aab414c2892d9ecdce2da0124a3b13cbd395435e9751f7720bff82d685ae39c9c737a65049fa2a7e6667165d7eae
- SSDEEP 6144:B2iefgF6OdLKeKSxviFfK9qTLXR3TN7XkA1KydWI+:BJUOdLuK4TLXR3T5m
- TLSH T1F754291033E80A49E2FF2775A4B014159B79BB57A9AAEF1C0D7314EE0873B81DA60777
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\System.DirectoryServices.Protocols.dll
- Size 178KB
- SHA256 fc0f22cc109a429b68d3d83fa48067166452942c25a7acb9870bd78a801cd8e8
- MD5 2006d42ec419f880c98bbbbb17f086a8
- SHA1 a865ba0595fcff5e045dbebd0f699f52fbb13ebc
- SHA512 354b95400724606e10507031669b847291c801d1503b0d72442db95f7b4d904347ee7f8584dc5c278736dd067d69009109c7e8c40ed47c536b9405e75a6d7cae
- SSDEEP 3072:l9THCcJnTPM7fqVCPecdwTPKu5RmX2wvCln1yZimWunuk/cD8IUt60ZeKFTpH4g:DTJsdwTPKu5I2wvClnlmWu9IJ0ZeKFZ
- TLSH T1D1043B1433FC0B1DEAFF1B74E9B051208A35B946BA3AE72D164544EE1CA3B809762777
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\System.ServiceProcess.ServiceController.dll
- Size 90KB
- SHA256 3961824bc760e2e5433c8bec08f85bb4c391ef545a1bed524bcc8cd4217852bc
- MD5 2263fef1a310e9a813067536845bdee1
- SHA1 29bc27e783ba51124e0e5baa81f03faadee69da5
- SHA512 0e11d70d9cffa8c9ecd07d28669307793a77fb96c6ef17a6be9289973718ad91ce08ca654675bf5137de281c432066ed85388ef479b314948457d8eeb10bef74
- SSDEEP 1536:8FHy6KWI+phJXYuk0wN7QvxG1TbUcWxaN0pg1bGgz2:8wII+pPof0wN7Qvx+uxaNP16gi
- TLSH T15E93F70163FC076AEAFB1F747CB161520A35BD46A935EB3D15C8419E0AF2B848A34777
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\TelemetryControllerImpl.dll
- Size 7.3MB
- SHA256 d783c0ae649b6d267c330c3c9d613d4c5ab09bf1f594598484da1760f0b16e4b
- MD5 7a1b3a54f39392375078dac7b2822ad1
- SHA1 7008531c23e7f266e9a94b20bf98f8038aca5562
- SHA512 518aa3b5060ee69f6d46cdc0ff5142109a1129b7b3481243a2291114ac436b2235d0bd6498a527a25686cf6901bfc3cdd2f5caa7d319e794eb587fa03b55d759
- SSDEEP 98304:MJrBHlha0hhvIzoMzMk/Tm78Wi6bPtBrtkXb4:MJNDa0hhvtMzMk/TmQW5bPtB5Wb4
- TLSH T147769E5AB6A400E8D4B6D23CDA578513D7B3B8254331D7EF06A096791F73BE09A3EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\UpdateControllerImpl.dll
- Size 4.5MB
- SHA256 058befee7a55f5d8510de91f4746053fd49393f2f1843c4f090c3dae60d7d540
- MD5 150ce3c5de43955af87ef53f51c1c866
- SHA1 43cbf73c227e208bd2f601c91a27d58962f08e51
- SHA512 20855a4289f8985ffa840d00819efeb2d2f076fff7507f695cf1a3f6927a7b48cd85285e62ca8d25cd4d2593b00b6614c5bc88677cfb8b933f8138b09a9b48ee
- SSDEEP 49152:lzY8o3OtUDkkGEVl0QFxd/X6LCzqlXB9eC24aeZSRBFZ24uFpei6tyP/ZNZoyP++:2en6yQIV2ZOFoxtFlwGYT
- TLSH T19C269E17AAE900F8D8B6D27CC9A78917D7B3B8150371DBCF169082691F637E05A3B724
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\VPNControllerImpl.dll
- Size 3.5MB
- SHA256 9b2b33a5c58a3e95423f5f3cf4d0c53b27ae4a399c72de90aaebb6b6e000b17a
- MD5 93bc933c0188b182424b8ab87fc7e635
- SHA1 783d97877ad1344a49e4c61f7c65f2c9ee2be63a
- SHA512 3fabebe19ba4d28ef2eda395c2c8c0f256a89959d215529b7226162a940d3ae75edea78083f1f614205da5915d3bdb5c8bcbdea80479180e9a9ab81916bd8215
- SSDEEP 49152:lUh1BFqcsDLEh7i2Tlu1fVPicc27eYv3OhJBwzn5QOZFFRPtdPSnZnZwCAMxM:YvKRziO5nwnZGCAMxM
- TLSH T1C5F59D1763E600F5D8B6C23889AB8517DBB3B8150371DBDF0AB096691F737E0563AB24
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\ddshelper.bin
- Size 1KB
- SHA256 99198c557b03b24dbf40724c62c12c8c039447afedfd109e20061288963d9454
- MD5 bdf8a750ae5ff4858b88f1a0f729e4b1
- SHA1 f27c3c54473eb6787614a137af1f9a34e67d2816
- SHA512 187a178c872369032f2e4beefb9000cfa7ed97de184495ac06cefeaa4deb77d5ebac008685bced49203840bafed719a0097d3f32708989ca96acbab51812ce2d
- TLSH T106118C84C7A838424CE0AC06CBA0F42A0E45709717B65A4C96B6C669C1AD13C0CECFF9
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\ddshelper.exe
- Size 253KB
- SHA256 d2257e7643128166f46a88da45ab9c38b7c23d0d727551dbd9f780a43f4abd11
- MD5 10bc07abd8ebae1c977a9b2f32b8c788
- SHA1 55bbf844af546c27289cdb53fe9f05a31678d410
- SHA512 6ba48d29073b49cc0c3acb775dee91b8532fc75f0b41b8a84a40ceb8a4f84a8ea918beb3b9f27dfb368480c4893c749979e1721895d27bdfc6e686f16e8eec1d
- SSDEEP 6144:jC+kTECKVL+F97/2uXWbXCoReuENID4eH:j/kTIVL+L7+UYXlROIDD
- TLSH T1A0447C1473A108FAE967C631CD92CA13E27378514B34E99F436086729F37781AE3976E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\e_sqlcipher.dll
- Size 1.8MB
- SHA256 9b17ebe20a49308652607f422772894f70091bc6178d4f51dedd46344a6fcfef
- MD5 0f227f3ddf4b2df6da84c3789708a4c9
- SHA1 766fef31903a60e00d7deb9c25bdceeefdeda224
- SHA512 12793e75692df77205fb6aad4c460d317379cf2c40ff9143ac436615f4a9722fcfd0cf2b5167916c4b8eb6c322031b5377d24c526cc776ce3bd36aa740cccfb0
- SSDEEP 24576:svKRx/vwkwBaPd71Oy+jTr0vsJhXVu6fITQvipJUasZBGoWsXCEwnG:s6N+a1O3BJrATci43qsfwG
- TLSH T1A2957D0BB2B900ACD9A782B8C517970BDBF1B4151764ABDB159086652F23FF61F7A330
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\e_sqlite3.dll
- Size 1.8MB
- SHA256 94580f3c8ce445ff700dbec025c29486931c9daa02c0500068c2dcc33883fb60
- MD5 f3e858cf11ffc2282517faa6bb1fe8cb
- SHA1 040be69b1ee852e089ff3c230e925a2c638f1f66
- SHA512 fab68c9928443f303c9c0c8e14b9c83c34ed2ed26d82917dd753ed14c2179eaae8451167ffb8e42d8a41cc6505842a224627fe3ea23cc1190f5615e981080331
- SSDEEP 24576:G0QT9LAXxkXe4hCk8tmg82mhJhHE6+YPk1Ic1J+6K/H+gmnBaTpmIzgz7QThB5wK:GF9LAKCk8tTEHE3YcviCaTpmvHQThB5t
- TLSH T1DB858D4BA2B900ACD8A7D2B8C517570BD7F274151724ABDB15908AA52F23FF61F7A330
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\mb5uns.deps.json
- Size 2KB
- SHA256 dbbc5441a58be6084057667a83cafc0af9b3377061a9bda4cfd4fca3b651fc01
- MD5 8cc0eec65565f747598512e2bdbedd23
- SHA1 65694b215256cd84a6d213a1e3caf047a4838ed6
- SHA512 39fc7cd6556f10467f52db40a295ec21bea0aa8b384c2fa8dd5567596ec90004a0603abe380887915628634f5bc624aa8db10cd05e71310d756a6a1907f6ec9a
- TLSH T1AE51BA18F6946B7742B2B7A4A87E4541F63503372004248A7CFE245C4F76BEBA096F35
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\mb5uns.dll
- Size 1.2MB
- SHA256 6caec27acc9a2b2d5f65a541e56441859fdbd57f4a8dab5382815a626c84994f
- MD5 59e117f13f8a8eeb0d320032afe2e236
- SHA1 fab6af40425c3f96c180aa7add630214235c1c58
- SHA512 4e5e17cd9264476f938d3e79a2d2a57cda01ef45afb2b60e0eb4a384ff9f68218e272216370f989e75ff09d0c5e7da0d5cbdab3516605933a0298c01ba9f85df
- SSDEEP 12288:isjKyu2f4D8825SUdyT8wCSP36bju0Jw5bQaUDC:isK2f4AjyIwCSP36/2
- TLSH T127556B00E641A658C9EAB2707C7CE37D19B4EC2DFC9A611A74E5BB3115F4D00AC69BBC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\mb5uns.exe
- Size 326KB
- SHA256 f19c8cc084099c92a2c3412047eff41d0657ce88104b0394a03921717e31a505
- MD5 328edfdfaeb384694fccf644a9ce7327
- SHA1 71a0e1d7e2928681e0e61320377a59aa52e72da6
- SHA512 675aca98e28d866bad7930c736fcbbde979ff18873907ebfd7f9375489c45ca827678181698baaf9de2a23e177d370a24b535854e4afe3e73f462100b6d2f631
- SSDEEP 3072:kXwANETcQt1Onb5RHrfqDQXFn4dPPYseJwmZf2jT63b9lFYmHl5rbxBDsHBql:ClxnlRLfyQXN42D0ahYmFTQ
- TLSH T185644C93A56841DDD4BA86318E929910B7B53C7D8BF162CF87E075A90F72BC06E3E305
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\mb5uns.runtimeconfig.json
- Size 567B
- SHA256 2c24c7ea26dbcf2d50661e42f364e5114c056e9cfbf5e2b82c59cb5b3c6598cb
- MD5 2aea2c8a0ffa5fa8d755f17e1b17e6d3
- SHA1 e6acae63839c3d6846bdf8c0957bbe2f63fc2790
- SHA512 c51474e86d4d185b4d2de78f00e32ead6412ea5a3cd2f0b92610e88b9157f7306af62869253a3ddaf8791e8c8f9948e50a0d72c4aafeb9f74720ea4f61b81ceb
- TLSH T1F2F0E96ACA106DB718B9737ED62AC182EB34536B10041D96B5FC081C6F7B6B61212F95
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\mbae-api-na.dll
- Size 723KB
- SHA256 6aee09c65a2f22658a8a74459df2b9df5c81c5ec7d853e496794ef6f52ed8924
- MD5 53d9f6d408d43a8b9f080b87ac0df146
- SHA1 1e6c7befb2c68efc87508c705cf72427cdf45370
- SHA512 b4db12bf61ddcf16ff14ea245865b2aa0d71efba17fcfd36d64d47707f6f497170f19235dc8bf69e3961d8072743f27cdc343f228f331d6f27c41ea07be11b7d
- SSDEEP 12288:LFvU1Pr3pBWtftHAmoLdkm9c5Wn2VqK/Zny2E3vFn+hPraFnPFN:ZvUtKtJAmsdjc50iHoZ7
- TLSH T14BF40819A3AD02A8EA77C536B663A223FF7334541B70BE8B5E108E395F31760963C751
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\mbae.dll
- Size 1.4MB
- SHA256 523a8858117a691eb787348186d038b31cc0e59a9c2defdea11eb0a8fc7f6eec
- MD5 e62f405a7682e88d79a1cc8893659043
- SHA1 b247dba0bc8ecfaed96019750a9333eafd167b87
- SHA512 df98d764a78687e78f0725c9d9a0e486eac619d8d2399a51bd04d44b37539939f5dd51121bf18581bf77cfbe521d4ca34c63f6029cd97bc9d615a525fc25eac4
- SSDEEP 24576:WpCY6hJZtbAblApkstSIzNvvaY8wPH+/yRsxGwfCZLKDDgWn1mdsHHH:fYQRrVzN6zZyRsHCZLsJnQdsH
- TLSH T10D657D20B6D5C239E49E02B0A97CEB6F153D7B240B2495DBF2D81E6D2E345D36A34B13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\mbae.sys
- Size 155KB
- SHA256 c990dd89b65d35d6c9b34e21c78d96e206ec3bcdd934716ee61ff79da0fa5251
- MD5 fc98ddab2223dc73b950622801b31554
- SHA1 997faaec1dfd18b9dd31e1c216440a28bc4cd612
- SHA512 da08860f8c3d8a9204d1480f33d21f2ab922db5cbbf7734527ed05477c2d9c184deaedb63196876c989c9ff6c1b45b5792661f5bce92212992a7cdb664a793e3
- SSDEEP 3072:hcj/Hk4/53QBvOP8JsUrLx1o6GwzfwKYdkXEnU/H0KBJT2:hc4wNQBvOEJvx1o6GwzfwZqEU/33C
- TLSH T1D3F36C52F3B400F5D8A6C679DB669213E6B2780D2721E7CF076085252F673E4BB39326
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\mbae64.dll
- Size 1.7MB
- SHA256 bd25a747e6aaf00678eb705cafa894897241695ddc176b0993904d280a882054
- MD5 a60cb38f8d1407db3521adbd7ef30fb5
- SHA1 56c5a3348b5bc0fc6892bfd6720bac213a9ca9b7
- SHA512 e1d1ee3de6960c74dfa3a44a454bf2872fbc9fca9ec075a66647856fc56b6f2be5816bbcd45b87a702b337c73306c2515ad1e02f18ebd8ba9a2a0275cc86842d
- SSDEEP 24576:67QoNWQ11lqWiTLFlRDqgGEQ7rfEPQGWHWe+idhDcEU:6soNX1jqWELDRDnIljHWIdqEU
- TLSH T1DD855B06B7A940E8D0B7C1388967A76BE6B174550F30A7DB66508B1DEF23BE04E3D361
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\mbamelam.cat
- Size 11KB
- SHA256 64416d564725416c6869ea951878a2734b1f6940b11f7961a897c45f0d8c6625
- MD5 bd4ceae54af081d6b1dd91ff584c5d61
- SHA1 5ade462d66e042da58bb1447d1b31f1aad901b68
- SHA512 37e7abd312f694ee2c8ea54ecf50ed12c16684f1007c61d9a6d1d01cba958be511c5e4e11cd7393a5cd57349fda1c552bebca42962137e0d11695c195761ebb0
- SSDEEP 192:oBxybp/yRpJCSEbhLxyKR/2FWQFdbiI/Ex6RMySX01k9z3AgEhrZg:oLp+eFRvmoMR9zJug
- TLSH T11A320AE58A6C5083DCA7AC6087E8E5D77C3D67C71D00987921DAFB5409933CAFB2816D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\mbamelam.inf
- Size 2KB
- SHA256 e26c2d3347e5f077da92713c9df3cd3eae438fb7e29810bd5c3afe567d2d3125
- MD5 5d8c05cc4f9b4304d57ea10b87f2dcf0
- SHA1 2cabe3d39aa5ec16c54c7818284a2ee235d2ddbd
- SHA512 55bff23fee9852f229246b71721b3659c916079787935d400a97641449dfda752fc8fbf36f9ea3dc4028f05daeb9006a99660284a61aa5d5a466af0ee966c738
- TLSH T164410454AA538BB8697B35B81E472883BF5412205076384032DEC8C99B6DF0C93757AB
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\mbamelam.sys
- Size 21KB
- SHA256 ded569e249e590314d095f740c6b8934a5a797e4f3edbe0f78eac9d333f12a2a
- MD5 8da81aa1f6b89ce1d2e216e3ea351c59
- SHA1 4baf79cbade9a5584630a540e6368d547579fb12
- SHA512 6d611bbd9d480ef2defd745fd06c4ab86e181267cf689d9d0e124edbaf22fd30fbe2310879cc7bb6dde5bae72c4feea1d329cdecfbf101d95634f85dd0769119
- SSDEEP 192:C7IlO/ZnEc+PbYv6/i0RtPH920QvVUKjnegqdsW++w/y1wVWQ4uW/+O68RwX01kd:wIlO/i8ChLIxUKjnev6+Twc69R9zING
- TLSH T108A23B6549780283F6BBC570C7E4C927BD38F39677408AEB0591E5681DA37C2AB3192D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\mbampt.exe
- Size 33KB
- SHA256 d232d82e410de12702a67c58acf927304ee42f3e6d81a9d71eca99f9052126db
- MD5 98cb0a7fff731f805fef0b2430ad4343
- SHA1 736a108843d2ea8de516e00b7539ec557c2eb45a
- SHA512 271e819122911d90b8d7aa13ea941fd86d892bdd0f7a5d42583c178e042e7f728909f8c1316f4cad5a6e06f596b18a203ebfe7713e2d605cec6a0f7539f1c853
- SSDEEP 768:vHxz5YiRiWT+5ALDz87z8+egc2Ip4PiTxf1ml9dHZjL81:p97RiWh8f8nS9P6fIbHZv81
- TLSH T198E27CD68A685843EE47DEB0B1E4DAA7BD78B7D31D91C1D7306AC1910B823C1BB6C12D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\mbamsisdk.dll
- Size 12.7MB
- SHA256 0778cc030a9e8b7cd66950bf492554842ffb64d8e01b145c2dd9551c9239a78a
- MD5 10a694b956d9999531d9a21be1c4f2d8
- SHA1 3ac8fd5ae83ab8c42ac335a8d59ffb730628c11b
- SHA512 10b8f7c76d30e6dd83c360712eefb36d71b285a507944438d0b4d0645b01c74f2b12d8892a73ba5ee60b67081602a88b3ef1343d011a23fc958e7733c7a14c0a
- SSDEEP 196608:3LYxLLbdfBrYViPou2HocTCG/K5GLv7DuJHSWSbAZlyX2pD:38xLLbdfBrYVi96uG/raJHSWSbAZlyGh
- TLSH T17CD6AE17BBD540B9D8BAC23885A78627DBB2BC114730D7CF06A4566A1FB3BE0563E314
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\mbcut.dll
- Size 4.2MB
- SHA256 cc9b2f7379351f5cb246fcab1823962716c3b90dce252292f3c7fabf718a0c23
- MD5 e10fde737021eab76462e4f0fcd6548d
- SHA1 e24fad860352bedd64aabced856404ab09ca94ab
- SHA512 333ae97d9238d925e6fc3dd254d93f3a90dcd7a694e3a8487b20d257e9371070641d576970a17a27dab4f97780039f1867d90dc80365318a7ccb1fe0b196edc9
- SSDEEP 49152:LsIdWtjIxvFfomKYsEwpmUeT0MSD1TX8jmxB5sVvXsuY2AYuSHyp4DZePe1zU/6n:LsWGqfrKYepmnIvqvXTAKWydzkT0d
- TLSH T153167C17ABA501A8D8BAC23885778603D7B2BC1147709BCF16A0667A1FB3BE1573F714
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\mbshlext.dll
- Size 3.1MB
- SHA256 8af36217efcc1b2a677accc77839ed3b67ddbfcabfa16caaa42c7e95796b940a
- MD5 d82467d25954c9fbaa91ca97e0de6834
- SHA1 d7da2b4f83acd0d2aaf55de2ae403fa6cc44bfc6
- SHA512 84a38b2d4a1b23439f4c6eca1fc148d618effd1444704f37e5812488877d15789b603944231281299ba332dbd0d3a0e51160c588c0adc1bf338675c62da45aa4
- SSDEEP 49152:zHsR0cmbmDszn14AcKLfC659mLVD+Bjmo+2g5rCdPWD8i51l3z:zHBpmj2Am0D8g3
- TLSH T169E54A227A9540ECF866A23864FB8502F6F27A05236097CB0558727D1EEB7F106BF7D4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\mbtun.dll
- Size 2.8MB
- SHA256 f21a980316bd4c57c70e00840ab76d9ad412092d7d2d6a2cff4f1311f7c05364
- MD5 2bbf63f1dab335f5caf431dbd4f38494
- SHA1 90f1d818ac8a4881bf770c1ff474f35cdaa4fcd0
- SHA512 ebb9834323329dc01ba2c87e5fad1083a4cb86f5ed761cb63299ac5336a9843a1aadd42fbed706797c2295117af1c00f96806422338352653c8e0255fecc2fd5
- SSDEEP 49152:xNrdEZjzdAj9fdc4fDrN1OxOh5PgqdnBq30yPFZP7KVxSL:bBzFRkshaZP2W
- TLSH T136D58C1AA7A800A8EEB6C27CC6578603D7F2B8151771ABDF02A456791F73BE1173E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\offreg.dll
- Size 140KB
- SHA256 8e6c155a97666c8e6a3f9ea95bfc6f6e4f87beac53dd72164aba3ef33ff88db1
- MD5 1659738d57a15a0983f0373b2faaef45
- SHA1 efd4cd05ff6bd787a2ceabfd11daba1c0e475855
- SHA512 4f62cfe0579e1aeeeb30edd5f42a2b1880446dd1075be051e2e0189da5071f9866e5425ff85547486fd7d952a28efa4e784db0cfdc1fcc428b34eaa89c6a7654
- SSDEEP 1536:kXNnhdTcQOCr7LClg5lSYOurIt/0q9mrf0Xp2N7RibuQusR9YfIZRoU:cnXTcQ57LClMlSYA0q9mrf0XoNHFQZ3
- TLSH T111E39D5A73B420A6E8678678C569875BE776B162232087DF12E5C6B80F037CA7F3C345
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\rtp.dll
- Size 4.7MB
- SHA256 a5b2dd0672accd7d17e091a07630246b7c865bf1c258172806b5643cdab386b4
- MD5 598a5d58c0201dbaabc6de41e372e929
- SHA1 8398cbccd895106abc3299181d242534252a4fb2
- SHA512 18399a35a3bd317caa766bc1d55cabf7af4e393f5233aae1c424b3f180d4c98c850b6ac8deb07f40379b5eabf291c128d4112cab0caa4f6542f6956b7a31cf11
- SSDEEP 49152:8lsD4iHitygEQR6sn+MK/1mWB93Fq/p1/M9CYh8EXywoDdWJKPCWzU3hyd0vzyAD:FHiDAFMpy9ByZE5Xx
- TLSH T109368D17AAEA00ACC876C23885779503EBB2BC1547709BCF0A6456692FB3BD2573F714
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\sentrynativesdk.dll
- Size 596KB
- SHA256 6e6096dabfe6b34c3e6ccba49cef544b7be6158e34168f819f8cac1b3645d4d0
- MD5 efba4bdd511e95708c555984bd21c2bc
- SHA1 dbb823e9530ae40249db0bb8b85492ad1574e8b4
- SHA512 058110541c3cff39a0a3c136b6eaeb01896e04bf192d7138e0cd680203fd7b0d05b056d90fd0956ae537329de5c6ff1c666704c568b73554fbe4e56bbbcc8c8c
- SSDEEP 12288:m5Hiqt9csEXkXfE/gv9DL+2/xzEdqwuKyCCGBazBWXsCjTls:m5Cqth3fZL+oxzuqwBCWazBWcCjps
- TLSH T1D8D47C5A76A803B8E07BD238C9934907E6B2780607719BCF03A057A76F27BD55B3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\version.dat
- Size 10B
- SHA256 c78527d9f17d2749fd433e4ce8f9ec8482f353dea3cf11b458eaf98d8449293f
- MD5 4514ff9e038d46c64e8a2cb1fbe7f31b
- SHA1 747ca1b5337fe6fae7f4e105e109ce6c5cc25f73
- SHA512 8baba00053af65f46bb56ac629b112045f58d1755fae4747ff1ef391c3ccb0ace0b927ecc94c315e578dcb2f80c97b025d4c30c872878db5f9699c2687ae5bdc
- MD5 SHA1 SHA512
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\ctlrpkg\wireguard.dll
- Size 1.3MB
- SHA256 d2ad6ce25634776f5067fd9d5750a5e3d2add1adde98eb1f56a2df194d0e9cbb
- MD5 bafa63cbef47269e12392eb29ff87070
- SHA1 a5814b3548010dd3e3413835bdc0590f726346f6
- SHA512 95290f78b4bf8d98e64c4c5280ac334bdda56265fd88370d7ba2caec93c776a13c33105fbd1c9f9bb8189d769415b95ca5dfe74f7276065e619eecee5dc07e76
- SSDEEP 12288:DUenDNpq9bKeKqM7cyOcN7kWCEKI2ExcN7kWOpPD:9pqFKew1N7VCEvcN7VOlD
- TLSH T1C055AE41B2491B94D4A283FDC9E68175A67ABC145B20CAFF0034F2686F73FEE9476E11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\dbclspkg\ActionsV5.dll
- Size 6.1MB
- SHA256 f2dc3b02c39cc92b945ebffc0be675251e93de87158eaf47bfeb5c3231488173
- MD5 d2ddd6f0a411ecd5023812336c7c386f
- SHA1 7eac246c6bb316814439d9e124d8371f27bb647a
- SHA512 6c2b3b4f4802670a1e461c6035a9ea32eafd653e7d5c9352b92fb0e27e3e1f5de178f02fa6875ea75d247f1545065e35f8f1d27105912ba7c19dafb24b535602
- SSDEEP 49152:7msy+BT0cuT6iMx6RqDX1aldmjrHPykS7WbQMB4wpZ4fKBj+Ae+Ysyg1cqW1wyT5:trTQNPYrHqe3le+jyTwyvbKIf/j
- TLSH T15C564B16A7E802A4E0B2C178EEF79103DBB27C255735CBDF0190525E0E73BE19A7AB15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\dbclspkg\BrowserSDKDLLV5.dll
- Size 7.0MB
- SHA256 c72e39709b26ac7577200a76515347ff11c0a9424cf61657762d657e7aecd974
- MD5 36b6cdd3677d6a079cd21768ffacbc7e
- SHA1 e525b6c778d7b59ef06300cc980f63bcf581a24a
- SHA512 e106563a21063eba244b536e67ececf2630415d5857af8aa67bedecabb39a87799324c3024bcf84487fbd9cfb76dc24b27ebb881734b4157a38b5c74d538ec3e
- SSDEEP 49152:8VF1SVg1db+wMSI0nW5xjpvypuDYpsD0VXZTWqls/e9uETWgjB+S/YfbWf2zv7je:s8TeZKT+X6S/Yf6fITlRChya9Fx
- TLSH T113768D17B6A400A9D8BBC17CCA578603EBB2BC06577097CF16A4966E1F73BE0563E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\dbclspkg\Global.nm
- Size 349KB
- SHA256 7939750c0c1cfaeea7037af0bccfb4fcb3eb8e21aa6e5d391e5f9ea4bcfaf545
- MD5 65d6e50395882ad2e4f70eead4d7cbbf
- SHA1 77c1f7c7d152f8d8f4d714ed07acf35b033ee939
- SHA512 afd078134ddc13c47e99a9b41bc2af7ba8af0573faeb9174e9be3a44e448a2642a9d9c2868d04ad58d48c7056c0a0adc64637e7dbe00afd5c920e125d6c69a14
- SSDEEP 6144:0hbXa/Q91SjzWeGZhfiYUZMAawskAEsYA8cwFl0pE1JOdiq0bWxK/R8lyA3hye3S:0hbK/Q91SjzWeGZhfiYUZMAawskAEsY9
- TLSH T133748BD167AE2354F5B2EFB41BA0DA25597A6CA2EF00DB99D302145B193DE50CB30F23
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\dbclspkg\Global.sr
- Size 17.4MB
- SHA256 f2e710c97425f295fcaf79945cd7e5ce118d847890f3227c2e0510ed4008308a
- MD5 6f6fa63bf424ca7212dc8f8a51d09843
- SHA1 fcff5ae9399f21bae2ce0fd329fe3c83f9554b00
- SHA512 50601748ef66bf5613b56ad1d85b271d7c8f627872fb4d1a4d8ec5bfe14094d07892e9624616682ade82a8b50d0e63321cbc3a3655dc4f959f3877f2aac5be45
- SSDEEP 196608:Vx+pAYnJbZvAGTUzWmU+980ChbrZ/Z//DXcbwoLMvWUkXMrSYXWaPECNuzUbub77:fKX/TUimU+98zhXTXcEoLMFrFPVAzFEO
- TLSH T168072366FECE2A7FD429D7BB094F8F394242A7655A138109FFF006AE83585558F39302
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\dbclspkg\MBAMCoreV5.dll
- Size 8.7MB
- SHA256 b226e4e93acba45a3e6c0ee06d6fa1c62fac91ae37c86595ab395088ab9edbc4
- MD5 1ab568867f09d24d997c993e185c4f08
- SHA1 bd97a322c4736f420c54c7ecec02e8bb1d764fa2
- SHA512 1c4d688a1897019428c8c7fa2dfc3368f6f7e3e1cfa55c915562a0630e70d5ad9ea2b36a4483f1b94118db32e5da85722a1524d52a5aa781933d583678e4f448
- SSDEEP 98304:9lZ2y5IWilAVOyU7mhNl/DP3RtFJe92YiGNwmdQk:9iy55ilAEj8Nl/DP3rFk9iGNwmdQk
- TLSH T192967B2BA7A400AFD87AD37889EB4502F672B811537397CF16A8A1761F637D09E3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\dbclspkg\MBAMCore_b.dll
- Size 8.7MB
- SHA256 c6d9cb10c3003a1e660e03b4f71c6a89601635f036590ca2f2e5bc23704d4478
- MD5 91f15182104d37d0bca5f0437e27dd44
- SHA1 82bb9fb8b73880e24f9d713701a5939631ee61da
- SHA512 081f20756e4d0b1eb432b4154187c7d3fad2b92b6e541f222dd567561d0c41a55cc40708a0e4b5e909c85db65f526e0f26dc115f3f310431e6934ca5627dda0d
- SSDEEP 98304:infxpayBsl++kliecj9fzbwgnKrb/Dk1eidiCpQA:infxpassJkliecj9fzbFnH1eidiCpQA
- TLSH T18B966C2BA7A400ABD87AD37889EB4502F673B811537397CF16A8A1361F677D09E3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\dbclspkg\cfg.bin
- Size 2KB
- SHA256 06cee2bf32530582fe8a7f84afd9be786f4986f3b35ad5c3989e61b7fab1e3f2
- MD5 7d6f402b86e291388f77a3afb313a7e0
- SHA1 5eb5bee3089194926abac8b2111db6018321e0fc
- SHA512 3e1e9fb48125d09f43fffdec679486e6585e865afc325e4a7cb97c4267b1d3daf8bc6fca63e272e9bac30fbcfcb13fb839b826a7063d5d7c3cba89df454c9d70
- TLSH T15751F8EC3F021B20C91BD8B2FB6E5B953204F2954A1D96525B4E80639ECA5C6B407F41
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\dbclspkg\clean.mbdb
- Size 20KB
- SHA256 72377bbfbfb09e4cbc2e2fa193f2ba28eec7620f26fe87e5ef221a26b82f7346
- MD5 fff858523e1e219987d83cbd2391eb46
- SHA1 5e8f4088ebe70cc1a9c23434c2bf5fa9364fab89
- SHA512 5303ef7760cf7db357389cf6c9abe3c85e5aac40b16693b9fd4a192f84acafaf40c92cc223b6e1fecdecc3908d63a34a519796827249a86aac3b3d6fdd6e639f
- SSDEEP 384:5e5iJaYsVKMH+K0hq0Vtj8B0kP3k7fzPO/JklLwFYQMJV8DhDoskxkBwRF:w6Y0MHv+q0VtjY0U3kbOWlLyY58DYm2
- TLSH T1F592DFBE4D812DC47CECB2BF373B60B0EA3C5E81469B9C40551944C85C7F8E4A69BD61
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\dbclspkg\dbmanifest2.dat
- Size 924B
- SHA256 7bf1ec784a21ea2ed4a606bddfed9f3382a9850e9b060db71ecc12e5ddee740d
- MD5 2a82a11d683c5ff22dc8bb453697fa02
- SHA1 074158252294d3f5e5b6767a5ab7b7990ad5e889
- SHA512 d3e2419fe22025e62149393b4124c7c2e14090d0945de640d323acd12e959f07ff22c05bd1d9217552f5c2e37c73a47d0ad49010e3b96b50f6b3f7263efa86d5
- TLSH T1B511C8F0C4563122100F6FCCA4C894577B3247A2517C1B9A643D4C9FA63441C1C4C887
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\dbclspkg\dynconfig.dat
- Size 39KB
- SHA256 008254ca1f4d6415da89d01a4292911de6135b42833156720a841a22685765dc
- MD5 10f23e7c8c791b91c86cd966d67b7bc7
- SHA1 3f596093b2bc33f7a2554818f8e41adbbd101961
- SHA512 2d1b21371ada038323be412945994d030ee8a9007db072484724616c8597c6998a560bc28886ebf89e2c8919fb70d76c98338d88832351823027491c98d48118
- SSDEEP 384:jNOT68xDvtG9ObE7L8u8sXNVkIfvs4FRj:ay8u8KVkIXsWRj
- TLSH T15603A21266FA1001B1B36588AEF28570DB2B74D965399EBF00C5464A4BEEE40BC53FF7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\dbclspkg\exclusions.txt
- Size 23KB
- SHA256 9e87e4c9da3337c63b7f0e6ed0eb71696121c74e18a5da577215e18097715e2f
- MD5 aef4eca7ee01bb1a146751c4d0510d2d
- SHA1 5cf2273da41147126e5e1eabd3182f19304eea25
- SHA512 d31d21e37b0048050b19600f8904354cff3f3ec8291c5a7a54267e14af9fb88dfb6d11e74a037cc0369ade8a8fb9b753861f3b3fb2219563e8ec359f66c042db
- SSDEEP 384:OpHJUPIIawosLqVqmv4EHUtVbUQIKiKn6p+C+vNCMSP+TyHS7ivS/6:mYmsGfvSp/6pzgH4cyH9E6
- TLSH T1B5B2D73A1CBD123751B4C6AACFD58877F640E1A7316A183A64D7874987CBE4329C31BE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\dbclspkg\igV5.exe
- Size 1.8MB
- SHA256 f0a1eb806f31c9aaacb91b61816ebbd5e13d93e5653b1bfe2dff71159582bb30
- MD5 4ddf3a45147ba6ba9b0a1de6af00153d
- SHA1 9f26cf5b581adb01648dafc49eef4bfc06d4cba8
- SHA512 ea3bf7e8c5d4fd4f02a3a187b6f0890d5ec4aea3d90c40b12f0624516f25525c12db32db4406919fbfc42ca21e1737be19bdfa792becb9c8d5067f943dd3c9fc
- SSDEEP 24576:2upw8j0kcU71dHGvPKN8kP95bLS0pBm2L6y1szQGfthuTVHzw8mvk1u:2Q0kcOnk88kPt7+zQFZw8mvk1u
- TLSH T17C95D820BAB6414FDB9916B82EBCAF9D22AC69490B6059C3738C975D0CF11D344FB376
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\dbclspkg\mbdigsig2.dat
- Size 514B
- SHA256 61d32df20cf1ff72e9c795ef6b6821371d04829a92b374f4979edb8c5287dc4e
- MD5 644447f4491706a2fb526146af8451df
- SHA1 3eb9344928bfca5f85ccbbdd35fb09fea3c234fd
- SHA512 2a67065101822ff7023f5fe4848e38dfe30dd19342fccf8b9d5dc4a9444a3153fe362823e1da100c06127bb9963f1638985f6198ca7283aaa55adc9a7048d1d9
- TLSH T13AF0C048AD587C919A9E1B07FA893B6265669FABE06190140245C1E4462BE04AF1998C
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\dbclspkg\prot.mbdb
- Size 24B
- SHA256 6089fbf0c0c1413f62e91dc9497bedc6d8a271e9dc761e20adc0dccf6f4a0c1f
- MD5 546d9e30eadad8b22f5b3ffa875144bf
- SHA1 3b323ffef009bfe0662c2bd30bb06af6dfc68e4d
- SHA512 3478f5dcf7af549dd6fe48ad714604200de84a90120b16a32233b6d44fa7240f5f4e5fe803f54b86bbdfd10fa1bfdd88fb85eb6a78e23e426933f98d0a2565ec
- MD5 SHA1 SHA512
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\dbclspkg\rdefs.mbdb
- Size 24B
- SHA256 850a4ea37a0fd6f68bf95422d502b2d1257264eb90cc38c0a3b1b95aa375be55
- MD5 2f7423ca7c6a0f1339980f3c8c7de9f8
- SHA1 102c77faa28885354cfe6725d987bc23bc7108ba
- SHA512 e922ac8a7a2cde6d387f8698207cf5efbd45b646986a090e3549d97a7d552dd74179bd7ac20b7d246ca49d340c4c168982c65b4749df760857810b2358e7eb69
- MD5 SHA1 SHA512
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\dbclspkg\rules.mbdb
- Size 6.2MB
- SHA256 09f70ad7fd9d15f6fe2cd8b4c1c8436291ebf067b873ed39370b1ce1366adb0e
- MD5 a8beb1bbe522f5fad3ae5b88d1fa48d2
- SHA1 89b9b89ffffd5b5b501c6a0f3184b6218a48f1a1
- SHA512 385ca06df86b2b8ae342b4243ac25b5b46b17991218a60ea97efcae975944c706aaa55216fa792628b877dccedafe4aa7a9999cef9517b83de238508bc0f0d23
- SSDEEP 98304:Y3UJtRgOMIP1Zy54nVAefi8Yh5V2yVu0momVB+g/201nTKYwRE6fEK7GGlTQ4vl4:YE7nMIP7JA4LYfmLagu4KvdE90Qul4
- TLSH T1A0663391F783E1A543F12722C757CCC627EC3BA9F5198DAE6F1C696188034AB242D7C5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\dbclspkg\sampleV5.dll
- Size 524KB
- SHA256 0f689946ac46566be81be8cee3f6bc29c50b73a52ba2d0c7fabb25baf952146d
- MD5 ac8c715cddc2a27f67b3e63bb32ba32a
- SHA1 20bbc4c15c6e2d15962a48d72dd96a40881db0aa
- SHA512 ac8cc10914fcd2d259a6ad226312313d2d4b1afda56e41a7f83a06cfaa352108dc0a03b45194163e372048c634f338dcec515945757684dba046f2a592070c0d
- SSDEEP 12288:bYIAmy9w5vPkTEetmCqryujcqhL0HU5WhjW5/R18:bY/VJrqhLcE18
- TLSH T113B45C00A760C01CF4F701FA97BA969DA8387970777CD4CB61E1E98A1A649E5EC37B13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\dbclspkg\scan.mbdb
- Size 408KB
- SHA256 07726338dfc11bbc05c326ce12222271e31e083b747c8df812121fb4c88076b8
- MD5 bfa8ab4f74377174dd8414eaeebe652a
- SHA1 0772418924ad6275ed15094a270f67714fbf1039
- SHA512 6175011bb3e053a831c507c50e55f39a67c3210664da6533c86edddf93e3853272397e7c84289d0bd643559532a0c9abc57cd21d1019844f062ff98d37dc51e3
- SSDEEP 12288:zUld8NmEksMhiOUrLIPJnZknkvV2OZY7QHVOQh2I:zUlH4MkLkJynA2OZY8wQ9
- TLSH T18994232596ACB11ABE51A35FB3B6A2EBC07D7C7A4238FFE642F441E90D1B7052050BD4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\dbclspkg\tids.mbdb
- Size 131KB
- SHA256 f931c175ddec37e2a552d3924fc9135d46dc3d89f07edf8400a66ca735245e70
- MD5 b2b05e42c81953983988e502d96977c8
- SHA1 db0b324f5a0f2501a8ff59214c4fadbad6806f81
- SHA512 8dbfc389e8a648370ca822d38abefad5ed1afde3e25db2896494b12b527c2d5a9d83912c839351eff664f49ca57adaa5cd763ac1b002b2be0c58c7713bde42bb
- SSDEEP 3072:RyZCJscm2lQVnG+lmWBEKDtKtmfHvOt7Q9LmxGmJRvsW7/:wUJA7nG+Y3UF6x1sW7/
- TLSH T1C5D323963B41DB653E18A29DA2AC386CF540FECE3B51C343C62574065BA4BFC6B548E2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\dbclspkg\version.dat
- Size 48B
- SHA256 0ead329fe8264cc1bcb727db0e389273b4a2786e30dcc9d39460c087122360a3
- MD5 7aa40ad15a0a0233a9fbc6d8d446d455
- SHA1 d6136185538a820f0da0f60a2b5bcaaefd932861
- SHA512 fa0bdcad5164045515a3ac2ea917245c8f8007ac7604301c6f450b58c160c0e362f9baec4a3035d3bceb94a37492f2bf18e98ca552b3b4e1e1ccb7f2f0fb0f21
- MD5 SHA1 SHA512
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\dbclspkg\wprot2.mbdb
- Size 18.2MB
- SHA256 1b2aad431b24955a50f72dc9997f3fe645386d7de2a09dc19f538556dcbabb05
- MD5 762c2e9eab7c0d2464d54088a726a813
- SHA1 f1ded434556c1037b47df8c2de7f3512d178cd53
- SHA512 c8931956ddfd1ee0f40e9a66da70478ce4c46e3d9048dd6c9c158cb0e1dece0099e3e557316fe4588a0f991e84c359318e3b1fb16bd82215bd3412fe3fba072b
- SSDEEP 196608:UKqI7QhLx3cxdegv7gBXyomINv1IjtOKU/a1PPkd3OoZujez4/LspjDtcNRJX:MEWV3Edpv7ZomwMOK7dPkFTz8ANDoJX
- TLSH T180172227FC15E116CBB6503A1ECAD4E217723B8080628F55B2596B31FD7583D7B2A2BC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_138bef5f8c3b11f19a327a3be15c66e4\dotnetpkgtmp\shared\Microsoft.NETCore.App\10.0.8\.version
- Size 50B
- SHA256 42559a4970a981aa61f3ed59ad44d05214fcc5eb97c35d06a88102a0b747a45f
- MD5 9072ad106b74f3900d25ae80843c8a24
- SHA1 b664a23dea5a5591c21fe0f4a9b5f344079d94d1
- SHA512 ea866258bbcccc0951f95367f3309db65d437ad27eb6fcbdfe12e08b9f76265050d6216091b89f0dc92db66b24f8238c8d6cc98ce49e6c3bb6b051ee037e56a2
- TLSH T1309004444445D47315D3313453015154F00C5D3C5D34CC11D05F707CC4D705CC55C301
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json
- Size 1KB
- SHA256 f6edec4cbffe6b7b7783544048361e567c5e9acb9cac5d4dfb534e1956bf1c60
- MD5 a92da238789d0ed1a57f9a948b80750b
- SHA1 0770af4c878b8779dd0723635a1a198462f4743d
- SHA512 1249a63472a7bccc0f1bd8091a48ce0b92ba96c3e1b00e5a1bce910c214a5a8d81b6a0156340076265fcb6a72be94c7726208fd5fb2955a5893ddcb646d0ced2
- TLSH T19F31A9241D01A93E7AB801885CD48A0EFBF127571099D86BFAF1E5D8DDB7213910AA7F
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json
- Size 47KB
- SHA256 df5f0852b341ec581e1a81e1bcf0f348f37af2c88361ba08a206643ae56f5b8b
- MD5 6196d2939dfd6130bd5a17f4fe8c9e2e
- SHA1 c0a8747ae54107f89540f84f069c0f14fe31a790
- SHA512 d2182d34497323963f1b21d7c43d3eaaa1737f35732b9590d70619bab4533dc52c247e273addf5b7f8e93a0d7b5f95f3a5cb4b794439de30ded5aed25b7cd245
- SSDEEP 384:zriPalGB5AWiWq2mhzJUVVqxKS3xV2CjNrBa7gHOykEaf:KUAHiWqn1UVVqx9U7gYEaf
- TLSH T1C52382BBD9DC0D1B99712294A9B94607FB20036F10980C17BDBEA98DCFB751394C6F1A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json
- Size 66KB
- SHA256 a650dc2b851c74320f66c940ddd5cc5166d6112c3eb57fb2d7275cb795e10823
- MD5 e4fc9ba25ee554edc13b6319d11d0108
- SHA1 3a858a46f5a2036e20ad03e8aec22d7108343602
- SHA512 6074e0d6dbe341a1ae78e366571bb9065de44c001cb1a1c773ab93870d16bd7c600d1fb8342d71c4e2f3240b4a9ee5b51bb0ad2b04349c59433f7a66deca4d7e
- SSDEEP 384:T+riPalGB5AWiWq2mhzJUVVqxKS3xV2CjNrBa7gHOykEajctcxPad:TDUAHiWqn1UVVqx9U7gYEaIKod
- TLSH T13863FB76D8DC4D5B857123A4AAB94603FB50036F51880C07BEBDEA8CCFB781695C6F1A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json
- Size 66KB
- SHA256 e6fd650f562d890dabfa18a5ed2613dfd1668c6ccd83638f7fc07a92750e4a38
- MD5 0561081ec28e2c4608bfac9622c3dfcf
- SHA1 797a329db38749a796fcda0a0082da2a9a03aa84
- SHA512 a56159dd2ac7ab04f707d1edc0970ff7471582e596dade17ae4b77e4d6e3ad44c5e6949e393c16b27c546c8a51f9d533678d9cf274e977a26646c6914f4c2124
- SSDEEP 384:Olr1PalGB5AWiWq2mhzJUVVqxKS3xV2CjNrBa7gHOykEajctcxPad:O3UAHiWqn1UVVqx9U7gYEaIKod
- TLSH T1F963FB76D8DC4D5B857123A4AAB94607FB50036F51880C07BEBDEA8CCFB781295C6F1A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\ArwControllerConfig.json
- Size 1KB
- SHA256 47ef6af28570fa197258eaed978dbc351369b9619bda022707c0506ca77d1808
- MD5 153b8b2d8a301a8e5c4f0e8b21a93dd2
- SHA1 f0d6c5982434bc4d3356fc2b64fdd3171b840a1c
- SHA512 e4899099d50d234d1beaf64adc66d6602a7524d99db98c4caa5ee5808bb2980c9cadd184828f168597e9833d1c0a20515ad0e02479bae9f257407260ec7aaf74
- TLSH T16F2126528A2419FFA1FCA009E9959253CFA047656418083BB2FCF788ED3A67263C2CD1
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\CleanControllerConfig.json
- Size 949B
- SHA256 7e6529c21a50fb5424cdae5fe496aeb5b81770db2fe38682ef7d6758be4239f9
- MD5 accc6ad5bef72d8f6a66c90df54a3cf5
- SHA1 b9a638e3ef92c22bd4954f14832137c24d8453c4
- SHA512 075a1a556d8c27662fbfeaa5a53ff8ffbaf8a37da031d3ec14ea0059aae8d9ee61a1f8ed43f9b8227948c22fd725a8e37486efcac540078621cad2535dfe8c0a
- TLSH T11D113A74840164BE54B9634EC4B5D581C790534A2C504C4BFABCC99DEE73436B02ADD9
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\CloudConfig.json
- Size 1KB
- SHA256 59189fbee2974901af800a976259b74606b5001fa2507652902100ffcf778bdc
- MD5 37a8f4323dd9363a83a56b2534ed08b5
- SHA1 1d7b9234d7903e7b6649f620e2a56681b094a6e9
- SHA512 223c64e281c30d1271f2de630f0632041c74284ad07aabe0cda9c4437501a9969e79ac2dbc8cb68dcf3a1f8e12be947dcf91e9c272b3dc973b9523587a7f4af0
- TLSH T1D011B2179222ADFAD4BD262C5F2E9786C37853131485086B7274C9CCCFBAB16501760F
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json
- Size 12KB
- SHA256 106cf853d64ce26e438aac7c6b874e4bb108057b47a569b036adc2f8caf23ba9
- MD5 3b0d9bc39ef2e2f1f0b89bff9ad28de9
- SHA1 c9b92e28184d4cead89bb9ae9dbd0ef07e9820a8
- SHA512 6c7d000ac1ec767e20d40ecd5ad126aa7eb5f7ca69afdcc8654873c1a03cf0e60de55aaa16cb1cd6fc879016e8653df94191681ec0eaaaeef73a8a3333be1d5b
- SSDEEP 384:ryamlYgVMzhrgHTb0MAJUKfVgH8BZ8ZFBE:rRmlYgVMzhrgHTb0MAJUKfVgH8BZ8ZFO
- TLSH T151425426D1B5DEBB66FD613661B40B82F364C75F08410C07797CC88C4F7BD2A62C2AA9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json
- Size 12KB
- SHA256 a04f595ee1bdcce72ff20061a69261e65884d6a3ec89ffcef9bad04e7c03bb97
- MD5 c303f74f090493f0ee3d37d8f13e188e
- SHA1 a36fd7b890bfe761cf770fc56f67018ee88ca84d
- SHA512 891178f1f64ab6e475763e3f43f04b83a039888b9884e8bc42b888d15e5a274dfb0fc5637356a62ef274593216ac6284aacbb7d877dad28f20d6eaaa25452307
- SSDEEP 192:DDmf/FYgVMzhrgHTb0MAJUKfVgH8BZ8ZF+Ps:/mlYgVMzhrgHTb0MAJUKfVgH8BZ8ZF+E
- TLSH T10A426526D1B5DEBB66FD613661B40782F364C76F08414C07797CC88C4F7BD2A62C2AA9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json
- Size 12KB
- SHA256 5643c9600f7246f1096f6dcfaf277daa9372cdd1beba44de6990df732e7b57da
- MD5 b6ae061ea48578379967bb4117bfa2c5
- SHA1 eb337a6c196fd89c3fb38fa836619ac9c0728336
- SHA512 24093fbd53a0f99d86a7102c207cc64328a08a6fe2abf7e1443331359e6783ccb534bf8b78f138e8231260ea9c55ef4c630e0720a083b0e6e250ee3f13d6a214
- SSDEEP 192:0Omf/FYgVMzhrgHTb0MAJUKfVgH8BZ8ZFqP9:bmlYgVMzhrgHTb0MAJUKfVgH8BZ8ZFql
- TLSH T1F2426426D1B5DEBB66FC613661B40B82F364C75F08414C07797CC88C4F7BD2A62C2AA9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json
- Size 12KB
- SHA256 94446e66176b44c24e5c60d3468df777f938f0b0ed09407da2bfef7d52f6ce05
- MD5 32990d690a71a439964fc8c7d9f1eec4
- SHA1 e07bebad62651d22b5fd4243524c0e518e46f462
- SHA512 77cae434d019b8070c2c0920fca0d73d99dba5a3602cbd3f6db688b6ca3b5aee792e2e03e915326ad38478c081221ba86692b30cfa759f5a0d3538d90c28a163
- SSDEEP 192:3vmf/FYgVMzhrgHTb0MAJUKfVgH8BZ8ZFqPs:fmlYgVMzhrgHTb0MAJUKfVgH8BZ8ZFqE
- TLSH T12F427526D1B5DEBB66FC617661B40B82F364C75F08414C07797CC88C4F7BD2A62C2AA9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json
- Size 12KB
- SHA256 4cf51900da2cb5417971d62b900339667ab537edefc4f32659dd932dffc46e45
- MD5 a56d4940c770e66a5dbffc2db8e1af4a
- SHA1 7479b2a1cd18a5094c0acd6f98f087ce6808881d
- SHA512 889eec757f43e2eb5b6b1873cb7ae122ddc023e5a4aa113a0af5530f2e9a559fe89198c7f0ab2dd1010f75ac90acea7a9acacba6790d9ffd64bddb43858a38fc
- SSDEEP 192:fYvmng/FYgVMzhrgHTb0MAJUKfVgH8BZ8ZFYMNPWq:QmKYgVMzhrgHTb0MAJUKfVgH8BZ8ZFxz
- TLSH T133427726D175EEBB66FC623661B40B82F364C75F08414C17797CC88C4F7BD2A62C26A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json
- Size 12KB
- SHA256 dd7f3cdc48839921a0ea9bdba0507039bafc702721a67a69ad6738e71f18dec1
- MD5 42bb02440d250356e3696dd2f293ffd9
- SHA1 5b402860bb30eb2ab710cf509b11618f9f28171d
- SHA512 4f8dbeac5e112d901d72e52b0cf3b5e96ea90b50e38fb969b8509b6501fdfe2957435d300f8d69c96ac87eaa31c4caa24db442b140e7cee2fcff6952d2f88287
- SSDEEP 384:wVRmrYgVMzhrgHTb0MAJUKfVgH8BZ8ZFhC:wnmrYgVMzhrgHTb0MAJUKfVgH8BZ8ZFI
- TLSH T18F427626D175EEBB66FC613661B40B82F364C76F08414C17797CC48C4F7BD2A62C26A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\MwacControllerConfig.json
- Size 2KB
- SHA256 3daef5e06fe0a76ba88cf8ddb7df614af03d29d8ce7f13b17950eb11576feb24
- MD5 b156241b11c3d45bbe1ebc5014a2dc7a
- SHA1 3419ebcc45a75175f1733b3356a9b5643324db0a
- SHA512 a3f72f5c4f93bbe09a6d08aca72a13c45eb62c6c345fbc7ca3f20759735c8677f34526c59f33eb4cea697549860c5acb8fea4af6ad3bda6274ce9ff039cf362a
- TLSH T118511432D9A86DBF09F45267BC984252F641871F415808A3BABDD97C8FF6C12200AF5F
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\MwacControllerConfig.json
- Size 2KB
- SHA256 ecf810db109fe6282a963a116d32dc1b9f2facfd405afae3f38f301bea9e7223
- MD5 31fcd30d9a960e058ccd51268f3b73cb
- SHA1 ab43a2d640955e7e920259e93f14dd38b08d19b5
- SHA512 a49949f4f840f4ea0e31e76a28f77f78933f9cbd1e7405340703191685cfbfdc797124b6cb243c3cc7b61b102b95610b544d6bf062ddf5bf32530d53363a77dd
- TLSH T1D3512932D9A86DBF09F85266AC684252F650971F41580CA3FABCC57C4FBAC12210AF5F
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\PoliciesConfig.json
- Size 814B
- SHA256 dc695296ce1e21c3f0f530b23184347d24bb7d26dc3e106960e90c82da7fc785
- MD5 cbc1900e7761efd2937a79f246f13fb2
- SHA1 1c17eeb196af0b517dab87847030f9fd2dcf3d80
- SHA512 935185d1e787f4da53145503c16d21c891015a50b440e0ffb6472f472e4f467f76d73bd429687cd2b4bc3508ba0b010fe34d3db95d29bc5bf4422fb419739381
- TLSH T136014766984080FE247C42688137D8C1F351871635181C2FF7FAEA0DEDB3A3B2085D8A
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\RtpConfig.json
- Size 2KB
- SHA256 faae35b55a56b097010cd5908a68d58faed46663d191e715aef45697fa5adf56
- MD5 9138be1c7500eb8c0bc4f4742094fd8c
- SHA1 e5191f13004210d84b226606b0b18d00e641c6be
- SHA512 4f772debf06bfc482b981c5cc3ffe7d0c0be27e09dd0376bd7bdff5b745f45bc471166696bf222fba32d4e89ddaf4e31c3336329588e4b7554b626f156b21da8
- TLSH T1BB512821AE40A87D4C79C1199C7C518ADB245B61160A187B72FEC83DCDBBA737BC5CC6
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json
- Size 2KB
- SHA256 ba475514c21ee3e8979d55b7364c3639d3f4032638e4c774eef9bbd7c790c776
- MD5 e0812177b4d894ec20c0f65d4fabfe1f
- SHA1 5038af4bbe224837e5e18f1b4519821b3478e6d9
- SHA512 e06b923a01edacdc075b1c1b7ccf4e12136ea9d1e0628abe7ed8bb1446c6985370e4ce2dea6c380440aa5d94afc28fbd6be77741fc905f3427ea8cee633b6553
- TLSH T170515B16D91058FE18B8E65EDC288086E72083972502187FB2FDC65C9FF76337686EE5
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json
- Size 5KB
- SHA256 f84a568d6d695f092317fbeb77bd195dfb6df35a9342275c4af412c2a8267ea5
- MD5 2fa1ee538fa38d6f8c8bc4bc9a81ed7d
- SHA1 04952c1bc5258784ff0b97475bbdfbfa5926b4b9
- SHA512 b9b5be53d621105e11ed12ef52b25b28d0138148f41f65069050ab3a3df3af25752ac23aac555a6fd6f6794c1f42a950e1305bab1707764ca7582dcfeac73228
- SSDEEP 48:kBeT5JtUmVSfKuGQf92Es1kV8Enmduwv8qXKeWQX92MEnAf3wsaA:kBeZOfK5k9JykfnYnXKBs9RsAf3wsaA
- TLSH T1D6C18E16D9105CFE18B8E25EDC288186EB3083972202187F75FD869C5FB76333686EE5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\SpConfigFile.json
- Size 12KB
- SHA256 c7e84b036a4c072ad7cab258ef32216d8785178fa7571e59b1b9809370176a6f
- MD5 209421e5ab4e0a680b740d36e6346798
- SHA1 33ffcfbab49858e2b0dc4af15339b2aa31b47f99
- SHA512 974d0f2cba7d9f93f0ab6b4985f75c34ee4a1bb5f6f22cafe127c628573c500f0db4c51691669d094598fe6b61bb5d6b49a35713ebe7c6642539e1dfafd3320a
- SSDEEP 384:d8+xwb8fkY/sDY8t7SSdUCExUYS9oFfJ7MLPi5LnDjufzqoA+8xRj81offZJZtXJ:AXDK
- TLSH T16D52161EE0A84867887726901F7A95A2E334526BC1435C6775FCB12CCFBB483C496F9E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json
- Size 1KB
- SHA256 ef0103b46fa25ac961727c6e422a02b5e56c1557bd62c7d4e2f7549b1a7d9ca7
- MD5 008eb87d69d34126964ec15147b70d90
- SHA1 f2a3666fd599cad5643441a478fbbab387e4a4ef
- SHA512 649f1b41b2417386114c5afef542ac6ed9750f7e1f10e777371079a910d5a54d4395ec378cc5840cfacdb4a8ac93f20554f9b6568716c20a5743a22b7af4779a
- TLSH T1CD31F4128A2845FF28FCD144D9B88717E7A0431B61161C1FFAF8DA58DE7703237E1998
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json
- Size 1KB
- SHA256 cf773d978f8dba52ee388aa0586e243cc48b737717fad05bb051c7ea64b54322
- MD5 4c2923cb1cb2aa529f134e28ae751064
- SHA1 576e1ae96472c85713ad19cb527fca5d38f85175
- SHA512 f421c9444749737e45f41712a1d3d1f3d5c2ea28ec93a20d775f4461061dbf4aeacc9467cf6ea2e3a87433f405a20359ebbe4cdde83fdf7486e31a73501f05ca
- TLSH T17031F5128A2845FF28FDD148C9B84717E7A0431B21161C1FFAF8DA58DD7703237E1A88
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json
- Size 1KB
- SHA256 fa91e2aa0880a28d1dae913787d04bfd1b50ed84c041ffff53e4309ebbc4c491
- MD5 d1941fb1da8975a4a6a8914b2785deb7
- SHA1 dbd87338469102e8ec89cfaeeb7bf46b255c395a
- SHA512 430de62efa4659fae1c4471d0c12d5a1b1412faa29c51bcac4f518029c7abbde25e012ec3c562f38e4bb2f14219261940e54412051c5274999c4c688be45a3dc
- TLSH T1FD3121128A2845FF28FDD144D9B88717E7A0532B61161C2FBAF8DA58CD3703237A1A88
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json
- Size 1KB
- SHA256 5119bac54378e848bfc638b1f36ae38b1732bc726914c6a6c167b8c246f262e3
- MD5 92c973c27fb96dcaaa0377799fdf0930
- SHA1 ff8a39e6cb30847584a51861edb78e9f701ca6ed
- SHA512 3810181e47ccc911544639b94a5034ee040303834124a4d44d076e9f774a86395b9f84907001834d24a8747a286b090d45c2d01c8f86894a44b9c8c36af2223a
- TLSH T1993124128A2845FF28FCE158C9B84717E7A0531B61061C1FB6FCDA58CF7707227E1A49
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json
- Size 1KB
- SHA256 fdc982d7ab0c3ba3a14dc00bf4a885f7c071f06bee317b732a36dc5277afeecd
- MD5 3a87eea54836ed734255874cbb9e9753
- SHA1 506bf146eb71e631aa013c9779b8c481f6a4d5e8
- SHA512 5818bf4df1cab410f472447ef782c15107439046e3e9b22740dd252c79e88640d3329e686b81ba6b1d21555efb9d17d0b7660cc8e8f01709372851fc5ede4c76
- TLSH T12F314622893888BF12759B8DC9B48002E760538E26B04D6FB3FDD848DDB3D756487A4D
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json
- Size 1KB
- SHA256 900525cf4d5260e3868e444300905e54c646f8eddd6a937eed64eef354767560
- MD5 1288a3f7bab3b5df24cdfdb43e1abd1a
- SHA1 e853e113dd5dc926bebcf699468da4a6419e928d
- SHA512 f9fba04123e3c31cd70eb0d23430d84d078dd8dbe5ebbce8b5398a9c3dfdc1941433d40793d0bbba9cc7d74401dbc02084312bef9bab0feedb2a5828ef0dc9f7
- TLSH T179314822853888BF21759A8DD9B88002E750438F66605D6FB7FCD848DDB3D752487A4D
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json
- Size 1KB
- SHA256 e85df1df3550b3665a5edee3891a124162eb8843592fe6f7601591e8b8996c2f
- MD5 9f5364f92f9139667fac0a935a950206
- SHA1 94c2e5feca3842916341fc0a2750b81dc7b4cdd0
- SHA512 97e6e5c6b13b47ed1c5deb6642ddd55e6c30592f04decbc06a06350bd764a3c656406447fb12f81641b48a9388c2368295b8114e51ea2d9cf9f1f82a333cfdf7
- TLSH T179314822893D88BF21B5978DC9B48001E760439E26604D6FB3FCD848DD73D742487A4D
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json
- Size 1KB
- SHA256 2ef9b85ce7b1a2d09f717fecd008b33d51c33aecbcbc60b81d13ae825261cc2a
- MD5 670d904fd05fd178ae193209cc256a5c
- SHA1 4f5c02906754591578274216d4a6a24de156fb2e
- SHA512 2aafd5158b592035e396c470a4c5771bb2f4552317718b18cb17930f48e42a4153b5f84dbd836eb887d427f090b338cbdcc82deba39e75ae9fd8b42518e6fad4
- TLSH T16D3139228538D8BF11B5965DC9B48102E760438E26608D6FB3FCD848DD73D742487A4E
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json
- Size 1KB
- SHA256 c4dcee72a93fa0a8d2a98c7849e9f312dddeade880c3388b97926243e1769d0f
- MD5 29735f26e94c9077439a039d94abfd3a
- SHA1 13f4e6720c601338166783244b7e4dfd038066ee
- SHA512 83cc0a8670ebd575cb0ac65400f08584ddf2ea55672ca3644d42467a941694337cd8c894948a914bf6e8ac98ee2ed3efba474628ae2ba8d7947fe672029ba604
- TLSH T1583147228529D8BF11B5969DD9B48102E760439E26708D6FB3F8DC48DDB39352487A4D
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json
- Size 1KB
- SHA256 9a5a621ed839285c8b75c7f824c12606d442f32431f0c25903cd148c6601f5c8
- MD5 ce72daa82c681611477b2646ef7e1dd0
- SHA1 963bec4e84a109c290be34f2feed1714f9e2479e
- SHA512 2c644f1bc1c492d5d18a84494dd915c835137b2d0410158eff3c380c5dc4dc940800b4573520259b1b0263070715fd955fbabb6aec991477c9eaa23f5f406a74
- TLSH T1C43159238929C8BF11B9975DC8B48102E760839F62B04D6FB3FCD808DD73A34248768D
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json
- Size 1KB
- SHA256 104342d52d6067ff8aee0013911728e49ac73d78a4067aecffd2a73676777a53
- MD5 cc2400cf42c353323c16f7125bd06746
- SHA1 3997addf925ab913bf5a568b4935de88bd6612a6
- SHA512 362923b8043cbbc5cb1be47f4b433fe626b6303f04c935383e610bc7ca7445f4fcac8869354ae43979589c3718948a4d89aee3a02264f7917d47f48eb7a7f418
- TLSH T1B33139228929C8BF22B9975DD8B48002E760839F66B04D6FB3FCD848DD739742487A4D
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json.bak
- Size 1KB
- SHA256 806e60e31cee0e5b7662d0b12af220c5f2d5a1267d7165da226c113a9966a841
- MD5 9339e736492e18856525c4c480c48524
- SHA1 bbb7227f33632ad209b61a8976194f5893d70fc2
- SHA512 0c993d2ab4fa2396ef3b586ea987c46aa6ba396d4726a36bb1c5e71fd7639261ae15a66ef6601163c16b35316da39f141945df86542ecc4290a1af5b8413fc53
- TLSH T1353139228939D8BF22B5979DC8B48102E7A0539E62704D6FB3FCD848DD73D745487A4D
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\VPNControllerConfig.json
- Size 1KB
- SHA256 c08faf3ef5165cb181830cc43f1ebdf12f64c829b2ef448fbc39cbf8cb579227
- MD5 faf6de40f0f90188172c2ca372a23135
- SHA1 ca9ad06d331a6b6d10b8acbea2d38a009900a1fa
- SHA512 2ef81753689b456dc23297b439963d074b549ad2464b3828f23a43166e092e2b4f8e8c55b0196e0b681652b9e569b4f2bcd8eb27177d932f0c4c2bca7635ccc5
- TLSH T178216B62B19010F9697D9A9B6C7D8240F270130F22DA8B82BFFCE054CEB7594A160F99
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\VPNControllerConfig.json
- Size 1KB
- SHA256 c6bd67e98495848438bca4cf32731febb18e7e0d934a7a4200abdbb1dc32e7f2
- MD5 867a5136017e5c5d42f75f038bded090
- SHA1 213e3fcd8475b5b48d69c9f392a0e10cabbc77c0
- SHA512 ef103734868e829baf515e39fc8051bbc9aa9cd42f103a70dc66857c0a06e3bac4ef810aa3da925085d27e3c106dc931aae6643628589368b31fee770bc06913
- TLSH T16C217C76B09010F66A7D9A9B6C7C4201F270530F11D98B82BFFCE014CEB3594A160F9A
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\VPNServerListConfig.json
- Size 125B
- SHA256 57fe599514356b6120c4f827b787419ea4afff31c50adfa3c077faa78719fbd7
- MD5 85f435e2691909f79d8ecfc5eab9fb56
- SHA1 a1fc470e9aa21ca39a3d83b29ce51930845be22d
- SHA512 b7a1093b186b5150f7a19e4a882b5e9d976483e5d025f63a1d1526f7481a5103e4e78526029ac29d73d4f9e7a1f28d7d6e98ad824dfac480a27df1bb54d5fad4
- TLSH T1C2B022880222AC303232230E0880000BE3E0BA0CC0AAC00A302BC08A8FA320008AAFF8
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\pkgvers.dat
- Size 78B
- SHA256 60ef0124cf177519540d2da94fd387ff45706613ba27da952513825c3c56ed60
- MD5 e6cc77918b429c5c847d4fe60177a551
- SHA1 d0e8af36d2580937280e08cb292c45439c68f00c
- SHA512 216542c6dccb5757da5db2fcbedaaf3408715486523dbb75a498f5b00a8a39927c1c1d878aa60e4f481d16ca306c96a757cf56162ff6d0cfa560291119087bbb
- TLSH T1F4A02230000C23000CEBB2F0B2B30E30B22FCC28BB020F0023C20233032A03022002AB
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\rmode\mbrescue.exe
- Size 7.7MB
- SHA256 477919ecb586d6ef4a06793417c2ae3126c51a51cf9445d901e90e3627e7143b
- MD5 ce8ca947e3162da157d1878d4cfec382
- SHA1 6f574aa206ba5e9d7469450780c4238cdd5112e8
- SHA512 4233bbde636d039ea3295e3b2066f56ea5a23e0431a5e675c967c60bbfa4f518f01eb90ac271da56a192671b925b3e14d3a25f1da4a8412983b4973565dff299
- SSDEEP 98304:akpowZa6gr/YzKrEAi9bESWCt+z3zweCeT007kxK:aFwZa62YW4AQbLWCtej1C9076K
- TLSH T1D586AE57A3E800E8D8B6D13CCA978503EBB2B85147719BDF06A4566A1F73AE05F3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.4MB
- SHA256 d3ee41a9e533f19851db6fc7b04262b9c7dd1d433b1f37813f3e78c08fd527cc
- MD5 8fe61f2891c91a5d6f2664c1edd60405
- SHA1 376083001b73c8c5c60670fa7b3d05558d35ae3b
- SHA512 18308e99d6bb60eeff37e78d1811eb694bd47868aa44cb2c8aef8960ccda562df809930458ad9442a983a028a363b28bc57a56c6f1e1f57afc45151a4fcf65b7
- SSDEEP 12288:BUtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:BU6mctvE/BT76+1NCE
- TLSH T1D4652382991F0185E9FF07F05255D265E8253FF93CDA0883F211851FAD305A2BD2BE6B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.7MB
- SHA256 c08ac29dc37526d85cc66db06ed3bcdff58bd64268645b7d7bd8930e5b324c2b
- MD5 51c202e1a40e7425c6e90aabe7be464e
- SHA1 f220999f48a55392f3acda628a1734e1bf203df0
- SHA512 e1a0fbc23493ea1497160fc3904ad81059319b4276ec1656fd321362078f469d764938a432ee306e967ff3229a6e08bbb0fe933cbaf7f6640ccd2a63cf05a72a
- SSDEEP 49152:oa0h2GEkuAe73q3pp46zwwQK6mGvKVO+n1:oa0hNYG4JwNXeN+1
- TLSH T18285AF1E67EC82B4D0BAD278C9A6814BE6B2B4261B3156CF1151853E3F37DE44D3EB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 1.5MB
- SHA256 f7f92fa516ac1b958153301dd7959d05581ebd7b4ac51bf4b93ca525a3570095
- MD5 a435aca04cdfbc4d38137c329ba53406
- SHA1 bb26d60db4852b83be77140ebe228577c0a2d57d
- SHA512 41c0cb3063b7cb4293e870b6a3a9babd16c614a22b822829b4162de1845340da6ab9b18c81376ddd6894538c235c266f09ee7cfd186b7563a4d12ee1057aef9d
- SSDEEP 12288:dhbHjfXptM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:dhbHjPp6mctvE/BT76+1NCE
- TLSH T12D65126E166E10D4F5B692BC8291824AD730BCB5271253DF6391823F4F33AE55C3AF92
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DriverStore\Temp\{fbb75e12-bf75-1a4b-a689-64b0aefce948}\mbtun.cat
- Size 10KB
- SHA256 9ceb410494b95397ec1f8fa505d071672bf61f81cc596b8eccd167a77893c658
- MD5 8abff1fbf08d70c1681a9b20384dbbf9
- SHA1 c9762e121e4f8a7ad931eee58ee60c8e9fc3ecb6
- SHA512 37998e0aee93ff47fe5b1636fce755966debe417a790e1aebd7674c86c1583feef04648a7bc79e4dedaabb731051f4f803932ac49ea0be05776c0f4d218b076f
- SSDEEP 192:gM6dynJCSEJOL7yKnUi8rFWQFIGjl8zjEswYt1FfRM/GX01k9z3AeOlFa:gqS4CFRWGjl8M8/fi/GR9z/OlFa
- TLSH T1B43208E1897D84C2ED87A87147E8E5977C3C1BCB2C5055A911ABF7600AA33C6E71853D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DriverStore\Temp\{fbb75e12-bf75-1a4b-a689-64b0aefce948}\mbtun.sys
- Size 107KB
- SHA256 6903e60784b9fa5d8b417f93f19665c59946a4de099bd1011ab36271b267261c
- MD5 83d4fba999eb8b34047c38fabef60243
- SHA1 25731b57e9968282610f337bc6d769aa26af4938
- SHA512 47faab5fff3e3e2d2aea0a425444aa2e215f1d5bf97edee2a3bb773468e1092919036bcd5002357594b62519bf3a8980749d8d0f6402de0e73c2125d26e78f1e
- SSDEEP 1536:k0h5S895dQOYJaryTmbMc6uqkZUcmSl47AjpdAyDCYJqUufIfmNn3VzwZ6Dh7Q9y:C895uOYJar1MLcmSlrSgC6Duls2t
- TLSH T174B36C9DA1783089DE42A6B482B98793EFB4357A2B1177BF01E1C1748F537C0DB29DA4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.2MB
- SHA256 b20a3199be69f642bd33cf4d89942a720116852175a4974074e65589699886a2
- MD5 6847b25b2513d2086376b77aabb63a78
- SHA1 1a55ce26a72936db986fe00b1f3420bfa6c056c5
- SHA512 43c8c27b6420d628a7e3d3ed61b5ad431b969e76da41a017cd70b012fd9c8941fa81978a3273a6d59b02ef0526c604a92c303387bafd6c9b33cb99c5cb58dcb0
- SSDEEP 24576:l3YgnJcRTk4yti+R5dBR/B6mctvE/BT76+1NCE:lIgnaTk46pBR/B6mGvKVO+n1
- TLSH T1DD45BF2DF2B910B9D8AAD236450143B5FB71782D1F209ACB0170C539AF16EE85E39F5E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 1.4MB
- SHA256 761f0f008aab9a469619f724bf22484245b87db8d3658d7b34d68e34a91d9cae
- MD5 5b00b9b823dfa6b0e72428aaec7b918c
- SHA1 e08eb38c89b0a3ede02ce76f2d7a47dcba5a4bde
- SHA512 2dbb1c4ede60f09c939bedea79f0212e417419b2c336100b9182d2c585ea7aa41a94564ebb1f43aa6a5eb37a16dae2515a2cfd6c981ba824965e07554708b05d
- SSDEEP 12288:OgtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:Og6mctvE/BT76+1NCE
- TLSH T128652381941B11C4D9EF07F05255D29AE8502FF9369B18C3E226851FAE305E27D3BAA7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.7MB
- SHA256 8085df7cd076dab719719823b3a7ee4f7ff1e0c6ead658821081994bdf926fbb
- MD5 1b8278d11fc79e66ef7b6db1118b0a3b
- SHA1 d4cb06de47e3de42cfb766d803e1a95a25db269b
- SHA512 01236f02a9fd5f0f13ae6e5877106ac3f459481aaf2a0cb86c6fb616c2e0c7d12bae5450c78541d17c44145edf0c80086452460f2563199ecc0fc3ba73afa89d
- SSDEEP 12288:tObQA4LWOsvAYFTXtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:KIL3UTX6mctvE/BT76+1NCE
- TLSH T10E850145F69500F8ED7B817CC9A2C616E272789D1764E7DF03684A6A1F233E24E3EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.5MB
- SHA256 1a223ad2f82a91a7c7d20be9c2dc96cade9cf89bbc22dffd9f76e8a34f6cdcf4
- MD5 2d2d7ee3f630074cf4edbf7fa2c2666b
- SHA1 3ea7827f08b257860e394108645b3d05150c9537
- SHA512 74cef09b55b3558b1fbaf549a0440f0adb50f4a4eecfb67821a0323e0377587959efc32af5d6f771ab36cb13acc220d8265bbb4a1b93a955f4ebd6a5d1783727
- SSDEEP 12288:ppFtVOztM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:VOz6mctvE/BT76+1NCE
- TLSH T13175121A36AE10E4E57A52788682830DD371B8F6176217DF4290817F5F73BF46C3AB62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 74bca42420db7c2624bac307edb6ffa7cb11727854153815c4d239507b3872b3
- MD5 34f553f8fcf7689d516249ea4a34ed37
- SHA1 b9a0c02a22b032e941e383c7439a6bbcf6b28e6e
- SHA512 4b28813b4521413037322b39e53d8c08c4fea38e45fcd390f0ac674327032c7d8c83976726a1c77adce14c8fadeb6425aa866af0bd859c844c8610b761b2b1c9
- SSDEEP 24576:G7NM9YqZqmWMUkPjZM48Mv6bEhsk6mctvE/BT76+1NCE:G7cBWMpPjN8DbEhJ6mGvKVO+n1
- TLSH T10A65AE2E6BAC81D5D477D13DC9A28206F6F1B4611B318ACB5162833E7F37AE44E36721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.8MB
- SHA256 144641ddd712e5b6e0988137b6423b4ac8e4c9704f9a283d8909951a30cfe7aa
- MD5 63e2b8745451f7273c26716be2b5b279
- SHA1 04cd61a98dbda2fb966612d6eb377d64901c5ffd
- SHA512 62c1d44e3242b10c6726aa5a5e24fff122f722a68aed2e43447658773e210d4d52f66f241dd2da69c2f06d73e5bec13dfcc612b1668b270a0703d73e61269834
- SSDEEP 24576:oW6BApg2YuyuNDYTabvcdvNYf8km1e6mctvE/BT76+1NCE:oF2YuHNETovAvNYf8kmE6mGvKVO+n1
- TLSH T15F858E2927ED80A4E0BBD2BD45B6D246FAB2B8511B3055CF4255862E1F33AF44D3DB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Spectrum.exe
- Size 1.4MB
- SHA256 47530766319d6de490d8d0407df4285e1526d6136a29cf945566a5f721b5c037
- MD5 c945014079d1824cb219fc419b68007c
- SHA1 70c88d2eb81b1a92f73e1d388ecd67c78b541745
- SHA512 0fd2565beb96d0789a5fd4efb3f82925e2aae2d4cd33c0aa22257da1787a31318958b433bbaad7c06f4e80176e93d9f583a61605e4d7765dd2ad7cc1d69fdce2
- SSDEEP 24576:cAFs06+OmlfQNXEbTo/6mctvE/BT76+1NCE:xFs060lcXuq6mGvKVO+n1
- TLSH T18765BF2F62AC00D5D07ED17D8A97C91AF6B1746707255ACB0260C63E7F6BEE81E39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 1.7MB
- SHA256 bbefc090f07e47941725ddb868c07592b515afa639bd10123d06f0c53410dd3f
- MD5 f81e148282bb995a3e8d934189d1aebb
- SHA1 f3e771fa976696f2dd38ff91ef2fb0265553ca1b
- SHA512 b160347aba73932b864d160b024e4739e8856e42ced8654e9aefd1a50ff23b5620906a6329c29432179273cbdd35363b2737fc5f1f3882dbf5805cb6c3aae123
- SSDEEP 12288:JCJnJ5D3VkrRzxEtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:gJnJ5D3Wxq6mctvE/BT76+1NCE
- TLSH T1F885E02DD2A810E8D4B7C3B4825A1786FE72387D2F2269C72474D5363F12EE0A979F15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 d786491a1c3558fd8962e17b9c47035a2b357e529e206a7886a6bb75665f8964
- MD5 10fc51f9b8fa19ad46dcf8ee951330b6
- SHA1 f85f44ee4b77d8bbc9f0ec17f3ae6beabb12ed64
- SHA512 6a7e83c33af511d96663b5de41fa01bc58e68c21ce9ac0fbc8ecd63e03187045b4c85a1c32459ef183dc452d7824891022f9f5f2478d0337c4694bcfd5a72b77
- SSDEEP 24576:QEPghm6/7IIXdwcXrif7qQncjlP65i3VuB6mctvE/BT76+1NCE:vg06DIKdwc+eQnSt65aVI6mGvKVO+n1
- TLSH T192955C15B7EA5294E8B3CAB1C962A1169B327C509B34F7DF0AC0C92E1E33BD1D935B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 1.5MB
- SHA256 bf12ff367c8317bb8605612701ed88b32e60529c61455eb5e023b4e11c904fc4
- MD5 90035754d28ab981582fe7ad1b7fe628
- SHA1 86536e2e3cfa91a48badbc319acc3d15cf01a64e
- SHA512 5829acfdae2ff16ec29a9fc13ea5ba1c59e01f760273ae05dfc18ac5069e0c2b033d1f41db001890516c0a2a724c1169530a95fba57492c23c0f4f941f74771f
- SSDEEP 12288:PEP3R8mtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:U8m6mctvE/BT76+1NCE
- TLSH T16F65129D2A1E20E4D56A51B88291C245D372F4F43B9227DF52A1C23F4E33AE52D3EF52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\catroot2\dberr.txt
- Size 37KB
- SHA256 95e9c233f584db720b6d55aedd17a6892aac0760ed255ff7b33a5fa412742037
- MD5 e4859919f3fcaf24059843212e04384e
- SHA1 61fd62e46870cd81e601a85c834a71033100b000
- SHA512 f44435639bc951f814d722ebda253dc0e98c5c37df9802799e02371e3d6881603ec8dcc108a2c158e8033ae9e46b07701c1a6abe3639f6966fb7fad123d60d1d
- SSDEEP 768:UUjyKV+awmkLZ4Y8bp4H8u8Fu7KHvtCI8+eCs:UUjyJawmkLZ4Y8bpQUFu7KHvtCI8+eL
- TLSH T12B035A0891D88829C6F509A2376EDE71C57BE5CAB70B1EE5706C6354DEC2B042EBB05F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 1.5MB
- SHA256 aa88c8939132b06f85b747d1e8ea83fb4aa861b8558c6d62307db01451fa9848
- MD5 9224718044ca398be9b1d02cfb982d8f
- SHA1 01c4873dd1e129d65541a79f818537045e2177a3
- SHA512 9e64cc1002927a1f320572aeb1fb2239cfca1a61d6d2e625ce743dd14f2dde96544a2e75ac872747eabcc1bec2ee86f5a019b46f65fb1e1b2b3e4c503cea4109
- SSDEEP 12288:WjkyZtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:WIyZ6mctvE/BT76+1NCE
- TLSH T117751241635910C4E9BA06B496A3C295DA30BCB06F2616DFA190E63F6F327D0BC36F57
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 1.4MB
- SHA256 2352268e44e6a433511df75389438697e161c5285d1fa58648c4dfd84696ab7b
- MD5 4f843d567480ebf33adbcd5fb220fe9c
- SHA1 9a2508484249fc7649093446148fe5fd12e8c4bd
- SHA512 d42ba1df3ad23accdc8827d02c18e3415c36b30f58bc446e34c9027b7f7059a26ddaabe5fa8b5f0653d25eebedd5053ee1a5383472c8699cefccdaa10d16d2b1
- SSDEEP 12288:VRjtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:Pj6mctvE/BT76+1NCE
- TLSH T138652385542B20C4EDAB07F04255D296E4603EF93A9B28DBA2A1C53FDF301D2793BD97
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.3MB
- SHA256 65d9959713b43879df7d693c1c5cb94db4d191aed19135c40ee0249bb4f8b419
- MD5 2ed58821ebb10e81d093cf12fc664997
- SHA1 fef4c9763a8391a988d6081193009b9689f587aa
- SHA512 79a8924b12d5ee41220c283a3362f31a8d9ac68e0de33965ade96d22c4ad1b9ca676c1cbbccacc6916e7ac0e108a264b2d0736733f66232a8deb7f27d1e09b30
- SSDEEP 12288:BLQZb3C97GYnZMv5zBcKY9dMD3MtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WrC:ZQ9MxZKdcz9dw3M6mctvE/BT76+1NCE
- TLSH T19D558C2DABE905CAE177D27595A250C3A633B4311B31D6CF2448D03D4D7AEE8AE78F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 1.6MB
- SHA256 f8d906d1cd948d5af16e6c550d5ee6b45caffafaf44a31cdbc29786ef6de6293
- MD5 799d9fd3057f6ed84c130d26c3f18651
- SHA1 60ab2ce4fd4ea7fcce11cc5a71678cd8a451868b
- SHA512 1d593666fe61ac9bfbb19e55a5b70a70e008eaa10f7b18d825add4b305a24957322d23f27bad191d2cbdd1941888149e6f0e6922839a098317b85fd4549b1c8a
- SSDEEP 12288:3yoKo2CRple9pVtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:3yocwApV6mctvE/BT76+1NCE
- TLSH T1C875E05FBB6E00E1E176813C89858345E773B4742B6217CB6291C33E8E239E9BD35B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 51c41fc273781f697db1b76bc92368e2ccd33eb545a37b9010a1bd5bd5af7c40
- MD5 34a6604ba592c1b0ff3a7b75480e9d78
- SHA1 b17a59fa034c3a8adf70955ce197cc8f6f2aee7f
- SHA512 595a73d6a26cbca5fc4d0378420cb2a6dd3140b4f327a0fc36483b6b2d8c08a3076be5ea5b686214ff1abf2ff57ad05594a772596a8ca131918441b1520518b1
- SSDEEP 49152:YWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKV6mGvKVO+n1:60zuNIXXeN+1
- TLSH T1C7A57B3DA2BC00A8D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A39F55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 7eaac3a7d62396c3edf45bcce18742d0a8672722d19f4972aab58738ce8e0329
- MD5 48984e568b29bbd0d28c256da9b52a08
- SHA1 e2dddc4b25c0533d76ceef5ded3a9112eeec0c11
- SHA512 62542761f25e306d9a38b9f98bf76a358b1bdac1cb5c26d996abd38a628a08f3620ba94e65311a4526e1d5a57fefdcb13603b2acb24446cb12f05eba782800d6
- SSDEEP 24576:z1QT7EcpfxR+N5AWAz3ooiYsjMqbm6mctvE/BT76+1NCE:uTDxR+N5YzTujMT6mGvKVO+n1
- TLSH T1FA55B02EA7F905E9D1BE85788B23C512FA727861033193CB42A0C17E1E779D85E7AF11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\SgrmBroker.exe
- Size 1.7MB
- SHA256 a9c2f57a64ff9a155b7671b31c996302b114cea4a5e55dba533f06b80af642d7
- MD5 b5c73789fec4ff2f6a18b8fe7854985a
- SHA1 dce8b2e602661a53349d0ebe3ed83e6a7e363eb1
- SHA512 0b05ffc290ef55ac34c08f5abb8565b8048b3f81b4a56baf6819819c1bf6487039d7b7e65d2589a0a0121b29120162ac59a9a3a49c55fa3995bf6b51d7ac9ec3
- SSDEEP 24576:ATMdOz0FFS+AmSLy6mctvE/BT76+1NCE:o0K+AmSLy6mGvKVO+n1
- TLSH T18A85E17EA36E14E5E47BC2BC9643C506E67234A5032266DB0690C17E2F67EE4393EF41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\msiexec.exe
- Size 1.4MB
- SHA256 8a57989f1f2ac06d99789895ce82cfc777734959387215dc633794edf38e56e9
- MD5 6a8ed083d330648affa659b980f6904f
- SHA1 81f85ccd55f9a2892dadd453c0dbf778ff0db9ff
- SHA512 86ca8e25a97d4bb7f9c2d694a902ef31154a4128d6575294fabb4c7e56defc61ad611a7b324ba2b95f02a545cb374b9ce858fa975f0a0341f11d3dc81510a226
- SSDEEP 12288:J4ZXtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:mX6mctvE/BT76+1NCE
- TLSH T16565124962AA30D4E8B752B086668256D530BCF6336619FF31E0C53F5F326D1A93AF13
- MD5 SHA1 SHA512 SSDEEP TLSH