Analysis
- max time kernel
94s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/08/2026, 14:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-03_94b3b5aea9f68be76318dcf0a02ed684_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
22 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-03_94b3b5aea9f68be76318dcf0a02ed684_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
36 signatures
150 seconds
General
- Target 2026-08-03_94b3b5aea9f68be76318dcf0a02ed684_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
- Size 3.2MB
- Sample260803-rmhwmasxft
- SHA256 83bb6f4b86afe5cc9bc6226b30fbf42accae59fb09cd8cdf6b816c9830ccc74a
- MD5 94b3b5aea9f68be76318dcf0a02ed684
- SHA1 ca5039304c3309d4658b250bda2e95a91682a065
- SHA512 ebf6c9d78ce7345460cdb698e164f38f51642c34ad39552942fefaa0e4ee09527f35774394ac86973fee48eac6554a71980f9f5f1cde93fc118650b20cadde8a
- SSDEEP 49152:PgZVSkzGQ8smL1yjEjwAeyfvE0Z3R0Tnxn1o2d5MQl3LNiXicJFFRGNzj3:WfGQ8smpGAeKtwnW2N7wRGpj3
- TLSH T161F5AF21B2918120E5F39370297EB7EA5B75BC256F76408F32DCBA390B725C09D35B26
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects executables built or packed with MPress PE compressor 1 IoCs
resource yara_rule behavioral2/files/0x000b00000001c66a-2064.dat INDICATOR_EXE_Packed_MPress - Detects executables packed with ConfuserEx Mod 1 IoCs
resource yara_rule behavioral2/files/0x000b00000001c66a-2064.dat INDICATOR_EXE_Packed_ConfuserEx - Detects executables packed with Goliath 1 IoCs
resource yara_rule behavioral2/files/0x000b00000001c66a-2064.dat INDICATOR_EXE_Packed_Goliath - Detects executables packed with Themida 1 IoCs
resource yara_rule behavioral2/files/0x000b00000001c66a-2064.dat INDICATOR_EXE_Packed_Themida - Downloads MZ/PE file 1 IoCs
flow pid Process 13 3520 2026-08-03_94b3b5aea9f68be76318dcf0a02ed684_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe - Drops file in Drivers directory 6 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\drivers\mbamtestfile.dat 2026-08-03_94b3b5aea9f68be76318dcf0a02ed684_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File created C:\Windows\SysWOW64\drivers\mbamtestfile.dat 2026-08-03_94b3b5aea9f68be76318dcf0a02ed684_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File created C:\Windows\system32\drivers\mbae.sys MBAMInstallerService.exe File created C:\Windows\system32\DRIVERS\MbamElam.sys MBAMService.exe File created C:\Windows\system32\DRIVERS\mbamswissarmy.sys MBAMService.exe File created C:\Windows\system32\DRIVERS\MbamChameleon.sys MBAMService.exe - Modifies RDP port number used by Windows 1 TTPs
- Patched UPX-packed file 1 IoCs
Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
resource yara_rule behavioral2/files/0x000b00000001c66a-2064.dat patched_upx - Sets service image path in registry 3 TTPs 2 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MBAMSwissArmy\ImagePath = "\\SystemRoot\\System32\\Drivers\\mbamswissarmy.sys" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mbamchameleon\ImagePath = "\\SystemRoot\\System32\\Drivers\\MbamChameleon.sys" MBAMService.exe - Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 2026-08-03_94b3b5aea9f68be76318dcf0a02ed684_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 2026-08-03_94b3b5aea9f68be76318dcf0a02ed684_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion MBAMService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate MBAMService.exe - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 21 IoCs
pid Process 244 elevation_service.exe 5576 elevation_service.exe 4660 maintenanceservice.exe 1644 OSE.EXE 2832 PerceptionSimulationService.exe 3160 perfhost.exe 2816 ReFsDedupSvc.exe 5100 SensorDataService.exe 3252 ssh-agent.exe 1800 AgentService.exe 4108 SearchIndexer.exe 2372 MBAMInstallerService.exe 6048 MBVpnTunnelService.exe 4252 MBVpnTunnelService.exe 1076 MBAMService.exe 4664 MBAMService.exe 3548 MbamElam.sys 5908 MBAMService.exe 4792 MBVpnTunnelService.exe 704 mbamswissarmy.sys 2620 MbamChameleon.sys - Impair Defenses: Safe Mode Boot 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\MBAMService MBAMInstallerService.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\MBAMService\ = "Service" MBAMInstallerService.exe - Loads dropped DLL 31 IoCs
pid Process 2372 MBAMInstallerService.exe 2372 MBAMInstallerService.exe 4252 MBVpnTunnelService.exe 6048 MBVpnTunnelService.exe 4252 MBVpnTunnelService.exe 5908 MBAMService.exe 5908 MBAMService.exe 5908 MBAMService.exe 5908 MBAMService.exe 5908 MBAMService.exe 5908 MBAMService.exe 5908 MBAMService.exe 5908 MBAMService.exe 5908 MBAMService.exe 5908 MBAMService.exe 4792 MBVpnTunnelService.exe 4792 MBVpnTunnelService.exe 5908 MBAMService.exe 5908 MBAMService.exe 5908 MBAMService.exe 5908 MBAMService.exe 5908 MBAMService.exe 5908 MBAMService.exe 5908 MBAMService.exe 5908 MBAMService.exe 5908 MBAMService.exe 5908 MBAMService.exe 5908 MBAMService.exe 5908 MBAMService.exe 5908 MBAMService.exe 5908 MBAMService.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\K: MBAMService.exe File opened (read-only) \??\Z: MBAMService.exe File opened (read-only) \??\H: MBAMService.exe File opened (read-only) \??\I: MBAMService.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\M: MBAMService.exe File opened (read-only) \??\S: MBAMService.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\U: MBAMService.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\L: MBAMService.exe File opened (read-only) \??\R: MBAMService.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\N: MBAMService.exe File opened (read-only) \??\V: MBAMService.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\X: MBAMService.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\Y: MBAMService.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\B: MBAMService.exe File opened (read-only) \??\W: MBAMService.exe File opened (read-only) \??\O: MBAMService.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\J: MBAMService.exe File opened (read-only) \??\P: MBAMService.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\D: MBAMService.exe File opened (read-only) \??\G: MBAMService.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\A: MBAMService.exe File opened (read-only) \??\T: MBAMService.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe - ConfuserEx .NET packer 1 IoCs
Detects ConfuserEx .NET packer.
resource yara_rule behavioral2/files/0x000b00000001c66a-2064.dat ConfuserEx - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\System32\DriverStore\FileRepository\qcwlan64.inf_amd64_71c84e1405061462\qcwlan64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netbxnd0a.inf_amd64_9744de6fd6c11c4f\netbxnd0a.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\net7800-x64-n650f.inf_amd64_bfc44179ca196669\net7800-x64-n650f.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netmlx5.inf_amd64_daa0dfc87505ee8d\netmlx5.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\rtucx21x64.inf_amd64_286645bc82b2f9fb\rtucx21x64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\Temp\{7399c2f9-87fe-0640-8a03-facad0fec4df}\SET78DC.tmp DrvInst.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-08-03_94b3b5aea9f68be76318dcf0a02ed684_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File created C:\Windows\System32\DriverStore\FileRepository\netrasa.inf_amd64_417ad0eea84e3a58\netrasa.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\rtcx21x64.inf_amd64_feec7a9662e785f0\rtcx21x64.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94D97B1EC1F43DD6ED4FE7AB95E144BC_38A1221025A0DFB52F454FF8C79E14CC MBAMService.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-08-03_94b3b5aea9f68be76318dcf0a02ed684_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\86844F70250DD8EF225D6B4178798C21_44AD5D0C299F1D4EE038B125B5E5863A MBAMService.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-08-03_94b3b5aea9f68be76318dcf0a02ed684_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File created C:\Windows\System32\DriverStore\FileRepository\netv1x64.inf_amd64_b0aef9976b305f93\netv1x64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\rndiscmp.inf_amd64_e3cf74e485b2778b\rndiscmp.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\c_net.inf_amd64_64490bb3b4dcbb9a\c_net.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\b57nd60a.inf_amd64_86493878b5fef607\b57nd60a.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\bthpan.inf_amd64_c908ea6dab3e932a\bthpan.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netimm.inf_amd64_8b2087393aaef952\netimm.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-08-03_94b3b5aea9f68be76318dcf0a02ed684_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File created C:\Windows\System32\DriverStore\FileRepository\netelx.inf_amd64_b821dc8c43094e14\netelx.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netwew00.inf_amd64_cc8804127f78dd92\netwew00.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netrtl64.inf_amd64_e646b306d9138846\netrtl64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netxex64.inf_amd64_01587744078125a1\netxex64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netwtw06.inf_amd64_c5f16d20642e3070\netwtw06.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netathrx.inf_amd64_ba496c81c003f721\netathrx.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\mbtun.inf_amd64_add82795013a7c3b\mbtun.cat DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\netwns64.inf_amd64_d630255fa92e6727\netwns64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\msdri.inf_amd64_fdc036dc83da2115\msdri.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe 2026-08-03_94b3b5aea9f68be76318dcf0a02ed684_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe 2026-08-03_94b3b5aea9f68be76318dcf0a02ed684_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File created C:\Windows\System32\DriverStore\FileRepository\netwmbclass.inf_amd64_0958b27686099e9c\netwmbclass.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netefe3e.inf_amd64_c4fbd94d20e3c73c\netefe3e.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netr28ux.inf_amd64_2613a90929adebda\netr28ux.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netwtw08.inf_amd64_448906930b28afd9\netwtw08.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netmlx4eth63.inf_amd64_59e293fc00a669f4\netmlx4eth63.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\bcmdhd64.inf_amd64_0c3c6ca9708e5a9a\bcmdhd64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netnvma.inf_amd64_f3a84765144777ee\netnvma.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netbxnda.inf_amd64_5cfb6a07d9d75a4a\netbxnda.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\mbtun.inf_amd64_add82795013a7c3b\mbtun.sys DrvInst.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50 MBAMService.exe File created C:\Windows\System32\DriverStore\FileRepository\netl160a.inf_amd64_24496b197c188680\netl160a.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-08-03_94b3b5aea9f68be76318dcf0a02ed684_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\System32\vds.exe 2026-08-03_94b3b5aea9f68be76318dcf0a02ed684_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File created C:\Windows\System32\DriverStore\FileRepository\nett4x64.inf_amd64_345dd70a1546350e\nett4x64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\kdnic.inf_amd64_a9d04a55194853d2\kdnic.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netk57a.inf_amd64_a4804fffb8ffc2e6\netk57a.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{7399c2f9-87fe-0640-8a03-facad0fec4df}\mbtun.cat DrvInst.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-08-03_94b3b5aea9f68be76318dcf0a02ed684_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File created C:\Windows\System32\DriverStore\FileRepository\netl260a.inf_amd64_39ee03ea6ee818e4\netl260a.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\ndisimplatformmp.inf_amd64_8f9eb8ff490e6c70\ndisimplatformmp.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\mrvlpcie8897.inf_amd64_668551398886eaf3\mrvlpcie8897.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-08-03_94b3b5aea9f68be76318dcf0a02ed684_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File created C:\Windows\System32\DriverStore\FileRepository\usbnet.inf_amd64_7e86f0597bbc0f66\usbnet.PNF MBVpnTunnelService.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.Reflection.Metadata.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\pl\WindowsFormsIntegration.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\System.Windows.Extensions.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\System.Xaml.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\Microsoft.Xaml.Behaviors.dll MBAMInstallerService.exe File opened for modification C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.json.bak MBAMService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.Buffers.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\Microsoft.Extensions.Logging.dll MBAMInstallerService.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-08-03_94b3b5aea9f68be76318dcf0a02ed684_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File created C:\Program Files\Malwarebytes\Anti-Malware\MdXaml.dll MBAMInstallerService.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-08-03_94b3b5aea9f68be76318dcf0a02ed684_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.IO.FileSystem.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.Runtime.InteropServices.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.Security.Cryptography.Algorithms.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\pl\System.Windows.Controls.Ribbon.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\zh-Hant\System.Windows.Forms.Primitives.resources.dll MBAMInstallerService.exe File opened for modification C:\Program Files\Malwarebytes\Anti-Malware\MbamBgNativeMsg.exe elevation_service.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.ComponentModel.TypeConverter.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.Xml.XPath.XDocument.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\cs\System.Windows.Controls.Ribbon.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\es\System.Xaml.resources.dll MBAMInstallerService.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe elevation_service.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-08-03_94b3b5aea9f68be76318dcf0a02ed684_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-08-03_94b3b5aea9f68be76318dcf0a02ed684_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\de\ReachFramework.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\ru\UIAutomationTypes.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\System.Windows.Presentation.dll MBAMInstallerService.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe elevation_service.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE 2026-08-03_94b3b5aea9f68be76318dcf0a02ed684_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.Xml.Linq.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\cs\System.Xaml.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.UI.Theme.Light.dll MBAMInstallerService.exe File opened for modification C:\Program Files\Malwarebytes\Anti-Malware\assistant.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe 2026-08-03_94b3b5aea9f68be76318dcf0a02ed684_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-08-03_94b3b5aea9f68be76318dcf0a02ed684_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\es\System.Windows.Forms.Design.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\PresentationFramework.Classic.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\System.Private.Windows.Core.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\mbamelam.inf MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\ru\Microsoft.VisualBasic.Forms.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\ko\System.Windows.Forms.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\PresentationFramework-SystemXml.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\ru\WindowsBase.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\assistant.dll MBAMInstallerService.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-08-03_94b3b5aea9f68be76318dcf0a02ed684_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File created C:\Program Files\Malwarebytes\Anti-Malware\MbamUI.Services.deps.json MBAMInstallerService.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe elevation_service.exe File created C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.cat MBAMService.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-08-03_94b3b5aea9f68be76318dcf0a02ed684_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\clrgc.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.Data.dll MBAMInstallerService.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe elevation_service.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\ru\System.Xaml.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\UpdateControllerImpl.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\Duende.IdentityModel.OidcClient.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\malwarebytes_assistant.deps.json MBAMInstallerService.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe elevation_service.exe File opened for modification C:\Program Files\Malwarebytes\Anti-Malware\MbamPt.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-08-03_94b3b5aea9f68be76318dcf0a02ed684_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\Microsoft.DiaSymReader.Native.amd64.dll MBAMInstallerService.exe - Drops file in Windows directory 7 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-08-03_94b3b5aea9f68be76318dcf0a02ed684_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\INF\setupapi.dev.log MBVpnTunnelService.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\inf\oem1.inf DrvInst.exe File created C:\Windows\inf\oem1.inf DrvInst.exe File created C:\Windows\ELAMBKUP\MbamElam.sys MBAMService.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 2 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh MBVpnTunnelService.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh MBVpnTunnelService.exe - Modifies trusted root certificate store through registry 1 TTPs 13 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 6b00000001000000200000005367f20c7ade0e2bca790915056d086b720c33c1fa2a2661acf787e3292e1270140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a2030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa20f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e1900000001000000100000009f687581f7ef744ecfc12b9cee6238f12000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 MBAMService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 5c0000000100000004000000001000001900000001000000100000009f687581f7ef744ecfc12b9cee6238f10f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa2140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a26b00000001000000200000005367f20c7ade0e2bca790915056d086b720c33c1fa2a2661acf787e3292e12702000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 MBAMService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8DA7F965EC5EFC37910F1C6E59FDC1CC6A6EDE16\Blob = 0300000001000000140000008da7f965ec5efc37910f1c6e59fdc1cc6a6ede162000000001000000450300003082034130820229a0030201020213066c9fcf99bf8c0a39e2f0788a43e696365bca300d06092a864886f70d01010b05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412031301e170d3135303532363030303030305a170d3338303131373030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f74204341203130820122300d06092a864886f70d01010105000382010f003082010a0282010100b2788071ca78d5e371af478050747d6ed8d78876f49968f7582160f97484012fac022d86d3a0437a4eb2a4d036ba01be8ddb48c80717364cf4ee8823c73eeb37f5b519f84968b0ded7b976381d619ea4fe8236a5e54a56e445e1f9fdb416fa74da9c9b35392ffab02050066c7ad080b2a6f9afec47198f503807dca2873958f8bad5a9f948673096ee94785e6f89a351c0308666a14566ba54eba3c391f948dcffd1e8302d7d2d747035d78824f79ec4596ebb738717f2324628b843fab71daacab4f29f240e2d4bf7715c5e69ffea9502cb388aae50386fdbfb2d621bc5c71e54e177e067c80f9c8723d63f40207f2080c4804c3e3b24268e04ae6c9ac8aa0d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604148418cc8534ecbc0c94942e08599cc7b2104e0a08300d06092a864886f70d01010b0500038201010098f2375a4190a11ac57651282036230eaee628bbaaf894ae48a4307f1bfc248d4bb4c8a197f6b6f17a70c85393cc0828e39825cf23a4f9de21d37c8509ad4e9a753ac20b6a897876444718656c8d418e3b7f9acbf4b5a750d7052c37e8034bade961a0026ef5f2f0c5b2ed5bb7dcfa945c779e13a57f52ad95f2f8933bde8b5c5bca5a525b60af14f74befa3fb9f40956d3154fc42d3c7461f23add90f48709ad9757871d1724334756e5759c2025c266029cf2319168e8843a5d4e4cb08fb231143e843297262a1a95d5e08d490aeb8d8ce14c2d055f286f6c49343776661c0b9e841d7977860036e4a72aea5d17dba109e866c1b8ab95933f8ebc490bef1b9 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0D44DD8C3C8C1A1A58756481E90F2E2AFFB3D26E\Blob = 0300000001000000140000000d44dd8c3c8c1a1a58756481e90f2e2affb3d26e2000000001000000ba010000308201b63082015ba0030201020213066c9fd5749736663f3b0b9ad9e89e7603f24a300a06082a8648ce3d0403023039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412033301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f7420434120333059301306072a8648ce3d020106082a8648ce3d030107034200042997a7c6417fc00d9be8011b56c6f252a5ba2db212e8d22ed7fac9c5d8aa6d1f73813b3b986b397c33a5c54e868e8017686245577d44581db337e56708eb66dea3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414abb6dbd7069e37ac3086079170c79cc419b178c0300a06082a8648ce3d0403020349003046022100e08592a317b78df92b06a593ac1a98686172fae1a1d0fb1c7860a64399c5b8c40221009c02eff1949cb396f9ebc62af8b62cfe3a901416d78c6324481cdf307dd5683b MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\1C58A3A8518E8759BF075B76B750D4F2DF264FCD\Blob = 0300000001000000140000001c58a3a8518e8759bf075b76b750d4f2df264fcd2000000001000000c2040000308204be308203a6a003020102021006d8d904d5584346f68a2fa754227ec4300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3231303431343030303030305a170d3331303431333233353935395a304f310b300906035504061302555331153013060355040a130c446967694365727420496e633129302706035504031320446967694365727420544c53205253412053484132353620323032302043413130820122300d06092a864886f70d01010105000382010f003082010a0282010100c14bb3654770bcdd4f58dbec9cedc366e51f311354ad4a66461f2c0aec6407e52edcdcb90a20eddfe3c4d09e9aa97a1d8288e51156db1e9f58c251e72c340d2ed292e156cbf1795fb3bb87ca25037b9a52416610604f571349f0e8376783dfe7d34b674c2251a6df0e9910ed57517426e27dc7ca622e131b7f238825536fc13458008b84fff8bea75849227b96ada2889b15bca07cdfe951a8d5b0ed37e236b4824b62b5499aecc767d6e33ef5e3d6125e44f1bf71427d58840380b18101faf9ca32bbb48e278727c52b74d4a8d697dec364f9cace53a256bc78178e490329aefb494fa415b9cef25c19576d6b79a72ba2272013b5d03d40d321300793ea99f50203010001a38201823082017e30120603551d130101ff040830060101ff020100301d0603551d0e04160414b76ba2eaa8aa848c79eab4da0f98b2c59576b9f4301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030106082b06010505070302307606082b06010505070101046a3068302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304006082b060105050730028634687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274476c6f62616c526f6f7443412e63727430420603551d1f043b30393037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274476c6f62616c526f6f7443412e63726c303d0603551d2004363034300b06096086480186fd6c02013007060567810c01013008060667810c0102013008060667810c0102023008060667810c010203300d06092a864886f70d01010b050003820101008032ce5e0bdd6e5a0d0aafe1d684cbc08efa8570edda5db30cf72b7540fe850afaf33178b7704b1a8958ba80bdf36b1de97ecf0bba589c59d490d3fd6cfdd0986db771825bcf6d0b5a09d07bdec443d82aa4de9e41265fbb8f99cbddaee1a86f9f87fe74b71f1b20abb14fc6f5675d5d9b3ce9ff69f7616cd6d9f3fd36c6ab038876d24b2e7586e3fcd8557d26c21177df3e02b67cf3ab7b7a86366fb8f7d89371cf86df7330fa7babed2a59c842843b11171a52f3c90e147da25b7267ba71ed574766c5b8024a65345e8bd02a3c209c51994ce7529ef76b112b0d927e1de88aeb36164387ea2a63bf753febdec403bb0a3cf730efebaf4cfc8b3610733ef3a4 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\2AD974A775F73CBDBBD8F5AC3A49255FA8FB1F8C\Blob = 0300000001000000140000002ad974a775f73cbdbbd8f5ac3a49255fa8fb1f8c2000000001000000620400003082045e30820346a0030201020213077312380b9d6688a33b1ed9bf9ccda68e0e0f300d06092a864886f70d01010b05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412031301e170d3232303832333232323132385a170d3330303832333232323132385a303c310b3009060355040613025553310f300d060355040a1306416d617a6f6e311c301a06035504031313416d617a6f6e205253412032303438204d303130820122300d06092a864886f70d01010105000382010f003082010a0282010100eb712ca9cb1f8828923230af8a570f78b73725955587ac675c97d322c8daa214676b7cf067dae2032ab356125dc6b547f96708a7937a9592180fb4f9f910369a7f2f80b64fba134ec75d531ee0dd96330720d396bc12e4745042a1051373b54f9b4424fe2d7fedbc2285ec362133977506ce271882dce3d9c582078d5e26012626671fd93f13cf32ba6bad7864fcaaff0e023c07df9c0578728cfdea75b7032884dae86e078cd05085ef8154b2716eec6d62ef8f94c35ee9c4a4d091c02e249198caeeba258ed4f671b6fb5b6b38064837478d86dcf2ea06fb76377d9eff424e4d588293cfe271c278b17aab4b5b94378881e4d9af24aef872c565fb4bb451e70203010001a382015a3082015630120603551d130101ff040830060101ff020100300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030106082b06010505070302301d0603551d0e0416041481b80e638a891218e5fa3b3b50959fe6e5901385301f0603551d230418301680148418cc8534ecbc0c94942e08599cc7b2104e0a08307b06082b06010505070101046f306d302f06082b060105050730018623687474703a2f2f6f6373702e726f6f746361312e616d617a6f6e74727573742e636f6d303a06082b06010505073002862e687474703a2f2f6372742e726f6f746361312e616d617a6f6e74727573742e636f6d2f726f6f746361312e636572303f0603551d1f043830363034a032a030862e687474703a2f2f63726c2e726f6f746361312e616d617a6f6e74727573742e636f6d2f726f6f746361312e63726c30130603551d20040c300a3008060667810c010201300d06092a864886f70d01010b05000382010100ad00de0205232e063262b46bb19416e41140de2bfa59c135efe0aa8f2b41b9d1f38739001df23db5a7470c0606c691f3075702d4edbd17c1909abf4875a2074f30dd4a6a42b50d3d15c00ffe845bc63c99cc5752b1d86e12d59692934b94e507e88982086a7a34d49e64e13d876a92909a63a14bf88fb6ea34d305be20c2de06e28c9f738b9f4d3985cace19369d85c99ec9f8503fb67e88a1efca84068b50b40a5ca61c44f1fdc8614060f26125aa07f4c7c27375e40c0b428d04e55f4448995b7b898196a7889d4b0d62e804c4d7feb4e8b26dcaecc01cbc385b1ddf85ce5b7ae3494b6cb9a7ddf405b249ade1c5146bc2ccebcd7fd65869bac3207e7fb0b8 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54362000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E\Blob = 030000000100000014000000b51c067cee2b0c3df855ab2d92f4fe39d4e70f0e2000000001000000e1030000308203dd308202c5a003020102020100300d06092a864886f70d01010b050030818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a30818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bdedc103fcf68ffc02b16f5b9f48d99d79e2a2b703615618c347b6d7ca3d352e8943f7a1699bde8a1afd13209cb44977322956fdb9ec8cdd22fa72dc276197eef65a84ec6e19b9892cdc845bd574fb6b5fc589a51052894655f4b8751ce67fe454ae4bf85572570219f8177159eb1e280774c59d48be6cb4f4a4b0f364377992c0ec465e7fe16d534c62afcd1f0b63bb3a9dfbfc7900986174cf26824063f3b2726a190d99cad40e75cc37fb8b89c159f1627f5fb35f6530f8a7b74d765a1e765e34c0e89656998ab3f07fa4cdbddc32317c91cfe05f11f86baa495cd19994d1a2e3635b0976b55662e14b741d96d426d4080459d0980e0ee6defcc3ec1f90f10203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147c0c321fa7d9307fc47d68a362a8a1ceab075b27300d06092a864886f70d01010b050003820101001159fa254f036f94993b9a1f828539d47605945ee128936d625d09c2a0a8d4b07538f1346a9de49f8a862651e62cd1c62d6e95204a9201ecb88a677b31e2672e8c9503262e439d4a31f60eb50cbbb7e2377f22ba00a30e7b52fb6bbb3bc4d379514ecd90f4670719c83c467a0d017dc558e76de68530179a24c410e004f7e0f27fd4aa0aff421d37ed94e5645912207738d3323e3881759673fa688fb1cbce1fc5ecfa9c7ecf7eb1f1072db6fcbfcaa4bfd097054abcea18280290bd5478092171d3d17d1dd916b0a9613dd00a0022fcc77bcb0964450b3b4081f77d7c32f598ca588e7d2aee90597364f936745e25a1f566052e7f3915a92afb508b8e8569f4 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa22000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\5A8CEF45D7A69859767A8C8B4496B578CF474B1A\Blob = 0300000001000000140000005a8cef45d7a69859767a8c8b4496b578cf474b1a2000000001000000450500003082054130820329a0030201020213066c9fd29635869f0a0fe58678f85b26bb8a37300d06092a864886f70d01010c05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412032301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f74204341203230820222300d06092a864886f70d01010105000382020f003082020a0282020100ad969f2d9c4a4c4a81795199ec8acb6b605113bc4d6d06fcb0088ddd19106ac7260c35d8c06f2084e994b19b8503c35bdb4ae8c8f89076d95b4fe34ce806364dcc9aac3d0c902b92d4061960ac374479858182ad5a37e00dcc9da64c5276ea439db704d150f655e0d5d2a64985e937e9ca7eae5c954d489a3fae205a6d8895d934b8521a4390b0bf6c05b9b678b7ead0e43a3c125362ff4af27bbe3505a91234e3f36474622c3d00495a28fe3244bb87dd652702713bda4af71fdacdf72155904f0fecae82e19f6bd945d3bbf05f87ed3c2c3986da3fdeec7255eb79a3addbdd7cb0ba1ccefcde4f3576cf0ff8781f6a36514627615be99ecff0a2557d7c258a6f2fb4c5cf842e2bfd0d51106cfb5f1bbc1b7ec5ae3b98013192ff0b57f49ab2b957e9abef0d76d1f0eef4ce86a7e06ee9b469a1df69f633c6692e97139ea587b057108137c953b3bb7ff692d19cd018f4926eda834fa663994ca5fb5eef21647a205f6c648515cb37e9620c0b2a16dc012e32da3e4bf59e3af6174094ef9e910886fabe63a85a33eccb744395f96c695236c7296ffc55035c1ffb9fbd47ebe74947950b4e89220949e0f5611ef1bf2e8a726e8059ff573af97532a34e5feced2862d94d73f2cc811760edcdebdcdba7cac57e02bdf2540854fdb42d092c17544a98d154e1516708d2ed6e7e6f3fd22d81592966cb903995111e7427feddebaf0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414b00cf04c30f405580248fd33e552af4b84e36652300d06092a864886f70d01010c05000382020100aaa8808f0e78a3e0a2d4cde6f5987a3bea0003b0970e93bc5aa8f62c8c7287a9b1fc7f73fd637178a58759cf30e10d10b2135a6d82f56ae6809fa0050b68e4476bc76adfb6fd773272e518fa09f4a0932c5dd28c75857665900c0379b7312363ad788309866884cafff9cf269a9279e7cd4bc5e761a717cbf3a91293936ba7e82f5392c46058b0cc0251185b858d625963b6adb4de9afb26f70027c05d55377499c9507fe3592e44e32c25eeec4c3277b49f1ae94b5d20c5dafd1c8716c643e8d4bb269a45705ea90b3753e2467b27fde046f289b7cc42b6cb28266ed9a5c93ac8411360f7508c15aeb26d1a151a5778e6922ad96590823f6c02afae123a27963604d71da28063a99bf1e5bab47c14b04ec9b11f745f38f651ea9bfa2ca211d4a92d271a45b1afb24e710dc05846d66906cb53cbb3fe6b41cd417e7d4c0f7c72797a59cd5e4a0eac9ba99873797cb4f4ccb9b8070cb2745cb8c76f88a190a7f4aaf9bf673af41a15621eb79fbe3db129af67a112f25810195303301bb81a89f69cbd97038ea309f31d8b21f1b4dfe41cd19f650206ea5cd613b384efa2a55c8c7729a768c06bae40d2a8b4eacdf08d4b389c199a1b2854b88990efca75813e1ef26424c718af4eff479e07f63565a4d30a56fff517646cefa822254993b6df0017da587e5deec51bb0d1d15f2110c7f9f3ba020a2707c5f1d6c7d3e0fb09606c MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F6108407D6F8BB67980CC2E244C2EBAE1CEF63BE\Blob = 030000000100000014000000f6108407d6f8bb67980cc2e244c2ebae1cef63be2000000001000000f6010000308201f230820178a0030201020213066c9fd7c1bb104c2943e5717b7b2cc81ac10e300a06082a8648ce3d0403033039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412034301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f7420434120343076301006072a8648ce3d020106052b8104002203620004d2ab8a374fa3530dfec18a7b4ba87b464b63b062f62d1bdb087121d200e863bd9a27fbf0396e5dea3da5c981aaa35b2098455d16dbfde8106de39ce0e3bd5f8462f3706433a0cb242f70ba88a12aa075f881ae6206c481db396e29b01efa2e5ca3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414d3ecc73a656ecce1da769a56fb9cf3866d57e581300a06082a8648ce3d040303036800306502303a8b21f1bd7e11add0ef58962fd6eb9d7e908d2bcf6655c32ce328a9700a470ef0375912ff2d9994284e2a4f354d335a023100ea75004e3bc43a941291c958469d211372a7889c8ae44c4adb96d4ac8b6b6b49125333add7e4be24fcb50a76d4a5bc10 MBAMInstallerService.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_94b3b5aea9f68be76318dcf0a02ed684_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 52 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe - Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MBAMService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MBAMService.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Malwarebytes.exe = "11000" MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION MBAMService.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\mbam.exe = "11000" MBAMService.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\mbamtray.exe = "11000" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION MBAMInstallerService.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications MBAMInstallerService.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\16.0\Common MBAMInstallerService.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:\ MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp SearchProtocolHost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\15.0\Common MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\16.0\Common\Security MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\16.0 MBAMInstallerService.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx SearchProtocolHost.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Malwarebytes\FirstRun = "false" MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\16.0 MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show" SearchProtocolHost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies MBAMInstallerService.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006e0bcc025323dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg SearchProtocolHost.exe Set value (str) \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:\ MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\S-1-5-20\Software MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:\ MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\16.0\Common MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0 MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\Software MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs MBAMService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6A66A096-E54B-4F72-8654-ED7715B07B43}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3DCF0F42-EF8F-4450-BA68-42B61F594B2F}\TypeLib\ = "{226C1698-A075-4315-BB5D-9C164A96ACE7}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3C0ECFDC-317D-406B-ADF5-C0E8217E244F}\ = "ILicenseControllerV15" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BBE61C7C-6D07-4067-B177-0C88A58FA92D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{638A43D2-5475-424B-87B8-042109D7768F}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3A34647B-D9A8-40D9-B563-F9461E98030E}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C9669A3D-81E8-46F6-A51E-815A0863D612}\TypeLib\Version = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{566DC5CA-A3C4-4959-AB92-37606E12AAFF}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MB.AEController.1\CLSID\ = "{F415899A-1576-4C8B-BC9F-4854781F8A20}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MB.ArwController\CurVer MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{55D0C28B-2BF3-4230-B48D-DB2C2D7BF6F8}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{90F4450A-B7B2-417C-8ABB-BBD1BDFBFC27}\TypeLib\ = "{332AFEBA-9341-4CEC-8EA6-DB155A99DF63}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{55E4B8FB-921C-4751-8B2D-AE33BD7D0B74}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{19B9825A-26E8-468B-BD9F-3034509098F0}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{34544A67-823A-484D-8E18-371AFEAEC02E}\TypeLib\ = "{FFB94DF8-FC15-411C-B443-E937085E2AC1}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{02E9FB91-8E7C-46BF-958D-EAF5002A59B8}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AD174136-2177-4A57-88AA-F336662EE04A}\TypeLib\Version = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{571FB9A8-E53B-4740-B125-082207566E5F}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E3B068E5-020E-4E96-AE08-76292A138FB8}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2A153977-1A37-4EF7-9226-9E128FA51AE1}\ = "ITelemetryControllerV5" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4163399F-AB08-4E5E-BE28-6B9440393AD3}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E95BF32A-DE84-4E41-B836-E2A7BAB962AF}\TypeLib\ = "{FFB94DF8-FC15-411C-B443-E937085E2AC1}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{61DF8ACF-EC61-4D69-A543-20EA450E1A84}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{05510285-C4B6-4AFD-971B-EBE3139F45A3}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{580243BF-3CEE-4131-A599-C6FED66BEB1B} MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E2870643-0645-41F9-BCCB-F5969386162C}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{34544A67-823A-484D-8E18-371AFEAEC02E}\ = "IRTPControllerEventsV6" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AC765BED-7B43-4A78-9958-11E3612E4B2F}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MB.CloudController.1\ = "CloudController Class" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E3D4AC2-A9AE-478A-91EE-79C35D3CA8C7}\TypeLib\Version = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4E0987E3-3699-4C92-8E76-CAEDA00FA44C}\ProxyStubClsid32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E41AC038-1688-417F-BE23-52D898B93903}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{96C7187E-6EC4-49BD-88C7-04A3A8A97CC5}\TypeLib\Version = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{19E8B60E-50A1-4E29-9138-A13421D2BF7D} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{97EB7268-0D7B-43F6-9C11-337287F960DF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{893E5593-9490-4E90-9F1E-0B786EC41470}\TypeLib\ = "{2446F405-83F0-460F-B837-F04540BB330C}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MB.MWACController\ = "MWACController Class" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{735BE2C0-5A9B-457A-A0A9-4B27FCED2817}\TypeLib\ = "{5709DEEB-F05E-4D5C-8DC4-3B0D924EE08F}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D1E6E99C-9728-4244-9570-215B400D226D}\ = "_ITelemetryControllerEventsV2" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8DF5CCD7-6442-495E-9016-B4AF5B9110A6}\ = "IMWACControllerEventsV13" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D2D1C2BC-3427-478E-A903-ADFBCF5711CD}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7DD05E6E-FF07-4CD3-A7BA-200BEC812A5C}\ = "IAEControllerV5" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C9669A3D-81E8-46F6-A51E-815A0863D612}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5BA2811A-EE5B-44DF-81CD-C75BB11A82D4}\TypeLib\Version = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\malwarebytes\shell\open MBAMInstallerService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MB.UpdateController\CurVer\ = "MB.UpdateController.1" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9F0067A5-A8F1-46BF-AA32-F418656FDE6F}\ = "IScanParametersV8" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{78E69E6F-EC12-4B84-8431-1D68572C7A61}\ = "_IScanControllerEvents" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F12E228B-821D-4093-B2E0-7F3E169A925A}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5B9F1C8B-1E3B-4FBA-9C8A-7B0E6DCD9C9E}\TypeLib\ = "{226C1698-A075-4315-BB5D-9C164A96ACE7}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FFB9BE53-8FE4-4B61-9C25-18E5B4B202E8}\TypeLib\ = "{332AFEBA-9341-4CEC-8EA6-DB155A99DF63}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C5201562-332D-4385-87E7-2BB41B1694AA}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BF474111-9116-45C6-AF53-209E64F1BB53}\Programmable MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5D448EF3-7261-4C0C-909C-6D56043C259D}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D81C2A20-D03D-40D4-A371-A499633A2AD3}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C4C41809-DC9B-4791-8F18-3F04C847E62F}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2650A9C4-A53C-4BEF-B766-7405B4D5562B}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A993F934-6341-4D52-AB17-F93184A624E4} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{636AD0C8-854C-46A5-8442-E5EE74723B3C}\TypeLib\ = "{FFB94DF8-FC15-411C-B443-E937085E2AC1}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B1790AB-65B0-4F50-812F-7CC86FA94AF7}\TypeLib\ = "{FFB94DF8-FC15-411C-B443-E937085E2AC1}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4E0F1EE6-E7CA-4BEE-8C08-0959842DA615}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6ED2B0A1-984E-4A35-9B04-E0EBAFB2842A}\ = "IScanControllerEventsV12" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{698A4513-65F0-46A3-9633-220A6E4D1D07}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0E2822AB-0447-4F28-AF4C-FFDB1E8595AE}\1.0\0\win64\ = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\\14" MBAMService.exe - Modifies system certificate store 2 TTPs 12 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\1C58A3A8518E8759BF075B76B750D4F2DF264FCD MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\2AD974A775F73CBDBBD8F5AC3A49255FA8FB1F8C MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8DA7F965EC5EFC37910F1C6E59FDC1CC6A6EDE16 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\5A8CEF45D7A69859767A8C8B4496B578CF474B1A MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0D44DD8C3C8C1A1A58756481E90F2E2AFFB3D26E MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F6108407D6F8BB67980CC2E244C2EBAE1CEF63BE MBAMInstallerService.exe - Suspicious behavior: EnumeratesProcesses 60 IoCs
pid Process 3520 2026-08-03_94b3b5aea9f68be76318dcf0a02ed684_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 3520 2026-08-03_94b3b5aea9f68be76318dcf0a02ed684_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 3520 2026-08-03_94b3b5aea9f68be76318dcf0a02ed684_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 3520 2026-08-03_94b3b5aea9f68be76318dcf0a02ed684_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 3520 2026-08-03_94b3b5aea9f68be76318dcf0a02ed684_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 3520 2026-08-03_94b3b5aea9f68be76318dcf0a02ed684_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 3520 2026-08-03_94b3b5aea9f68be76318dcf0a02ed684_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 3520 2026-08-03_94b3b5aea9f68be76318dcf0a02ed684_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 3520 2026-08-03_94b3b5aea9f68be76318dcf0a02ed684_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 3520 2026-08-03_94b3b5aea9f68be76318dcf0a02ed684_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 3520 2026-08-03_94b3b5aea9f68be76318dcf0a02ed684_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 3520 2026-08-03_94b3b5aea9f68be76318dcf0a02ed684_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 3520 2026-08-03_94b3b5aea9f68be76318dcf0a02ed684_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 3520 2026-08-03_94b3b5aea9f68be76318dcf0a02ed684_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 3520 2026-08-03_94b3b5aea9f68be76318dcf0a02ed684_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 3520 2026-08-03_94b3b5aea9f68be76318dcf0a02ed684_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 3520 2026-08-03_94b3b5aea9f68be76318dcf0a02ed684_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 3520 2026-08-03_94b3b5aea9f68be76318dcf0a02ed684_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 3520 2026-08-03_94b3b5aea9f68be76318dcf0a02ed684_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 3520 2026-08-03_94b3b5aea9f68be76318dcf0a02ed684_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 3520 2026-08-03_94b3b5aea9f68be76318dcf0a02ed684_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 3520 2026-08-03_94b3b5aea9f68be76318dcf0a02ed684_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 3520 2026-08-03_94b3b5aea9f68be76318dcf0a02ed684_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 3520 2026-08-03_94b3b5aea9f68be76318dcf0a02ed684_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 3520 2026-08-03_94b3b5aea9f68be76318dcf0a02ed684_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 3520 2026-08-03_94b3b5aea9f68be76318dcf0a02ed684_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 3520 2026-08-03_94b3b5aea9f68be76318dcf0a02ed684_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 3520 2026-08-03_94b3b5aea9f68be76318dcf0a02ed684_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 3520 2026-08-03_94b3b5aea9f68be76318dcf0a02ed684_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 3520 2026-08-03_94b3b5aea9f68be76318dcf0a02ed684_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 2372 MBAMInstallerService.exe 2372 MBAMInstallerService.exe 2372 MBAMInstallerService.exe 2372 MBAMInstallerService.exe 2372 MBAMInstallerService.exe 2372 MBAMInstallerService.exe 2372 MBAMInstallerService.exe 2372 MBAMInstallerService.exe 2372 MBAMInstallerService.exe 2372 MBAMInstallerService.exe 2372 MBAMInstallerService.exe 2372 MBAMInstallerService.exe 2372 MBAMInstallerService.exe 2372 MBAMInstallerService.exe 2372 MBAMInstallerService.exe 2372 MBAMInstallerService.exe 2372 MBAMInstallerService.exe 2372 MBAMInstallerService.exe 2372 MBAMInstallerService.exe 2372 MBAMInstallerService.exe 2372 MBAMInstallerService.exe 2372 MBAMInstallerService.exe 2372 MBAMInstallerService.exe 2372 MBAMInstallerService.exe 2372 MBAMInstallerService.exe 2372 MBAMInstallerService.exe 2372 MBAMInstallerService.exe 2372 MBAMInstallerService.exe 2372 MBAMInstallerService.exe 2372 MBAMInstallerService.exe - Suspicious behavior: LoadsDriver 4 IoCs
pid Process 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 3520 2026-08-03_94b3b5aea9f68be76318dcf0a02ed684_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe Token: SeAssignPrimaryTokenPrivilege 1800 AgentService.exe Token: SeBackupPrivilege 2816 ReFsDedupSvc.exe Token: SeRestorePrivilege 2816 ReFsDedupSvc.exe Token: SeBackupPrivilege 2816 ReFsDedupSvc.exe Token: SeRestorePrivilege 2816 ReFsDedupSvc.exe Token: SeBackupPrivilege 2816 ReFsDedupSvc.exe Token: SeRestorePrivilege 2816 ReFsDedupSvc.exe Token: SeBackupPrivilege 2816 ReFsDedupSvc.exe Token: SeRestorePrivilege 2816 ReFsDedupSvc.exe Token: SeBackupPrivilege 2816 ReFsDedupSvc.exe Token: SeRestorePrivilege 2816 ReFsDedupSvc.exe Token: 33 4108 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 4108 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4108 SearchIndexer.exe Token: SeDebugPrivilege 3520 2026-08-03_94b3b5aea9f68be76318dcf0a02ed684_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe Token: SeDebugPrivilege 3520 2026-08-03_94b3b5aea9f68be76318dcf0a02ed684_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe Token: SeDebugPrivilege 3520 2026-08-03_94b3b5aea9f68be76318dcf0a02ed684_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe Token: SeDebugPrivilege 3520 2026-08-03_94b3b5aea9f68be76318dcf0a02ed684_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe Token: SeDebugPrivilege 2372 MBAMInstallerService.exe Token: SeDebugPrivilege 2372 MBAMInstallerService.exe Token: SeDebugPrivilege 2372 MBAMInstallerService.exe Token: SeDebugPrivilege 2372 MBAMInstallerService.exe Token: SeDebugPrivilege 2372 MBAMInstallerService.exe Token: SeDebugPrivilege 2372 MBAMInstallerService.exe Token: SeDebugPrivilege 2372 MBAMInstallerService.exe Token: SeDebugPrivilege 2372 MBAMInstallerService.exe Token: SeDebugPrivilege 2372 MBAMInstallerService.exe Token: SeDebugPrivilege 2372 MBAMInstallerService.exe Token: SeDebugPrivilege 2372 MBAMInstallerService.exe Token: SeDebugPrivilege 2372 MBAMInstallerService.exe Token: SeDebugPrivilege 2372 MBAMInstallerService.exe Token: SeDebugPrivilege 2372 MBAMInstallerService.exe Token: SeDebugPrivilege 2372 MBAMInstallerService.exe Token: SeDebugPrivilege 2372 MBAMInstallerService.exe Token: SeDebugPrivilege 2372 MBAMInstallerService.exe Token: SeDebugPrivilege 2372 MBAMInstallerService.exe Token: SeDebugPrivilege 2372 MBAMInstallerService.exe Token: SeDebugPrivilege 2372 MBAMInstallerService.exe Token: SeDebugPrivilege 2372 MBAMInstallerService.exe Token: SeDebugPrivilege 2372 MBAMInstallerService.exe Token: SeDebugPrivilege 2372 MBAMInstallerService.exe Token: SeDebugPrivilege 2372 MBAMInstallerService.exe Token: SeDebugPrivilege 2372 MBAMInstallerService.exe Token: SeDebugPrivilege 2372 MBAMInstallerService.exe Token: SeDebugPrivilege 2372 MBAMInstallerService.exe Token: SeDebugPrivilege 2372 MBAMInstallerService.exe Token: SeDebugPrivilege 2372 MBAMInstallerService.exe Token: SeDebugPrivilege 2372 MBAMInstallerService.exe Token: SeDebugPrivilege 2372 MBAMInstallerService.exe Token: SeDebugPrivilege 2372 MBAMInstallerService.exe Token: SeDebugPrivilege 2372 MBAMInstallerService.exe Token: SeDebugPrivilege 2372 MBAMInstallerService.exe Token: SeDebugPrivilege 2372 MBAMInstallerService.exe Token: SeDebugPrivilege 2372 MBAMInstallerService.exe Token: SeDebugPrivilege 2372 MBAMInstallerService.exe Token: SeDebugPrivilege 2372 MBAMInstallerService.exe Token: SeDebugPrivilege 2372 MBAMInstallerService.exe Token: SeDebugPrivilege 2372 MBAMInstallerService.exe Token: SeDebugPrivilege 2372 MBAMInstallerService.exe Token: SeDebugPrivilege 2372 MBAMInstallerService.exe Token: SeDebugPrivilege 2372 MBAMInstallerService.exe Token: SeDebugPrivilege 2372 MBAMInstallerService.exe Token: SeDebugPrivilege 2372 MBAMInstallerService.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3520 2026-08-03_94b3b5aea9f68be76318dcf0a02ed684_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4108 wrote to memory of 3020 4108 SearchIndexer.exe 101 PID 4108 wrote to memory of 996 4108 SearchIndexer.exe 102 PID 4108 wrote to memory of 1728 4108 SearchIndexer.exe 103 PID 4108 wrote to memory of 5008 4108 SearchIndexer.exe 104 PID 2372 wrote to memory of 6048 2372 MBAMInstallerService.exe 108 PID 2372 wrote to memory of 1076 2372 MBAMInstallerService.exe 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_94b3b5aea9f68be76318dcf0a02ed684_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-03_94b3b5aea9f68be76318dcf0a02ed684_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe"1⤵
- Downloads MZ/PE file
- Drops file in Drivers directory
- Checks BIOS information in registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3520
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:244
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:5576
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:4660
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:1644
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:2832
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3160
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2816
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5100
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:3252
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1800
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:3020
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:996
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2828 2844 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:1728
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2848 2864 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵
- Modifies data under HKEY_USERS
PID:5008
-
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies trusted root certificate store through registry
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe" /installmbtun2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
PID:6048
-
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe" /Service /Protected2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
PID:1076
-
-
C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Event Triggered Execution: Netsh Helper DLL
PID:4252
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "9" "C:\Program Files\Malwarebytes\Anti-Malware\mbtun\mbtun.inf" "9" "4ba9030c7" "0000000000000188" "Service-0x0-3e7$\Default" "00000000000000E0" "208" "C:\Program Files\Malwarebytes\Anti-Malware\mbtun"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:4316
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"1⤵
- Executes dropped EXE
PID:4664
-
C:\Windows\system32\DRIVERS\MbamElam.sysC:\Windows\system32\DRIVERS\MbamElam.sys1⤵
- Executes dropped EXE
PID:3548
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies trusted root certificate store through registry
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies system certificate store
PID:5908 -
C:\ProgramData\Malwarebytes\MBAMService\rmode\mbrescue.exe"C:\ProgramData\Malwarebytes\MBAMService\rmode\mbrescue.exe" /rescuemode "C:\Program Files\Malwarebytes\Anti-Malware" "C:\ProgramData\Malwarebytes\MBAMService"2⤵PID:3656
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k AppReadiness -p -s AppReadiness1⤵PID:624
-
C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Event Triggered Execution: Netsh Helper DLL
PID:4792
-
C:\Windows\system32\DRIVERS\mbamswissarmy.sysC:\Windows\system32\DRIVERS\mbamswissarmy.sys1⤵
- Executes dropped EXE
PID:704
-
C:\Windows\system32\DRIVERS\MbamChameleon.sysC:\Windows\system32\DRIVERS\MbamChameleon.sys1⤵
- Executes dropped EXE
PID:2620
-
C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe"C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe"1⤵PID:2268
-
C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe"C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe"2⤵PID:796
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
2Component Object Model Hijacking
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
2Component Object Model Hijacking
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
1Safe Mode Boot
1Modify Registry
3Subvert Trust Controls
2Install Root Certificate
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\PROGRA~1\MALWAR~1\ANTI-M~1\mbtun\mbtun.cat
- Size 10KB
- SHA256 9ceb410494b95397ec1f8fa505d071672bf61f81cc596b8eccd167a77893c658
- MD5 8abff1fbf08d70c1681a9b20384dbbf9
- SHA1 c9762e121e4f8a7ad931eee58ee60c8e9fc3ecb6
- SHA512 37998e0aee93ff47fe5b1636fce755966debe417a790e1aebd7674c86c1583feef04648a7bc79e4dedaabb731051f4f803932ac49ea0be05776c0f4d218b076f
- SSDEEP 192:gM6dynJCSEJOL7yKnUi8rFWQFIGjl8zjEswYt1FfRM/GX01k9z3AeOlFa:gqS4CFRWGjl8M8/fi/GR9z/OlFa
- TLSH T1B43208E1897D84C2ED87A87147E8E5977C3C1BCB2C5055A911ABF7600AA33C6E71853D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\PROGRA~1\MALWAR~1\ANTI-M~1\mbtun\mbtun.sys
- Size 107KB
- SHA256 6903e60784b9fa5d8b417f93f19665c59946a4de099bd1011ab36271b267261c
- MD5 83d4fba999eb8b34047c38fabef60243
- SHA1 25731b57e9968282610f337bc6d769aa26af4938
- SHA512 47faab5fff3e3e2d2aea0a425444aa2e215f1d5bf97edee2a3bb773468e1092919036bcd5002357594b62519bf3a8980749d8d0f6402de0e73c2125d26e78f1e
- SSDEEP 1536:k0h5S895dQOYJaryTmbMc6uqkZUcmSl47AjpdAyDCYJqUufIfmNn3VzwZ6Dh7Q9y:C895uOYJar1MLcmSlrSgC6Duls2t
- TLSH T174B36C9DA1783089DE42A6B482B98793EFB4357A2B1177BF01E1C1748F537C0DB29DA4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 41a68fddbceb3240901ecac17acd7832e964ee079a00c015e42cf18a0efee144
- MD5 f3915649e2025787f4317e80e00f66e0
- SHA1 0c98c29aceeb385538d4698184da7472b2d0179e
- SHA512 bf50bc563709028b27ac49121313e2e925a84c7e37506f70fe6d8b97add9217265695b3a6ba4768bc40a7075e2f407606122b57f2dda650f546351c6a025bbcc
- SSDEEP 49152:Zb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnGLNiXicJFFRGNzj3:v3q6mjBJ7wRGpj3
- TLSH T17CD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.5MB
- SHA256 0899272d8a542008f5836f12d51c0d8f730984874e48f829323414980fa41b29
- MD5 12969c594ebeff6f100e453f4d7c0c22
- SHA1 4f52e33500ddecf8971afbebd25b5571c1bba761
- SHA512 d62bc3e849fc68648b9c3490439f4d309240fac0dfa022e75510e08f749eff76d505632eaea4fa69e254659833e5c61f8e38effc22c42bbb66962c4ec0670934
- SSDEEP 24576:3XYfDtczAt/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:itc8LNiXicJFFRGNzj3
- TLSH T12B75012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.8MB
- SHA256 c1c85f3e1c04051a1663528a451a45740e5261573715fbf9e7bc85a833a0fc88
- MD5 ca672a7ed20cdea764d7734f09c9ca23
- SHA1 44a5ed718be04f689f12e645c885f9762e4a190c
- SHA512 268c1e5292b740756332043365af5a0dbcc33f2f0e06c7af2ebc673fa565dcf1cf5a6734ef88235dfacd3ef73cbc7bb6477a0e35a3ba84f4a3e238f0b3c86141
- SSDEEP 24576:r0Le5ji0hmxhrM+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:rPji0AzPLNiXicJFFRGNzj3
- TLSH T11D859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 371a6f6e85cfed141ba51871aee58a7c62aa74ec81344792ba7a315f38027396
- MD5 35bb8c1811b04a71bcb6d3186be3d6e3
- SHA1 4345640863d3b47aee6caa2bb8411bb08b65be08
- SHA512 0d5dc96a245e2b09bbd664a197d8e35fd5800d565c9521ccb41cc90fd06a40104338f3fd119baa7f0c81c2d389824ea2367848f82d039b682c634853b10241e1
- SSDEEP 24576:sa7/ezSC6vUyD/aqgrvWj6q8wyuM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:L/ezSC6vUzPv+HjyDLNiXicJFFRGNzj3
- TLSH T1FD756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 f1b5381444bd0322635c5cc456231db51baaa34b63ab828409ffa522748c326b
- MD5 d7c39f97c44f9b0af75029e42813ee2f
- SHA1 3c7450eae23860e4bb3d79e634597d98ca0f11c9
- SHA512 96b331c1eb454bffff96be5114a9ff6ac639baffd86066733465ad4a9c690e7bb8415ced539df06aa19766602495f18c0415e743e548271522be58c0f0098fb5
- SSDEEP 24576:TVbqPb88hv/l+BZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:TVO88hXl+vLNiXicJFFRGNzj3
- TLSH T18B559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.2MB
- SHA256 9a77730daeac95c29f5dcdc5e595cfb4478c0fd79daded3d882ded55a0985071
- MD5 0b54e088891bd227c46fc4eb4437ba5c
- SHA1 d04e872fa447b806afd0a47f047e20f10b6f5f56
- SHA512 6185992c5d259421ed9c3fa7922f1a36169d15ba715a7f9271cbc8a1fd6a9320e29f03b7f68758260b749f2b0e1e7a730955b9a749aed39a676f76933c78eec1
- SSDEEP 24576:DGK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:bLNiXicJFFRGNzj3
- TLSH T17F5523D3468865B1FBFD0039867A5828B5845E2CCA595DE2D2543E5EA13CFEBCF38123
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.5MB
- SHA256 3ecb947d54c0dd84a532eff7fd1d7e3f0c2d0e81b8209e994a432f99e4e748a3
- MD5 b36a23e4b32fc62808e87da4f6fccda5
- SHA1 db52d9a904b16b1b0ed9f2554ecc9cfcf83ee3b5
- SHA512 6e9562d7b56935a8f930775821eae1602d8c9a2f0120740e6b10cb76c39a9e8bbe5827293af47985078c0cbb6bcadeba5890459e990f63ca5c816106cbb5534d
- SSDEEP 24576:sJIUx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:sJIUxLNiXicJFFRGNzj3
- TLSH T12A75CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 feeeff96a3c1a15acced4bd9c6f312575d1fc6eaf3e767ca49e0e1839f3dc0f1
- MD5 7fb39abf9b1adc87025ec5e1c9000b95
- SHA1 740c3fa274c60fee8209c795d8ee1b6830da6f5e
- SHA512 8a1ed00841b4f58e9556a54d4dc7552833eab23797b720f9f4359be163e6e6c023affedea9dc74653563360a9edb2c1419386b5e210b44c30aea0a6b081a4e78
- SSDEEP 49152:UQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THh:UQvGAdlCEL8c/WRNw5Cc7wRGpj3
- TLSH T1DC266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.6MB
- SHA256 16607e9bf7d57ab920b25e39f35050a6bc088b7aa506493d27d71cd2b96ec46c
- MD5 d1454b5807cc188f81cfc0a7da5dc51a
- SHA1 85d0c58ecefb359a4a95ce38028a710629687122
- SHA512 34fd55642241a6b074cd1e4a69e89985e638f77aada4f65fe8bd56a8f4dbf44c42de82dcd27954d2893cb22e2408c809580e22c28ac2af0b08dd9409ad1a9627
- SSDEEP 24576:xfewsAjf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:tljfLNiXicJFFRGNzj3
- TLSH T10E75E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 8d7e5e50b8656b04dae208cc463eeed2dd053fbb33ae8e6ed5dc391d153b48dc
- MD5 e67813d09c9e262fb896a85e5967c181
- SHA1 96810922940c77a7b0ff7ff30427b6b7fe268234
- SHA512 3489a51fd9c2313deae5df621f4e3cec24250b6f77779a85fe1bfee5a94018367f5c19edae650cb691afb8836e480b853cc114af3a88798637d878cd41856e8f
- SSDEEP 196608:yUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHbF9:yUEtQevvqc2W1cpV20I32J9
- TLSH T18B474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 8a15c262452c369710be75cd4b29d5040e1b55221231ff4fd18c1d3fe1c313a9
- MD5 9ad66999a8f2321be694700328df66b8
- SHA1 43119d5beee56aa7be9662c7646fd656440d1b98
- SHA512 35ee2511337b1147ee2dbd25b197b9dd7b5ad39e8dd82f3942d9e1b95751cd8d40e471be9283ba3d0ec76757030e721a00c1fa40f06b54b2ace05d4971cf5c04
- SSDEEP 49152:0CbRquA/m2yL5zLfFiV+XenmE3/z/LNiXicJFFRGNzj3:doq2Vjnmw7wRGpj3
- TLSH T1A6D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.5MB
- SHA256 c559bf4a451587f93018b954dc741d93f446b459f704eb6188d8b884d5bf72e0
- MD5 0fd102089fe8e825234f9a122da91d69
- SHA1 0f32f342e319fe3f904b52c1b5eafc3a7023f0b5
- SHA512 c48ec71f566ff91827179a5a309c3f2930380c59fa65dda5d44b0174101b4f96b3c8c472524266d479f6acd51d81cd15bb88bdc13e10e1d61f210ca97b1700b4
- SSDEEP 24576:zwuROWj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:zwSOELNiXicJFFRGNzj3
- TLSH T1CF65F18632940CF9EABA41398657C035F7F2BC152A21DB5F5360C65B6F37361AE2DB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 0354e470fe7b1be1254328d5ac482756a994344444995b5ce572ceb7b3984118
- MD5 90da846362cb6130399cd02ee9d08c4d
- SHA1 2f89ac87250c8bc04c1f30607088787bcba68d65
- SHA512 f499d47ada9ce0e9fbd7563e1e9c94422ea2df6cd13e1073b2a0ab23a26daa414c340b147d0f2f93f8888feb2c335a41898178d4841b6aa06f786b553ea209d2
- SSDEEP 49152:tB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gldLNiXicJFFRGNzj3:zu6JmIxd2dd7wRGpj3
- TLSH T13DD59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\7z.dll
- Size 1.6MB
- SHA256 623e628393bc4b8131c1f4302b195429dfa67e890d3325ceaa56940660052b1b
- MD5 4da585f081e096a43a574f4f4167947e
- SHA1 38c81c6deae0e6d35c64c060b26271413a176a49
- SHA512 0fe168bf1661691dbaa103e478dd7e46b476db094bf1938bf1ad12ddb8a8f371bf611ff504d2eb3ac319862444cc64a27ebee8735aa3752aa32a399b09427243
- SSDEEP 24576:a9raURTF/5pe2g5RpBDxSjv9IrqLwRpFEDbt7y0MVoAAlzi8pY:a9hP/5petvSjWZR8DxO0mo5M8pY
- TLSH T16F756D5BF67400A4D5D6C034C5276B1BEAB1B88B8330A7EF12D15A6B6F13BF19979320
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\CleanControllerImpl.dll
- Size 8.7MB
- SHA256 8404395da4f44f39236e8265593f52dcbbdcb7e37e129498d4c18b56dee6902e
- MD5 b7930dfd9175b4c2d9abde99076bce4e
- SHA1 7219ee742a50fca1c9be0f68652704386f837797
- SHA512 b3afcdfc3c538ebbc9ed373f1c440592ed45adf274e8e0b4210b1b394605af23f999c2fe7c3742f6c8962578b6982d71f98a7c1be1c4a8f7d663e7240b7a4102
- SSDEEP 98304:pBDjgBUbuC7uYUxcbfssqiamfbt5rOTwLCeLZT:UBUiC7ufWfssqilfbtlkwd
- TLSH T1F9968E56B6E400A4E4F6D178CE678503DBB2BC551731DBDF0690966A1F73BE08A3EB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\CloudControllerImpl.dll
- Size 6.9MB
- SHA256 c1af072bd24fe47e5f2cd71faa900c7a1dd16520d3735f9cc8df40d671b5e9b7
- MD5 43cb480992b8419e0e2938e8897590f8
- SHA1 e8c69764ce3d6627956bc88b598b99b0143dbd87
- SHA512 f6d974086da91d5da49015ef82e4d0494c3bef77829fa4c7438fdf8e0fa06520f682609dfa42a0dd06fded7ae113543a9284467514486f2b514e2d6e94f0d231
- SSDEEP 98304:lTUvUuVCKfYls1zPJ2KxJRttlMA+4sS3GK:evUGCKfn1zPJ2KnRttOTm3GK
- TLSH T163769E5BA6E400A8D8B7C17CCE578503EBB2B81543719BDF06A4967A1F73BE0563EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\LicenseControllerImpl.dll
- Size 7.1MB
- SHA256 223dd68b4fc42d3451d7631a56bf261517e400da2b9536969b7eda80b28a0e93
- MD5 d91ed54c2e16f0c2d883dbcdd0b3c513
- SHA1 e5116a0fd899ccefc5e7375100b6fee90107c293
- SHA512 44b036566fde88317ccb90a3173464c96c547b61da73e1e65cfdbbd2bbe8df96d7425088cb7322c8c1e5cc6abdcc47ab76e41834f8e5cfa0ae07fadde35c5c5c
- SSDEEP 98304:qWth0pN471WY8eAolIft4ooTU5tgrJDFfv/8k:qU034715FAolIV76U5twtFfv/b
- TLSH T137769F6AA7E400ACD4B6D27CCA578503D7B2B8054371DBDF06A4967A1F73BE0963EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
- Size 10.6MB
- SHA256 d10e04217f81b44667c6237971f1f2843d132220c8712e8a855436e9f1f73baa
- MD5 cdd8c06c1f88f57727813906e3a58fb5
- SHA1 4ba873161c0ab0f489bb0c82a267aac8b0cb91dc
- SHA512 40fb64f723481e9b8e24d88edff74dbb85b2e63790595c067b01cc5986ac3a0fdeef0d8083e4c86c0e2681837cb53eb98e7bda2bcb22eb77d1b8330e2d72ef73
- SSDEEP 196608:PRO3j3Ld/5Mo9/vEvt2teG35tTdnXo9076gZCN3R9i:PROT7d/6o9XEvt2teG3p42Yi
- TLSH T10DB69E17A6B400E8D4F7D238CA579A03D7B2B81643B197CF0690567A1F63BE19E3EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
- Size 4.1MB
- SHA256 a67f94a3014d93b9b91f0c8427c81cc18cb13239a114d91c51f993702e60a580
- MD5 88138b3ddd9b2800ea155743aa26fe87
- SHA1 0b45bd01e388bf4821a3caa09e78033588f66667
- SHA512 4f2f2f04c1b3c1d55731d7dc55fa3ee09385b8f77084e79ebde5252242008eb3362beb9b50b3ea8934acc471dcef67763f20d5268f6cb18bfb98926e4189c3b3
- SSDEEP 49152:0JxO5tmuSoHE4RtMMoLPqf/nkMq1BmwlxMOqSv6bi36i6X43jtPQ6zU+5pAqIPIS:8Y5tY4RMk6lxMObN6/tbH
- TLSH T188168D57A7A901E8D8A6C23CC4678603E7B2BC151770A7CF0664627A1FB3AD25F3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
- Size 4.6MB
- SHA256 b582a7d50debfc1c7100ce418030a525b42eb1b330377b8d8999826498f3a76c
- MD5 e3162b579b95050b6311775e05f998d3
- SHA1 5eff286e3556bc02e2cccefbe4fe212db09cf20a
- SHA512 02ab762c74fbc4bbd799605af94f6f7a78e653684634fb00ff1af9707710ff951586029bf2be7dd9215848ee243c9d2ecd59cfbef0ffa929b0873d8b60307fad
- SSDEEP 49152:oJxO5tmuSoHE4RtMMoLPqf/nkMq1BmwlxMOqSv6fi36i6X43jtPQ6zU+5pAqIPIw:wY5tY4RMk6lxMObl6/tbP7wRGpj3
- TLSH T1DD269E57A7A901E8D8A6C23CC4678603E7B2BC151770A7CF0664627A1FB3AD25F3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnel_mbtun.dll
- Size 4.2MB
- SHA256 0b764892f7f32d385684411e647f69f428067180aa28315d71668d3ab25b335e
- MD5 ca4f7f1ffd364bdb46dbbb8bd1319125
- SHA1 a2d8a1a3401a93da3303376e37e6ae36e08c693d
- SHA512 522a23be06d466db16e9abe89897e8562ef1fab483285c37c5ff43468e084a91ea78892ea9225c2da589e440e84034d23b0236af99182ed6d1eb118b4e0dc273
- SSDEEP 49152:lBPD6Io8w4LcTwEDRzTJoeM9YSxjQ5g+o9h6iO0oFjn2Q1Z0NwEIx6:PDG8VQkgRzSeMfn+ofU1M
- TLSH T1C8164B02F8B205B9F2BEF131C9A963217A31749503327B871F9195692A66FE47E3D313
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\PoliciesControllerImpl.dll
- Size 6.1MB
- SHA256 cd1e8f98551fb69d3d47837c09fea35be358dd7c27104afb7f1938a7fadbb2c5
- MD5 436a5828103f6874dda5ca0b32e8e8ec
- SHA1 7a5346221f40349881a65df91014114b1644c8f8
- SHA512 a4ce868855d83ad112b528a4969e5a5f79a115eb92f9e3ef1f05eb09f7f39c099abb162bbf2024b298af715560d81d9f08c2457109d7b2b33c04dff9789dbd05
- SSDEEP 98304:at69nEVAZKwY4Lka7NrGWeG0qwtEQ9VsAwbB:aAnEVmKv4Lka7NrGWJ0qwtP749
- TLSH T1C8569D1BA6E800A8D8B6D13CCA978513E7B2BC15177197CF06A4967A1F73BE05B3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.json
- Size 621B
- SHA256 e981eeb7c0525be4fa4d1e42e5e626a02bf69c15d5262f7bee5ab0b79e275880
- MD5 76048f1e8f6971099a2289176982bfd6
- SHA1 488e7f66de885934e95cd0b14b025c5e1a19a192
- SHA512 32303fc6f33e6a0e3a05fb3e08a061347ece229d0ac1891934bab27308ca71e8b41c88aae35c1fb55b281bf611aad18cd5f82b937e93081c8e3feb5986bba87b
- TLSH T17EF0AC12E95F82F745B4578C96A004C7F728939D0240590FB7F4F685CEF6C28DA82C85
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\TelemetryControllerImpl.dll
- Size 7.3MB
- SHA256 d783c0ae649b6d267c330c3c9d613d4c5ab09bf1f594598484da1760f0b16e4b
- MD5 7a1b3a54f39392375078dac7b2822ad1
- SHA1 7008531c23e7f266e9a94b20bf98f8038aca5562
- SHA512 518aa3b5060ee69f6d46cdc0ff5142109a1129b7b3481243a2291114ac436b2235d0bd6498a527a25686cf6901bfc3cdd2f5caa7d319e794eb587fa03b55d759
- SSDEEP 98304:MJrBHlha0hhvIzoMzMk/Tm78Wi6bPtBrtkXb4:MJNDa0hhvtMzMk/TmQW5bPtB5Wb4
- TLSH T147769E5AB6A400E8D4B6D23CDA578513D7B3B8254331D7EF06A096791F73BE09A3EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\UpdateControllerImpl.dll
- Size 4.5MB
- SHA256 058befee7a55f5d8510de91f4746053fd49393f2f1843c4f090c3dae60d7d540
- MD5 150ce3c5de43955af87ef53f51c1c866
- SHA1 43cbf73c227e208bd2f601c91a27d58962f08e51
- SHA512 20855a4289f8985ffa840d00819efeb2d2f076fff7507f695cf1a3f6927a7b48cd85285e62ca8d25cd4d2593b00b6614c5bc88677cfb8b933f8138b09a9b48ee
- SSDEEP 49152:lzY8o3OtUDkkGEVl0QFxd/X6LCzqlXB9eC24aeZSRBFZ24uFpei6tyP/ZNZoyP++:2en6yQIV2ZOFoxtFlwGYT
- TLSH T19C269E17AAE900F8D8B6D27CC9A78917D7B3B8150371DBCF169082691F637E05A3B724
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll
- Size 3.1MB
- SHA256 8af36217efcc1b2a677accc77839ed3b67ddbfcabfa16caaa42c7e95796b940a
- MD5 d82467d25954c9fbaa91ca97e0de6834
- SHA1 d7da2b4f83acd0d2aaf55de2ae403fa6cc44bfc6
- SHA512 84a38b2d4a1b23439f4c6eca1fc148d618effd1444704f37e5812488877d15789b603944231281299ba332dbd0d3a0e51160c588c0adc1bf338675c62da45aa4
- SSDEEP 49152:zHsR0cmbmDszn14AcKLfC659mLVD+Bjmo+2g5rCdPWD8i51l3z:zHBpmj2Am0D8g3
- TLSH T169E54A227A9540ECF866A23864FB8502F6F27A05236097CB0558727D1EEB7F106BF7D4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\mbtun.dll
- Size 2.8MB
- SHA256 f21a980316bd4c57c70e00840ab76d9ad412092d7d2d6a2cff4f1311f7c05364
- MD5 2bbf63f1dab335f5caf431dbd4f38494
- SHA1 90f1d818ac8a4881bf770c1ff474f35cdaa4fcd0
- SHA512 ebb9834323329dc01ba2c87e5fad1083a4cb86f5ed761cb63299ac5336a9843a1aadd42fbed706797c2295117af1c00f96806422338352653c8e0255fecc2fd5
- SSDEEP 49152:xNrdEZjzdAj9fdc4fDrN1OxOh5PgqdnBq30yPFZP7KVxSL:bBzFRkshaZP2W
- TLSH T136D58C1AA7A800A8EEB6C27CC6578603D7F2B8151771ABDF02A456791F73BE1173E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\mbtun\mbtun.inf
- Size 1KB
- SHA256 4a350fc20834a579c5a58352b7a3aa02a454abbbd9eecd3cd6d2a14864a49cd8
- MD5 5d1917024b228efbeab3c696e663873e
- SHA1 cec5e88c2481d323ec366c18024d61a117f01b21
- SHA512 14b345f03284b8c1d97219e3dd1a3910c1e453f93f51753f417e643f50922e55c0e23aab1d437300e6c196c7017d7b7538de4850df74b3599e90f3941b40ab4a
- TLSH T1CB4140BD48D20AB83C673356671B69C27BDC220145C920ADB2DE8606C88EDDCB905EB9
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\offreg.dll
- Size 140KB
- SHA256 8e6c155a97666c8e6a3f9ea95bfc6f6e4f87beac53dd72164aba3ef33ff88db1
- MD5 1659738d57a15a0983f0373b2faaef45
- SHA1 efd4cd05ff6bd787a2ceabfd11daba1c0e475855
- SHA512 4f62cfe0579e1aeeeb30edd5f42a2b1880446dd1075be051e2e0189da5071f9866e5425ff85547486fd7d952a28efa4e784db0cfdc1fcc428b34eaa89c6a7654
- SSDEEP 1536:kXNnhdTcQOCr7LClg5lSYOurIt/0q9mrf0Xp2N7RibuQusR9YfIZRoU:cnXTcQ57LClMlSYA0q9mrf0XoNHFQZ3
- TLSH T111E39D5A73B420A6E8678678C569875BE776B162232087DF12E5C6B80F037CA7F3C345
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\pkgvers.dat
- Size 78B
- SHA256 d66a1ff3d1b70baf9a382bff5e0ba710c1e4dd2cdc6d381c740fcec5697f168f
- MD5 7e124e77e3c9a9d7f0759286cf99fee2
- SHA1 790a52342ee511e5de80db22831b8d41ab7849f1
- SHA512 6923562c19624d9466243fd2e743642792c654cd293644c386de9a85addc736dac41ed9c1feac2aaedeb400ccf16eb0112955d06750f73f4bae2697eec2507fd
- TLSH T148A02230000C03000CFAB2F0B3B30E20B20FCC2C2B000F0023C2022302AA03022202AF
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.7MB
- SHA256 34685a6a567fe399c6aac5e30d55f2604bf386263ec31562651b118099b96f79
- MD5 4f6bb02b3eebe5a2b22857c10c211d7d
- SHA1 c66f18f9cca90cb8b2616909e39138a0275f4fcf
- SHA512 0417f4cf3b4b731a979c6a4416bc1f272e32cfe6290982930f5da23fd3eeebcac7791b93dabc0fac82dade9c5d9004205032d99e0ba68fcc4a29b348950d1904
- SSDEEP 24576:6fwvzk9RX6wkyAIq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:BMnYIqLNiXicJFFRGNzj3
- TLSH T1D385DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.5MB
- SHA256 f48631513d30f95b33f5d47c35ee232bc615958c00fa85232430308336964bee
- MD5 60f3f8f0b029bfe2277eee51ccb16bb6
- SHA1 a64abe4be4a228f1605651deb828f5a8ffdbe58e
- SHA512 6236fba554d686647f33e98645361550c0cda58506b1d575fba2537f478fbea98059e2a5e154873650c9dd0c57bc02135443fe7b459d43b407ed4f1b40b0dd6b
- SSDEEP 49152:hYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0NLNiXicJFFRGN:4ySzPl7wRGpj3
- TLSH T19E066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.4MB
- SHA256 fd0ef6ed977d2884453dd0bb1102f404810f95f987acc334eedcffde2902f45c
- MD5 4ad183d70a1956d7ff1df867fe0106eb
- SHA1 b03ea2e20e24c70e2fade40aeca690ea95329581
- SHA512 10d0743312375d142cf050468b6495981ab23108b8d65604c54e45f3438aa217c5f362948b118c701fdde9d25e685f06df371acb1df4bb7666514f6b92e24743
- SSDEEP 24576:g47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AY7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:g47JUQjqirIhCnDHUPfF/dLNiXicJFFS
- TLSH T1F565AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_4a2022008f4611f19d7e7ead4f05718a\7z.dll
- Size 1.6MB
- SHA256 bb01c6fbb29590d6d144a9038c2a7736d6925a6dbd31889538af033e03e4f5fa
- MD5 3430e2544637cebf8ba1f509ed5a27b1
- SHA1 7e5bd7af223436081601413fb501b8bd20b67a1e
- SHA512 91c4eb3d341a8b30594ee4c08a638c3fb7f3a05248b459bcf07ca9f4c2a185959313a68741bdcec1d76014009875fa7cbfa47217fb45d57df3b9b1c580bc889d
- SSDEEP 24576:29raURTF/5pe2g5RpBDxSjv9IrqLwRpFEDbt7y0MVoAAlziG3B:29hP/5petvSjWZR8DxO0mo5MG3B
- TLSH T175756D5BF67400A4D5D6C034C5276B1BEAB1B88B8330A6EF12D15E6B6F13BF19979320
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_4a2022008f4611f19d7e7ead4f05718a\ctlrpkg\MBAMService.exe
- Size 11.0MB
- SHA256 fd7a1428221fe7de747930cb3d9f2991610e2b1d809a0abc1f26590db5f5986c
- MD5 bb079cbeb5948a894358ac3c5586d990
- SHA1 777c05ca055c938d3352e758d835d33896807a23
- SHA512 692ac8284d78c69b06dfdd7e4b6ecd0380e7198d587c48655d4d2204957e7968209e5aba6fd06ab150823998bdb74446a7f168fb9240f2f1aba0f5a38c39abcd
- SSDEEP 98304:RA64Z/iUYtDJODZi1EZnnsc8tUFswknM94BJ:C64dSJODZi1EZnsc82FZyM94BJ
- TLSH T126C6E606A7F951D8F5BAD674AD7B652AEE32BC618B3093CF1150560B0F32ED48E38721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_4a2022008f4611f19d7e7ead4f05718a\ctlrpkg\MBAMWsc.exe
- Size 4.2MB
- SHA256 7878a9b10903b8c0def49015deefd48a3ea0e46c0f5ac9ae755336994e020152
- MD5 acbb82943fe0d5f1c5df74b1a7dccd2f
- SHA1 c41e38f59eff5e40a6a47b14be44520dcd6d405a
- SHA512 7092748502f06bf05df19bd2d4d5857f161a35a9b2e3a72645eaacffacae7a8dad10ab41ad3b80d3a63ff0773b6c818edf3769ce6b1f61b01cc92edfb755dfc5
- SSDEEP 49152:dK5b4+V1qsR86LMFRbbX8DREqUaP7bBfnuF0JRlnPkokPmsBLdS4BPQRzU/81fge:i86kyaHF0JRlMhBpMyok3M
- TLSH T1C6166B06B6A540ECD866C239A47A8503E7F2B811273097CF066853761FF7AD21EBE7D4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_4a2022008f4611f19d7e7ead4f05718a\ctlrpkg\Malwarebytes_Assistant.runtimeconfig.json
- Size 615B
- SHA256 61fca252e8e336706f4c153c16100b7b621f9092ed09bb6959e406ab5bb21e85
- MD5 389f208d959c5ff4ee9c0e4dbbc31ecc
- SHA1 32243920d3687a1b8af307a3ae140103ec08f222
- SHA512 86dce7141f4fe9fd938f8b5be78d9e9d9885365d7ea7d4d3cb0674ea63a9201f4f0e02ceef47819b9d596a2e397fa68c78e9dfd15acf804ff93fca0f55b1997b
- TLSH T1C5F08B29CA106CB718B8337ED125C083EA30133B10002C56B4FC080C7F775B62221F96
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_4a2022008f4611f19d7e7ead4f05718a\ctlrpkg\mbae.sys
- Size 155KB
- SHA256 c990dd89b65d35d6c9b34e21c78d96e206ec3bcdd934716ee61ff79da0fa5251
- MD5 fc98ddab2223dc73b950622801b31554
- SHA1 997faaec1dfd18b9dd31e1c216440a28bc4cd612
- SHA512 da08860f8c3d8a9204d1480f33d21f2ab922db5cbbf7734527ed05477c2d9c184deaedb63196876c989c9ff6c1b45b5792661f5bce92212992a7cdb664a793e3
- SSDEEP 3072:hcj/Hk4/53QBvOP8JsUrLx1o6GwzfwKYdkXEnU/H0KBJT2:hc4wNQBvOEJvx1o6GwzfwZqEU/33C
- TLSH T1D3F36C52F3B400F5D8A6C679DB669213E6B2780D2721E7CF076085252F673E4BB39326
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_4a2022008f4611f19d7e7ead4f05718a\ctlrpkg\mbamelam.cat
- Size 11KB
- SHA256 64416d564725416c6869ea951878a2734b1f6940b11f7961a897c45f0d8c6625
- MD5 bd4ceae54af081d6b1dd91ff584c5d61
- SHA1 5ade462d66e042da58bb1447d1b31f1aad901b68
- SHA512 37e7abd312f694ee2c8ea54ecf50ed12c16684f1007c61d9a6d1d01cba958be511c5e4e11cd7393a5cd57349fda1c552bebca42962137e0d11695c195761ebb0
- SSDEEP 192:oBxybp/yRpJCSEbhLxyKR/2FWQFdbiI/Ex6RMySX01k9z3AgEhrZg:oLp+eFRvmoMR9zJug
- TLSH T11A320AE58A6C5083DCA7AC6087E8E5D77C3D67C71D00987921DAFB5409933CAFB2816D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_4a2022008f4611f19d7e7ead4f05718a\ctlrpkg\mbamelam.inf
- Size 2KB
- SHA256 e26c2d3347e5f077da92713c9df3cd3eae438fb7e29810bd5c3afe567d2d3125
- MD5 5d8c05cc4f9b4304d57ea10b87f2dcf0
- SHA1 2cabe3d39aa5ec16c54c7818284a2ee235d2ddbd
- SHA512 55bff23fee9852f229246b71721b3659c916079787935d400a97641449dfda752fc8fbf36f9ea3dc4028f05daeb9006a99660284a61aa5d5a466af0ee966c738
- TLSH T164410454AA538BB8697B35B81E472883BF5412205076384032DEC8C99B6DF0C93757AB
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_4a2022008f4611f19d7e7ead4f05718a\ctlrpkg\mbamelam.sys
- Size 21KB
- SHA256 ded569e249e590314d095f740c6b8934a5a797e4f3edbe0f78eac9d333f12a2a
- MD5 8da81aa1f6b89ce1d2e216e3ea351c59
- SHA1 4baf79cbade9a5584630a540e6368d547579fb12
- SHA512 6d611bbd9d480ef2defd745fd06c4ab86e181267cf689d9d0e124edbaf22fd30fbe2310879cc7bb6dde5bae72c4feea1d329cdecfbf101d95634f85dd0769119
- SSDEEP 192:C7IlO/ZnEc+PbYv6/i0RtPH920QvVUKjnegqdsW++w/y1wVWQ4uW/+O68RwX01kd:wIlO/i8ChLIxUKjnev6+Twc69R9zING
- TLSH T108A23B6549780283F6BBC570C7E4C927BD38F39677408AEB0591E5681DA37C2AB3192D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_4a2022008f4611f19d7e7ead4f05718a\ctlrpkg\mbuns.exe
- Size 2.7MB
- SHA256 0385b06957b7f5b2c3c7132f8ebd8414f64f00407ea2baf07acbffa8d6eca334
- MD5 b2416edb738fa965cc0d0405322a24c1
- SHA1 d09de4354bafc2026084c1d3a8f59514a1d430f3
- SHA512 a4409884cefb389bf12f2f8ab2f0b74539e1a1c8b63f885728f4424091886450facf4e18e137bc6e5cb1e92329957de57099ad04c0433e9a4bc086e5a1238a76
- SSDEEP 49152:yg9zAA9HY7oomwAeyfvE0Z3R0Tnxn1o2d5Hptj4LC:BdAA9HY1AeKtwnW2f
- TLSH T112D59E31B2D18020D5B39270297EA7EB5B79BC256F7640CF32D8B6390B725C0AD75B26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_4a2022008f4611f19d7e7ead4f05718a\ctlrpkg\srvversion.dat
- Size 9B
- SHA256 af0cac103fb816b5059d8775d63406a2f410a8ed70826978cddc6d88d8ddc668
- MD5 bcec912691aaf576c95bfe0265863b6c
- SHA1 1c9b9a02b6f3845a292b49332056df7e2ca2d539
- SHA512 d0556b3e89b42e12e26104ca3f1889714bee2a45fe74ebd8af7720398bd3a32d072f5ae91bfdf33406ff0027188705780c769350c4cda5176b15b3541d4fe412
- MD5 SHA1 SHA512
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_4a2022008f4611f19d7e7ead4f05718a\dbclspkg\MBAMCoreV5.dll
- Size 8.7MB
- SHA256 b226e4e93acba45a3e6c0ee06d6fa1c62fac91ae37c86595ab395088ab9edbc4
- MD5 1ab568867f09d24d997c993e185c4f08
- SHA1 bd97a322c4736f420c54c7ecec02e8bb1d764fa2
- SHA512 1c4d688a1897019428c8c7fa2dfc3368f6f7e3e1cfa55c915562a0630e70d5ad9ea2b36a4483f1b94118db32e5da85722a1524d52a5aa781933d583678e4f448
- SSDEEP 98304:9lZ2y5IWilAVOyU7mhNl/DP3RtFJe92YiGNwmdQk:9iy55ilAEj8Nl/DP3rFk9iGNwmdQk
- TLSH T192967B2BA7A400AFD87AD37889EB4502F672B811537397CF16A8A1761F637D09E3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_4a2022008f4611f19d7e7ead4f05718a\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\10.0.8\.version
- Size 50B
- SHA256 42559a4970a981aa61f3ed59ad44d05214fcc5eb97c35d06a88102a0b747a45f
- MD5 9072ad106b74f3900d25ae80843c8a24
- SHA1 b664a23dea5a5591c21fe0f4a9b5f344079d94d1
- SHA512 ea866258bbcccc0951f95367f3309db65d437ad27eb6fcbdfe12e08b9f76265050d6216091b89f0dc92db66b24f8238c8d6cc98ce49e6c3bb6b051ee037e56a2
- TLSH T1309004444445D47315D3313453015154F00C5D3C5D34CC11D05F707CC4D705CC55C301
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\LOGS\MBVpnTunnelService.log
- Size 4KB
- SHA256 addfa5ad72da2f2ec8197ce82c7ef287fb18cf4c2a6ea0b31a3bd876d473151e
- MD5 8f6e7b8d734552ad9588030a4c4eff3d
- SHA1 ac97b614e54901c61c53ca8bd9e675f259cdd701
- SHA512 2340292e38c47dd31255d5097c1207e65949b09a93d04317f577cc0c06571581606da3120492f7b712e23afb91b9f04592dc733605e52397647af653fea6e719
- SSDEEP 96:NE/9F4TiRHEBye9RHDZoyegSHmNuM36NuiJvNuieNui9Mui02epiI2eprLnpFcl4:NElF8fHtT
- TLSH T130A1A009A7D80115B2B7EB05FCF624A39B773C669534AE1D01950B0E0677C5AF8A1B3F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json
- Size 47KB
- SHA256 17dd55147abd332a15a21d1aba1e4b5e0b4ae25ed731ba156ced6fea918b7c0f
- MD5 73812f6b3daacbe681f343dfd51dc948
- SHA1 1b624d39e605e70f07411df6ad5ce07eec5dddde
- SHA512 595e67392e9832f1c9f5fd19e543cc1e4d2b5b48cbb0bfa59ac967642d356ecb12f28434391229e850b40778b6f5957877be6b88e218161d566269d5efe58248
- SSDEEP 384:nriPalGB5AWiWq2mhzJUVVqxKS3xV2CjNrBa7gHOykEaf:OUAHiWqn1UVVqx9U7gYEaf
- TLSH T13A2382BBD9DC0D0B99312294A9B94607FB20036F10980C17BDBEA98CCFB751394C6F1A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json
- Size 12KB
- SHA256 b3a5e4f96401b7f0ec0339ca01fc05b1c4650bc539fb6030029fa02059a82936
- MD5 7a84fe8fd300284a60032ae24982f18d
- SHA1 61256fbdf373a6be16f713366dcf99faa1cfd26d
- SHA512 743c127af3c16bf70ccb5b95d7dbb935f00bdad1a3c8587541ea4373052909f7c2e32974880cc24c08ebe006fad0060d703ea3e04a9d5ce03cfeae44c4ae927c
- SSDEEP 192:YDmf/FYgVMzhrgHTb0MAJUKfVgH8BZ8ZFBPs:emlYgVMzhrgHTb0MAJUKfVgH8BZ8ZFBE
- TLSH T1BE425522D1B5DEBB66FD617661B40B82F364C75F08414C07797CC88C4F7BD2A62C2AA9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json
- Size 12KB
- SHA256 ed93abc0b33d1a63f5f270b574e1deabb8da605637182c1ad7e516bc6d0be923
- MD5 33326691c21417cf7885ee52d037487a
- SHA1 170085f4bc11cedd5a6d6503f52410c26e35f04e
- SHA512 9b2e6fb05caeecf9295e2854098a5d9d47f945e3c1831be85a08996c4d88f516663769d601bc101584e0ce7a3901cba630b44d1d2707151a3006e039d3fad01a
- SSDEEP 192:mgEmY/FYgVMzhrgHTb0MAJUKfVgH8BZ8ZFvPD:+myYgVMzhrgHTb0MAJUKfVgH8BZ8ZFvr
- TLSH T121426626D1B5DEBB66FD623661B40B82F364C75F08414C07797CC48C4F7BD2A62C2AA9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\MwacControllerConfig.json
- Size 2KB
- SHA256 32535636e2ccf2ae834230fe575e1df0025ba9cc15ac0c2fb9c222932cb767b3
- MD5 612275365dc4b5fe546ded7e35010156
- SHA1 d40bc355e02064905c815fca85b5956404cf4302
- SHA512 67a292fd07cd30ced61b734c1a56ee71a32500c76e5055f9c6de410b8b3f44cce535b4d246f3c159b4f416372f9ea1d4e26e885a1c004895f2691426caf0e77f
- TLSH T1DA513A32D9686CBF09F85266ACA84252F651871F41580CA3FABCC57C5FB6C12210AF5F
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\PoliciesConfig.json
- Size 814B
- SHA256 41e6aba630335637651678c1772ec11c44f0d04d21e8a1c457e15e66b8361618
- MD5 d83c462faadfae1a0a3e4c905afefdf7
- SHA1 929f35eb849edcdfefb29534cf09f7dd44edf3f0
- SHA512 db201dd08964b1d3d01206209397ce8c642d230e10194d9fdbe5a14a543215506c96abd524311cc19c12898ca8b95b6c9340f0239941e0be69b986a26b3bfa22
- TLSH T18F012826984084FE293C416C4537D881F751871A34191C2FB7F9EA0DED73A3A2185D86
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json
- Size 5KB
- SHA256 96781753ee8f4f4165b3ac1513e6ec46798382f98a255d235a9d8d0994a1b3e8
- MD5 edb50c8c20774a0e94186fb0446967fe
- SHA1 163df1683cabb6dbcce37946a9840e4e70ac4bfd
- SHA512 9f04716a736e6db7d6e5c7b78f912abacf1438585436337e5b03f37225e1bd527d056fd2a84ef19092e99820329920023fca0eeb2052629f760ea33d740fc735
- SSDEEP 48:XT5JtUmVSfKuGQf92Es1kV8Ebmduw+8qXKeWQX92MEnAf3wsaA:DZOfK5k9JykfbYoXKBs9RsAf3wsaA
- TLSH T12DC16B16D9105CFE18B9E25EDC288186EB3083972202186FB5FD859C5FF76333686EE5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\SpConfigFile.json
- Size 12KB
- SHA256 bacd02fedb2af4029a42b9994547cb1a80ae1dfc95f280417fc6944d596af6bc
- MD5 43af47ee182b12ac0dfba49a033087a9
- SHA1 84ed1e7413daa46474e1d21a92840062ab4cb64d
- SHA512 826aeb708aea009bfe08f9aca06e2187221a712a3091f1d0d1a29e8b35331c1e686dfc301722009b339b0c55ecdeac9c253cc0395bbab30303e765a4fc334520
- SSDEEP 384:V8+xwb8fkY/sDY8t7SSdUCExUYS9oFfJ7MLPi5LnDjufzqoA+8xRj81offZJZtXJ:IXDK
- TLSH T10352161EE0A84867887726901F7A95A2E334526BC1435C6775FCB12CCFBB483C496F9E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json
- Size 1KB
- SHA256 66bf6a10e0d30cc28fef5d33c3f175593ad0ceff4edfe9348c343e2dcb3a342c
- MD5 3ba5adcb5ea302c307957a2dee8db303
- SHA1 0a9ff56187848869f62dcb8113b8ba236a5f1328
- SHA512 26464065cd35737e1476898df9733f5dcaa79527da10b0c1f0b0d68fd6a34bd552ea684ebb3041f7b82b02862247b829b8a8e59b9a327217e1f8c0981f028366
- TLSH T1103128528A2845FF28FDD144C9B88717E7A0531B61161C1FB6F8DA58DD7707233E1989
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json
- Size 1KB
- SHA256 9f0d9857ad67a6ab528e0aefdf3191ea9c7f321ca15a4869bd9e5fd20372434c
- MD5 f53ed5b23752c182f7381a81d3b3a642
- SHA1 1477517bb37c0d0e4030e9aa1fb59dc2a36fd794
- SHA512 58281c2534bb022a046eafb0eb35c1f4e5c34cbfdffa7d846b44ffc48c06b222e5b102563b433a1f5fb75bd9e18477e63eef3041c15bc1ae0032f3a9ce684374
- TLSH T1D83145228929C8BF25B5975DD9B88102E760438F26A08D2FB3FCD848DD739346487A4D
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\rmode\mbrescue.exe
- Size 7.7MB
- SHA256 477919ecb586d6ef4a06793417c2ae3126c51a51cf9445d901e90e3627e7143b
- MD5 ce8ca947e3162da157d1878d4cfec382
- SHA1 6f574aa206ba5e9d7469450780c4238cdd5112e8
- SHA512 4233bbde636d039ea3295e3b2066f56ea5a23e0431a5e675c967c60bbfa4f518f01eb90ac271da56a192671b925b3e14d3a25f1da4a8412983b4973565dff299
- SSDEEP 98304:akpowZa6gr/YzKrEAi9bESWCt+z3zweCeT007kxK:aFwZa62YW4AQbLWCtej1C9076K
- TLSH T1D586AE57A3E800E8D8B6D13CCA978503EBB2B85147719BDF06A4566A1F73AE05F3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
- Size 1.3MB
- SHA256 c268e9853bc491df0ce0cd419f15b25d7ec2c4c4fba6c7a5763f75ab30ab0af4
- MD5 08f81fd3644e2633755f4f6480f7abbc
- SHA1 8c866b270318b4bc898b96d603793674423bb2f1
- SHA512 219016a215bccec266a95527a366da29dc1ba9ba220e1cc914345ed477e1e94dc54f09fe20f1db59889f32612bfa620d990ef739683f2574f8f7510f9934d08f
- SSDEEP 12288:1Ajkvsy5BUbB46BuQeE84Tq0QGQudaRbiA2JJ8dW3fdE:1ACspB47EMfhCaRbxq6WPdE
- TLSH T183552940762BC75FC6A980326E32D1CCAB707D45EE056F0773C8873F9576568BAE2292
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
- Size 410KB
- SHA256 86903a3e700e24ba50fcb40ab8d836469db46698fdc2b21abccfe0a187d01ed8
- MD5 008317d2215fe3d8f31360c4ede702d7
- SHA1 38e398e85122e846121f63b6e1c3269c2c3ced8b
- SHA512 e44f3b04b0e36b6190c381d25b67d59fedac572ad6eb34af9d760da69efc4904b9d8139ef0d1a8140b0da2182d2191802ccd4163995a3320f5785368a0502b28
- SSDEEP 1536:2liMTEELOCSfRbSFY553TRJRbSYk4avLThHpRbS5/mXLP6mA9LfGw:uEEIbSFY5fbSvLvRbSn/
- TLSH T1AC94A711B771E35ECAB6C07B5430B29EEB7DB5119F025E443B884CB0D8B215EB6BA781
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.2MB
- SHA256 87e919dab6757e48115082842ae7ee257be3f0f15cf0b67fe3c6c35091e7fc29
- MD5 a598628d4cbcb6eef9537ab803691c44
- SHA1 a15bf996d390cdfc4a221420430b033821cfdf2a
- SHA512 81486ec29fed42f5dd88bfac839540e7bd61f945a69b1bad994234275464c2b79fb4a038c245ad0d38e34d96dff5f6737cf2018553b2037015e69d35ea3b8479
- SSDEEP 12288:JF70iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Xe/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T1E6552393568859B1FAFD0039857A8434B54D7E2C9F1598E3E2043A5EA238FDBCF38527
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 11813897f262af77bda94b1b9dff86e70c2e174bb90fcedba6eda0e87bc79fb3
- MD5 c3f39411bca1c2d990ac1362874bfe33
- SHA1 f4551953370fddb383b31bc1a300c9a48a747cc5
- SHA512 78406336694ffb9ced20b43f12524cc7e6cedb36daa4d47cedc6e09f595f851ef6b0e641081d36f210c102719634369123c172f52859717000c1412944182917
- SSDEEP 24576:0gb6bmBIi49WNNFpg1rSvFv7bYM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:0gb4mBIBhGF7LNiXicJFFRGNzj3
- TLSH T16465AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\CatRoot2\dberr.txt
- Size 64KB
- SHA256 8dd7997be982eb265d8cf97f385f31c70c46fd7ceb050c42ef5a13e39bd2710a
- MD5 62178f9203bccb2cf4b0bb5f1c25ac74
- SHA1 2702e707946163f3865d476df97efeec3a84d05e
- SHA512 f0c1761deb839915f02e4b2ecea74d273e3fece6884b9a39ed39ca0f0481918721ed18912c82ea60fd4d72377bbc37ab891d2a3445aeb00f4c34f9b08c013cb3
- SSDEEP 1536:Nu7Et/xoToXuvBKoZaL6TNX9FgwcwHC8SCs8o8WcMv1K0Rw7gN4Tkl1bvzwLM65D:L1L6
- TLSH T1D6534E0580DC8519C5B60BA272A7EE72C92E69CA770B1DE931ED7301D8C2B552F7A07F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DriverStore\FileRepository\mbtun.inf_amd64_add82795013a7c3b.ini
- Size 409B
- SHA256 e4db091524f8d71c74842376d74c7102aff4784da2d3369ef21f4abde79ac8a6
- MD5 9c22de16b64a78e9be7a3d2a8720da51
- SHA1 dc906ee4c862774c2c361328ad5ff97ab345efbc
- SHA512 f32ea020284747f10ed2be5480a427abf7eb4d15f45b41369bc0bdb6da21a891a6d21fcf14172e5499ebea40a019a704916517ff290888f4585f10ee0b412546
- TLSH T194E0ECC211AB19DAA407815FE1072C944724708E0C2233D9F601C0E5556AEC717EEF23
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.8MB
- SHA256 8dc144eb873326e370185813a08a464567586762b5056af39b10b5f5584a9f8d
- MD5 d375a37470d12cb272f542f7d16b75d4
- SHA1 d8c641f5338195ebdb105d7648e11e56c13846b6
- SHA512 8780380c37b41eca3c2e884ed0ad1ede771d8972e819e102471ef1ee91cc0654ee81de458330d63f8b6629a190d36fd609cf4ad04f03a65b8c45ad0a990d0ee6
- SSDEEP 24576:VG88u8FpJqH1vzria7/mr/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Y7ZFPqVya7/ULNiXicJFFRGNzj3
- TLSH T12485F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.5MB
- SHA256 2fc0c12f0f9d2e856d34aaaf604950fd1b065c2d5280697443ac87d61c7bc2e7
- MD5 31a6f96ac0bb145b468c9fe11ece2c3f
- SHA1 0606c0d310e70ae7dc7a4371acb1a8aa6c0ced0c
- SHA512 19a1bd3e32280ab4b77ea176c51299bc79993f582c12521724482aa05bfdb1c1f1c2a84f158aa030670f275d10a77dab18ed46ec30055d0ee5dad923c00d7511
- SSDEEP 24576:VPUr+NQn/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:VJQnLNiXicJFFRGNzj3
- TLSH T18C65F16F22DC18E5E67AA13D85828619F7717866071292CF02D0917E4F37EE8BD3DB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.6MB
- SHA256 18632ad12496769e85dcca7c50efe2da3b4410ecf9700712d4757480ff897733
- MD5 74cb035c0b9fcf582910c7621cc1c128
- SHA1 8ff6f616cd78ef6298938c5ba57046c0fe67bbcc
- SHA512 6ba2eb8708ee1ee823f08525f6a80530daf640c9bf3f03b688ee312f9141ec9a7ac2e6c673f326306fc53bad0acf52129820f9304ae880f082ed830298bb7c27
- SSDEEP 49152:8BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjXLNiXicJFFRGNzj3:fG05lO43by7wRGpj3
- TLSH T102D5C06E62EC11F5D1BBD07CDAC6460BEBB23815033556CB02A486A91F27FF49A7E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 bc92917f20a1c00dafbd975601c41b83f30a2693e3d9545771fe424635c997dc
- MD5 d0aba623014595c1d561ae993f3920eb
- SHA1 756b99717a07bc0e777e6e13e82da4e07a0fb6b4
- SHA512 8fff7d978970c854ab01d9668f98878ac03bcae8a48aa0a4b8edf02fe560d0e138cadd726a3af67a3b5b3cff692bdf60f142c7ca00fc2270714a0bca9c9ad7d1
- SSDEEP 24576:ufa5POZ3dpyWVM50JicR2hG0lasx2+47eidnN/TwSfVcYG3K/cJHlnFR+IGNe8jg:2a5POZ3lJt2pasx2+mPLNiXicJFFRGNf
- TLSH T15365BF5EA2FC01D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 0006fb49c62df25cbce17c05ae4c8f54a9809a5723f43aaa69c4d617561ef22a
- MD5 ba0354c412e814547112aa745dda3c6c
- SHA1 25c27113a5c5aed6871c0e1613f1611421ba9b9f
- SHA512 1752f929113be6a0591fe6c1f1dcd5aa77a35bfaed910e46cb1c3e55668e249d0e97ff2155d05d64f24b011fd994c6f49d40d79ccfd7f578710894c8ab84435c
- SSDEEP 24576:iNcwHdjbyQ4nLC18lb/EOjowL7FkD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:iNc/zEOVHF0LNiXicJFFRGNzj3
- TLSH T119858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\mb_8D3D.tmp
- Size 107KB
- SHA256 ad820dd54edb13e255d34eafacd71f278d6514e2f7e4c2970401f922a774ceb0
- MD5 2df8ff40bec48460845f851a54b76fe8
- SHA1 8e19f3d76c87d590cf1af839ddbe98af381d44e7
- SHA512 2177f5dfd6901f09ae2b8a0d6bea7b5fac3d00a721aa297ca6c35666cf2549d6c8d8655063a332224ccc8e0f00bdc84334636e9f1527862c850cc4ceb96d7d61
- SSDEEP 3072:dAZdoamZdgBjLpSXussssvYssssnC1c9RvZfy74hfp:dW542pSessssgssss7Nea
- TLSH T1B6B3F1F78379B8D9C513DA3B93874B110B28426B2C8A7E45A84DDB158D7E66181C3F8F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 14f52d486760027b82cdcc4f2bc27b463d1a72303a81fdf1d0a5325cd2e22b06
- MD5 e29f500b116340655d6dfa8127faba90
- SHA1 0ea2ca5d0598acd3f84dd7bfc4b1a6494967ef92
- SHA512 f915ad9c0a7c68e9f3ed98a67dc0496031cc92a57092e3eca06fdeb1f5ababb7432d884e5d6e1a555a0b879ea26cf3636c7520607daf24cfa24e46c58f15747f
- SSDEEP 24576:pzkNvNnaFeYhJNtmZBmB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:pzMwBtOmBLNiXicJFFRGNzj3
- TLSH T19A55AF6EA6E846E4D1FEC675CD238512F6727861073292CB9290C13F4E279D89E39F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\Sgrm\SgrmBroker.exe
- Size 1.6MB
- SHA256 eae2497d5eeed7f11ed6467fa6d7f783d76083d5b0566612673026405bc7a9be
- MD5 426dbd1bdf30d30553e8869fbd58a421
- SHA1 db169cd90723eea80019cec4a824dded404d3dab
- SHA512 8166990c010712186911ad93130152d7a57db78be1fe6aaeb83ce014d57f801690e3cf872561efe10f2b2938b253ebda4ef10d9554f3cb7efdc7a5763d393137
- SSDEEP 24576:9D3FHshBIYQgAC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:9DVHeBIAACLNiXicJFFRGNzj3
- TLSH T17E75E17EE69C04E4E57AC17CCA638906E77138AD032265DB029491BA5F2BFE46D3DF10
- MD5 SHA1 SHA512 SSDEEP TLSH