Analysis
- max time kernel
149s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/08/2026, 00:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-15_6f2cfc04db33c1aaad083d62ecfddabb_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
36 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-15_6f2cfc04db33c1aaad083d62ecfddabb_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
37 signatures
150 seconds
General
- Target 2026-08-15_6f2cfc04db33c1aaad083d62ecfddabb_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
- Size 3.3MB
- Sample260816-aramdaxsey
- SHA256 32852a5d46b2c8f7a1d4e1e6d8d5eb23ac33da50ecc1fb8ea28c4a2edb34793a
- MD5 6f2cfc04db33c1aaad083d62ecfddabb
- SHA1 3dac1f6cf2829bd271803b6f805dbe9e54b3e182
- SHA512 1a6d90d6fb0c6e23f6c8acf59cc28058d7b2c580ff6c553ae8757398bd36d7d7a627dccdc05bd82e70e497d71bb807ce7d5c7253975aaaeef1a40e79b092fa64
- SSDEEP 49152:mixAMxont7Lv7ywAeyfvE0Z3R0vnxn1o2d5PF0xufDmg27RnWGj:jGMxontvnAeKtEnW2XFbD527BWG
- TLSH T199F5AF31B2918120D5B3D270297EBBEB5B79BC256F76408F32D8B6390B725C09D74B26
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 4636 created 3036 4636 2026-08-15_6f2cfc04db33c1aaad083d62ecfddabb_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 81 - Detects executables built or packed with MPress PE compressor 1 IoCs
resource yara_rule behavioral2/files/0x000c00000001c63a-2115.dat INDICATOR_EXE_Packed_MPress - Detects executables packed with ConfuserEx Mod 1 IoCs
resource yara_rule behavioral2/files/0x000c00000001c63a-2115.dat INDICATOR_EXE_Packed_ConfuserEx - Detects executables packed with Goliath 1 IoCs
resource yara_rule behavioral2/files/0x000c00000001c63a-2115.dat INDICATOR_EXE_Packed_Goliath - Detects executables packed with Themida 1 IoCs
resource yara_rule behavioral2/files/0x000c00000001c63a-2115.dat INDICATOR_EXE_Packed_Themida - Downloads MZ/PE file 1 IoCs
flow pid Process 22 4636 2026-08-15_6f2cfc04db33c1aaad083d62ecfddabb_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe - Drops file in Drivers directory 6 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\drivers\mbamtestfile.dat 2026-08-15_6f2cfc04db33c1aaad083d62ecfddabb_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File created C:\Windows\SysWOW64\drivers\mbamtestfile.dat 2026-08-15_6f2cfc04db33c1aaad083d62ecfddabb_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File created C:\Windows\system32\drivers\mbae.sys MBAMInstallerService.exe File created C:\Windows\system32\DRIVERS\MbamElam.sys MBAMService.exe File created C:\Windows\system32\DRIVERS\mbamswissarmy.sys MBAMService.exe File created C:\Windows\system32\DRIVERS\MbamChameleon.sys MBAMService.exe - Modifies RDP port number used by Windows 1 TTPs
- Patched UPX-packed file 1 IoCs
Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
resource yara_rule behavioral2/files/0x000c00000001c63a-2115.dat patched_upx - Sets service image path in registry 3 TTPs 2 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MBAMSwissArmy\ImagePath = "\\SystemRoot\\System32\\Drivers\\mbamswissarmy.sys" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mbamchameleon\ImagePath = "\\SystemRoot\\System32\\Drivers\\MbamChameleon.sys" MBAMService.exe - Checks BIOS information in registry 2 TTPs 6 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion MBAMService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate MBAMService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion mbrescue.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate mbrescue.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 2026-08-15_6f2cfc04db33c1aaad083d62ecfddabb_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 2026-08-15_6f2cfc04db33c1aaad083d62ecfddabb_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 20 IoCs
pid Process 6120 elevation_service.exe 4140 elevation_service.exe 2156 maintenanceservice.exe 2152 OSE.EXE 800 PerceptionSimulationService.exe 5728 perfhost.exe 2600 ReFsDedupSvc.exe 3352 SensorDataService.exe 1640 ssh-agent.exe 5052 AgentService.exe 1748 SearchIndexer.exe 3752 MBAMInstallerService.exe 5980 MBVpnTunnelService.exe 2728 MBVpnTunnelService.exe 4748 MBAMService.exe 4404 MBAMService.exe 200 MbamElam.sys 4992 MbamChameleon.sys 596 mbamswissarmy.sys 5876 mbrescue.exe - Impair Defenses: Safe Mode Boot 1 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\MBAMService\ = "Service" MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\MBAMService MBAMInstallerService.exe - Loads dropped DLL 33 IoCs
pid Process 3752 MBAMInstallerService.exe 3752 MBAMInstallerService.exe 5980 MBVpnTunnelService.exe 2728 MBVpnTunnelService.exe 2728 MBVpnTunnelService.exe 4404 MBAMService.exe 4404 MBAMService.exe 4404 MBAMService.exe 4404 MBAMService.exe 4404 MBAMService.exe 4404 MBAMService.exe 4404 MBAMService.exe 4404 MBAMService.exe 4404 MBAMService.exe 4404 MBAMService.exe 4404 MBAMService.exe 4404 MBAMService.exe 4404 MBAMService.exe 4404 MBAMService.exe 4404 MBAMService.exe 4404 MBAMService.exe 4404 MBAMService.exe 4404 MBAMService.exe 4404 MBAMService.exe 4404 MBAMService.exe 4404 MBAMService.exe 4404 MBAMService.exe 4404 MBAMService.exe 4404 MBAMService.exe 4404 MBAMService.exe 4404 MBAMService.exe 3752 MBAMInstallerService.exe 3752 MBAMInstallerService.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: MBAMService.exe File opened (read-only) \??\M: MBAMService.exe File opened (read-only) \??\S: MBAMService.exe File opened (read-only) \??\V: MBAMInstallerService.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\T: MBAMService.exe File opened (read-only) \??\W: MBAMService.exe File opened (read-only) \??\W: MBAMInstallerService.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\K: MBAMService.exe File opened (read-only) \??\N: MBAMService.exe File opened (read-only) \??\Z: MBAMService.exe File opened (read-only) \??\X: MBAMInstallerService.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\U: MBAMService.exe File opened (read-only) \??\J: MBAMInstallerService.exe File opened (read-only) \??\K: MBAMInstallerService.exe File opened (read-only) \??\N: MBAMInstallerService.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\P: MBAMService.exe File opened (read-only) \??\I: MBAMInstallerService.exe File opened (read-only) \??\R: MBAMInstallerService.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\A: MBAMService.exe File opened (read-only) \??\J: MBAMService.exe File opened (read-only) \??\R: MBAMService.exe File opened (read-only) \??\X: MBAMService.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\B: MBAMService.exe File opened (read-only) \??\B: MBAMInstallerService.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\G: MBAMService.exe File opened (read-only) \??\L: MBAMService.exe File opened (read-only) \??\L: MBAMInstallerService.exe File opened (read-only) \??\U: MBAMInstallerService.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\O: MBAMService.exe File opened (read-only) \??\V: MBAMService.exe File opened (read-only) \??\Q: MBAMInstallerService.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\H: MBAMService.exe File opened (read-only) \??\D: MBAMInstallerService.exe - ConfuserEx .NET packer 1 IoCs
Detects ConfuserEx .NET packer.
resource yara_rule behavioral2/files/0x000c00000001c63a-2115.dat ConfuserEx - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\System32\DriverStore\FileRepository\mbtun.inf_amd64_add82795013a7c3b.ini DrvInst.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-08-15_6f2cfc04db33c1aaad083d62ecfddabb_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File created C:\Windows\System32\DriverStore\FileRepository\netvchannel.inf_amd64_4282c59d3148caa2\netvchannel.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netv1x64.inf_amd64_b0aef9976b305f93\netv1x64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netwsw00.inf_amd64_8bd5558c3d9b718a\netwsw00.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\mbtun.inf_amd64_add82795013a7c3b\mbtun.inf DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\kdnic_legacy.inf_amd64_052adde7f2101c60\kdnic_legacy.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netmyk64.inf_amd64_2f029cbaae1f9a8c\netmyk64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\c_net.inf_amd64_64490bb3b4dcbb9a\c_net.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\ykinx64.inf_amd64_5f83c04f4adb7630\ykinx64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netl160a.inf_amd64_24496b197c188680\netl160a.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netwtw04.inf_amd64_28271e5be9a9f6f4\netwtw04.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netl1c63x64.inf_amd64_20b3691d6e7445a9\netl1c63x64.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File created C:\Windows\System32\DriverStore\FileRepository\net1ic64.inf_amd64_93678a2d694d4579\net1ic64.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{73142409-306a-754a-9959-3d45a4693ba0}\mbtun.inf DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\netrtwlane01.inf_amd64_e88ba65a7546f702\netrtwlane01.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\bcmdhd64.inf_amd64_0c3c6ca9708e5a9a\bcmdhd64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\rtcx21x64.inf_amd64_feec7a9662e785f0\rtcx21x64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netg664.inf_amd64_f4299f18c1844724\netg664.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{73142409-306a-754a-9959-3d45a4693ba0}\SETCFF6.tmp DrvInst.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-08-15_6f2cfc04db33c1aaad083d62ecfddabb_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-08-15_6f2cfc04db33c1aaad083d62ecfddabb_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File created C:\Windows\System32\DriverStore\FileRepository\netax88179_178a.inf_amd64_be76888d30e8464a\netax88179_178a.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-08-15_6f2cfc04db33c1aaad083d62ecfddabb_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File created C:\Windows\System32\DriverStore\FileRepository\netwew01.inf_amd64_a78e41f934de228a\netwew01.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\wnetvsc.inf_amd64_3ea8686d80de3706\wnetvsc.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netvwwanmp.inf_amd64_21a7e1c8368216a0\netvwwanmp.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07A7CCFBD28A674D95D3BF853C9007C6 MBAMService.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-08-15_6f2cfc04db33c1aaad083d62ecfddabb_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File created C:\Windows\System32\DriverStore\FileRepository\nete1g3e.inf_amd64_1bcc7029f170b19a\nete1g3e.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\net44amd.inf_amd64_6af2734d06d3e49f\net44amd.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netrtwlans.inf_amd64_e0770fc2820687e2\netrtwlans.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07A7CCFBD28A674D95D3BF853C9007C6 MBAMService.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-08-15_6f2cfc04db33c1aaad083d62ecfddabb_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File created C:\Windows\System32\DriverStore\FileRepository\netnvm64.inf_amd64_3dc2e896fdc07ff7\netnvm64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netwlv64.inf_amd64_786cb697586229e5\netwlv64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\msux64w10.inf_amd64_f329abee714f5000\msux64w10.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\net8192se64.inf_amd64_3d81196084e3f594\net8192se64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netvwifimp.inf_amd64_16c785b9ba77e7b0\netvwifimp.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{73142409-306a-754a-9959-3d45a4693ba0} DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\net2ic68.inf_amd64_7af2e2aa52ab9b71\net2ic68.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netwtw02.inf_amd64_669639d5a41714fa\netwtw02.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\rtux64w10.inf_amd64_382d70e2c349183c\rtux64w10.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netrtwlane.inf_amd64_9f581aa49737d7bf\netrtwlane.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\86844F70250DD8EF225D6B4178798C21_44AD5D0C299F1D4EE038B125B5E5863A MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94D97B1EC1F43DD6ED4FE7AB95E144BC_38A1221025A0DFB52F454FF8C79E14CC MBAMService.exe File created C:\Windows\System32\DriverStore\FileRepository\nete1e3e.inf_amd64_71ee3a27d9580084\nete1e3e.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netxex64.inf_amd64_01587744078125a1\netxex64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netjme.inf_amd64_7d2f6f04d092b277\netjme.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe 2026-08-15_6f2cfc04db33c1aaad083d62ecfddabb_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-08-15_6f2cfc04db33c1aaad083d62ecfddabb_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File created C:\Windows\System32\DriverStore\FileRepository\net7800-x64-n650f.inf_amd64_bfc44179ca196669\net7800-x64-n650f.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netwns64.inf_amd64_d630255fa92e6727\netwns64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netavpna.inf_amd64_27530893ea84631e\netavpna.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netmlx4eth63.inf_amd64_59e293fc00a669f4\netmlx4eth63.PNF MBVpnTunnelService.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\System.Windows.Forms.Design.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\ru\UIAutomationProvider.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\System.Printing.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\System.Windows.Forms.Design.Editors.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\Microsoft.Extensions.Primitives.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\Prism.dll MBAMInstallerService.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-08-15_6f2cfc04db33c1aaad083d62ecfddabb_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaw.exe elevation_service.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.Linq.AsyncEnumerable.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.Threading.Overlapped.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\pl\ReachFramework.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\System.IO.Packaging.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\zh-Hans\UIAutomationProvider.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\MbamUI.Tray.dll MBAMInstallerService.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe elevation_service.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\mscorrc.dll MBAMInstallerService.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 2026-08-15_6f2cfc04db33c1aaad083d62ecfddabb_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.Xml.ReaderWriter.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\fr\UIAutomationTypes.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\pt-BR\ReachFramework.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\ru\System.Windows.Forms.Primitives.resources.dll MBAMInstallerService.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-08-15_6f2cfc04db33c1aaad083d62ecfddabb_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe elevation_service.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\fr\ReachFramework.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\it\PresentationCore.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\it\WindowsBase.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\ko\System.Windows.Controls.Ribbon.resources.dll MBAMInstallerService.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe elevation_service.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\tr\System.Xaml.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\MbamBgNativeMsg.exe MBAMInstallerService.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-08-15_6f2cfc04db33c1aaad083d62ecfddabb_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe elevation_service.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\WindowsBase.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.UI.Theme.Dark.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll MBAMInstallerService.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-08-15_6f2cfc04db33c1aaad083d62ecfddabb_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\PresentationFramework-SystemData.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\Microsoft.Extensions.Caching.Memory.dll MBAMInstallerService.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe elevation_service.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.Linq.Queryable.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\de\System.Xaml.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\malwarebytes_assistant.dll MBAMInstallerService.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-08-15_6f2cfc04db33c1aaad083d62ecfddabb_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-08-15_6f2cfc04db33c1aaad083d62ecfddabb_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\ja\UIAutomationClientSideProviders.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\System.Diagnostics.EventLog.Messages.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\mbamelam.sys MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\MbamPt.exe MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\MbamUI.Services.deps.json MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.dll MBAMInstallerService.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 2026-08-15_6f2cfc04db33c1aaad083d62ecfddabb_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe elevation_service.exe File created C:\Program Files\Malwarebytes\Anti-Malware\LicenseControllerImpl.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\Microsoft.Data.Sqlite.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\rtp.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\de\PresentationUI.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\tr\System.Windows.Input.Manipulations.resources.dll MBAMInstallerService.exe - Drops file in Windows directory 7 IoCs
description ioc Process File opened for modification C:\Windows\inf\oem1.inf DrvInst.exe File created C:\Windows\inf\oem1.inf DrvInst.exe File created C:\Windows\ELAMBKUP\MbamElam.sys MBAMService.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-08-15_6f2cfc04db33c1aaad083d62ecfddabb_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe File opened for modification C:\Windows\INF\setupapi.dev.log MBVpnTunnelService.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 1 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh MBVpnTunnelService.exe - Modifies trusted root certificate store through registry 1 TTPs 13 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa22000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8DA7F965EC5EFC37910F1C6E59FDC1CC6A6EDE16\Blob = 0300000001000000140000008da7f965ec5efc37910f1c6e59fdc1cc6a6ede162000000001000000450300003082034130820229a0030201020213066c9fcf99bf8c0a39e2f0788a43e696365bca300d06092a864886f70d01010b05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412031301e170d3135303532363030303030305a170d3338303131373030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f74204341203130820122300d06092a864886f70d01010105000382010f003082010a0282010100b2788071ca78d5e371af478050747d6ed8d78876f49968f7582160f97484012fac022d86d3a0437a4eb2a4d036ba01be8ddb48c80717364cf4ee8823c73eeb37f5b519f84968b0ded7b976381d619ea4fe8236a5e54a56e445e1f9fdb416fa74da9c9b35392ffab02050066c7ad080b2a6f9afec47198f503807dca2873958f8bad5a9f948673096ee94785e6f89a351c0308666a14566ba54eba3c391f948dcffd1e8302d7d2d747035d78824f79ec4596ebb738717f2324628b843fab71daacab4f29f240e2d4bf7715c5e69ffea9502cb388aae50386fdbfb2d621bc5c71e54e177e067c80f9c8723d63f40207f2080c4804c3e3b24268e04ae6c9ac8aa0d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604148418cc8534ecbc0c94942e08599cc7b2104e0a08300d06092a864886f70d01010b0500038201010098f2375a4190a11ac57651282036230eaee628bbaaf894ae48a4307f1bfc248d4bb4c8a197f6b6f17a70c85393cc0828e39825cf23a4f9de21d37c8509ad4e9a753ac20b6a897876444718656c8d418e3b7f9acbf4b5a750d7052c37e8034bade961a0026ef5f2f0c5b2ed5bb7dcfa945c779e13a57f52ad95f2f8933bde8b5c5bca5a525b60af14f74befa3fb9f40956d3154fc42d3c7461f23add90f48709ad9757871d1724334756e5759c2025c266029cf2319168e8843a5d4e4cb08fb231143e843297262a1a95d5e08d490aeb8d8ce14c2d055f286f6c49343776661c0b9e841d7977860036e4a72aea5d17dba109e866c1b8ab95933f8ebc490bef1b9 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0D44DD8C3C8C1A1A58756481E90F2E2AFFB3D26E\Blob = 0300000001000000140000000d44dd8c3c8c1a1a58756481e90f2e2affb3d26e2000000001000000ba010000308201b63082015ba0030201020213066c9fd5749736663f3b0b9ad9e89e7603f24a300a06082a8648ce3d0403023039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412033301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f7420434120333059301306072a8648ce3d020106082a8648ce3d030107034200042997a7c6417fc00d9be8011b56c6f252a5ba2db212e8d22ed7fac9c5d8aa6d1f73813b3b986b397c33a5c54e868e8017686245577d44581db337e56708eb66dea3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414abb6dbd7069e37ac3086079170c79cc419b178c0300a06082a8648ce3d0403020349003046022100e08592a317b78df92b06a593ac1a98686172fae1a1d0fb1c7860a64399c5b8c40221009c02eff1949cb396f9ebc62af8b62cfe3a901416d78c6324481cdf307dd5683b MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F6108407D6F8BB67980CC2E244C2EBAE1CEF63BE\Blob = 030000000100000014000000f6108407d6f8bb67980cc2e244c2ebae1cef63be2000000001000000f6010000308201f230820178a0030201020213066c9fd7c1bb104c2943e5717b7b2cc81ac10e300a06082a8648ce3d0403033039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412034301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f7420434120343076301006072a8648ce3d020106052b8104002203620004d2ab8a374fa3530dfec18a7b4ba87b464b63b062f62d1bdb087121d200e863bd9a27fbf0396e5dea3da5c981aaa35b2098455d16dbfde8106de39ce0e3bd5f8462f3706433a0cb242f70ba88a12aa075f881ae6206c481db396e29b01efa2e5ca3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414d3ecc73a656ecce1da769a56fb9cf3866d57e581300a06082a8648ce3d040303036800306502303a8b21f1bd7e11add0ef58962fd6eb9d7e908d2bcf6655c32ce328a9700a470ef0375912ff2d9994284e2a4f354d335a023100ea75004e3bc43a941291c958469d211372a7889c8ae44c4adb96d4ac8b6b6b49125333add7e4be24fcb50a76d4a5bc10 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\1C58A3A8518E8759BF075B76B750D4F2DF264FCD\Blob = 0300000001000000140000001c58a3a8518e8759bf075b76b750d4f2df264fcd2000000001000000c2040000308204be308203a6a003020102021006d8d904d5584346f68a2fa754227ec4300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3231303431343030303030305a170d3331303431333233353935395a304f310b300906035504061302555331153013060355040a130c446967694365727420496e633129302706035504031320446967694365727420544c53205253412053484132353620323032302043413130820122300d06092a864886f70d01010105000382010f003082010a0282010100c14bb3654770bcdd4f58dbec9cedc366e51f311354ad4a66461f2c0aec6407e52edcdcb90a20eddfe3c4d09e9aa97a1d8288e51156db1e9f58c251e72c340d2ed292e156cbf1795fb3bb87ca25037b9a52416610604f571349f0e8376783dfe7d34b674c2251a6df0e9910ed57517426e27dc7ca622e131b7f238825536fc13458008b84fff8bea75849227b96ada2889b15bca07cdfe951a8d5b0ed37e236b4824b62b5499aecc767d6e33ef5e3d6125e44f1bf71427d58840380b18101faf9ca32bbb48e278727c52b74d4a8d697dec364f9cace53a256bc78178e490329aefb494fa415b9cef25c19576d6b79a72ba2272013b5d03d40d321300793ea99f50203010001a38201823082017e30120603551d130101ff040830060101ff020100301d0603551d0e04160414b76ba2eaa8aa848c79eab4da0f98b2c59576b9f4301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030106082b06010505070302307606082b06010505070101046a3068302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304006082b060105050730028634687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274476c6f62616c526f6f7443412e63727430420603551d1f043b30393037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274476c6f62616c526f6f7443412e63726c303d0603551d2004363034300b06096086480186fd6c02013007060567810c01013008060667810c0102013008060667810c0102023008060667810c010203300d06092a864886f70d01010b050003820101008032ce5e0bdd6e5a0d0aafe1d684cbc08efa8570edda5db30cf72b7540fe850afaf33178b7704b1a8958ba80bdf36b1de97ecf0bba589c59d490d3fd6cfdd0986db771825bcf6d0b5a09d07bdec443d82aa4de9e41265fbb8f99cbddaee1a86f9f87fe74b71f1b20abb14fc6f5675d5d9b3ce9ff69f7616cd6d9f3fd36c6ab038876d24b2e7586e3fcd8557d26c21177df3e02b67cf3ab7b7a86366fb8f7d89371cf86df7330fa7babed2a59c842843b11171a52f3c90e147da25b7267ba71ed574766c5b8024a65345e8bd02a3c209c51994ce7529ef76b112b0d927e1de88aeb36164387ea2a63bf753febdec403bb0a3cf730efebaf4cfc8b3610733ef3a4 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E\Blob = 030000000100000014000000b51c067cee2b0c3df855ab2d92f4fe39d4e70f0e2000000001000000e1030000308203dd308202c5a003020102020100300d06092a864886f70d01010b050030818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a30818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bdedc103fcf68ffc02b16f5b9f48d99d79e2a2b703615618c347b6d7ca3d352e8943f7a1699bde8a1afd13209cb44977322956fdb9ec8cdd22fa72dc276197eef65a84ec6e19b9892cdc845bd574fb6b5fc589a51052894655f4b8751ce67fe454ae4bf85572570219f8177159eb1e280774c59d48be6cb4f4a4b0f364377992c0ec465e7fe16d534c62afcd1f0b63bb3a9dfbfc7900986174cf26824063f3b2726a190d99cad40e75cc37fb8b89c159f1627f5fb35f6530f8a7b74d765a1e765e34c0e89656998ab3f07fa4cdbddc32317c91cfe05f11f86baa495cd19994d1a2e3635b0976b55662e14b741d96d426d4080459d0980e0ee6defcc3ec1f90f10203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147c0c321fa7d9307fc47d68a362a8a1ceab075b27300d06092a864886f70d01010b050003820101001159fa254f036f94993b9a1f828539d47605945ee128936d625d09c2a0a8d4b07538f1346a9de49f8a862651e62cd1c62d6e95204a9201ecb88a677b31e2672e8c9503262e439d4a31f60eb50cbbb7e2377f22ba00a30e7b52fb6bbb3bc4d379514ecd90f4670719c83c467a0d017dc558e76de68530179a24c410e004f7e0f27fd4aa0aff421d37ed94e5645912207738d3323e3881759673fa688fb1cbce1fc5ecfa9c7ecf7eb1f1072db6fcbfcaa4bfd097054abcea18280290bd5478092171d3d17d1dd916b0a9613dd00a0022fcc77bcb0964450b3b4081f77d7c32f598ca588e7d2aee90597364f936745e25a1f566052e7f3915a92afb508b8e8569f4 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\5A8CEF45D7A69859767A8C8B4496B578CF474B1A\Blob = 0300000001000000140000005a8cef45d7a69859767a8c8b4496b578cf474b1a2000000001000000450500003082054130820329a0030201020213066c9fd29635869f0a0fe58678f85b26bb8a37300d06092a864886f70d01010c05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412032301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f74204341203230820222300d06092a864886f70d01010105000382020f003082020a0282020100ad969f2d9c4a4c4a81795199ec8acb6b605113bc4d6d06fcb0088ddd19106ac7260c35d8c06f2084e994b19b8503c35bdb4ae8c8f89076d95b4fe34ce806364dcc9aac3d0c902b92d4061960ac374479858182ad5a37e00dcc9da64c5276ea439db704d150f655e0d5d2a64985e937e9ca7eae5c954d489a3fae205a6d8895d934b8521a4390b0bf6c05b9b678b7ead0e43a3c125362ff4af27bbe3505a91234e3f36474622c3d00495a28fe3244bb87dd652702713bda4af71fdacdf72155904f0fecae82e19f6bd945d3bbf05f87ed3c2c3986da3fdeec7255eb79a3addbdd7cb0ba1ccefcde4f3576cf0ff8781f6a36514627615be99ecff0a2557d7c258a6f2fb4c5cf842e2bfd0d51106cfb5f1bbc1b7ec5ae3b98013192ff0b57f49ab2b957e9abef0d76d1f0eef4ce86a7e06ee9b469a1df69f633c6692e97139ea587b057108137c953b3bb7ff692d19cd018f4926eda834fa663994ca5fb5eef21647a205f6c648515cb37e9620c0b2a16dc012e32da3e4bf59e3af6174094ef9e910886fabe63a85a33eccb744395f96c695236c7296ffc55035c1ffb9fbd47ebe74947950b4e89220949e0f5611ef1bf2e8a726e8059ff573af97532a34e5feced2862d94d73f2cc811760edcdebdcdba7cac57e02bdf2540854fdb42d092c17544a98d154e1516708d2ed6e7e6f3fd22d81592966cb903995111e7427feddebaf0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414b00cf04c30f405580248fd33e552af4b84e36652300d06092a864886f70d01010c05000382020100aaa8808f0e78a3e0a2d4cde6f5987a3bea0003b0970e93bc5aa8f62c8c7287a9b1fc7f73fd637178a58759cf30e10d10b2135a6d82f56ae6809fa0050b68e4476bc76adfb6fd773272e518fa09f4a0932c5dd28c75857665900c0379b7312363ad788309866884cafff9cf269a9279e7cd4bc5e761a717cbf3a91293936ba7e82f5392c46058b0cc0251185b858d625963b6adb4de9afb26f70027c05d55377499c9507fe3592e44e32c25eeec4c3277b49f1ae94b5d20c5dafd1c8716c643e8d4bb269a45705ea90b3753e2467b27fde046f289b7cc42b6cb28266ed9a5c93ac8411360f7508c15aeb26d1a151a5778e6922ad96590823f6c02afae123a27963604d71da28063a99bf1e5bab47c14b04ec9b11f745f38f651ea9bfa2ca211d4a92d271a45b1afb24e710dc05846d66906cb53cbb3fe6b41cd417e7d4c0f7c72797a59cd5e4a0eac9ba99873797cb4f4ccb9b8070cb2745cb8c76f88a190a7f4aaf9bf673af41a15621eb79fbe3db129af67a112f25810195303301bb81a89f69cbd97038ea309f31d8b21f1b4dfe41cd19f650206ea5cd613b384efa2a55c8c7729a768c06bae40d2a8b4eacdf08d4b389c199a1b2854b88990efca75813e1ef26424c718af4eff479e07f63565a4d30a56fff517646cefa822254993b6df0017da587e5deec51bb0d1d15f2110c7f9f3ba020a2707c5f1d6c7d3e0fb09606c MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\2AD974A775F73CBDBBD8F5AC3A49255FA8FB1F8C\Blob = 0300000001000000140000002ad974a775f73cbdbbd8f5ac3a49255fa8fb1f8c2000000001000000620400003082045e30820346a0030201020213077312380b9d6688a33b1ed9bf9ccda68e0e0f300d06092a864886f70d01010b05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412031301e170d3232303832333232323132385a170d3330303832333232323132385a303c310b3009060355040613025553310f300d060355040a1306416d617a6f6e311c301a06035504031313416d617a6f6e205253412032303438204d303130820122300d06092a864886f70d01010105000382010f003082010a0282010100eb712ca9cb1f8828923230af8a570f78b73725955587ac675c97d322c8daa214676b7cf067dae2032ab356125dc6b547f96708a7937a9592180fb4f9f910369a7f2f80b64fba134ec75d531ee0dd96330720d396bc12e4745042a1051373b54f9b4424fe2d7fedbc2285ec362133977506ce271882dce3d9c582078d5e26012626671fd93f13cf32ba6bad7864fcaaff0e023c07df9c0578728cfdea75b7032884dae86e078cd05085ef8154b2716eec6d62ef8f94c35ee9c4a4d091c02e249198caeeba258ed4f671b6fb5b6b38064837478d86dcf2ea06fb76377d9eff424e4d588293cfe271c278b17aab4b5b94378881e4d9af24aef872c565fb4bb451e70203010001a382015a3082015630120603551d130101ff040830060101ff020100300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030106082b06010505070302301d0603551d0e0416041481b80e638a891218e5fa3b3b50959fe6e5901385301f0603551d230418301680148418cc8534ecbc0c94942e08599cc7b2104e0a08307b06082b06010505070101046f306d302f06082b060105050730018623687474703a2f2f6f6373702e726f6f746361312e616d617a6f6e74727573742e636f6d303a06082b06010505073002862e687474703a2f2f6372742e726f6f746361312e616d617a6f6e74727573742e636f6d2f726f6f746361312e636572303f0603551d1f043830363034a032a030862e687474703a2f2f63726c2e726f6f746361312e616d617a6f6e74727573742e636f6d2f726f6f746361312e63726c30130603551d20040c300a3008060667810c010201300d06092a864886f70d01010b05000382010100ad00de0205232e063262b46bb19416e41140de2bfa59c135efe0aa8f2b41b9d1f38739001df23db5a7470c0606c691f3075702d4edbd17c1909abf4875a2074f30dd4a6a42b50d3d15c00ffe845bc63c99cc5752b1d86e12d59692934b94e507e88982086a7a34d49e64e13d876a92909a63a14bf88fb6ea34d305be20c2de06e28c9f738b9f4d3985cace19369d85c99ec9f8503fb67e88a1efca84068b50b40a5ca61c44f1fdc8614060f26125aa07f4c7c27375e40c0b428d04e55f4448995b7b898196a7889d4b0d62e804c4d7feb4e8b26dcaecc01cbc385b1ddf85ce5b7ae3494b6cb9a7ddf405b249ade1c5146bc2ccebcd7fd65869bac3207e7fb0b8 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 6b00000001000000200000005367f20c7ade0e2bca790915056d086b720c33c1fa2a2661acf787e3292e1270140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a2030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa20f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e1900000001000000100000009f687581f7ef744ecfc12b9cee6238f12000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 MBAMService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 5c0000000100000004000000001000001900000001000000100000009f687581f7ef744ecfc12b9cee6238f10f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa2140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a26b00000001000000200000005367f20c7ade0e2bca790915056d086b720c33c1fa2a2661acf787e3292e12702000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 MBAMService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54362000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde MBAMInstallerService.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-15_6f2cfc04db33c1aaad083d62ecfddabb_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 52 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe - Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MBAMService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MBAMService.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION MBAMInstallerService.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Malwarebytes.exe = "11000" MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION MBAMService.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\mbam.exe = "11000" MBAMService.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\mbamtray.exe = "11000" MBAMService.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services" SearchProtocolHost.exe Key created \REGISTRY\USER\S-1-5-20\Software MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003dac4928162ddd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000eec61be9152ddd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor" SearchProtocolHost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000705e64e7152ddd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software MBAMInstallerService.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ad3959e7152ddd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:\ MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ce387eea152ddd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: MBAMInstallerService.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:\ MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0\Common\Security MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\16.0\Common MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\16.0\Common MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs MBAMInstallerService.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:\ MBAMInstallerService.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2 SearchProtocolHost.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCB473CB-B8B5-44A7-A3E0-D83AF05350DF}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6CE18DD5-2BD7-4844-B9AD-DF6A995750A1}\TypeLib\ = "{2446F405-83F0-460F-B837-F04540BB330C}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BB344FF5-ACAE-4B90-AD24-DEFD41159C56}\ = "IVPNControllerV4" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MB.VPNController\ = "VPNController Class" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6C1047E9-9ADC-4F8A-8594-036375F53103}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6696D5DD-4143-482C-ABF4-3B215CF3DBFC} MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A2C9E279-3E50-44F0-8C3B-606A303BA1D1} MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{ADCD8BEB-8924-4876-AE14-2438FF14FA17}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E36A44EC-B16B-41DE-AD94-A59E117F67FF}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{ED06E075-D1FD-4635-BA17-2F6D6BB0DFD6}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{937B7931-D964-4CDB-92D0-2233CCC10295}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1097B101-1FF8-4DD8-A6C1-6C39FB2EA5D6}\TypeLib\ = "{5709DEEB-F05E-4D5C-8DC4-3B0D924EE08F}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C0CEAFA7-4F65-418C-8A61-92B2048115EE}\ = "ICloudControllerV3" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8FF168C7-A609-4237-A076-E461334BF4EA}\TypeLib\ = "{49F6AC60-2104-42C6-8F71-B3916D5AA732}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2846D47E-9B85-4836-B883-6A7B493E2D6A}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AECF19A2-3EEE-40D9-910A-4B3448AEB407}\ = "IUpdateControllerV16" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B243B0B7-0567-4DA5-B8E4-A4CE22A4F2B6}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AFF1A83B-6C83-4342-8E68-1648DE06CB65}\1.0 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FA1D4FDD-C9C8-4575-A2A1-4179C3A3473D}\TypeLib\Version = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{ECDAC35E-72BB-4856-97E1-226BA47C62C5}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D0C724C7-E25C-4505-A300-4677A3DCA32D}\TypeLib\ = "{332AFEBA-9341-4CEC-8EA6-DB155A99DF63}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C5201562-332D-4385-87E7-2BB41B1694AA}\ = "_ILicenseControllerEvents" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B59F38D8-23CF-4D7F-BAE8-939738B3001B}\TypeLib\ = "{2446F405-83F0-460F-B837-F04540BB330C}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0070F531-5D6B-4302-ACA0-6920E95D9A31}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{08057A16-2479-49CE-BA58-1EA1FF95D95D}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{97DA9E74-558F-4085-AE41-6A82ED12D02C}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C85F3EB8-B099-4598-89C3-E33BAC2CE53D}\ = "IScanControllerEventsV2" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8153C0A7-AC17-452A-9388-358F782478D4}\TypeLib\Version = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9704115C-F54E-4D64-8554-0CAF8BF33B1B}\ProxyStubClsid32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5A7F7475-8272-40DE-A4FA-A98C38BDB458}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8CB653AC-F9CF-4277-BFB1-C0ED1C650F56}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{08927360-710B-483B-BEEC-17E51FF84AF9} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{77AD284A-4686-413D-AA76-BDFC1DF52A19}\ = "ISPControllerV3" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{172ABF99-1426-47CA-895B-092E23728E8A}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{09FAE0FE-2897-496A-9FD2-39C86556F1D2}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{76AD4430-9C5C-4FC2-A15F-4E16ACD735AC}\TypeLib\Version = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E03FDF96-969E-4700-844D-7F754F1657EF}\ProxyStubClsid32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D2D1C2BC-3427-478E-A903-ADFBCF5711CD} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DB82CDC6-F12A-4156-8DBF-EC7465B9C0B9}\TypeLib\ = "{59DBD1B8-A7BD-4322-998F-41B0D2516FA0}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0070F531-5D6B-4302-ACA0-6920E95D9A31}\ = "_IPoliciesControllerEventsV3" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E2870643-0645-41F9-BCCB-F5969386162C}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8B05F69B-4F9B-4FD3-A491-16153F999E00}\ProxyStubClsid32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MB.VPNController\CurVer MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9DB48A12-9CF4-429F-BDC3-93AB42B7C966}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{72F290D5-789C-4D8A-9EBE-63ECEA150373}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B9442AA1-AEB8-4FB4-B998-BFBC37BA8A99} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3C871BA6-4662-4E17-ABF4-3B2276FC0FF4}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{71B13605-3569-4F4A-B971-08FF179A3A60}\ = "_IScannerEvents" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A0101B90-FD0B-40CF-90E4-33650F09A80F}\ = "ICleanControllerV3" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{767D2042-D2F6-4BAA-B30E-00E0CD4015BD}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{83D0C30B-ECF4-40C5-80EC-21BB47F898A9} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EC676D1E-2E9E-4876-834C-7AF2BCA2E885}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F1C46F8-E697-4175-B240-CDE682A4BA2D}\VersionIndependentProgID\ = "MB.MWACController" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{130CD414-6BFD-4F6C-9362-A2264B222E76}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{014D0CF7-ACC9-4004-B999-7BDBAAD274B7}\TypeLib\ = "{49F6AC60-2104-42C6-8F71-B3916D5AA732}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0F2D6C4F-0B95-4A53-BA9D-55526737DC34}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{55E4B8FB-921C-4751-8B2D-AE33BD7D0B74}\ = "_IMWACControllerEventsV6" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79D77750-02E0-4451-A7BB-524ACD93DD93}\ProxyStubClsid32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A0EB1521-C843-47D5-88D2-5449A2F5F40B}\ProxyStubClsid32 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1EB774AC-23B7-4F52-A9F2-708D194F0C86}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MB.LicenseController MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DE03E614-112D-43E0-8E15-E7236CC32108}\AppID = "{1F7896AD-8886-42CD-8ABD-7A1315A3A5F2}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{ADA09B8D-A536-4429-8331-49808442D24B}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EABA01A8-8468-430A-9D6E-4C9F1CE22C88}\TypeLib MBAMService.exe - Modifies system certificate store 2 TTPs 12 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\5A8CEF45D7A69859767A8C8B4496B578CF474B1A MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\2AD974A775F73CBDBBD8F5AC3A49255FA8FB1F8C MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8DA7F965EC5EFC37910F1C6E59FDC1CC6A6EDE16 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0D44DD8C3C8C1A1A58756481E90F2E2AFFB3D26E MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F6108407D6F8BB67980CC2E244C2EBAE1CEF63BE MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\1C58A3A8518E8759BF075B76B750D4F2DF264FCD MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2 MBAMService.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4636 2026-08-15_6f2cfc04db33c1aaad083d62ecfddabb_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 4636 2026-08-15_6f2cfc04db33c1aaad083d62ecfddabb_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 4636 2026-08-15_6f2cfc04db33c1aaad083d62ecfddabb_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 4636 2026-08-15_6f2cfc04db33c1aaad083d62ecfddabb_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 4636 2026-08-15_6f2cfc04db33c1aaad083d62ecfddabb_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 4636 2026-08-15_6f2cfc04db33c1aaad083d62ecfddabb_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 4636 2026-08-15_6f2cfc04db33c1aaad083d62ecfddabb_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 4636 2026-08-15_6f2cfc04db33c1aaad083d62ecfddabb_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 4636 2026-08-15_6f2cfc04db33c1aaad083d62ecfddabb_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 4636 2026-08-15_6f2cfc04db33c1aaad083d62ecfddabb_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 4636 2026-08-15_6f2cfc04db33c1aaad083d62ecfddabb_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 4636 2026-08-15_6f2cfc04db33c1aaad083d62ecfddabb_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 4636 2026-08-15_6f2cfc04db33c1aaad083d62ecfddabb_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 4636 2026-08-15_6f2cfc04db33c1aaad083d62ecfddabb_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 4636 2026-08-15_6f2cfc04db33c1aaad083d62ecfddabb_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 4636 2026-08-15_6f2cfc04db33c1aaad083d62ecfddabb_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 4636 2026-08-15_6f2cfc04db33c1aaad083d62ecfddabb_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 4636 2026-08-15_6f2cfc04db33c1aaad083d62ecfddabb_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 4636 2026-08-15_6f2cfc04db33c1aaad083d62ecfddabb_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 4636 2026-08-15_6f2cfc04db33c1aaad083d62ecfddabb_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 4636 2026-08-15_6f2cfc04db33c1aaad083d62ecfddabb_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 4636 2026-08-15_6f2cfc04db33c1aaad083d62ecfddabb_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 4636 2026-08-15_6f2cfc04db33c1aaad083d62ecfddabb_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 4636 2026-08-15_6f2cfc04db33c1aaad083d62ecfddabb_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 4636 2026-08-15_6f2cfc04db33c1aaad083d62ecfddabb_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 4636 2026-08-15_6f2cfc04db33c1aaad083d62ecfddabb_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 4636 2026-08-15_6f2cfc04db33c1aaad083d62ecfddabb_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 4636 2026-08-15_6f2cfc04db33c1aaad083d62ecfddabb_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 4636 2026-08-15_6f2cfc04db33c1aaad083d62ecfddabb_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 4636 2026-08-15_6f2cfc04db33c1aaad083d62ecfddabb_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 6120 elevation_service.exe 6120 elevation_service.exe 6120 elevation_service.exe 6120 elevation_service.exe 6120 elevation_service.exe 6120 elevation_service.exe 6120 elevation_service.exe 3752 MBAMInstallerService.exe 3752 MBAMInstallerService.exe 3752 MBAMInstallerService.exe 3752 MBAMInstallerService.exe 3752 MBAMInstallerService.exe 3752 MBAMInstallerService.exe 3752 MBAMInstallerService.exe 3752 MBAMInstallerService.exe 3752 MBAMInstallerService.exe 3752 MBAMInstallerService.exe 3752 MBAMInstallerService.exe 3752 MBAMInstallerService.exe 3752 MBAMInstallerService.exe 3752 MBAMInstallerService.exe 3752 MBAMInstallerService.exe 3752 MBAMInstallerService.exe 3752 MBAMInstallerService.exe 3752 MBAMInstallerService.exe 3752 MBAMInstallerService.exe 3752 MBAMInstallerService.exe 3752 MBAMInstallerService.exe 3752 MBAMInstallerService.exe 3752 MBAMInstallerService.exe 3752 MBAMInstallerService.exe 3752 MBAMInstallerService.exe 3752 MBAMInstallerService.exe 3752 MBAMInstallerService.exe - Suspicious behavior: LoadsDriver 4 IoCs
pid Process 820 Process not Found 820 Process not Found 820 Process not Found 820 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4636 2026-08-15_6f2cfc04db33c1aaad083d62ecfddabb_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe Token: SeBackupPrivilege 2600 ReFsDedupSvc.exe Token: SeRestorePrivilege 2600 ReFsDedupSvc.exe Token: SeBackupPrivilege 2600 ReFsDedupSvc.exe Token: SeRestorePrivilege 2600 ReFsDedupSvc.exe Token: SeBackupPrivilege 2600 ReFsDedupSvc.exe Token: SeRestorePrivilege 2600 ReFsDedupSvc.exe Token: SeBackupPrivilege 2600 ReFsDedupSvc.exe Token: SeRestorePrivilege 2600 ReFsDedupSvc.exe Token: SeBackupPrivilege 2600 ReFsDedupSvc.exe Token: SeRestorePrivilege 2600 ReFsDedupSvc.exe Token: SeAssignPrimaryTokenPrivilege 5052 AgentService.exe Token: 33 1748 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 1748 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1748 SearchIndexer.exe Token: SeDebugPrivilege 4636 2026-08-15_6f2cfc04db33c1aaad083d62ecfddabb_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe Token: SeDebugPrivilege 4636 2026-08-15_6f2cfc04db33c1aaad083d62ecfddabb_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe Token: SeDebugPrivilege 4636 2026-08-15_6f2cfc04db33c1aaad083d62ecfddabb_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe Token: SeDebugPrivilege 4636 2026-08-15_6f2cfc04db33c1aaad083d62ecfddabb_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe Token: SeIncreaseQuotaPrivilege 4636 2026-08-15_6f2cfc04db33c1aaad083d62ecfddabb_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe Token: SeDebugPrivilege 6120 elevation_service.exe Token: SeDebugPrivilege 3752 MBAMInstallerService.exe Token: SeDebugPrivilege 3752 MBAMInstallerService.exe Token: SeDebugPrivilege 3752 MBAMInstallerService.exe Token: SeDebugPrivilege 3752 MBAMInstallerService.exe Token: SeDebugPrivilege 3752 MBAMInstallerService.exe Token: SeDebugPrivilege 3752 MBAMInstallerService.exe Token: SeDebugPrivilege 3752 MBAMInstallerService.exe Token: SeDebugPrivilege 3752 MBAMInstallerService.exe Token: SeDebugPrivilege 3752 MBAMInstallerService.exe Token: SeDebugPrivilege 3752 MBAMInstallerService.exe Token: SeDebugPrivilege 3752 MBAMInstallerService.exe Token: SeDebugPrivilege 3752 MBAMInstallerService.exe Token: SeDebugPrivilege 3752 MBAMInstallerService.exe Token: SeDebugPrivilege 3752 MBAMInstallerService.exe Token: SeDebugPrivilege 3752 MBAMInstallerService.exe Token: SeDebugPrivilege 3752 MBAMInstallerService.exe Token: SeDebugPrivilege 3752 MBAMInstallerService.exe Token: SeDebugPrivilege 3752 MBAMInstallerService.exe Token: SeDebugPrivilege 3752 MBAMInstallerService.exe Token: SeDebugPrivilege 3752 MBAMInstallerService.exe Token: SeDebugPrivilege 3752 MBAMInstallerService.exe Token: SeDebugPrivilege 3752 MBAMInstallerService.exe Token: SeDebugPrivilege 3752 MBAMInstallerService.exe Token: SeDebugPrivilege 3752 MBAMInstallerService.exe Token: SeDebugPrivilege 3752 MBAMInstallerService.exe Token: SeDebugPrivilege 3752 MBAMInstallerService.exe Token: SeDebugPrivilege 3752 MBAMInstallerService.exe Token: SeDebugPrivilege 3752 MBAMInstallerService.exe Token: SeDebugPrivilege 3752 MBAMInstallerService.exe Token: SeDebugPrivilege 3752 MBAMInstallerService.exe Token: SeDebugPrivilege 3752 MBAMInstallerService.exe Token: SeDebugPrivilege 3752 MBAMInstallerService.exe Token: SeDebugPrivilege 3752 MBAMInstallerService.exe Token: SeDebugPrivilege 3752 MBAMInstallerService.exe Token: SeDebugPrivilege 3752 MBAMInstallerService.exe Token: SeDebugPrivilege 3752 MBAMInstallerService.exe Token: SeDebugPrivilege 3752 MBAMInstallerService.exe Token: SeDebugPrivilege 3752 MBAMInstallerService.exe Token: SeDebugPrivilege 3752 MBAMInstallerService.exe Token: SeDebugPrivilege 3752 MBAMInstallerService.exe Token: SeDebugPrivilege 3752 MBAMInstallerService.exe Token: SeDebugPrivilege 3752 MBAMInstallerService.exe Token: SeDebugPrivilege 3752 MBAMInstallerService.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4636 2026-08-15_6f2cfc04db33c1aaad083d62ecfddabb_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1748 wrote to memory of 4380 1748 SearchIndexer.exe 101 PID 1748 wrote to memory of 4532 1748 SearchIndexer.exe 102 PID 1748 wrote to memory of 6100 1748 SearchIndexer.exe 103 PID 1748 wrote to memory of 6056 1748 SearchIndexer.exe 104 PID 3752 wrote to memory of 5980 3752 MBAMInstallerService.exe 108 PID 3752 wrote to memory of 4748 3752 MBAMInstallerService.exe 113 PID 4404 wrote to memory of 5876 4404 MBAMService.exe 125
Processes
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS1⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\2026-08-15_6f2cfc04db33c1aaad083d62ecfddabb_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-15_6f2cfc04db33c1aaad083d62ecfddabb_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Downloads MZ/PE file
- Drops file in Drivers directory
- Checks BIOS information in registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4636
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6120
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:4140
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:2156
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:2152
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:800
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5728
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2600
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3352
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:1640
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5052
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:4380
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:4532
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3064 3060 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:6100
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3020 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵
- Modifies data under HKEY_USERS
PID:6056
-
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- Modifies trusted root certificate store through registry
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3752 -
C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe" /installmbtun2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
PID:5980
-
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe" /Service /Protected2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
PID:4748
-
-
C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Event Triggered Execution: Netsh Helper DLL
PID:2728
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "9" "C:\Program Files\Malwarebytes\Anti-Malware\mbtun\mbtun.inf" "9" "4ba9030c7" "0000000000000180" "Service-0x0-3e7$\Default" "000000000000017C" "208" "C:\Program Files\Malwarebytes\Anti-Malware\mbtun"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:4088
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Modifies trusted root certificate store through registry
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\ProgramData\Malwarebytes\MBAMService\rmode\mbrescue.exe"C:\ProgramData\Malwarebytes\MBAMService\rmode\mbrescue.exe" /rescuemode "C:\Program Files\Malwarebytes\Anti-Malware" "C:\ProgramData\Malwarebytes\MBAMService"2⤵
- Checks BIOS information in registry
- Executes dropped EXE
PID:5876
-
-
C:\Windows\system32\DRIVERS\MbamElam.sysC:\Windows\system32\DRIVERS\MbamElam.sys1⤵
- Executes dropped EXE
PID:200
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k AppReadiness -p -s AppReadiness1⤵PID:4236
-
C:\Windows\system32\DRIVERS\MbamChameleon.sysC:\Windows\system32\DRIVERS\MbamChameleon.sys1⤵
- Executes dropped EXE
PID:4992
-
C:\Windows\system32\DRIVERS\mbamswissarmy.sysC:\Windows\system32\DRIVERS\mbamswissarmy.sys1⤵
- Executes dropped EXE
PID:596
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
2Component Object Model Hijacking
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
2Component Object Model Hijacking
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
1Safe Mode Boot
1Modify Registry
3Subvert Trust Controls
2Install Root Certificate
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 f4f34430cffc651c763dd944981c8b3801f49d0926b367575f1d1e15b1829c2e
- MD5 79c41cea96d9258ef6a22fd167603caa
- SHA1 60c4920f60195bac62a1d786b2f179991813f78d
- SHA512 a4f25c4b8e5dbb20d2c9bf5a76029e0a90bf7cc9a91b4f391bc0c7dbb7694fc8c5b751478c4cf0f533e00cc2c53b8b63e99f41bbcbe1cc16c6e89e70f30587de
- SSDEEP 49152:Vb+632BuPkFKRrdE6ohrstBhuXjfS4LWxn4Dmg27RnWGj:r3q60jBzD527BWG
- TLSH T193D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.4MB
- SHA256 a3e0a167bb9e7cab5c09cbf3326389ccba6138786632a05d88ea94f44616c5a4
- MD5 3370ece7df7d210e55c82315c203107f
- SHA1 a16b2ee2e360b65bd8d720a1973adf1f1de92c91
- SHA512 5a42c45a8740033c59fc8e7c1c6a3146286f32dbf7f590ecc3e901b4ae6b276b242df83c0e023ca039263cddb66dca62c3d985549a97762783330720d999bc14
- SSDEEP 24576:QXYfDtczALsqjnhMgeiCl7G0nehbGZpbD:ntcuDmg27RnWGj
- TLSH T19765F129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.7MB
- SHA256 2a3b49e44abbc5b42f08222b191f06ad4e76445a72454ad8af8bb375b32c3b8a
- MD5 0f782013c47daf524ad3e16c2728e79b
- SHA1 6da6beff53541cc63ac450910a5d8dec7e304ebb
- SHA512 eb726fdfef9aa6fd605da2896ea26ea9123a366f53d66a41a22265900153533458e5b35a8ac026109e52829a4c45c59a2778900e9824337d2d73c34447be9822
- SSDEEP 24576:R0Le5ji0hmxNrMUsqjnhMgeiCl7G0nehbGZpbD:RPji0A7ZDmg27RnWGj
- TLSH T144859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 650c1cfcecc11f5ea5f667f044780ffc1bf15c0d576ad834d74fafcc8d4d5d5b
- MD5 6837c19e7c072bde992627fb7fe68953
- SHA1 3b2cfdf5d92903a217835fee8a4c74919b622b5f
- SHA512 5272c5b60ecb545108668a4d256acebd21814c17330bca2259c93642f828733f40993be12f7ba03b81ecae8d2d75eabefcbbab95efa86aa8f37843217c83962f
- SSDEEP 24576:Wa7/ezSC6vUyD/aqgrvWr6q8wyuKsqjnhMgeiCl7G0nehbGZpbD:h/ezSC6vUzPviHjyVDmg27RnWGj
- TLSH T19E755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 fa5b098b32d6478582bfa984c57f1e181c176721b0d61bb8f44735cefa03a290
- MD5 5f3a7cc44b7659859ddefa72b1cf5a0b
- SHA1 92043dda27a2ce19bae36b69e2221870303d431b
- SHA512 29e459dc9dfb786177c4de0d82031314f6eee436ce11d2fca683b07aac6a779592425785daff567d248d4ea9dd3ed35ddf8fb9a7e7862bfbd4f7dd702fbf5846
- SSDEEP 24576:WVbqPb88hv/l+b/sqjnhMgeiCl7G0nehbGZpbD:WVO88hXl+nDmg27RnWGj
- TLSH T18D559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.2MB
- SHA256 e626c03c103e8f3a5f4533404b6670247e35e5b12ee95234114de6c55a310c0a
- MD5 8c28c2faa599e37562aaa38372c3fb1c
- SHA1 f22f472ddc236bda3a4b4d457738bcb167758ddd
- SHA512 33ff0b749ead813317fdce705d779fdfe6b60c6f7d070ba670827f7043efc1eb9168319d8b9ef17bbecb652d3d95cea030b6a61e07eedd1547590dd65622130c
- SSDEEP 12288:8jYXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:8jYsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1FA4523BF964C50CAEA7608B5C3E9F11D6C137E56982008536A637CFDE6B5458CB39023
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.4MB
- SHA256 284d9f154250108a634976bdd5d022a6178857d9414759f578e2627e74b112ec
- MD5 ebc462437a5f208cbd8f270af31fc53e
- SHA1 b11eb35e7aacacfe56e3e954d2c3f48392abd060
- SHA512 b8c431b3f19255082a44fa7050e0f373e36404740a36f38209353bf7b16dcee5a9a3076b67f22b00845dadb2e86d27ad0500376160a3d129610a3ac2ebd3451c
- SSDEEP 12288:feBNUbTVO86UHXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:fJIUHsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1D565CF7BEE28FCD2C27A8DB85791C600E76278314F61A3CBD165824EDE235E44E79C25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 d62d4f41f6e47de0b3482eeef722663c71c4febb6a5bd82f04f9fab41fec4df2
- MD5 7c602fd5a9d13df6f32709c0df2cbd90
- SHA1 5954384461015c527cce1dd21a96371938c1b786
- SHA512 15f17b688e464c7d2cb1d7b0294b50ff895772acd4b42c05c226d1175e9658d3a4d5e970dc601fb952e916b36837eff2451a063c7a4b002fb1e8bb678b2c2763
- SSDEEP 49152:ZQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THK:ZQvGAdlCEL8c/RRNw5COD527BWG
- TLSH T130266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.5MB
- SHA256 6e90a549aa4bd4c112944b2061d97a59240a868810e41fe9e0f6f057b601aa4d
- MD5 08034f2c22bdf69ad71e7bacff381cf6
- SHA1 2042ac4530b3f8cbcded86650c129bbf61a3dcde
- SHA512 12c5f9dac906f34eac310af2685fd82dccde24b00b1cdc883f45e9da70d72dabd759629ed747e6217b9f74a9d82267302b5f832bb85129b5d195cc9d328e60d4
- SSDEEP 12288:gAwSfxL/2Dc3DDLLmt0LDQewsAjVXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:1SewsAjVsqjnhMgeiCl7G0nehbGZpbD
- TLSH T11575E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 8975525335a4b7b82b266f0c19103aec3f74c4143cb6757ee86b0868a9154b47
- MD5 53c50510fd05420524ba2836af916d49
- SHA1 9b1257296a98d4b0b79b464238d85e2caa86e4f7
- SHA512 4bf77e519327857b9d14eb8def5ec210472d9f3d1c9b8f0ed1563b4bac0527a1bcf3369a46fc9ae5a2ce813dd434923bc87ea455673c77a64803c01190ce62f0
- SSDEEP 196608:9UEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHxVQBWG:9UEtQevvqc2W1cpV2RI328B
- TLSH T10F474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 17f056e280ffba0ded28fda6131a855e3a01be54088c45f83cf88414d4e7b5eb
- MD5 eb1b958f3820577ebd98871bd17616c6
- SHA1 95c8089b3d66bffec1c9cbad875638e1dad108b5
- SHA512 d2c08bd081d04119ff22dcf6dbe278228526419b85c3eca672d7484b978a51da8bda14072c591a86b7880a15be238c7fa0a976bfa88fbb5db002024e26a68fad
- SSDEEP 49152:3CbRquA/m2yL5zLfFiV+XenmE3/zpDmg27RnWGj:goq2VjnmaD527BWG
- TLSH T11ED58D1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 1349cb1e0409764463e54e2063d71aac9ce9707c98c7d47ffdc04d1381e6ee2f
- MD5 3ad0ccde0619ba30eec04f4bf5d3ba08
- SHA1 0e94f0a5211c46161079689f8374f917b1e69e39
- SHA512 8e053529d4d9af72fc30c9ba952e84b8777fe0efd542c37ce1bfd6e7ffa2a957b76297c3da00b68bc1ccf116f0342d15bca6a46079da5818c9e60b03e0ef557d
- SSDEEP 24576:eAhGL2IFoiwtA5l7S532sqjnhMgeiCl7G0nehbGZpbD:eAM1Foiq5KDmg27RnWGj
- TLSH T194359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.4MB
- SHA256 60045b82ccd7772495c16a40542a96467260b28178bbd5aa7f675f08546ab65b
- MD5 012ddf031b7f444a65c7b722494982b9
- SHA1 b58b1a9f99df6c5da2092dc5e8ef289092b4d52a
- SHA512 b6a7a3eaf4bc6aa5f757bc7935437c4e73b139bbd0fafe4f97508ee5ca1056bc19f74e0c90993fd6a17cecaafb4865ae7ded0ff308989724050db8bef9839c89
- SSDEEP 12288:umw5HEjsChNSBFgl0WDm+CqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:nwuXOWhsqjnhMgeiCl7G0nehbGZpbD
- TLSH T16165F15A76A80CF9E9674139C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.3MB
- SHA256 d50c59fafc5bbe100de6c9749fb0d87a25939e3821362a372fed8b7be4497271
- MD5 0e08fb570631245bd4a26240e1e15dae
- SHA1 b13664cbeab1f17dea02f601c7e2332b214fb676
- SHA512 d95857884a84ea574619c2bab588502ea182654bd6466fafddcf95e0a5c75c2f13f89e3d246ef202530ecc682c1c674a616a223df402af35999275b34da8e536
- SSDEEP 12288:z/Z1IyFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:bZu8sqjnhMgeiCl7G0nehbGZpbD
- TLSH T1AB5512AA239820FAE1A3417CC5E5D609E7337C62673043CF166659AA6F739C44E39733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 f5ef77a5b250a6ccb6e10429a0a337406b219a8aa0a579c67a6e2aa67630f190
- MD5 b077c3e65049d3efd31e7296b3357cf8
- SHA1 1ad0d58d4bf390ff58e37b31c8fdfe2df6defa83
- SHA512 e79a1dce7499f6be95042f5dc2349ed5941e34ad9b08d561270e4dbc1e4511d5498effa48f14d341d5c7fa583a16d5917d1d7b77d083c5b0743f4b3780c4e579
- SSDEEP 98304:dQRQyi36YOcPhLvw2gAf+PN3XD527BWG:UQyiKahX+PNnVQBWG
- TLSH T149667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 2e0b347a4578ef72215c12eafb8ae8ce9009893f279bba7a47c43c17411a55af
- MD5 8e8729e1fdd3ec4e514788f88ef0dac5
- SHA1 b261a7751685ec8023c44539472427a64d668ccc
- SHA512 df866cc106e379a70a778f81c50fea56486c7b2d00782503ea73dad376d77e28255ee39a8531258e25ec4230e64e0176a12699f949942a6ae8e2acc2ffb672f0
- SSDEEP 98304:3QRQyi36YOcPhLvw2gAf+PN3XD527BWG:mQyiKahX+PNnVQBWG
- TLSH T1D8667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 a880fe49ddf4d36f4ace0ffc28e469d3481c547c46f429348f014c6d46a827b1
- MD5 ff1be5b24af8c8c1fff5d4cab2bc8ad1
- SHA1 ad1dd87877f5e493c8d8f3d407e79ffa8f019ab0
- SHA512 cf47bac734405238eb180ad3bd7335fcb63dda25934d058c7b899cebf7e5fb90054e8693c18a205a4a7770a3d4e6645ddf18692b791b1abdc2ff562c63fe0899
- SSDEEP 24576:iwvLof6SRQ+rn/fDboqxN1nnh6D7DaHGTNHu7PNU3/5W/ohL0MsqjnhMgeiCl7Ge:c68Qg55nhceWu7PNU3/ZDmg27RnWGj
- TLSH T1ECB55933B2F60099C44DE1769F4A872196D27C758FE0E3DB8511721A1BB2AD07B3A71B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 d0f08825aa98fb99c5117fe3011e9e3a94007b4e80c9301e0d356890383b44dc
- MD5 da205ac70cd32f0e718a6eeeb42160f0
- SHA1 5af80729da6d954a115ee730d754144f7abd5eb1
- SHA512 ffb8c8f98cb7d3245ad61c64dbbde16d05805f0d61fe9e69f4dfba3ee75d77834fcd24c87761faf6a7ad9bfbd898857bec0c93a33e94b51c8976145987abea13
- SSDEEP 98304:dy5112gYy5azzVva69nLKnhZED527BWG:ALIHjWhCVQBWG
- TLSH T1F4167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 921320a1124fd100e63c51aa03c3148e70f808e0964c9e54e718c743f803935d
- MD5 44e13d8bbfd3ee1ebbee2cdd93b22084
- SHA1 314a53da5d0d8d885401f11aca46d5b17a6b4015
- SHA512 8835548a86bda169e7beef9d115d4dd5ffc464c6f880d6bb33ce7762e7662ed3a4ed78919692acdb4504820abee2e88f8784d2b5c9f260223e0d34e6a01e0d1a
- SSDEEP 49152:RB+taZ3usBWOBr4tEG20bqx0z+n217aau1glPDmg27RnWGj:Hu6JmUxd2dPD527BWG
- TLSH T1BCD59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 3d7725893fecf30b9890e6d3866d4c1bf8ff9c565794050cd405ea944125de72
- MD5 4ffcac187d3bad9096ab2678246fe19a
- SHA1 c390c6dc95239495818025d4c03d8ccef8928cfe
- SHA512 13bd1ac1da822d7dd0eec7624aa011de04c62fac2d343500b4d00a7c53064c7447784a688957f7852c5e9c2decee179d17bf6923d0abe7fb1b27ad3bc3feb63d
- SSDEEP 49152:/1hpsNoJpF1A6BU44CwH7R4x7Dmg27RnWGj:/mifPkRaD527BWG
- TLSH T14DB5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 fd943e78d8d78d68c8dbdf45c26558510db548b33eb2ada6f4acdb8a6aafb7a8
- MD5 cbd6fdeb4f172f27aede98055470c719
- SHA1 4d3a72697a9bca9ee557a2b7a7737ac5371aba56
- SHA512 c62296c88723b7510d463b9d5464b7bd1b191ffb3b896176ee1749380a372dcbd141d703fbd79ebcee11c73b57063483c199d986422ce02643ef174e75725701
- SSDEEP 49152:QSuZQIY0Be2KNRVtOnks6NMHqoDmg27RnWGj:K5dKvi61oD527BWG
- TLSH T1BCC5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 743a746158d72cf3806d085bb53665d16e85aa5e32703713b80e23d39ba33a73
- MD5 723c5367ddf8507ce83b16865e9c3795
- SHA1 f3956fc0cf4bfbf43c882dbd55b82841e16bab42
- SHA512 72d67f433255c9bd3105025ca71e7c13abd40b58e676119fff050451a00ab9e5b28632b4473bc15718f218e0ceed403b7c1830a5b4e7c5a7e05c9aaaddd2ad1d
- SSDEEP 49152:ShtSn8EApI0figXgiDn0AP5w/Dmg27RnWGj:TX2iyph2D527BWG
- TLSH T19A95BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.2MB
- SHA256 1702292c9639e64fd5d7303919d6449d84630fe9dea3a2c8cf0bf3c80073dbe1
- MD5 0e352507a9b6c457690e36cb381e9b1a
- SHA1 3621b6dc9bb8cdca26a63bea351854eef96a03e2
- SHA512 b6acd572acd5b5b56cb20c6f12a75b8860eeb18ddb6408555d5e0fe263b082d76d851e2d57e67ef1f0a11c47fccf5d54365135eb0155b3a05a419810d805cecf
- SSDEEP 12288:rgXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:rgsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1E54523BE964C41CAE52644F5C3E5F14DAC073E5BE9200493BA9B7CBAF7B24584B38427
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.2MB
- SHA256 e7173973edec0656ee1a99117a000195787989e2c7f17238f10830e0d9cf5d48
- MD5 b8fcd31be31ee01e08a0a294a8c95123
- SHA1 ee49eff5720d84016b6e4764b9a6875af24f9da4
- SHA512 69b6d3098aa89aa9251f98d2f17f80becdb58d42a6e4eae248119a057ceddd6e482bdd34b809d371ebfca8b8190d2ebb6a5aee6e108de9c3f2a13467d563726d
- SSDEEP 12288:tZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:tZsqjnhMgeiCl7G0nehbGZpbD
- TLSH T14D4523BE964C41CBE52644B5C3E5F14DAC073E6BE9200493BA9B7CBAF7B14584B38427
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.2MB
- SHA256 c4dcefba33f6277268bcce29afd8b925f75ac4533787da87b0389c3978fbc625
- MD5 60e09f32c8fd274abe742a66140c55cc
- SHA1 7f8357d85e0fde87ca0d12b6b0400f1b9c38a456
- SHA512 61362c3a5ffbc955d992858a9c26d16b4ed46389af4baa3629faadf9e8adedfb16e9d7ed669113766dda491b21dbb9dd4d52d5c7c328971467a7c7464483a8f8
- SSDEEP 12288:0PXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:0PsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1724523BE964C41CAE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B24584B38467
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.2MB
- SHA256 3ef65d4e5ac8cf31a93ee2af77188ff1e43b22cb30601ed82193ed433066e6f5
- MD5 edded06773db5d04f0bda3c60415428a
- SHA1 410517fc6c5dc47c07b23ba4bd2a7973edaab018
- SHA512 1fa8ab2e6281841fefa33562a161eb600b4914949c7160d93892f18f1a7f3291948523e0cd1e261cdcb46e5eab023ea8204f101c186c96cfd1b9887cee518241
- SSDEEP 12288:BVWXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:6sqjnhMgeiCl7G0nehbGZpbD
- TLSH T11745237E675C00CAD87285B4C2F5E10DE8277D56EA3005DB6B532CEE9FB16944F38A22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.2MB
- SHA256 fb560e798a8d0c2937deea9603162c254ca777f54a75ce054340349375da257e
- MD5 876348c911dcb93f4f2c22490221739e
- SHA1 5008c4a6cedbbc23a4bb2d1aa53c607ccbc25f4b
- SHA512 a46a46ba5a14bb91bd6967d69b4db125ba3ed1b7fb8c554e51eb34bf5c5686bfcf3ca39ebcc7f5d3dfd9d3c51ba4cff796c41534abbe44c28c94414b0a94809c
- SSDEEP 12288:DOXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:DOsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1484523BE964C41CAE52644F5C3E5F14DAC073E6BE9200483BA9B7CBDF7B24584B38466
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.2MB
- SHA256 8af81bacf489a524a0e353d8f4be5bf0221dccd485e67312fea229080aad38a9
- MD5 40058e408d5bf2564bda0635f5ed09e0
- SHA1 2fe912ad7e4063b362f381ab16262fad3b9b0cd1
- SHA512 4f596922494630b40c0eab72d106a2dc39c9ec3695ab4bd61ce254c7b6df6d57d4b4a1ab074525d96904265f03f5f0b8dc33fcf0c8e88bcb397f932f3e33666c
- SSDEEP 12288:u9Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:u9sqjnhMgeiCl7G0nehbGZpbD
- TLSH T1594523BE964C41CBE52644B5C3E5F14DAC073E6BE9200493BA9B7CBAF7B14584B38427
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.2MB
- SHA256 80845316936ad82e3411366f3ecddb3598d2d04c0105b7940cc6d7398e3addd4
- MD5 d717ab835fafc46ec4da0597b0b2ebcd
- SHA1 985fd1c02b46bf3cc62126fb61b0cf5c0b11ab6c
- SHA512 e74d658fa9f22dbd6098cdf78016c3cf945cfafd10cc7f61ede0b1ef0a72fe65a0fb06958dee53e4f7f1b10e85341b3b2aac3855396ac7806d4c0856160c2e68
- SSDEEP 12288:PxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:PxsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1AA4523BE964C41CAE52644F5C3E5F14DAC073E6BE9200493BA9B7CBAF7B14584B38427
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 1.4MB
- SHA256 fea6ecb1e279370c5e21641ef76376c8124a1d53eeb8ef0845c4dc2108255f88
- MD5 4c30e3470b0a55654f6d4b94519abb75
- SHA1 0fc530f2eac3020d19724971505db81c3b74b6b5
- SHA512 46163dbbb4b835119e3bc108d7a56c9c03e2a05fa0ca3181383ebf15006560a2959b76d6c2f5c508368be49344cbe95e3463c926ec7d3fad6e18bbd07334aa6a
- SSDEEP 24576:KZMMzFVSO5sqjnhMgeiCl7G0nehbGZpbD:KZMMzfRDmg27RnWGj
- TLSH T1B86501A9B39418F8EC63813EC965D90AD5B27C5A0B70C61F13A4366B5F733A00D3DB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 1.2MB
- SHA256 f71e8326cabe5bc9ae3631f401e727c26503b899261699cda0c4f12564ab31f3
- MD5 1422e8af1a5611da37748a654be9c9d1
- SHA1 2710857079efb01e6d4764c0a92b8866f215af32
- SHA512 ceac8e55676a8243ec92ee53c339183ef2c7e04d84d108e4f7646bb17384cb423420f31fc76157522c301b7084899de0e5119c91c77314c10b65e47372686ad5
- SSDEEP 12288:IsXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:IssqjnhMgeiCl7G0nehbGZpbD
- TLSH T1D34523BE964C51CAE52604B5C3E9F14DAC073E6BE9200483BA9B7CBDF7B14584B38427
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 1.2MB
- SHA256 d8f4495fd11fa9ced1b9683d3380c95ba5cb053e4036936e1c133b35bf23d8fd
- MD5 938177a421865a08c49450eb48c47aab
- SHA1 fd607c2bdaaf885ebb1514a4770eeb51763c5d83
- SHA512 81fc2ea4970f9273e28391d9daf46f36bafb2dae2757085604f72202df643b5a535795a400ec4305f0c9cbdc684c902de031487248ff337d5e5dae3431581e75
- SSDEEP 12288:8IXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:8IsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1D14523BE964C41CAE52644B5C3E5F14DAC073E6BE9200493BA9B7CBAF7B14584B38427
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 1.3MB
- SHA256 1fa754f0d74fa2465e0ed18b363f418ede344d9d6044d159a2064f29c2472621
- MD5 7dce789aa893b7316ee74ddfdb6bdc45
- SHA1 a8808ee2bacb2a77bd43ca3df52c37a06a63dc25
- SHA512 58c745a85419df9e2fda620bf0bb616a55b17515a207bce778d7fa7339b2f043c0297e29124c2a48bcd7e62d5a2d378c86965bf4efc2543d679ed971cdfe8454
- SSDEEP 12288:DyPz5L8FXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:uzyFsqjnhMgeiCl7G0nehbGZpbD
- TLSH T14755125B73A530F9D1378178C5A29A06F7327C3647204A9F17A416BA6F736908E3EB31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 1.2MB
- SHA256 55dc5fbe8af4f37c3bfffb41344a34990aeb3de2ac9fe0d5c044bd86909c86be
- MD5 e292a63cabd65b582e2f73693932a059
- SHA1 650ba1e3ee157d6c202a4a842089dfc9a374ed78
- SHA512 4c90b2d8321a75aae600109391c86afa745c78d173ec756186da2325a20736ea670b5d5ff0d1d71a6065f8910eb7e68d14d013c93499fb4bd542d78f2bfa426a
- SSDEEP 12288:bsXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:bssqjnhMgeiCl7G0nehbGZpbD
- TLSH T1DB4523BF964C51CAE52604B5C3E5F14DAC073E6BE9200483BA9B7CBDF7B14584B38426
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 1.2MB
- SHA256 18196caed3d5a0260c82aeba0a159a801fa119ce51f9c24b00ac883352317fd5
- MD5 84e8ab236d35ae3434910b024099a3b1
- SHA1 4a65ec4e99912d01383f3ce61ffe10d013b1fcb7
- SHA512 e65852101d38da6b9a6a4e5d306b0ea00954e7ad2fdc3acbee4cb7c6d34b275a906ef2eb7edbf066b556e07a6fddee79aabd5cd858e69b973b00e8aeda22c99e
- SSDEEP 12288:IsXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:IssqjnhMgeiCl7G0nehbGZpbD
- TLSH T1074523BE965C51CAE52604B5C3E9F14DAC073E6BE9200483BA9B7CBDF7B14584B38427
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 1.3MB
- SHA256 9cc50eecb15595538847d6c186981bd0c7ad1e3f22561a06e73c7fb3e2761dc7
- MD5 7725e763840da381ee28fe50eb1ba24c
- SHA1 204c0123ae40942a145cd2c9edbc3b2134cbb46d
- SHA512 b5840b2b87e05c448f080722d8a38d3dc18a5d82a7a86e4336ada88936aea22c223eea7279da60ee8807abd02853ac59c97243a8e18baee5477b9b7f2cde5ba8
- SSDEEP 12288:IyPz5L8FXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:JzyFsqjnhMgeiCl7G0nehbGZpbD
- TLSH T13855125B73A530F9D1378178C5A29A06F7327C3647204A9F17A416BA6F736908E3EB31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
- Size 1.4MB
- SHA256 2c33b9692a6171f29d66b3a7445213aa64050c1a6b3c804fad1b93986e7dbeb5
- MD5 f0ac44da57e1590a6f4ca2311c06afbb
- SHA1 d5174ce14f69b75cd2e4d5e8636e930f7429417f
- SHA512 a9f8d694404188002b08a27265145ba7ed1c045f8276cf9758fb13be5da916bb12b9a4b46a72107a8443584fc8e825844a9bd9287e4e0ad8a95c8141c156fab5
- SSDEEP 24576:6T9aLl3z0zDfsqjnhMgeiCl7G0nehbGZpbD:6TQLljeDmg27RnWGj
- TLSH T1AA6501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A43A6A5F733A00D3DB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
- Size 1.6MB
- SHA256 4749fa79054837e823e01957a6b088fed9953c6a06eb292d7a1f7c9ed69980eb
- MD5 ae9bdc70c4cf6e5e4ab5793f7f3e24d1
- SHA1 1507ab77a9f055e549765a27ad01e47d2c85dfc3
- SHA512 06083965fcb82f6fa614d55141ee0b1be4b826b154bda56b7145d52e53be9b54fea11c836c25eec7279f0fdf522e489d15146f16c3e67c289dfafe78f04a0c2e
- SSDEEP 24576:H3td9CHKy7GZzsqjnhMgeiCl7G0nehbGZpbD:Xtd9CHKyaRDmg27RnWGj
- TLSH T1CE75CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 1.2MB
- SHA256 a1456f19c1efbe0eb867fd578b817b6c44d2276b72fd118e4c3608b09c94bdbf
- MD5 c3666c1e5b86a90158cde050c44ac70d
- SHA1 f491762fe14d803b7630dff09c5ab48149c71690
- SHA512 4fd36e71f05b679da124ef63f39a81c084a1ab7a66aa8ceccbd3931e5d66d5486b8dc8877fa5b4e96e16b152640f682f1bdef0a5d0ca574b50dfc43ec622094a
- SSDEEP 12288:fvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:fvsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1774523BE964C41CAE52604B5C3E5F14DAC073E5BE9200493BA9B7CBDF7B24584B38467
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 1.2MB
- SHA256 c404951f98e9dc46adcb3de09bded8c76504afe6fa0a363affa6c8a5dbf04bc9
- MD5 4d3d45904c5859361fdb6f6dd1300d07
- SHA1 e11ee8f4e14fcaa8cd0d36190be8e6f7255e3819
- SHA512 534b0d25a3c05740bce338c05779394c101d50ffad390342016959696694d65c1dca7096efccd44b17d05d25a57c8ccae1a1343d656fb8c8f3b0f7c379f6b13d
- SSDEEP 12288:blXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:blsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1934523BE965C41CAE52644F5C3E9F10DAC073E5BE9200493BA9B7CBAE7B14584B38427
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 1.2MB
- SHA256 21d4b58b213f66c2a87ce54e7f4f7101647b500c2b7fa0d974d5b2c399a7ac47
- MD5 8ead4d50513815783ff9ad36cceb4c3f
- SHA1 f3e132f15791b38517e2511a1bfd4c5dbed58bf0
- SHA512 01c63444290ce370fbf25d51f11f9f4f33aa4e83966d22c883502bdad9c7fab7b80035e2e3d7f98c5043a31f3d02c6eb237a617f08a5d56a608c1b3dfabe00a7
- SSDEEP 12288:AiXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:AisqjnhMgeiCl7G0nehbGZpbD
- TLSH T1EB4523BE965C41CAE52644B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB18584B38427
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 1.2MB
- SHA256 06fda0673ffb9372583ff5f9fccbd2e9a9911e5d898bf66f29f74c792bcdad8b
- MD5 9e471c8db8dd55d2309315cfa018bb10
- SHA1 0cb8f12dca7bf161765b2aa838c82b661d3541f3
- SHA512 88c459220e2e3fdf419b0d31a6382000910c4805c0235eba614e354fe92a9cde105adfe8abf4341c35fa873ce46a379a26b0833bcf0c630a7ba6a8cbd2ac90f5
- SSDEEP 12288:PsXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:PssqjnhMgeiCl7G0nehbGZpbD
- TLSH T1EA4523BE964C51CAE52604B5C3E9F14DAC073E5BE9200483BA9B7CBDF7B14584B38427
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 1.2MB
- SHA256 54cb750a6e30a7582b9665ee653d3e48192f950d64949d78bd84078e71ccc789
- MD5 d72d1798c816620ead419cfec209e824
- SHA1 a89191b2809afb605f6b2936509b407bbe9f4187
- SHA512 5cadb943b117f47a695071173fe015090555cc8f2e63dbef4d797940103fd792c63927688900eb315a1aecd1bd9de475c5f901e027e3277d85fd62a6cb39130d
- SSDEEP 12288:pvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:pvsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1964523BE964C41CAE52644B5C3E5F14DAC073E6BE9200483BA9B7CBDF7B14584B38467
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 1.2MB
- SHA256 9fae8dd2bc78dbeb107ecea05c424be867acc965f9ead7d9ffb3c9766d685fdd
- MD5 c60664d634874821ff59720b8ee269a2
- SHA1 4dda00576e8dcf7508a45c070fa70d90f02bfb69
- SHA512 91d9e3591ea12a14e0431e878aa127a5837bc0853c44e3cfc01bf06b3a756e42c8d6bb594439ccda7143f0b48320aa2392a48af07bf503bc3c4b285b959f856a
- SSDEEP 12288:lkXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:lksqjnhMgeiCl7G0nehbGZpbD
- TLSH T17F4523BE965C41CAE52644F5C3E5E10DAC073E6BE9200493BA9B7CBEF7B14584B38427
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
- Size 10.6MB
- SHA256 d10e04217f81b44667c6237971f1f2843d132220c8712e8a855436e9f1f73baa
- MD5 cdd8c06c1f88f57727813906e3a58fb5
- SHA1 4ba873161c0ab0f489bb0c82a267aac8b0cb91dc
- SHA512 40fb64f723481e9b8e24d88edff74dbb85b2e63790595c067b01cc5986ac3a0fdeef0d8083e4c86c0e2681837cb53eb98e7bda2bcb22eb77d1b8330e2d72ef73
- SSDEEP 196608:PRO3j3Ld/5Mo9/vEvt2teG35tTdnXo9076gZCN3R9i:PROT7d/6o9XEvt2teG3p42Yi
- TLSH T10DB69E17A6B400E8D4F7D238CA579A03D7B2B81643B197CF0690567A1F63BE19E3EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\mbtun\mbtun.inf
- Size 1KB
- SHA256 4a350fc20834a579c5a58352b7a3aa02a454abbbd9eecd3cd6d2a14864a49cd8
- MD5 5d1917024b228efbeab3c696e663873e
- SHA1 cec5e88c2481d323ec366c18024d61a117f01b21
- SHA512 14b345f03284b8c1d97219e3dd1a3910c1e453f93f51753f417e643f50922e55c0e23aab1d437300e6c196c7017d7b7538de4850df74b3599e90f3941b40ab4a
- TLSH T1CB4140BD48D20AB83C673356671B69C27BDC220145C920ADB2DE8606C88EDDCB905EB9
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.6MB
- SHA256 241752de632f24245bbc645a187e1cc3f931e976cc3536739fb406c3dd0a14d3
- MD5 330acbcf3a6da589e8da954289b90f09
- SHA1 6fb56dbe579b3eb614f19b8dce5ad5b530211b5e
- SHA512 ff685f6c6db789a70726287cf14630d1ffe29c9711647d36e3c019ebe2d5bf8307d292e19ba7e8d017aef5ce4ecf32ae5136236288d1e96028b02c28a787ad08
- SSDEEP 24576:afwvok9RX6wkyAI4sqjnhMgeiCl7G0nehbGZpbD:uMnYIkDmg27RnWGj
- TLSH T1CC85D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.5MB
- SHA256 9b5bd034adf03c6fff9e5b7e31c217d9c5f764c475f5688caa43088d61990845
- MD5 e68fcef586a828b551871fce4976b861
- SHA1 c70406b9daf72dbf644ad2812639c1f76b8dd44f
- SHA512 f68ddf6dcd17d3132b707e1cd9164d2f20685ea6a2638bcffd0238123c39c7c085e8026583207dfb155cac801c282d62303687fdf7071c219c678b4935c5989f
- SSDEEP 49152:lYvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0fDmg27RnWGj:zySzP3D527BWG
- TLSH T123066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.4MB
- SHA256 9196752682f77e54767be619c41c0c178a30b2dbf47cbc8e25549da28f36d30e
- MD5 4428e038eddca88c1193287401e31861
- SHA1 5ae41c6f73d12829447cf3f0d0d7dbd4689b7723
- SHA512 9e088f53e2a5755e6880d128fa349f2c40346d672ab12e2936aca73fb0f035227a8d5f99d86512b4b9a11dd7fec26787e8b8edfe62e485063ab5a78a09c65ae8
- SSDEEP 24576:V47Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AYpsqjnhMgeiCl7G0nehbGZpbD:V47JUQj4irIhCnDHUPfF/PDmg27RnWGj
- TLSH T1A265AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF2270437D6F63ED44F35B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.3MB
- SHA256 a3d760a904fccf461d3c468f2e97d142300043aabfa2d05df9605e09aca55078
- MD5 ed3a5e8a67486253e8a4e9618185e48f
- SHA1 e8878b217fa63e9fe329b3a97bf046d141466301
- SHA512 ee1500ab84f4ddd161f05d9af1ca87dd20063fbcab942a4f0ada44d5084ed087944f80beeac7215b35a4c200b69b616cf04a066667c0fccd022f1b8f088f1135
- SSDEEP 12288:ZGsf8Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:r8sqjnhMgeiCl7G0nehbGZpbD
- TLSH T1BB55011AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_328ca45c990911f1a5b4c2afdf444b08\7z.dll
- Size 1.6MB
- SHA256 bb01c6fbb29590d6d144a9038c2a7736d6925a6dbd31889538af033e03e4f5fa
- MD5 3430e2544637cebf8ba1f509ed5a27b1
- SHA1 7e5bd7af223436081601413fb501b8bd20b67a1e
- SHA512 91c4eb3d341a8b30594ee4c08a638c3fb7f3a05248b459bcf07ca9f4c2a185959313a68741bdcec1d76014009875fa7cbfa47217fb45d57df3b9b1c580bc889d
- SSDEEP 24576:29raURTF/5pe2g5RpBDxSjv9IrqLwRpFEDbt7y0MVoAAlziG3B:29hP/5petvSjWZR8DxO0mo5MG3B
- TLSH T175756D5BF67400A4D5D6C034C5276B1BEAB1B88B8330A6EF12D15E6B6F13BF19979320
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_328ca45c990911f1a5b4c2afdf444b08\ctlrpkg\MBAMService.exe
- Size 11.0MB
- SHA256 fd7a1428221fe7de747930cb3d9f2991610e2b1d809a0abc1f26590db5f5986c
- MD5 bb079cbeb5948a894358ac3c5586d990
- SHA1 777c05ca055c938d3352e758d835d33896807a23
- SHA512 692ac8284d78c69b06dfdd7e4b6ecd0380e7198d587c48655d4d2204957e7968209e5aba6fd06ab150823998bdb74446a7f168fb9240f2f1aba0f5a38c39abcd
- SSDEEP 98304:RA64Z/iUYtDJODZi1EZnnsc8tUFswknM94BJ:C64dSJODZi1EZnsc82FZyM94BJ
- TLSH T126C6E606A7F951D8F5BAD674AD7B652AEE32BC618B3093CF1150560B0F32ED48E38721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_328ca45c990911f1a5b4c2afdf444b08\ctlrpkg\MBAMWsc.exe
- Size 4.2MB
- SHA256 7878a9b10903b8c0def49015deefd48a3ea0e46c0f5ac9ae755336994e020152
- MD5 acbb82943fe0d5f1c5df74b1a7dccd2f
- SHA1 c41e38f59eff5e40a6a47b14be44520dcd6d405a
- SHA512 7092748502f06bf05df19bd2d4d5857f161a35a9b2e3a72645eaacffacae7a8dad10ab41ad3b80d3a63ff0773b6c818edf3769ce6b1f61b01cc92edfb755dfc5
- SSDEEP 49152:dK5b4+V1qsR86LMFRbbX8DREqUaP7bBfnuF0JRlnPkokPmsBLdS4BPQRzU/81fge:i86kyaHF0JRlMhBpMyok3M
- TLSH T1C6166B06B6A540ECD866C239A47A8503E7F2B811273097CF066853761FF7AD21EBE7D4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_328ca45c990911f1a5b4c2afdf444b08\ctlrpkg\Malwarebytes_Assistant.runtimeconfig.json
- Size 615B
- SHA256 61fca252e8e336706f4c153c16100b7b621f9092ed09bb6959e406ab5bb21e85
- MD5 389f208d959c5ff4ee9c0e4dbbc31ecc
- SHA1 32243920d3687a1b8af307a3ae140103ec08f222
- SHA512 86dce7141f4fe9fd938f8b5be78d9e9d9885365d7ea7d4d3cb0674ea63a9201f4f0e02ceef47819b9d596a2e397fa68c78e9dfd15acf804ff93fca0f55b1997b
- TLSH T1C5F08B29CA106CB718B8337ED125C083EA30133B10002C56B4FC080C7F775B62221F96
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_328ca45c990911f1a5b4c2afdf444b08\ctlrpkg\mbae.sys
- Size 155KB
- SHA256 c990dd89b65d35d6c9b34e21c78d96e206ec3bcdd934716ee61ff79da0fa5251
- MD5 fc98ddab2223dc73b950622801b31554
- SHA1 997faaec1dfd18b9dd31e1c216440a28bc4cd612
- SHA512 da08860f8c3d8a9204d1480f33d21f2ab922db5cbbf7734527ed05477c2d9c184deaedb63196876c989c9ff6c1b45b5792661f5bce92212992a7cdb664a793e3
- SSDEEP 3072:hcj/Hk4/53QBvOP8JsUrLx1o6GwzfwKYdkXEnU/H0KBJT2:hc4wNQBvOEJvx1o6GwzfwZqEU/33C
- TLSH T1D3F36C52F3B400F5D8A6C679DB669213E6B2780D2721E7CF076085252F673E4BB39326
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_328ca45c990911f1a5b4c2afdf444b08\ctlrpkg\mbamelam.cat
- Size 11KB
- SHA256 64416d564725416c6869ea951878a2734b1f6940b11f7961a897c45f0d8c6625
- MD5 bd4ceae54af081d6b1dd91ff584c5d61
- SHA1 5ade462d66e042da58bb1447d1b31f1aad901b68
- SHA512 37e7abd312f694ee2c8ea54ecf50ed12c16684f1007c61d9a6d1d01cba958be511c5e4e11cd7393a5cd57349fda1c552bebca42962137e0d11695c195761ebb0
- SSDEEP 192:oBxybp/yRpJCSEbhLxyKR/2FWQFdbiI/Ex6RMySX01k9z3AgEhrZg:oLp+eFRvmoMR9zJug
- TLSH T11A320AE58A6C5083DCA7AC6087E8E5D77C3D67C71D00987921DAFB5409933CAFB2816D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_328ca45c990911f1a5b4c2afdf444b08\ctlrpkg\mbamelam.inf
- Size 2KB
- SHA256 e26c2d3347e5f077da92713c9df3cd3eae438fb7e29810bd5c3afe567d2d3125
- MD5 5d8c05cc4f9b4304d57ea10b87f2dcf0
- SHA1 2cabe3d39aa5ec16c54c7818284a2ee235d2ddbd
- SHA512 55bff23fee9852f229246b71721b3659c916079787935d400a97641449dfda752fc8fbf36f9ea3dc4028f05daeb9006a99660284a61aa5d5a466af0ee966c738
- TLSH T164410454AA538BB8697B35B81E472883BF5412205076384032DEC8C99B6DF0C93757AB
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_328ca45c990911f1a5b4c2afdf444b08\ctlrpkg\mbamelam.sys
- Size 21KB
- SHA256 ded569e249e590314d095f740c6b8934a5a797e4f3edbe0f78eac9d333f12a2a
- MD5 8da81aa1f6b89ce1d2e216e3ea351c59
- SHA1 4baf79cbade9a5584630a540e6368d547579fb12
- SHA512 6d611bbd9d480ef2defd745fd06c4ab86e181267cf689d9d0e124edbaf22fd30fbe2310879cc7bb6dde5bae72c4feea1d329cdecfbf101d95634f85dd0769119
- SSDEEP 192:C7IlO/ZnEc+PbYv6/i0RtPH920QvVUKjnegqdsW++w/y1wVWQ4uW/+O68RwX01kd:wIlO/i8ChLIxUKjnev6+Twc69R9zING
- TLSH T108A23B6549780283F6BBC570C7E4C927BD38F39677408AEB0591E5681DA37C2AB3192D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_328ca45c990911f1a5b4c2afdf444b08\ctlrpkg\srvversion.dat
- Size 9B
- SHA256 af0cac103fb816b5059d8775d63406a2f410a8ed70826978cddc6d88d8ddc668
- MD5 bcec912691aaf576c95bfe0265863b6c
- SHA1 1c9b9a02b6f3845a292b49332056df7e2ca2d539
- SHA512 d0556b3e89b42e12e26104ca3f1889714bee2a45fe74ebd8af7720398bd3a32d072f5ae91bfdf33406ff0027188705780c769350c4cda5176b15b3541d4fe412
- MD5 SHA1 SHA512
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_328ca45c990911f1a5b4c2afdf444b08\dbclspkg\MBAMCoreV5.dll
- Size 8.7MB
- SHA256 b226e4e93acba45a3e6c0ee06d6fa1c62fac91ae37c86595ab395088ab9edbc4
- MD5 1ab568867f09d24d997c993e185c4f08
- SHA1 bd97a322c4736f420c54c7ecec02e8bb1d764fa2
- SHA512 1c4d688a1897019428c8c7fa2dfc3368f6f7e3e1cfa55c915562a0630e70d5ad9ea2b36a4483f1b94118db32e5da85722a1524d52a5aa781933d583678e4f448
- SSDEEP 98304:9lZ2y5IWilAVOyU7mhNl/DP3RtFJe92YiGNwmdQk:9iy55ilAEj8Nl/DP3rFk9iGNwmdQk
- TLSH T192967B2BA7A400AFD87AD37889EB4502F672B811537397CF16A8A1761F637D09E3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_328ca45c990911f1a5b4c2afdf444b08\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\10.0.8\.version
- Size 50B
- SHA256 42559a4970a981aa61f3ed59ad44d05214fcc5eb97c35d06a88102a0b747a45f
- MD5 9072ad106b74f3900d25ae80843c8a24
- SHA1 b664a23dea5a5591c21fe0f4a9b5f344079d94d1
- SHA512 ea866258bbcccc0951f95367f3309db65d437ad27eb6fcbdfe12e08b9f76265050d6216091b89f0dc92db66b24f8238c8d6cc98ce49e6c3bb6b051ee037e56a2
- TLSH T1309004444445D47315D3313453015154F00C5D3C5D34CC11D05F707CC4D705CC55C301
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json
- Size 47KB
- SHA256 1ed1e72b514efc4749c38f40f5fdb91f4bf6bd784be43a5b7a5e4245564a4da0
- MD5 3cb2f1bf1cc449f01e465a5a80baf527
- SHA1 d3df58b8e3b9aadf6aaaac0ebd98712f3bedcb3d
- SHA512 30f3b9f1173a7a78e8cdf5eb5184de0a25b1dd871f62b42e71b666dd9fc61195971e74e8fb849b32f0066be010a29db8fc0a8fb46daa5ca2ea12f90b4e192ef8
- SSDEEP 384:+riPalGB5AWiWq2mhzJUVVqxKS3xV2CjNrBa7gHOykEaf:DUAHiWqn1UVVqx9U7gYEaf
- TLSH T1E42382BBD9DC0D1B99712294A9B94607FB20036F10980C17BDBEA98DCFB751394C6F1A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json
- Size 12KB
- SHA256 6d13a0123795bb29d15ae18f5770acd752fd65cbea78c0fa52b69346dbc9f43c
- MD5 168cdeaeac070be676afff46ee49cc01
- SHA1 8aaf2294b9cae9fadb66735c6b18010bd3287967
- SHA512 ab9254e0c32a604f9500f2f2d66a542030bf38427eeb3707625c157e4c30e98abe0fc406ee03a472fd20e5f5935ecd6c61725141cb61f30869ec5936ec9e27d7
- SSDEEP 192:Ivmf/FYgVMzhrgHTb0MAJUKfVgH8BZ8ZUBPs:SmlYgVMzhrgHTb0MAJUKfVgH8BZ8ZUBE
- TLSH T12A425422D1B5DEBB66FD617661B40B82F364C75F08414C07797CC88C4F7BD2A62C2AA9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json
- Size 12KB
- SHA256 7ea17d00352b4db9a6b43abbd31ed3cf20dd4984d9ac916d4c45ccdb2a2815cb
- MD5 20c1e185e52a7063994eeb0e162ed144
- SHA1 5ce54ba601016426a5482144d9085df3c079ad30
- SHA512 2b6cf89786506a7717a4e0b9694fdce4db9808ebc5a9bcc0ba3e0f43f4def0322523a9cce4683e3a420bb160bf1a8c9e7576e699f056575f6f9eb50d84e62206
- SSDEEP 384:7m5YgVMzhrgHTb0MAJUKfVgH8BZ8ZFRGpn:7m5YgVMzhrgHTb0MAJUKfVgH8BZ8ZF8n
- TLSH T15B427626D175DEBB66FD623661B40B82F360C75F08410C17797CC88C4F7BD2A62C2AA9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\MwacControllerConfig.json
- Size 2KB
- SHA256 6cd6c4660d6b97e1b2cd5dcbced4b23cc1840e5ef13a2225f00d096009a084db
- MD5 e80442593d78fdd5b2b0643d525e65ca
- SHA1 017497c4c131a3ba389c81b1e3188eeefe3a97b0
- SHA512 4c9d38bc0c7573ac5539927f654163ca48fd1b43af3eb459d22024470d8f25b1c9d8df0dcea0c6a07e45b881773d04f047efb51a10bddbabfbcf563d8332b1f5
- TLSH T107512632D5A86CBF09F85266ACA84252F651875F41580CA3FABCC57C5FBAC12210AF5F
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json
- Size 5KB
- SHA256 efb28993abb7e1975e0e59997f929b7cbb8e8dd8ed08bddcc9eac20b43802e69
- MD5 64a7a1a4dd9b2dce4f838e963ebcd34e
- SHA1 99925e138915a572ddf6adfeb19e23e62ea759bd
- SHA512 92db49f7f8bc3034b3b9c435a6ba591573380bd20aab8e0099d4cb9414b8233aa0ca7da824264f7f190e8fe8c540f7556613befde2939273d4ba3fde2c205da2
- SSDEEP 48:qT5JtUmVSfKuGQf92Es1kV8EGYpmduwY48qXKeWQX92MEnAf3wsaA:yZOfK5k9JykfGWYyIXKBs9RsAf3wsaA
- TLSH T14AC19D16D9105CFE18B8E25EDC288186EB3083972206186FB5FD859C5FB763336C6EE5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\SpConfigFile.json
- Size 12KB
- SHA256 ccc958d704c3b3caa795ba1c29789e1fe2a22701de1a1546f189a41b32eb8a7d
- MD5 655785abc76787a66db8419d70353917
- SHA1 d4701bd5e981c73675e0a28a4847e56aec5e4986
- SHA512 5a4dfae1e05595d83d1599163fd491a06d661a59e97bfd19d5488cec963df016ff22cc99d7a3c42c0eb9d4c3903b7ab97324a129786e4bea01876f8089fd6a52
- SSDEEP 384:28+xwb8fkY/sDY8t7SSdUCExUYS9oFfJ7MLPi5LnDjufzqoA+8xRj81offZJZtXJ:bXDK
- TLSH T1F452161EE0A84867887726901F7A95A2E334526BC1435C6775FCB12CCFBB483C496F9E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json
- Size 1KB
- SHA256 4f7f194a2982e4f8c579b66a1db7b1654092c004b8a82c159aab8a98460ab00e
- MD5 af322c4437fc47df74ef402d3657614a
- SHA1 e86c6e0a439a37f42b3ede6023a765e0a2291975
- SHA512 b22a145742ee469aba698cd5b6c63a97e75e051abe84ba14b815d930d7846e00a6331e6f6c97269dcf3aea8272129690c475da6878b2579b5f6a0b33e79c8b86
- TLSH T1673105128A2845FF29FCD254D9B88717E7A0531B21161C1FFAF8DA58DE7707237E1A88
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json
- Size 1KB
- SHA256 3c604b31ff7d4fe2567f080bccad8140fa2c6703abe0a85cdd499495e563129f
- MD5 b5098872496c9a50614e0ac3a4805520
- SHA1 1127ac7e01a20790b7a93fc6e620e64e9c36e586
- SHA512 850f7200de0f55332115fcad5bd6d9bf69a61b5290995bd76bfeff76f126bcee1f2b52378f116d599c4cee6c8a8669a643f5911007d3f85b01070de7fbd1ec8b
- TLSH T1D9315922892998BF26B5974DC9B48102E760438F26708D2FB3FCDC48DDB397424C7A4D
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\rmode\mbrescue.exe
- Size 7.7MB
- SHA256 477919ecb586d6ef4a06793417c2ae3126c51a51cf9445d901e90e3627e7143b
- MD5 ce8ca947e3162da157d1878d4cfec382
- SHA1 6f574aa206ba5e9d7469450780c4238cdd5112e8
- SHA512 4233bbde636d039ea3295e3b2066f56ea5a23e0431a5e675c967c60bbfa4f518f01eb90ac271da56a192671b925b3e14d3a25f1da4a8412983b4973565dff299
- SSDEEP 98304:akpowZa6gr/YzKrEAi9bESWCt+z3zweCeT007kxK:aFwZa62YW4AQbLWCtej1C9076K
- TLSH T1D586AE57A3E800E8D8B6D13CCA978503EBB2B85147719BDF06A4566A1F73AE05F3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
- Size 1.2MB
- SHA256 6aea115a0f8ced213dab7cc85e07b016658e297c41d81e0143caffda4e7cee29
- MD5 1143ca05bc81a62751f57f5d33c520f5
- SHA1 0bae7d865838519cc93f8577ae7104a2f5ed26a8
- SHA512 f0ce11031bc1f509d928bd15b0c822ebb1c88d1467d4b93cb0acb8a6c3df1d425934d90d88ad3cfcb1383e9acd1f4a343412066a09e86537828b13f928d1070c
- SSDEEP 12288:0cBd+U3fyQ9npWHMv+04OO4MTd6FcUMmLcfwNpb:0cBoUP3mG4ONMT0aUMLfw/
- TLSH T144452701762BC78BC6A950325E76D2CCA7707D41FE05AF0773C9873F9476668B6B2282
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
- Size 414KB
- SHA256 0efc837a529c969fdcb1ca1cb81184ce4dfb04c5d57b70521c783f40fd727501
- MD5 7441d6cd4385d4c7fb8bc9587f5cf019
- SHA1 d270f9ee9c1679e85900f6710304e9d3c72fa6ce
- SHA512 9b35048f2252741d11bad115794accb54fefe1001e3b6d64427aa20d3290df8b79db66c419066134cfa7c4d687f82072ae473d159faa251bad6f05c53af3f419
- SSDEEP 1536:y3Lxt7GQ6qYX5AqnNXpqBNxQq7yvsB7i4HATg26dWzxd:oLx/u
- TLSH T11194D9027736B25EC5F380BA5971969EDB3CF402EF424E4527840A79C8F2256B2FA7C1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.2MB
- SHA256 c665965652b122e15f354e9d5b17998849f0ed0f514dbfcd3c40a649c0dc7c2f
- MD5 2114a5d458a4fb038406f0a45226d27d
- SHA1 39a2c968e7a14965ba94e11925a6e984bfc097df
- SHA512 5c7a6328c48d83c8400233ee45d04154b88b626b2f47d0164780772b4d85b3fd1207733dde4653aa7078d13b4e7ba0109aee8d634b63711086049a0bd7901f7d
- SSDEEP 12288:WF70Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:i0sqjnhMgeiCl7G0nehbGZpbD
- TLSH T10A45237B934C518AF93605B482E9E12D680B7E669F1044C3BA4778FDF6B18D88F38517
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 b90f831e0c377ba5b22a92655242619af74fa0af2bf51322bef7aeb8df05b0d2
- MD5 a4f3e93f9dc99ac4a617c2106bbc2afc
- SHA1 fb926085b0d83b4815eaad61fb2dc90717ac9a9e
- SHA512 5ba8b6b623540a4df998c49d6edbe916dcd31a4d618cdea54c82dccc9d9b0d61729c718fa98172c88552ecfc0722336539e770a19fcb18976c91c8ea48a42123
- SSDEEP 24576:Igb6bmBIi49WNNFpg1rSvFv7bYKsqjnhMgeiCl7G0nehbGZpbD:Igb4mBIBhGFtDmg27RnWGj
- TLSH T11B659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DriverStore\FileRepository\mbtun.inf_amd64_add82795013a7c3b.ini
- Size 409B
- SHA256 c86566e1fd1d02f5535f569aad5a9c9177d86b38019510cbc530e5c35c044db8
- MD5 e10e3824d34b320fb108a79b78615682
- SHA1 3ca6783b7537615ca119d3f45f9c8f28ee1999c8
- SHA512 eb63d0ceaaf9db2a7dbf6251769fcbbeec4a86966ca008c6bf2a5b0468b221da763277be4831a3f527c3e95ee8dfb4a483a242ec2c1acc8a8e372014203f6ed2
- TLSH T1AFE0E58128F531DAEC0381ADA12F3DEEC316728B046120ADB3086044DAD2DC82C485BB
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.7MB
- SHA256 6407c36fe168311b384cac3aac13b6c3c2a6a66911a966b4f64253bd4b3c97d7
- MD5 3fa56fe3b39d7f8fd718ea43ea5d1e27
- SHA1 2f154bc03cd09f4afed621941c7f0584454f13f9
- SHA512 5c84ab36d15737de1eb75b320c69e0e0734e8cdd55ed43f1d21993a8793003cec1260c46e06a705c43a5ddc80e5a97c014a6aa35acfedda650f10f6c4b2a29ed
- SSDEEP 24576:zG88u8FpJqH1Wzria7/m5sqjnhMgeiCl7G0nehbGZpbD:C7ZFPqVha7/GDmg27RnWGj
- TLSH T1EE85016577E401F1D477D138CA868667F6B2B8250324EFDF07A88A551F23AE44B3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.4MB
- SHA256 d96a073c48b753f261d48664027e0c4371f4d8e309286900c3a5a840cf3ab4d5
- MD5 a76a8d9708f654318dd824c509433550
- SHA1 d74c3c0153b38474c131ee914a6c952bf49d3d59
- SHA512 859807bd4e6881136b8cd0991a7314ebc584df827658dde899eaf3b29fb74d2ae1ccfc104dc257fc9c069e95338e59f897931739201d12be9aa41fc6a21e80ff
- SSDEEP 12288:rHvUrBFrEjwaQtXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:rPUr+NQtsqjnhMgeiCl7G0nehbGZpbD
- TLSH T1FC65F12F62AC18E5E676A17CC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.6MB
- SHA256 697299a7f761c84342f60c971814b53adec2bc90e5b89e68f6e6b9225f437a5c
- MD5 e4b90423bc1e8636acea7b7aaec3b6cc
- SHA1 1d026845d24ca369fe262a2058ddf2f0250319e7
- SHA512 8f3d5f454c9a81e329c5598b3de0de5a3a2f2ef106f34cc76fa0f7dc2c7f7878465ed16164c817bbf5097dacd127cdd66c4fe35bab5226700baefd1faedf0694
- SSDEEP 49152:NBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjhDmg27RnWGj:WG05lO43bMD527BWG
- TLSH T1CCD5B06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 33b2090feb66fa686dc1a62283a3374531c947f718360667ce5b51a5f4a13481
- MD5 024f9c8061cd036eec42cf79e56bc4fd
- SHA1 fb9952ff8612ce447b83c0fc7fa3460dfc9d8d5b
- SHA512 089e9bc6336c8ab0b76ac0b690ca646f8b0be884e8b257a846e6d7f8b1cf14381bb061245163e2cc447ced942614f14b3f04a0b8936973cb6c9106f23dd84ab4
- SSDEEP 24576:3fa5POZ3dpqWVM50JicR2hG0lasx2+47eidnrsqjnhMgeiCl7G0nehbGZpbD:Pa5POZ39Jt2pasx2+mZDmg27RnWGj
- TLSH T17165BF5EA7FC00D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 7ba9ceb107f63fe23d84984e24eaa43cd3d68e5a18c151c70a8bc05000047b31
- MD5 0ce7170a26672af26271cfa829a9d05d
- SHA1 168b26ac70c298b8aeaffb77f9f17fce4067b573
- SHA512 74a4077f458099aab7d4a515b887b17df59f525cc5ca8632097dfcd0555b8aa58bc663bee5a5f13107414bc9432732d4c071c5f852ead89c24adba617e7434c1
- SSDEEP 24576:PNcwHdjbyQ4nLC18lb/EOjowL7FkBsqjnhMgeiCl7G0nehbGZpbD:PNc/zEOVHFmDmg27RnWGj
- TLSH T190857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\mb_DB2F.tmp
- Size 107KB
- SHA256 ad820dd54edb13e255d34eafacd71f278d6514e2f7e4c2970401f922a774ceb0
- MD5 2df8ff40bec48460845f851a54b76fe8
- SHA1 8e19f3d76c87d590cf1af839ddbe98af381d44e7
- SHA512 2177f5dfd6901f09ae2b8a0d6bea7b5fac3d00a721aa297ca6c35666cf2549d6c8d8655063a332224ccc8e0f00bdc84334636e9f1527862c850cc4ceb96d7d61
- SSDEEP 3072:dAZdoamZdgBjLpSXussssvYssssnC1c9RvZfy74hfp:dW542pSessssgssss7Nea
- TLSH T1B6B3F1F78379B8D9C513DA3B93874B110B28426B2C8A7E45A84DDB158D7E66181C3F8F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 6027e02bbcd75a08e853232ff4b23d58112239b781d99e5f29dd241b198d1bb6
- MD5 abe6b5a6b49563345be9a860599480ba
- SHA1 d508a41812138398a8107b64ec7f7c9ea7222da3
- SHA512 8ced78ef840d2463feb19429611c9031d70871f8a822163f6847bef6f9e9a5f75b4c57239ec5efb8731a5d1b63538478a4c0f32be9bcc37ed2aa639220adc8bb
- SSDEEP 24576:ctkNvNnaFeYhJNtmZBm3sqjnhMgeiCl7G0nehbGZpbD:ctMwBtOmLDmg27RnWGj
- TLSH T15F55AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\Sgrm\SgrmBroker.exe
- Size 1.6MB
- SHA256 b3005d6c4a97349ec3e0a6c7734584855fc4d1dc2efddac687cae44f61ebdaea
- MD5 28e1fa0abb8516230fa2390385a2c959
- SHA1 180386956540b3e37b7e02dca37feffe2ce2f8e1
- SHA512 4b41ae9339cc3cd1708e760c6d2f584f33fdd29ced545884f34f765553a155a045da4bcf87a4ff630bdcab4a919e0b38c8892bd82e9856c66bd160f54a97c39d
- SSDEEP 24576:7D3FHshBIYQgAAsqjnhMgeiCl7G0nehbGZpbD:7DVHeBIAA8Dmg27RnWGj
- TLSH T11B75E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
- MD5 SHA1 SHA512 SSDEEP TLSH