Analysis
- max time kernel
123s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
06/10/2026, 16:10
Static task
static1
Behavioral task
behavioral1
Sample
2026-10-05_bb64a0caddf1be79707b5bb950a6034e_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral2
Sample
2026-10-05_bb64a0caddf1be79707b5bb950a6034e_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
Resource
win11ltsc2024-20260911-en
General
- Target 2026-10-05_bb64a0caddf1be79707b5bb950a6034e_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
- Size 3.3MB
- Sample261006-tmlnma1yev
- SHA256 e2760255374e4de30916a4e133b90e83d383f93137bec86f9130ddca8edb1f07
- MD5 bb64a0caddf1be79707b5bb950a6034e
- SHA1 13ab055bbb6f9a984696f74494140b31875b5a57
- SHA512 ba443cb9ebc53c7a5851fde5968aed16c222d44d81ecb8a3227c131f167b0f4ba246f401f92115e59c604260137452b4fe732aa4798bddd7ac87b959ec6b1a97
- SSDEEP 49152:1ZbqCBYywXtNnM2wAeyfvE0Z3R0vnxn1o2d5XQ1LNiXicJFFRGNzj3:3OCBYywXtUAeKtEnW2fA7wRGpj3
- TLSH T12CF5AF31B2D18120D1B3D270297EB7EA5B75BC256F76408F32D8BA390B725C09D75B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 TTPs 1 IoCs
description pid Process procid_target PID 4156 created 2700 4156 2026-10-05_bb64a0caddf1be79707b5bb950a6034e_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 82 - Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs
resource yara_rule behavioral2/files/0x000d00000001c4cb-2071.dat INDICATOR_SUSPICIOUS_Binary_References_Browsers - Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 2 IoCs
resource yara_rule behavioral2/files/0x000d00000001c44b-2050.dat INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL behavioral2/files/0x000d00000001c449-2047.dat INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL - Detects executables built or packed with MPress PE compressor 2 IoCs
resource yara_rule behavioral2/files/0x000d00000001c4cf-2061.dat INDICATOR_EXE_Packed_MPress behavioral2/files/0x000d00000001c4ce-2077.dat INDICATOR_EXE_Packed_MPress - Detects executables packed with ConfuserEx Mod 1 IoCs
resource yara_rule behavioral2/files/0x000d00000001c4cf-2061.dat INDICATOR_EXE_Packed_ConfuserEx - Detects executables packed with Goliath 1 IoCs
resource yara_rule behavioral2/files/0x000d00000001c4cf-2061.dat INDICATOR_EXE_Packed_Goliath - Detects executables packed with Themida 1 IoCs
resource yara_rule behavioral2/files/0x000d00000001c4cf-2061.dat INDICATOR_EXE_Packed_Themida - Downloads MZ/PE file 1 IoCs
flow pid Process 22 4156 2026-10-05_bb64a0caddf1be79707b5bb950a6034e_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe - Drops file in Drivers directory 9 IoCs
description ioc Process File created C:\Windows\system32\DRIVERS\mbam.sys MBAMService.exe File created C:\Windows\SysWOW64\drivers\mbamtestfile.dat 2026-10-05_bb64a0caddf1be79707b5bb950a6034e_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File created C:\Windows\system32\DRIVERS\mbamswissarmy.sys MBAMService.exe File created C:\Windows\system32\DRIVERS\mwac.sys MBAMService.exe File opened for modification C:\Windows\SysWOW64\drivers\mbamtestfile.dat 2026-10-05_bb64a0caddf1be79707b5bb950a6034e_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File created C:\Windows\system32\drivers\mbae.sys MBAMInstallerService.exe File created C:\Windows\system32\DRIVERS\MbamElam.sys MBAMService.exe File created C:\Windows\system32\DRIVERS\MbamChameleon.sys MBAMService.exe File created C:\Windows\system32\DRIVERS\farflt11.sys MBAMService.exe - Modifies RDP port number used by Windows 1 TTPs
- Patched UPX-packed file 1 IoCs
Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
resource yara_rule behavioral2/files/0x000d00000001c4cf-2061.dat patched_upx - Sets service image path in registry 3 TTPs 4 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MBAMFarflt\ImagePath = "\\SystemRoot\\System32\\Drivers\\farflt11.sys" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MBAMProtection\ImagePath = "\\SystemRoot\\System32\\Drivers\\mbam.sys" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MBAMSwissArmy\ImagePath = "\\SystemRoot\\System32\\Drivers\\mbamswissarmy.sys" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mbamchameleon\ImagePath = "\\SystemRoot\\System32\\Drivers\\MbamChameleon.sys" MBAMService.exe - Checks BIOS information in registry 2 TTPs 6 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion MBAMService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate MBAMService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion mbrescue.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate mbrescue.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 2026-10-05_bb64a0caddf1be79707b5bb950a6034e_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 2026-10-05_bb64a0caddf1be79707b5bb950a6034e_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 24 IoCs
pid Process 5776 elevation_service.exe 1876 elevation_service.exe 4372 maintenanceservice.exe 2936 OSE.EXE 5284 PerceptionSimulationService.exe 2768 perfhost.exe 5260 ReFsDedupSvc.exe 3416 SensorDataService.exe 2996 ssh-agent.exe 1560 AgentService.exe 5404 SearchIndexer.exe 4760 MBAMInstallerService.exe 4536 MBVpnTunnelService.exe 4440 MBVpnTunnelService.exe 1968 MBAMService.exe 1812 MbamElam.sys 4468 MBAMService.exe 3052 mbamswissarmy.sys 4232 MbamChameleon.sys 1356 MBVpnTunnelService.exe 5100 mbrescue.exe 5076 mbam.sys 3392 Malwarebytes.exe 1884 Malwarebytes.exe - Impair Defenses: Safe Mode Boot 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\MBAMService MBAMInstallerService.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\MBAMService\ = "Service" MBAMInstallerService.exe - Loads dropped DLL 64 IoCs
pid Process 4760 MBAMInstallerService.exe 4760 MBAMInstallerService.exe 4536 MBVpnTunnelService.exe 4440 MBVpnTunnelService.exe 4440 MBVpnTunnelService.exe 4468 MBAMService.exe 4468 MBAMService.exe 4468 MBAMService.exe 4468 MBAMService.exe 4468 MBAMService.exe 4468 MBAMService.exe 4468 MBAMService.exe 4468 MBAMService.exe 4468 MBAMService.exe 4468 MBAMService.exe 4468 MBAMService.exe 4468 MBAMService.exe 4468 MBAMService.exe 4468 MBAMService.exe 4468 MBAMService.exe 4468 MBAMService.exe 4468 MBAMService.exe 4468 MBAMService.exe 4468 MBAMService.exe 4468 MBAMService.exe 4468 MBAMService.exe 4468 MBAMService.exe 4468 MBAMService.exe 1356 MBVpnTunnelService.exe 1356 MBVpnTunnelService.exe 4468 MBAMService.exe 4468 MBAMService.exe 4468 MBAMService.exe 4760 MBAMInstallerService.exe 4468 MBAMService.exe 4468 MBAMService.exe 4468 MBAMService.exe 4760 MBAMInstallerService.exe 4468 MBAMService.exe 4468 MBAMService.exe 4468 MBAMService.exe 3392 Malwarebytes.exe 3392 Malwarebytes.exe 3392 Malwarebytes.exe 3392 Malwarebytes.exe 3392 Malwarebytes.exe 3392 Malwarebytes.exe 3392 Malwarebytes.exe 3392 Malwarebytes.exe 3392 Malwarebytes.exe 3392 Malwarebytes.exe 3392 Malwarebytes.exe 3392 Malwarebytes.exe 3392 Malwarebytes.exe 3392 Malwarebytes.exe 3392 Malwarebytes.exe 1884 Malwarebytes.exe 1884 Malwarebytes.exe 1884 Malwarebytes.exe 1884 Malwarebytes.exe 1884 Malwarebytes.exe 1884 Malwarebytes.exe 1884 Malwarebytes.exe 1884 Malwarebytes.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe \??\F:\ MBAMService.exe File opened (read-only) \??\K: MBAMService.exe File opened (read-only) \??\X: MBAMService.exe File opened (read-only) \??\Y: MBAMService.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\J: MBAMService.exe File opened (read-only) \??\L: MBAMService.exe File opened (read-only) \??\M: MBAMService.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\A: MBAMService.exe File opened (read-only) \??\N: MBAMService.exe File opened (read-only) \??\V: MBAMService.exe File opened (read-only) \??\Z: MBAMService.exe \??\F:\ MBAMInstallerService.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe \??\F:\ 2026-10-05_bb64a0caddf1be79707b5bb950a6034e_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened (read-only) \??\X: MBAMInstallerService.exe File opened (read-only) \??\Z: MBAMInstallerService.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\B: MBAMService.exe File opened (read-only) \??\P: MBAMService.exe File opened (read-only) \??\O: MBAMInstallerService.exe File opened (read-only) \??\W: MBAMInstallerService.exe File opened (read-only) \??\Y: MBAMInstallerService.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\R: MBAMInstallerService.exe File opened (read-only) \??\T: MBAMInstallerService.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\S: MBAMService.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\I: MBAMService.exe File opened (read-only) \??\N: MBAMInstallerService.exe File opened (read-only) \??\U: MBAMInstallerService.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\D: MBAMService.exe File opened (read-only) \??\G: MBAMService.exe File opened (read-only) \??\G: MBAMInstallerService.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\U: MBAMService.exe File opened (read-only) \??\I: MBAMInstallerService.exe - ConfuserEx .NET packer 1 IoCs
Detects ConfuserEx .NET packer.
resource yara_rule behavioral2/files/0x000d00000001c4cf-2061.dat ConfuserEx - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-10-05_bb64a0caddf1be79707b5bb950a6034e_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File created C:\Windows\System32\DriverStore\FileRepository\netwtw04.inf_amd64_28271e5be9a9f6f4\netwtw04.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\msdri.inf_amd64_fdc036dc83da2115\msdri.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netvwwanmp.inf_amd64_21a7e1c8368216a0\netvwwanmp.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\e2xw10x64.inf_amd64_b78633a7607613a0\e2xw10x64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netwtw02.inf_amd64_669639d5a41714fa\netwtw02.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\rtux64w10.inf_amd64_382d70e2c349183c\rtux64w10.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netrtwlane.inf_amd64_9f581aa49737d7bf\netrtwlane.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt MBAMService.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File created C:\Windows\System32\DriverStore\FileRepository\netv1x64.inf_amd64_b0aef9976b305f93\netv1x64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\rtcx21x64.inf_amd64_feec7a9662e785f0\rtcx21x64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\Temp\{d0514e49-1399-1845-a19d-4a5917a86b8d}\SET1A70.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\mbtun.inf_amd64_add82795013a7c3b\mbtun.cat DrvInst.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File created C:\Windows\System32\DriverStore\FileRepository\netwtw10.inf_amd64_400af1170541b7b0\netwtw10.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\athw8x.inf_amd64_600627b27b9c7b10\athw8x.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netbc64.inf_amd64_4c416384b17ee84f\netbc64.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50 MBAMService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\86844F70250DD8EF225D6B4178798C21_44AD5D0C299F1D4EE038B125B5E5863A MBAMService.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File created C:\Windows\System32\DriverStore\FileRepository\netax88179_178a.inf_amd64_be76888d30e8464a\netax88179_178a.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\nete1g3e.inf_amd64_1bcc7029f170b19a\nete1g3e.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\wnetvsc.inf_amd64_3ea8686d80de3706\wnetvsc.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt MBAMService.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File created C:\Windows\System32\DriverStore\FileRepository\netwbw02.inf_amd64_d0afc216e2ec6863\netwbw02.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\net8187bv64.inf_amd64_4295cf068229eafc\net8187bv64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\mrvlpcie8897.inf_amd64_668551398886eaf3\mrvlpcie8897.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netimm.inf_amd64_8b2087393aaef952\netimm.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{d0514e49-1399-1845-a19d-4a5917a86b8d}\mbtun.sys DrvInst.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-10-05_bb64a0caddf1be79707b5bb950a6034e_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-10-05_bb64a0caddf1be79707b5bb950a6034e_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File created C:\Windows\System32\DriverStore\FileRepository\kdnic_legacy.inf_amd64_052adde7f2101c60\kdnic_legacy.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-10-05_bb64a0caddf1be79707b5bb950a6034e_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File created C:\Windows\System32\DriverStore\FileRepository\net1ic64.inf_amd64_93678a2d694d4579\net1ic64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netwns64.inf_amd64_d630255fa92e6727\netwns64.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netrndis.inf_amd64_7559d510c51e5594\netrndis.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netvwifimp.inf_amd64_16c785b9ba77e7b0\netvwifimp.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netg664.inf_amd64_f4299f18c1844724\netg664.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\dc21x4vm.inf_amd64_9512f2b97d63f7fa\dc21x4vm.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netathrx.inf_amd64_ba496c81c003f721\netathrx.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netbxnd0a.inf_amd64_9744de6fd6c11c4f\netbxnd0a.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\Temp\{d0514e49-1399-1845-a19d-4a5917a86b8d}\SET1A71.tmp DrvInst.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94D97B1EC1F43DD6ED4FE7AB95E144BC_38A1221025A0DFB52F454FF8C79E14CC MBAMService.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-10-05_bb64a0caddf1be79707b5bb950a6034e_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File created C:\Windows\System32\DriverStore\FileRepository\netvchannel.inf_amd64_4282c59d3148caa2\netvchannel.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\qcwlan64.inf_amd64_71c84e1405061462\qcwlan64.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File created C:\Windows\System32\DriverStore\FileRepository\netwsw00.inf_amd64_8bd5558c3d9b718a\netwsw00.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netr28ux.inf_amd64_2613a90929adebda\netr28ux.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\wceisvista.inf_amd64_b98fec2fcf3c69e9\wceisvista.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\netrtwlanu.inf_amd64_2814b0012fc3a833\netrtwlanu.PNF MBVpnTunnelService.exe File created C:\Windows\System32\DriverStore\FileRepository\rt640x64.inf_amd64_cbf4e23981c3c8a3\rt640x64.PNF MBVpnTunnelService.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{d0514e49-1399-1845-a19d-4a5917a86b8d}\mbtun.cat DrvInst.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\a2f78a9e7465cd71.bin elevation_service.exe File created C:\Windows\System32\DriverStore\FileRepository\bcmdhd64.inf_amd64_0c3c6ca9708e5a9a\bcmdhd64.PNF MBVpnTunnelService.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe elevation_service.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\ru\PresentationFramework.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\ru\System.Windows.Input.Manipulations.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\System.Private.Windows.GdiPlus.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\ArwControllerImpl.dll MBAMInstallerService.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-10-05_bb64a0caddf1be79707b5bb950a6034e_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe 2026-10-05_bb64a0caddf1be79707b5bb950a6034e_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\ja\PresentationFramework.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\pl\UIAutomationTypes.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\zh-Hant\PresentationCore.resources.dll MBAMInstallerService.exe File opened for modification C:\Program Files\Malwarebytes\Anti-Malware\DDSHelper.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe elevation_service.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\pl\System.Windows.Forms.Design.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\mbcut.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\zh-Hans\Microsoft.VisualBasic.Forms.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\AEControllerImpl.dll MBAMInstallerService.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe elevation_service.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\System.Diagnostics.PerformanceCounter.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\Microsoft.Extensions.DependencyModel.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\SQLitePCLRaw.core.dll MBAMInstallerService.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe elevation_service.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.Xml.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\malwarebytes_assistant.dll MBAMInstallerService.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe elevation_service.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\de\PresentationCore.resources.dll MBAMInstallerService.exe File opened for modification C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-10-05_bb64a0caddf1be79707b5bb950a6034e_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-10-05_bb64a0caddf1be79707b5bb950a6034e_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.Diagnostics.DiagnosticSource.dll MBAMInstallerService.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe elevation_service.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\fr\System.Windows.Input.Manipulations.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.json.bak MBAMInstallerService.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-10-05_bb64a0caddf1be79707b5bb950a6034e_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe 2026-10-05_bb64a0caddf1be79707b5bb950a6034e_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.IO.MemoryMappedFiles.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\System.Resources.Extensions.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\tr\ReachFramework.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.IO.Compression.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\pl\PresentationUI.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\tr\UIAutomationTypes.resources.dll MBAMInstallerService.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-10-05_bb64a0caddf1be79707b5bb950a6034e_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-10-05_bb64a0caddf1be79707b5bb950a6034e_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-10-05_bb64a0caddf1be79707b5bb950a6034e_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\Microsoft.CSharp.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\PresentationNative_cor3.dll MBAMInstallerService.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 2026-10-05_bb64a0caddf1be79707b5bb950a6034e_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.NETCore.App\10.0.8\System.Net.WebSockets.Client.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\cs\UIAutomationTypes.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\ja\UIAutomationTypes.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\zh-Hans\System.Windows.Forms.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\85c533ebc1a011f1bdf7f6d780bea338 MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\Microsoft.WindowsDesktop.App.deps.json MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\zh-Hant\WindowsBase.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\BrowserSDKDLL.dll MBAMInstallerService.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe elevation_service.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\Microsoft.VisualBasic.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\shared\Microsoft.WindowsDesktop.App\10.0.8\pt-BR\WindowsFormsIntegration.resources.dll MBAMInstallerService.exe File created C:\Program Files\Malwarebytes\Anti-Malware\MbamUI.Core.deps.json MBAMInstallerService.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe elevation_service.exe - Drops file in Windows directory 7 IoCs
description ioc Process File created C:\Windows\inf\oem1.inf DrvInst.exe File created C:\Windows\ELAMBKUP\MbamElam.sys MBAMService.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-10-05_bb64a0caddf1be79707b5bb950a6034e_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe File opened for modification C:\Windows\INF\setupapi.dev.log MBVpnTunnelService.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\inf\oem1.inf DrvInst.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 2 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh MBVpnTunnelService.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh MBVpnTunnelService.exe - Modifies trusted root certificate store through registry 1 TTPs 14 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E\Blob = 030000000100000014000000b51c067cee2b0c3df855ab2d92f4fe39d4e70f0e2000000001000000e1030000308203dd308202c5a003020102020100300d06092a864886f70d01010b050030818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a30818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bdedc103fcf68ffc02b16f5b9f48d99d79e2a2b703615618c347b6d7ca3d352e8943f7a1699bde8a1afd13209cb44977322956fdb9ec8cdd22fa72dc276197eef65a84ec6e19b9892cdc845bd574fb6b5fc589a51052894655f4b8751ce67fe454ae4bf85572570219f8177159eb1e280774c59d48be6cb4f4a4b0f364377992c0ec465e7fe16d534c62afcd1f0b63bb3a9dfbfc7900986174cf26824063f3b2726a190d99cad40e75cc37fb8b89c159f1627f5fb35f6530f8a7b74d765a1e765e34c0e89656998ab3f07fa4cdbddc32317c91cfe05f11f86baa495cd19994d1a2e3635b0976b55662e14b741d96d426d4080459d0980e0ee6defcc3ec1f90f10203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147c0c321fa7d9307fc47d68a362a8a1ceab075b27300d06092a864886f70d01010b050003820101001159fa254f036f94993b9a1f828539d47605945ee128936d625d09c2a0a8d4b07538f1346a9de49f8a862651e62cd1c62d6e95204a9201ecb88a677b31e2672e8c9503262e439d4a31f60eb50cbbb7e2377f22ba00a30e7b52fb6bbb3bc4d379514ecd90f4670719c83c467a0d017dc558e76de68530179a24c410e004f7e0f27fd4aa0aff421d37ed94e5645912207738d3323e3881759673fa688fb1cbce1fc5ecfa9c7ecf7eb1f1072db6fcbfcaa4bfd097054abcea18280290bd5478092171d3d17d1dd916b0a9613dd00a0022fcc77bcb0964450b3b4081f77d7c32f598ca588e7d2aee90597364f936745e25a1f566052e7f3915a92afb508b8e8569f4 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa22000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8DA7F965EC5EFC37910F1C6E59FDC1CC6A6EDE16\Blob = 0300000001000000140000008da7f965ec5efc37910f1c6e59fdc1cc6a6ede162000000001000000450300003082034130820229a0030201020213066c9fcf99bf8c0a39e2f0788a43e696365bca300d06092a864886f70d01010b05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412031301e170d3135303532363030303030305a170d3338303131373030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f74204341203130820122300d06092a864886f70d01010105000382010f003082010a0282010100b2788071ca78d5e371af478050747d6ed8d78876f49968f7582160f97484012fac022d86d3a0437a4eb2a4d036ba01be8ddb48c80717364cf4ee8823c73eeb37f5b519f84968b0ded7b976381d619ea4fe8236a5e54a56e445e1f9fdb416fa74da9c9b35392ffab02050066c7ad080b2a6f9afec47198f503807dca2873958f8bad5a9f948673096ee94785e6f89a351c0308666a14566ba54eba3c391f948dcffd1e8302d7d2d747035d78824f79ec4596ebb738717f2324628b843fab71daacab4f29f240e2d4bf7715c5e69ffea9502cb388aae50386fdbfb2d621bc5c71e54e177e067c80f9c8723d63f40207f2080c4804c3e3b24268e04ae6c9ac8aa0d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604148418cc8534ecbc0c94942e08599cc7b2104e0a08300d06092a864886f70d01010b0500038201010098f2375a4190a11ac57651282036230eaee628bbaaf894ae48a4307f1bfc248d4bb4c8a197f6b6f17a70c85393cc0828e39825cf23a4f9de21d37c8509ad4e9a753ac20b6a897876444718656c8d418e3b7f9acbf4b5a750d7052c37e8034bade961a0026ef5f2f0c5b2ed5bb7dcfa945c779e13a57f52ad95f2f8933bde8b5c5bca5a525b60af14f74befa3fb9f40956d3154fc42d3c7461f23add90f48709ad9757871d1724334756e5759c2025c266029cf2319168e8843a5d4e4cb08fb231143e843297262a1a95d5e08d490aeb8d8ce14c2d055f286f6c49343776661c0b9e841d7977860036e4a72aea5d17dba109e866c1b8ab95933f8ebc490bef1b9 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\5A8CEF45D7A69859767A8C8B4496B578CF474B1A\Blob = 0300000001000000140000005a8cef45d7a69859767a8c8b4496b578cf474b1a2000000001000000450500003082054130820329a0030201020213066c9fd29635869f0a0fe58678f85b26bb8a37300d06092a864886f70d01010c05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412032301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f74204341203230820222300d06092a864886f70d01010105000382020f003082020a0282020100ad969f2d9c4a4c4a81795199ec8acb6b605113bc4d6d06fcb0088ddd19106ac7260c35d8c06f2084e994b19b8503c35bdb4ae8c8f89076d95b4fe34ce806364dcc9aac3d0c902b92d4061960ac374479858182ad5a37e00dcc9da64c5276ea439db704d150f655e0d5d2a64985e937e9ca7eae5c954d489a3fae205a6d8895d934b8521a4390b0bf6c05b9b678b7ead0e43a3c125362ff4af27bbe3505a91234e3f36474622c3d00495a28fe3244bb87dd652702713bda4af71fdacdf72155904f0fecae82e19f6bd945d3bbf05f87ed3c2c3986da3fdeec7255eb79a3addbdd7cb0ba1ccefcde4f3576cf0ff8781f6a36514627615be99ecff0a2557d7c258a6f2fb4c5cf842e2bfd0d51106cfb5f1bbc1b7ec5ae3b98013192ff0b57f49ab2b957e9abef0d76d1f0eef4ce86a7e06ee9b469a1df69f633c6692e97139ea587b057108137c953b3bb7ff692d19cd018f4926eda834fa663994ca5fb5eef21647a205f6c648515cb37e9620c0b2a16dc012e32da3e4bf59e3af6174094ef9e910886fabe63a85a33eccb744395f96c695236c7296ffc55035c1ffb9fbd47ebe74947950b4e89220949e0f5611ef1bf2e8a726e8059ff573af97532a34e5feced2862d94d73f2cc811760edcdebdcdba7cac57e02bdf2540854fdb42d092c17544a98d154e1516708d2ed6e7e6f3fd22d81592966cb903995111e7427feddebaf0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414b00cf04c30f405580248fd33e552af4b84e36652300d06092a864886f70d01010c05000382020100aaa8808f0e78a3e0a2d4cde6f5987a3bea0003b0970e93bc5aa8f62c8c7287a9b1fc7f73fd637178a58759cf30e10d10b2135a6d82f56ae6809fa0050b68e4476bc76adfb6fd773272e518fa09f4a0932c5dd28c75857665900c0379b7312363ad788309866884cafff9cf269a9279e7cd4bc5e761a717cbf3a91293936ba7e82f5392c46058b0cc0251185b858d625963b6adb4de9afb26f70027c05d55377499c9507fe3592e44e32c25eeec4c3277b49f1ae94b5d20c5dafd1c8716c643e8d4bb269a45705ea90b3753e2467b27fde046f289b7cc42b6cb28266ed9a5c93ac8411360f7508c15aeb26d1a151a5778e6922ad96590823f6c02afae123a27963604d71da28063a99bf1e5bab47c14b04ec9b11f745f38f651ea9bfa2ca211d4a92d271a45b1afb24e710dc05846d66906cb53cbb3fe6b41cd417e7d4c0f7c72797a59cd5e4a0eac9ba99873797cb4f4ccb9b8070cb2745cb8c76f88a190a7f4aaf9bf673af41a15621eb79fbe3db129af67a112f25810195303301bb81a89f69cbd97038ea309f31d8b21f1b4dfe41cd19f650206ea5cd613b384efa2a55c8c7729a768c06bae40d2a8b4eacdf08d4b389c199a1b2854b88990efca75813e1ef26424c718af4eff479e07f63565a4d30a56fff517646cefa822254993b6df0017da587e5deec51bb0d1d15f2110c7f9f3ba020a2707c5f1d6c7d3e0fb09606c MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0D44DD8C3C8C1A1A58756481E90F2E2AFFB3D26E\Blob = 0300000001000000140000000d44dd8c3c8c1a1a58756481e90f2e2affb3d26e2000000001000000ba010000308201b63082015ba0030201020213066c9fd5749736663f3b0b9ad9e89e7603f24a300a06082a8648ce3d0403023039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412033301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f7420434120333059301306072a8648ce3d020106082a8648ce3d030107034200042997a7c6417fc00d9be8011b56c6f252a5ba2db212e8d22ed7fac9c5d8aa6d1f73813b3b986b397c33a5c54e868e8017686245577d44581db337e56708eb66dea3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414abb6dbd7069e37ac3086079170c79cc419b178c0300a06082a8648ce3d0403020349003046022100e08592a317b78df92b06a593ac1a98686172fae1a1d0fb1c7860a64399c5b8c40221009c02eff1949cb396f9ebc62af8b62cfe3a901416d78c6324481cdf307dd5683b MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F6108407D6F8BB67980CC2E244C2EBAE1CEF63BE\Blob = 030000000100000014000000f6108407d6f8bb67980cc2e244c2ebae1cef63be2000000001000000f6010000308201f230820178a0030201020213066c9fd7c1bb104c2943e5717b7b2cc81ac10e300a06082a8648ce3d0403033039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412034301e170d3135303532363030303030305a170d3430303532363030303030305a3039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f7420434120343076301006072a8648ce3d020106052b8104002203620004d2ab8a374fa3530dfec18a7b4ba87b464b63b062f62d1bdb087121d200e863bd9a27fbf0396e5dea3da5c981aaa35b2098455d16dbfde8106de39ce0e3bd5f8462f3706433a0cb242f70ba88a12aa075f881ae6206c481db396e29b01efa2e5ca3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414d3ecc73a656ecce1da769a56fb9cf3866d57e581300a06082a8648ce3d040303036800306502303a8b21f1bd7e11add0ef58962fd6eb9d7e908d2bcf6655c32ce328a9700a470ef0375912ff2d9994284e2a4f354d335a023100ea75004e3bc43a941291c958469d211372a7889c8ae44c4adb96d4ac8b6b6b49125333add7e4be24fcb50a76d4a5bc10 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\2AD974A775F73CBDBBD8F5AC3A49255FA8FB1F8C\Blob = 0300000001000000140000002ad974a775f73cbdbbd8f5ac3a49255fa8fb1f8c2000000001000000620400003082045e30820346a0030201020213077312380b9d6688a33b1ed9bf9ccda68e0e0f300d06092a864886f70d01010b05003039310b3009060355040613025553310f300d060355040a1306416d617a6f6e3119301706035504031310416d617a6f6e20526f6f742043412031301e170d3232303832333232323132385a170d3330303832333232323132385a303c310b3009060355040613025553310f300d060355040a1306416d617a6f6e311c301a06035504031313416d617a6f6e205253412032303438204d303130820122300d06092a864886f70d01010105000382010f003082010a0282010100eb712ca9cb1f8828923230af8a570f78b73725955587ac675c97d322c8daa214676b7cf067dae2032ab356125dc6b547f96708a7937a9592180fb4f9f910369a7f2f80b64fba134ec75d531ee0dd96330720d396bc12e4745042a1051373b54f9b4424fe2d7fedbc2285ec362133977506ce271882dce3d9c582078d5e26012626671fd93f13cf32ba6bad7864fcaaff0e023c07df9c0578728cfdea75b7032884dae86e078cd05085ef8154b2716eec6d62ef8f94c35ee9c4a4d091c02e249198caeeba258ed4f671b6fb5b6b38064837478d86dcf2ea06fb76377d9eff424e4d588293cfe271c278b17aab4b5b94378881e4d9af24aef872c565fb4bb451e70203010001a382015a3082015630120603551d130101ff040830060101ff020100300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030106082b06010505070302301d0603551d0e0416041481b80e638a891218e5fa3b3b50959fe6e5901385301f0603551d230418301680148418cc8534ecbc0c94942e08599cc7b2104e0a08307b06082b06010505070101046f306d302f06082b060105050730018623687474703a2f2f6f6373702e726f6f746361312e616d617a6f6e74727573742e636f6d303a06082b06010505073002862e687474703a2f2f6372742e726f6f746361312e616d617a6f6e74727573742e636f6d2f726f6f746361312e636572303f0603551d1f043830363034a032a030862e687474703a2f2f63726c2e726f6f746361312e616d617a6f6e74727573742e636f6d2f726f6f746361312e63726c30130603551d20040c300a3008060667810c010201300d06092a864886f70d01010b05000382010100ad00de0205232e063262b46bb19416e41140de2bfa59c135efe0aa8f2b41b9d1f38739001df23db5a7470c0606c691f3075702d4edbd17c1909abf4875a2074f30dd4a6a42b50d3d15c00ffe845bc63c99cc5752b1d86e12d59692934b94e507e88982086a7a34d49e64e13d876a92909a63a14bf88fb6ea34d305be20c2de06e28c9f738b9f4d3985cace19369d85c99ec9f8503fb67e88a1efca84068b50b40a5ca61c44f1fdc8614060f26125aa07f4c7c27375e40c0b428d04e55f4448995b7b898196a7889d4b0d62e804c4d7feb4e8b26dcaecc01cbc385b1ddf85ce5b7ae3494b6cb9a7ddf405b249ade1c5146bc2ccebcd7fd65869bac3207e7fb0b8 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 6b00000001000000200000005367f20c7ade0e2bca790915056d086b720c33c1fa2a2661acf787e3292e1270140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a2030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa20f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e1900000001000000100000009f687581f7ef744ecfc12b9cee6238f12000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 MBAMService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54362000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\1C58A3A8518E8759BF075B76B750D4F2DF264FCD\Blob = 0300000001000000140000001c58a3a8518e8759bf075b76b750d4f2df264fcd2000000001000000c2040000308204be308203a6a003020102021006d8d904d5584346f68a2fa754227ec4300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3231303431343030303030305a170d3331303431333233353935395a304f310b300906035504061302555331153013060355040a130c446967694365727420496e633129302706035504031320446967694365727420544c53205253412053484132353620323032302043413130820122300d06092a864886f70d01010105000382010f003082010a0282010100c14bb3654770bcdd4f58dbec9cedc366e51f311354ad4a66461f2c0aec6407e52edcdcb90a20eddfe3c4d09e9aa97a1d8288e51156db1e9f58c251e72c340d2ed292e156cbf1795fb3bb87ca25037b9a52416610604f571349f0e8376783dfe7d34b674c2251a6df0e9910ed57517426e27dc7ca622e131b7f238825536fc13458008b84fff8bea75849227b96ada2889b15bca07cdfe951a8d5b0ed37e236b4824b62b5499aecc767d6e33ef5e3d6125e44f1bf71427d58840380b18101faf9ca32bbb48e278727c52b74d4a8d697dec364f9cace53a256bc78178e490329aefb494fa415b9cef25c19576d6b79a72ba2272013b5d03d40d321300793ea99f50203010001a38201823082017e30120603551d130101ff040830060101ff020100301d0603551d0e04160414b76ba2eaa8aa848c79eab4da0f98b2c59576b9f4301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030106082b06010505070302307606082b06010505070101046a3068302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304006082b060105050730028634687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274476c6f62616c526f6f7443412e63727430420603551d1f043b30393037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274476c6f62616c526f6f7443412e63726c303d0603551d2004363034300b06096086480186fd6c02013007060567810c01013008060667810c0102013008060667810c0102023008060667810c010203300d06092a864886f70d01010b050003820101008032ce5e0bdd6e5a0d0aafe1d684cbc08efa8570edda5db30cf72b7540fe850afaf33178b7704b1a8958ba80bdf36b1de97ecf0bba589c59d490d3fd6cfdd0986db771825bcf6d0b5a09d07bdec443d82aa4de9e41265fbb8f99cbddaee1a86f9f87fe74b71f1b20abb14fc6f5675d5d9b3ce9ff69f7616cd6d9f3fd36c6ab038876d24b2e7586e3fcd8557d26c21177df3e02b67cf3ab7b7a86366fb8f7d89371cf86df7330fa7babed2a59c842843b11171a52f3c90e147da25b7267ba71ed574766c5b8024a65345e8bd02a3c209c51994ce7529ef76b112b0d927e1de88aeb36164387ea2a63bf753febdec403bb0a3cf730efebaf4cfc8b3610733ef3a4 MBAMInstallerService.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 5c0000000100000004000000001000001900000001000000100000009f687581f7ef744ecfc12b9cee6238f10f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa2140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a26b00000001000000200000005367f20c7ade0e2bca790915056d086b720c33c1fa2a2661acf787e3292e12702000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 MBAMService.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 12 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname Malwarebytes.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 2026-10-05_bb64a0caddf1be79707b5bb950a6034e_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname MBAMService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname mbrescue.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain Malwarebytes.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 2026-10-05_bb64a0caddf1be79707b5bb950a6034e_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname MBAMInstallerService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain MBAMInstallerService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname elevation_service.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain elevation_service.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain MBAMService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain mbrescue.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-05_bb64a0caddf1be79707b5bb950a6034e_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 52 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe - Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MBAMService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MBAMService.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Malwarebytes.exe = "11000" MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION MBAMService.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\mbam.exe = "11000" MBAMService.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\mbamtray.exe = "11000" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION MBAMInstallerService.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:\ MBAMInstallerService.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000008649c542ad55dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Malwarebytes MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\16.0\Common\Security MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\16.0 MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-19\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005be40e42ad55dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:\ MBAMInstallerService.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes: MBAMInstallerService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000074c04d43ad55dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT MBAMService.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000006c6c042ad55dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0\Common\Security MBAMInstallerService.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000066a0df41ad55dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data." SearchProtocolHost.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F415899A-1576-4C8B-BC9F-4854781F8A20}\Version MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D5599B6B-FA0C-45B5-8309-853B003EA412}\Programmable MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DE03E614-112D-43E0-8E15-E7236CC32108}\ProgID\ = "MB.TelemetryController.1" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9DAB0CA5-AE19-41AE-955C-41DD44C52697} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A0B9A582-5C93-41EF-A196-75B1DE8D4A8A}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BAFDF38F-72A8-4791-AACC-72EB8E09E460}\TypeLib\ = "{783B187E-360F-419C-B6DA-592892764A01}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C47DD110-0C5F-4BC1-B2B1-B4518D5D9479}\ = "IMBAMServiceControllerV14" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7CCF1A92-E4E0-4EA8-8ADF-79561962D419}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{563D4D90-1666-4949-AC2E-E39DB953DF70}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DD67766C-A28D-44F3-A5D0-962965510B2D} MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{993A5C11-A9B8-41E9-9088-C5182B1F279A}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CC4D9C86-78F2-435F-8355-5328509E04F1}\ = "ITelemetryControllerV4" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D1E6E99C-9728-4244-9570-215B400D226D}\TypeLib\ = "{226C1698-A075-4315-BB5D-9C164A96ACE7}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{620A01DD-16D2-4A83-B02C-E29BE38B3029}\ = "_IUpdateControllerEventsV2" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{893E5593-9490-4E90-9F1E-0B786EC41470}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31BF2366-C6DB-49F1-96A5-8026B9DF4152}\TypeLib\Version = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3641B831-731C-4963-B50B-D84902285C26}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{25321640-5EF1-4095-A0DA-30DE19699441}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7C710FA9-862A-40CF-9F54-063EF8FC8438}\TypeLib\Version = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C8952062-7422-4BAD-8A60-94E21F5CFE7C} MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{473BC184-760C-4255-A118-E8064C4EC595} MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D0E28CBC-BED5-4CF8-8696-4DFF648BBE83}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8640989C-20B4-41BE-BFE1-218EF5B076A6}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8640989C-20B4-41BE-BFE1-218EF5B076A6}\TypeLib\Version = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB30855D-36DF-41BD-9EEE-03BA7E8E70B7}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5091804-600E-4226-BF28-80ABFDF4AFAB}\ = "IScanner" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C7BCC13C-47B9-4DC0-8FC6-B2A489EF60EF}\TypeLib MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BADF77CD-ECCE-4B36-88FF-6A2804FFE307}\TypeLib\ = "{5709DEEB-F05E-4D5C-8DC4-3B0D924EE08F}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{25321640-5EF1-4095-A0DA-30DE19699441}\TypeLib\ = "{A82129F1-32E1-4D79-A39F-EBFEE53A70BF}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{698A4513-65F0-46A3-9633-220A6E4D1D07}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MB.MBAMServiceController\CurVer MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D57ACF19-30E3-4B7E-BCDD-6EEB8E57AF27}\TypeLib\ = "{332AFEBA-9341-4CEC-8EA6-DB155A99DF63}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6EC225D5-FD37-4F9B-B80F-09FAE36103AE}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4163399F-AB08-4E5E-BE28-6B9440393AD3}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B3FCAA7C-EA26-43E6-A312-CDB85491DDD8}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E1AC7139-D1FF-4DE9-84A4-92E2B47F5D2A}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\"" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{50538523-AA2F-40D3-9B58-DB51D5BD3D4A}\ = "_IMBAMServiceControllerEventsV3" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1097B101-1FF8-4DD8-A6C1-6C39FB2EA5D6}\TypeLib\ = "{5709DEEB-F05E-4D5C-8DC4-3B0D924EE08F}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CE7ABFE9-8F8F-4EDD-86BD-9209FD072126}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{226C1698-A075-4315-BB5D-9C164A96ACE7} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B44D50B8-E459-4078-9249-3763459B2676}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{836B5F21-DD6B-4DF2-8377-C00A03DEE2FC}\ = "_IMWACControllerEventsV14" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E95BF32A-DE84-4E41-B836-E2A7BAB962AF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B38EDC4F-A2CD-4F76-8607-F123FE4031D5}\ = "IScanControllerV12" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{716C74C4-80C9-4CEB-A5E6-9E3F5F209D9B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FFB9BE53-8FE4-4B61-9C25-18E5B4B202E8}\TypeLib\ = "{332AFEBA-9341-4CEC-8EA6-DB155A99DF63}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BE6DEC4E-1BDE-49DA-AFDD-D979539A9A0D}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{636AD0C8-854C-46A5-8442-E5EE74723B3C}\TypeLib\Version = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4412646D-16F5-4F3C-8348-0744CDEBCCBF} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{07B91244-8A85-4196-8904-7681CD9C42A6}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0C4652FC-FA35-4394-A133-F68409776465} MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E3B068E5-020E-4E96-AE08-76292A138FB8}\ProxyStubClsid32 MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8307A4A5-A025-438B-B23B-8EE38A453D54}\ = "ILicenseController" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E7DAEEB9-30B6-4AC4-BB74-7763C950D8EC} MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{014D0CF7-ACC9-4004-B999-7BDBAAD274B7} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{97EB7268-0D7B-43F6-9C11-337287F960DF}\TypeLib\Version = "1.0" MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2E3F70EF-D9BE-485F-A6F5-816DD0EDC757}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{17A7CC72-3288-442A-ABE8-F8E049B3BE83}\TypeLib MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0E2822AB-0447-4F28-AF4C-FFDB1E8595AE}\1.0\0 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{59E42E77-5F19-4602-A559-3FFA9EE51202} MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{983849D5-BFE9-43E9-A9A0-CBAFBC917F39}\ = "_ICleanControllerEventsV4" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1E3F0FEC-3E40-4137-8C7D-090AFA9B6C5E}\ = "_ITelemetryControllerEvents" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{01222402-A8AB-4183-8843-8ADBF0B11869}\TypeLib\Version = "1.0" MBAMService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D6A9933-FB41-45C4-9C1C-762D3562BBE3}\TypeLib\Version = "1.0" MBAMService.exe - Modifies system certificate store 2 TTPs 13 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\5A8CEF45D7A69859767A8C8B4496B578CF474B1A MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0D44DD8C3C8C1A1A58756481E90F2E2AFFB3D26E MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2 MBAMService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F6108407D6F8BB67980CC2E244C2EBAE1CEF63BE MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\1C58A3A8518E8759BF075B76B750D4F2DF264FCD MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\2AD974A775F73CBDBBD8F5AC3A49255FA8FB1F8C MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2 MBAMInstallerService.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8DA7F965EC5EFC37910F1C6E59FDC1CC6A6EDE16 MBAMInstallerService.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4156 2026-10-05_bb64a0caddf1be79707b5bb950a6034e_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 4156 2026-10-05_bb64a0caddf1be79707b5bb950a6034e_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 4156 2026-10-05_bb64a0caddf1be79707b5bb950a6034e_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 4156 2026-10-05_bb64a0caddf1be79707b5bb950a6034e_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 4156 2026-10-05_bb64a0caddf1be79707b5bb950a6034e_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 4156 2026-10-05_bb64a0caddf1be79707b5bb950a6034e_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 4156 2026-10-05_bb64a0caddf1be79707b5bb950a6034e_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 4156 2026-10-05_bb64a0caddf1be79707b5bb950a6034e_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 4156 2026-10-05_bb64a0caddf1be79707b5bb950a6034e_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 4156 2026-10-05_bb64a0caddf1be79707b5bb950a6034e_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 4156 2026-10-05_bb64a0caddf1be79707b5bb950a6034e_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 4156 2026-10-05_bb64a0caddf1be79707b5bb950a6034e_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 4156 2026-10-05_bb64a0caddf1be79707b5bb950a6034e_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 4156 2026-10-05_bb64a0caddf1be79707b5bb950a6034e_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 4156 2026-10-05_bb64a0caddf1be79707b5bb950a6034e_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 4156 2026-10-05_bb64a0caddf1be79707b5bb950a6034e_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 4156 2026-10-05_bb64a0caddf1be79707b5bb950a6034e_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 4156 2026-10-05_bb64a0caddf1be79707b5bb950a6034e_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 4156 2026-10-05_bb64a0caddf1be79707b5bb950a6034e_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 4156 2026-10-05_bb64a0caddf1be79707b5bb950a6034e_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 4156 2026-10-05_bb64a0caddf1be79707b5bb950a6034e_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 4156 2026-10-05_bb64a0caddf1be79707b5bb950a6034e_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 4156 2026-10-05_bb64a0caddf1be79707b5bb950a6034e_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 4156 2026-10-05_bb64a0caddf1be79707b5bb950a6034e_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 4156 2026-10-05_bb64a0caddf1be79707b5bb950a6034e_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 4156 2026-10-05_bb64a0caddf1be79707b5bb950a6034e_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 4156 2026-10-05_bb64a0caddf1be79707b5bb950a6034e_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 4156 2026-10-05_bb64a0caddf1be79707b5bb950a6034e_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 4156 2026-10-05_bb64a0caddf1be79707b5bb950a6034e_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 4156 2026-10-05_bb64a0caddf1be79707b5bb950a6034e_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 4760 MBAMInstallerService.exe 4760 MBAMInstallerService.exe 4760 MBAMInstallerService.exe 4760 MBAMInstallerService.exe 4760 MBAMInstallerService.exe 4760 MBAMInstallerService.exe 4760 MBAMInstallerService.exe 4760 MBAMInstallerService.exe 4760 MBAMInstallerService.exe 4760 MBAMInstallerService.exe 4760 MBAMInstallerService.exe 4760 MBAMInstallerService.exe 4760 MBAMInstallerService.exe 4760 MBAMInstallerService.exe 4760 MBAMInstallerService.exe 4760 MBAMInstallerService.exe 4760 MBAMInstallerService.exe 4760 MBAMInstallerService.exe 4760 MBAMInstallerService.exe 4760 MBAMInstallerService.exe 4760 MBAMInstallerService.exe 4760 MBAMInstallerService.exe 4760 MBAMInstallerService.exe 4760 MBAMInstallerService.exe 4760 MBAMInstallerService.exe 4760 MBAMInstallerService.exe 4760 MBAMInstallerService.exe 4760 MBAMInstallerService.exe 4760 MBAMInstallerService.exe 4760 MBAMInstallerService.exe 4468 MBAMService.exe 4468 MBAMService.exe 4468 MBAMService.exe 4468 MBAMService.exe - Suspicious behavior: LoadsDriver 13 IoCs
pid Process 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4156 2026-10-05_bb64a0caddf1be79707b5bb950a6034e_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe Token: SeBackupPrivilege 5260 ReFsDedupSvc.exe Token: SeRestorePrivilege 5260 ReFsDedupSvc.exe Token: SeBackupPrivilege 5260 ReFsDedupSvc.exe Token: SeRestorePrivilege 5260 ReFsDedupSvc.exe Token: SeBackupPrivilege 5260 ReFsDedupSvc.exe Token: SeRestorePrivilege 5260 ReFsDedupSvc.exe Token: SeBackupPrivilege 5260 ReFsDedupSvc.exe Token: SeRestorePrivilege 5260 ReFsDedupSvc.exe Token: SeBackupPrivilege 5260 ReFsDedupSvc.exe Token: SeRestorePrivilege 5260 ReFsDedupSvc.exe Token: SeAssignPrimaryTokenPrivilege 1560 AgentService.exe Token: 33 5404 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 5404 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 5404 SearchIndexer.exe Token: SeDebugPrivilege 4156 2026-10-05_bb64a0caddf1be79707b5bb950a6034e_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe Token: SeDebugPrivilege 4156 2026-10-05_bb64a0caddf1be79707b5bb950a6034e_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe Token: SeDebugPrivilege 4156 2026-10-05_bb64a0caddf1be79707b5bb950a6034e_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe Token: SeDebugPrivilege 4156 2026-10-05_bb64a0caddf1be79707b5bb950a6034e_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe Token: SeDebugPrivilege 4760 MBAMInstallerService.exe Token: SeDebugPrivilege 4760 MBAMInstallerService.exe Token: SeDebugPrivilege 4760 MBAMInstallerService.exe Token: SeDebugPrivilege 4760 MBAMInstallerService.exe Token: SeDebugPrivilege 4760 MBAMInstallerService.exe Token: SeDebugPrivilege 4760 MBAMInstallerService.exe Token: SeDebugPrivilege 4760 MBAMInstallerService.exe Token: SeDebugPrivilege 4760 MBAMInstallerService.exe Token: SeDebugPrivilege 4760 MBAMInstallerService.exe Token: SeDebugPrivilege 4760 MBAMInstallerService.exe Token: SeDebugPrivilege 4760 MBAMInstallerService.exe Token: SeDebugPrivilege 4760 MBAMInstallerService.exe Token: SeDebugPrivilege 4760 MBAMInstallerService.exe Token: SeDebugPrivilege 4760 MBAMInstallerService.exe Token: SeDebugPrivilege 4760 MBAMInstallerService.exe Token: SeDebugPrivilege 4760 MBAMInstallerService.exe Token: SeDebugPrivilege 4760 MBAMInstallerService.exe Token: SeDebugPrivilege 4760 MBAMInstallerService.exe Token: SeDebugPrivilege 4760 MBAMInstallerService.exe Token: SeDebugPrivilege 4760 MBAMInstallerService.exe Token: SeDebugPrivilege 4760 MBAMInstallerService.exe Token: SeDebugPrivilege 4760 MBAMInstallerService.exe Token: SeDebugPrivilege 4760 MBAMInstallerService.exe Token: SeDebugPrivilege 4760 MBAMInstallerService.exe Token: SeDebugPrivilege 4760 MBAMInstallerService.exe Token: SeDebugPrivilege 4760 MBAMInstallerService.exe Token: SeDebugPrivilege 4760 MBAMInstallerService.exe Token: SeDebugPrivilege 4760 MBAMInstallerService.exe Token: SeDebugPrivilege 4760 MBAMInstallerService.exe Token: SeDebugPrivilege 4760 MBAMInstallerService.exe Token: SeDebugPrivilege 4760 MBAMInstallerService.exe Token: SeDebugPrivilege 4760 MBAMInstallerService.exe Token: SeDebugPrivilege 4760 MBAMInstallerService.exe Token: SeDebugPrivilege 4760 MBAMInstallerService.exe Token: SeDebugPrivilege 4760 MBAMInstallerService.exe Token: SeDebugPrivilege 4760 MBAMInstallerService.exe Token: SeDebugPrivilege 4760 MBAMInstallerService.exe Token: SeDebugPrivilege 4760 MBAMInstallerService.exe Token: SeDebugPrivilege 4760 MBAMInstallerService.exe Token: SeDebugPrivilege 4760 MBAMInstallerService.exe Token: SeDebugPrivilege 4760 MBAMInstallerService.exe Token: SeDebugPrivilege 4760 MBAMInstallerService.exe Token: SeDebugPrivilege 4760 MBAMInstallerService.exe Token: SeDebugPrivilege 4760 MBAMInstallerService.exe Token: SeDebugPrivilege 4760 MBAMInstallerService.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4156 2026-10-05_bb64a0caddf1be79707b5bb950a6034e_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 5404 wrote to memory of 4956 5404 SearchIndexer.exe 101 PID 5404 wrote to memory of 2396 5404 SearchIndexer.exe 102 PID 5404 wrote to memory of 3488 5404 SearchIndexer.exe 103 PID 5404 wrote to memory of 936 5404 SearchIndexer.exe 104 PID 4760 wrote to memory of 4536 4760 MBAMInstallerService.exe 108 PID 4760 wrote to memory of 1968 4760 MBAMInstallerService.exe 114 PID 4468 wrote to memory of 5100 4468 MBAMService.exe 131 PID 4156 wrote to memory of 3392 4156 2026-10-05_bb64a0caddf1be79707b5bb950a6034e_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe 134 PID 3392 wrote to memory of 1884 3392 Malwarebytes.exe 135
Processes
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS1⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\2026-10-05_bb64a0caddf1be79707b5bb950a6034e_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-05_bb64a0caddf1be79707b5bb950a6034e_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Downloads MZ/PE file
- Drops file in Drivers directory
- Checks BIOS information in registry
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4156
-
-
C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe"C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe"C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
PID:1884
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
PID:5776
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1876
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:4372
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:2936
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:5284
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2768
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5260
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3416
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:2996
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1560
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5404 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:4956
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:2396
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 952 3060 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵
- Modifies data under HKEY_USERS
PID:3488
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 952 3024 3056 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:936
-
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- Modifies trusted root certificate store through registry
- Reads the TCP/IP host and domain name from the registry
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe" /installmbtun2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
PID:4536
-
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe" /Service /Protected2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
PID:1968
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "9" "C:\Program Files\Malwarebytes\Anti-Malware\mbtun\mbtun.inf" "9" "4ba9030c7" "000000000000016C" "Service-0x0-3e7$\Default" "000000000000017C" "208" "C:\Program Files\Malwarebytes\Anti-Malware\mbtun"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:4412
-
C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Event Triggered Execution: Netsh Helper DLL
PID:4440
-
C:\Windows\system32\DRIVERS\MbamElam.sysC:\Windows\system32\DRIVERS\MbamElam.sys1⤵
- Executes dropped EXE
PID:1812
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Modifies trusted root certificate store through registry
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\ProgramData\Malwarebytes\MBAMService\rmode\mbrescue.exe"C:\ProgramData\Malwarebytes\MBAMService\rmode\mbrescue.exe" /rescuemode "C:\Program Files\Malwarebytes\Anti-Malware" "C:\ProgramData\Malwarebytes\MBAMService"2⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:5100
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k AppReadiness -p -s AppReadiness1⤵PID:5660
-
C:\Windows\system32\DRIVERS\mbamswissarmy.sysC:\Windows\system32\DRIVERS\mbamswissarmy.sys1⤵
- Executes dropped EXE
PID:3052
-
C:\Windows\system32\DRIVERS\MbamChameleon.sysC:\Windows\system32\DRIVERS\MbamChameleon.sys1⤵
- Executes dropped EXE
PID:4232
-
C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Event Triggered Execution: Netsh Helper DLL
PID:1356
-
C:\Windows\system32\DRIVERS\mbam.sysC:\Windows\system32\DRIVERS\mbam.sys1⤵
- Executes dropped EXE
PID:5076
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
2Component Object Model Hijacking
1Netsh Helper DLL
1Privilege Escalation
Access Token Manipulation
1Parent PID Spoofing
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
2Component Object Model Hijacking
1Netsh Helper DLL
1Defense Evasion
Access Token Manipulation
1Parent PID Spoofing
1Impair Defenses
1Safe Mode Boot
1Modify Registry
3Subvert Trust Controls
2Install Root Certificate
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\PROGRA~1\MALWAR~1\ANTI-M~1\mbtun\mbtun.cat
- Size 10KB
- SHA256 9ceb410494b95397ec1f8fa505d071672bf61f81cc596b8eccd167a77893c658
- MD5 8abff1fbf08d70c1681a9b20384dbbf9
- SHA1 c9762e121e4f8a7ad931eee58ee60c8e9fc3ecb6
- SHA512 37998e0aee93ff47fe5b1636fce755966debe417a790e1aebd7674c86c1583feef04648a7bc79e4dedaabb731051f4f803932ac49ea0be05776c0f4d218b076f
- SSDEEP 192:gM6dynJCSEJOL7yKnUi8rFWQFIGjl8zjEswYt1FfRM/GX01k9z3AeOlFa:gqS4CFRWGjl8M8/fi/GR9z/OlFa
- TLSH T1B43208E1897D84C2ED87A87147E8E5977C3C1BCB2C5055A911ABF7600AA33C6E71853D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\PROGRA~1\MALWAR~1\ANTI-M~1\mbtun\mbtun.sys
- Size 107KB
- SHA256 6903e60784b9fa5d8b417f93f19665c59946a4de099bd1011ab36271b267261c
- MD5 83d4fba999eb8b34047c38fabef60243
- SHA1 25731b57e9968282610f337bc6d769aa26af4938
- SHA512 47faab5fff3e3e2d2aea0a425444aa2e215f1d5bf97edee2a3bb773468e1092919036bcd5002357594b62519bf3a8980749d8d0f6402de0e73c2125d26e78f1e
- SSDEEP 1536:k0h5S895dQOYJaryTmbMc6uqkZUcmSl47AjpdAyDCYJqUufIfmNn3VzwZ6Dh7Q9y:C895uOYJar1MLcmSlrSgC6Duls2t
- TLSH T174B36C9DA1783089DE42A6B482B98793EFB4357A2B1177BF01E1C1748F537C0DB29DA4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 5d1e1b47a63eb0499abba3967403f91a7cb9e3d85cb01f2707a6a1c65bc9d94b
- MD5 bc1ecf0c41f72ea831f04b62af4d02cf
- SHA1 94b7e27e5ca63b88d15e9359710fb1095f33bf00
- SHA512 273489a4c153f7edca307783058c533bfc4dcffc052bc7576bb2e751353b830c94aefd413dbe8f5912882e4a2090dfaa2cf38804bfc23f47569b38597ceec893
- SSDEEP 49152:Ub+632BuPkFKRrdE6ohdstBhuXjfS4LWxnnLNiXicJFFRGNzj3:O3q6mjBI7wRGpj3
- TLSH T1F0D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.5MB
- SHA256 0056fb52d8aa7a1a7c50179692fe4bd39f011f1735de958074b91970c5fe531f
- MD5 f2de0851e78e42c565b0f1b44f998239
- SHA1 3a94e925ee101323ae0bed02a7fc45ad922b3546
- SHA512 0ba9996e08c71627af6370991d759333b432d0e88a66dba5b9bb8c8abda6e07b2459838ad6f06b635b18f6ff1e02dfc4e204385358cd466134985fb03e4f4fe5
- SSDEEP 24576:tXYfDtczAU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:4tcdLNiXicJFFRGNzj3
- TLSH T1FA75012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.5MB
- SHA256 2c07bb8c459d466951e3f9af682f46b437b4f9157afb2988211524d5b9f0654e
- MD5 c8997d7704199aed3b9ad4f4c4e1db67
- SHA1 9ee57a0848145aaab71c862adeee836f1c347426
- SHA512 9f24764a6719891010c1081026ca5658ea18348d18505eb5d019193a4809209e63854808e22646d857fbbf25e5438307fc83be41d7db2bb5a8605ddd3e74088b
- SSDEEP 24576:xwuROWy/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:xwSOFLNiXicJFFRGNzj3
- TLSH T1E165F18632980CF9EAB641398657C035F7F2BC152A21DB5F5360C65B6F37361AE2DB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 37ec281bb8d3e092788cdd9a58810735a32594aa3a945b36d280d4b0c4337dcd
- MD5 528b78f51c6dba6a3f281444c2d8f45d
- SHA1 1400f495f22a3f401d65ebd9ed9771c63a297c8a
- SHA512 ff4fefe6a3cacff8192228d1b1d46815f15c6822e9068b000ea009c2a6316c0ba7dcfacabbc90e31e5cec445872c4c8c2771323218939d910520d06783e017df
- SSDEEP 49152:LB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glkLNiXicJFFRGNzj3:du6JmIxd2dk7wRGpj3
- TLSH T11CD59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
- Size 9.3MB
- SHA256 09dddf618d0e0ef31552efe2276bb18944f796f8bd7332fd140b0c28f81e8cea
- MD5 51cb35475d448144d3acdc80df871742
- SHA1 da85f01601b42a30cc9d7f0188671a1f0b809a11
- SHA512 9ff92c1fd097e5c12d8da3170c4363ba0d5a9071d5c8d444a4dc3049e5d9beef7927cd7517c648034a1178edc9ab35934f84c64aa4e4c0f20c6cb4dd2351bcee
- SSDEEP 196608:3imNPUl0q13KubyWAmKql9076yPZ+C902J:yaPUl0q1aubyzMl2xP
- TLSH T17CA69E17A2E801E8D4F6D138CA578613E7B2B84643B197DF0790957A1F63BE19E3EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
- Size 4.1MB
- SHA256 a67f94a3014d93b9b91f0c8427c81cc18cb13239a114d91c51f993702e60a580
- MD5 88138b3ddd9b2800ea155743aa26fe87
- SHA1 0b45bd01e388bf4821a3caa09e78033588f66667
- SHA512 4f2f2f04c1b3c1d55731d7dc55fa3ee09385b8f77084e79ebde5252242008eb3362beb9b50b3ea8934acc471dcef67763f20d5268f6cb18bfb98926e4189c3b3
- SSDEEP 49152:0JxO5tmuSoHE4RtMMoLPqf/nkMq1BmwlxMOqSv6bi36i6X43jtPQ6zU+5pAqIPIS:8Y5tY4RMk6lxMObN6/tbH
- TLSH T188168D57A7A901E8D8A6C23CC4678603E7B2BC151770A7CF0664627A1FB3AD25F3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\PoliciesControllerImpl.dll
- Size 6.1MB
- SHA256 cd1e8f98551fb69d3d47837c09fea35be358dd7c27104afb7f1938a7fadbb2c5
- MD5 436a5828103f6874dda5ca0b32e8e8ec
- SHA1 7a5346221f40349881a65df91014114b1644c8f8
- SHA512 a4ce868855d83ad112b528a4969e5a5f79a115eb92f9e3ef1f05eb09f7f39c099abb162bbf2024b298af715560d81d9f08c2457109d7b2b33c04dff9789dbd05
- SSDEEP 98304:at69nEVAZKwY4Lka7NrGWeG0qwtEQ9VsAwbB:aAnEVmKv4Lka7NrGWJ0qwtP749
- TLSH T1C8569D1BA6E800A8D8B6D13CCA978513E7B2BC15177197CF06A4967A1F73BE05B3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.json
- Size 621B
- SHA256 61391736db1e0c4ea5327340141296b985418709ea97ef76a20c9da792182966
- MD5 f6f2e0e3d78d0005e10a25df03478bee
- SHA1 02e287da1f64ecd6614442fbf14b57d98e7c408d
- SHA512 5d2abc661898d614b3658bbd149e58fd35654066d49dfb16fa4fd578c7156272bffd4e9d944b1fc6628c1f9b060ca4d220e9181eab5aa1797ec5176074a3e509
- TLSH T1CAF0DD02955F42F70570468C41A40487F634838E02119A0FBBF4F680CDF2C249B93C44
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.json
- Size 784B
- SHA256 3356042182153bd9038318279588c22da1ff09c342825c0f77ec86c352a36565
- MD5 499864989538ece2120b9ff069d4ea9b
- SHA1 e69525bdfeee289ea9bd6915e355e037728b5957
- SHA512 4fb5f3d857793e8cca753a5da9ddbfa58a74ef04d1e6c01b57dfe02baaf9ade92b04c87cf7c2ee373a97452ef07da95c89406dd9f8d848ad944b7295dd1bc9c0
- TLSH T13701DC03593E82BB54B5439954680186F774E34E2120490F77F8E685EEB7829A7D2D40
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\mbtun.dll
- Size 2.8MB
- SHA256 f21a980316bd4c57c70e00840ab76d9ad412092d7d2d6a2cff4f1311f7c05364
- MD5 2bbf63f1dab335f5caf431dbd4f38494
- SHA1 90f1d818ac8a4881bf770c1ff474f35cdaa4fcd0
- SHA512 ebb9834323329dc01ba2c87e5fad1083a4cb86f5ed761cb63299ac5336a9843a1aadd42fbed706797c2295117af1c00f96806422338352653c8e0255fecc2fd5
- SSDEEP 49152:xNrdEZjzdAj9fdc4fDrN1OxOh5PgqdnBq30yPFZP7KVxSL:bBzFRkshaZP2W
- TLSH T136D58C1AA7A800A8EEB6C27CC6578603D7F2B8151771ABDF02A456791F73BE1173E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\mbtun\mbtun.inf
- Size 1KB
- SHA256 4a350fc20834a579c5a58352b7a3aa02a454abbbd9eecd3cd6d2a14864a49cd8
- MD5 5d1917024b228efbeab3c696e663873e
- SHA1 cec5e88c2481d323ec366c18024d61a117f01b21
- SHA512 14b345f03284b8c1d97219e3dd1a3910c1e453f93f51753f417e643f50922e55c0e23aab1d437300e6c196c7017d7b7538de4850df74b3599e90f3941b40ab4a
- TLSH T1CB4140BD48D20AB83C673356671B69C27BDC220145C920ADB2DE8606C88EDDCB905EB9
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\offreg.dll
- Size 140KB
- SHA256 8e6c155a97666c8e6a3f9ea95bfc6f6e4f87beac53dd72164aba3ef33ff88db1
- MD5 1659738d57a15a0983f0373b2faaef45
- SHA1 efd4cd05ff6bd787a2ceabfd11daba1c0e475855
- SHA512 4f62cfe0579e1aeeeb30edd5f42a2b1880446dd1075be051e2e0189da5071f9866e5425ff85547486fd7d952a28efa4e784db0cfdc1fcc428b34eaa89c6a7654
- SSDEEP 1536:kXNnhdTcQOCr7LClg5lSYOurIt/0q9mrf0Xp2N7RibuQusR9YfIZRoU:cnXTcQ57LClMlSYA0q9mrf0XoNHFQZ3
- TLSH T111E39D5A73B420A6E8678678C569875BE776B162232087DF12E5C6B80F037CA7F3C345
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\pkgvers.dat
- Size 78B
- SHA256 d66a0aae0576552d0cef8b9466a2337aa0efbc2dc23dece0e9f764f81f95f5f3
- MD5 a885956d95ca7d572785df54648eca8c
- SHA1 eff7814dcfeee8282f79065a198dfcca3c3cd298
- SHA512 1f1398aaedb94d3129a9b6f33d16d2cd0a9dc88a46dd6d740142f6148e355d77375e59424d44036d5ba1a1773b6a24dccbf4bf1484695fb9785e73765c83efd2
- TLSH T10CA01128808C23000C22B2F2B0B22200302BECA8E8200F00228A02220232020232820B
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\farflt11.cat
- Size 10KB
- SHA256 352af60dc4b0133f608e051d909f783dc491eeb7b7ede0e9567b78f589d51ef5
- MD5 f2e9597355a9ddcef779231deb3b82a3
- SHA1 022781702cdb25761559a223b7b6286afd5331b4
- SHA512 ac59d14cfc5250323b5967d05f9f1ac6bd5192ad61f87e85347fe806712525550d0eb34d414c715725f2bfc6ebee00778ed1b7b4a048d6f53535bb6106f32c6d
- SSDEEP 192:ud3dHdsdfWyeJCWW7/lyKFFWQFTOUpA1wki+X01k9z3AGuJmuiqMbq:SN9kfCRiZFR9ki+R9zBK8qeq
- TLSH T1C83218E6866C92C3ED936CB043E8E55B7C3D27CB4C90496922D7F6580DA37C9E31446E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\farflt11.inf
- Size 3KB
- SHA256 142f7bef5d7c91cc29537e423e4c10fc409b085adc66b75552252bb5c7b38697
- MD5 9924a26e2fb32c82e9683a01d65d4a78
- SHA1 f707880f584131c0f69fdbf1dda753c88cb75125
- SHA512 600665fcc54d8b76f2e9b059bfe7e4f7f1c3b4e2e635c8f97eee4a34b478485312998e42db4dadfb221eaba817082283b7b7be5938557fe24339302177e353bc
- TLSH T17951019463978574AECB31A45F077807B6253480A1F5395832DD84D8C389A2E5AF87BF
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\farflt11.sys
- Size 212KB
- SHA256 e5cc373a31f28f908c34cfb9afd5136989186437e5a5e594c4c5904365acc745
- MD5 bad893429e033c4338c37eee72995429
- SHA1 b1fbff3bfaaa4a7d06fb039544f8f30715f766d7
- SHA512 16cdd3d533035178a56ee7a04a3fc692333522ffb37611de07426494c143b55737fd239f1744f71038abec36d6dff669cac3a20ff472d4432c28552968a0532f
- SSDEEP 6144:XTVnD84C7Up6K6ofUPSZv5Qv+FEa4tWa7qscunj:XTxDC7Up6MxZvGWFuazuj
- TLSH T12A246C52A2E41DF4F977C6B5C6A29107E772340A1720EACF027086761F7B7E4BA39319
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.cat
- Size 11KB
- SHA256 45bfd887f1969f364ecca95f32a46354bb463864a697d631a14082eb213aa04a
- MD5 c553d878f2fe661a2408224c80178b7e
- SHA1 3c2f6515b04ee0af02b43920827d9830cf94b558
- SHA512 8a8cc31eede18ea4e169420a5c4e86388155a6f3e8000b981f9ff14c56cf6ea43ff0ad6a20d960a692dc70de6ee683541be8129fea326481384c17376bf04b3c
- SSDEEP 192:IgFgUgr1gZQWy+JCWW7/lyKFFWQFsW3pA1wki+X01k9z3APhAdE:meQqRiZFRDki+R9zGhA+
- TLSH T16D3229E5862C96C2E9A7ACB043E4F5673C3D67CB4C4084A922E7F7640D937CAE71406E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.inf
- Size 3KB
- SHA256 47b7c516bb57c612de19f0ca865590af95b6e32bf873a0fef9e011b2c5b483d4
- MD5 5a9717e1385703e8f06b27aa10a69e87
- SHA1 84ee67a9167b5eb6560711b9871de98898ad07a5
- SHA512 dd3c7278c2c11ad15a55fae6d19b96dadd92f85b7f0c8ce934298258af00bb5c052a84a98499b8867b0f43704fb307c67d03692ca69dda4d814c6c17dd73df44
- TLSH T1B95121A4AB93C570A68BB5526F033403F11538A0E0E97554B2DD81D9D389A4E26B4BBA
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Malwarebytes\Anti-Malware\sdk\mwac.inf
- Size 1KB
- SHA256 2a64969c4a410028974fe7adbf456735eab205eda44bab5d3a347d2929f44fc4
- MD5 a0e5d07981603a2cea5444f637870b6b
- SHA1 fdd303e520bceb8aaab93ed5f770e00fb1a3a0a0
- SHA512 60da7f845eb8ffbde94d87af41be3411bb043b76764355260887870eff7a1aa31704d72954619932187e92b36aad575ea84523af9c29c4d76d360fdaa9514339
- TLSH T17A31FD49B28799BC66C77B615F134483F020320850B9341436EFC19DE7EA91C537A6BA
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.7MB
- SHA256 26ce9c174fb54d9385c9282004d2fb1449790d24493b75caf9117d8197a656f7
- MD5 49c2bd18422578e98dc98782d845bb18
- SHA1 8b8d236a0a06b3ed5c340d4b3fa12da73065457c
- SHA512 29c3d932ddfdda4d48acd7e1d3b8a001175ca91c7cfa20ab492f0602b9deb5b5520dd08044764b453d356952253cda9b08f8bdc0b9957770d47059c7c482bbb0
- SSDEEP 24576:wfwvzk9RX6wkyAIz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:jMnYIzLNiXicJFFRGNzj3
- TLSH T1B685DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\7z.dll
- Size 1.6MB
- SHA256 37fa780bc230081691a105a3c1aed525ceec10ac1e64c1d1867137ce75e1b668
- MD5 05331236220c141ecbb04475e584f54d
- SHA1 782a2059612b599480468575f3af07079592f8aa
- SHA512 981d9d48c71e9b10bdae7a19e6afb489080fc14616728d8b89e87191322694029f19b9c1927336a6da5fe396e057c04cbef5d38d3e5a7e7a4e57ccb617423445
- SSDEEP 24576:1MLDS/eBHA6c6CWUN4mAq2pBDht5VHif44E2zq9xRjMUskEQHpvb96y0tzuh5z8Q:KLDVRCzfCtTHpNXEQHpR6yoihSGQ0
- TLSH T10D756C5BF67400A4D1D6C134C517AB1BE6B1B84B8720E7EF02E59A6B6F13BF19939320
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\AEControllerImpl.dll
- Size 4.9MB
- SHA256 878239e138180492b8e703203db1eeda5da1a88b7897c16e7323bb506ef28dfe
- MD5 e4f9ffbfd7c3c8b641ebbbdcfe6399e8
- SHA1 8ee46b184bb37a8f24001eebe120796fa46935f2
- SHA512 8f68576a20a8a3b6e7125733862583bcb4fe137392392acb4e3b826450cb4b656815a3be7b44174bd3fef3a0f4722079eded587d8c0f2ac3680d67384cdbb317
- SSDEEP 49152:y3QcNVHvFJa0GV9Tkq9HWsMyhXTnXRUHNNWjwJZ1yWBEsUXH7PWnE8q12VPvUbA:q0XTnMmPsUXbPWNPvcYLX
- TLSH T152368D16A7F401A8C8B6C23CCA578503D7B2BC154730DBDF16A4966A1FB3BE1563EB24
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\ActionsShim.dll
- Size 3.7MB
- SHA256 6c5047cb77ea843e8386ba2b26a8458e6255e2ab94d493e914620623723c6b32
- MD5 33617cde11d2bfcef47faf0d5ce3cef9
- SHA1 2439b5f0622cd539b6f6f2f87d78edba466299ed
- SHA512 ef909e5e6a695a0f2ae95621cf87795705b3d267ea7d1c82634faeff3a4e3b111f5f809cd9e7dbb71d588d6106e0b54c138364f99ba41c7c5d47cde9af1b753e
- SSDEEP 49152:SH0QptrM88LLHy9nqSk5n9BT1vAPZmbLMo7JTfYkwZdPHFszUlE3JqCx9R345GEm:ktro8k3booBovlE3JqCx9R345GEzul
- TLSH T16E068B17EB9540A8CC6AD23C855B8607D7B2BC25237097CF17B462AA1FB3BE1523E714
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\ArwControllerImpl.dll
- Size 5.6MB
- SHA256 a1904889632fce5fece6dbecda5e237423d571652350f24c8724bdeb3a30228a
- MD5 40f500da8c204e5e9a89fdd8dfae4ff6
- SHA1 3a407e01769f582116a34c3b874dd5b534734072
- SHA512 5a1888e523b39f1590c05236f502c2f5c0ab4a9384737294fdfa0c8b0870d851e2cb927b71112a8828c67c9017209e8b4fa66fca262d5f8d9a11ec481c946d46
- SSDEEP 49152:rjEQxZvdSVum8H2EMBNi3IcKpFd5wKqW1c7h/med5BNhlA+KjTscJ0Kzp+i7JtmC:rYQxjspzwJxE+6Tv+iVg64Iky
- TLSH T160468E1AB7D500A8D4B6C238CA578513E7B2BC554331DBDF06A4A6AA1F73BE0473EB14
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\ArwLib.dll
- Size 7.2MB
- SHA256 1019ac61854dd7f45f1bd047ffb26f3602598148f1785b0eb77a825302fdfa2a
- MD5 03569e93d84d0e22f15ca14397a77f7c
- SHA1 27ea1e684ff8ae275d54b18ff3a394dd5dbde6da
- SHA512 dccc919b15abb0dcc1f7b3ed2def0622e0d3bd1385e145f62d43630336029f78680aa88c9d1a381186e92ff0090e510b87018dd31421193372e66b8d753852cc
- SSDEEP 98304:sbSGwhdIwHLn3FEG7E2IfkxO2p/sfDLfXjbrwsLcaMNPaeti:wKXIwr3FED2IfEO2p/CbrwWa8
- TLSH T1D9769D16A2E400B9D8B6D278CA678513E7B3BC151331D7CF06A0966E2F73BE1563E724
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\Assistant.deps.json
- Size 15KB
- SHA256 383c4e0f3bffb2a4ae6819ccff2b8559da2c28683af8ce1f99d7f707655a3539
- MD5 70c56f55d32fc3435d48537c17eb9882
- SHA1 0cda0d5f55d488a0a3fcb7d9920cdd5b8309c6f6
- SHA512 75e7cde4f4568a6cf5cb77df2f671c434ff86abb3fe0be83be7048bbaa676112a9abc456d78bfa63c95618d97a8ad16f7c305172880cd34718c4e215a380421f
- SSDEEP 96:XT5Q03qXNHxVwTA3G8EnqimkKqTxecaFh4QUPoayc6TABcSVy9/LDYap75LGQ9gI:Xd3GcaFKQUP7ybCWShCYdA81EP
- TLSH T15462BA25E8946E7B0972BBF1B8754181F639232F7004284E79FC285D8FB7E5A6086F35
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\Assistant.dll
- Size 159KB
- SHA256 33719b228ada42bd50c0e91119d3bf078faa612ab1585a5ae1c44650b864dacc
- MD5 c7d0dabf0d80f6fe7df3083399877d91
- SHA1 646478f931f286c625139e029a2ea17af40b9705
- SHA512 19bb4b18a318da9a650a66e11da691fbe8de75f281bef7c934364e829c50ad2b39f33ce57b2ab760722ce4c34bd60479f5b8e9738948cdc2abd0a60d8d0b9dfb
- SSDEEP 1536:OArX8hDyiL2ZolcQAqh7RiT8hHrS9XfILcz:OArvalcmhxZo
- TLSH T196F35C879B948072EFDA49346DF0C7EA2B346E861CD34D56A754B1FD2AB2FD11A04322
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\Assistant.exe
- Size 301KB
- SHA256 23f4cd1510b7dc2e3cc5cc846b6159c737e63a97f72352e8db6a34cf6182c71c
- MD5 d19e2eac5f55ed0d85dcfc97f4ba0a39
- SHA1 905b18e4f3f48381bc8eca524cba80aea5c1a150
- SHA512 887c0a083176294410277afe122a99a8a34f884daeeeb2c4d921d60bea728f674a22b0b6d9dc0d5b2fb5612356b65f4097fe03dadc74b9183c76768a27ab47ba
- SSDEEP 3072:pXwANETcQt1Onb5RHrfqDQXFn4dPPYseJwmZf2jT6lb+aPOWE3MHA:RlxnlRLfyQXN42D0IlOTv
- TLSH T124644B03965850BAEDE6D638CD918B41FB7238594BF366CB13505ABA1F76FD09E38302
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\BrowserSDKDLLShim.dll
- Size 3.7MB
- SHA256 f6d24605eb688e039e4509d184d974bb14c4c38528edad129d0653eadfea80f9
- MD5 889529ee7dadd23f11ed5b3fdd1f5b79
- SHA1 3e8a1bee4d28102aeb4c6f2eb94946282ffa7e12
- SHA512 bcd57045d516232828003b2b970b457138cebafbfbf2bf762199c291228b2cd674d8084190fee22f0adf047e8f2ac20644712313cfb5f90289a83fd6698995ec
- SSDEEP 49152:aHENZh/xwXNNnfFEXqGW3nILlpqCBS6+38Q/h0oYEaF6r+jep6Plw3zUoC02n:TOX/xPb/aomGIoIn
- TLSH T1E2067B17EB9500A8CC6AD23C856B8607D7B2BC25677097CF1AB462791FB3BE1123E714
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\CleanControllerImpl.dll
- Size 8.8MB
- SHA256 0f8c7572972f1bfbdc523da81fd9b20a0f25a080eb563149529ebdbd0cb5a315
- MD5 393af25a2ae316dbcf776c0c2ebcead8
- SHA1 208a08f26fb6762df38320ec15c924c7924756f5
- SHA512 2615354c625c4927ac72c28b406d24547926cf10dbb38a840692a18b787c8bcf16a15d20053181050674ffdb48d622bee5585442a800f1a80be9df34a8615427
- SSDEEP 98304:EBk6XbCeYt6nyILa0k+BZhb8+QZL0t1br02yauahg:gXbdQ6nyO5rBZhb8+4L0t1Hha
- TLSH T1D8969E1AB6E400A8D4F6D278CE678403DBB2BC551731D7DF06A0966A1F73BE05A3EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\CloudControllerImpl.dll
- Size 6.9MB
- SHA256 f4924e03eeb91f5c6be468c96696d9b9605b177b1fda7ec8881fdd20ee856f81
- MD5 00d720d9a7d0a2b10902d62d45512c79
- SHA1 26d6606e91a5a306d84f7fac5458aafe20a50b5c
- SHA512 1825f178fd0d7060c1553df4f3d5c737af39e19edea6ce2790b87a5c9d893f2a50a65f94fed7f88574d5c10da238d3aaabd5b34a0ee85f2b4a509b0223db475a
- SSDEEP 98304:jFJ8mOCFE8we7xbYmr2Mgl5vzmAt2zA6wyk:jL8mOD8p7umr2Mgl5LmAtoHwD
- TLSH T102769E5BA6E400A8D8B7D27CCA578503D7B2B81543319BDF0AA4967A1F73BE0573EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\DryIoc.dll
- Size 597KB
- SHA256 8d6b6dcb41784873db85dcc28b99639829a44eaed62e51fc1693c8ff1df356a1
- MD5 ebcd37cad55dfb2bce880cec80eeec2d
- SHA1 d68a32226b7c060588932d317a315c56fc4f5ab4
- SHA512 db0d561c4a0fe3926463ada9d5063952d246911cbefe9a9217039e4c661b4304dd41b601fd66f04bfa966cd7b8842d93a2e857ab3fa5ad1726ad397843c7693d
- SSDEEP 12288:D0pb1qj47g2Gzp3+bszwrO8Zakh8Zfnr600DssPUbUhDPzk:DqEL2SJMZbxHhLzk
- TLSH T1EFD48D0533EC461AC6FFE673793925165BF5E413B8ABE78F158884F818AAB115E403B3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\Duende.IdentityModel.OidcClient.dll
- Size 165KB
- SHA256 eecde68a50fb9feb26917f809b1f3602fd9481ee03a8165d4177ad889eb0a265
- MD5 d1a373aeade0364a5ed7009ad34e7e36
- SHA1 f7f48b2a86f24d73df3fcd7fd848432db988fbd2
- SHA512 6caf435e716262176c6e296050fa1ebcce8dc670bc8819668bb18de07665f3159cff243f271d8bd09e9c981fc2cd0ac46c7acf25f6788c462edf9490d5688fbc
- SSDEEP 3072:2R8wizSvYrIgF6ApyaljQi4xBzZGhbMyB9EVqr:2o+vYLDoxVZGLHB
- TLSH T1CEF33C6577EC8312CA9F7F78F590A12565B59E03BE81EEC90E487CFE05263C2390971A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\Duende.IdentityModel.dll
- Size 250KB
- SHA256 146ece96af20c6fcdfb9efc25b988124f9fb5cbdf5b10fa7ff3c644bc0d1f541
- MD5 3d6c880c5b46da357ae0aeb222648621
- SHA1 797309f696d270beeccd7e4755ce3bffc245e955
- SHA512 e0a6f93e50321e6617abd0ee523b9709a05d2b5fcb714f21fbb173910467f023843e1e2872eeb180ea77449dc84d86d0603258ac1523597b3d6620310c11b100
- SSDEEP 6144:1BCOgXPwr6V8Hhm2ZTKR9bzIdbN2mCFMhqPDhadW:TCOgXPwr6V8Hhm2ZO3b5Dhad
- TLSH T1D9445C0263F48617F3EF6F3AF574A5218577BD467A00EA8E4D487DEC1522B80BA15B23
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\LicenseControllerImpl.dll
- Size 7.1MB
- SHA256 34cdfc6dd326c373ca3297ca377d1416b2aa6493eb73deae0e35fc0935c5eddc
- MD5 354e206e8e85bfd2b97f6d2faeff3768
- SHA1 5ac220442710477664d8b195fe50d288a3f9e83a
- SHA512 4d4e328ef180499a2da134baa2480f95d1a47535be3f909f1aa5b9b913a6821bff7e5a23e8572cb09a342fa371cd3b49d03c0cb4c4e3816c184a1c7899816910
- SSDEEP 98304:rFerlzM9UbqjzolwSonfMQnYlVkHtnteWhGcm:RwlY9UbUSbonfdnYfkHtw6Gl
- TLSH T14676AE6AA7E400ACD4B6C27CCA578503D7B2B8055371DBDF06A4967A1F73BE0963EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\MBAMCrashHandler.exe
- Size 890KB
- SHA256 164932ea0ead0fc1d660b075913244fe7ca7322c725cdb0903ae4cf217b19a64
- MD5 498178f914ec446f77c3c03637ef8889
- SHA1 e865fb47b565b146b05d1bbaa8d79b1e37f71e34
- SHA512 a93d02495be1f921f062fadcd65ac5ffb7ef2254707160f34832452ffc7c06a34784b7435afee645f253de6802a5a19d9c3cd38d3b9bdcb309e8c1a335b26cbc
- SSDEEP 24576:m+JgyhxA4n0eEmZ7HF6ULsOmSxNVl2uCdRP8a2hi6:msgyhx30b87F6ULsOmSxNVl2uCdR0a2f
- TLSH T140157C1A777C00F9D0B7D179CA46AA07E6B2740B03B05BDB13A147963F276D49E3AB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\MBAMService.exe
- Size 11.1MB
- SHA256 ed4f4ea1e7df9c13bc1068fea72efb50b483e40794100d07924d395d04cb6b6e
- MD5 e71310310109e39bd8198a82be8d1ee7
- SHA1 ef95632150e7ece3debfe3329b4e3dc2cccd660d
- SHA512 91cdeb54edab911031ebfb77fed31a8f912d7d95c901f5d40258e1e7146da4ba0c3bdbbe5119fecf635ea7faa55a637395bea50937befb3b79355b5990234f1c
- SSDEEP 49152:NPJ9TDqKKjKAF7fjceNB+KgsFevSlSyCS67IEQy3+LYQGLGgYa7dnbD2j0eGHrqq:9J9SZUgGLY310/EqdNWY0jjgbuGv0+5
- TLSH T1C3C6E506A7F951D8F5BBD674A977662AEE32BC618B3083CF1150560B0F32ED48E39721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\MBAMShim.dll
- Size 4.3MB
- SHA256 dcc714dd199d9768faa0ca212e63efe63caa8aeb4cb11487fa389ff59f6cf98d
- MD5 5be75744f4065e88aeda92344b999ada
- SHA1 48347bd7c99adf4e1c8407c0f56b2017ef8e5525
- SHA512 53cba40ed9450dc83c8fc6e522b567884c1a7b858f708930f164fb5eaafb4d6972625eeb35b7d5d01d754f7c7af7727ecf08efb37de6541ec637021fa06c6613
- SSDEEP 49152:+6s9rQzE4CYJQEw34L4lvXYsFFXBulqfCbLqmsc/6ZeFYpA8aIJammPsQzUOu+/x:rs9rVzYJGrsSCbvyg8aeTO/Z2JgH3
- TLSH T138267D17ABE801A8D87AC23885A78603E7B3BC16077097CF1A64557A1FB3BD15A3F714
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\MBAMWsc.exe
- Size 4.2MB
- SHA256 7878a9b10903b8c0def49015deefd48a3ea0e46c0f5ac9ae755336994e020152
- MD5 acbb82943fe0d5f1c5df74b1a7dccd2f
- SHA1 c41e38f59eff5e40a6a47b14be44520dcd6d405a
- SHA512 7092748502f06bf05df19bd2d4d5857f161a35a9b2e3a72645eaacffacae7a8dad10ab41ad3b80d3a63ff0773b6c818edf3769ce6b1f61b01cc92edfb755dfc5
- SSDEEP 49152:dK5b4+V1qsR86LMFRbbX8DREqUaP7bBfnuF0JRlnPkokPmsBLdS4BPQRzU/81fge:i86kyaHF0JRlMhBpMyok3M
- TLSH T1C6166B06B6A540ECD866C239A47A8503E7F2B811273097CF066853761FF7AD21EBE7D4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\MBVpnTunnel_mbtun.dll
- Size 4.2MB
- SHA256 0b764892f7f32d385684411e647f69f428067180aa28315d71668d3ab25b335e
- MD5 ca4f7f1ffd364bdb46dbbb8bd1319125
- SHA1 a2d8a1a3401a93da3303376e37e6ae36e08c693d
- SHA512 522a23be06d466db16e9abe89897e8562ef1fab483285c37c5ff43468e084a91ea78892ea9225c2da589e440e84034d23b0236af99182ed6d1eb118b4e0dc273
- SSDEEP 49152:lBPD6Io8w4LcTwEDRzTJoeM9YSxjQ5g+o9h6iO0oFjn2Q1Z0NwEIx6:PDG8VQkgRzSeMfn+ofU1M
- TLSH T1C8164B02F8B205B9F2BEF131C9A963217A31749503327B871F9195692A66FE47E3D313
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\MBVpnTunnel_wireguard.dll
- Size 2.9MB
- SHA256 998086c9be8d1e7bb8ec63e907c834dd315849cb78de4da8cdb5702e03eb79ad
- MD5 2b25add11147543409d55d85d1662e06
- SHA1 37ced9f532ef0bb743305d4b58095d49ae8e382b
- SHA512 4bf32d77cb9617ddaf835cc7fed41f590e343a7c567474353e75ae80c5820efa6a5b443143b6fbecfd8cd9df77ba4356c19cf65d47d73c408091ec4041ea30a7
- SSDEEP 49152:OiZVz3arb/TUvO90dL3BmAFd4A64nsfJNraOc3jxJpr7ZEN7DS25+NkzZGALgFtt:OK30c3jxrw5HZId7W
- TLSH T199D53903B89584B4C5AAD230896B92977B317C890B3163D73B50BBF92F72BD45E78364
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\MWACControllerImpl.dll
- Size 7.8MB
- SHA256 fdd969a68f96e9a4db90892bbe9f00e546e4f59272ae67fa782f529148728b54
- MD5 f0a1624762378c54bfef75dcbac0ac21
- SHA1 f55301d7527c119a19897fd22fefe55f2765208a
- SHA512 e1a18e20a2e9859000f21da2e5dd53561ead973accbb4689db076eccfe0cf20c5270a7b345bf89c5d491af97212095503264437fa471cfaad21d02a67c551261
- SSDEEP 98304:pWMmIkBpXCMFjNavi12Oig11lzkOtFlRig/X0:pKIcpSMFgq12Oig17kOtL0g/E
- TLSH T1BC865B1AA7B941D4E8BAC23CDA67A617F972BC198330A3CF0654975A0F73BD0953E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\Malwarebytes.Interop.Activation.dll
- Size 36KB
- SHA256 f5a9e3587fcf855046d8b08e86ed61105f2f330a1c9021461446c137ed3b9ac5
- MD5 2db24fdb7584378e27e5a023ce1c4221
- SHA1 f4c59cc128a4c79b1a6b450a81f5c2f9ed7e6b9a
- SHA512 0e1fcd125a839f5a85ecd96e432ece37a62a13af579153b375fd6ec57b605689bcbb46e7f3d0a93e0e1235ddedf4965b0d9b2f4826d7d7eaada79a15a4efe7b5
- SSDEEP 768:SI9HlxK1JN2bwUUcXk6xf1mlrjE7W3b/bF+Y7N2Ip4O6xf1mlrjE71:l9HlS2bwUBfIfmADh7Q9HfIfm1
- TLSH T1A5036DDA9A349003EF97AF7163E4DA83FD39A7C36845C56718AAD18408CB3C4E35626D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\Malwarebytes.Protection.Interop.dll
- Size 2.6MB
- SHA256 201337eadd3efce2c0cd64503e048c94b14c052c76d6ff998cf45921ab5a64cc
- MD5 cfd47803a74044f277131132e3a89676
- SHA1 8cf3b87e8dc50f9bcbb4037639237ba8d461e7ce
- SHA512 e68ea687643227198582ef6556886edfad20efd8bc507d2d65d001d35e9405db7909845f315f4e0ceb8d69950d8d49feb312dc0bae863e923e5d27220fd52bed
- SSDEEP 49152:DJHU2YKCHSDZqQgHJmCOxQhAB27fGAhD+ibzdTquV5CEEERrv:DJHU2vCHSDZqQgHJmCOxQhAB27fGAhDX
- TLSH T18BC531267DA49F3ADAB4417EA6839F385722EAC5720BEE07350CA9090FD14DD3D47A31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\Malwarebytes.UI.Controls.dll
- Size 32KB
- SHA256 4c3d97304af4e091ee4ed390f2c75deb04de900ab404bc41e529a0c5bbbd04c9
- MD5 1cab5dc89a3c6e8aa69ee3a709e92f84
- SHA1 a8781531ac1700ee363f91995ca5269c3ef4846e
- SHA512 1b03c710f2d4bc754d74e09838c26444f244585b1dca8d84c76dd1ab0cff4f08aa368eb4595042ece1a71c339b44aaeaa2397aa85f8ffde507124d25704e3ddc
- SSDEEP 768:RQgoN5YiRifT5ALY6mM6m0fXT2Ip40GTxf1ml6Z+7EtNgU:RQrT7Ri16mM6m0va9vfIL+P
- TLSH T1EEE26CD78AB84403EE57DE31F1E8DA97BD38B7D36C91C1DA2069C1910B463C1A3A926C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\Malwarebytes.UI.Style.dll
- Size 108KB
- SHA256 ba1e626a9b6a3d7c967d00ae31b7a758edb0ac23d8332939f044710d8e6288a9
- MD5 a3478b0ba3b8948726bb37e82ee224de
- SHA1 122dad2b5a9b8e689f73405cc4cd8f420944134f
- SHA512 8a44270495ba7a2cf136cd618efb48b45d4fb60a85927eb4d9761ff8822ea852e9b1a1eafd77a6f0b4ec382330b835ab38872b4a09250d930f5e0f95c7ed32e8
- SSDEEP 1536:xVuxwXvVh3gIrjyhryRlMAMZHcEzpr7Ri86mM6m0va9ufIk02:xVuxwXvVh3gIrj/HHMHcEVrtoU
- TLSH T138B307546A550CB0EB134EB6ADDBCE0C3D3145AA00E1C86521DF8CDF6EC9B8186A977F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\Malwarebytes.UI.Theme.Dark.dll
- Size 55KB
- SHA256 e0b84c137d3cef1dd43fc3572d359373b1614ab8aa0f5091f58120bfd3fc1c53
- MD5 ba57abe6bc54c2a30a83372a1e5712fa
- SHA1 5dc310260a243e4ca26d25c09f152b22727a12c2
- SHA512 d940e2ccd2ef2d84b84be43765d88738136268892206a4f65182cce1c72fc4b15009ad11ab76b24bcd575cc6c1c06c5f3d7e82d9163f862e4a981082e081509c
- SSDEEP 768:wIZlzpsplPN8n7RF1f5YiRiY5ALIN6mM6m0fXT2Ip4pTxf1ml9dHejL:f/1R7RikN6mM6m0va9bfIbHev
- TLSH T1BD43C755E5894827EF675830BCFE74826F3511B49403BE4FABAF627006D034F1AEE626
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\Malwarebytes.UI.Theme.Light.dll
- Size 55KB
- SHA256 d2d177294181c0bc81baef93502e603eb1fdcff51b074a1f068c38003f1c0502
- MD5 231f26bf96e205bf339693ad3d30f0c5
- SHA1 24bf339765d5477e147e0e3320f1acc1e261689a
- SHA512 18b59759d24e579376fe2f067ff23688ae36363334191c0639a3d8bae071d7662738129490042c6164a7286fa800b0591e91ee7302f811f6f9ef369fc30be33a
- SSDEEP 768:nEfnxB+jbhXrzV+5YiRisGy5ALR6mM6m0fXT2Ip4PPTxf1ml9dHWjL:3XnV07Rij6mM6m0va9P1fIbHWv
- TLSH T10743B496E5894827EF235831BCF974827F3511A48403BE4FABAF6770069134F1AEE625
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\Malwarebytes.UI.Theme.Primitives.dll
- Size 2.1MB
- SHA256 7a543d38cb51c1fae0e41297c50247f7558aae0e879f7d6762b2349193ad992f
- MD5 2d99f557950980a71f4fd6c03b6c148a
- SHA1 bdafdcda30a295aa2fcee118212dadf6129b550c
- SHA512 39617ee745fb102e2131f6494f9eccf065ef576f64fca4bde72b9f57f5b4aa526d76efea1d838529d5438f6f2bd329f256e3309960c88601de2d6a6cb9108308
- SSDEEP 24576:4R7Lmv3ser0IruI+dktHly2fuBLwf+ogKTAWrrBcUg0A7PEjRr8Diyr:qc+4H42GBLwf+oFTAWrrBcUg0EEf0
- TLSH T1DEA58D02F302A719CD827E387D7DD3BD5B71F8197E1A961B74C5AF2488CA4809C59BAC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\Malwarebytes.deps.json
- Size 53KB
- SHA256 c6b4bc62a0002a7e0fe48bc53259d77e0f6d50916f236b4eca98625220038b7f
- MD5 85bd4b43616f9773bd72801ac9b26d54
- SHA1 096a9f52615ca76209fc1a00e3628e01d6046036
- SHA512 8d972124d3ed37d7cbc6eb8edac6d7ef8c1ee58c63e83a1303b0ba1c59da7ec5965b484ad53b58931972fa6508173b180676e43e647677c8798093d44dd44af0
- SSDEEP 384:XH6kyitlXt1XBcbuQT4J7VjFneQmiVmAH1nmhwtjenRQh0TDb+CKxoiYoI3c4sOr:Xaa/Xt1XcuQT4JYQhTx9pH9o
- TLSH T1ED33AB25D4545E7B4572F7B1A9790581F62A132FA0046C8E78FC285C8FB3F9B609AF38
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\Malwarebytes.dll
- Size 7.9MB
- SHA256 e4282a1c1e5d9b5b146044a1a5e471fc4e29ad4359034138a6472539f49ee493
- MD5 d4ec6c14e5b21a1c37ebbb465e60543b
- SHA1 ce3502120f0ec7b747d759d52115900b8baa6d10
- SHA512 3361abbbf2066e4ab7046e4ae19fb0ca57f8afbdb912faad8b1d87f17a6c422103718c92a1b5c22963ef165c684602dba35e08a63962637f3f906875f23f096a
- SSDEEP 98304:v0mUCmIJdn5ex8dU2gwjGYzzGziMydcXXopvy:v0mP9nxDjtwzopvy
- TLSH T12086C0156BBC8E78C9D707F1582203049975758623E2873CA38E2C3EBC9AF558D19B6F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\Malwarebytes.exe
- Size 304KB
- SHA256 54c5255b0ded5687029a70648eec59663db5b0a2051e728827a1a6eb2ce7f840
- MD5 715b5551c2cd1fb8a35ae384098102c5
- SHA1 3125469361c82f5a1501d6b4a18175dd95bdb693
- SHA512 7862be90f3095364ced40f356c53f0bb39f1f671a5a29b648d7e420459e2d7f3a8c91eb3cb8586cb51a1aeef472f83f3e0cd3bad6e719736cfe00959f74aaac1
- SSDEEP 3072:fXwANETcQt1Onb5RHrfqDQXFn4dPPYseJwmZf2jT67b2aPOJfj530ub:/lxnlRLfyQXN42D0GtO1jK8
- TLSH T1C6644B03969850BAEDE2D638CD918B45FB32385A4BF356CB13505ABA1F76FD05E38302
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\Malwarebytes.runtimeconfig.json
- Size 732B
- SHA256 3f60cdd7ad6efb453058c7d80dcad1ef76bf5db28fd548fb6f9714b409e4a181
- MD5 5bfe910e05d660bafacad9e7769c940b
- SHA1 fffa577eed91f3e25b5c1a1824a4dc758628845c
- SHA512 7d47cbe8d7799213636773b36cb6ca8efa22d8f1fa1b125355e7804b022280572a7b647608f39e71ecbc480e244e2bcaa59f27d9c16a3751953629fbd15ca7e0
- TLSH T115014979CA106CB718B9327BD525D483EA34133B10046C56B5FD090C7F7B6BA2232F96
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\Malwarebytes_Assistant.deps.json
- Size 15KB
- SHA256 ec66f1c4c94bd64eff9bc523835cc02f3d5329a36fe4342746f656ba7cbb374e
- MD5 3a93034c9ab1695627b7c6eb2a8ff955
- SHA1 fb9853151ffe17e54d7156ff022cdb8173388158
- SHA512 36b78bde7a3344f77eaeaadc44b629afbcf39573cf3d260f21a682dd131bb9b288f3f370f5ca342f80154b3777e71e70dbfc06af9ebe3d57f8b26a0b6aa21ebd
- SSDEEP 96:Xn5Q03qXNHxVwTA3G8EnqimkKqTxecaFh4QUPoayc6TZBcSVy9/LDYap75LGQ9gI:X53GcaFKQUP7ybrWShCYdA81EP
- TLSH T12A62CA25E8946E770A72BBF1B8754181F629232F7004284E79FC285D8FB7F5A6086F35
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\Malwarebytes_Assistant.dll
- Size 164KB
- SHA256 bf7b2b4b6f7bfbad00d897c6dc4bfbd5f2598eb91c3c7e61ed519b9e58192f38
- MD5 8a56dff0556b09afd5f0320523b46bcf
- SHA1 c134641222b2a2fb27186cad2c967d7d1a8ac0ff
- SHA512 72effc1a358b884bc4e608caf5981f0dabb9399a64cdd57b1c9e9b640c98b1f1af65201d662a5351363e4312cf778cd72e8b14d966313edf7cdec6646a92f29d
- SSDEEP 1536:p2O8bzCTGoZolcQAaZ7RijeSHrS9OtfIk0M:p2DbzCLalc2ZJTe
- TLSH T10FF35C87A7A48072DFEA49346DF1C7DA3B347D461CE39A4AA744B5FC2972FD11A04322
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\Malwarebytes_Assistant.exe
- Size 301KB
- SHA256 ad845b01d6f5b93e002c0247ad26d552e296a6ab1315613e6d8ee2246c8ef22e
- MD5 cbae50b7531dcf2be79c226f4cbf083a
- SHA1 cdb342df88d2cbbd909517d5310bfcc8946c6db8
- SHA512 725e9b5389b1f4eb0464be402484b8dace88349e599e12a1e8d56a7d36a8a05ea688fe250f5a0a1871794176cf4bac334ab24c772ac7e52a7fc34cd17495b459
- SSDEEP 3072:dXwANETcQt1Onb5RHrfqDQXFn4dPPYseJwmZf2jT6ebzaPOi0ApTP:llxnlRLfyQXN42D0rWOURP
- TLSH T144644A03A65850BAEDE6D638CD918B41FB7238594BF366CB13505ABA1F76FD05E38302
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\Malwarebytes_Assistant.runtimeconfig.json
- Size 615B
- SHA256 61fca252e8e336706f4c153c16100b7b621f9092ed09bb6959e406ab5bb21e85
- MD5 389f208d959c5ff4ee9c0e4dbbc31ecc
- SHA1 32243920d3687a1b8af307a3ae140103ec08f222
- SHA512 86dce7141f4fe9fd938f8b5be78d9e9d9885365d7ea7d4d3cb0674ea63a9201f4f0e02ceef47819b9d596a2e397fa68c78e9dfd15acf804ff93fca0f55b1997b
- TLSH T1C5F08B29CA106CB718B8337ED125C083EA30133B10002C56B4FC080C7F775B62221F96
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\MbamBgNativeMsg.exe
- Size 4.3MB
- SHA256 470a0254bc323f229dfba24e3ab3eb0c23a3491f5acc4e90e45d8095cfdca639
- MD5 2ed6711266267105c7ed7dfe534c6870
- SHA1 8690eee718918e1ff6a12551e6f2c6f64ec9884c
- SHA512 5fc7c53aa8cf226cc9c4caab3f801e2422e2fbbfca7d8aa88af6a2455f61e5e0948a37b5c476cf14677cbea1a6d81412a1411d2fc12d58a8c5a8288c44a06fc3
- SSDEEP 49152:av1K0RN+6ZgxovIWYmrbm3UJ6GVB9i1WMetWVNUe4On5x82kAPyczUUbnnr6YYRO:AfZgMmEHi1VeB4w/Sr6YYRZQ7
- TLSH T11D268D17A79801E8D876C238C55A8613E7B2BC1607708BCF06A4567A2FB3AE54F3F754
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\MbamUI.Core.deps.json
- Size 7KB
- SHA256 794b599d0cdf356a486ca39362dc74821f28c7b55d51d8cb2050c32813f2606f
- MD5 317f81512fac8ec9718ce730056d326f
- SHA1 3bac5ed86fd165e7802cffcdce7c9f59b4609448
- SHA512 3b7b6d67baa9d8dbe248ccfa4554cb88bccbe1ef68eabeec8ec70b9e86a8745498417a4187897f0549f63b90bd3844897f36ab349d1ed06f970859eb7e627689
- SSDEEP 96:Xboe03qXNHxVwTA3G8EnqimC4QhS975LGQ9gpGc6bXpzXaTgNj+FPhCYwpUVCk86:XbeqQhSChCYhV
- TLSH T1EAF1CB21E8946F370976B7B1B87A4151FA39132B70046C4E79FC280C8FB6F9A5096F35
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\MbamUI.Core.dll
- Size 183KB
- SHA256 9055cc925319368d70afc76ac5163bc1dba72fa9a765a9ca35af1de0184f31d9
- MD5 a4d2a98610ab64c6c7d258c8a9bf61a2
- SHA1 b0a8630fccc1f3160e6177b7b86a9dfcc2b76edf
- SHA512 dfcb9e65a1e28d16bb01690244e719c28cae260323108f3e284d2c04e17e3fafb36e029d68a2f22dafc00e60a3743ba30f5306aee6328f4cafca005f27968281
- SSDEEP 3072:petvc17zcaTJss80J2PSb7gtlGijIHhyGFzH1LdJT6:pet8vcaTy0J26b7gtQi0hXzHrx6
- TLSH T1D604280277F8060AFAFF0F7BB8BA5115CE76BE562C21D66D1591409D08B6B80CE61B37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\MbamUI.Data.dll
- Size 1.9MB
- SHA256 e963c710452371fc88a5fb29e6d3a63d13e5740168842d74be72ea134dd706b4
- MD5 620996f557360a5a89e1699bfca2e7d1
- SHA1 0237d8a001362fb06805742db93100e6a6586cea
- SHA512 10096daa58b793e2ad945920f95a81db1afc35ecc72e905714bab2aa25529dc336f85dfdb18337d356d752999195fc02a7dd2ebca5f448e163c81ed0f40a5a79
- SSDEEP 6144:djIZKevzZVQJtIIgd3S/2U4Y2e7Zx5DPLj0Dy2nnviM5dFMZhwhLwNgONTxwdIXk:d0zZ+JSdi/2U4SRI8cu5tPU
- TLSH T1DA950D3666842C23C7E1DD7B644A3A3E012CB947A98EF69DB01BE4FE0EF6744D51B904
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\MbamUI.Services.deps.json
- Size 14KB
- SHA256 72f59e1f726eaec2a193c1acf455ca6bc41ad8846b4334d9473a3e8d452ebb18
- MD5 cb61e744b8fecb96608f2704443b8c1e
- SHA1 13bdd7a1e895c9083765b3c02a9ee95240416cb7
- SHA512 1c192694ef416e332a61ceddebc24005e8aa6517c3c166f2e3e3d74c2749c54cebd9877ccbc84b46566bf1b8a3759813a35f766a00cbec5c6e54a5ca63ed58a7
- SSDEEP 96:Xkyc6TV5Q03qXNHxVwTA3G8EnqimkKqTxecN4QhPo6BcSVy9/LDYap75LGQ9gpGX:Xkyb73GceQhPjWShCYdA8IEM
- TLSH T17B62B925E8946E770972BBF1A8354141F639232F7004684E79FC285D8FB7F5AA086F35
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\MbamUI.Services.dll
- Size 4.0MB
- SHA256 eba8133ae7775d691fcf2abaaa3406463d7c40f61389f55e822b1ebea444ae6d
- MD5 df721debc9dbbe8981f9ad200829fc1a
- SHA1 0d318222c56d41eaedd25cb9567faab5d67c3c55
- SHA512 a16d781af38e4de4d2559c51c8ec9d3f648762c246713d496aaebe5ce080c214618b840a6d42a6be46a0d4504765ddd99e502541581d70c2f0e6c3418ec97fac
- SSDEEP 24576:k4nkVztlv8lQJxnv0Y8XB4LvyAoDpXTWpma6tzylxqQRTtD6/0e23YkpoojjBjZ:kaheJ1vvyTBtuLp1Wi3/KgjBd
- TLSH T1BA165B1067F5296DE1EB133BED3186056B72F99D3B35C20C0B5544AE29F2788CE6A363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\MbamUI.Tray.deps.json
- Size 14KB
- SHA256 53b36a5c74f11ade2f09f1e9639e9e4fa0d2a8853a1ee8aa29ab70cbfa76814e
- MD5 864f8d7168452e764aa1be0fa3a548cb
- SHA1 13360f67216fc41dd436c875a0fe862097056b3e
- SHA512 1751ca9756445756d688f7cd456c9ee4493bcd29930bf8829ee6631e2dc437e0d615e30fe4e46ea639fad140205c63b0fd0d00d83625534a709ecc1fa7f1c6d7
- SSDEEP 96:X75Q03qXNHxVwTA3G8EnqimkKqTxecN4QhPoayc6TFBcSVy9/LDYap75LGQ9gpGk:XF3GceQhP7yb/WShCYdA8IEP
- TLSH T18962A925E8946E770972BBF1A8350181F639236F7004684E79FC285D8FB7F5AA086F35
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\MbamUI.Tray.dll
- Size 191KB
- SHA256 709e5ee46191cd492cdf44814807e80560865c0c199e7db90d966cdf1b3973d7
- MD5 38f92486e93a79084e38348ad1bc8f3e
- SHA1 e3154eef790cc81c681d30f2b7602aad31dd18f5
- SHA512 1b2d1d216afd1dced45c637ed895c3650a02fb55f9227eb9ba5b5273eedc167f836537ea115e54878fe3daab380e218fb69c38a42b43573879375333937df85a
- SSDEEP 3072:TRjx2BrTbfJtOSIQJmoQDF1G3AWb4B0BNdmKj5Vge:exTbfmSBJmoQDF1GwWu8N/j1
- TLSH T1C4141683ABD88962FA9E797B685701AD8B35EA571B33D26D34C48C7C0577F884F02217
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\MdXaml.dll
- Size 183KB
- SHA256 c9566bbc0053b617676b93335870647e4d4cbe22ec142098caf81a66e6590d74
- MD5 aadcadbde9d862d4e51b8398e4f529bb
- SHA1 90a4e19138a1408affc096d280e7c3fdcb9ee9a4
- SHA512 282f31b8779dc6657ea430f47299a6e9e7cb0198af3cca587da61bdaa546186beb7a275fbd6b8c297efb1d49f8d23f531a8d9daca65833dc0713f3f294a662f6
- SSDEEP 3072:CLmHpg9WcYmiWbkt+akcNfU0LYmaGTK5hyRNv:9WfIZt3HLLla2K89
- TLSH T132041A0253D88A21E2AF0934E520E8A5DB3343AB1236CA457BDD75AF1B7B3910577B63
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\Microsoft.Data.Sqlite.dll
- Size 173KB
- SHA256 4ffa9156ebb9332bc53196cde2e62997447ad046629216be555e07d5d65f6c19
- MD5 803fb44bcf3e488c9fbaac4933d729bb
- SHA1 2f9d613cc53944e912ede7a1214d87554e30394f
- SHA512 569041a3b05cf1bd548ff2c767a48d4c30c9be9a3e11c4407714d1ae1928f817d1a15cdc08fed40c0fbbda78ee3ac4f9ad443be43744647507bc7f6caefb8afd
- SSDEEP 3072:5Po1U7KHI/FRmHsGP8vrzqWLvVtly65GBSilr7DSILSAQSIgdG8CmST:9omLmHsGPKGWhrZ543Iv8Ch
- TLSH T16B0449B4135C6543C7FFCE32B0B96C820734AA4BD5D2D74BAE40E5B93923745AE8129E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\Microsoft.EntityFrameworkCore.Abstractions.dll
- Size 33KB
- SHA256 c29df8f2db22e129bb6929130d98aa612b570a5ebab9842a11e809796cf03448
- MD5 5e000060b3a6a847d27f892b4f0f9c12
- SHA1 ef4f660221e458f6ae38127769f66f924581b3a3
- SHA512 28337074f48d61d9c11c4dd30eebacff52b0bbe5470aef7a0a07b2c336adf0ede76c7aa5742c457a6f8459528b8b5140775f7d6d6eb6e282942ceb30ac2b1f73
- SSDEEP 768:/eLi5XHQQd3Sksb55OkbzouC+MV2bQEF/9zR:WMXdtw5BbzS+U28EDzR
- TLSH T1DFF25C52639C9333DAFF1A76F570A5812836F7863811DA7A4A44F08D18637C0AA70B77
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\Microsoft.EntityFrameworkCore.Relational.dll
- Size 2.1MB
- SHA256 687f84616b0a58de7ba0c20d14b4fe38871d79161f2de5bb3f48d171c292a0db
- MD5 6d842b431b91328b5c703ec7e721c3f4
- SHA1 1a5617d2e2c79fa20b43aa7eaf3d0aacf5ddb6ed
- SHA512 04cb1f53504f1fa4860b5bc984ebf7054e8ee99c1512efca461c01c74f63e493d81ff7a5ffe56c98a09a27a6f3c8d170fc194e7fcc4c88f7f6c5c1acd689f5d1
- SSDEEP 24576:yfWlkbXVTUH5pnb05u3bLbeIdvDLbncb9WOEJ89F7T+IyTS6oNzvP/vTXqXFti7F:ypEJ89F7TgS6oZkSNPeFC/U6
- TLSH T1C0A55B45B3B8BE62E1BF5336E025844473F6E846A352EB5A240CBAFE2C537411D41B7B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\Microsoft.EntityFrameworkCore.Sqlite.dll
- Size 304KB
- SHA256 623bc03297fcefc658a9e251d1e75c12d7365b80a3ebcfecd3e31d5a6e7feead
- MD5 3ded14093905c1f26692be0c0ec2305d
- SHA1 aa249a469baecbff645d9cb6c6b7577ac30c2f6f
- SHA512 68eb5848dee8ce008e90d317611fda792f2b10e4e19c03f0e5453f214e501cb2bf1f81755a29ad7a185ac4cd5cbc0c3af78c554425fcd5183d7b8bfd8f60c423
- SSDEEP 3072:y614aDpdB36A912H5mQtTLvf8u4tcLR8BlNt+kNpQo2NxGG6tHmXiVstgbx3h+0q:yg4aFjPf26o81tzpv2GGdyBCjKcwJnQ
- TLSH T1C5646B4133FC9326D5FF8736B074C14883FCE9178499DB4E2C94A5EB2EE23415A29A67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\Microsoft.EntityFrameworkCore.dll
- Size 2.7MB
- SHA256 6750a0c56a1d557d7590728d4d7378f6e1ec65cb96e59489023cdc9fd139f6ca
- MD5 4522635c0a768a1968fc0c606384aec4
- SHA1 b1a5d4ec3016894c5c73ca1ca80304dab0144634
- SHA512 6362209e1e9f8f1eda70b01609ce617987d10a422730bb5f3559a2ac4d2c970e4bba6d4c03406f52e50262b8f0627f6df2bcd4408a0a496be69392994ec2e388
- SSDEEP 24576:cH7ch/JrNY4K49OX6HDkMqdGO+nDGBHUefp2c1boCLFtrNBIdu633Do9R/42iQ9Q:qcqRYkMqdGO+lWm2/NW+hmqulzEY
- TLSH T192D55B55F3EC5F26C4BFC736B078054093FFE8941372DB075084AABA39A37524AC96A6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\Microsoft.Extensions.Caching.Abstractions.dll
- Size 36KB
- SHA256 46697030a421c60e4a1eecb295fe14513a562bb2e5d7e0ac878f4934e56bb50b
- MD5 ccc8814b69e63f0c87dac4da0d9dd1bb
- SHA1 1a2f71bf9b77e83084fad125161735148703fa2b
- SHA512 e7413110fb79901fad3c4cecd2701f760f7962ee52c00e566a965babf1d0a805827efe499ea8d2eb455f12ea6bf3cd1cfe988d5fb53d70d77004bba3dfccedb0
- SSDEEP 768:/BPRm3g7qLxnMLsLNRP0iNeAr+KIeOt83ZW26/9ze:5PkxMoLAiNeAr+Kst83ZW2Eze
- TLSH T12F035B048764C363DDFE2BBABDE581C60A36E64A6412E71A5C8CF4DD0D03788DBB1766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\Microsoft.Extensions.Caching.Memory.dll
- Size 46KB
- SHA256 f108fc79cd1b69eb4d0f8a45d198c5fb99ace430dbec65380854a559a248d6a9
- MD5 6346b4d17d67e59c82aa743b572ba255
- SHA1 0e6ccc1c528501562cd17d878525de1be6e69fcc
- SHA512 4620967e627981f0c758e6fae1ec10a3564ff6612b538d21be6167fbb4c1545d7ed65abf392086b41f02cc62260d190ff6c21ac59f78e9549c601f70527bcddc
- SSDEEP 768:LZWKkP6xlhFOQjkEL3ZAcueHPsXeHrjZ9zf62K:9lanm3OTwsXebzfW
- TLSH T1FB234A00576C4327DFFE1BB8EAB0A5511B7A87977811FB691CCEB1995CA37C0861223B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\Microsoft.Extensions.Configuration.Abstractions.dll
- Size 27KB
- SHA256 c295e6c3384ed61e4fea0fc43479aadedf81a60c9c97d3dbdb9247f562e0846f
- MD5 59a088e0efed74aedb4d38b18cb81dca
- SHA1 80c85b3e2654e9a98ae49ceb0c074d9b43352b02
- SHA512 e869a3512828477ee8a5fb163d008e50cd516cbd121bbb5873a4434a9200612470edcd7204749dc13cfb7e9e0d3ee9ab323e7b4a3194e3d5b7d17a7a447750ea
- SSDEEP 384:TJ5rtAUhkfuUIh0cUarO9vaTG/dwSzRjz67MFTFUjTWsjSNWRlNaADSki+R9zGDp:15KUhFFh0cU6Qp6cO9zkR
- TLSH T10DD24B1683AC9323CCBB2E75E9A1C4562E35D397A801EE5A64DDF0094DA37C45722B3E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\Microsoft.Extensions.DependencyInjection.Abstractions.dll
- Size 64KB
- SHA256 ca708422782fb25819941a16a057ea96d6d18b037e7e5cbfdf340b7a04362b57
- MD5 ae5e45ed689ecd9ca584e517dec04437
- SHA1 a03538d460b2cd255477500b364d9e463afe05c2
- SHA512 0ec0ddb7f15cda3e02039de26d1730d6ac4383a384ad56fda8398ec6cf33d9489add536e78e76f6a6f33590895f9da60e2d6b98aa437607c6533e9b80d26152c
- SSDEEP 1536:PFuu+NbA5+iU5t53Ueb4I+MkT/sEyWzekwmgzT:Ph4ttkDsb6omg3
- TLSH T10C532B6837F9E613DBBE4A3137E642C1AB78AF036001F70F254A92F50597BC949909B7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\Microsoft.Extensions.DependencyInjection.dll
- Size 93KB
- SHA256 47f8175d34e9087d3858644803c558cb9cf52b29bffda796f65c1c527d1b6a22
- MD5 691d122172e70a956be0ed59b935a8a9
- SHA1 13db5e854cfe3805bb518b501c438ea394b5683b
- SHA512 995afb87da135e03386bd5d0072bc93a8c99372ec963a566d304161ba9521a4735d88e9048e5b9bd07a25da410c54a1165e0392aceb292410be6c8f5c48308f0
- SSDEEP 1536:txemzdEwSsliCvUFoN93dJrutpF5nRN46zIQ:txqsl2FoNBrutdj46/
- TLSH T1F2935C7513FC9B26E9DF0A74A87542404B79FA9A3402E35D0EC4E06D1EA3FC54B6226B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\Microsoft.Extensions.DependencyModel.dll
- Size 82KB
- SHA256 8dadc004effa669d9caf231019413e469d58632eadb9dacf56aad07d8bac82a3
- MD5 52ec978e8277e966277939d57630fd6d
- SHA1 547f659d6e20d7f13120fb52413a2db7fecd428e
- SHA512 43fffe70d25e79c45a5cb018e03565718aeaf910231c270cd87bb9806ba410c7afee2bc54911b80553ed7898e6a61e46636ced974139e2aba5158d24d951d3a0
- SSDEEP 1536:iuCEshm8cqNUMP/9T3vM8Gkvv0P2OK4bYMgzU:L5lbOj/9TfL7vCfsMgI
- TLSH T15C836C01A7EC9713EAEF1BB578B5A05907B2F65B6013FB5C6D4D609A0907BC04720AF7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\Microsoft.Extensions.Logging.Abstractions.dll
- Size 65KB
- SHA256 ec244a2db19dffe90cd299fa4b0691456ced342a078b4a93cf3726a9b431e9ac
- MD5 ce9485a33686f5b71a44b578c1f62a83
- SHA1 08c936106235dc9a3c30f817896f947354460b4c
- SHA512 fbd2b2bb5b83a280fe16e51d48dab44f9708ba224ae854e8510790cf0eebbfb23056009d8d5347f05c04fb4e2d16ee110f497ad7f243646e6ad78927fcc6b1e1
- SSDEEP 1536:jc7Vs2LEzbPQV1b66atnqmY8bf24LNU/XhQ6zIhQ:j2PBV1b/OqRY0q6t
- TLSH T1AC636C1197DC4733CB7F4EB6E82196524B35C5473103E7676CCCE1697827BD8AA202BA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\Microsoft.Extensions.Logging.dll
- Size 50KB
- SHA256 74d8fd2d7997fc638474e2bd79916458a30481e6a6925b50e7e96b4b852031c3
- MD5 8ab959f2310c6f8a3ecf2de3cecb978c
- SHA1 f989f82c587621c85856ba0266759e6a848f4e98
- SHA512 aef718d5e732e7c9a6dc98e54e03d7cc91f72b5fbe738bc9d1d1a8001fc1fdc9e7247fada6be660b58f4532f172855e3108110b91d3ead49aad03266a6eddd87
- SSDEEP 768:OVY+gXlZrIb5IilZcLfQQ1rERWp8gFT7Gf0lJa2s9zwH:OVY+yf25IiDcTZ1rEgz60lJDkzwH
- TLSH T1D0334A5183EC9366E5EE5E38F9E0D8555B3AD74B6002EB865ECCF0B428B37D0462067B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\Microsoft.Extensions.Options.dll
- Size 63KB
- SHA256 644350f8c2404d4479b97a250edb29585e5fafec1b6ce8486ae600c5015fd7fb
- MD5 cd3547864f8b6753525e759948a8901e
- SHA1 121a0634920dd0edab6403f9aedd675bb77ab74f
- SHA512 55128005f5d095b0f977f0a1f8814cb1f7dbcbde8b14f791f392387f605e7bc0e20ce96de65ee6f7c23c6c6930f2df6390f3ebacab81af9ba76059a4e5d869e9
- SSDEEP 768:JxLQqsUmClAD59d05JD/GQtbOZZn6SqaDiNax4PTcFBLCx5NLdW7NDpfbrr9zP70:TLExCmD7dvQtgZtqTyekE5mB9fXBzA
- TLSH T13A536D014B5C9762CEEF4A71F458C1F11A36C36BB54BB32A96CCE2A81DE73909FA1531
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\Microsoft.Extensions.Primitives.dll
- Size 43KB
- SHA256 a0794c3bab2d7e0c848f0dffb3b9aa4b43ce07dc0abd122ebb7bf6dc79452ec4
- MD5 0665c2fcf8856e8790488ad7caa2c00f
- SHA1 5e7f4cc30b5a252cfdc016eadf69d3b181013d36
- SHA512 3d3f4595d5ea34e2b691b05fd540b8c92bb84b1d30706a10e375166cc3fe70228f7f68425e4dd9d814fa0669ed10ec61fe30c0cd43c705054f3a20da20cdc260
- SSDEEP 768:EipZy7/jRFQLfvJ4dBayaIb/Olz1OkytW58cZM7uisK1KPp2Kfr//9zT8B:nMjjcLfnjimp1OkytVc67uisK162eNzG
- TLSH T113135C41A3AC8333CEFE5E32B4E4D155063897AA7552FB5B96C8E0A45D633C05B3263B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\Microsoft.Xaml.Behaviors.dll
- Size 142KB
- SHA256 0493049febb4be74bdf669ad7fa754941c2754fe33421e230a8f14c8fd06c8c4
- MD5 a10c6f9556dfccca0db08b9ef2e86c4b
- SHA1 e34dedf472f32ac21306e5673d34dd2ec0deac15
- SHA512 8128bc268c5a62cec0eaf3bcb22b93e017f2a1d60808476a1c437ebdb6494ebfe898ac24dfbd620b525ed9b26bf81a8b7ebcfea26dabbeaf18fbf5538aa160e1
- SSDEEP 3072:+XQg6pDJRt4v4VMvlat1dLXTrGmAJ5ryjTT:YQD1JRtigRGG
- TLSH T198E34B6053FC8A5ED7FF1634E0B061158671EB9BB933DB0D5E84D2AE04A338266127B7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\MwacLib.dll
- Size 6.6MB
- SHA256 3652577e9d5d5fec4f63aa6fc4e49d42f7c17ebebad51c54e7c32373ab29c73b
- MD5 06169ad7cded2cfde1b040078818cfc6
- SHA1 8c58501129d04168f76cf55aa3846a5dd01a8cb4
- SHA512 9d2a937e3d2e37d95c3dc3bf15703a078e17e19bd0cfccb1ee362c74cd1a634fedc67b87624606883bf35a2001b1e92c835f71c4abd629da9eb39fbedd3294d2
- SSDEEP 49152:UHysXsdfI2NfbHfHfOhezBJu1eiGTbLkTKk4BHnVazTKcY1FKkAE3E1xEXp0LHLZ:9nOhFkxEKcYpAnE5edWwnJBAFE4q
- TLSH T112668D26B6E440A9D8B6D238CA578213FBB3B851573197DF06A0973A1F73BD0963E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\Prism.Container.Extensions.dll
- Size 20KB
- SHA256 85a55b97f20431fcf6d33634de6a86d7c6d441be413c728e19dda8b0aef72e92
- MD5 7c761ce50753f23707b12774d6191482
- SHA1 2a6367003777f077c2b0969e0454bc4de7b0757a
- SHA512 cc0dc04d17316a816553bac6092f124310c3fcb3c131ee9421bc6581710493233e7004d07bc097a9caa818d3b0c1320135d6562794d9520c207fbe6dd2f4f559
- SSDEEP 384:h8z2AKJxYjp8LXg0uHPF+jCZSZmZPSUPo2/VlhC9:h8z2AoYN3vF+jqSUPoAlhC9
- TLSH T1D5922B528BA44373EDBB8F35BDF592105A30FF41AC60CE6A069CD0C9CEE2B5445B463A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\Prism.DryIoc.Wpf.dll
- Size 26KB
- SHA256 ad1666c83f2554b09396386fcec856f9b3068b9bc2a29f13c08d3ce0c23d7d4f
- MD5 bd3f6009fc2b6a04bb3401c0158a2868
- SHA1 62aeb021c1fd18dd4bee4e3c6947571738582819
- SHA512 83e4ed6ff4351056c2003d776cb15916f280f1cd3aa4c6ae6e4cf982c0b69e21c1ad3c08d0ee4b3fbf7861f9b231f5ddb8735a037ee7beb76c1ac485fe49450d
- SSDEEP 384:j6Xd47wSthuCfI0xlid20I3W7xrgfScZSZmZPtU91C/SyIpMehV:8d4sAuCfDxd16ZQSYtG1npKehV
- TLSH T1D5C24B51CFE01536DEBB4F7E78F051015E70F746BC52C6AF819880A41EA3BA11A9077E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\Prism.Wpf.dll
- Size 132KB
- SHA256 c3b44b118486a5d74d696c14853e5306ec893dadd0be8ea6f404edae8c66f2d3
- MD5 7a103c5bde44976ad0627443af2e1a4b
- SHA1 55e4bb694cca644846bd4a39782d76d9b4996480
- SHA512 8ca0142f855f776cd610c5e9e6ed46bae8d980deff2a8916c8fb4356d516d1f0d9b8c0114f456740402f1de1ea55c5eb4f797bb04f00196c7a647fe212e50836
- SSDEEP 3072:ifxD31bs6W5SVEcJ8+s8ggRwfEQwwzOfzH3mgQ:ift31RVVRs8g5wwzOfz0
- TLSH T1CDD35B2923FC876BDBFF4A39F57440018FB2FE472062E75A5944E4AC285374196923BB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\Prism.dll
- Size 89KB
- SHA256 92090c9c3c5195149885be91aa469b85d2cba9a215cb3bfb65e93945f33d852b
- MD5 0877a419afc7306cfa2d301e314f0548
- SHA1 ba76afb78636546c5dd73162bba7a98ae3b34724
- SHA512 5e3ac30005f4fdee8f85d2a632415bef7a9722add4cfc59745da9a41e87cf79e5c62a0c2fb52b79381495be94f7b7d0ec3a455f0f112e7b0bdaf63d6b46c6bd1
- SSDEEP 1536:eH8fhOdBanbA/0soPhaECCcCxGVSCC+5rgnCnS+6j+DZORL0SSeVEEkqYyg1H:G8Z8MbwaCCcCxGVSCCFCnS+94LNSCYR
- TLSH T116935C1063EC4B23DAFF5F78B97410450BB6FA436522EB5E594CA1A80C63BD049A53FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\QRCoder.dll
- Size 228KB
- SHA256 5c06f128b66ea50ecb92ba0c7173c47b8f58eff8328bf1973794d5117604b650
- MD5 18597be15c7349a4fc565d52e7be6c1a
- SHA1 9d4f08368ccc081a0f214fa4ab7cf87838cb499a
- SHA512 0401e409c207a66f090d75515be6c47c390949431e9d442bf7a60a8c74c88c2b89c5c2325459e4025c281d4759a36ab877ef7511075c383d2b9440f082fada49
- SSDEEP 3072:wbtYdT8Wa/cOnjtzdG0PRUQYw8n+6nMovphLwQfldIkP5NxBVWrDAoBgDvsJot7B:wbC8WqTbK5ntLPIk1nWrDAagYS
- TLSH T144349C6967FCDA02E6BF6F35E8B050118772BAA22D36D74F198CD4AC15A3BC049407B7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\RTPControllerImpl.dll
- Size 6.5MB
- SHA256 e9768a3b26d32210a3effbb5dc19e21ed210a0e961a9d5f1688415e0cd8fa25f
- MD5 6be74889fb768db8e1691f18a188792c
- SHA1 e71979f579a1daf5298127a36b3705998dbee018
- SHA512 4bc2cc69626eaca705401733cf6d2376bce011e90735b4a4621a8ce20c92b6f3a47e901b0ca806eb3ee98821c52e6ad7928943c5b8ba098b905e44f95cdad469
- SSDEEP 49152:1q1AzAU1AAnVekencojgZFydV7r6oVfdWn2vsI46tKVc0+dZQl1Xpct6XQ9dQABr:VB7VcwNWk4gYSwju+NmMY4wu
- TLSH T1F3669E1A77E400A4D4B6D238CA678513D7B3BC554732DBDF06A0966A2F73BE0863EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\SPControllerImpl.dll
- Size 4.5MB
- SHA256 6563c8273b0285bb2db5df55c8a707b76ed9215739b78ea4e2f954ee1025ef12
- MD5 efaf9a951675b1d23cf37e6f0cb9a02b
- SHA1 ec1edd6046df2d78f26a708db865c16065bc5021
- SHA512 9a43c424313d610c9bc133bb35d7ed3b7bf424c66b8820483a103aa41d3628fb609c26d5ab1399f7b6bb43ae962b03307cc32fb5a5a4d434934b5be0bf98c793
- SSDEEP 49152:JRNwUFTWIls1ThDYENU+QTRzmKVuPSfgSdBF5Mufa3j9LIJv24rBPZROnwPi5zUR:XlQBFQT8v6GufOJVuBPzyKR
- TLSH T1B1268D17AAE801ACD876D23C89AB8603D7B2BC61437097CF0674567A1FB3BE1563E714
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\SQLitePCLRaw.batteries_v2.dll
- Size 32KB
- SHA256 a3ab8eb17f24daa3e06676850fb3e635ab0d11e9c03bf8d0ff4d79c85f65ce76
- MD5 4ef11c789d4e2141681a4871508ec23e
- SHA1 8a165f2dcfa379eb4270021d4bc8ca834207ce7d
- SHA512 dc73c867e80b8410f871ae5a05d2f053b6f88278e83e6e0bcab1ac945d05d16f3daa327b4e02f4acabc5921d4e4dc9757d07a7ae0b9915dd39c7316821464489
- SSDEEP 768:IXy5YiRiUIrA+hLy1JpJMegc2Ip45Txf1mlIJqlT:IXw7RiUf1HrS9LfIkqp
- TLSH T10EE27ED74B684407EF53DE70B5E4D9A3BD78B7C368608597609AC2800B423C6BB9D2BD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\SQLitePCLRaw.core.dll
- Size 77KB
- SHA256 f87073b9bceb6270cb71cb7edee808736f284152b9332d6dab9821464657192e
- MD5 6272f95ea80021233267325fc9c4e6bb
- SHA1 c60f9284fdcdb5eb9b9e5a3da01f0fecf6ab4243
- SHA512 cda2e0115903251196bbf6589009157cb6b2e7dd2b73b0a8d1b21049f3fec65e655b889c21303b68d0be8bf09f03fb333181d40e2efcd5d8db8bb661a4fdbb06
- SSDEEP 1536:LAFy5WiUx1PaDJqq4qLN1JirPi1HLsKa7RieHrS9/fIkCa:L/pji2PaxS
- TLSH T1D4737B7587958D1AE9CE8030B0BB40D6BA70D21AA7F7CB63F590D0B019723CB56B51BE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\SQLitePCLRaw.provider.e_sqlcipher.dll
- Size 63KB
- SHA256 4caa977c084e3025a4386e388f6879da32946136b3cebe31c48f6d988dfdb3b1
- MD5 6e4c0cb16484986666ae3834c3ee4a68
- SHA1 3f3751fa063480fca5955239c370540a3dbd412b
- SHA512 b1cae329435a467ad58cff7e797c7c9efcb8d935da8fa4f424fa3fd8ec17e90279f0d6ff2dc207e9b238b91044893850847e4d5404ea4d73445df4e6c1fed1e6
- SSDEEP 1536:aD35VJMRjNUQ2QuX2YTn7Pe/x9hE431Tyv7Ri0qSHrS96fIbHSnM:aNajoR72lBYvCTJ
- TLSH T1C0533BD6975E0A22F68D0A3278775E86A178E3C2FF725303A957C3385D633C58B942B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\SQLitePCLRaw.provider.e_sqlite3.dll
- Size 63KB
- SHA256 a2494f2ab97ccb867ccc48205120c370cc56654c7b712222b51fe88e5f797a41
- MD5 8dbf42a20df57eeef0993a11a2b80f09
- SHA1 ebf9543cf9764cf3f125361f5ce32975f9946bbb
- SHA512 aa4ecabd4be7ddbdf557e7f3e0dc53d5abcfb6490957e8d025ad7fd294a9a3537df87fff0e8c4897c9ed8e588a13009617730b3b19928d7e16abe891c5dbb93d
- SSDEEP 1536:ILOVCntPI/3ebE43FTtA7Ri4+v0HrS98JfIYkX:I3tQeBHAxCp
- TLSH T19E534BD6874F2525F69D0B32B8B35E869678E392FB321713A947C3798D623C14F842B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\ScanControllerImpl.dll
- Size 7.0MB
- SHA256 070388b46ac8e1bb5e09fd3afb99a3d9b7ba786efa5072c1d65d1bdf9b62ab9f
- MD5 04f7821bc2f8953c0ecde89cd8613712
- SHA1 23fc69e74f33a744d955651b4f13ed5b0a7e8a10
- SHA512 9314d37916568b83e06f6bb0d8fa7bd41d4de4aa8133a0d3443e264f2959e8ae701c85c5382cfae4eef7f27ea791b2d7cbff0739e711923417862969ce9162ed
- SSDEEP 98304:JBpHTOw/z5fIjpYfbRmnhsFRLti5wYVbEB3NitGzCXMiNWoqtNZQ33GpjlZe:HpHTOwRNi42MiNWoqtN632n8
- TLSH T1C8767D5A72E400A8D4B7C278CAA78513DBB3BC554731D7DF0660966A1F73BE08A3EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\SelfProtectionSdk.dll
- Size 4.6MB
- SHA256 09b8ea52a6950390fa1f96720f0c7b4c527631b24d27466e5f9e5952701dbc0b
- MD5 9466bdc77270fafe1849911257d1b2f9
- SHA1 4b6f98d87da1b31cb788f202617f567e200473cb
- SHA512 de9d02a89e20fde5777bc591c647871689cd9f0ed07d5aa3b483accac897eeef536ebc56d732349c0ce6eea233e117fbcf131e83877d66281424772aa8b4a7cc
- SSDEEP 49152:VvVNraNCw9Vjvu1DPcFFiIju4Bn241fvX9MDwKDKGMsWOVRtPGWzU03LcZdkZH4e:Bw9UqIivGDcsWoO5xZdkU+3
- TLSH T1AD268D17A6E601A8D876C23889B78603E7B2BC1147709BCF0A6496792FB3BD1573F714
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\SelfProtectionShim.dll
- Size 4.0MB
- SHA256 ccb4ce36aa0887ed1017abd15b1019f31a8fe2c1afc55a6a063d94142d7483c2
- MD5 d1d035f3ad7cc27a29e0e80186571c4b
- SHA1 37a42f712a8e847f8d575613b47962c0f3c28f3a
- SHA512 f37523a83d0a41ef128b8d731599e26be3dfdb868c6e0f9068e5318f038cd59d72700beab772814d4d2ebc69657d3173bd3c596461473a25cfe9b10306733e82
- SSDEEP 49152:8EWWy/r6DbXWDWVZ76nXsLLeLWRBKI8GUfdgTyQWVp1CLrNSJPCqwzUyLWm:3fXWsDY3dgTWC3dSNm
- TLSH T17F168D17B7E841B8D866C23D85638603E7B2BC2107709BCF16A466791FB3BE2563E714
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\Sentry.dll
- Size 835KB
- SHA256 3c1e22c93602a9807771c1fa1416916776671c56e68fc18376eae7d7e4366ece
- MD5 6790483da111d2c6104a40484443d9e3
- SHA1 c1d042194785365168a0cd2e5ab0d0302d6642a2
- SHA512 8cbb8263cbd63749890292d1ab8f07d14145f8e800e17c54262b1035a36ab3e824f44cb96687c013c6af4347e2f78321823f701088eea30c2ed713938dc6d6a2
- SSDEEP 12288:3viEDdBXBL8cTitI9PrTiU5OrTYT0ffg+ZO2gVA:3K8HTH62OoQo+ZO2gi
- TLSH T10E055A4127F8D73AD4AFAB30E87851580FF6FB5AA566E70F0608A1AD3D973418E40763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\Serilog.Extensions.Logging.dll
- Size 55KB
- SHA256 2ed97c6c9d069560e5e3f2fb7971ef13694fbb72d3d0606805cce7144ef0811e
- MD5 6f779e4267e1bf6fd17f4ad8f5412336
- SHA1 0266afe2b99415b217d4b69d5ed1e9cbbd00ecc2
- SHA512 202d5f7c358210fe8bf8d4edc86a4d83ffc00cfb73f61fbbf211a2c723b1aff8f9a15a69a4f2afe70abab6114042632c612d4f9a97c8f08923d22eed6e9e6ba4
- SSDEEP 768:xmkF5xvmGCZDv9Pj3lqYh5YiRiWCrA+hLLYJpJMegc2Ip454Txf1mlRaXXC3H:x3dvmGCZDFPTwYP7RiWgYHrS9yfIYXQ
- TLSH T1CE437D42A77C5723DECB5E31B0E4C991BB34D7E37420D6863899E2904D633862BB526F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\Serilog.Sinks.File.dll
- Size 63KB
- SHA256 6a4cf1c06f76e10daa10ada8ade23b2f0cb74ad78e95232f3dc62b6775279ab1
- MD5 e1f99433d7679a605b6204810fc1d724
- SHA1 617acf6204d8f9b9f9a7e684aaec36730acd4602
- SHA512 eed75c836e676e38a5c635c4b0c9d5b44be1d881282b22f97629af4336fb33664d48641f43ba15f59e7554203444ddfb98959b1325c39ab8db526ab8dbfb4b07
- SSDEEP 768:1rOrAAt9tu4wjf82XdrHdDQ7cRAPUWvXPomsA6Be5YiRiHkrA+hLaJpJMegc2IpG:10Dt41dC7cRbVBU7RixHrS9MfILph
- TLSH T1B4536D92A7EC0327EEDF5F74B4F4D9532B35F7E36821D64A1098C2940C62B811B643AB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\Serilog.dll
- Size 186KB
- SHA256 7a60b92c5ec7db4c7037c70243531f1c34552d318d5a29c5a7e84141e752978a
- MD5 5d7777605e71bec6379fe95add5bdb4c
- SHA1 c0df63924e5e362c1954a4a125cef4efbb544fcf
- SHA512 ab5a993037c05be308a1e3854d8a149abe4685b03d7c37a5a7ffdb114921cbcd89809846fa785ebbaf6a4b773e32aff381706a2ed0c434f6a4e418b4fb889b34
- SSDEEP 3072:8ojNje2ueNclPk+lbsdAz/SnSpnf6G9Hk3xvVbXyMc6f9MXU4JV2LgI:8ohje2ueNclPJlbsAzSixHW1Ti7k
- TLSH T10C147E2A73EC4A76DADF5B7DB0A091442B30FA5B9427E7CF680CA5E80917F855E40327
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\Swissarmy.dll
- Size 5.3MB
- SHA256 a24d72190300454137e6d64c87eeb5f27f9cf12830120bb0f1ba5e9e5b410221
- MD5 32a81cdcb2e3847cea53da1de934ed3d
- SHA1 91a1824a6e47289bd9c079722894a68a01c00e75
- SHA512 4d4536479e7914efc1ad3a6b9b9ee4ac777c086c8911592f00681f8188b1aeb68664d713e24a63784edc8f71a042d444cc339537d159f41aa8012870b172e2af
- SSDEEP 49152:SLG8qKNFeojCOg33h8pRdPSDIGRmqiZBmdWZyKYbHkEAoXvEPj8QF9yllBpP9azk:wfex8pCIQbWZ0kd8xTdNhfoXPX/c
- TLSH T1C4468D17A6D500ADD8B7C278C99B8603D7B3B81553319BCF1A64522A2FB3BE2573E701
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\SwissarmyShim.dll
- Size 3.8MB
- SHA256 732966ed236d085e61eeb95901c76a7cc2701cb85c94f420f03e1236ebbf7512
- MD5 d6bf703d35964296a44799730871656d
- SHA1 8646dd060b408f43c191197045a05a62389b5036
- SHA512 9f539adf35e90651a4a973103e86e5a7a167fb1b21bf736da59713744953ca2c5809686f8e61316b1f1c7cb294a5ebd2b9042f62691082e4dec6e42cbe70a24b
- SSDEEP 49152:B5AWJyZyVe6ZGVE96H+KLNjU1BWIaDLwOx/AJJKFS7JkC3zly0IPLRzUgT9RmGv:eUemgTTwOCJJRDqygz3
- TLSH T19D067B17E79940A8CCAAC23C85578607D7B2BC127770A7CF1AB466691FB3BE1123E714
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\System.Diagnostics.EventLog.dll
- Size 172KB
- SHA256 9177c5434d2872741cf7a80e000c52166fed8930d07ab154c6a4d476d01a9aaa
- MD5 74de4396506a13ba8bcbbe9d445e53ee
- SHA1 0fef9f1f91de802006f20c019c9d1a2899df0843
- SHA512 42a00206c4f43ac589aaec7d06045959cf47fd58caef55d91801e88010c454fccf6451a525a8a80f7ee4eaa1813cd7b832f975f494f11802c7622bb4ba552adc
- SSDEEP 3072:XhV2mZAS5h+Jp6l6XPSlzOR5KkORMuPYHgDCaTd7brDHbh7oN+r65k1+EK8IFxQX:XGa2tPgDCaTd7bvl7o+25k1udSOk
- TLSH T151045B3873E84B0EE7FE1F38F4B160194736B5A6693BE36D458498ED0563BC09A20767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\System.DirectoryServices.AccountManagement.dll
- Size 297KB
- SHA256 721a82b65516782f57f7fbf4c9940c016f8c1a209d5fed553b5044c45485b8fd
- MD5 1f873950cc7f0b618f60b2480af0cb2b
- SHA1 f19815525e195507a3b0ac715f8436e0ef77f4ef
- SHA512 9941dac5b23bf3370743086ce0f30ae0ddd7aab414c2892d9ecdce2da0124a3b13cbd395435e9751f7720bff82d685ae39c9c737a65049fa2a7e6667165d7eae
- SSDEEP 6144:B2iefgF6OdLKeKSxviFfK9qTLXR3TN7XkA1KydWI+:BJUOdLuK4TLXR3T5m
- TLSH T1F754291033E80A49E2FF2775A4B014159B79BB57A9AAEF1C0D7314EE0873B81DA60777
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\System.DirectoryServices.Protocols.dll
- Size 178KB
- SHA256 fc0f22cc109a429b68d3d83fa48067166452942c25a7acb9870bd78a801cd8e8
- MD5 2006d42ec419f880c98bbbbb17f086a8
- SHA1 a865ba0595fcff5e045dbebd0f699f52fbb13ebc
- SHA512 354b95400724606e10507031669b847291c801d1503b0d72442db95f7b4d904347ee7f8584dc5c278736dd067d69009109c7e8c40ed47c536b9405e75a6d7cae
- SSDEEP 3072:l9THCcJnTPM7fqVCPecdwTPKu5RmX2wvCln1yZimWunuk/cD8IUt60ZeKFTpH4g:DTJsdwTPKu5I2wvClnlmWu9IJ0ZeKFZ
- TLSH T1D1043B1433FC0B1DEAFF1B74E9B051208A35B946BA3AE72D164544EE1CA3B809762777
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\System.ServiceProcess.ServiceController.dll
- Size 90KB
- SHA256 3961824bc760e2e5433c8bec08f85bb4c391ef545a1bed524bcc8cd4217852bc
- MD5 2263fef1a310e9a813067536845bdee1
- SHA1 29bc27e783ba51124e0e5baa81f03faadee69da5
- SHA512 0e11d70d9cffa8c9ecd07d28669307793a77fb96c6ef17a6be9289973718ad91ce08ca654675bf5137de281c432066ed85388ef479b314948457d8eeb10bef74
- SSDEEP 1536:8FHy6KWI+phJXYuk0wN7QvxG1TbUcWxaN0pg1bGgz2:8wII+pPof0wN7Qvx+uxaNP16gi
- TLSH T15E93F70163FC076AEAFB1F747CB161520A35BD46A935EB3D15C8419E0AF2B848A34777
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\TelemetryControllerImpl.dll
- Size 7.4MB
- SHA256 1e13bd4f75569d9f70c0a1bf77d5393c72caf502b2c38b1b8e01018734d56455
- MD5 4c73a450618af1e01b9a23f6102f7de7
- SHA1 20ceadc8972224581c4ca87bd2a403136bcd0411
- SHA512 e42a868a865b59a18279a07a05aff2f8078ed80d5a468e64b9fac164b2bdf4499f2dfea06867352e47247f82dd02730043c75a1bbea5d3c060f2fbe624b26347
- SSDEEP 98304:rCVw2csWhacsA37vHuqzSxvvtrFsJJtBRdywwmM:nBzccsA7HxzSxvvtRmJtTVwv
- TLSH T10B769E5BB6A800E8D4B6C23CDA578513E7B2B8155371D7DF0AA0967A1F73BE0463EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\UpdateControllerImpl.dll
- Size 6.3MB
- SHA256 ff70350b82c6bbe4f2611d3b45617c34967280b86236c2a4a2e6a0a55dec5a6a
- MD5 d31e2df2f0eabfb0170cfd49b306aab4
- SHA1 ec8a969db0494706371856eae76993314fce0a02
- SHA512 465f55fa4a0b1110fc18c97fdaa631f8b6a950f68f4da17baf1cf21fc14c5e74c1ccdcfb40b719bad0023760af2f820f1fc8c2a43360784debafcf17469a5f9a
- SSDEEP 98304:oakC6dGRbkI0qxM7B8affvsj8YSzO/tUdFyewBB:hkbI0qxfaffvsj8YcO/tULYB
- TLSH T100668C1BA7E400A8D8B7D138CA578503E7B2B856177197CF06A4967E2F73BE0563E720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\VPNControllerImpl.dll
- Size 4.9MB
- SHA256 19b062a4afe6ad8e4691d48192a7f103d5f6e78370c3238141e5c18ed80c6702
- MD5 6b50efd1923ede28f41997615e817e4c
- SHA1 f5156ebe5b64eed636b23f6e9a6679380c86bcf1
- SHA512 a8a446b9f2fece0c96e7ba93f64f3e3ac2b66e2ec1ea0310990e546e542adf326e8cb3fa828285a829ff5013925c9e95e671e35934e53f7f2e71cea1fd450189
- SSDEEP 49152:rluYSQhZbe6djwk/CNkTqoIr09w23EKSBufF9GBF9RzcVCdxekT2geLnvPEBzU9w:pJIr0hA19RwVvYCSp
- TLSH T1BF367B16B7E501A8D8B6C23CC9A78503D7B2BC114730DBDF16A4566A1FB3BE0563EB24
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\ddshelper.bin
- Size 1KB
- SHA256 99198c557b03b24dbf40724c62c12c8c039447afedfd109e20061288963d9454
- MD5 bdf8a750ae5ff4858b88f1a0f729e4b1
- SHA1 f27c3c54473eb6787614a137af1f9a34e67d2816
- SHA512 187a178c872369032f2e4beefb9000cfa7ed97de184495ac06cefeaa4deb77d5ebac008685bced49203840bafed719a0097d3f32708989ca96acbab51812ce2d
- TLSH T106118C84C7A838424CE0AC06CBA0F42A0E45709717B65A4C96B6C669C1AD13C0CECFF9
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\ddshelper.exe
- Size 253KB
- SHA256 d2257e7643128166f46a88da45ab9c38b7c23d0d727551dbd9f780a43f4abd11
- MD5 10bc07abd8ebae1c977a9b2f32b8c788
- SHA1 55bbf844af546c27289cdb53fe9f05a31678d410
- SHA512 6ba48d29073b49cc0c3acb775dee91b8532fc75f0b41b8a84a40ceb8a4f84a8ea918beb3b9f27dfb368480c4893c749979e1721895d27bdfc6e686f16e8eec1d
- SSDEEP 6144:jC+kTECKVL+F97/2uXWbXCoReuENID4eH:j/kTIVL+L7+UYXlROIDD
- TLSH T1A0447C1473A108FAE967C631CD92CA13E27378514B34E99F436086729F37781AE3976E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\e_sqlcipher.dll
- Size 1.8MB
- SHA256 8ae79522c885057fcbd2435bceb0bb1281b30fcb00b43c5a8e42f0a0677fef26
- MD5 53a0b4f0913ac611ca8f89c5e9e1414e
- SHA1 ceea56dcb169c656a8fd2cd49ead8a31e0e437b8
- SHA512 f3d8b65cbba5b4ea615f17f378c88f499e302499ad3f9e8d129394b7342568587cdf93cfa7c96dc9929324e0cf8d5ba4c31c4823e65d42919ee344dec2e8e822
- SSDEEP 24576:GvKRx/vwkwBaPd71Oy+jTr0vsJhXVu6fITQvipJUasZBGoWsXCEwnb:G6N+a1O3BJrATci43qsfwb
- TLSH T103957D0BB3B900ACD9A782B8C517970BDBF1B4151764ABDB159086652F23FF61E7A330
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\e_sqlite3.dll
- Size 1.8MB
- SHA256 e0a736e91481d5914d8a073ca8fa64f770e9c7992b3f3473c06dcfda50cc89d1
- MD5 a1ffdbf2f62e4f34e428a92cf63a8553
- SHA1 31087d51325e9104d13f4d75ea1fbd7844cebf9c
- SHA512 4f651b641703bf6e65265dd6ec38b0238b7021116137106fa436b66fb1afcdadfa7b38f520840e6316d1b2558da2a8910a2f61f7717c0db24b47c981beb368e8
- SSDEEP 24576:z0QT9LAXxkXe4hCk8tmg82mhJhHE6+YPk1Ic1J+6K/H+gmnBaTpmIzgz7QThB5wo:zF9LAKCk8tTEHE3YcviCaTpmvHQThB5z
- TLSH T185857D4BA2B900ACD8A7D2B8C517570BD7F274151724ABDB15908AA52F23FF61F7A330
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\mb5uns.deps.json
- Size 2KB
- SHA256 dbbc5441a58be6084057667a83cafc0af9b3377061a9bda4cfd4fca3b651fc01
- MD5 8cc0eec65565f747598512e2bdbedd23
- SHA1 65694b215256cd84a6d213a1e3caf047a4838ed6
- SHA512 39fc7cd6556f10467f52db40a295ec21bea0aa8b384c2fa8dd5567596ec90004a0603abe380887915628634f5bc624aa8db10cd05e71310d756a6a1907f6ec9a
- TLSH T1AE51BA18F6946B7742B2B7A4A87E4541F63503372004248A7CFE245C4F76BEBA096F35
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\mb5uns.dll
- Size 1.3MB
- SHA256 08ac8a8cc8b991ebc256b595dd2ff7a8935f09d6512209a25febbe08ee3b33f1
- MD5 442dc9e920c1904a3ae217239d8596b8
- SHA1 5ed4f393901f2bd4769630c33acbfd27579e0818
- SHA512 8cfd6a2b98706779b3f7ae7526460849d9d4bb4c2441dc07e0b74f00c0eed840e35e7a006e3e3e9bc21880de34acf0c33eb1ce4f04d17d4d67bd12094261b728
- SSDEEP 12288:6eKyu2f4D8825SUdyTCQwCSll1MvbwdTbiR+Fa:S2f4AjyGQwCSlH8
- TLSH T1E0556B00E681A618CAE6B2707C7CE37D19B4EC2DFC9A611674E5BB3515F4D00AC69BBC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\mb5uns.exe
- Size 326KB
- SHA256 7e75457de02a91b5e8000c6bc17efb5784ce6a3d0c90e861b49a9c62461db242
- MD5 55ff5de509d04449b57179f3617aced2
- SHA1 42128de25dc6ea0493d32f08f92e0c846e25104b
- SHA512 41dd3ce68f10224691698bf5d009d9e8c3c0bf51950c79c4e1978696dd6b95d81a022b2831ba8c7d63aefbb41c95a964c7432aa2eef23b94afaa0ad4a4b9cc44
- SSDEEP 3072:PXwANETcQt1Onb5RHrfqDQXFn4dPPYseJwmZf2jT63b9lFYmHl5rbxBea2OPt:PlxnlRLfyQXN42D0ahYmFTqO
- TLSH T150644CA3A56841DDD4BA86318E929910B7B53C7D8BF162CF87E075A90F72BC06E3D305
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\mb5uns.runtimeconfig.json
- Size 623B
- SHA256 4afc3f604abeed8ce727030cbd0445cf645e9d4990b7913156e80db61e468146
- MD5 eadd0705db4200aca40973a1559ea6eb
- SHA1 ca23fae378ee2f47d10aa704faa96c1ef41d055b
- SHA512 5f82da8e1bc2f131d6f9a071b1dc8ab901d1f789ccd5482440e4e23ef5c802edc06f042cbfd9aee3006ee526fcd53b5a8c5af1b7a927d90f785a7e4833f3d1d5
- TLSH T171F0F679CA106CBB18B9327ED529C582EA34532B10041D56B5FD081C6F775B51222F96
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\mbae-api-na.dll
- Size 723KB
- SHA256 6aee09c65a2f22658a8a74459df2b9df5c81c5ec7d853e496794ef6f52ed8924
- MD5 53d9f6d408d43a8b9f080b87ac0df146
- SHA1 1e6c7befb2c68efc87508c705cf72427cdf45370
- SHA512 b4db12bf61ddcf16ff14ea245865b2aa0d71efba17fcfd36d64d47707f6f497170f19235dc8bf69e3961d8072743f27cdc343f228f331d6f27c41ea07be11b7d
- SSDEEP 12288:LFvU1Pr3pBWtftHAmoLdkm9c5Wn2VqK/Zny2E3vFn+hPraFnPFN:ZvUtKtJAmsdjc50iHoZ7
- TLSH T14BF40819A3AD02A8EA77C536B663A223FF7334541B70BE8B5E108E395F31760963C751
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\mbae.dll
- Size 1.4MB
- SHA256 523a8858117a691eb787348186d038b31cc0e59a9c2defdea11eb0a8fc7f6eec
- MD5 e62f405a7682e88d79a1cc8893659043
- SHA1 b247dba0bc8ecfaed96019750a9333eafd167b87
- SHA512 df98d764a78687e78f0725c9d9a0e486eac619d8d2399a51bd04d44b37539939f5dd51121bf18581bf77cfbe521d4ca34c63f6029cd97bc9d615a525fc25eac4
- SSDEEP 24576:WpCY6hJZtbAblApkstSIzNvvaY8wPH+/yRsxGwfCZLKDDgWn1mdsHHH:fYQRrVzN6zZyRsHCZLsJnQdsH
- TLSH T10D657D20B6D5C239E49E02B0A97CEB6F153D7B240B2495DBF2D81E6D2E345D36A34B13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\mbae.sys
- Size 155KB
- SHA256 c990dd89b65d35d6c9b34e21c78d96e206ec3bcdd934716ee61ff79da0fa5251
- MD5 fc98ddab2223dc73b950622801b31554
- SHA1 997faaec1dfd18b9dd31e1c216440a28bc4cd612
- SHA512 da08860f8c3d8a9204d1480f33d21f2ab922db5cbbf7734527ed05477c2d9c184deaedb63196876c989c9ff6c1b45b5792661f5bce92212992a7cdb664a793e3
- SSDEEP 3072:hcj/Hk4/53QBvOP8JsUrLx1o6GwzfwKYdkXEnU/H0KBJT2:hc4wNQBvOEJvx1o6GwzfwZqEU/33C
- TLSH T1D3F36C52F3B400F5D8A6C679DB669213E6B2780D2721E7CF076085252F673E4BB39326
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\mbae64.dll
- Size 1.7MB
- SHA256 bd25a747e6aaf00678eb705cafa894897241695ddc176b0993904d280a882054
- MD5 a60cb38f8d1407db3521adbd7ef30fb5
- SHA1 56c5a3348b5bc0fc6892bfd6720bac213a9ca9b7
- SHA512 e1d1ee3de6960c74dfa3a44a454bf2872fbc9fca9ec075a66647856fc56b6f2be5816bbcd45b87a702b337c73306c2515ad1e02f18ebd8ba9a2a0275cc86842d
- SSDEEP 24576:67QoNWQ11lqWiTLFlRDqgGEQ7rfEPQGWHWe+idhDcEU:6soNX1jqWELDRDnIljHWIdqEU
- TLSH T1DD855B06B7A940E8D0B7C1388967A76BE6B174550F30A7DB66508B1DEF23BE04E3D361
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\mbamelam.cat
- Size 11KB
- SHA256 64416d564725416c6869ea951878a2734b1f6940b11f7961a897c45f0d8c6625
- MD5 bd4ceae54af081d6b1dd91ff584c5d61
- SHA1 5ade462d66e042da58bb1447d1b31f1aad901b68
- SHA512 37e7abd312f694ee2c8ea54ecf50ed12c16684f1007c61d9a6d1d01cba958be511c5e4e11cd7393a5cd57349fda1c552bebca42962137e0d11695c195761ebb0
- SSDEEP 192:oBxybp/yRpJCSEbhLxyKR/2FWQFdbiI/Ex6RMySX01k9z3AgEhrZg:oLp+eFRvmoMR9zJug
- TLSH T11A320AE58A6C5083DCA7AC6087E8E5D77C3D67C71D00987921DAFB5409933CAFB2816D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\mbamelam.inf
- Size 2KB
- SHA256 e26c2d3347e5f077da92713c9df3cd3eae438fb7e29810bd5c3afe567d2d3125
- MD5 5d8c05cc4f9b4304d57ea10b87f2dcf0
- SHA1 2cabe3d39aa5ec16c54c7818284a2ee235d2ddbd
- SHA512 55bff23fee9852f229246b71721b3659c916079787935d400a97641449dfda752fc8fbf36f9ea3dc4028f05daeb9006a99660284a61aa5d5a466af0ee966c738
- TLSH T164410454AA538BB8697B35B81E472883BF5412205076384032DEC8C99B6DF0C93757AB
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\mbampt.exe
- Size 33KB
- SHA256 52d7c66a6dd46eb8f0674ea42bf600b8fb0cca1c1788057b2d375b8281a98583
- MD5 b9917dd13a77e2284709e4072ebe4a4c
- SHA1 57660195857febc49fd533644c561c706b8a912d
- SHA512 4ce6fc25aef60333a5b1f64d33d57b9a540fb60c2e41f291e0a15dfcd7a921ff784df6f9467ab21126ee4e4c4d9ce7b7c6fc5f37ad2a232e384d4e8f1346564d
- SSDEEP 768:OHgn5YiRik5ALk2Q2awxu2Ip4PTxf1mlRaXZ6b:L57RiE2Q25f91fIYZC
- TLSH T1D6E27CC64A684442FE079E70B1E8DA5BBD78B7D319A0C1DB206EC1950F923C1BBAD17D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\mbamsisdk.dll
- Size 12.7MB
- SHA256 35ec2acc44f082c4ba3f9cb689ba89d8d6d320f27d8b106ee1b80564150702fc
- MD5 8c9f88ee2331ef1dea5a47f9b30dd599
- SHA1 3d326ac06e0a57f0c47432c582a3ffe5d62641c8
- SHA512 479939578338710046267ab7d84d68ea3dd322787940d40b851e41248fe67607a3e7b7aec29d7145fa8a5f0e2a5eca6c8356d11f4addc2f0422327fd04e7da83
- SSDEEP 196608:NppTqNbqRsihlFIHlGlRiJIwUAdHeVz8hzU4l/C2NWnt:bpTqNbqRsihIHYyJ77HeVz8hzU4l/CZ
- TLSH T1C6D6AE17BBD540B4D8BAC23885A78727DBB2BC11473097CF06A4566A1FB3BE1563E324
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\mbcut.dll
- Size 4.2MB
- SHA256 cc9b2f7379351f5cb246fcab1823962716c3b90dce252292f3c7fabf718a0c23
- MD5 e10fde737021eab76462e4f0fcd6548d
- SHA1 e24fad860352bedd64aabced856404ab09ca94ab
- SHA512 333ae97d9238d925e6fc3dd254d93f3a90dcd7a694e3a8487b20d257e9371070641d576970a17a27dab4f97780039f1867d90dc80365318a7ccb1fe0b196edc9
- SSDEEP 49152:LsIdWtjIxvFfomKYsEwpmUeT0MSD1TX8jmxB5sVvXsuY2AYuSHyp4DZePe1zU/6n:LsWGqfrKYepmnIvqvXTAKWydzkT0d
- TLSH T153167C17ABA501A8D8BAC23885778603D7B2BC1147709BCF16A0667A1FB3BE1573F714
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\mbshlext.dll
- Size 3.1MB
- SHA256 8af36217efcc1b2a677accc77839ed3b67ddbfcabfa16caaa42c7e95796b940a
- MD5 d82467d25954c9fbaa91ca97e0de6834
- SHA1 d7da2b4f83acd0d2aaf55de2ae403fa6cc44bfc6
- SHA512 84a38b2d4a1b23439f4c6eca1fc148d618effd1444704f37e5812488877d15789b603944231281299ba332dbd0d3a0e51160c588c0adc1bf338675c62da45aa4
- SSDEEP 49152:zHsR0cmbmDszn14AcKLfC659mLVD+Bjmo+2g5rCdPWD8i51l3z:zHBpmj2Am0D8g3
- TLSH T169E54A227A9540ECF866A23864FB8502F6F27A05236097CB0558727D1EEB7F106BF7D4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\rtp.dll
- Size 4.4MB
- SHA256 db4dbf65f6da762d70bdf5932ea8529d3d5e90b968637bc504a39db04f87a48e
- MD5 fc53082dd5c3ec9b8b25fca85da312a9
- SHA1 90b8395132dbe7afe5b3cfe40abea028ba901b8d
- SHA512 83eaa7d717ba9d05cdb2539b6024e48c241724ebe9645687e88a4b36fc94eb79e2f8f112e23f0ddfddbb6eeb618eb2fe93a7e52ec43257d9f2d31576a54eb4c7
- SSDEEP 49152:hlsD4iHitygEQR6sn+MK/1mWB93Fq/p1/M9CYh8EXywoDdWJKPCWzU3hPd0gSDSv:iHiDAFMpy9ByZE5MW
- TLSH T17B268C17AAEA00A8C876C23C89779603EBB2BC1547709BCF066456691FB3BD2573F714
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\sentrynativesdk.dll
- Size 596KB
- SHA256 6e6096dabfe6b34c3e6ccba49cef544b7be6158e34168f819f8cac1b3645d4d0
- MD5 efba4bdd511e95708c555984bd21c2bc
- SHA1 dbb823e9530ae40249db0bb8b85492ad1574e8b4
- SHA512 058110541c3cff39a0a3c136b6eaeb01896e04bf192d7138e0cd680203fd7b0d05b056d90fd0956ae537329de5c6ff1c666704c568b73554fbe4e56bbbcc8c8c
- SSDEEP 12288:m5Hiqt9csEXkXfE/gv9DL+2/xzEdqwuKyCCGBazBWXsCjTls:m5Cqth3fZL+oxzuqwBCWazBWcCjps
- TLSH T1D8D47C5A76A803B8E07BD238C9934907E6B2780607719BCF03A057A76F27BD55B3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\srvversion.dat
- Size 9B
- SHA256 0edffbd0e4c895acbe7bbd411b84845336082fd5ffa0a5af7d6441fbc997cf84
- MD5 07de8ee77d42dfe76460fefedb5ee2af
- SHA1 3928977c7dd9658d9628916d11494914bf9367b7
- SHA512 a16a82640971ef2f33b603ab067b8193127c755ff17cc1f42fa8bf3d8b61622b575b073267dfa28a5e885195bfdce1a6d6cd5e71abc152dd19e04d3a8452a485
- MD5 SHA1 SHA512
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\version.dat
- Size 10B
- SHA256 deccf9159ecb0cd93713dbc8f4117d8f0192b80c073ab2f0fc725d83e2a99ded
- MD5 985af5d45144709de39eefdf35f706e7
- SHA1 a5bef766783b725f182e08b70025492aea585930
- SHA512 15e55ac109f8cf9de375196ccf7897b448a99722eba9d13009dc667df2c31c61a6c7b434b2d3a918733e9d8b917bc8675eac854ee549cf08e315c50ddd9b6fec
- MD5 SHA1 SHA512
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\ctlrpkg\wireguard.dll
- Size 1.3MB
- SHA256 d2ad6ce25634776f5067fd9d5750a5e3d2add1adde98eb1f56a2df194d0e9cbb
- MD5 bafa63cbef47269e12392eb29ff87070
- SHA1 a5814b3548010dd3e3413835bdc0590f726346f6
- SHA512 95290f78b4bf8d98e64c4c5280ac334bdda56265fd88370d7ba2caec93c776a13c33105fbd1c9f9bb8189d769415b95ca5dfe74f7276065e619eecee5dc07e76
- SSDEEP 12288:DUenDNpq9bKeKqM7cyOcN7kWCEKI2ExcN7kWOpPD:9pqFKew1N7VCEvcN7VOlD
- TLSH T1C055AE41B2491B94D4A283FDC9E68175A67ABC145B20CAFF0034F2686F73FEE9476E11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\dbclspkg\ActionsV5.dll
- Size 6.1MB
- SHA256 f2dc3b02c39cc92b945ebffc0be675251e93de87158eaf47bfeb5c3231488173
- MD5 d2ddd6f0a411ecd5023812336c7c386f
- SHA1 7eac246c6bb316814439d9e124d8371f27bb647a
- SHA512 6c2b3b4f4802670a1e461c6035a9ea32eafd653e7d5c9352b92fb0e27e3e1f5de178f02fa6875ea75d247f1545065e35f8f1d27105912ba7c19dafb24b535602
- SSDEEP 49152:7msy+BT0cuT6iMx6RqDX1aldmjrHPykS7WbQMB4wpZ4fKBj+Ae+Ysyg1cqW1wyT5:trTQNPYrHqe3le+jyTwyvbKIf/j
- TLSH T15C564B16A7E802A4E0B2C178EEF79103DBB27C255735CBDF0190525E0E73BE19A7AB15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\dbclspkg\BrowserSDKDLLV5.dll
- Size 7.0MB
- SHA256 c72e39709b26ac7577200a76515347ff11c0a9424cf61657762d657e7aecd974
- MD5 36b6cdd3677d6a079cd21768ffacbc7e
- SHA1 e525b6c778d7b59ef06300cc980f63bcf581a24a
- SHA512 e106563a21063eba244b536e67ececf2630415d5857af8aa67bedecabb39a87799324c3024bcf84487fbd9cfb76dc24b27ebb881734b4157a38b5c74d538ec3e
- SSDEEP 49152:8VF1SVg1db+wMSI0nW5xjpvypuDYpsD0VXZTWqls/e9uETWgjB+S/YfbWf2zv7je:s8TeZKT+X6S/Yf6fITlRChya9Fx
- TLSH T113768D17B6A400A9D8BBC17CCA578603EBB2BC06577097CF16A4966E1F73BE0563E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\dbclspkg\Global.nm
- Size 349KB
- SHA256 314b03fd2b01e1a1f9a4883d3379fb3da1bdb358750b6e9cfd7fb3e03ae307ac
- MD5 b1f3e0a2a1d5566a8d342b8ff3d18a78
- SHA1 f978a6cb4607dd91cdf2f727af2ca1828d50a105
- SHA512 5b5a6bc0b6d003b8685de50c00fc2af580555f76867bf7a66474e05cff280acaa9ce59e189c1424415f3dd4f4f5f80d52f91382365cd98916d74521e811d79fa
- SSDEEP 6144:whbwrwj6aYsFylXad2VmYmWVT+Tz7IjmwIunxaQIBE4+gtwJ27Ntk5bivoTthyeC:whbEwj6aYsFylXad2VmYmWVT+Tz7Ijmh
- TLSH T1B3748BD167AE2354F5B2EFB41BA0DA25597A6CA2EF00DB99D302145B193DE50CB30F23
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\dbclspkg\Global.sr
- Size 23.0MB
- SHA256 e68be3dc860396f2d2f157c1568e2382c8a3e3a053a5ae2a87d520aaa6399ada
- MD5 af0bf69068ab3b2e8c02641d26589cdf
- SHA1 cfe5d80f884572060659c0241c05d14cee8b8f4b
- SHA512 932ed1dee1067d78ec9d0822497dbbb127dd2a9753dd5432546c5e1a118d6add7a5e015ecff8e5e6268bde226fe3eaf99aa32e3787b2b43027c2419dd25be909
- SSDEEP 393216:z20/ZGBPp0ANgERVcG9Vq1Iri6Fid796rVYGzK:i0/ZUR0AmEh62FwMK
- TLSH T182372327FADA3ABBE835D3BB458E9F754213EB2119038149FFF0025E824DA555F69302
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\dbclspkg\MBAMCoreV5.dll
- Size 8.7MB
- SHA256 3b38dece370c841f7a3fdd4b5e3eb7991d9a61fa93c69b1376195ae17c99201c
- MD5 0cb86424bb9b76967340ef0ae112586e
- SHA1 af7803d40c5a11527d8fac19276840bca2d4353f
- SHA512 019c0453493585e213b7f9c24c8c08ed8aa5bfc429799e4e9b529191dbc5c188560d209529bafe8b37b2c772c2cc873f3d3c1ddea0df9343eddb34089ed7c07e
- SSDEEP 98304:w35+HGfmiYv+ohXHumrcvPwx3qghzR11Q8:w35+HGf+VXHumrcvPwdqAF11Q8
- TLSH T1BE967B1BA7A400ABD87AD37889EB4502F673B811537397CF16A8A1761F63BD09E3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\dbclspkg\cfg.bin
- Size 2KB
- SHA256 a4d54bff6782b5e7cc3d59ce8ac7f1d9a80fd5eb045d0fe8ff3ffa110f609e73
- MD5 4529d759488cc5e9a3c2ec5c1fcb65ff
- SHA1 9e11b3342ce26ac669189b9cd9d742d84724f245
- SHA512 8e61360af311bccfdc257a9ee1b60b4bf111cab7c10234863a3b5d85e4847d1e7b63280c9dcce60a52ba7626914ad81230e33756e175e1a1948613fd6e2b2978
- TLSH T19E512B153F508B70C1377A79D71B463DDBAF451921021DA752D7678AE8F58BE2C33444
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\dbclspkg\clean.mbdb
- Size 21KB
- SHA256 72cae0054d620772f1b33e26dd4c16b187892c0c96e90d1e45291d3df3a64489
- MD5 3ec043393493c6d6035137c6927eb878
- SHA1 0598ed2577392bee853808b75aad21b5a461c663
- SHA512 50d012d5d43492685806b6ab12da6a3b4d9ece59b92f9e056fff64ef59fd715d619097036c934034460f93f6ff379839eef5f9358f914d3119514cf0b04c995a
- SSDEEP 384:2TrwItpdh2OGt66P+wOy/nzuPQ0Efvzgl2eBg1Ix8LF4yUDaq/UG:2Xw03hstay/nzyQ0GvPoxJDN/UG
- TLSH T1CDA2D0E7165B05EBAF0AD2681667F33D360C8612A5CE6F827CDB5F3F8A5D8497310610
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\dbclspkg\dbmanifest2.dat
- Size 924B
- SHA256 bc670d68c456cd8cb17a537428ff27eacc09a711acc87659b24f6691cf212e96
- MD5 e8291fc124a527f4ea5faba1cd39ca0b
- SHA1 370ded189fab2aa43167992a535e9c9b618c554e
- SHA512 a7d3e23c2f0f3c76a17a683e80742230cc3df9813b20ec23fc3b4665e904f1ce34e9a7acc138eccd73d062354442cdec773092b84670563310a405968a880023
- TLSH T1021184F8C462F0170B3F9B9A716B03979E39C0A2C6480B9A7C3AA4D9DA1567C40088DC
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\dbclspkg\dynconfig.dat
- Size 39KB
- SHA256 008254ca1f4d6415da89d01a4292911de6135b42833156720a841a22685765dc
- MD5 10f23e7c8c791b91c86cd966d67b7bc7
- SHA1 3f596093b2bc33f7a2554818f8e41adbbd101961
- SHA512 2d1b21371ada038323be412945994d030ee8a9007db072484724616c8597c6998a560bc28886ebf89e2c8919fb70d76c98338d88832351823027491c98d48118
- SSDEEP 384:jNOT68xDvtG9ObE7L8u8sXNVkIfvs4FRj:ay8u8KVkIXsWRj
- TLSH T15603A21266FA1001B1B36588AEF28570DB2B74D965399EBF00C5464A4BEEE40BC53FF7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\dbclspkg\exclusions.txt
- Size 23KB
- SHA256 9e87e4c9da3337c63b7f0e6ed0eb71696121c74e18a5da577215e18097715e2f
- MD5 aef4eca7ee01bb1a146751c4d0510d2d
- SHA1 5cf2273da41147126e5e1eabd3182f19304eea25
- SHA512 d31d21e37b0048050b19600f8904354cff3f3ec8291c5a7a54267e14af9fb88dfb6d11e74a037cc0369ade8a8fb9b753861f3b3fb2219563e8ec359f66c042db
- SSDEEP 384:OpHJUPIIawosLqVqmv4EHUtVbUQIKiKn6p+C+vNCMSP+TyHS7ivS/6:mYmsGfvSp/6pzgH4cyH9E6
- TLSH T1B5B2D73A1CBD123751B4C6AACFD58877F640E1A7316A183A64D7874987CBE4329C31BE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\dbclspkg\igV5.exe
- Size 1.8MB
- SHA256 21600e8542230081e34d2da49d174f577d47e6f5d4088b3be4508c10d642f4fb
- MD5 8c999ce2d91e1001c7e7282273f75c7a
- SHA1 7aca5a7cc1f274311684a44f8ce753c0699715f7
- SHA512 23f79420ec283b1e9719d26a9a95899dde6acc03d0aa42940ee0f32676d61610d85ac58206b8b992964118270c18a095fd34a8e1494a1b6f5b8d3f1535813908
- SSDEEP 24576:20pw8j0kcU71dHGvPKN8kP95bLS0pBm2L6y1szQGfthuTVHzw8mv5:2y0kcOnk88kPt7+zQFZw8mv5
- TLSH T1F095D720BAB6414FDB9916B82EBCAF9D22AC69490B6059C3738C975D0CF11D344FB376
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\dbclspkg\mbdigsig2.dat
- Size 514B
- SHA256 15cae80f6d39dfc522d230814385f8c6a87a2a60a8945066d99621de7672c15c
- MD5 7f20e72790c3459b3ccdad39eb4f11fe
- SHA1 1b388dd83d26bb5ab218d38c4368ec097d304971
- SHA512 73167f3647106eaf4d65a5ca043bd119ed4b73d51cc17b02a7768369024f3b5a0f8fd478db1ba39fe7d683ef83bd17595e7165e80c3d2113de007f195c1d758e
- TLSH T1B0F00EB48A5A0CE3C66F6808170127D58415B7C4A527AD62C4EFF3B323C64F6DEB4514
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\dbclspkg\prot.mbdb
- Size 24B
- SHA256 6089fbf0c0c1413f62e91dc9497bedc6d8a271e9dc761e20adc0dccf6f4a0c1f
- MD5 546d9e30eadad8b22f5b3ffa875144bf
- SHA1 3b323ffef009bfe0662c2bd30bb06af6dfc68e4d
- SHA512 3478f5dcf7af549dd6fe48ad714604200de84a90120b16a32233b6d44fa7240f5f4e5fe803f54b86bbdfd10fa1bfdd88fb85eb6a78e23e426933f98d0a2565ec
- MD5 SHA1 SHA512
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\dbclspkg\rdefs.mbdb
- Size 24B
- SHA256 850a4ea37a0fd6f68bf95422d502b2d1257264eb90cc38c0a3b1b95aa375be55
- MD5 2f7423ca7c6a0f1339980f3c8c7de9f8
- SHA1 102c77faa28885354cfe6725d987bc23bc7108ba
- SHA512 e922ac8a7a2cde6d387f8698207cf5efbd45b646986a090e3549d97a7d552dd74179bd7ac20b7d246ca49d340c4c168982c65b4749df760857810b2358e7eb69
- MD5 SHA1 SHA512
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\dbclspkg\rules.mbdb
- Size 6.9MB
- SHA256 883599a367a22a4baf51bcc5d377ca60be951d1dfd4a56d7854c365d064bad43
- MD5 25fee8ed9ad964a032b21aa7fb5cd9b3
- SHA1 dc634e091fa06627c0f447ac10511e8ca42e94d4
- SHA512 8fa02a365ec00097fc62264bd0fd6d45b2f8c847e040411ee5f446e4cb7076fbff1ca8848073e0cc3e9d9ae6374ca5222ac66d2834661ce0fbccc3150fe83522
- SSDEEP 196608:qPe0j8fy2gAa+jT2bjcwBWlp/y9qc3E4VDh3gbS:qPei8q2gAaKqUnlpCqcJz3gbS
- TLSH T1E676337355F1D063886141A142183A9445B6E9272CE3E3E63E7FFF1BF72A1C9E89C528
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\dbclspkg\sampleV5.dll
- Size 524KB
- SHA256 030a55e24a44c983de03eaf02e8b733860b7dece1f6a1a910fa05f73d1f45759
- MD5 c1ed4c6ef735f0844d1089eee35a48fc
- SHA1 5463a6da49ee5e8683ea7b56003165c5fe09360e
- SHA512 bd48c0eebb35844b8d8069ddd02ca8c480ac844dfc8a4065e1277f0cc07d9c03e823cfe203a36fcc1056c745e4b99039cfc9f8fc0362610b448fce0ad593aad1
- SSDEEP 12288:MYIAmy9w5vPkTEetmCqryujcqhL0HU5WhjW5/D:MY/VJrqhLce
- TLSH T1A1B45C00A761C01CF4F701FA97BA969DA9387970773C90CB61E1E98A1A649E5FC37B13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\dbclspkg\scan.mbdb
- Size 415KB
- SHA256 1b10ab6c4defe9d5df777f102f275e20d6848feb9cab0df8d7d8a5992aa80f51
- MD5 312aeda943482d20cde6fc23b844f6ee
- SHA1 bad565edc48195f2014095547a6db2188d2c0100
- SHA512 40360c974d1b07f99fc452d611837b0fa37674ac022d60d0272c3b89e47329517825c3bc24a2d62656fcb0145964ddbbc75cbccdcddf5b214386f08eada27802
- SSDEEP 12288:eWjglWTFjpQPopPN+nXXZfJtgANEzdo9xaTAIk61Q:e9qpt5A5fJthNed0xoPk6W
- TLSH T13E94233ED23EDD3B9E47188A5BA90CBA135CBA31D29D5745C47AA20D2E2F370A0D7C05
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\dbclspkg\tids.mbdb
- Size 138KB
- SHA256 2e20ef923ad2fe6a56974aa3f8b536847ce7ff9536a25991aa5129268f901570
- MD5 f976d0345ca5313d993475571f3c5d14
- SHA1 83faeb7f3e20e38b600278686c7e63625daf467d
- SHA512 41f663b5214cc253f291a4a40f5a44926acd3c2114b8b247599ca9e1f09331dd94cb4433aa759a86281d4ec68fab336a11d66786ea69327551c3859a67cdd963
- SSDEEP 3072:VDWPy335obvEg1Q+G9jl5I143K6dB+1AtsRKzvIyuhRgPrWfERP3bn:VyPSJ01S+w4S6vScyaRKPrn
- TLSH T1EAD3126FB2CC7C998F4F016AE53E987C6987519C36A677B5D6E82DC4E329C0D400E28D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\dbclspkg\version.dat
- Size 48B
- SHA256 1a42cb245120146ed08824b9bd51c557df7269ca90302f2e153bfb0d64bf7d5c
- MD5 d098b61032b89bc9edb6bb55316d8c55
- SHA1 8e877b6341c88d032113b6aa8a4d0dde8a274864
- SHA512 e5a2dd9198d264b1d070ff07064625bff00c6a6323b56839b17d1effbead68f8ecee853dedc68599a66ff2e8ee718b1516ad84b533901b1dc5131b891534fea9
- MD5 SHA1 SHA512
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\dbclspkg\wprot2.mbdb
- Size 21.1MB
- SHA256 c3f627881abec607f8d1f36bf1c15fc5841680ea9ed29068930cc5ceddba102a
- MD5 49ddd76dddcf96d9a976f1a1c74794db
- SHA1 b49d2f9669c80023037f8614766006446fa59884
- SHA512 0efbcdee49bc126e4296d3889519447abef5105479eaeffa5e1f38d1e52d24e87552e96a4345033031ac5a36c714de6c557e37e42ae091f37053cb6c767aee0d
- SSDEEP 393216:9MeiAD9fRAgFkoE/Pq9ZuAdPpO+gxIQIf+0h29ud:9tRpAmOP0xpYE
- TLSH T12627222BFC15E106CBB6507A1ECAD4D627713B8080628F45B2496B31FD7587D7B2A2BC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_85c57666c1a011f1af86f6d780bea338\dotnetpkgtmp\shared\Microsoft.NETCore.App\10.0.8\.version
- Size 50B
- SHA256 42559a4970a981aa61f3ed59ad44d05214fcc5eb97c35d06a88102a0b747a45f
- MD5 9072ad106b74f3900d25ae80843c8a24
- SHA1 b664a23dea5a5591c21fe0f4a9b5f344079d94d1
- SHA512 ea866258bbcccc0951f95367f3309db65d437ad27eb6fcbdfe12e08b9f76265050d6216091b89f0dc92db66b24f8238c8d6cc98ce49e6c3bb6b051ee037e56a2
- TLSH T1309004444445D47315D3313453015154F00C5D3C5D34CC11D05F707CC4D705CC55C301
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\LOGS\MBVpnTunnelService.log
- Size 4KB
- SHA256 c0340c2cc00de7a00d4887f36c0ecd42cf01e4c826ea3092aa5e6e2daf04d96d
- MD5 58291569f7189d64387028f458dd2717
- SHA1 03a84afe13700e46a8fd0b175666c1539418ff45
- SHA512 0ae96fdaf36fd892fe11facf447224a41d4ac720704b6078498cf0d0469bb8b38845d5b814d49de67b1b791d92d20bc22452ec83239cc6e3ca4b159ca3b72918
- SSDEEP 96:NE/98TIRHEPORHDZ8XhSHQM3MiJJioipi0wiIwrLoFoiVM4:NEl4SkZJQ7
- TLSH T1C7A10629A7DD011572B39B14B9F219A36F273C6BA634ED2D00981E0E0576D46F8A273F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\LOGS\mbae-default.log
- Size 1KB
- SHA256 6dc00ee217f4642168ef877913ead9800deed25ec01ecae0d0db00ef94b7127b
- MD5 a2513644e4cf58d4e5c324d5405b7fbd
- SHA1 9644bfcf02dc2421d28001446798ec8afa56be6a
- SHA512 e6672a810ac6bf23a15408b6220156f7ce15b4b12ff7a256ff40e5155982573276d44a8509a7d0ecd8fe6ca562c414c6ad4b555a94e73af39777e0a95188f02b
- TLSH T18431996E010C5BB5966D3D9820BFB0DEDC68472D50D89FB4B2BE81D4E0C55E29001DE0
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json
- Size 47KB
- SHA256 606ccb78b589abaea4fd51ab6deaca4f9bb158510d25144b153e6d887d69da85
- MD5 e53d1f80f61929c135c1dd5d2e376169
- SHA1 0fe6383844e10a0f383c7dfbc8a511ac72e13ba0
- SHA512 bbe5dace1fd48bcab471e6a8c1d647966dd2b29739a79315ad9a4f00db86861b47db62b30513941d5af9c91d42dc04ec1f7ed265c6470f3ce52f45b6052f95b1
- SSDEEP 384:WriPalGB5AWiWq2mhzJUVVqxKS3xV2CjNrBa7gHOykEaf:rUAHiWqn1UVVqx9U7gYEaf
- TLSH T17F2382BBD9DC0D0B99712294A9B94607FB20036F10980C17BDBEA98CCFB751394C6F1A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json
- Size 66KB
- SHA256 ede57f808e3c4b461dfb203183f1d64b421f4b1b2b5653201c09589af248940a
- MD5 ed97831bee4eb9c5533070a5d7d83df4
- SHA1 ae1996d79d7f58060b3a3d15531d33a526df2784
- SHA512 582cb4bd5e20b62e3ecf3e7ef8543bf46f286468272a883a91063f1b8138da13125a670206aa9bab2f8ad010fbcd8029edf9fb22bad903e9fe7bc3285999b3bc
- SSDEEP 384:ZriPalGB5AWiWq2mhzJUVVqxKS3xV2CjNrBa7gHOykEajctcxPad:IUAHiWqn1UVVqx9U7gYEaIKod
- TLSH T10163FB76D8DC4D5B857123A4AAB94603FB50036F51880C07BEBDEA8CCFB781295C6F1A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json
- Size 66KB
- SHA256 ce34f474489374ca3ae63da5f21018c7971cd206ae21216123a3e3081a706ab4
- MD5 9d873e768542ada5f9586719a19ab6e2
- SHA1 064f090ca853f50cc6afe2def8f1ede26d3b1350
- SHA512 5c8016738567abf837138175bdae2b9982b37737332b750bb0188e4a1ae6c0bef282a7af11173b040eddfecf9a4741228144a96ff2891ba50bc2de7d162edb1d
- SSDEEP 384:jr1PalGB5AWiWq2mhzJUVVqxKS3xV2CjNrBa7gHOykEajctcxPad:9UAHiWqn1UVVqx9U7gYEaIKod
- TLSH T1BA63FB76D8DC4D5B857123A4AAB94603FB50036F51880C07BEBDEA8CCFB781695C6F1A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\AeConfig.json
- Size 90KB
- SHA256 c6c2def30b866e6fd4154289d9368a85c81222d4d281a73bc91309f092cf228d
- MD5 9a3be5a556c3393b1319e69f9259b400
- SHA1 251bef73b27f9e8a77983419e368ae31cd45426b
- SHA512 29641ea9006e9e2aa7cf6f009d90026cbafb9c380aa5900c5dfa17dd26ec6b0baec2d49f1901ac55b8d14872e509370479e880792a7cdcccbd39abe96b690042
- SSDEEP 384:Qr1PalGB5AWiWq2mhzJUVVqxKS3xV2CjNrBa7gHOykEajctcxPaFH9uYf4RfH:2UAHiWqn1UVVqx9U7gYEaIKo7tf4RfH
- TLSH T12D93D737D8DC4D6B953223A4A9794203FA60436F11880C43BEBDED8CDF77912958AF5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\ArwControllerConfig.json
- Size 1KB
- SHA256 ac72b63f53e2cd767dd0ec849f210164b29db3bca7794ec8f3d81b38f25641e5
- MD5 04acd5c90b69549b84723ff50af5deff
- SHA1 99e00f8579a543f5d5b2ca420a108a6c8cacfc6a
- SHA512 c44cea72843e22e746bf2b2a3e5343dd0687baae3657c2b4acfab5d18b0ae86d67fd6617094df668c1c3c2e86b638a604f1b2756a1baebe2d39f276e81e436f2
- TLSH T187212656962019FFA5FD9009E8949253CFB047A51409083BB2FCF788ED3A67263C6CD2
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\ArwControllerConfig.json
- Size 1KB
- SHA256 c6221a04717565de480203ed6e1595ff4b4a5d020dbadbf015d896b5502ca782
- MD5 8ed38de3c8140553446b4cd75f06fbcc
- SHA1 e4924ad9ed072f7515e133d09f52f4ff778462e4
- SHA512 096e9a84e35e8d2f5e21c15b90ccd3cb9a55505f6cd96e01877989715b0402c5a225aca40ae6fe78d7f2b0a306e1469eab0393248b1780e7940d48e6c4d16138
- TLSH T1B521F352862419FFA5FDD009E9949253CFB057696408083BB1FCF788ED3A672A3C68D1
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\CleanControllerConfig.json
- Size 949B
- SHA256 b5fb8bc34cebb7fb9d54d2f162ab94d879f2a89dc0b7f00538c3ebd1b60d15e8
- MD5 56b571b1fb93d06b2a74fa190e990be4
- SHA1 c82086729012874e03c4c2ada125fbb85bb68670
- SHA512 df4a3590276bcb37dd3324589d7c156c9d4e8fa14ff7eb0c1dedb5b597b189079bbe820fc8280de67be33e70d5cae2362d429752a1ce3ade04d33097d578760a
- TLSH T123115934C40264BE54B9634EC9B9E581C380930A28544C8BFBBCC98CEE73832F42BDD9
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\CloudConfig.json
- Size 1KB
- SHA256 e343a82a5f5a7789dd0e546973b312f061cecb1d813cdc115d986ada56e6a6d6
- MD5 eb0e20c525094a4dfb30b359210c12d4
- SHA1 65016f70e966038ab7ecfca6a045c138952808db
- SHA512 385b6e5a5da1a071533ba775346a193384dbea7f397d98403ba2f4d486a0bb6eb0b2c4b630d5871b2c63f22d10593f709c36b88d9355558fc584972d70056827
- TLSH T15411B21B9222BDFAE0BD265C5F6E978AC33857131885086B7270C5CCDF7AB16901760F
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json
- Size 12KB
- SHA256 2c159d6827c610e244fca73ad9d2d8d2b84ce81a36666e3ffea5a5d010708e44
- MD5 96ac74367a585fb8f3d882e21240de0a
- SHA1 164b768a55761fce8066f5ef2af24ef955daf51d
- SHA512 82cb7e30df9b0fcedd364ac026cb59b004874169ee40729347f307d6294a8d6fc3ed4565b2707d8166de783ba850e6cd63293e437e9deec1ec13fd98a298d1f6
- SSDEEP 192:0Amf/FYgVMzhrgHTb0MAJUKfVgH8BZ8ZMBPs:LmlYgVMzhrgHTb0MAJUKfVgH8BZ8ZMBE
- TLSH T1E5426422D1B5DEBB66FD617661B40B82F364C75F08410C07797CC88C4F7BD2A62C2AA9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json
- Size 12KB
- SHA256 5f416f2546dce0c979304b28b0632f14a3c861a9b882b954c708f59873d14e90
- MD5 04733aac48072607b5352bd4f74c7a7c
- SHA1 8d943ae938a52adcc31196ca6d899de5ff29b523
- SHA512 82464c3e3bb58a839c65ad05030ce4f36fb5feb791d90798f44c8a768beab8a6165546e3216ac30d3cb82262c4b69d7286957f242f46af56ad7a84848da403ae
- SSDEEP 384:emlYgVMzhrgHTb0MAJUKfVgH8BZ8ZMArE:emlYgVMzhrgHTb0MAJUKfVgH8BZ8ZMAQ
- TLSH T118426426D1B5DEBB66FD617661B40B82F364C75F08410C07797CC88C4F7BD2A62C2AA9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json
- Size 12KB
- SHA256 c380bfb70e7bf22dc561c4fbd0441c85e35bfd8adbb46e28a2599592f950ef38
- MD5 2171dab5121dc547eba89b9d96f09eb6
- SHA1 6b592dca209a42135e325e58447ceeac8a83d0db
- SHA512 f0c45896915c8072613b3cdf574f2be1f3e6f439b593c2da2e2f0e3ff18c15bfcbe21ec167691fa9f3bfeeb5a4e3f0e84b03f39acb4459883ab43c1735c4c7ae
- SSDEEP 384:3mxYgVMzhrgHTb0MAJUKfVgH8BZ8ZFD3Ky9:3mxYgVMzhrgHTb0MAJUKfVgH8BZ8ZFD3
- TLSH T15C427626D175DEBB66FC613661B40B82F364C76F08414C17797CC88C4F7BD2A62C2AA9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json
- Size 12KB
- SHA256 afb8bdb2f0e7449b11a066007c224a33590bf6c886b39ea6326e5d25d19b571c
- MD5 1c6349ee9ff181cbbb5406cbb2020999
- SHA1 dbc86f55c3ee9daf89f712fdec8d5b2347927274
- SHA512 0eac39cc2605ae002c63e5deeab59a07c8021b3b4bc724bb065dfdab09bd308d917d5f66bb82fcbc61cdceb7f6fd358616fb81f29bf815f999f983e4856eb591
- SSDEEP 384:lmXYgVMzhrgHTb0MAJUKfVgH8BZ8ZFDU6Up:lmXYgVMzhrgHTb0MAJUKfVgH8BZ8ZFDc
- TLSH T1AC428726D175DEBB66FD613661B40B82F364C76F08814C07797CC48C4F7BD2A62C26A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\MwacControllerConfig.json
- Size 2KB
- SHA256 ae48142e4cb33edaac9fea8c67bdae919dfcddac4690c10d171bc8a73de560be
- MD5 0bc658b7929c99581f5a5188f32a060e
- SHA1 2197e05c1c89757eb522c4b2a80d3c2bb7a60da1
- SHA512 33aa6554d917ac00009f84dae57051c48e411de1daf7ab0e90b6bb0a653d21c9188ecb11d20ae205ef82952a94eba5634ef8f94aacde20005c9e08e6507fd6cc
- TLSH T139511632D9986CBF19F452666C984252F641871F425808A3BABDD97C8FB7C12210AF5F
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\MwacControllerConfig.json
- Size 2KB
- SHA256 f97721ceb57905c1ad6d03b7639f07d656778af3e111821233c92f43a64f15d0
- MD5 7a7b0b9a860af82d5033a99ad12e0194
- SHA1 7e4ea7bdda9c1a895b57de5cc1ce8c9fc1664aeb
- SHA512 c8a23346f9516bcd7e4ad33dfca7359cc1d1d7f9caf161cb62d00f5b14d4ea0a7dd81626ab026669461b37c42840a3112e5004fb7ef48fad755fab5deeab0447
- TLSH T1D6514B32D9A86CBF09F85266AC684252F650871F41580CA3BABCC97C5FB6C12250AF5F
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\MwacControllerConfig.json
- Size 2KB
- SHA256 cd348ec8cfc5cad56dc271b0087c1e406798ed2d7914c62bac2e01db260d2be7
- MD5 f619eaef8b1787a855bb86ae4497d0c9
- SHA1 31a5581eeb00e165e9b25be5355ec94873565595
- SHA512 8eaaf4d994e3bce87787985f5346ee03f7288a2b1b17928a52897598d2a43125b173fa8417342ac77365712e00dc2734fc675f3ede68e6d333281dc87bc0c55b
- TLSH T10E514D32D5686CBF09F85266AC694252F650871F41580CA3BABDC57C4FF7C12250AF5F
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\PoliciesConfig.json
- Size 814B
- SHA256 2d4942e328712b17fefda07bf03948034764a31681fa8ffdcda94ff23aaa57ce
- MD5 29c5ba58e179e787563b626358860bcc
- SHA1 d1ce6be62ba40b86bf30ac58b2ed635f61004c8b
- SHA512 bc6676b6d9a6174a2be9424cfd40b1150c10d0d033641544ada8cb7ec2f06f6ce2919f95868a921cfc32251a3432a4a468b3a66054b77d3bf7a07f3aa6bc3b98
- TLSH T169014726984090FE257C81688137D8C1F361871634191C2FF7F9EA0EEDB7A3B2185D85
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\RtpConfig.json
- Size 3KB
- SHA256 527604d5e0f0b1a0aa4dcf18f6c9bfa9bf553ec3c2c27b45c1aa7a67ce6faddd
- MD5 fef396fcb3ba462445bc85ebf9aaba5d
- SHA1 7b049c51de529e033248cc52e9da1ecfe4a0c30d
- SHA512 d2c3f02132c17e4b34760d202516c98ff4db8815a829969af4ca8cb519d4af2b0d0bb45ff38f7ac84a730aac29ef0a7c08f317f2053d8e7d653ba4929f5c82da
- TLSH T10B511B219B40B87D4879C21A9C78614ADB245B65160E187B71FEC83DCDFA6737BC5CC2
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\RtpConfig.json
- Size 3KB
- SHA256 221288a7c590419ef20c8d89e94097f630d8f4b7d051366599743fa061cafa51
- MD5 30ab165a91e30ce98271fe05fca0dfba
- SHA1 6770507387bae4f9d415f16db5853efc75fd3ba6
- SHA512 e9b6cc3ea632ce2ffc925e8358b818c6224c1d6f64611d9cd1e2ed60dcbd051a73235af41960d93197846a177577d91347c19c601122cd66be53413b054bdc59
- TLSH T158512B219B40B87D4C79C21A9C78614ADB245B61160E087B71FEC43DCDBA6737BC5CC6
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json
- Size 3KB
- SHA256 ae581ab9534c8e61cfdd82b755e8d0b7612b7e4a11f0179a2a5743c7edb9c488
- MD5 4f91ec16a6232ecf8ea7d8107725f5ae
- SHA1 5810823dfb7dcac51c2332a50bc89bba003f6e84
- SHA512 70a37118d03469519c1171d0adb9e203e2a1b76dc695fc5447f86aa993ce6a302011d2b4a8de0eaabadcdc216b4db172e523e1d571ac1c509cc117e6ed415e0d
- TLSH T118618C16D61068FE08B8E25EDC248186EB2087972602187FB1FDC55C9FF76337A85EE5
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json
- Size 5KB
- SHA256 2cce9fdf392f974a0d0ff48128eb4622e05f4d401ed05218740028f95018401d
- MD5 6cbf0234196ceeb917fb44604458d9f5
- SHA1 73bbd822ba5df271656d4606496fc6c3328ccccc
- SHA512 3fdd3f89ca3587284885b5da2f9364b6900499f55f962c319ff6c101208ae1ca2ffb33cfaacd2902895ba1925726a437d6eeeee3d3599f5149fc8ebdc432d14a
- SSDEEP 48:7T5JtpmNmVSfKuGQf92Es1kV8EOmduwwIG8qXKeWQX92MEnAf3wsaA:fZyfK5k9JykfOYuIWXKBs9RsAf3wsaA
- TLSH T122C18A16D9105CFE18B8E25EDC28818AEB2083972206087FB1FD855C5FF76333686EE5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json
- Size 8KB
- SHA256 53d5624c418b975ac864c6804d6d328d52bffb59170d0f5e6af5fbce1eb67b51
- MD5 425316b5bd8b835940d6ab553f0afc26
- SHA1 06cc59cb838df5afa995e73eaa241087b8c7fda1
- SHA512 9488a89b81ae62bb91af7b5d46d7d1040943dfd2ca12cf90a00c5effcc6108cac9a501e9b8624a0357d3e52ac727049bf699974d7d48d9ed76f6524dcbf48ba4
- SSDEEP 96:2ZyfK5k9JykfOYuIWXKBs9RsaS+RSEZXKBs9RdAf3wsaA:Myi59KuIWaBoR7ZaB5gsR
- TLSH T18B027E16D9105CFE18B8D25EDC28818AEB20839722061C7F75FD859C5FB76333686EE5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json
- Size 5KB
- SHA256 4f45a8f13e6f24a6c5531f8ab821e1f613ea6cad5c3be464faac7e9e27652cfd
- MD5 792667db102732620d125b2e8e79301a
- SHA1 dea3d8d0ad5a5e6096615ab0e7440052ad0a69f6
- SHA512 475dd6ce62f4f138803262a841881ee27020676317ddd56a5feafb1686406d805507a3bb0164f459e7f0c8356e3ea4ac28a00de622b351d996d3413c23a3c387
- SSDEEP 48:44S5JtpmNmVSfKuGQf92Es1kV8EOmduwwIG8qXKeWQX92MEnAf3wsaA:IZyfK5k9JykfOYuIWXKBs9RsAf3wsaA
- TLSH T164C17C16D9505CFE18B8E25EDC28818AEB2083972206087FB5FD855C5FF76333686EE5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\SpConfigFile.json
- Size 12KB
- SHA256 c9a5a60e8d85461e29420ad10a32c4db2d012ebd865d624dab76702e2f7fff0a
- MD5 5489fbb8432911a6f1a4b4cd4c747a8e
- SHA1 df89369f17784523cb8d45eeb4d740ae011f915b
- SHA512 641dbb32804958e429eb3be1f58ce476d9de269205dd289e7f7430aee82e35f16cd44c736ef8c7cd7e5ccf717324cf180d3543588889e7f19a92339c91f73434
- SSDEEP 384:L8+xwb8fkY/sDY8t7SSdUCExUYS9oFfJ7MLPi5LnDjufzqoA+8xRj81offZJZtXJ:2XDK
- TLSH T1B852261EE0A84867887726901F7A95A2E334526BC1435C6775FCB12CCFBB483C496F9E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\SpConfigFile.json
- Size 12KB
- SHA256 296f519236edc18578d69fb58fa2737d7d3c70b5addd7777bd22661ed2ed759b
- MD5 e5a7e16a7f9ce4459c3193cec5c7802e
- SHA1 829d5b9c45a0a0150d03b48531f5540b08d7e4bc
- SHA512 a9832c91d60e8ffc5ef036f5cbfb054e2e7407d4c0de41e41f13a1fd409d5ebecfb34739cae269346476d72dcd160e4be46e1cd70f794413ec93e5182e2a9b8a
- SSDEEP 384:l8+xwb8fkY/sDY8t7SSdUCExUYS9oFfJ7MLPi5LnDjufzqoA+8xRj81offZJZtXJ:4XDK
- TLSH T12052161EE0A84867887726901F7A95A2E334526BC1435C6775FCB12CCFBB483C496F9E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json
- Size 1KB
- SHA256 3e31a5e392d717416f333f463bcd34de787ded5c2764424e73ae8bdae24bdf61
- MD5 b9ebaf6a299479c52152163afcb5170c
- SHA1 fa176ed7df166c3b0714c2d3b89b59e44dca1a4f
- SHA512 1411ed0335d5392d4f8e37579bee2137ce60704fa7b6e7242f8d727ed38cfca1148a19a4628155fc75d46e462f111d1c5a7941071fa32197ae6707cebdfb05d8
- TLSH T1EF31E0128A2841FE28FCD154D9B88B17E7A0431B21161C1FFAF8DA58DE7707227E1A88
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json
- Size 1KB
- SHA256 ca49e4276f1c30244553f3014a49ba1b9fe9065d609d0f98253a40785d32d319
- MD5 615c6e7253d6a6c8c747c507f8810bae
- SHA1 f04e125f6ab3fd378639705665a903562f9721af
- SHA512 19fb90237d2b3d00c3b9e7c6a424a32212743912a4023858c34a8298c435cacd2e05d421ad5e4d3e4601f6ba6947453c4370b6f6dc1a2b5c4c9023f391cb598a
- TLSH T1AC3138228A2845FF28FCD154C9B88717E7A0531B61161C1FFAF8DA58DE7707237E1A89
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json
- Size 1KB
- SHA256 f98cdf1addc3d190de44e5df1caabfc22b2c3e87276a6d30db70887c77e346ea
- MD5 6c02b399f97991fcd9846b467f2227b4
- SHA1 fd7d0f841c72e7eb2e965dd1b17e300f5c61bdbc
- SHA512 9c6206f340984d9a9e9cd0f7ce63fb6ba93c19c454d94359d94cf856c4c584d44b618611216d306e0115657380e1a98b33c63e51d3feee643f8da7705d202391
- TLSH T1EE3126128A2845FF28FCD148D9B88717E7A0531B61161C1FFAF8DA58DE3703237E1A99
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json
- Size 1KB
- SHA256 95e33db59eeaa3802c79ed71141f02ef7bd7b2ae70038f1f4d49f4394c5dc84b
- MD5 a76b0899dff7c0e27192f889122c1d61
- SHA1 c89d4c18fa15bd04934e33f27ae9c9a8d3a4dc6d
- SHA512 76d94af45c96e67af9bb1bc67aea5d8df515d919cdaa9b0b5a451527af310ea37c83f1ea26d93d41ba2125c06969c0de0429d31c52d608f21309e9b80622139e
- TLSH T1623124128A2845FF28FCD254D9B88716E7A0531B51161C1FBAFCDA58DF3707237E1988
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json
- Size 1KB
- SHA256 a1007cf14cd159c9db7b5e766c3e2318efc82659cc533fe9a552ae75db6dd1af
- MD5 5cadaff8d91d96f6e4d3a7caf98e6825
- SHA1 50eb63bfbb67c42ac4ce679b2d79b970742c82a6
- SHA512 a54e96ec8d9ede3d1ffe7d8cc01fa8c4f1a07bb2905dac06fbc7216f1fb7a78919663ce5c4f40599aea5e046e5d2a4326c74ceae63107b99ea9263417ba372c5
- TLSH T1173104228A2845BF28FCD194C9B84707E6A0531B11161C2FBAFCDA5CCF3703237E1A58
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json
- Size 1KB
- SHA256 ed5b370f9212e5839a17b3f67ed00aaeb8f7a6714705420267d2550063a35ecb
- MD5 0397b242bb515cd0cee4abaaf6efbb52
- SHA1 aa7628ecb4b7c600de308a81dd00093f13384a96
- SHA512 37a76e02c3fc367b7f881531f9a52b5f3dd8581d1802a393fdfb37e23b76ea0fc43875905907ce18a7d653fecc12d2c1c9fae3b5db049449cce994b769a86d43
- TLSH T1D63123128A2845FF28FCD254D9B84707E6A0531B51161C2FBAFCDA58CF7743237E6A49
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json
- Size 1KB
- SHA256 ba0e7b6364fc1345f1f8003cec807d7ca3a26389deb9b93cdae5d6aa4fae51c4
- MD5 6caffbe6e10492a13eb65a0c72ec00b0
- SHA1 af3e054eeea7036bd1b782c3bbccb63047d14e77
- SHA512 5a84e6ae92c74d2896b103b9350ba70ee208e84a64cf7ba731dbdcbeefc0bf62433be7e3f15c6772c99ca2a658aa9635741f5e1f0fc523687b7ac84300a6bbc5
- TLSH T1AE3104228A2845FF28FDD254D9B84706E6A0535B11161C1FBAFCDA58CF7747237E2A88
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json
- Size 1KB
- SHA256 c79a09965a02847788744722138fcaaae30f0769fc2a107037f648dd7e537ce2
- MD5 a2b57a745816d62bd97771d5db480e5c
- SHA1 6881c68f27b07c636b76ac0daeaf17a512d52908
- SHA512 589e97101344cb02ed34b4f957bbaa38104a6c9c8e85daad3792edcace89c0c05ea1b9b4393105aa7df79a563f06782868aa51bd79d1558cd2c667a506fe7a77
- TLSH T17A312522892998BF1175978D99B48002E760838E6660596FB3FCD848DDB3D3524C7A4D
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json
- Size 1KB
- SHA256 7061e7841b1e7cf9f4a944af59aa0644805e6229c9857bb9de59b754c0ab2844
- MD5 cef6bd558a1c231a79b0821c1ee239d9
- SHA1 0b7920ff16ed935c98463e4d630aaadc4df9d17d
- SHA512 b711a2517132af171700c7acf4e1e3976579acba4068c3c747c6729583810af691e946f7f62d16a9ed65ae6bac4e12126471dee182fa8d2ffb1950084634fabf
- TLSH T1A1312522892998BF1175978D99B48002E760838E6660596FB3FCD848DDB3D7524C7A4D
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json
- Size 1KB
- SHA256 faa630363921ab01a26ca3689500315d3bbbf0c5be2d5e20cd36988ec4973f10
- MD5 132b63d83715fecab1d78b30e876c9fb
- SHA1 0893020d99da9d48d69784010d13277987c18e3f
- SHA512 788c9bfd3c23f6b5216d982bbb6b03a8e821ece7e79f38efda8f808bc6b81523ed7208166f7c4dff59c9984cc60e7c1f6e66f6978957568daf00caf444a6d265
- TLSH T1CB318A228939D8BF21B9975DD8B48002E760839F66B04D6FB3FCE848DD739346587A4D
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json
- Size 1KB
- SHA256 de307602f166827f33ab78ce19910a248ef84ed3373e209a1b8f32aff6af9619
- MD5 1b9d35eaa6d474a1d04df44f1186c78a
- SHA1 9b7cbb5a585c5010a9dc8ada8644d175209583e1
- SHA512 2dd22513f7e6bb4fa00fc3daeeed480dd2c7b3b9a8fb5a3d945dde0de9b88d062d98d26d9c7f17861680a7ba880765792fa37482d370bc1eccb5eb2a9eac2095
- TLSH T134319B228939C8BF21B5979DD8B48001E760839F62B08D2FB3FDD848DD739346487A4D
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json
- Size 1KB
- SHA256 91597cbd0f0aec07549fbe3b7c7031a0e9a5295f86193232d75cc3639e66a13b
- MD5 040ccf43a7cfbd7ffc141834e0951339
- SHA1 3c0d34f66b254682c2cf54663f76dbec811e9c0d
- SHA512 6322e123c5ac50b5e96588556cb935e07c225de49f154acbafcec8ab3de12e3f377449faad88bb2f15232493152daad0017281e5b8f423087d142825742168e1
- TLSH T164318B22852CC8BF12B5979DD8B48102D760839F61704D2FB3FCD848DD739342587A4D
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\VPNControllerConfig.json
- Size 1KB
- SHA256 89199443847420a351f1c750fa17f93ce55e11ea96742039b3a0dd4911a2c3ea
- MD5 7d366bba8ed8444cac2a21b26a294650
- SHA1 94e551a1a4f91948a7c278d7a49a2417e7d62ac1
- SHA512 0e18f775eb1276c64af5a4079b2ce6a1fcc44d41b17108ce03728099919902432fdc0ed6a293a3abe1c6a8e389eb2e671e316361b0099b9b27f0e8da194e4d6b
- TLSH T1A5216B62B09010F9697D9A9B6C7D8240F270530F15DA8B42BFFCE114CDB7594A160F9A
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\VPNControllerConfig.json
- Size 1KB
- SHA256 9cba8a32bdf11b0e15abcf1ac6e160ebe322cc09d2a5b4bfd666ab4afa8d19cb
- MD5 bd75406ffbfa4bb1a0ef518ff53ca794
- SHA1 9dc0e8718c863d81a93ef550449ea8ab982bc465
- SHA512 719b0d1586c3483ddbe97254b2600086081697ea13e2dc5c582e8b98c33aac1786fafbc49e69a02836df0a11291b10b09461877e6d39f9113cde52a275c81b9f
- TLSH T199217F72B19010F56A7D9A9B6C7C8205F670534F15DE8B82FFBCE010CDB7694A161F89
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\config\VPNServerListConfig.json
- Size 125B
- SHA256 3d08d70b0feda92e53e24e0023688caaca38e3b6c18b111426298ea6cdad48f7
- MD5 c16fcb4487300832fd367a549c4e6405
- SHA1 1be745292fb2296d7ccdfd1a70acbd33317f60aa
- SHA512 a736080da01b34bf18253b4f68781a04498c5a7f90d767a218a762456c53e85bf6b82fff0b81556d7c6ba67cdcea6183eea49ce21baa4a8effbd4f9885fad83b
- TLSH T135B02B04001307F01036038945C0014CC6C0278124494009F12EB0C58AD2A610041F38
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Malwarebytes\MBAMService\rmode\mbrescue.exe
- Size 7.7MB
- SHA256 477919ecb586d6ef4a06793417c2ae3126c51a51cf9445d901e90e3627e7143b
- MD5 ce8ca947e3162da157d1878d4cfec382
- SHA1 6f574aa206ba5e9d7469450780c4238cdd5112e8
- SHA512 4233bbde636d039ea3295e3b2066f56ea5a23e0431a5e675c967c60bbfa4f518f01eb90ac271da56a192671b925b3e14d3a25f1da4a8412983b4973565dff299
- SSDEEP 98304:akpowZa6gr/YzKrEAi9bESWCt+z3zweCeT007kxK:aFwZa62YW4AQbLWCtej1C9076K
- TLSH T1D586AE57A3E800E8D8B6D13CCA978503EBB2B85147719BDF06A4566A1F73AE05F3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
- Size 1.1MB
- SHA256 57033093e33793d755726a02fdc2a589e0a842faeabf96fca0c30aa3b4c97ded
- MD5 de6296652ae37efe3bea1c7849d173b1
- SHA1 bf1699dfaa79fc78bb68d3bf75d4e113a47d63dd
- SHA512 a34b3ff594e346701ef3d05c494f88e24107efe48d53657a9fdaaa62f085a12bfba88ecc2cf50046c64def65290123626ec867c04de8d1f6efd51f408e3d6029
- SSDEEP 12288:SbllnXDU3f3SokkL8W0AEG43TtMjGwWlBI:SblJTUPNbER3TCqwWI
- TLSH T18D353941B626DB4FC6A940325E33D5CCAB707D01EE04AB0372C9873FD576659BAF2292
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
- Size 422KB
- SHA256 b44e6b0b816177387c7d6fb8da0429515d6ab935a401b9f2eed1888cc3d2b674
- MD5 9b61730172911e6f700b9cd20544ceed
- SHA1 8396480f24e9fa7b712c300ea1e34b353a1926ca
- SHA512 42b2c58c7f45b522c31b6128299aae1b2669729bb705637359b2436a24377aefc8e8abad38b68f5b43058e0796f679b357d8ef9a70b6035cc26d3075e6caec8d
- SSDEEP 1536:aNLUNOc+4yNYZ+/OAZ87GLZSPDZ0CIo1KrC85ZnFfo:m0O1ro
- TLSH T1A294C500B7B2D39FCFF5C07F507262EE973874515E41AF083B458AB494F606AA6E6782
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.2MB
- SHA256 bbc0ddd541ab13b9def17543ab5b2d9ece7e386578ca4a47943973d466b45ba5
- MD5 1d6796651756140664b16370896824b3
- SHA1 8a396fa7232e8e11ce93a0cf3d5ffd3a6aa4ef0a
- SHA512 6f07b5fc27307a2ca4ddb3df206eb9cd09f08450996eee32b5a4cf869f38d7b8afce0d47eab63352992ab12c5a7247866445f1af38b962b862bf2daf5771d7af
- SSDEEP 12288:0F7riJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:I//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
- TLSH T109552393468C59B1FAFD1039857A8434B5497E2C9F1594E3E2043A5EA238FDBCF38527
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 fd017d6769153ca84f101049f849cb970fae55a1174b130d501744caca22820c
- MD5 7bf919cd3377f0eb58130e34dc39d6df
- SHA1 fd9b097470e4ee241fac332be472b049eee72701
- SHA512 581e3e1e8b232cb88feb9aaef6ae8707269358c5b57d70e31cdf03d234ef2e9ddd6e44179d32ab3cc533561abef99d026f2a78e1a18c67860b638431320b625a
- SSDEEP 24576:3gb6bmBIi49WNNFpg1rSvFv7bYN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:3gb4mBIBhGFKLNiXicJFFRGNzj3
- TLSH T16965AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\CatRoot2\dberr.txt
- Size 70KB
- SHA256 5a3634a0082f90efabe57649b935ab553d7f4a3312cfa2ec52db3367d7b9aa02
- MD5 5ca68129eef27dd3b83949a1114bc266
- SHA1 5ad8f340a18ac8e4aa3bfc56724140d587b1bb47
- SHA512 23b52f40a9c5626c7b23b86e6a7720873a7b41f6784f709e0198d5257869a0c2f24b1f0de1199b45b9fb8f891c7bca3b452e82378128c92d2290800c13cde287
- SSDEEP 1536:w+LXfs2qU5BAzt32+yje8CtzAv4Atn/1AhqDU/AhqQvOPcdBT9s0kxBOoRmjhias:vlNs
- TLSH T1FA635C0580DCC509D9B609A27267FEB2C57E659A731F4EEB30ED6304D9C2F042FBA469
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\CatRoot2\dberr.txt
- Size 70KB
- SHA256 247fe1b8ec290dbc58410cbe0b52be1af8dd74f03b427432894e0efb9d7786f4
- MD5 1563cf23a0483f1aa3757869f7c70b51
- SHA1 a085a6e654c4699417fe56c94da7146f4fe9e7f4
- SHA512 5477a0f63f01bc8063ad8504898da054897a6ecef4d8521a8da5600284de733510989e79e2b67ccef7334b7ee85574563b591b5287eaac8fb1f9054a91dc55e0
- SSDEEP 1536:w+LXfs2qU5BAzt32+yje8CtzAv4Atn/1AhqDU/AhqQvOPcdBT9s0kxBOoRmjhiai:vlNi
- TLSH T162635C0580DCC509D9B609A27267FDB2C57E659A731F4EEB30ED6304D9C2F042FBA469
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DriverStore\FileRepository\mbtun.inf_amd64_add82795013a7c3b.ini
- Size 409B
- SHA256 6064b86819b739a261dc5f1f5197b5bcc778797b1a95e59a1584a07e5787a507
- MD5 19328c7383f8fb4401ceaf18f0ec3ada
- SHA1 70809287a27a2742f1535062da16d0a39e8d4d39
- SHA512 33dc6c302c996e72b7ab226017c05986ce7675221b962f4f20d4841001571ac1ffd70dfe2d180a2f01c4951874e75336e5239ebfac76538165e6afd78564d9a6
- TLSH T1C4E0E5D9138BD5DE408283EB510E3CE48274A0ED0532A0ADB210C7C4BE1BF88AFC29B1
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.8MB
- SHA256 606c2a1b4d9df8970dc119503d48963f95ceb7032bb10c11a3b6a4097d102d8d
- MD5 c7377ea55e2f31c948b5b5175d7be896
- SHA1 01bac22272423606098cd20a449908c3c2ba95f8
- SHA512 0ad27acbd726c5d096694b3e1b015096efac091edc78d17f5d28edc2f1e0f6f774a20910ddc354e01e920655c890727a92b8cc42628520e10c6a037cc3977994
- SSDEEP 24576:JG88u8FpJqH1vzria7/ma/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:c7ZFPqVya7/1LNiXicJFFRGNzj3
- TLSH T13E85F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.6MB
- SHA256 cc56c387a8b20e4facfb97d3af5fb8e9ba1e03c7b2d909c597862b3f6b4179b0
- MD5 d1004d93de8cacb41a031d17e75570f6
- SHA1 c36c397eb5c0d136d8dda0db5326e7c1689cd92c
- SHA512 c0b0a674384192aaf486c9a6a083d4210160958485970391fbf6703561bf07b8c506694aa265403baf7bccf18fac0f1ce2503e21dbc7a78b7cfb6ffd1d72b94d
- SSDEEP 49152:8BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjOLNiXicJFFRGNzj3:fG05lO43b77wRGpj3
- TLSH T1F8D5C06A62EC11F5D1BBD07CDAC6460BEBB23815033556CF02A486A91F27FF49A7E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 f1d209885e3e3915da57bee7dac6a116cd1889aaefda59b73d6eba06b61719e5
- MD5 8b2c8e1ad140f79f6fd32de1f28a7fd4
- SHA1 6c49ea74e43c6b6ce49377652cfbb29f249eaafb
- SHA512 fd83db57d74dbc42a085b22d50541ad67c2b5046a658841ab15d6e5dbe41594a4c89de58ef7e66ec402da0a6a570ed1650cf1b3eec68bc5a883ae75c85b76cff
- SSDEEP 24576:Yfa5POZ3dpyWVM50JicR2hG0lasx2+47eidn0/TwSfVcYG3K/cJHlnFR+IGNe8jg:ga5POZ3lJt2pasx2+mGLNiXicJFFRGNf
- TLSH T1A965BF5EA2FC01D5E5B9D17DC583461AF5B1342553329BCB022182BE3F27EE89E39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 d00b7f1576c92b31c070ef286614f151026a432fd493422733344bfc44adafcd
- MD5 3186abad5da9f3175334e58e2b580b33
- SHA1 3617d715a23fec3e6dd4d4f1c13b4cc714b61553
- SHA512 0e0994d32cfdbb5cec71d0abde438cb4aba2a3ec1dc8b593d640c700a147f7280ef89c0572bca3b307c4339a9ada2b831f97977c7973bbde49a458a3c8c5ec6e
- SSDEEP 24576:mNcwHdjbyQ4nLC18lb/EOjowL7FkS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:mNc/zEOVHFVLNiXicJFFRGNzj3
- TLSH T1AC858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\catroot2\dberr.txt
- Size 71KB
- SHA256 6efe6add2003bdcae4cd4056a4bb97b15b0f5c271e94c859e5910613c7cc45b0
- MD5 61ca4eb93a23cf2f5b06a05eeaafd265
- SHA1 bfa3c01c4a2003d383731a8005c5a6febf767295
- SHA512 74ffb046cbca838310b4fac8796f4b532106bc496ef74057dfebfc3e7b940affb0583f0f1e288c6337bf4dd087d3581235e90dec98091b2974a2380bdbd17bdf
- SSDEEP 1536:w+LXfs2qU5BAzt32+yje8CtzAv4Atn/1AhqDU/AhqQvOPcdBT9s0kxBOoRmjhia7:vlN7
- TLSH T189635C0580DCC509D9B609A27267FDB2C57E659A731F4EEB30ED6304D9C2F042FBA46A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\drivers\MbamChameleon.sys
- Size 230KB
- SHA256 a2f19edac47313a8d282ec88ff6da531d49ada37829328278be4b8d395819f0f
- MD5 7e71850b3c629e6753c1ae3c44353d01
- SHA1 43ebff27352b1e2aba7a892cae8cb3e9d60242af
- SHA512 a5de9eac12d2ea3af7936ecdf268b7786dd467cd62050a341afea67c30343dfef05c5eba9325dc5803f61ac0ec3f95ce029bf1c0298fb78a70f173ffa502597f
- SSDEEP 3072:f/Oxj1rrPoZW1sldvOyp509rYfDPmLbZSZhW8PY9PRVNSXwKX9WVUgl00ZoYAYey:W6vOyp5uZSZhPAvVIXwm9W166oIqIj9
- TLSH T1BD347E5AD2D41DA6F9B6C2BA8ED69542E77334091B21DACF0370842A1F67BB0F53530A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\drivers\MbamElam.sys
- Size 21KB
- SHA256 ded569e249e590314d095f740c6b8934a5a797e4f3edbe0f78eac9d333f12a2a
- MD5 8da81aa1f6b89ce1d2e216e3ea351c59
- SHA1 4baf79cbade9a5584630a540e6368d547579fb12
- SHA512 6d611bbd9d480ef2defd745fd06c4ab86e181267cf689d9d0e124edbaf22fd30fbe2310879cc7bb6dde5bae72c4feea1d329cdecfbf101d95634f85dd0769119
- SSDEEP 192:C7IlO/ZnEc+PbYv6/i0RtPH920QvVUKjnegqdsW++w/y1wVWQ4uW/+O68RwX01kd:wIlO/i8ChLIxUKjnev6+Twc69R9zING
- TLSH T108A23B6549780283F6BBC570C7E4C927BD38F39677408AEB0591E5681DA37C2AB3192D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\drivers\mbamswissarmy.sys
- Size 240KB
- SHA256 1da576165e8736412c0961b0d66d17d37218f5ef1f972acba91c208f59718536
- MD5 fae4b757caf4dd3f163f689963bae227
- SHA1 380d5dccde375bcf9ce6c7bf850cf05ff23a110a
- SHA512 babf4e01d6f38a2f91a571ac874fb986fd1bf69ea3164e8330eff5c8eeaa501698149b62842c4a25283359b09413d4e49b2deb9c88a54c7b7fd2d1d43504021b
- SSDEEP 3072:sn4o+ABSwoiM1DL5ZqVlCqpK65lJdEAQdSHBZeKsdVC140UMnX2PaUWzSLlFXVy:sn43/rRLGVl3NdhQSBZeNRXM3JylFE
- TLSH T117347C06E3E479A6F9B7817989A29102E77171492B31CECF5374C42A2F1B7E0F93534A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\mb_49AD.tmp
- Size 107KB
- SHA256 ad820dd54edb13e255d34eafacd71f278d6514e2f7e4c2970401f922a774ceb0
- MD5 2df8ff40bec48460845f851a54b76fe8
- SHA1 8e19f3d76c87d590cf1af839ddbe98af381d44e7
- SHA512 2177f5dfd6901f09ae2b8a0d6bea7b5fac3d00a721aa297ca6c35666cf2549d6c8d8655063a332224ccc8e0f00bdc84334636e9f1527862c850cc4ceb96d7d61
- SSDEEP 3072:dAZdoamZdgBjLpSXussssvYssssnC1c9RvZfy74hfp:dW542pSessssgssss7Nea
- TLSH T1B6B3F1F78379B8D9C513DA3B93874B110B28426B2C8A7E45A84DDB158D7E66181C3F8F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 c4379cbade0a65c5d4c2ac8da81c1edf0f3de71146201ae3a975000e648dc1a6
- MD5 09a8e2865bb663e48a20c8bf5b753daa
- SHA1 90c5c8be4b9ca3f966e5ed7c23353a073059d36d
- SHA512 11336b0afecf156039dd0493ddee06d219e57bfe921017081a64206427e46f726b31a0fc3b079e0f2cc4d7710774c06d8df941633cab72528742ccbfd3c892a7
- SSDEEP 24576:lzkNvNnaFeYhJNtmZBmA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:lzMwBtOmALNiXicJFFRGNzj3
- TLSH T19255AF6EB6E806E4D1FEC675CD238512E6727861073293CB9290C13F4E679D89E39F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.5MB
- SHA256 e8584441603943548f91fb630ad115695019af731367ca008f0678e81e5127b0
- MD5 844aa59512a2bccba3505df0ea0076cd
- SHA1 f967d9814b247f54e26f63d189e994e16a757354
- SHA512 25636b197358659a28a7c22a4afed1b87c2faeccea900f6189aa4d1833f8c7b29440673e38ea016c0990dd8cb2ff548458fbee92e1517af03d46faf9aa3b6ab6
- SSDEEP 24576:OPUr+NQ+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:OJQ+LNiXicJFFRGNzj3
- TLSH T19D65F16F22DC18E5E67AA13D85828619F7717866071292CF02D0917E4F37EE8BD3DB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\Sgrm\SgrmBroker.exe
- Size 1.6MB
- SHA256 8311e518c0e08cdbf998a711324ec856074189f7ba90b7e1a27e9f8bf07675db
- MD5 f193473304a24c6419ce4a252b4801e1
- SHA1 7d2af2dfede5f86ad11ae1f20892c29bbf17f142
- SHA512 55577b50f742db3a976cc4c28a51bc22a31a12b37603323048752839a6117f3e31081e0f746aad8f93f5af70f1be4f2000916b9c7d277106a54ce9abaa64ea54
- SSDEEP 24576:QD3FHshBIYQgAr/TwSfVcYG3K/cJHlnFR+IGNe8j3Izz:QDVHeBIAArLNiXicJFFRGNzj3
- TLSH T1A275E17EE69C04E4E57AC17CCA638906E77138AD032265DB029491BA5F2BFE46D3DF10
- MD5 SHA1 SHA512 SSDEEP TLSH